diff --git a/accessible/base/nsCoreUtils.cpp b/accessible/base/nsCoreUtils.cpp
index 0bd318e7ee..7bd4c1eca4 100644
--- a/accessible/base/nsCoreUtils.cpp
+++ b/accessible/base/nsCoreUtils.cpp
@@ -150,7 +150,7 @@ nsCoreUtils::DispatchTouchEvent(EventMessage aMessage, int32_t aX, int32_t aY,
 
   // XXX: Touch has an identifier of -1 to hint that it is synthesized.
   RefPtr<dom::Touch> t = new dom::Touch(-1, LayoutDeviceIntPoint(aX, aY),
-                                          nsIntPoint(1, 1), 0.0f, 1.0f);
+                                        LayoutDeviceIntPoint(1, 1), 0.0f, 1.0f);
   t->SetTarget(aContent);
   event.touches.AppendElement(t);
   nsEventStatus status = nsEventStatus_eIgnore;
diff --git a/b2g/app/b2g.js b/b2g/app/b2g.js
index c255f60614..0d39655820 100644
--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@@ -1081,8 +1081,9 @@ pref("gfx.vsync.refreshdriver", true);
 pref("dom.activities.developer_mode_only", "import-app");
 
 // mulet apparently loads firefox.js as well as b2g.js, so we have to explicitly
-// disable serviceworkers here to get them disabled in mulet.
+// disable serviceworkers and push here to get them disabled in mulet.
 pref("dom.serviceWorkers.enabled", false);
+pref("dom.push.enabled", false);
 
 // Retain at most 10 processes' layers buffers
 pref("layers.compositor-lru-size", 10);
diff --git a/b2g/app/moz.build b/b2g/app/moz.build
index 44de14ba4f..1330a6bd13 100644
--- a/b2g/app/moz.build
+++ b/b2g/app/moz.build
@@ -28,11 +28,8 @@ USE_LIBS += [
 for var in ('MOZ_APP_NAME', 'MOZ_APP_VERSION', 'MOZ_UPDATER'):
     DEFINES[var] = CONFIG[var]
 
-GENERATED_INCLUDES += [
-    '/build',
-]
-
 LOCAL_INCLUDES += [
+    '!/build',
     '/toolkit/xre',
     '/xpcom/base',
     '/xpcom/build',
diff --git a/b2g/app/nsBrowserApp.cpp b/b2g/app/nsBrowserApp.cpp
index b7fcea85f5..e7fcc431a5 100644
--- a/b2g/app/nsBrowserApp.cpp
+++ b/b2g/app/nsBrowserApp.cpp
@@ -34,7 +34,7 @@
 #endif
 
 #ifdef MOZ_WIDGET_GONK
-#include "GonkDisplay.h"
+#include "BootAnimation.h"
 #endif
 
 #include "BinaryPath.h"
@@ -148,8 +148,8 @@ static int do_main(int argc, char* argv[])
   }
 
 #ifdef MOZ_WIDGET_GONK
-  /* Called to start the boot animation */
-  (void) mozilla::GetGonkDisplay();
+  /* Start boot animation */
+  mozilla::StartBootAnimation();
 #endif
 
   if (appini) {
diff --git a/browser/app/moz.build b/browser/app/moz.build
index 0a691bdb2a..d6d5e837c4 100644
--- a/browser/app/moz.build
+++ b/browser/app/moz.build
@@ -6,7 +6,6 @@
 
 DIRS += ['profile/extensions']
 
-
 if CONFIG['OS_ARCH'] == 'WINNT' and CONFIG['MOZ_ASAN']:
     GeckoProgram(CONFIG['MOZ_APP_NAME'])
 else:
@@ -27,11 +26,8 @@ DEFINES['APP_VERSION'] = CONFIG['MOZ_APP_VERSION']
 
 DEFINES['XPCOM_GLUE'] = True
 
-GENERATED_INCLUDES += [
-    '/build',
-]
-
 LOCAL_INCLUDES += [
+    '!/build',
     '/toolkit/xre',
     '/xpcom/base',
     '/xpcom/build',
diff --git a/browser/app/profile/palemoon.js b/browser/app/profile/palemoon.js
index 019f884e22..46f1c28d38 100644
--- a/browser/app/profile/palemoon.js
+++ b/browser/app/profile/palemoon.js
@@ -919,8 +919,13 @@ pref("dom.ipc.plugins.enabled.x86_64", true);
 pref("dom.ipc.plugins.enabled", true);
 #endif
 
-// If decoding-via-gmp is turned on for <video>, default to using
-// Adobe's GMP for decoding.
+// Decode using Gecko Media Plugins in <video>, if a system decoder is not
+// availble and the preferred GMP is available.
+pref("media.gmp.decoder.enabled", true);
+
+// If decoding-via-GMP is turned on for <video>, use Adobe's GMP for decoding,
+// if it's available. Note: We won't fallback to another GMP if Adobe's is not
+// installed.
 pref("media.gmp.decoder.aac", 2);
 pref("media.gmp.decoder.h264", 2);
 
@@ -1261,11 +1266,12 @@ pref("browser.display.standalone_images.background_color", "#2E3B41");
 
 pref("view_source.tab", false);
 
-// Enable Service Workers for desktop on non-release builds
-#ifndef RELEASE_BUILD
+// Enable ServiceWorkers for Push API consumers.
+// Interception is still disabled.
 pref("dom.serviceWorkers.enabled", true);
-pref("dom.serviceWorkers.interception.enabled", true);
-#endif
+
+// Enable Push API.
+pref("dom.push.enabled", true);
 
 // ****************** domain-specific UAs ******************
 
diff --git a/browser/branding/shared/pref/preferences.inc b/browser/branding/shared/pref/preferences.inc
index cb8fea1f7c..27c93946dc 100644
--- a/browser/branding/shared/pref/preferences.inc
+++ b/browser/branding/shared/pref/preferences.inc
@@ -91,7 +91,6 @@ pref("dom.max_script_run_time", 20); //Should be plenty for a page script to do
 
 // ===| Canvas |===============================================================
 
-pref("canvas.poisondata", true);  //Enable canvas anti-fingerprinting by default for extra security
 
 // ===| Plugins |==============================================================
 
diff --git a/browser/components/preferences/content.js b/browser/components/preferences/content.js
index 0775c6270b..94932d019d 100644
--- a/browser/components/preferences/content.js
+++ b/browser/components/preferences/content.js
@@ -13,8 +13,7 @@ var gContentPane = {
     this._rebuildFonts();
     var menulist = document.getElementById("defaultFont");
     if (menulist.selectedIndex == -1) {
-      menulist.insertItemAt(0, "", "", "");
-      menulist.selectedIndex = 0;
+      menulist.value = FontBuilder.readFontSelection(menulist);
     }
   },
 
diff --git a/browser/components/preferences/fonts.js b/browser/components/preferences/fonts.js
index e9f93a2d15..431678d98e 100644
--- a/browser/components/preferences/fonts.js
+++ b/browser/components/preferences/fonts.js
@@ -63,41 +63,6 @@ var gFontsDialog = {
     return undefined;
   },
   
-  readFontSelection: function (aElement)
-  {
-    // Determine the appropriate value to select, for the following cases:
-    // - there is no setting 
-    // - the font selected by the user is no longer present (e.g. deleted from
-    //   fonts folder)
-    var preference = document.getElementById(aElement.getAttribute("preference"));
-    if (preference.value) {
-      var fontItems = aElement.getElementsByAttribute("value", preference.value);
-    
-      // There is a setting that actually is in the list. Respect it.
-      if (fontItems.length > 0)
-        return undefined;
-    }
-    
-    var defaultValue = aElement.firstChild.firstChild.getAttribute("value");
-    var languagePref = document.getElementById("font.language.group");
-    preference = document.getElementById("font.name-list." + aElement.id + "." + languagePref.value);
-    if (!preference || !preference.hasUserValue)
-      return defaultValue;
-    
-    var fontNames = preference.value.split(",");
-    var stripWhitespace = /^\s*(.*)\s*$/;
-    
-    for (var i = 0; i < fontNames.length; ++i) {
-      var fontName = fontNames[i].replace(stripWhitespace, "$1");
-      fontItems = aElement.getElementsByAttribute("value", fontName);
-      if (fontItems.length)
-        break;
-    }
-    if (fontItems.length)
-      return fontItems[0].getAttribute("value");
-    return defaultValue;
-  },
-  
   readUseDocumentFonts: function ()
   {
     var preference = document.getElementById("browser.display.use_document_fonts");
diff --git a/browser/components/preferences/fonts.xul b/browser/components/preferences/fonts.xul
index 97c68695e3..4e66831020 100644
--- a/browser/components/preferences/fonts.xul
+++ b/browser/components/preferences/fonts.xul
@@ -107,7 +107,7 @@
                      accesskey="&sizeProportional.accesskey;"
                      control="sizeVar"/>
             </hbox>  
-            <menulist id="sizeVar">
+            <menulist id="sizeVar" delayprefsave="true">
               <menupopup>
                 <menuitem value="9" label="9"/>
                 <menuitem value="10" label="10"/>
@@ -141,30 +141,30 @@
             <hbox align="center" pack="end">
               <label accesskey="&serif.accesskey;" control="serif">&serif.label;</label>
             </hbox>
-            <menulist id="serif" flex="1" style="width: 0px;"
-                      onsyncfrompreference="return gFontsDialog.readFontSelection(document.getElementById('serif'));"/>
+            <menulist id="serif" flex="1" style="width: 0px;" delayprefsave="true"
+                      onsyncfrompreference="return FontBuilder.readFontSelection(this);"/>
             <spacer/>
           </row>
           <row align="center">
             <hbox align="center" pack="end">
               <label accesskey="&sans-serif.accesskey;" control="sans-serif">&sans-serif.label;</label>
             </hbox>
-            <menulist id="sans-serif" flex="1" style="width: 0px;"
-                      onsyncfrompreference="return gFontsDialog.readFontSelection(document.getElementById('sans-serif'));"/>
+            <menulist id="sans-serif" flex="1" style="width: 0px;" delayprefsave="true"
+                      onsyncfrompreference="return FontBuilder.readFontSelection(this);"/>
             <spacer/>
           </row>
           <row align="center">
             <hbox align="center" pack="end">
               <label accesskey="&monospace.accesskey;" control="monospace">&monospace.label;</label>
             </hbox>
-            <menulist id="monospace" flex="1" style="width: 0px;" crop="right"
-                      onsyncfrompreference="return gFontsDialog.readFontSelection(document.getElementById('monospace'));"/>
+            <menulist id="monospace" flex="1" style="width: 0px;" crop="right" delayprefsave="true"
+                      onsyncfrompreference="return FontBuilder.readFontSelection(this);"/>
             <hbox align="center" pack="end">
               <label value="&size.label;"
                      accesskey="&sizeMonospace.accesskey;"
                      control="sizeMono"/>
             </hbox>  
-            <menulist id="sizeMono">
+            <menulist id="sizeMono" delayprefsave="true">
               <menupopup>
                 <menuitem value="9" label="9"/>
                 <menuitem value="10" label="10"/>
diff --git a/browser/themes/linux/browser.css b/browser/themes/linux/browser.css
index 6171240402..e2e3b52a23 100644
--- a/browser/themes/linux/browser.css
+++ b/browser/themes/linux/browser.css
@@ -937,6 +937,9 @@ toolbar[iconsize="small"] #webrtc-status-button {
 .urlbar-icon {
   cursor: pointer;
   padding: 0 3px;
+  /* 16x16 icon with border-box sizing */
+  width: 22px;
+  height: 16px;
 }
 
 #urlbar-search-splitter {
diff --git a/browser/themes/osx/browser.css b/browser/themes/osx/browser.css
index 9836d9daa5..5ae75a89c9 100644
--- a/browser/themes/osx/browser.css
+++ b/browser/themes/osx/browser.css
@@ -912,7 +912,10 @@ html|*.urlbar-input:-moz-lwtheme::-moz-placeholder,
 }
 
 .urlbar-icon {
-    padding: 0 3px;
+  padding: 0 3px;
+  /* 16x16 icon with border-box sizing */
+  width: 22px;
+  height: 16px;
 }
 
 .searchbar-engine-button,
@@ -1276,8 +1279,8 @@ richlistitem[type~="action"][actiontype="switchtab"][selected="true"] > .ac-url-
 /* popup blocker button */
 
 #page-report-button {
-    list-style-image: url("chrome://browser/skin/urlbar-popup-blocked.png");
-    -moz-image-region: rect(0, 16px, 16px, 0);
+  list-style-image: url("chrome://browser/skin/urlbar-popup-blocked.png");
+  -moz-image-region: rect(0, 16px, 16px, 0);
 }
 
 #page-report-button:hover {
diff --git a/browser/themes/windows/browser.css b/browser/themes/windows/browser.css
index 90f1cb0b7d..0b17b121ea 100644
--- a/browser/themes/windows/browser.css
+++ b/browser/themes/windows/browser.css
@@ -1340,6 +1340,9 @@ html|*.urlbar-input:-moz-lwtheme::-moz-placeholder,
 
 .urlbar-icon {
   padding: 0 3px;
+  /* 16x16 icon with border-box sizing */
+  width: 22px;
+  height: 16px;
 }
 
 .searchbar-engine-button,
diff --git a/build/docs/jar-manifests.rst b/build/docs/jar-manifests.rst
index a8064f16a0..8d4f97375f 100644
--- a/build/docs/jar-manifests.rst
+++ b/build/docs/jar-manifests.rst
@@ -31,6 +31,13 @@ To ship chrome files in a JAR, an indented line indicates a file to be packaged:
    <jarfile>.jar:
      path/in/jar/file_name.xul     (source/tree/location/file_name.xul)
 
+If the JAR manifest and packaged file live in the same directory, the path and
+parenthesis can be omitted. In other words, the following two lines are
+equivalent::
+
+   path/in/jar/same_place.xhtml     (same_place.xhtml)
+   path/in/jar/same_place.xhtml
+
 The source tree location may also be an *absolute* path (taken from the
 top of the source tree::
 
diff --git a/build/win32/mozconfig.vs2013-win64 b/build/win32/mozconfig.vs2013-win64
index 86a846cf67..85821f0720 100644
--- a/build/win32/mozconfig.vs2013-win64
+++ b/build/win32/mozconfig.vs2013-win64
@@ -2,7 +2,7 @@ _VSPATH="/c/tools/vs2013"
 export WIN32_REDIST_DIR=${_VSPATH}/VC/redist/x86/Microsoft.VC120.CRT
 
 ## includes: win8.1 sdk includes, msvc std library, directx sdk for d3d9 ##
-export INCLUDE=/c/Program\ Files\ \(x86\)/Windows\ Kits/8.1/include/shared:/c/Program\ Files\ \(x86\)/Windows\ Kits/8.1/include/um:${_VSPATH}/vc/include:${_VSPATH}/vc/atlmfc/include:/c/tools/sdks/dx10/include
+export INCLUDE=/c/Program\ Files\ \(x86\)/Windows\ Kits/8.1/include/shared:/c/Program\ Files\ \(x86\)/Windows\ Kits/8.1/include/um:/c/Program\ Files\ \(x86\)/Windows\ Kits/8.1/include/winrt:${_VSPATH}/vc/include:${_VSPATH}/vc/atlmfc/include:/c/tools/sdks/dx10/include
 
 ## libs: win8.1 sdk x86 (32-bit) libs, msvc (32-bit) std library, msvc atl libs, directx sdk (32-bit) for d3d9  ##
 export LIBPATH=/c/Program\ Files\ \(x86\)/Windows\ Kits/8.1/Lib/winv6.3/um/x86:${_VSPATH}/vc/lib:${_VSPATH}/vc/atlmfc/lib:/c/tools/sdks/dx10/lib
diff --git a/build/win64/mozconfig.vs2013 b/build/win64/mozconfig.vs2013
index 776c9183e5..5fbde2df73 100644
--- a/build/win64/mozconfig.vs2013
+++ b/build/win64/mozconfig.vs2013
@@ -2,7 +2,7 @@ _VSPATH="/c/tools/vs2013"
 export WIN32_REDIST_DIR=${_VSPATH}/VC/redist/x64/Microsoft.VC120.CRT
 
 ## includes: win8.1 sdk includes, msvc std library, directx sdk for d3d9 ##
-export INCLUDE=/c/Program\ Files\ \(x86\)/Windows\ Kits/8.1/include/shared:/c/Program\ Files\ \(x86\)/Windows\ Kits/8.1/include/um:${_VSPATH}/vc/include:${_VSPATH}/vc/atlmfc/include:/c/tools/sdks/dx10/include
+export INCLUDE=/c/Program\ Files\ \(x86\)/Windows\ Kits/8.1/include/shared:/c/Program\ Files\ \(x86\)/Windows\ Kits/8.1/include/um:/c/Program\ Files\ \(x86\)/Windows\ Kits/8.1/include/winrt:${_VSPATH}/vc/include:${_VSPATH}/vc/atlmfc/include:/c/tools/sdks/dx10/include
 
 ## libs: win8.1 sdk x64 (64-bit) libs, msvc (64-bit) std library, msvc atl libs, directx sdk (64-bit) for d3d9  ##
 export LIBPATH=/c/Program\ Files\ \(x86\)/Windows\ Kits/8.1/Lib/winv6.3/um/x64:${_VSPATH}/vc/lib/amd64:${_VSPATH}/vc/atlmfc/lib/amd64:/c/tools/sdks/dx10/lib/x64
diff --git a/chrome/moz.build b/chrome/moz.build
index 2ba1c2ce39..14aa417220 100644
--- a/chrome/moz.build
+++ b/chrome/moz.build
@@ -28,11 +28,8 @@ include('/ipc/chromium/chromium-config.mozbuild')
 
 FINAL_LIBRARY = 'xul'
 
-GENERATED_INCLUDES += [
-    '/xpcom',
-]
-
 LOCAL_INCLUDES += [
+    '!/xpcom',
     '/netwerk/base',
     '/netwerk/protocol/res',
     '/xpcom/components'
diff --git a/dom/apps/tests/test_third_party_homescreen.html b/dom/apps/tests/test_third_party_homescreen.html
index d3ead7ddcf..7f1f5aaefc 100644
--- a/dom/apps/tests/test_third_party_homescreen.html
+++ b/dom/apps/tests/test_third_party_homescreen.html
@@ -163,11 +163,11 @@ function runTest() {
   ok(app, "App is non-null");
   is(app.manifestURL, gManifestURL, "App manifest url is correct.");
 
-  var context = {"manifestURL": app.manifestURL, "isInBrowserElement": false};
+  var context = {manifestURL: app.manifestURL};
 
-  SpecialPowers.pushPermissions([{"type": "homescreen-webapps-manage",
-                                  "allow": 1,
-                                  "context": context}], continueTest);
+  SpecialPowers.pushPermissions([{type: "homescreen-webapps-manage",
+                                  allow: 1,
+                                  context: context}], continueTest);
   yield undefined;
 
   // Launch the app.
diff --git a/dom/base/ImageEncoder.cpp b/dom/base/ImageEncoder.cpp
index 60e39913f8..fd01674a22 100644
--- a/dom/base/ImageEncoder.cpp
+++ b/dom/base/ImageEncoder.cpp
@@ -138,7 +138,7 @@ public:
 
   EncodingRunnable(const nsAString& aType,
                    const nsAString& aOptions,
-                   uint8_t* aImageBuffer,
+                   UniquePtr<uint8_t[]> aImageBuffer,
                    layers::Image* aImage,
                    imgIEncoder* aEncoder,
                    EncodingCompleteEvent* aEncodingCompleteEvent,
@@ -147,7 +147,7 @@ public:
                    bool aUsingCustomOptions)
     : mType(aType)
     , mOptions(aOptions)
-    , mImageBuffer(aImageBuffer)
+    , mImageBuffer(Move(aImageBuffer))
     , mImage(aImage)
     , mEncoder(aEncoder)
     , mEncodingCompleteEvent(aEncodingCompleteEvent)
@@ -161,7 +161,7 @@ public:
     nsCOMPtr<nsIInputStream> stream;
     nsresult rv = ImageEncoder::ExtractDataInternal(mType,
                                                     mOptions,
-                                                    mImageBuffer,
+                                                    mImageBuffer.get(),
                                                     mFormat,
                                                     mSize,
                                                     mImage,
@@ -175,7 +175,7 @@ public:
     if (rv == NS_ERROR_INVALID_ARG && mUsingCustomOptions) {
       rv = ImageEncoder::ExtractDataInternal(mType,
                                              EmptyString(),
-                                             mImageBuffer,
+                                             mImageBuffer.get(),
                                              mFormat,
                                              mSize,
                                              mImage,
@@ -220,7 +220,7 @@ public:
 private:
   nsAutoString mType;
   nsAutoString mOptions;
-  nsAutoArrayPtr<uint8_t> mImageBuffer;
+  UniquePtr<uint8_t[]> mImageBuffer;
   RefPtr<layers::Image> mImage;
   nsCOMPtr<imgIEncoder> mEncoder;
   RefPtr<EncodingCompleteEvent> mEncodingCompleteEvent;
@@ -287,7 +287,7 @@ nsresult
 ImageEncoder::ExtractDataAsync(nsAString& aType,
                                const nsAString& aOptions,
                                bool aUsingCustomOptions,
-                               uint8_t* aImageBuffer,
+                               UniquePtr<uint8_t[]> aImageBuffer,
                                int32_t aFormat,
                                const nsIntSize aSize,
                                EncodeCompleteCallback* aEncodeCallback)
@@ -306,7 +306,7 @@ ImageEncoder::ExtractDataAsync(nsAString& aType,
 
   nsCOMPtr<nsIRunnable> event = new EncodingRunnable(aType,
                                                      aOptions,
-                                                     aImageBuffer,
+                                                     Move(aImageBuffer),
                                                      nullptr,
                                                      encoder,
                                                      completeEvent,
diff --git a/dom/base/ImageEncoder.h b/dom/base/ImageEncoder.h
index a38bbd2091..def44c547f 100644
--- a/dom/base/ImageEncoder.h
+++ b/dom/base/ImageEncoder.h
@@ -11,6 +11,7 @@
 #include "nsError.h"
 #include "mozilla/dom/File.h"
 #include "mozilla/dom/HTMLCanvasElementBinding.h"
+#include "mozilla/UniquePtr.h"
 #include "nsLayoutUtils.h"
 #include "nsSize.h"
 
@@ -58,7 +59,7 @@ public:
   static nsresult ExtractDataAsync(nsAString& aType,
                                    const nsAString& aOptions,
                                    bool aUsingCustomOptions,
-                                   uint8_t* aImageBuffer,
+                                   UniquePtr<uint8_t[]> aImageBuffer,
                                    int32_t aFormat,
                                    const nsIntSize aSize,
                                    EncodeCompleteCallback* aEncodeCallback);
diff --git a/dom/base/nsContentUtils.h b/dom/base/nsContentUtils.h
index bf81bc5909..611c6d9fc7 100644
--- a/dom/base/nsContentUtils.h
+++ b/dom/base/nsContentUtils.h
@@ -106,7 +106,6 @@ class nsIWindowProvider;
 
 struct JSPropertyDescriptor;
 struct JSRuntime;
-struct nsIntMargin;
 
 template<class E> class nsCOMArray;
 template<class K, class V> class nsDataHashtable;
diff --git a/dom/base/nsDOMCID.h b/dom/base/nsDOMCID.h
index 5d94b585f6..97dffb492f 100644
--- a/dom/base/nsDOMCID.h
+++ b/dom/base/nsDOMCID.h
@@ -21,12 +21,9 @@
   0x45f27d10, 0x987b, 0x11d2,                        \
  {0xbd, 0x40, 0x00, 0x10, 0x5a, 0xa4, 0x5e, 0x89} }
 
-#define SERVICEWORKERPERIODICUPDATER_CONTRACTID \
-  "@mozilla.org/service-worker-periodic-updater;1"
-
 //The dom cannot provide the crypto or pkcs11 classes that
 //were used in older days, so if someone wants to provide
-//the service they must implement an object and give it 
+//the service they must implement an object and give it
 //this class ID
 #define NS_CRYPTO_CONTRACTID "@mozilla.org/security/crypto;1"
 #define NS_PKCS11_CONTRACTID "@mozilla.org/security/pkcs11;1"
diff --git a/dom/base/nsDOMWindowUtils.cpp b/dom/base/nsDOMWindowUtils.cpp
index 0503fa1f12..7fb4f0d730 100644
--- a/dom/base/nsDOMWindowUtils.cpp
+++ b/dom/base/nsDOMWindowUtils.cpp
@@ -983,11 +983,14 @@ nsDOMWindowUtils::SendTouchEventCommon(const nsAString& aType,
   for (uint32_t i = 0; i < aCount; ++i) {
     LayoutDeviceIntPoint pt =
       nsContentUtils::ToWidgetPoint(CSSPoint(aXs[i], aYs[i]), offset, presContext);
-    RefPtr<Touch> t = new Touch(aIdentifiers[i],
-                                  pt,
-                                  nsIntPoint(aRxs[i], aRys[i]),
-                                  aRotationAngles[i],
-                                  aForces[i]);
+    LayoutDeviceIntPoint radius =
+      LayoutDeviceIntPoint::FromAppUnitsRounded(
+        CSSPoint::ToAppUnits(CSSPoint(aRxs[i], aRys[i])),
+        presContext->AppUnitsPerDevPixel());
+
+    RefPtr<Touch> t =
+      new Touch(aIdentifiers[i], pt, radius, aRotationAngles[i], aForces[i]);
+
     event.touches.AppendElement(t);
   }
 
diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
index fcc6f2ee45..556b7664f8 100644
--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -10591,13 +10591,13 @@ nsIDocument::CreateTouch(nsIDOMWindow* aView,
                          float aForce)
 {
   RefPtr<Touch> touch = new Touch(aTarget,
-                                    aIdentifier,
-                                    aPageX, aPageY,
-                                    aScreenX, aScreenY,
-                                    aClientX, aClientY,
-                                    aRadiusX, aRadiusY,
-                                    aRotationAngle,
-                                    aForce);
+                                  aIdentifier,
+                                  aPageX, aPageY,
+                                  aScreenX, aScreenY,
+                                  aClientX, aClientY,
+                                  aRadiusX, aRadiusY,
+                                  aRotationAngle,
+                                  aForce);
   return touch.forget();
 }
 
diff --git a/dom/base/test/test_messagemanager_assertpermission.html b/dom/base/test/test_messagemanager_assertpermission.html
index 2a5becb680..83724aee9f 100644
--- a/dom/base/test/test_messagemanager_assertpermission.html
+++ b/dom/base/test/test_messagemanager_assertpermission.html
@@ -32,8 +32,8 @@ function setUp() {
 
   let appId = gAppsService.getAppLocalIdByManifestURL(APP_MANIFEST);
   SpecialPowers.addPermission("foobar", true, { url: APP_URL,
-                                                appId: appId,
-                                                isInBrowserElement: false });
+                                                originAttributes: { appId: appId }
+                                              });
   SpecialPowers.pushPrefEnv({"set":[['dom.mozBrowserFramesEnabled', true],
                                     ['dom.ipc.browser_frames.oop_by_default', true]]}, runNextTest);
 }
diff --git a/dom/base/test/test_messagemanager_targetchain.html b/dom/base/test/test_messagemanager_targetchain.html
index 419f15cedb..8f0d21e728 100644
--- a/dom/base/test/test_messagemanager_targetchain.html
+++ b/dom/base/test/test_messagemanager_targetchain.html
@@ -103,15 +103,17 @@
     addEventListener("load", function() {
       var principal = SpecialPowers.wrap(document).nodePrincipal;
       SpecialPowers.pushPermissions([
-        { "type": "browser", "allow": 1, "context": { "url": principal.URI.spec,
-                                                      "appId": principal.appId,
-                                                      "isInBrowserElement": false }},
-        { "type": "browser", "allow": 1, "context": { "url": principal.URI.spec,
-                                                      "appId": principal.appId,
-                                                      "isInBrowserElement": true }}
+        { type: "browser", allow: 1, context: { url: principal.URI.spec,
+                                                originAttributes: {
+                                                  appId: principal.appId
+                                                }}},
+        { type: "browser", allow: 1, context: { url: principal.URI.spec,
+                                                originAttributes: {
+                                                  appId: principal.appId,
+                                                  inBrowser: true }}}
       ], () => {
         SpecialPowers.pushPrefEnv({
-          "set": [
+          set: [
             ["dom.mozBrowserFramesEnabled", true],
             ["dom.ipc.browser_frames.oop_by_default", false],
           ]
diff --git a/dom/base/test/test_websocket.html b/dom/base/test/test_websocket.html
index 1a79c5d860..a09cc7db6f 100644
--- a/dom/base/test/test_websocket.html
+++ b/dom/base/test/test_websocket.html
@@ -1225,11 +1225,7 @@ function test41()
         ok(true, "test 41c close");
 
         // clean up the STS state
-        const Cc = SpecialPowers.Cc;
         const Ci = SpecialPowers.Ci;
-        var ios = Cc["@mozilla.org/network/io-service;1"].getService(Ci.nsIIOService);
-        var thehost = ios.newURI("http://example.com", null, null);
-        var sss = Cc["@mozilla.org/ssservice;1"].getService(Ci.nsISiteSecurityService);
         var loadContext = SpecialPowers.wrap(window)
                           .QueryInterface(Ci.nsIInterfaceRequestor)
                           .getInterface(Ci.nsIWebNavigation)
@@ -1237,7 +1233,7 @@ function test41()
         var flags = 0;
         if (loadContext.usePrivateBrowsing)
           flags |= Ci.nsISocketProvider.NO_PERMANENT_STORAGE;
-        sss.removeState(Ci.nsISiteSecurityService.HEADER_HSTS, thehost, flags);
+        SpecialPowers.cleanUpSTSData("http://example.com", flags);
         doTest(42);
        }
      }
diff --git a/dom/bindings/test/moz.build b/dom/bindings/test/moz.build
index 1b81ad3e6e..eeadfee342 100644
--- a/dom/bindings/test/moz.build
+++ b/dom/bindings/test/moz.build
@@ -41,8 +41,8 @@ WEBIDL_EXAMPLE_INTERFACES += [
     'TestExampleProxyInterface',
 ]
 
-GENERATED_INCLUDES += ['..']
 LOCAL_INCLUDES += [
+    '!..',
     '/dom/bindings',
     '/js/xpconnect/src',
     '/js/xpconnect/wrappers',
diff --git a/dom/browser-element/mochitest/browserElement_AllowEmbedAppsInNestedOOIframe.js b/dom/browser-element/mochitest/browserElement_AllowEmbedAppsInNestedOOIframe.js
index 67c0df8e2d..b408ecb062 100644
--- a/dom/browser-element/mochitest/browserElement_AllowEmbedAppsInNestedOOIframe.js
+++ b/dom/browser-element/mochitest/browserElement_AllowEmbedAppsInNestedOOIframe.js
@@ -22,17 +22,16 @@ function runTest() {
 
   document.body.appendChild(iframe);
 
-  var context = { 'url': 'http://example.org',
-                  'appId': SpecialPowers.Ci.nsIScriptSecurityManager.NO_APP_ID,
-                  'isInBrowserElement': true };
+  var context = {url: 'http://example.org',
+                 originAttributes: {inBrowser: true}};
   SpecialPowers.pushPermissions([
-    {'type': 'browser', 'allow': 1, 'context': context},
-    {'type': 'embed-apps', 'allow': 1, 'context': context}
+    {type: 'browser', allow: 1, context: context},
+    {type: 'embed-apps', allow: 1, context: context}
   ], function() {
     iframe.src = 'http://example.org/tests/dom/browser-element/mochitest/file_browserElement_AllowEmbedAppsInNestedOOIframe.html';
   });
 }
 
 addEventListener('testready', () => {
-  SpecialPowers.pushPrefEnv({"set": [["dom.ipc.tabs.nested.enabled", true]]}, runTest);
+  SpecialPowers.pushPrefEnv({set: [["dom.ipc.tabs.nested.enabled", true]]}, runTest);
 });
diff --git a/dom/browser-element/mochitest/browserElement_CopyPaste.js b/dom/browser-element/mochitest/browserElement_CopyPaste.js
index 762b792507..217348f5f7 100644
--- a/dom/browser-element/mochitest/browserElement_CopyPaste.js
+++ b/dom/browser-element/mochitest/browserElement_CopyPaste.js
@@ -321,13 +321,14 @@ function testCut2(e) {
 
 // Give our origin permission to open browsers, and remove it when the test is complete.
 var principal = SpecialPowers.wrap(document).nodePrincipal;
-var context = { 'url': SpecialPowers.wrap(principal.URI).spec,
-                'appId': principal.appId,
-                'isInBrowserElement': true };
+var context = { url: SpecialPowers.wrap(principal.URI).spec,
+                originAttributes: {
+                  appId: principal.appId,
+                  inBrowser: true }};
 
 addEventListener('testready', function() {
   SpecialPowers.pushPermissions([
-    {'type': 'browser', 'allow': 1, 'context': context}
+    {type: 'browser', allow: 1, context: context}
   ], runTest);
 });
 
diff --git a/dom/browser-element/mochitest/browserElement_DisallowEmbedAppsInOOP.js b/dom/browser-element/mochitest/browserElement_DisallowEmbedAppsInOOP.js
index 8c9b1ba811..d757e3eecd 100644
--- a/dom/browser-element/mochitest/browserElement_DisallowEmbedAppsInOOP.js
+++ b/dom/browser-element/mochitest/browserElement_DisallowEmbedAppsInOOP.js
@@ -28,12 +28,11 @@ function runTest() {
 
   document.body.appendChild(iframe);
 
-  var context = { 'url': 'http://example.org',
-                  'appId': SpecialPowers.Ci.nsIScriptSecurityManager.NO_APP_ID,
-                  'isInBrowserElement': true };
+  var context = {url: 'http://example.org',
+                 originAttributes: {inBrowser: true}};
   SpecialPowers.pushPermissions([
-    {'type': 'browser', 'allow': 1, 'context': context},
-    {'type': 'embed-apps', 'allow': 1, 'context': context}
+    {type: 'browser', allow: 1, context: context},
+    {type: 'embed-apps', allow: 1, context: context}
   ], function() {
     iframe.src = 'http://example.org/tests/dom/browser-element/mochitest/file_browserElement_DisallowEmbedAppsInOOP.html';
   });
diff --git a/dom/browser-element/mochitest/browserElement_SetInputMethodActive.js b/dom/browser-element/mochitest/browserElement_SetInputMethodActive.js
index b56320ce99..e88d7bde44 100644
--- a/dom/browser-element/mochitest/browserElement_SetInputMethodActive.js
+++ b/dom/browser-element/mochitest/browserElement_SetInputMethodActive.js
@@ -36,8 +36,7 @@ function runTest() {
     allow: true,
     context: {
       url: imeUrl,
-      appId: SpecialPowers.Ci.nsIScriptSecurityManager.NO_APP_ID,
-      isInBrowserElement: true
+      originAttributes: {inBrowser: true}
     }
   }], SimpleTest.waitForFocus.bind(SimpleTest, createFrames));
 }
diff --git a/dom/browser-element/mochitest/browserElement_SetVisibleFrames.js b/dom/browser-element/mochitest/browserElement_SetVisibleFrames.js
index cfc5e251a1..f5456122f1 100644
--- a/dom/browser-element/mochitest/browserElement_SetVisibleFrames.js
+++ b/dom/browser-element/mochitest/browserElement_SetVisibleFrames.js
@@ -18,9 +18,11 @@ var iframe;
 
 function runTest() {
   var principal = SpecialPowers.wrap(document).nodePrincipal;
-  SpecialPowers.addPermission("browser", true, { url: SpecialPowers.wrap(principal.URI).spec,
-                                                 appId: principal.appId,
-                                                 isInBrowserElement: true });
+  SpecialPowers.addPermission("browser", true, {url: SpecialPowers.wrap(principal.URI).spec,
+                                                originAttributes: {
+                                                  appId: principal.appId,
+                                                  inBrowser: true
+                                                }});
 
   iframe = document.createElement('iframe');
   iframe.setAttribute('mozbrowser', 'true');
@@ -75,10 +77,11 @@ function finish() {
   iframe.removeEventListener('mozbrowsershowmodalprompt', checkMessage);
 
   var principal = SpecialPowers.wrap(document).nodePrincipal;
-  SpecialPowers.removePermission("browser", { url: SpecialPowers.wrap(principal.URI).spec,
-                                              appId: principal.appId,
-                                              isInBrowserElement: true });
-
+  SpecialPowers.removePermission("browser", {url: SpecialPowers.wrap(principal.URI).spec,
+                                             originAttributes: {
+                                               appId: principal.appId,
+                                               inBrowser: true
+                                             }});
   SimpleTest.finish();
 }
 
diff --git a/dom/browser-element/mochitest/browserElement_SetVisibleFrames2.js b/dom/browser-element/mochitest/browserElement_SetVisibleFrames2.js
index 94e550eb2c..c298a1fb4d 100644
--- a/dom/browser-element/mochitest/browserElement_SetVisibleFrames2.js
+++ b/dom/browser-element/mochitest/browserElement_SetVisibleFrames2.js
@@ -12,9 +12,11 @@ browserElementTestHelpers.addPermission();
 
 function runTest() {
   var principal = SpecialPowers.wrap(document).nodePrincipal;
-  SpecialPowers.addPermission("browser", true, { url: SpecialPowers.wrap(principal.URI).spec,
-                                                 appId: principal.appId,
-                                                 isInBrowserElement: true });
+  SpecialPowers.addPermission("browser", true, {url: SpecialPowers.wrap(principal.URI).spec,
+                                                originAttributes: {
+                                                  appId: principal.appId,
+                                                  inBrowser: true
+                                                }});
 
   var iframe = document.createElement('iframe');
   iframe.setAttribute('mozbrowser', 'true');
@@ -56,9 +58,11 @@ function runTest() {
 
 function finish() {
   var principal = SpecialPowers.wrap(document).nodePrincipal;
-  SpecialPowers.removePermission("browser", { url: SpecialPowers.wrap(principal.URI).spec,
-                                              appId: principal.appId,
-                                              isInBrowserElement: true });
+  SpecialPowers.removePermission("browser", {url: SpecialPowers.wrap(principal.URI).spec,
+                                             originAttributes: {
+                                               appId: principal.appId,
+                                               inBrowser: true
+                                             }});
 
   SimpleTest.finish();
 }
diff --git a/dom/browser-element/mochitest/priority/test_ExpectingSystemMessage2.html b/dom/browser-element/mochitest/priority/test_ExpectingSystemMessage2.html
index 7658cb4d61..5c6a25fdf9 100644
--- a/dom/browser-element/mochitest/priority/test_ExpectingSystemMessage2.html
+++ b/dom/browser-element/mochitest/priority/test_ExpectingSystemMessage2.html
@@ -22,15 +22,19 @@ SpecialPowers.addPermission("embed-apps", true, document);
 
 // Give our origin permission to open browsers, and remove it when the test is complete.
 var principal = SpecialPowers.wrap(document).nodePrincipal;
-SpecialPowers.addPermission("browser", true, { url: SpecialPowers.wrap(principal.URI).spec,
-                                               appId: principal.appId,
-                                               isInBrowserElement: true });
+SpecialPowers.addPermission("browser", true, {url: SpecialPowers.wrap(principal.URI).spec,
+                                              originAttributes: {
+                                                appId: principal.appId,
+                                                inBrowser: true
+                                              }});
 
 addEventListener('unload', function() {
   var principal = SpecialPowers.wrap(document).nodePrincipal;
-  SpecialPowers.removePermission("browser", { url: SpecialPowers.wrap(principal.URI).spec,
-                                              appId: principal.appId,
-                                              isInBrowserElement: true });
+  SpecialPowers.removePermission("browser", {url: SpecialPowers.wrap(principal.URI).spec,
+                                             originAttributes: {
+                                               appId: principal.appId,
+                                               inBrowser: true
+                                             }});
 });
 
 function runTest() {
diff --git a/dom/browser-element/mochitest/priority/test_NestedFrames.html b/dom/browser-element/mochitest/priority/test_NestedFrames.html
index 3696a2c497..77b6b7af20 100644
--- a/dom/browser-element/mochitest/priority/test_NestedFrames.html
+++ b/dom/browser-element/mochitest/priority/test_NestedFrames.html
@@ -21,15 +21,19 @@ browserElementTestHelpers.enableProcessPriorityManager();
 
 // Give our origin permission to open browsers, and remove it when the test is complete.
 var principal = SpecialPowers.wrap(document).nodePrincipal;
-SpecialPowers.addPermission("browser", true, { url: SpecialPowers.wrap(principal.URI).spec,
-                                               appId: principal.appId,
-                                               isInBrowserElement: true });
+SpecialPowers.addPermission("browser", true, {url: SpecialPowers.wrap(principal.URI).spec,
+                                              originAttributes: {
+                                                appId: principal.appId,
+                                                inBrowser: true
+                                              }});
 
 addEventListener('unload', function() {
   var principal = SpecialPowers.wrap(document).nodePrincipal;
-  SpecialPowers.removePermission("browser", { url: SpecialPowers.wrap(principal.URI).spec,
-                                              appId: principal.appId,
-                                              isInBrowserElement: true });
+  SpecialPowers.removePermission("browser", {url: SpecialPowers.wrap(principal.URI).spec,
+                                             originAttributes: {
+                                               appId: principal.appId,
+                                               inBrowser: true
+                                             }});
 });
 
 function runTest() {
diff --git a/dom/cache/test/mochitest/driver.js b/dom/cache/test/mochitest/driver.js
index 608946cfa0..9549fd632e 100644
--- a/dom/cache/test/mochitest/driver.js
+++ b/dom/cache/test/mochitest/driver.js
@@ -34,16 +34,7 @@ function runTests(testFile, order) {
   // adapted from dom/indexedDB/test/helpers.js
   function clearStorage() {
     return new Promise(function(resolve, reject) {
-      var principal = SpecialPowers.wrap(document).nodePrincipal;
-      var appId, inBrowser;
-      var nsIPrincipal = SpecialPowers.Components.interfaces.nsIPrincipal;
-      if (principal.appId != nsIPrincipal.UNKNOWN_APP_ID &&
-          principal.appId != nsIPrincipal.NO_APP_ID) {
-        appId = principal.appId;
-        inBrowser = principal.isInBrowserElement;
-      }
-      SpecialPowers.clearStorageForURI(document.documentURI, resolve, appId,
-                                       inBrowser);
+      SpecialPowers.clearStorageForDoc(SpecialPowers.wrap(document), resolve);
     });
   }
 
diff --git a/dom/cache/test/mochitest/test_cache_orphaned_body.html b/dom/cache/test/mochitest/test_cache_orphaned_body.html
index b0ad935bbe..cb30c368fa 100644
--- a/dom/cache/test/mochitest/test_cache_orphaned_body.html
+++ b/dom/cache/test/mochitest/test_cache_orphaned_body.html
@@ -24,46 +24,19 @@ function setupTestIframe() {
 
 function clearStorage() {
   return new Promise(function(resolve, reject) {
-    var principal = SpecialPowers.wrap(document).nodePrincipal;
-    var appId, inBrowser;
-    var nsIPrincipal = SpecialPowers.Components.interfaces.nsIPrincipal;
-    if (principal.appId != nsIPrincipal.UNKNOWN_APP_ID &&
-        principal.appId != nsIPrincipal.NO_APP_ID) {
-      appId = principal.appId;
-      inBrowser = principal.isInBrowserElement;
-    }
-    SpecialPowers.clearStorageForURI(document.documentURI, resolve, appId,
-                                     inBrowser);
+    SpecialPowers.clearStorageForDoc(SpecialPowers.wrap(document), resolve);
   });
 }
 
 function storageUsage() {
   return new Promise(function(resolve, reject) {
-    var principal = SpecialPowers.wrap(document).nodePrincipal;
-    var appId, inBrowser;
-    var nsIPrincipal = SpecialPowers.Components.interfaces.nsIPrincipal;
-    if (principal.appId != nsIPrincipal.UNKNOWN_APP_ID &&
-        principal.appId != nsIPrincipal.NO_APP_ID) {
-      appId = principal.appId;
-      inBrowser = principal.isInBrowserElement;
-    }
-    SpecialPowers.getStorageUsageForURI(document.documentURI, resolve, appId,
-                                        inBrowser);
+    SpecialPowers.getStorageUsageForDoc(SpecialPowers.wrap(document), resolve);
   });
 }
 
 function resetStorage() {
   return new Promise(function(resolve, reject) {
-    var principal = SpecialPowers.wrap(document).nodePrincipal;
-    var appId, inBrowser;
-    var nsIPrincipal = SpecialPowers.Components.interfaces.nsIPrincipal;
-    if (principal.appId != nsIPrincipal.UNKNOWN_APP_ID &&
-        principal.appId != nsIPrincipal.NO_APP_ID) {
-      appId = principal.appId;
-      inBrowser = principal.isInBrowserElement;
-    }
-    SpecialPowers.resetStorageForURI(document.documentURI, resolve, appId,
-                                     inBrowser);
+    SpecialPowers.resetStorageForDoc(SpecialPowers.wrap(document), resolve);
   });
 }
 
diff --git a/dom/cache/test/mochitest/test_cache_orphaned_cache.html b/dom/cache/test/mochitest/test_cache_orphaned_cache.html
index 8fab9b47a2..8c51962d27 100644
--- a/dom/cache/test/mochitest/test_cache_orphaned_cache.html
+++ b/dom/cache/test/mochitest/test_cache_orphaned_cache.html
@@ -24,46 +24,19 @@ function setupTestIframe() {
 
 function clearStorage() {
   return new Promise(function(resolve, reject) {
-    var principal = SpecialPowers.wrap(document).nodePrincipal;
-    var appId, inBrowser;
-    var nsIPrincipal = SpecialPowers.Components.interfaces.nsIPrincipal;
-    if (principal.appId != nsIPrincipal.UNKNOWN_APP_ID &&
-        principal.appId != nsIPrincipal.NO_APP_ID) {
-      appId = principal.appId;
-      inBrowser = principal.isInBrowserElement;
-    }
-    SpecialPowers.clearStorageForURI(document.documentURI, resolve, appId,
-                                     inBrowser);
+    SpecialPowers.clearStorageForDoc(SpecialPowers.wrap(document), resolve);
   });
 }
 
 function storageUsage() {
   return new Promise(function(resolve, reject) {
-    var principal = SpecialPowers.wrap(document).nodePrincipal;
-    var appId, inBrowser;
-    var nsIPrincipal = SpecialPowers.Components.interfaces.nsIPrincipal;
-    if (principal.appId != nsIPrincipal.UNKNOWN_APP_ID &&
-        principal.appId != nsIPrincipal.NO_APP_ID) {
-      appId = principal.appId;
-      inBrowser = principal.isInBrowserElement;
-    }
-    SpecialPowers.getStorageUsageForURI(document.documentURI, resolve, appId,
-                                        inBrowser);
+    SpecialPowers.getStorageUsageForDoc(SpecialPowers.wrap(document), resolve);
   });
 }
 
 function resetStorage() {
   return new Promise(function(resolve, reject) {
-    var principal = SpecialPowers.wrap(document).nodePrincipal;
-    var appId, inBrowser;
-    var nsIPrincipal = SpecialPowers.Components.interfaces.nsIPrincipal;
-    if (principal.appId != nsIPrincipal.UNKNOWN_APP_ID &&
-        principal.appId != nsIPrincipal.NO_APP_ID) {
-      appId = principal.appId;
-      inBrowser = principal.isInBrowserElement;
-    }
-    SpecialPowers.resetStorageForURI(document.documentURI, resolve, appId,
-                                     inBrowser);
+    SpecialPowers.resetStorageForDoc(SpecialPowers.wrap(document), resolve);
   });
 }
 
diff --git a/dom/cache/test/mochitest/test_cache_restart.html b/dom/cache/test/mochitest/test_cache_restart.html
index 21b807a26b..007441c3fd 100644
--- a/dom/cache/test/mochitest/test_cache_restart.html
+++ b/dom/cache/test/mochitest/test_cache_restart.html
@@ -11,16 +11,7 @@
 <script class="testbody" type="text/javascript">
 function resetStorage() {
   return new Promise(function(resolve, reject) {
-    var principal = SpecialPowers.wrap(document).nodePrincipal;
-    var appId, inBrowser;
-    var nsIPrincipal = SpecialPowers.Components.interfaces.nsIPrincipal;
-    if (principal.appId != nsIPrincipal.UNKNOWN_APP_ID &&
-        principal.appId != nsIPrincipal.NO_APP_ID) {
-      appId = principal.appId;
-      inBrowser = principal.isInBrowserElement;
-    }
-    SpecialPowers.resetStorageForURI(document.documentURI, resolve, appId,
-                                     inBrowser);
+    SpecialPowers.resetStorageForDoc(SpecialPowers.wrap(document), resolve);
   });
 }
 
diff --git a/dom/cache/test/mochitest/test_cache_shrink.html b/dom/cache/test/mochitest/test_cache_shrink.html
index 732623eb32..cddaa01147 100644
--- a/dom/cache/test/mochitest/test_cache_shrink.html
+++ b/dom/cache/test/mochitest/test_cache_shrink.html
@@ -12,46 +12,19 @@
 <script class="testbody" type="text/javascript">
 function clearStorage() {
   return new Promise(function(resolve, reject) {
-    var principal = SpecialPowers.wrap(document).nodePrincipal;
-    var appId, inBrowser;
-    var nsIPrincipal = SpecialPowers.Components.interfaces.nsIPrincipal;
-    if (principal.appId != nsIPrincipal.UNKNOWN_APP_ID &&
-        principal.appId != nsIPrincipal.NO_APP_ID) {
-      appId = principal.appId;
-      inBrowser = principal.isInBrowserElement;
-    }
-    SpecialPowers.clearStorageForURI(document.documentURI, resolve, appId,
-                                     inBrowser);
+    SpecialPowers.clearStorageForDoc(SpecialPowers.wrap(document), resolve);
   });
 }
 
 function storageUsage() {
   return new Promise(function(resolve, reject) {
-    var principal = SpecialPowers.wrap(document).nodePrincipal;
-    var appId, inBrowser;
-    var nsIPrincipal = SpecialPowers.Components.interfaces.nsIPrincipal;
-    if (principal.appId != nsIPrincipal.UNKNOWN_APP_ID &&
-        principal.appId != nsIPrincipal.NO_APP_ID) {
-      appId = principal.appId;
-      inBrowser = principal.isInBrowserElement;
-    }
-    SpecialPowers.getStorageUsageForURI(document.documentURI, resolve, appId,
-                                        inBrowser);
+    SpecialPowers.getStorageUsageForDoc(SpecialPowers.wrap(document), resolve);
   });
 }
 
 function resetStorage() {
   return new Promise(function(resolve, reject) {
-    var principal = SpecialPowers.wrap(document).nodePrincipal;
-    var appId, inBrowser;
-    var nsIPrincipal = SpecialPowers.Components.interfaces.nsIPrincipal;
-    if (principal.appId != nsIPrincipal.UNKNOWN_APP_ID &&
-        principal.appId != nsIPrincipal.NO_APP_ID) {
-      appId = principal.appId;
-      inBrowser = principal.isInBrowserElement;
-    }
-    SpecialPowers.resetStorageForURI(document.documentURI, resolve, appId,
-                                     inBrowser);
+    SpecialPowers.resetStorageForDoc(SpecialPowers.wrap(document), resolve);
   });
 }
 
diff --git a/dom/canvas/CanvasRenderingContext2D.cpp b/dom/canvas/CanvasRenderingContext2D.cpp
index c8751a86e2..071a11f262 100644
--- a/dom/canvas/CanvasRenderingContext2D.cpp
+++ b/dom/canvas/CanvasRenderingContext2D.cpp
@@ -1648,26 +1648,24 @@ CanvasRenderingContext2D::SetContextOptions(JSContext* aCx,
   return NS_OK;
 }
 
-void
-CanvasRenderingContext2D::GetImageBuffer(uint8_t** aImageBuffer,
-                                         int32_t* aFormat)
+UniquePtr<uint8_t[]>
+CanvasRenderingContext2D::GetImageBuffer(int32_t* aFormat)
 {
-  *aImageBuffer = nullptr;
   *aFormat = 0;
 
   EnsureTarget();
   RefPtr<SourceSurface> snapshot = mTarget->Snapshot();
   if (!snapshot) {
-    return;
+    return nullptr;
   }
 
   RefPtr<DataSourceSurface> data = snapshot->GetDataSurface();
   if (!data || data->GetSize() != IntSize(mWidth, mHeight)) {
-    return;
+    return nullptr;
   }
 
-  *aImageBuffer = SurfaceToPackedBGRA(data);
   *aFormat = imgIEncoder::INPUT_FORMAT_HOSTARGB;
+  return SurfaceToPackedBGRA(data);
 }
 
 nsString CanvasRenderingContext2D::GetHitRegion(const mozilla::gfx::Point& aPoint)
@@ -1693,29 +1691,15 @@ CanvasRenderingContext2D::GetInputStream(const char *aMimeType,
     return NS_ERROR_FAILURE;
   }
 
-  nsAutoArrayPtr<uint8_t> imageBuffer;
   int32_t format = 0;
-  GetImageBuffer(getter_Transfers(imageBuffer), &format);
+  UniquePtr<uint8_t[]> imageBuffer = GetImageBuffer(&format);
   if (!imageBuffer) {
     return NS_ERROR_FAILURE;
   }
-  
-  bool PoisonData = Preferences::GetBool("canvas.poisondata",false);
-  if (PoisonData) {
-    srand(time(nullptr));
-    // Image buffer is always a packed BGRA array (BGRX -> BGR[FF])
-    // so always 4-value pixels.
-    // GetImageBuffer => SurfaceToPackedBGRA [=> ConvertBGRXToBGRA]
-    int32_t dataSize = mWidth * mHeight * 4;
-#pragma omp parallel for
-    for (int32_t j = 0; j < dataSize; ++j) {
-      if (imageBuffer[j] !=0 && imageBuffer[j] != 255)
-        imageBuffer[j] += rand() % 3 - 1;
-    }
-  }
 
-  return ImageEncoder::GetInputStream(mWidth, mHeight, imageBuffer, format,
-                                      encoder, aEncoderOptions, aStream);
+  return ImageEncoder::GetInputStream(mWidth, mHeight, imageBuffer.get(),
+                                      format, encoder, aEncoderOptions,
+                                      aStream);
 }
 
 SurfaceFormat
@@ -4496,7 +4480,7 @@ CanvasRenderingContext2D::DrawImage(const CanvasImageSource& image,
     if (ok) {
       NativeSurface texSurf;
       texSurf.mType = NativeSurfaceType::OPENGL_TEXTURE;
-      texSurf.mFormat = SurfaceFormat::R5G6B5;
+      texSurf.mFormat = SurfaceFormat::R5G6B5_UINT16;
       texSurf.mSize.width = mCurrentVideoSize.width;
       texSurf.mSize.height = mCurrentVideoSize.height;
       texSurf.mSurface = (void*)((uintptr_t)mVideoTexture);
@@ -5153,14 +5137,6 @@ CanvasRenderingContext2D::GetImageData(JSContext* aCx, double aSx,
   return imageData.forget();
 }
 
-inline uint8_t PoisonValue(uint8_t v)
-{
-  if (v==0 || v==255)
-    return v; //don't fuzz edges to prevent overflow/underflow
-    
-  return v + rand() %3 -1;
-}
-
 nsresult
 CanvasRenderingContext2D::GetImageDataArray(JSContext* aCx,
                                             int32_t aX,
@@ -5174,10 +5150,6 @@ CanvasRenderingContext2D::GetImageDataArray(JSContext* aCx,
   }
 
   MOZ_ASSERT(aWidth && aHeight);
-  
-  bool PoisonData = Preferences::GetBool("canvas.poisondata",false);
-  if (PoisonData)
-    srand(time(nullptr));
 
   CheckedInt<uint32_t> len = CheckedInt<uint32_t>(aWidth) * aHeight * 4;
   if (!len.isValid() || len.value() > INT32_MAX) {
@@ -5253,14 +5225,6 @@ CanvasRenderingContext2D::GetImageDataArray(JSContext* aCx,
         g = *src++;
         b = *src++;
 #endif
-
-        // Poison data for trackers if enabled
-        if (PoisonData) {
-          PoisonValue(r);
-          PoisonValue(g);
-          PoisonValue(b);
-        }
-
         *dst++ = r;
         *dst++ = g;
         *dst++ = b;
@@ -5284,15 +5248,6 @@ CanvasRenderingContext2D::GetImageDataArray(JSContext* aCx,
       g = *src++;
       b = *src++;
 #endif
-
-      // Poison data for trackers if enabled
-      if (PoisonData) {
-        PoisonValue(a);
-        PoisonValue(r);
-        PoisonValue(g);
-        PoisonValue(b);
-      }
-
       // Convert to non-premultiplied color
       *dst++ = gfxUtils::sUnpremultiplyTable[a * 256 + r];
       *dst++ = gfxUtils::sUnpremultiplyTable[a * 256 + g];
diff --git a/dom/canvas/CanvasRenderingContext2D.h b/dom/canvas/CanvasRenderingContext2D.h
index 85b7d783c9..876d800d34 100644
--- a/dom/canvas/CanvasRenderingContext2D.h
+++ b/dom/canvas/CanvasRenderingContext2D.h
@@ -20,6 +20,7 @@
 #include "mozilla/dom/CanvasPattern.h"
 #include "mozilla/gfx/Rect.h"
 #include "mozilla/gfx/2D.h"
+#include "mozilla/UniquePtr.h"
 #include "gfx2DGlue.h"
 #include "imgIEncoder.h"
 #include "nsLayoutUtils.h"
@@ -533,7 +534,7 @@ public:
 
   friend class CanvasRenderingContext2DUserData;
 
-  virtual void GetImageBuffer(uint8_t** aImageBuffer, int32_t* aFormat) override;
+  virtual UniquePtr<uint8_t[]> GetImageBuffer(int32_t* aFormat) override;
 
 
   // Given a point, return hit region ID if it exists
diff --git a/dom/canvas/CanvasRenderingContextHelper.cpp b/dom/canvas/CanvasRenderingContextHelper.cpp
index e050f0e56f..ac4b87c961 100644
--- a/dom/canvas/CanvasRenderingContextHelper.cpp
+++ b/dom/canvas/CanvasRenderingContextHelper.cpp
@@ -7,6 +7,7 @@
 #include "ImageEncoder.h"
 #include "mozilla/dom/CanvasRenderingContext2D.h"
 #include "mozilla/Telemetry.h"
+#include "mozilla/UniquePtr.h"
 #include "nsContentUtils.h"
 #include "nsDOMJSUtils.h"
 #include "nsIScriptContext.h"
@@ -49,10 +50,10 @@ CanvasRenderingContextHelper::ToBlob(JSContext* aCx,
     }
   }
 
-  uint8_t* imageBuffer = nullptr;
+  UniquePtr<uint8_t[]> imageBuffer;
   int32_t format = 0;
   if (mCurrentContext) {
-    mCurrentContext->GetImageBuffer(&imageBuffer, &format);
+    imageBuffer = mCurrentContext->GetImageBuffer(&format);
   }
 
   // Encoder callback when encoding is complete.
@@ -99,7 +100,7 @@ CanvasRenderingContextHelper::ToBlob(JSContext* aCx,
   aRv = ImageEncoder::ExtractDataAsync(type,
                                        params,
                                        usingCustomParseOptions,
-                                       imageBuffer,
+                                       Move(imageBuffer),
                                        format,
                                        GetWidthHeight(),
                                        callback);
diff --git a/dom/canvas/WebGLContext.cpp b/dom/canvas/WebGLContext.cpp
index fe44075946..11b2434a16 100644
--- a/dom/canvas/WebGLContext.cpp
+++ b/dom/canvas/WebGLContext.cpp
@@ -1033,25 +1033,25 @@ WebGLContext::LoseOldestWebGLContextIfLimitExceeded()
     }
 }
 
-void
-WebGLContext::GetImageBuffer(uint8_t** out_imageBuffer, int32_t* out_format)
+UniquePtr<uint8_t[]>
+WebGLContext::GetImageBuffer(int32_t* out_format)
 {
-    *out_imageBuffer = nullptr;
     *out_format = 0;
 
     // Use GetSurfaceSnapshot() to make sure that appropriate y-flip gets applied
     bool premult;
     RefPtr<SourceSurface> snapshot =
       GetSurfaceSnapshot(mOptions.premultipliedAlpha ? nullptr : &premult);
-    if (!snapshot)
-        return;
+    if (!snapshot) {
+        return nullptr;
+    }
 
     MOZ_ASSERT(mOptions.premultipliedAlpha || !premult, "We must get unpremult when we ask for it!");
 
     RefPtr<DataSourceSurface> dataSurface = snapshot->GetDataSurface();
 
     return gfxUtils::GetImageBuffer(dataSurface, mOptions.premultipliedAlpha,
-                                    out_imageBuffer, out_format);
+                                    out_format);
 }
 
 NS_IMETHODIMP
diff --git a/dom/canvas/WebGLContext.h b/dom/canvas/WebGLContext.h
index df328f85a0..78893e70fd 100644
--- a/dom/canvas/WebGLContext.h
+++ b/dom/canvas/WebGLContext.h
@@ -234,8 +234,7 @@ public:
         return NS_ERROR_NOT_IMPLEMENTED;
     }
 
-    virtual void GetImageBuffer(uint8_t** out_imageBuffer,
-                                int32_t* out_format) override;
+    virtual UniquePtr<uint8_t[]> GetImageBuffer(int32_t* out_format) override;
     NS_IMETHOD GetInputStream(const char* mimeType,
                               const char16_t* encoderOptions,
                               nsIInputStream** out_stream) override;
diff --git a/dom/canvas/WebGLContextDraw.cpp b/dom/canvas/WebGLContextDraw.cpp
index bff2b2bf20..4f46dda789 100644
--- a/dom/canvas/WebGLContextDraw.cpp
+++ b/dom/canvas/WebGLContextDraw.cpp
@@ -7,6 +7,7 @@
 
 #include "GLContext.h"
 #include "mozilla/CheckedInt.h"
+#include "mozilla/UniquePtrExtensions.h"
 #include "WebGLBuffer.h"
 #include "WebGLContextUtils.h"
 #include "WebGLFramebuffer.h"
@@ -581,7 +582,7 @@ WebGLContext::DoFakeVertexAttrib0(GLuint vertexCount)
         GetAndFlushUnderlyingGLErrors();
 
         if (mFakeVertexAttrib0BufferStatus == WebGLVertexAttrib0Status::EmulatedInitializedArray) {
-            UniquePtr<GLfloat[]> array(new (fallible) GLfloat[4 * vertexCount]);
+            auto array = MakeUniqueFallible<GLfloat[]>(4 * vertexCount);
             if (!array) {
                 ErrorOutOfMemory("Fake attrib0 array.");
                 return false;
diff --git a/dom/canvas/WebGLContextGL.cpp b/dom/canvas/WebGLContextGL.cpp
index 8d4e45089a..1e253dae31 100644
--- a/dom/canvas/WebGLContextGL.cpp
+++ b/dom/canvas/WebGLContextGL.cpp
@@ -51,6 +51,7 @@
 #include "mozilla/dom/ToJSValue.h"
 #include "mozilla/Endian.h"
 #include "mozilla/RefPtr.h"
+#include "mozilla/UniquePtrExtensions.h"
 
 namespace mozilla {
 
@@ -1589,7 +1590,7 @@ WebGLContext::ReadPixels(GLint x, GLint y, GLsizei width,
         uint32_t subrect_byteLength = (subrect_height-1)*subrect_alignedRowSize + subrect_plainRowSize;
 
         // create subrect buffer, call glReadPixels, copy pixels into destination buffer, delete subrect buffer
-        UniquePtr<GLubyte> subrect_data(new (fallible) GLubyte[subrect_byteLength]);
+        auto subrect_data = MakeUniqueFallible<GLubyte[]>(subrect_byteLength);
         if (!subrect_data)
             return ErrorOutOfMemory("readPixels: subrect_data");
 
@@ -1936,7 +1937,7 @@ WebGLContext::SurfaceFromElementResultToImageSurface(nsLayoutUtils::SurfaceFromE
         case SurfaceFormat::A8:
             *format = WebGLTexelFormat::A8;
             break;
-        case SurfaceFormat::R5G6B5:
+        case SurfaceFormat::R5G6B5_UINT16:
             *format = WebGLTexelFormat::RGB565;
             break;
         default:
diff --git a/dom/canvas/nsICanvasRenderingContextInternal.h b/dom/canvas/nsICanvasRenderingContextInternal.h
index b5212dd9e2..a18e4001bb 100644
--- a/dom/canvas/nsICanvasRenderingContextInternal.h
+++ b/dom/canvas/nsICanvasRenderingContextInternal.h
@@ -14,6 +14,7 @@
 #include "mozilla/dom/HTMLCanvasElement.h"
 #include "mozilla/dom/OffscreenCanvas.h"
 #include "mozilla/RefPtr.h"
+#include "mozilla/UniquePtr.h"
 
 #define NS_ICANVASRENDERINGCONTEXTINTERNAL_IID \
 { 0xb84f2fed, 0x9d4b, 0x430b, \
@@ -96,7 +97,7 @@ public:
   NS_IMETHOD InitializeWithSurface(nsIDocShell *docShell, gfxASurface *surface, int32_t width, int32_t height) = 0;
 
   // Creates an image buffer. Returns null on failure.
-  virtual void GetImageBuffer(uint8_t** imageBuffer, int32_t* format) = 0;
+  virtual mozilla::UniquePtr<uint8_t[]> GetImageBuffer(int32_t* format) = 0;
 
   // Gives you a stream containing the image represented by this context.
   // The format is given in mimeTime, for example "image/png".
diff --git a/dom/events/DataTransfer.cpp b/dom/events/DataTransfer.cpp
index 11345c7876..21076ad63b 100644
--- a/dom/events/DataTransfer.cpp
+++ b/dom/events/DataTransfer.cpp
@@ -31,6 +31,7 @@
 #include "mozilla/dom/FileList.h"
 #include "mozilla/dom/BindingUtils.h"
 #include "mozilla/dom/OSFileSystem.h"
+#include "mozilla/dom/Promise.h"
 
 namespace mozilla {
 namespace dom {
diff --git a/dom/events/DataTransfer.h b/dom/events/DataTransfer.h
index 7629e8c3cb..40d737df4b 100644
--- a/dom/events/DataTransfer.h
+++ b/dom/events/DataTransfer.h
@@ -20,7 +20,6 @@
 #include "mozilla/Attributes.h"
 #include "mozilla/EventForwards.h"
 #include "mozilla/dom/File.h"
-#include "mozilla/dom/Promise.h"
 
 class nsINode;
 class nsITransferable;
@@ -36,6 +35,7 @@ namespace dom {
 class DOMStringList;
 class Element;
 class FileList;
+class Promise;
 template<typename T> class Optional;
 
 /**
diff --git a/dom/events/Event.cpp b/dom/events/Event.cpp
index ea9a8c373e..6d3ce67a0a 100644
--- a/dom/events/Event.cpp
+++ b/dom/events/Event.cpp
@@ -898,7 +898,8 @@ Event::Shutdown()
   }
 }
 
-LayoutDeviceIntPoint
+// static
+CSSIntPoint
 Event::GetScreenCoords(nsPresContext* aPresContext,
                        WidgetEvent* aEvent,
                        LayoutDeviceIntPoint aPoint)
@@ -906,8 +907,7 @@ Event::GetScreenCoords(nsPresContext* aPresContext,
   if (!nsContentUtils::LegacyIsCallerChromeOrNativeCode() &&
       nsContentUtils::ResistFingerprinting()) {
     // When resisting fingerprinting, return client coordinates instead.
-    CSSIntPoint clientCoords = GetClientCoords(aPresContext, aEvent, aPoint, CSSIntPoint(0, 0));
-    return LayoutDeviceIntPoint(clientCoords.x, clientCoords.y);
+    return GetClientCoords(aPresContext, aEvent, aPoint, CSSIntPoint(0, 0));
   }
 
   if (EventStateManager::sIsPointerLocked) {
@@ -922,19 +922,26 @@ Event::GetScreenCoords(nsPresContext* aPresContext,
         aEvent->mClass != eTouchEventClass &&
         aEvent->mClass != eDragEventClass &&
         aEvent->mClass != eSimpleGestureEventClass)) {
-    return LayoutDeviceIntPoint(0, 0);
+    return CSSIntPoint(0, 0);
   }
 
+  // Doing a straight conversion from LayoutDeviceIntPoint to CSSIntPoint
+  // seem incorrect, but it is needed to maintain legacy functionality.
+  if (!aPresContext) {
+    return CSSIntPoint(aPoint.x, aPoint.y);
+  }
+
+  LayoutDeviceIntPoint offset = aPoint;
+
   WidgetGUIEvent* guiEvent = aEvent->AsGUIEvent();
-  if (!guiEvent->widget) {
-    return aPoint;
+  if (guiEvent && guiEvent->widget) {
+    offset += guiEvent->widget->WidgetToScreenOffset();
   }
 
-  LayoutDeviceIntPoint offset = aPoint + guiEvent->widget->WidgetToScreenOffset();
-  nscoord factor =
-    aPresContext->DeviceContext()->AppUnitsPerDevPixelAtUnitFullZoom();
-  return LayoutDeviceIntPoint(nsPresContext::AppUnitsToIntCSSPixels(offset.x * factor),
-                              nsPresContext::AppUnitsToIntCSSPixels(offset.y * factor));
+  nsPoint pt =
+    LayoutDevicePixel::ToAppUnits(offset, aPresContext->DeviceContext()->AppUnitsPerDevPixelAtUnitFullZoom());
+
+  return CSSPixel::FromAppUnitsRounded(pt);
 }
 
 // static
diff --git a/dom/events/Event.h b/dom/events/Event.h
index cedb9795c2..2eb7700cdc 100644
--- a/dom/events/Event.h
+++ b/dom/events/Event.h
@@ -133,9 +133,9 @@ public:
                                    WidgetEvent* aEvent,
                                    LayoutDeviceIntPoint aPoint,
                                    CSSIntPoint aDefaultPoint);
-  static LayoutDeviceIntPoint GetScreenCoords(nsPresContext* aPresContext,
-                                              WidgetEvent* aEvent,
-                                              LayoutDeviceIntPoint aPoint);
+  static CSSIntPoint GetScreenCoords(nsPresContext* aPresContext,
+                                     WidgetEvent* aEvent,
+                                     LayoutDeviceIntPoint aPoint);
   static CSSIntPoint GetOffsetCoords(nsPresContext* aPresContext,
                                      WidgetEvent* aEvent,
                                      LayoutDeviceIntPoint aPoint,
diff --git a/dom/events/EventStateManager.cpp b/dom/events/EventStateManager.cpp
index 0bfe1934d8..fe89f93c4e 100644
--- a/dom/events/EventStateManager.cpp
+++ b/dom/events/EventStateManager.cpp
@@ -270,7 +270,7 @@ EventStateManager* EventStateManager::sActiveESM = nullptr;
 nsIDocument* EventStateManager::sMouseOverDocument = nullptr;
 nsWeakFrame EventStateManager::sLastDragOverFrame = nullptr;
 LayoutDeviceIntPoint EventStateManager::sLastRefPoint = kInvalidRefPoint;
-LayoutDeviceIntPoint EventStateManager::sLastScreenPoint = LayoutDeviceIntPoint(0, 0);
+CSSIntPoint EventStateManager::sLastScreenPoint = CSSIntPoint(0, 0);
 LayoutDeviceIntPoint EventStateManager::sSynthCenteringPoint = kInvalidRefPoint;
 CSSIntPoint EventStateManager::sLastClientPoint = CSSIntPoint(0, 0);
 bool EventStateManager::sIsPointerLocked = false;
@@ -556,9 +556,9 @@ EventStateManager::PreHandleEvent(nsPresContext* aPresContext,
        aEvent->mClass == eWheelEventClass) &&
       !sIsPointerLocked) {
     sLastScreenPoint =
-      UIEvent::CalculateScreenPoint(aPresContext, aEvent);
+      Event::GetScreenCoords(aPresContext, aEvent, aEvent->refPoint);
     sLastClientPoint =
-      UIEvent::CalculateClientPoint(aPresContext, aEvent, nullptr);
+      Event::GetClientCoords(aPresContext, aEvent, aEvent->refPoint, CSSIntPoint(0, 0));
   }
 
   *aStatus = nsEventStatus_eIgnore;
diff --git a/dom/events/EventStateManager.h b/dom/events/EventStateManager.h
index 77328a34e8..7d685aa6d3 100644
--- a/dom/events/EventStateManager.h
+++ b/dom/events/EventStateManager.h
@@ -250,7 +250,7 @@ public:
   // locked. This is used by dom::Event::GetScreenCoords() to make mouse
   // events' screen coord appear frozen at the last mouse position while
   // the pointer is locked.
-  static LayoutDeviceIntPoint sLastScreenPoint;
+  static CSSIntPoint sLastScreenPoint;
 
   // Holds the point in client coords of the last mouse event. Used by
   // dom::Event::GetClientCoords() to make mouse events' client coords appear
diff --git a/dom/events/Touch.cpp b/dom/events/Touch.cpp
index b93ae71a6c..35a4bb911a 100644
--- a/dom/events/Touch.cpp
+++ b/dom/events/Touch.cpp
@@ -32,7 +32,7 @@ Touch::Touch(EventTarget* aTarget,
   mTarget = aTarget;
   mIdentifier = aIdentifier;
   mPagePoint = CSSIntPoint(aPageX, aPageY);
-  mScreenPoint = LayoutDeviceIntPoint(aScreenX, aScreenY);
+  mScreenPoint = CSSIntPoint(aScreenX, aScreenY);
   mClientPoint = CSSIntPoint(aClientX, aClientY);
   mRefPoint = LayoutDeviceIntPoint(0, 0);
   mPointsInitialized = true;
@@ -48,13 +48,13 @@ Touch::Touch(EventTarget* aTarget,
 
 Touch::Touch(int32_t aIdentifier,
              LayoutDeviceIntPoint aPoint,
-             nsIntPoint aRadius,
+             LayoutDeviceIntPoint aRadius,
              float aRotationAngle,
              float aForce)
 {
   mIdentifier = aIdentifier;
   mPagePoint = CSSIntPoint(0, 0);
-  mScreenPoint = LayoutDeviceIntPoint(0, 0);
+  mScreenPoint = CSSIntPoint(0, 0);
   mClientPoint = CSSIntPoint(0, 0);
   mRefPoint = aPoint;
   mPointsInitialized = false;
@@ -67,6 +67,23 @@ Touch::Touch(int32_t aIdentifier,
   nsJSContext::LikelyShortLivingObjectCreated();
 }
 
+Touch::Touch(const Touch& aOther)
+  : mTarget(aOther.mTarget)
+  , mRefPoint(aOther.mRefPoint)
+  , mChanged(aOther.mChanged)
+  , mMessage(aOther.mMessage)
+  , mIdentifier(aOther.mIdentifier)
+  , mPagePoint(aOther.mPagePoint)
+  , mClientPoint(aOther.mClientPoint)
+  , mScreenPoint(aOther.mScreenPoint)
+  , mRadius(aOther.mRadius)
+  , mRotationAngle(aOther.mRotationAngle)
+  , mForce(aOther.mForce)
+  , mPointsInitialized(aOther.mPointsInitialized)
+{
+  nsJSContext::LikelyShortLivingObjectCreated();
+}
+
 Touch::~Touch()
 {
 }
diff --git a/dom/events/Touch.h b/dom/events/Touch.h
index f22aabe212..36db8c23b8 100644
--- a/dom/events/Touch.h
+++ b/dom/events/Touch.h
@@ -42,9 +42,10 @@ public:
         float aForce);
   Touch(int32_t aIdentifier,
         LayoutDeviceIntPoint aPoint,
-        nsIntPoint aRadius,
+        LayoutDeviceIntPoint aRadius,
         float aRotationAngle,
         float aForce);
+  Touch(const Touch& aOther);
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(Touch)
@@ -80,8 +81,8 @@ public:
   int32_t mIdentifier;
   CSSIntPoint mPagePoint;
   CSSIntPoint mClientPoint;
-  LayoutDeviceIntPoint mScreenPoint;
-  nsIntPoint mRadius;
+  CSSIntPoint mScreenPoint;
+  LayoutDeviceIntPoint mRadius;
   float mRotationAngle;
   float mForce;
 protected:
diff --git a/dom/events/TouchEvent.cpp b/dom/events/TouchEvent.cpp
index 38b184a876..c920822778 100644
--- a/dom/events/TouchEvent.cpp
+++ b/dom/events/TouchEvent.cpp
@@ -181,10 +181,10 @@ TouchEvent::PrefEnabled(JSContext* aCx, JSObject* aGlobal)
   int32_t flag = 0;
   if (NS_SUCCEEDED(Preferences::GetInt("dom.w3c_touch_events.enabled", &flag))) {
     if (flag == 2) {
-#ifdef XP_WIN
+#if defined(XP_WIN) || MOZ_WIDGET_GTK == 3
       static bool sDidCheckTouchDeviceSupport = false;
       static bool sIsTouchDeviceSupportPresent = false;
-      // On Windows we auto-detect based on device support.
+      // On Windows and GTK3 we auto-detect based on device support.
       if (!sDidCheckTouchDeviceSupport) {
         sDidCheckTouchDeviceSupport = true;
         sIsTouchDeviceSupportPresent = WidgetUtils::IsTouchDeviceSupportPresent();
diff --git a/dom/events/UIEvent.cpp b/dom/events/UIEvent.cpp
index 66877f5dfb..3bc1e318c9 100644
--- a/dom/events/UIEvent.cpp
+++ b/dom/events/UIEvent.cpp
@@ -342,11 +342,13 @@ UIEvent::DuplicatePrivateData()
   mPagePoint =
     Event::GetPageCoords(mPresContext, mEvent, mEvent->refPoint, mClientPoint);
   // GetScreenPoint converts mEvent->refPoint to right coordinates.
-  LayoutDeviceIntPoint screenPoint =
+  CSSIntPoint screenPoint =
     Event::GetScreenCoords(mPresContext, mEvent, mEvent->refPoint);
   nsresult rv = Event::DuplicatePrivateData();
   if (NS_SUCCEEDED(rv)) {
-    mEvent->refPoint = screenPoint;
+    CSSToLayoutDeviceScale scale = mPresContext ? mPresContext->CSSToDevPixelScale()
+                                                : CSSToLayoutDeviceScale(1);
+    mEvent->refPoint = RoundedToInt(screenPoint * scale);
   }
   return rv;
 }
diff --git a/dom/events/UIEvent.h b/dom/events/UIEvent.h
index 70dd05f3e4..1733d3bc86 100644
--- a/dom/events/UIEvent.h
+++ b/dom/events/UIEvent.h
@@ -40,62 +40,6 @@ public:
   NS_IMETHOD_(void) Serialize(IPC::Message* aMsg, bool aSerializeInterfaceType) override;
   NS_IMETHOD_(bool) Deserialize(const IPC::Message* aMsg, void** aIter) override;
 
-  static LayoutDeviceIntPoint CalculateScreenPoint(nsPresContext* aPresContext,
-                                                   WidgetEvent* aEvent)
-  {
-    if (!aEvent ||
-        (aEvent->mClass != eMouseEventClass &&
-         aEvent->mClass != eMouseScrollEventClass &&
-         aEvent->mClass != eWheelEventClass &&
-         aEvent->mClass != eDragEventClass &&
-         aEvent->mClass != ePointerEventClass &&
-         aEvent->mClass != eSimpleGestureEventClass)) {
-      return LayoutDeviceIntPoint(0, 0);
-    }
-
-    WidgetGUIEvent* event = aEvent->AsGUIEvent();
-    if (!event->widget) {
-      return aEvent->refPoint;
-    }
-
-    LayoutDeviceIntPoint offset = aEvent->refPoint + event->widget->WidgetToScreenOffset();
-    nscoord factor =
-      aPresContext->DeviceContext()->AppUnitsPerDevPixelAtUnitFullZoom();
-    return LayoutDeviceIntPoint(nsPresContext::AppUnitsToIntCSSPixels(offset.x * factor),
-                                nsPresContext::AppUnitsToIntCSSPixels(offset.y * factor));
-  }
-
-  static CSSIntPoint CalculateClientPoint(nsPresContext* aPresContext,
-                                          WidgetEvent* aEvent,
-                                          CSSIntPoint* aDefaultClientPoint)
-  {
-    if (!aEvent ||
-        (aEvent->mClass != eMouseEventClass &&
-         aEvent->mClass != eMouseScrollEventClass &&
-         aEvent->mClass != eWheelEventClass &&
-         aEvent->mClass != eDragEventClass &&
-         aEvent->mClass != ePointerEventClass &&
-         aEvent->mClass != eSimpleGestureEventClass) ||
-        !aPresContext ||
-        !aEvent->AsGUIEvent()->widget) {
-      return aDefaultClientPoint
-             ? *aDefaultClientPoint
-             : CSSIntPoint(0, 0);
-    }
-
-    nsIPresShell* shell = aPresContext->GetPresShell();
-    if (!shell) {
-      return CSSIntPoint(0, 0);
-    }
-    nsIFrame* rootFrame = shell->GetRootFrame();
-    if (!rootFrame) {
-      return CSSIntPoint(0, 0);
-    }
-    nsPoint pt =
-      nsLayoutUtils::GetEventCoordinatesRelativeTo(aEvent, rootFrame);
-
-    return CSSIntPoint::FromAppUnitsRounded(pt);
-  }
 
   static already_AddRefed<UIEvent> Constructor(const GlobalObject& aGlobal,
                                                const nsAString& aType,
diff --git a/dom/events/test/mochitest.ini b/dom/events/test/mochitest.ini
index 6aa87e4fb8..51e894c205 100644
--- a/dom/events/test/mochitest.ini
+++ b/dom/events/test/mochitest.ini
@@ -124,7 +124,6 @@ skip-if = toolkit == 'android' #CRASH_DUMP, RANDOM
 skip-if = toolkit == 'android' #CRASH_DUMP, RANDOM
 [test_bug704423.html]
 [test_bug741666.html]
-skip-if = toolkit == 'android'
 [test_bug742376.html]
 [test_bug812744.html]
 [test_bug855741.html]
diff --git a/dom/events/test/test_all_synthetic_events.html b/dom/events/test/test_all_synthetic_events.html
index d029f7ab31..710947a390 100644
--- a/dom/events/test/test_all_synthetic_events.html
+++ b/dom/events/test/test_all_synthetic_events.html
@@ -146,10 +146,6 @@ const kEventConstructors = {
                                                          return e;
                                                        },
                                              },
-  CSSFontFaceLoadEvent:                      { create: function (aName, aProps) {
-                                                         return new CSSFontFaceLoadEvent(aName, aProps);
-                                                       },
-                                             },
   CustomEvent:                               { create: function (aName, aProps) {
                                                          return new CustomEvent(aName, aProps);
                                                        },
@@ -223,6 +219,10 @@ const kEventConstructors = {
                                                          return new FocusEvent(aName, aProps);
                                                        },
                                              },
+  FontFaceSetLoadEvent:                      { create: function (aName, aProps) {
+                                                         return new FontFaceSetLoadEvent(aName, aProps);
+                                                       },
+                                             },
   GamepadEvent:                              { create: function (aName, aProps) {
                                                          return new GamepadEvent(aName, aProps);
                                                        },
diff --git a/dom/indexedDB/ActorsParent.cpp b/dom/indexedDB/ActorsParent.cpp
index ee9d4decb6..f053babcd6 100644
--- a/dom/indexedDB/ActorsParent.cpp
+++ b/dom/indexedDB/ActorsParent.cpp
@@ -146,11 +146,11 @@ class VersionChangeTransaction;
 
 // If JS_STRUCTURED_CLONE_VERSION changes then we need to update our major
 // schema version.
-static_assert(JS_STRUCTURED_CLONE_VERSION == 5,
+static_assert(JS_STRUCTURED_CLONE_VERSION == 6,
               "Need to update the major schema version.");
 
 // Major schema version. Bump for almost everything.
-const uint32_t kMajorSchemaVersion = 21;
+const uint32_t kMajorSchemaVersion = 22;
 
 // Minor schema version. Should almost always be 0 (maybe bump on release
 // branches if we have to).
@@ -1986,21 +1986,21 @@ private:
     }
 
     size_t compressedLength = snappy::MaxCompressedLength(uncompressedLength);
-    nsAutoArrayPtr<char> compressed(new (fallible) char[compressedLength]);
+    UniqueFreePtr<uint8_t> compressed(
+      static_cast<uint8_t*>(malloc(compressedLength)));
     if (NS_WARN_IF(!compressed)) {
       return NS_ERROR_OUT_OF_MEMORY;
     }
 
     snappy::RawCompress(reinterpret_cast<const char*>(uncompressed),
-                        uncompressedLength, compressed.get(),
+                        uncompressedLength,
+                        reinterpret_cast<char*>(compressed.get()),
                         &compressedLength);
 
-    std::pair<const void *, int> data(static_cast<void*>(compressed.get()),
-                                      int(compressedLength));
+    std::pair<uint8_t *, int> data(compressed.release(),
+                                   int(compressedLength));
 
-    // XXX This copies the buffer again... There doesn't appear to be any way to
-    //     preallocate space and write directly to a BlobVariant at the moment.
-    nsCOMPtr<nsIVariant> result = new mozilla::storage::BlobVariant(data);
+    nsCOMPtr<nsIVariant> result = new mozilla::storage::AdoptedBlobVariant(data);
 
     result.forget(aResult);
     return NS_OK;
@@ -4066,6 +4066,19 @@ UpgradeSchemaFrom20_0To21_0(mozIStorageConnection* aConnection)
   return NS_OK;
 }
 
+nsresult
+UpgradeSchemaFrom21_0To22_0(mozIStorageConnection* aConnection)
+{
+  // The only change between 21 and 22 was a different structured clone format,
+  // but it's backwards-compatible.
+  nsresult rv = aConnection->SetSchemaVersion(MakeSchemaVersion(22, 0));
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
+
+  return NS_OK;
+}
+
 nsresult
 GetDatabaseFileURL(nsIFile* aDatabaseFile,
                    PersistenceType aPersistenceType,
@@ -4558,7 +4571,7 @@ CreateStorageConnection(nsIFile* aDBFile,
       }
     } else  {
       // This logic needs to change next time we change the schema!
-      static_assert(kSQLiteSchemaVersion == int32_t((21 << 4) + 0),
+      static_assert(kSQLiteSchemaVersion == int32_t((22 << 4) + 0),
                     "Upgrade function needed due to schema version increase.");
 
       while (schemaVersion != kSQLiteSchemaVersion) {
@@ -4598,6 +4611,8 @@ CreateStorageConnection(nsIFile* aDBFile,
           rv = UpgradeSchemaFrom19_0To20_0(aFMDirectory, connection);
         } else if (schemaVersion == MakeSchemaVersion(20, 0)) {
           rv = UpgradeSchemaFrom20_0To21_0(connection);
+        } else if (schemaVersion == MakeSchemaVersion(21, 0)) {
+          rv = UpgradeSchemaFrom21_0To22_0(connection);
         } else {
           IDB_WARNING("Unable to open IndexedDB database, no upgrade path is "
                       "available!");
diff --git a/dom/indexedDB/test/file.js b/dom/indexedDB/test/file.js
index b0813c69d1..fd3365e00c 100644
--- a/dom/indexedDB/test/file.js
+++ b/dom/indexedDB/test/file.js
@@ -189,17 +189,7 @@ function grabFileUsageAndContinueHandler(usage, fileUsage)
 
 function getUsage(usageHandler)
 {
-  let principal = SpecialPowers.wrap(document).nodePrincipal;
-  let appId, inBrowser;
-  if (principal.appId != Components.interfaces.nsIPrincipal.UNKNOWN_APP_ID &&
-      principal.appId != Components.interfaces.nsIPrincipal.NO_APP_ID) {
-    appId = principal.appId;
-    inBrowser = principal.isInBrowserElement;
-  }
-  SpecialPowers.getStorageUsageForURI(window.document.documentURI,
-                                      usageHandler,
-                                      appId,
-                                      inBrowser);
+  SpecialPowers.getStorageUsageForDoc(SpecialPowers.wrap(document), usageHandler);
 }
 
 function getFileId(file)
diff --git a/dom/indexedDB/test/helpers.js b/dom/indexedDB/test/helpers.js
index cc10360f43..16c85c09f2 100644
--- a/dom/indexedDB/test/helpers.js
+++ b/dom/indexedDB/test/helpers.js
@@ -34,17 +34,10 @@ function executeSoon(aFun)
 }
 
 function clearAllDatabases(callback) {
-  let principal = SpecialPowers.wrap(document).nodePrincipal;
-  let appId, inBrowser;
-  if (principal.appId != Components.interfaces.nsIPrincipal.UNKNOWN_APP_ID &&
-      principal.appId != Components.interfaces.nsIPrincipal.NO_APP_ID) {
-    appId = principal.appId;
-    inBrowser = principal.isInBrowserElement;
-  }
-  SpecialPowers.clearStorageForURI(document.documentURI, callback, appId, inBrowser);
+  SpecialPowers.clearStorageForDoc(SpecialPowers.wrap(document), callback);
 }
 
-let testHarnessGenerator = testHarnessSteps();
+var testHarnessGenerator = testHarnessSteps();
 testHarnessGenerator.next();
 
 function testHarnessSteps() {
diff --git a/dom/indexedDB/test/webapp_clearBrowserData.js b/dom/indexedDB/test/webapp_clearBrowserData.js
index adf220f595..110fc0634d 100644
--- a/dom/indexedDB/test/webapp_clearBrowserData.js
+++ b/dom/indexedDB/test/webapp_clearBrowserData.js
@@ -117,11 +117,9 @@ function start()
   }
 
   SpecialPowers.addPermission("browser", true, document);
-  SpecialPowers.addPermission("browser", true, { manifestURL: manifestURL,
-                                                 isInBrowserElement: false });
+  SpecialPowers.addPermission("browser", true, { manifestURL: manifestURL });
   SpecialPowers.addPermission("embed-apps", true, document);
-  SpecialPowers.addPermission("indexedDB", true, { manifestURL: manifestURL,
-                                                   isInBrowserElement: false });
+  SpecialPowers.addPermission("indexedDB", true, { manifestURL: manifestURL });
 
   SpecialPowers.setAllAppsLaunchable(true);
 
diff --git a/dom/inputmethod/mochitest/test_bug1043828.html b/dom/inputmethod/mochitest/test_bug1043828.html
index 5325ab722a..17b374f711 100644
--- a/dom/inputmethod/mochitest/test_bug1043828.html
+++ b/dom/inputmethod/mochitest/test_bug1043828.html
@@ -91,8 +91,9 @@ function runTest() {
       allow: true,
       context: {
         url: imeUrl,
-        appId: SpecialPowers.Ci.nsIScriptSecurityManager.NO_APP_ID,
-        isInBrowserElement: true
+        originAttributes: {
+          inBrowser: true
+        }
       }
     }], function() {
       keyboardA.src = imeUrl;
diff --git a/dom/inputmethod/mochitest/test_bug944397.html b/dom/inputmethod/mochitest/test_bug944397.html
index afcfc099e0..9e4b045421 100644
--- a/dom/inputmethod/mochitest/test_bug944397.html
+++ b/dom/inputmethod/mochitest/test_bug944397.html
@@ -78,8 +78,9 @@ function runTest() {
       allow: true,
       context: {
         url: imeUrl,
-        appId: SpecialPowers.Ci.nsIScriptSecurityManager.NO_APP_ID,
-        isInBrowserElement: true
+        originAttributes: {
+          inBrowser: true
+        }
       }
     }], function() {
       // STEP 2c: Tell Gecko to use this iframe as its keyboard app
diff --git a/dom/interfaces/base/nsIServiceWorkerManager.idl b/dom/interfaces/base/nsIServiceWorkerManager.idl
index 0793e2dedf..85aedf1c1f 100644
--- a/dom/interfaces/base/nsIServiceWorkerManager.idl
+++ b/dom/interfaces/base/nsIServiceWorkerManager.idl
@@ -34,7 +34,7 @@ interface nsIServiceWorkerInfo : nsISupports
   readonly attribute DOMString waitingCacheName;
 };
 
-[scriptable, builtinclass, uuid(8fb9db4f-1d04-402b-9c37-542da06e03b9)]
+[scriptable, builtinclass, uuid(10f80c8c-7bf5-479e-a8d8-12ef50c802e8)]
 interface nsIServiceWorkerManager : nsISupports
 {
   /**
@@ -145,8 +145,6 @@ interface nsIServiceWorkerManager : nsISupports
                                      [optional, array, size_is(aDataLength)] in uint8_t aDataBytes);
   void sendPushSubscriptionChangeEvent(in ACString aOriginAttributes,
                                        in ACString scope);
-
-  void updateAllRegistrations();
 };
 
 %{ C++
diff --git a/dom/ipc/ContentChild.cpp b/dom/ipc/ContentChild.cpp
index 5a7fb4a93e..41b40355a7 100644
--- a/dom/ipc/ContentChild.cpp
+++ b/dom/ipc/ContentChild.cpp
@@ -78,7 +78,6 @@
 #include "nsIMutable.h"
 #include "nsIObserverService.h"
 #include "nsIScriptSecurityManager.h"
-#include "nsIServiceWorkerManager.h"
 #include "nsScreenManagerProxy.h"
 #include "nsMemoryInfoDumper.h"
 #include "nsServiceManagerUtils.h"
@@ -1417,16 +1416,6 @@ ContentChild::RecvBidiKeyboardNotify(const bool& aIsLangRTL)
     return true;
 }
 
-bool
-ContentChild::RecvUpdateServiceWorkerRegistrations()
-{
-    nsCOMPtr<nsIServiceWorkerManager> swm = mozilla::services::GetServiceWorkerManager();
-    if (swm) {
-        swm->UpdateAllRegistrations();
-    }
-    return true;
-}
-
 static CancelableTask* sFirstIdleTask;
 
 static void FirstIdle(void)
diff --git a/dom/ipc/ContentChild.h b/dom/ipc/ContentChild.h
index 587da7d47a..c721716e4a 100644
--- a/dom/ipc/ContentChild.h
+++ b/dom/ipc/ContentChild.h
@@ -320,8 +320,6 @@ public:
 
     virtual bool RecvBidiKeyboardNotify(const bool& isLangRTL) override;
 
-    virtual bool RecvUpdateServiceWorkerRegistrations() override;
-
     virtual bool RecvNotifyVisited(const URIParams& aURI) override;
     // auto remove when alertfinished is received.
     nsresult AddRemoteAlertObserver(const nsString& aData, nsIObserver* aObserver);
diff --git a/dom/ipc/PContent.ipdl b/dom/ipc/PContent.ipdl
index 64d470b101..a0f40588cc 100644
--- a/dom/ipc/PContent.ipdl
+++ b/dom/ipc/PContent.ipdl
@@ -511,8 +511,6 @@ child:
      */
     async BidiKeyboardNotify(bool isLangRTL);
 
-    async UpdateServiceWorkerRegistrations();
-
     async DataStoreNotify(uint32_t aAppId, nsString aName,
                           nsString aManifestURL);
 
diff --git a/dom/ipc/TabParent.cpp b/dom/ipc/TabParent.cpp
index 4d86913740..ce655c50e3 100644
--- a/dom/ipc/TabParent.cpp
+++ b/dom/ipc/TabParent.cpp
@@ -955,7 +955,7 @@ TabParent::UpdateDimensions(const nsIntRect& rect, const ScreenIntSize& size)
       ViewAs<LayoutDevicePixel>(mRect,
                                 PixelCastJustification::LayoutDeviceIsScreenForTabDims);
     LayoutDeviceIntSize devicePixelSize =
-      ViewAs<LayoutDevicePixel>(mDimensions.ToUnknownSize(),
+      ViewAs<LayoutDevicePixel>(mDimensions,
                                 PixelCastJustification::LayoutDeviceIsScreenForTabDims);
 
     CSSRect unscaledRect = devicePixelRect / widgetScale;
@@ -2891,11 +2891,13 @@ TabParent::InjectTouchEvent(const nsAString& aType,
         CSSPoint::ToAppUnits(CSSPoint(aXs[i], aYs[i])),
         presContext->AppUnitsPerDevPixel());
 
-    RefPtr<Touch> t = new Touch(aIdentifiers[i],
-                                  pt,
-                                  nsIntPoint(aRxs[i], aRys[i]),
-                                  aRotationAngles[i],
-                                  aForces[i]);
+    LayoutDeviceIntPoint radius =
+      LayoutDeviceIntPoint::FromAppUnitsRounded(
+        CSSPoint::ToAppUnits(CSSPoint(aRxs[i], aRys[i])),
+        presContext->AppUnitsPerDevPixel());
+
+    RefPtr<Touch> t =
+      new Touch(aIdentifiers[i], pt, radius, aRotationAngles[i], aForces[i]);
 
     // Consider all injected touch events as changedTouches. For more details
     // about the meaning of changedTouches for each event, see
diff --git a/dom/ipc/tests/test_permission_for_nested_oop_app.html b/dom/ipc/tests/test_permission_for_nested_oop_app.html
index 461ddd16ee..9992081348 100644
--- a/dom/ipc/tests/test_permission_for_nested_oop_app.html
+++ b/dom/ipc/tests/test_permission_for_nested_oop_app.html
@@ -33,8 +33,7 @@ var tests = [
   function() {
     var appId = gAppsService.getAppLocalIdByManifestURL(embedAppHostedManifestURL);
     var context = { url: embedApp.origin,
-                    appId: appId,
-                    isInBrowserElement: false };
+                    originAttributes: { appId: appId } };
     setupOpenAppPermission(context, runTests);
   },
 
diff --git a/dom/ipc/tests/test_permission_for_two_oop_apps.html b/dom/ipc/tests/test_permission_for_two_oop_apps.html
index 9e2182515f..7983191b27 100644
--- a/dom/ipc/tests/test_permission_for_two_oop_apps.html
+++ b/dom/ipc/tests/test_permission_for_two_oop_apps.html
@@ -33,8 +33,7 @@ var tests = [
   function() {
     var appId = gAppsService.getAppLocalIdByManifestURL(embedAppHostedManifestURL);
     var context = { url: embedApp.origin,
-                    appId: appId,
-                    isInBrowserElement: false };
+                    originAttributes: { appId: appId } };
     setupOpenAppPermission(context, runTests);
   },
 
diff --git a/dom/ipc/tests/test_permission_helper.js b/dom/ipc/tests/test_permission_helper.js
index 125da91390..6d2cc9f5d6 100644
--- a/dom/ipc/tests/test_permission_helper.js
+++ b/dom/ipc/tests/test_permission_helper.js
@@ -53,8 +53,7 @@ function test1() {
 
   if (!SpecialPowers.hasPermission( PERMISSION_TYPE,
                                     { url: APP_URL,
-                                      appId: appId,
-                                      isInBrowserElement: false })) {
+                                      originAttributes: { appId: appId }})) {
     errorHandler('[test 1] App should have permission: ' + PERMISSION_TYPE);
   }
 
@@ -82,8 +81,7 @@ function test2() {
 
   if (!SpecialPowers.hasPermission( PERMISSION_TYPE,
                                     { url: APP_URL,
-                                      appId: appId,
-                                      isInBrowserElement: false })) {
+                                      originAttributes: { appId: appId }})) {
     errorHandler('[test 2] App should have permission: ' + PERMISSION_TYPE);
   }
 
@@ -111,8 +109,7 @@ function test3() {
 
   if (!SpecialPowers.hasPermission(PERMISSION_TYPE,
                                    { url: APP_URL,
-                                     appId: appId,
-                                     isInBrowserElement: false })) {
+                                     originAttributes: { appId: appId }})) {
     errorHandler('[test 3] App should have permission: ' + PERMISSION_TYPE);
   }
 }
@@ -148,8 +145,7 @@ function test4() {
 
   if (!SpecialPowers.hasPermission(PERMISSION_TYPE,
                                    { url: APP_URL,
-                                     appId: appId,
-                                     isInBrowserElement: false })) {
+                                     originAttributes: { appId: appId }})) {
     errorHandler('[test 4] App should have permission: ' + PERMISSION_TYPE);
   }
 }
@@ -174,8 +170,7 @@ function test5() {
 
   if (!SpecialPowers.hasPermission( PERMISSION_TYPE,
                                     { url: APP_URL,
-                                      appId: appId,
-                                      isInBrowserElement: false })) {
+                                      originAttributes: { appId: appId }})) {
     errorHandler('[test 5] App should have permission: ' + PERMISSION_TYPE);
   }
 
@@ -290,8 +285,7 @@ function addPermissionToApp(appURL, manifestURL) {
         "expireType":permManager.EXPIRE_SESSION,
         "expireTime":now + SESSION_PERSIST_MINUTES*60*1000,
         "context": { url: appURL,
-                     appId: appId,
-                     isInBrowserElement:false }
+                     originAttributes: { appId: appId } }
       }
     ], function() {
       runTests();
@@ -303,8 +297,7 @@ function runNextIfAppHasPermission(round, expect, appURL, manifestURL) {
 
   var hasPerm = SpecialPowers.hasPermission(PERMISSION_TYPE,
                                             { url: appURL,
-                                              appId: appId,
-                                              isInBrowserElement: false });
+                                              originAttributes: { appId: appId }});
   var result = (expect==hasPerm);
   if (result) {
     runTests();
diff --git a/dom/ipc/tests/test_permission_when_oop_app_crashes.html b/dom/ipc/tests/test_permission_when_oop_app_crashes.html
index f1f5dd52bb..ea40aa3160 100644
--- a/dom/ipc/tests/test_permission_when_oop_app_crashes.html
+++ b/dom/ipc/tests/test_permission_when_oop_app_crashes.html
@@ -33,8 +33,7 @@ var tests = [
   function() {
     var appId = gAppsService.getAppLocalIdByManifestURL(embedAppHostedManifestURL);
     var context = { url: embedApp.origin,
-                    appId: appId,
-                    isInBrowserElement: false };
+                    originAttributes: { appId: appId } };
     setupOpenAppPermission(context, runTests);
   },
 
diff --git a/dom/media/AbstractMediaDecoder.h b/dom/media/AbstractMediaDecoder.h
index 3f61aa2c47..97461449f2 100644
--- a/dom/media/AbstractMediaDecoder.h
+++ b/dom/media/AbstractMediaDecoder.h
@@ -116,10 +116,6 @@ public:
   // Called from HTMLMediaElement when owner document activity changes
   virtual void SetElementVisibility(bool aIsVisible) {}
 
-  // Called by some MediaDecoderReader to determine if we can rely
-  // on the resource length to limit reads.
-  virtual bool HasInitializationData() { return false; }
-
   // Stack based class to assist in notifying the frame statistics of
   // parsed and decoded frames. Use inside video demux & decode functions
   // to ensure all parsed and decoded frames are reported on all return paths.
diff --git a/dom/media/MediaData.cpp b/dom/media/MediaData.cpp
index 99a3f0eebd..667c033e78 100644
--- a/dom/media/MediaData.cpp
+++ b/dom/media/MediaData.cpp
@@ -198,14 +198,14 @@ VideoData::ShallowCopyUpdateTimestampAndDuration(const VideoData* aOther,
 }
 
 /* static */
-void VideoData::SetVideoDataToImage(PlanarYCbCrImage* aVideoImage,
+bool VideoData::SetVideoDataToImage(PlanarYCbCrImage* aVideoImage,
                                     const VideoInfo& aInfo,
                                     const YCbCrBuffer &aBuffer,
                                     const IntRect& aPicture,
                                     bool aCopyData)
 {
   if (!aVideoImage) {
-    return;
+    return false;
   }
   const YCbCrBuffer::Plane &Y = aBuffer.mPlanes[0];
   const YCbCrBuffer::Plane &Cb = aBuffer.mPlanes[1];
@@ -229,9 +229,9 @@ void VideoData::SetVideoDataToImage(PlanarYCbCrImage* aVideoImage,
 
   aVideoImage->SetDelayedConversion(true);
   if (aCopyData) {
-    aVideoImage->SetData(data);
+    return aVideoImage->SetData(data);
   } else {
-    aVideoImage->SetDataNoCopy(data);
+    return aVideoImage->SetDataNoCopy(data);
   }
 }
 
@@ -330,12 +330,10 @@ VideoData::Create(const VideoInfo& aInfo,
                "Wrong format?");
   PlanarYCbCrImage* videoImage = static_cast<PlanarYCbCrImage*>(v->mImage.get());
 
-  if (!aImage) {
-    VideoData::SetVideoDataToImage(videoImage, aInfo, aBuffer, aPicture,
-                                   true /* aCopyData */);
-  } else {
-    VideoData::SetVideoDataToImage(videoImage, aInfo, aBuffer, aPicture,
-                                   false /* aCopyData */);
+  bool shouldCopyData = (aImage == nullptr);
+  if (!VideoData::SetVideoDataToImage(videoImage, aInfo, aBuffer, aPicture,
+                                      shouldCopyData)) {
+    return nullptr;
   }
 
 #ifdef MOZ_WIDGET_GONK
@@ -346,8 +344,10 @@ VideoData::Create(const VideoInfo& aInfo,
       return nullptr;
     }
     videoImage = static_cast<PlanarYCbCrImage*>(v->mImage.get());
-    VideoData::SetVideoDataToImage(videoImage, aInfo, aBuffer, aPicture,
-                                   true /* aCopyData */);
+    if(!VideoData::SetVideoDataToImage(videoImage, aInfo, aBuffer, aPicture,
+                                       true /* aCopyData */)) {
+      return nullptr;
+    }
   }
 #endif
   return v.forget();
@@ -473,7 +473,9 @@ VideoData::Create(const VideoInfo& aInfo,
   data.mPicSize = aPicture.Size();
   data.mGraphicBuffer = aBuffer;
 
-  videoImage->SetData(data);
+  if (!videoImage->SetData(data)) {
+    return nullptr;
+  }
 
   return v.forget();
 }
diff --git a/dom/media/MediaData.h b/dom/media/MediaData.h
index 82795a7559..6dc4f2ef61 100644
--- a/dom/media/MediaData.h
+++ b/dom/media/MediaData.h
@@ -283,7 +283,7 @@ public:
 
   // Initialize PlanarYCbCrImage. Only When aCopyData is true,
   // video data is copied to PlanarYCbCrImage.
-  static void SetVideoDataToImage(PlanarYCbCrImage* aVideoImage,
+  static bool SetVideoDataToImage(PlanarYCbCrImage* aVideoImage,
                                   const VideoInfo& aInfo,
                                   const YCbCrBuffer &aBuffer,
                                   const IntRect& aPicture,
@@ -334,6 +334,7 @@ public:
   nsTArray<nsCString> mSessionIds;
 };
 
+
 // MediaRawData is a MediaData container used to store demuxed, still compressed
 // samples.
 // Use MediaRawData::CreateWriter() to obtain a MediaRawDataWriter object that
diff --git a/dom/media/MediaDecoderStateMachine.cpp b/dom/media/MediaDecoderStateMachine.cpp
index b3b86a9d82..89e9ef7e8f 100644
--- a/dom/media/MediaDecoderStateMachine.cpp
+++ b/dom/media/MediaDecoderStateMachine.cpp
@@ -412,14 +412,17 @@ bool MediaDecoderStateMachine::HaveNextFrameData()
          (!HasVideo() || VideoQueue().GetSize() > 1);
 }
 
-int64_t MediaDecoderStateMachine::GetDecodedAudioDuration()
+int64_t
+MediaDecoderStateMachine::GetDecodedAudioDuration()
 {
   MOZ_ASSERT(OnTaskQueue());
-  int64_t audioDecoded = AudioQueue().Duration();
   if (mMediaSink->IsStarted()) {
-    audioDecoded += AudioEndTime() - GetMediaTime();
+    // |mDecodedAudioEndTime == -1| means no decoded audio at all so the
+    // returned duration is 0.
+    return mDecodedAudioEndTime != -1 ? mDecodedAudioEndTime - GetClock() : 0;
   }
-  return audioDecoded;
+  // MediaSink not started. All audio samples are in the queue.
+  return AudioQueue().Duration();
 }
 
 void MediaDecoderStateMachine::DiscardStreamData()
@@ -884,14 +887,16 @@ MediaDecoderStateMachine::OnVideoDecoded(MediaData* aVideoSample)
         StopPrerollingVideo();
       }
 
-      // Schedule the state machine to send stream data as soon as possible or
-      // the VideoQueue() is empty before the Push().
-      // VideoQueue() is empty implies the state machine thread doesn't have
-      // precise time information about video frames. Once the first video
-      // frame pushed in the queue, schedule the state machine as soon as
-      // possible to render the video frame or delay the state machine thread
-      // accurately.
-      if (VideoQueue().GetSize() == 1) {
+      // Schedule the state machine to send stream data as soon as possible if
+      // the VideoQueue() is empty or contains one frame before the Push().
+      //
+      // The state machine threads requires a frame in VideoQueue() that is `in
+      // the future` to gather precise timing information. The head of
+      // VideoQueue() is always `in the past`.
+      //
+      // Schedule the state machine as soon as possible to render the video
+      // frame or delay the state machine thread accurately.
+      if (VideoQueue().GetSize() <= 2) {
         ScheduleStateMachine();
       }
 
@@ -1806,12 +1811,6 @@ int64_t MediaDecoderStateMachine::AudioDecodedUsecs()
   // already decoded and pushed to the hardware, plus the amount of audio
   // data waiting to be pushed to the hardware.
   int64_t pushed = mMediaSink->IsStarted() ? (AudioEndTime() - GetMediaTime()) : 0;
-
-  // Currently for real time streams, AudioQueue().Duration() produce
-  // wrong values (Bug 1114434), so we use frame counts to calculate duration.
-  if (IsRealTime()) {
-    return pushed + FramesToUsecs(AudioQueue().FrameCount(), mInfo.mAudio.mRate).value();
-  }
   return pushed + AudioQueue().Duration();
 }
 
@@ -2412,6 +2411,9 @@ nsresult MediaDecoderStateMachine::RunStateMachine()
         clockTime = std::max(int64_t(0), std::max(clockTime, Duration().ToMicroseconds()));
         UpdatePlaybackPosition(clockTime);
 
+        // Ensure readyState is updated before firing the 'ended' event.
+        UpdateNextFrameStatus();
+
         nsCOMPtr<nsIRunnable> event =
           NS_NewRunnableMethod(mDecoder, &MediaDecoder::PlaybackEnded);
         AbstractThread::MainThread()->Dispatch(event.forget());
diff --git a/dom/media/MediaEventSource.h b/dom/media/MediaEventSource.h
index c7595682cd..cff00190e5 100644
--- a/dom/media/MediaEventSource.h
+++ b/dom/media/MediaEventSource.h
@@ -10,11 +10,13 @@
 #include "mozilla/AbstractThread.h"
 #include "mozilla/Atomics.h"
 #include "mozilla/Mutex.h"
+#include "mozilla/Tuple.h"
 #include "mozilla/TypeTraits.h"
 #include "mozilla/UniquePtr.h"
 
 #include "nsISupportsImpl.h"
 #include "nsTArray.h"
+#include "nsThreadUtils.h"
 
 namespace mozilla {
 
@@ -129,19 +131,25 @@ class ListenerHelper {
   // Define our custom runnable to minimize copy of the event data.
   // NS_NewRunnableFunction will result in 2 copies of the event data.
   // One is captured by the lambda and the other is the copy of the lambda.
-  template <typename T>
+  template <typename... Ts>
   class R : public nsRunnable {
-    typedef typename RemoveCV<typename RemoveReference<T>::Type>::Type ArgType;
   public:
-    template <typename U>
-    R(RevocableToken* aToken, const Function& aFunction, U&& aEvent)
-      : mToken(aToken), mFunction(aFunction), mEvent(Forward<U>(aEvent)) {}
+    template <typename... Us>
+    R(RevocableToken* aToken, const Function& aFunction, Us&&... aEvents)
+      : mToken(aToken)
+      , mFunction(aFunction)
+      , mEvents(Forward<Us>(aEvents)...) {}
+
+    template <typename... Vs, size_t... Is>
+    void Invoke(Tuple<Vs...>& aEvents, IndexSequence<Is...>) {
+      // Enable move whenever possible since mEvent won't be used anymore.
+      mFunction(Move(Get<Is>(aEvents))...);
+    }
 
     NS_IMETHOD Run() override {
       // Don't call the listener if it is disconnected.
       if (!mToken->IsRevoked()) {
-        // Enable move whenever possible since mEvent won't be used anymore.
-        mFunction(Move(mEvent));
+        Invoke(mEvents, typename IndexSequenceFor<Ts...>::Type());
       }
       return NS_OK;
     }
@@ -149,25 +157,29 @@ class ListenerHelper {
   private:
     RefPtr<RevocableToken> mToken;
     Function mFunction;
-    ArgType mEvent;
+
+    template <typename T>
+    using ArgType = typename RemoveCV<typename RemoveReference<T>::Type>::Type;
+    Tuple<ArgType<Ts>...> mEvents;
   };
 
 public:
   ListenerHelper(RevocableToken* aToken, Target* aTarget, const Function& aFunc)
     : mToken(aToken), mTarget(aTarget), mFunction(aFunc) {}
 
-  // |F| takes one argument.
-  template <typename F, typename T>
+  // |F| takes one or more arguments.
+  template <typename F, typename... Ts>
   typename EnableIf<TakeArgs<F>::value, void>::Type
-  Dispatch(const F& aFunc, T&& aEvent) {
-    nsCOMPtr<nsIRunnable> r = new R<T>(mToken, aFunc, Forward<T>(aEvent));
+  DispatchHelper(const F& aFunc, Ts&&... aEvents) {
+    nsCOMPtr<nsIRunnable> r =
+      new R<Ts...>(mToken, aFunc, Forward<Ts>(aEvents)...);
     EventTarget<Target>::Dispatch(mTarget.get(), r.forget());
   }
 
   // |F| takes no arguments. Don't bother passing aEvent.
-  template <typename F, typename T>
+  template <typename F, typename... Ts>
   typename EnableIf<!TakeArgs<F>::value, void>::Type
-  Dispatch(const F& aFunc, T&&) {
+  DispatchHelper(const F& aFunc, Ts&&...) {
     const RefPtr<RevocableToken>& token = mToken;
     nsCOMPtr<nsIRunnable> r = NS_NewRunnableFunction([=] () {
       // Don't call the listener if it is disconnected.
@@ -178,9 +190,9 @@ public:
     EventTarget<Target>::Dispatch(mTarget.get(), r.forget());
   }
 
-  template <typename T>
-  void Dispatch(T&& aEvent) {
-    Dispatch(mFunction, Forward<T>(aEvent));
+  template <typename... Ts>
+  void Dispatch(Ts&&... aEvents) {
+    DispatchHelper(mFunction, Forward<Ts>(aEvents)...);
   }
 
 private:
@@ -194,12 +206,10 @@ private:
  *
  * @Copy Data will always be copied. Each listener gets a copy.
  * @Move Data will always be moved.
- * @Both Data will be moved when possible or copied when necessary.
  */
 enum class EventPassMode : int8_t {
   Copy,
-  Move,
-  Both
+  Move
 };
 
 class ListenerBase {
@@ -220,96 +230,82 @@ private:
  * Since virtual methods can not be templated, this class is specialized
  * to provide different Dispatch() overloads depending on EventPassMode.
  */
-template <typename ArgType, EventPassMode Mode = EventPassMode::Copy>
+template <EventPassMode Mode, typename... As>
 class Listener : public ListenerBase {
 public:
   virtual ~Listener() {}
-  virtual void Dispatch(const ArgType& aEvent) = 0;
+  virtual void Dispatch(const As&... aEvents) = 0;
 };
 
-template <typename ArgType>
-class Listener<ArgType, EventPassMode::Both> : public ListenerBase {
+template <typename... As>
+class Listener<EventPassMode::Move, As...> : public ListenerBase {
 public:
   virtual ~Listener() {}
-  virtual void Dispatch(const ArgType& aEvent) = 0;
-  virtual void Dispatch(ArgType&& aEvent) = 0;
-};
-
-template <typename ArgType>
-class Listener<ArgType, EventPassMode::Move> : public ListenerBase {
-public:
-  virtual ~Listener() {}
-  virtual void Dispatch(ArgType&& aEvent) = 0;
+  virtual void Dispatch(As&&... aEvents) = 0;
 };
 
 /**
  * Store the registered target thread and function so it knows where and to
  * whom to send the event data.
  */
-template <typename Target, typename Function, typename ArgType, EventPassMode>
-class ListenerImpl : public Listener<ArgType, EventPassMode::Copy> {
+template <typename Target, typename Function, EventPassMode, typename... As>
+class ListenerImpl : public Listener<EventPassMode::Copy, As...> {
 public:
   ListenerImpl(Target* aTarget, const Function& aFunction)
     : mHelper(ListenerBase::Token(), aTarget, aFunction) {}
-  void Dispatch(const ArgType& aEvent) override {
-    mHelper.Dispatch(aEvent);
+  void Dispatch(const As&... aEvents) override {
+    mHelper.Dispatch(aEvents...);
   }
 private:
   ListenerHelper<Target, Function> mHelper;
 };
 
-template <typename Target, typename Function, typename ArgType>
-class ListenerImpl<Target, Function, ArgType, EventPassMode::Both>
-  : public Listener<ArgType, EventPassMode::Both> {
+template <typename Target, typename Function, typename... As>
+class ListenerImpl<Target, Function, EventPassMode::Move, As...>
+  : public Listener<EventPassMode::Move, As...> {
 public:
   ListenerImpl(Target* aTarget, const Function& aFunction)
     : mHelper(ListenerBase::Token(), aTarget, aFunction) {}
-  void Dispatch(const ArgType& aEvent) override {
-    mHelper.Dispatch(aEvent);
-  }
-  void Dispatch(ArgType&& aEvent) override {
-    mHelper.Dispatch(Move(aEvent));
-  }
-private:
-  ListenerHelper<Target, Function> mHelper;
-};
-
-template <typename Target, typename Function, typename ArgType>
-class ListenerImpl<Target, Function, ArgType, EventPassMode::Move>
-  : public Listener<ArgType, EventPassMode::Move> {
-public:
-  ListenerImpl(Target* aTarget, const Function& aFunction)
-    : mHelper(ListenerBase::Token(), aTarget, aFunction) {}
-  void Dispatch(ArgType&& aEvent) override {
-    mHelper.Dispatch(Move(aEvent));
+  void Dispatch(As&&... aEvents) override {
+    mHelper.Dispatch(Move(aEvents)...);
   }
 private:
   ListenerHelper<Target, Function> mHelper;
 };
 
 /**
- * Select EventPassMode based on ListenerMode and if the type is copyable.
+ * Select EventPassMode based on ListenerMode.
  *
  * @Copy Selected when ListenerMode is NonExclusive because each listener
  * must get a copy.
  *
- * @Move Selected when ListenerMode is Exclusive and the type is move-only.
- *
- * @Both Selected when ListenerMode is Exclusive and the type is copyable.
- * The data will be moved when possible and copied when necessary.
+ * @Move Selected when ListenerMode is Exclusive. All types passed to
+ * MediaEventProducer::Notify() must be movable.
  */
-template <typename ArgType, ListenerMode Mode>
+template <ListenerMode Mode>
 struct PassModePicker {
-  // TODO: pick EventPassMode::Both when we can detect if a type is
-  // copy-constructible to allow copy-only types in Exclusive mode.
   static const EventPassMode Value =
     Mode == ListenerMode::NonExclusive ?
     EventPassMode::Copy : EventPassMode::Move;
 };
 
+/**
+ * Return true if any type is a reference type.
+ */
+template <typename Head, typename... Tails>
+struct IsAnyReference {
+  static const bool value = IsReference<Head>::value ||
+                            IsAnyReference<Tails...>::value;
+};
+
+template <typename T>
+struct IsAnyReference<T> {
+  static const bool value = IsReference<T>::value;
+};
+
 } // namespace detail
 
-template <typename T, ListenerMode> class MediaEventSource;
+template <ListenerMode, typename... Ts> class MediaEventSourceImpl;
 
 /**
  * Not thread-safe since this is not meant to be shared and therefore only
@@ -318,8 +314,8 @@ template <typename T, ListenerMode> class MediaEventSource;
  * listener from an event source.
  */
 class MediaEventListener {
-  template <typename T, ListenerMode>
-  friend class MediaEventSource;
+  template <ListenerMode, typename... Ts>
+  friend class MediaEventSourceImpl;
 
 public:
   MediaEventListener() {}
@@ -342,6 +338,12 @@ public:
     mToken = nullptr;
   }
 
+  void DisconnectIfExists() {
+    if (mToken) {
+      Disconnect();
+    }
+  }
+
 private:
   // Avoid exposing RevocableToken directly to the client code so that
   // listeners can be disconnected in a controlled manner.
@@ -352,16 +354,22 @@ private:
 /**
  * A generic and thread-safe class to implement the observer pattern.
  */
-template <typename EventType, ListenerMode Mode = ListenerMode::NonExclusive>
-class MediaEventSource {
-  static_assert(!IsReference<EventType>::value, "Ref-type not supported!");
-  typedef typename detail::EventTypeTraits<EventType>::ArgType ArgType;
-  static const detail::EventPassMode PassMode
-    = detail::PassModePicker<ArgType, Mode>::Value;
-  typedef detail::Listener<ArgType, PassMode> Listener;
+template <ListenerMode Mode, typename... Es>
+class MediaEventSourceImpl {
+  static_assert(!detail::IsAnyReference<Es...>::value,
+                "Ref-type not supported!");
+
+  template <typename T>
+  using ArgType = typename detail::EventTypeTraits<T>::ArgType;
+
+  static const detail::EventPassMode PassMode =
+    detail::PassModePicker<Mode>::Value;
+
+  typedef detail::Listener<PassMode, ArgType<Es>...> Listener;
 
   template<typename Target, typename Func>
-  using ListenerImpl = detail::ListenerImpl<Target, Func, ArgType, PassMode>;
+  using ListenerImpl =
+    detail::ListenerImpl<Target, Func, PassMode, ArgType<Es>...>;
 
   template <typename Method>
   using TakeArgs = detail::TakeArgs<Method>;
@@ -376,13 +384,13 @@ class MediaEventSource {
     return MediaEventListener((*l)->Token());
   }
 
-  // |Method| takes one argument.
+  // |Method| takes one or more arguments.
   template <typename Target, typename This, typename Method>
   typename EnableIf<TakeArgs<Method>::value, MediaEventListener>::Type
   ConnectInternal(Target* aTarget, This* aThis, Method aMethod) {
     detail::RawPtr<This> thiz(aThis);
-    auto f = [=] (ArgType&& aEvent) {
-      (thiz.get()->*aMethod)(Move(aEvent));
+    auto f = [=] (ArgType<Es>&&... aEvents) {
+      (thiz.get()->*aMethod)(Move(aEvents)...);
     };
     return ConnectInternal(aTarget, f);
   }
@@ -443,10 +451,10 @@ public:
   }
 
 protected:
-  MediaEventSource() : mMutex("MediaEventSource::mMutex") {}
+  MediaEventSourceImpl() : mMutex("MediaEventSourceImpl::mMutex") {}
 
-  template <typename T>
-  void NotifyInternal(T&& aEvent) {
+  template <typename... Ts>
+  void NotifyInternal(Ts&&... aEvents) {
     MutexAutoLock lock(mMutex);
     for (int32_t i = mListeners.Length() - 1; i >= 0; --i) {
       auto&& l = mListeners[i];
@@ -456,7 +464,7 @@ protected:
         mListeners.RemoveElementAt(i);
         continue;
       }
-      l->Dispatch(Forward<T>(aEvent));
+      l->Dispatch(Forward<Ts>(aEvents)...);
     }
   }
 
@@ -465,17 +473,25 @@ private:
   nsTArray<UniquePtr<Listener>> mListeners;
 };
 
+template <typename... Es>
+using MediaEventSource =
+  MediaEventSourceImpl<ListenerMode::NonExclusive, Es...>;
+
+template <typename... Es>
+using MediaEventSourceExc =
+  MediaEventSourceImpl<ListenerMode::Exclusive, Es...>;
+
 /**
  * A class to separate the interface of event subject (MediaEventSource)
  * and event publisher. Mostly used as a member variable to publish events
  * to the listeners.
  */
-template <typename EventType, ListenerMode Mode = ListenerMode::NonExclusive>
-class MediaEventProducer : public MediaEventSource<EventType, Mode> {
+template <typename... Es>
+class MediaEventProducer : public MediaEventSource<Es...> {
 public:
-  template <typename T>
-  void Notify(T&& aEvent) {
-    this->NotifyInternal(Forward<T>(aEvent));
+  template <typename... Ts>
+  void Notify(Ts&&... aEvents) {
+    this->NotifyInternal(Forward<Ts>(aEvents)...);
   }
 };
 
@@ -491,6 +507,18 @@ public:
   }
 };
 
+/**
+ * A producer with Exclusive mode.
+ */
+template <typename... Es>
+class MediaEventProducerExc : public MediaEventSourceExc<Es...> {
+public:
+  template <typename... Ts>
+  void Notify(Ts&&... aEvents) {
+    this->NotifyInternal(Forward<Ts>(aEvents)...);
+  }
+};
+
 } // namespace mozilla
 
 #endif //MediaEventSource_h_
diff --git a/dom/media/MediaFormatReader.cpp b/dom/media/MediaFormatReader.cpp
index 5f87f6bb6b..4d97d49169 100644
--- a/dom/media/MediaFormatReader.cpp
+++ b/dom/media/MediaFormatReader.cpp
@@ -454,7 +454,8 @@ MediaFormatReader::RequestVideoData(bool aSkipToNextKeyframe,
 
   media::TimeUnit timeThreshold{media::TimeUnit::FromMicroseconds(aTimeThreshold)};
   if (ShouldSkip(aSkipToNextKeyframe, timeThreshold)) {
-    mVideo.mDecodingRequested = false;
+    // Cancel any pending demux request.
+    mVideo.mDemuxRequest.DisconnectIfExists();
     Flush(TrackInfo::kVideoTrack);
     RefPtr<VideoDataPromise> p = mVideo.mPromise.Ensure(__func__);
     SkipVideoDemuxToNextKeyFrame(timeThreshold);
@@ -584,6 +585,7 @@ MediaFormatReader::NotifyNewOutput(TrackType aTrack, MediaData* aSample)
   }
   decoder.mOutput.AppendElement(aSample);
   decoder.mNumSamplesOutput++;
+  decoder.mNumSamplesOutputTotal++;
   ScheduleUpdate(aTrack);
 }
 
@@ -602,6 +604,7 @@ MediaFormatReader::NotifyDrainComplete(TrackType aTrack)
 {
   MOZ_ASSERT(OnTaskQueue());
   auto& decoder = GetDecoderData(aTrack);
+  LOG("%s", TrackTypeToStr(aTrack));
   if (!decoder.mOutputRequested) {
     LOG("MediaFormatReader called DrainComplete() before flushing, ignoring.");
     return;
@@ -824,19 +827,20 @@ MediaFormatReader::HandleDemuxedSamples(TrackType aTrack,
       decoder.mDecoder = nullptr;
       if (sample->mKeyframe) {
         decoder.mQueuedSamples.AppendElements(Move(samples));
-        ScheduleUpdate(aTrack);
+        NotifyDecodingRequested(aTrack);
       } else {
         MOZ_ASSERT(decoder.mTimeThreshold.isNothing());
         LOG("Stream change occurred on a non-keyframe. Seeking to:%lld",
             sample->mTime);
         decoder.mTimeThreshold = Some(TimeUnit::FromMicroseconds(sample->mTime));
         RefPtr<MediaFormatReader> self = this;
+        decoder.ResetDemuxer();
         decoder.mSeekRequest.Begin(decoder.mTrackDemuxer->Seek(decoder.mTimeThreshold.ref())
                    ->Then(OwnerThread(), __func__,
                           [self, aTrack] (media::TimeUnit aTime) {
                             auto& decoder = self->GetDecoderData(aTrack);
                             decoder.mSeekRequest.Complete();
-                            self->ScheduleUpdate(aTrack);
+                            self->NotifyDecodingRequested(aTrack);
                           },
                           [self, aTrack] (DemuxerFailureReason aResult) {
                             auto& decoder = self->GetDecoderData(aTrack);
@@ -919,7 +923,7 @@ MediaFormatReader::Update(TrackType aTrack)
 {
   MOZ_ASSERT(OnTaskQueue());
 
-  if (mShutdown || !mInitDone) {
+  if (mShutdown) {
     return;
   }
 
@@ -951,9 +955,9 @@ MediaFormatReader::Update(TrackType aTrack)
 
   if (aTrack == TrackInfo::kVideoTrack) {
     uint64_t delta =
-      decoder.mNumSamplesOutput - mLastReportedNumDecodedFrames;
+      decoder.mNumSamplesOutputTotal - mLastReportedNumDecodedFrames;
     a.mDecoded = static_cast<uint32_t>(delta);
-    mLastReportedNumDecodedFrames = decoder.mNumSamplesOutput;
+    mLastReportedNumDecodedFrames = decoder.mNumSamplesOutputTotal;
   }
 
   if (decoder.HasPromise()) {
@@ -1281,11 +1285,14 @@ MediaFormatReader::Seek(int64_t aTime, int64_t aUnused)
     return SeekPromise::CreateAndReject(NS_ERROR_FAILURE, __func__);
   }
 
-  mPendingSeekTime.emplace(media::TimeUnit::FromMicroseconds(aTime));
+  mOriginalSeekTime = Some(media::TimeUnit::FromMicroseconds(aTime));
+  mPendingSeekTime = mOriginalSeekTime;
 
   RefPtr<SeekPromise> p = mSeekPromise.Ensure(__func__);
 
-  AttemptSeek();
+  RefPtr<nsIRunnable> task(
+    NS_NewRunnableMethod(this, &MediaFormatReader::AttemptSeek));
+  OwnerThread()->Dispatch(task.forget());
 
   return p;
 }
@@ -1294,6 +1301,13 @@ void
 MediaFormatReader::AttemptSeek()
 {
   MOZ_ASSERT(OnTaskQueue());
+  if (mPendingSeekTime.isNothing()) {
+    return;
+  }
+  // An internal seek may be pending due to Seek queueing multiple tasks calling
+  // AttemptSeek ; we can ignore those by resetting any pending demuxer's seek.
+  mAudio.mSeekRequest.DisconnectIfExists();
+  mVideo.mSeekRequest.DisconnectIfExists();
   if (HasVideo()) {
     DoVideoSeek();
   } else if (HasAudio()) {
@@ -1315,6 +1329,34 @@ MediaFormatReader::OnSeekFailed(TrackType aTrack, DemuxerFailureReason aResult)
   }
 
   if (aResult == DemuxerFailureReason::WAITING_FOR_DATA) {
+    if (HasVideo() && aTrack == TrackType::kAudioTrack &&
+        mOriginalSeekTime.isSome() &&
+        mPendingSeekTime.ref() != mOriginalSeekTime.ref()) {
+      // We have failed to seek audio where video seeked to earlier.
+      // Attempt to seek instead to the closest point that we know we have in
+      // order to limit A/V sync discrepency.
+
+      // Ensure we have the most up to date buffered ranges.
+      UpdateReceivedNewData(TrackType::kAudioTrack);
+      Maybe<media::TimeUnit> nextSeekTime;
+      // Find closest buffered time found after video seeked time.
+      for (const auto& timeRange : mAudio.mTimeRanges) {
+        if (timeRange.mStart >= mPendingSeekTime.ref()) {
+          nextSeekTime.emplace(timeRange.mStart);
+          break;
+        }
+      }
+      if (nextSeekTime.isNothing() ||
+          nextSeekTime.ref() > mOriginalSeekTime.ref()) {
+        nextSeekTime = mOriginalSeekTime;
+        LOG("Unable to seek audio to video seek time. A/V sync may be broken");
+      } else {
+        mOriginalSeekTime.reset();
+      }
+      mPendingSeekTime = nextSeekTime;
+      DoAudioSeek();
+      return;
+    }
     NotifyWaitingForData(aTrack);
     return;
   }
@@ -1343,6 +1385,7 @@ MediaFormatReader::OnVideoSeekCompleted(media::TimeUnit aTime)
 
   if (HasAudio()) {
     MOZ_ASSERT(mPendingSeekTime.isSome());
+    mPendingSeekTime = Some(aTime);
     DoAudioSeek();
   } else {
     mPendingSeekTime.reset();
diff --git a/dom/media/MediaFormatReader.h b/dom/media/MediaFormatReader.h
index 054ec57b92..5b3df155fb 100644
--- a/dom/media/MediaFormatReader.h
+++ b/dom/media/MediaFormatReader.h
@@ -208,6 +208,7 @@ private:
       , mDrainComplete(false)
       , mNumSamplesInput(0)
       , mNumSamplesOutput(0)
+      , mNumSamplesOutputTotal(0)
       , mSizeOfQueue(0)
       , mIsHardwareAccelerated(false)
       , mLastStreamSourceID(UINT32_MAX)
@@ -267,6 +268,7 @@ private:
     nsTArray<RefPtr<MediaData>> mOutput;
     uint64_t mNumSamplesInput;
     uint64_t mNumSamplesOutput;
+    uint64_t mNumSamplesOutputTotal;
 
     // These get overriden in the templated concrete class.
     // Indicate if we have a pending promise for decoded frame.
@@ -290,6 +292,7 @@ private:
       mReceivedNewData = false;
       mDiscontinuity = true;
       mQueuedSamples.Clear();
+      mDecodingRequested = false;
       mOutputRequested = false;
       mInputExhausted = false;
       mNeedDraining = false;
@@ -299,6 +302,7 @@ private:
       mOutput.Clear();
       mNumSamplesInput = 0;
       mNumSamplesOutput = 0;
+      mSizeOfQueue = 0;
       mNextStreamSourceID.reset();
     }
 
@@ -421,6 +425,7 @@ private:
     OnSeekFailed(TrackType::kAudioTrack, aFailure);
   }
   // Temporary seek information while we wait for the data
+  Maybe<media::TimeUnit> mOriginalSeekTime;
   Maybe<media::TimeUnit> mPendingSeekTime;
   MozPromiseHolder<SeekPromise> mSeekPromise;
 
diff --git a/dom/media/MediaMetadataManager.h b/dom/media/MediaMetadataManager.h
index 1f126c494c..f875353a65 100644
--- a/dom/media/MediaMetadataManager.h
+++ b/dom/media/MediaMetadataManager.h
@@ -19,10 +19,8 @@
 namespace mozilla {
 
 class TimedMetadata;
-typedef MediaEventProducer<TimedMetadata, ListenerMode::Exclusive>
-        TimedMetadataEventProducer;
-typedef MediaEventSource<TimedMetadata, ListenerMode::Exclusive>
-        TimedMetadataEventSource;
+typedef MediaEventProducerExc<TimedMetadata> TimedMetadataEventProducer;
+typedef MediaEventSourceExc<TimedMetadata> TimedMetadataEventSource;
 
 // A struct that contains the metadata of a media, and the time at which those
 // metadata should start to be reported.
diff --git a/dom/media/VideoSegment.cpp b/dom/media/VideoSegment.cpp
index adc8995d68..7ac47b5c90 100644
--- a/dom/media/VideoSegment.cpp
+++ b/dom/media/VideoSegment.cpp
@@ -80,7 +80,10 @@ VideoFrame::CreateBlackImage(const gfx::IntSize& aSize)
   data.mStereoMode = StereoMode::MONO;
 
   // SetData copies data, so we can free data.
-  planar->SetData(data);
+  if (!planar->SetData(data)) {
+    MOZ_ASSERT(false);
+    return nullptr;
+  }
 
   return image.forget();
 }
diff --git a/dom/media/XiphExtradata.cpp b/dom/media/XiphExtradata.cpp
new file mode 100644
index 0000000000..6a5765a9ee
--- /dev/null
+++ b/dom/media/XiphExtradata.cpp
@@ -0,0 +1,80 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "XiphExtradata.h"
+
+namespace mozilla {
+
+bool XiphHeadersToExtradata(MediaByteBuffer* aCodecSpecificConfig,
+                            const nsTArray<const unsigned char*>& aHeaders,
+                            const nsTArray<size_t>& aHeaderLens)
+{
+  size_t nheaders = aHeaders.Length();
+  if (!nheaders || nheaders > 255) return false;
+  aCodecSpecificConfig->AppendElement(nheaders - 1);
+  for (size_t i = 0; i < nheaders - 1; i++) {
+    size_t headerLen;
+    for (headerLen = aHeaderLens[i]; headerLen >= 255; headerLen -= 255) {
+      aCodecSpecificConfig->AppendElement(255);
+    }
+    aCodecSpecificConfig->AppendElement(headerLen);
+  }
+  for (size_t i = 0; i < nheaders; i++) {
+    aCodecSpecificConfig->AppendElements(aHeaders[i], aHeaderLens[i]);
+  }
+  return true;
+}
+
+bool XiphExtradataToHeaders(nsTArray<unsigned char*>& aHeaders,
+                            nsTArray<size_t>& aHeaderLens,
+                            unsigned char* aData,
+                            size_t aAvailable)
+{
+  size_t total = 0;
+  if (aAvailable < 1) {
+    return false;
+  }
+  aAvailable--;
+  int nHeaders = *aData++ + 1;
+  for (int i = 0; i < nHeaders - 1; i++) {
+    size_t headerLen = 0;
+    for (;;) {
+      // After this test, we know that (aAvailable - total > headerLen) and
+      // (headerLen >= 0) so (aAvailable - total > 0). The loop decrements
+      // aAvailable by 1 and total remains fixed, so we know that in the next
+      // iteration (aAvailable - total >= 0). Thus (aAvailable - total) can
+      // never underflow.
+      if (aAvailable - total <= headerLen) {
+        return false;
+      }
+      // Since we know (aAvailable > total + headerLen), this can't overflow
+      // unless total is near 0 and both aAvailable and headerLen are within
+      // 255 bytes of the maximum representable size. However, that is
+      // impossible, since we would have had to have gone through this loop
+      // more than 255 times to make headerLen that large, and thus decremented
+      // aAvailable more than 255 times.
+      headerLen += *aData;
+      aAvailable--;
+      if (*aData++ != 255) break;
+    }
+    // And this check ensures updating total won't cause (aAvailable - total)
+    // to underflow.
+    if (aAvailable - total < headerLen) {
+      return false;
+    }
+    aHeaderLens.AppendElement(headerLen);
+    // Since we know aAvailable >= total + headerLen, this can't overflow.
+    total += headerLen;
+  }
+  aHeaderLens.AppendElement(aAvailable - total);
+  for (int i = 0; i < nHeaders; i++) {
+    aHeaders.AppendElement(aData);
+    aData += aHeaderLens[i];
+  }
+  return true;
+}
+
+} // namespace mozilla
diff --git a/dom/media/XiphExtradata.h b/dom/media/XiphExtradata.h
new file mode 100644
index 0000000000..5a9cbba782
--- /dev/null
+++ b/dom/media/XiphExtradata.h
@@ -0,0 +1,28 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#if !defined(XiphExtradata_h)
+#define XiphExtradata_h
+
+#include "MediaData.h"
+
+namespace mozilla {
+
+/* This converts a list of headers to the canonical form of extradata for Xiph
+   codecs in non-Ogg containers. We use it to pass those headers from demuxer
+   to decoder even when demuxing from an Ogg cotainer. */
+bool XiphHeadersToExtradata(MediaByteBuffer* aCodecSpecificConfig,
+                            const nsTArray<const unsigned char*>& aHeaders,
+                            const nsTArray<size_t>& aHeaderLens);
+
+/* This converts a set of extradata back into a list of headers. */
+bool XiphExtradataToHeaders(nsTArray<unsigned char*>& aHeaders,
+                            nsTArray<size_t>& aHeaderLens,
+                            unsigned char* aData,
+                            size_t aAvailable);
+
+} // namespace mozilla
+
+#endif // XiphExtradata_h
diff --git a/dom/media/encoder/VP8TrackEncoder.cpp b/dom/media/encoder/VP8TrackEncoder.cpp
index cd736e75c3..96aeeaeec6 100644
--- a/dom/media/encoder/VP8TrackEncoder.cpp
+++ b/dom/media/encoder/VP8TrackEncoder.cpp
@@ -4,14 +4,16 @@
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "VP8TrackEncoder.h"
-#include "vpx/vp8cx.h"
-#include "vpx/vpx_encoder.h"
+#include "GeckoProfiler.h"
+#include "LayersLogging.h"
+#include "libyuv.h"
+#include "mozilla/gfx/2D.h"
+#include "prsystem.h"
 #include "VideoSegment.h"
 #include "VideoUtils.h"
-#include "prsystem.h"
+#include "vpx/vp8cx.h"
+#include "vpx/vpx_encoder.h"
 #include "WebMWriter.h"
-#include "libyuv.h"
-#include "GeckoProfiler.h"
 
 namespace mozilla {
 
@@ -23,6 +25,7 @@ PRLogModuleInfo* gVP8TrackEncoderLog;
 #define DEFAULT_BITRATE_BPS 2500000
 #define DEFAULT_ENCODE_FRAMERATE 30
 
+using namespace mozilla::gfx;
 using namespace mozilla::layers;
 
 VP8TrackEncoder::VP8TrackEncoder()
@@ -259,91 +262,177 @@ nsresult VP8TrackEncoder::PrepareRawFrame(VideoChunk &aChunk)
     img = aChunk.mFrame.GetImage();
   }
 
+  if (img->GetSize() != IntSize(mFrameWidth, mFrameHeight)) {
+    VP8LOG("Dynamic resolution changes (was %dx%d, now %dx%d) are unsupported\n",
+           mFrameWidth, mFrameHeight, img->GetSize().width, img->GetSize().height);
+    return NS_ERROR_FAILURE;
+  }
+
   ImageFormat format = img->GetFormat();
-  if (format != ImageFormat::PLANAR_YCBCR) {
-    VP8LOG("Unsupported video format\n");
-    return NS_ERROR_FAILURE;
-  }
+  if (format == ImageFormat::PLANAR_YCBCR) {
+    PlanarYCbCrImage* yuv = static_cast<PlanarYCbCrImage *>(img.get());
 
-  // Cast away constness b/c some of the accessors are non-const
-  PlanarYCbCrImage* yuv =
-  const_cast<PlanarYCbCrImage *>(static_cast<const PlanarYCbCrImage *>(img.get()));
-  // Big-time assumption here that this is all contiguous data coming
-  // from getUserMedia or other sources.
-  MOZ_ASSERT(yuv);
-  if (!yuv->IsValid()) {
-    NS_WARNING("PlanarYCbCrImage is not valid");
-    return NS_ERROR_FAILURE;
-  }
-  const PlanarYCbCrImage::Data *data = yuv->GetData();
-
-  if (isYUV420(data) && !data->mCbSkip) { // 420 planar
-    mVPXImageWrapper->planes[VPX_PLANE_Y] = data->mYChannel;
-    mVPXImageWrapper->planes[VPX_PLANE_U] = data->mCbChannel;
-    mVPXImageWrapper->planes[VPX_PLANE_V] = data->mCrChannel;
-    mVPXImageWrapper->stride[VPX_PLANE_Y] = data->mYStride;
-    mVPXImageWrapper->stride[VPX_PLANE_U] = data->mCbCrStride;
-    mVPXImageWrapper->stride[VPX_PLANE_V] = data->mCbCrStride;
-  } else {
-    uint32_t yPlaneSize = mFrameWidth * mFrameHeight;
-    uint32_t halfWidth = (mFrameWidth + 1) / 2;
-    uint32_t halfHeight = (mFrameHeight + 1) / 2;
-    uint32_t uvPlaneSize = halfWidth * halfHeight;
-    if (mI420Frame.IsEmpty()) {
-      mI420Frame.SetLength(yPlaneSize + uvPlaneSize * 2);
+    MOZ_ASSERT(yuv);
+    if (!yuv->IsValid()) {
+      NS_WARNING("PlanarYCbCrImage is not valid");
+      return NS_ERROR_FAILURE;
     }
+    const PlanarYCbCrImage::Data *data = yuv->GetData();
 
-    MOZ_ASSERT(mI420Frame.Length() >= (yPlaneSize + uvPlaneSize * 2));
-    uint8_t *y = mI420Frame.Elements();
-    uint8_t *cb = mI420Frame.Elements() + yPlaneSize;
-    uint8_t *cr = mI420Frame.Elements() + yPlaneSize + uvPlaneSize;
+    if (isYUV420(data) && !data->mCbSkip) {
+      // 420 planar, no need for conversions
+      mVPXImageWrapper->planes[VPX_PLANE_Y] = data->mYChannel;
+      mVPXImageWrapper->planes[VPX_PLANE_U] = data->mCbChannel;
+      mVPXImageWrapper->planes[VPX_PLANE_V] = data->mCrChannel;
+      mVPXImageWrapper->stride[VPX_PLANE_Y] = data->mYStride;
+      mVPXImageWrapper->stride[VPX_PLANE_U] = data->mCbCrStride;
+      mVPXImageWrapper->stride[VPX_PLANE_V] = data->mCbCrStride;
 
+      return NS_OK;
+    }
+  }
+
+  // Not 420 planar, have to convert
+  uint32_t yPlaneSize = mFrameWidth * mFrameHeight;
+  uint32_t halfWidth = (mFrameWidth + 1) / 2;
+  uint32_t halfHeight = (mFrameHeight + 1) / 2;
+  uint32_t uvPlaneSize = halfWidth * halfHeight;
+
+  if (mI420Frame.IsEmpty()) {
+    mI420Frame.SetLength(yPlaneSize + uvPlaneSize * 2);
+  }
+
+  uint8_t *y = mI420Frame.Elements();
+  uint8_t *cb = mI420Frame.Elements() + yPlaneSize;
+  uint8_t *cr = mI420Frame.Elements() + yPlaneSize + uvPlaneSize;
+
+  if (format == ImageFormat::PLANAR_YCBCR) {
+    PlanarYCbCrImage* yuv = static_cast<PlanarYCbCrImage *>(img.get());
+
+    MOZ_ASSERT(yuv);
+    if (!yuv->IsValid()) {
+      NS_WARNING("PlanarYCbCrImage is not valid");
+      return NS_ERROR_FAILURE;
+    }
+    const PlanarYCbCrImage::Data *data = yuv->GetData();
+
+    int rv;
+    std::string yuvFormat;
     if (isYUV420(data) && data->mCbSkip) {
       // If mCbSkip is set, we assume it's nv12 or nv21.
       if (data->mCbChannel < data->mCrChannel) { // nv12
-        libyuv::NV12ToI420(data->mYChannel, data->mYStride,
-                           data->mCbChannel, data->mCbCrStride,
-                           y, mFrameWidth,
-                           cb, halfWidth,
-                           cr, halfWidth,
-                           mFrameWidth, mFrameHeight);
+        rv = libyuv::NV12ToI420(data->mYChannel, data->mYStride,
+                                data->mCbChannel, data->mCbCrStride,
+                                y, mFrameWidth,
+                                cb, halfWidth,
+                                cr, halfWidth,
+                                mFrameWidth, mFrameHeight);
+        yuvFormat = "NV12";
       } else { // nv21
-        libyuv::NV21ToI420(data->mYChannel, data->mYStride,
-                           data->mCrChannel, data->mCbCrStride,
-                           y, mFrameWidth,
-                           cb, halfWidth,
-                           cr, halfWidth,
-                           mFrameWidth, mFrameHeight);
+        rv = libyuv::NV21ToI420(data->mYChannel, data->mYStride,
+                                data->mCrChannel, data->mCbCrStride,
+                                y, mFrameWidth,
+                                cb, halfWidth,
+                                cr, halfWidth,
+                                mFrameWidth, mFrameHeight);
+        yuvFormat = "NV21";
       }
     } else if (isYUV444(data) && !data->mCbSkip) {
-      libyuv::I444ToI420(data->mYChannel, data->mYStride,
-                         data->mCbChannel, data->mCbCrStride,
-                         data->mCrChannel, data->mCbCrStride,
-                         y, mFrameWidth,
-                         cb, halfWidth,
-                         cr, halfWidth,
-                         mFrameWidth, mFrameHeight);
+      rv = libyuv::I444ToI420(data->mYChannel, data->mYStride,
+                              data->mCbChannel, data->mCbCrStride,
+                              data->mCrChannel, data->mCbCrStride,
+                              y, mFrameWidth,
+                              cb, halfWidth,
+                              cr, halfWidth,
+                              mFrameWidth, mFrameHeight);
+      yuvFormat = "I444";
     } else if (isYUV422(data) && !data->mCbSkip) {
-      libyuv::I422ToI420(data->mYChannel, data->mYStride,
-                         data->mCbChannel, data->mCbCrStride,
-                         data->mCrChannel, data->mCbCrStride,
-                         y, mFrameWidth,
-                         cb, halfWidth,
-                         cr, halfWidth,
-                         mFrameWidth, mFrameHeight);
+      rv = libyuv::I422ToI420(data->mYChannel, data->mYStride,
+                              data->mCbChannel, data->mCbCrStride,
+                              data->mCrChannel, data->mCbCrStride,
+                              y, mFrameWidth,
+                              cb, halfWidth,
+                              cr, halfWidth,
+                              mFrameWidth, mFrameHeight);
+      yuvFormat = "I422";
     } else {
       VP8LOG("Unsupported planar format\n");
       return NS_ERROR_NOT_IMPLEMENTED;
     }
 
-    mVPXImageWrapper->planes[VPX_PLANE_Y] = y;
-    mVPXImageWrapper->planes[VPX_PLANE_U] = cb;
-    mVPXImageWrapper->planes[VPX_PLANE_V] = cr;
-    mVPXImageWrapper->stride[VPX_PLANE_Y] = mFrameWidth;
-    mVPXImageWrapper->stride[VPX_PLANE_U] = halfWidth;
-    mVPXImageWrapper->stride[VPX_PLANE_V] = halfWidth;
+    if (rv != 0) {
+      VP8LOG("Converting an %s frame to I420 failed\n", yuvFormat.c_str());
+      return NS_ERROR_FAILURE;
+    }
+
+    VP8LOG("Converted an %s frame to I420\n");
+  } else {
+    // Not YCbCr at all. Try to get access to the raw data and convert.
+
+    RefPtr<SourceSurface> surf = img->GetAsSourceSurface();
+    if (!surf) {
+      VP8LOG("Getting surface from %s image failed\n", Stringify(format).c_str());
+      return NS_ERROR_FAILURE;
+    }
+
+    RefPtr<DataSourceSurface> data = surf->GetDataSurface();
+    if (!data) {
+      VP8LOG("Getting data surface from %s image with %s (%s) surface failed\n",
+             Stringify(format).c_str(), Stringify(surf->GetType()).c_str(),
+             Stringify(surf->GetFormat()).c_str());
+      return NS_ERROR_FAILURE;
+    }
+
+    DataSourceSurface::ScopedMap map(data, DataSourceSurface::READ);
+    if (!map.IsMapped()) {
+      VP8LOG("Reading DataSourceSurface from %s image with %s (%s) surface failed\n",
+             Stringify(format).c_str(), Stringify(surf->GetType()).c_str(),
+             Stringify(surf->GetFormat()).c_str());
+      return NS_ERROR_FAILURE;
+    }
+
+    int rv;
+    switch (surf->GetFormat()) {
+      case SurfaceFormat::B8G8R8A8:
+      case SurfaceFormat::B8G8R8X8:
+        rv = libyuv::ARGBToI420(static_cast<uint8*>(map.GetData()),
+                                map.GetStride(),
+                                y, mFrameWidth,
+                                cb, halfWidth,
+                                cr, halfWidth,
+                                mFrameWidth, mFrameHeight);
+        break;
+      case SurfaceFormat::R5G6B5_UINT16:
+        rv = libyuv::RGB565ToI420(static_cast<uint8*>(map.GetData()),
+                                  map.GetStride(),
+                                  y, mFrameWidth,
+                                  cb, halfWidth,
+                                  cr, halfWidth,
+                                  mFrameWidth, mFrameHeight);
+        break;
+      default:
+        VP8LOG("Unsupported SourceSurface format %s\n",
+               Stringify(surf->GetFormat()).c_str());
+        return NS_ERROR_NOT_IMPLEMENTED;
+    }
+
+    if (rv != 0) {
+      VP8LOG("%s to I420 conversion failed\n",
+             Stringify(surf->GetFormat()).c_str());
+      return NS_ERROR_FAILURE;
+    }
+
+    VP8LOG("Converted a %s frame to I420\n",
+           Stringify(surf->GetFormat()).c_str());
   }
 
+  mVPXImageWrapper->planes[VPX_PLANE_Y] = y;
+  mVPXImageWrapper->planes[VPX_PLANE_U] = cb;
+  mVPXImageWrapper->planes[VPX_PLANE_V] = cr;
+  mVPXImageWrapper->stride[VPX_PLANE_Y] = mFrameWidth;
+  mVPXImageWrapper->stride[VPX_PLANE_U] = halfWidth;
+  mVPXImageWrapper->stride[VPX_PLANE_V] = halfWidth;
+
   return NS_OK;
 }
 
diff --git a/dom/media/encoder/VP8TrackEncoder.h b/dom/media/encoder/VP8TrackEncoder.h
index c43ee39d56..3642f5858e 100644
--- a/dom/media/encoder/VP8TrackEncoder.h
+++ b/dom/media/encoder/VP8TrackEncoder.h
@@ -71,7 +71,7 @@ private:
   // Muted frame, we only create it once.
   RefPtr<layers::Image> mMuteFrame;
 
-  // I420 frame, convert the 4:4:4, 4:2:2 to I420.
+  // I420 frame, for converting to I420.
   nsTArray<uint8_t> mI420Frame;
 
   /**
diff --git a/dom/media/gtest/TestMediaEventSource.cpp b/dom/media/gtest/TestMediaEventSource.cpp
index e2356ffa95..98862f2fbd 100644
--- a/dom/media/gtest/TestMediaEventSource.cpp
+++ b/dom/media/gtest/TestMediaEventSource.cpp
@@ -304,7 +304,7 @@ TEST(MediaEventSource, MoveOnly)
   RefPtr<TaskQueue> queue = new TaskQueue(
     GetMediaThreadPool(MediaThreadType::PLAYBACK));
 
-  MediaEventProducer<UniquePtr<int>, ListenerMode::Exclusive> source;
+  MediaEventProducerExc<UniquePtr<int>> source;
 
   auto func = [] (UniquePtr<int>&& aEvent) {
     EXPECT_EQ(*aEvent, 20);
diff --git a/dom/media/gtest/TestVideoTrackEncoder.cpp b/dom/media/gtest/TestVideoTrackEncoder.cpp
index 828ae9e119..b5c258a850 100644
--- a/dom/media/gtest/TestVideoTrackEncoder.cpp
+++ b/dom/media/gtest/TestVideoTrackEncoder.cpp
@@ -55,8 +55,9 @@ public:
 private:
   Image *CreateI420Image()
   {
-    PlanarYCbCrImage *image = new PlanarYCbCrImage(new BufferRecycleBin());
+    PlanarYCbCrImage *image = new RecyclingPlanarYCbCrImage(new BufferRecycleBin());
     PlanarYCbCrData data;
+    data.mPicSize = mImageSize;
 
     const uint32_t yPlaneSize = mImageSize.width * mImageSize.height;
     const uint32_t halfWidth = (mImageSize.width + 1) / 2;
@@ -92,8 +93,9 @@ private:
 
   Image *CreateNV12Image()
   {
-    PlanarYCbCrImage *image = new PlanarYCbCrImage(new BufferRecycleBin());
+    PlanarYCbCrImage *image = new RecyclingPlanarYCbCrImage(new BufferRecycleBin());
     PlanarYCbCrData data;
+    data.mPicSize = mImageSize;
 
     const uint32_t yPlaneSize = mImageSize.width * mImageSize.height;
     const uint32_t halfWidth = (mImageSize.width + 1) / 2;
@@ -128,8 +130,9 @@ private:
 
   Image *CreateNV21Image()
   {
-    PlanarYCbCrImage *image = new PlanarYCbCrImage(new BufferRecycleBin());
+    PlanarYCbCrImage *image = new RecyclingPlanarYCbCrImage(new BufferRecycleBin());
     PlanarYCbCrData data;
+    data.mPicSize = mImageSize;
 
     const uint32_t yPlaneSize = mImageSize.width * mImageSize.height;
     const uint32_t halfWidth = (mImageSize.width + 1) / 2;
diff --git a/dom/media/mediasource/SourceBufferResource.cpp b/dom/media/mediasource/SourceBufferResource.cpp
index 8f7b959635..9611a60f27 100644
--- a/dom/media/mediasource/SourceBufferResource.cpp
+++ b/dom/media/mediasource/SourceBufferResource.cpp
@@ -64,7 +64,7 @@ SourceBufferResource::ReadInternal(char* aBuffer, uint32_t aCount, uint32_t* aBy
   uint32_t available = GetLength() - readOffset;
   uint32_t count = std::min(aCount, available);
   SBR_DEBUGV("readOffset=%llu GetLength()=%u available=%u count=%u mEnded=%d",
-             this, readOffset, GetLength(), available, count, mEnded);
+             readOffset, GetLength(), available, count, mEnded);
   if (available == 0) {
     SBR_DEBUGV("reached EOF");
     *aBytes = 0;
diff --git a/dom/media/mediasource/TrackBuffersManager.cpp b/dom/media/mediasource/TrackBuffersManager.cpp
index 629d40ef98..2439899b18 100644
--- a/dom/media/mediasource/TrackBuffersManager.cpp
+++ b/dom/media/mediasource/TrackBuffersManager.cpp
@@ -74,7 +74,7 @@ TrackBuffersManager::TrackBuffersManager(dom::SourceBufferAttributes* aAttribute
   , mAppendState(AppendState::WAITING_FOR_SEGMENT)
   , mBufferFull(false)
   , mFirstInitializationSegmentReceived(false)
-  , mNewSegmentStarted(false)
+  , mNewMediaSegmentStarted(false)
   , mActiveTrack(false)
   , mType(aType)
   , mParser(ContainerParser::CreateForMIMEType(aType))
@@ -585,12 +585,11 @@ TrackBuffersManager::SegmentParserLoop()
           // This is a new initialization segment. Obsolete the old one.
           RecreateParser(false);
         }
-        mNewSegmentStarted = true;
         continue;
       }
       if (mParser->IsMediaSegmentPresent(mInputBuffer)) {
         SetAppendState(AppendState::PARSING_MEDIA_SEGMENT);
-        mNewSegmentStarted = true;
+        mNewMediaSegmentStarted = true;
         continue;
       }
       // We have neither an init segment nor a media segment, this is either
@@ -621,27 +620,43 @@ TrackBuffersManager::SegmentParserLoop()
         RejectAppend(NS_ERROR_FAILURE, __func__);
         return;
       }
-      // 2. If the input buffer does not contain a complete media segment header yet, then jump to the need more data step below.
-      if (mParser->MediaHeaderRange().IsNull()) {
-        AppendDataToCurrentInputBuffer(mInputBuffer);
-        mInputBuffer = nullptr;
-        NeedMoreData();
-        return;
-      }
 
       // We can't feed some demuxers (WebMDemuxer) with data that do not have
       // monotonizally increasing timestamps. So we check if we have a
       // discontinuity from the previous segment parsed.
       // If so, recreate a new demuxer to ensure that the demuxer is only fed
       // monotonically increasing data.
-      if (newData) {
-        if (mNewSegmentStarted && mLastParsedEndTime.isSome() &&
+      if (mNewMediaSegmentStarted) {
+        if (newData && mLastParsedEndTime.isSome() &&
             start < mLastParsedEndTime.ref().ToMicroseconds()) {
+          MSE_DEBUG("Re-creating demuxer");
           ResetDemuxingState();
           return;
         }
-        mNewSegmentStarted = false;
-        mLastParsedEndTime = Some(TimeUnit::FromMicroseconds(end));
+        if (newData || !mParser->MediaSegmentRange().IsNull()) {
+          if (mPendingInputBuffer) {
+            // We now have a complete media segment header. We can resume parsing
+            // the data.
+            AppendDataToCurrentInputBuffer(mPendingInputBuffer);
+            mPendingInputBuffer = nullptr;
+          }
+          mNewMediaSegmentStarted = false;
+          if (newData) {
+            mLastParsedEndTime = Some(TimeUnit::FromMicroseconds(end));
+          }
+        } else {
+          // We don't have any data to demux yet, stash aside the data.
+          // This also handles the case:
+          // 2. If the input buffer does not contain a complete media segment header yet, then jump to the need more data step below.
+          if (!mPendingInputBuffer) {
+            mPendingInputBuffer = mInputBuffer;
+          } else {
+            mPendingInputBuffer->AppendElements(*mInputBuffer);
+          }
+          mInputBuffer = nullptr;
+          NeedMoreData();
+          return;
+        }
       }
 
       // 3. If the input buffer contains one or more complete coded frames, then run the coded frame processing algorithm.
@@ -781,6 +796,16 @@ TrackBuffersManager::OnDemuxerResetDone(nsresult)
     MOZ_ASSERT(mAudioTracks.mDemuxer);
   }
 
+  if (mPendingInputBuffer) {
+    // We had a partial media segment header stashed aside.
+    // Reparse its content so we can continue parsing the current input buffer.
+    int64_t start, end;
+    mParser->ParseStartAndEndTimestamps(mPendingInputBuffer, start, end);
+    mProcessedInput += mPendingInputBuffer->Length();
+  }
+
+  mLastParsedEndTime.reset();
+
   SegmentParserLoop();
 }
 
diff --git a/dom/media/mediasource/TrackBuffersManager.h b/dom/media/mediasource/TrackBuffersManager.h
index 72585a2574..34d0203f1e 100644
--- a/dom/media/mediasource/TrackBuffersManager.h
+++ b/dom/media/mediasource/TrackBuffersManager.h
@@ -82,14 +82,14 @@ public:
   MediaInfo GetMetadata();
   const TrackBuffer& GetTrackBuffer(TrackInfo::TrackType aTrack);
   const media::TimeIntervals& Buffered(TrackInfo::TrackType);
-  media:: TimeIntervals SafeBuffered(TrackInfo::TrackType) const;
+  media::TimeIntervals SafeBuffered(TrackInfo::TrackType) const;
   bool IsEnded() const
   {
     return mEnded;
   }
   media::TimeUnit Seek(TrackInfo::TrackType aTrack,
-                  const media::TimeUnit& aTime,
-                  const media::TimeUnit& aFuzz);
+                       const media::TimeUnit& aTime,
+                       const media::TimeUnit& aFuzz);
   uint32_t SkipToNextRandomAccessPoint(TrackInfo::TrackType aTrack,
                                        const media::TimeUnit& aTimeThreadshold,
                                        bool& aFound);
@@ -150,7 +150,7 @@ private:
   Atomic<bool> mBufferFull;
   bool mFirstInitializationSegmentReceived;
   // Set to true once a new segment is started.
-  bool mNewSegmentStarted;
+  bool mNewMediaSegmentStarted;
   bool mActiveTrack;
   Maybe<media::TimeUnit> mGroupStartTimestamp;
   media::TimeUnit mGroupEndTimestamp;
@@ -167,6 +167,11 @@ private:
   // Demuxer objects and methods.
   void AppendDataToCurrentInputBuffer(MediaByteBuffer* aData);
   RefPtr<MediaByteBuffer> mInitData;
+  // Temporary input buffer to handle partial media segment header.
+  // We store the current input buffer content into it should we need to
+  // reinitialize the demuxer once we have some samples and a discontinuity is
+  // detected.
+  RefPtr<MediaByteBuffer> mPendingInputBuffer;
   RefPtr<SourceBufferResource> mCurrentInputBuffer;
   RefPtr<MediaDataDemuxer> mInputDemuxer;
   // Length already processed in current media segment.
diff --git a/dom/media/moz.build b/dom/media/moz.build
index 3647889dce..1eb33dc6af 100644
--- a/dom/media/moz.build
+++ b/dom/media/moz.build
@@ -149,6 +149,7 @@ EXPORTS += [
     'VideoSegment.h',
     'VideoUtils.h',
     'VorbisUtils.h',
+    'XiphExtradata.h',
 ]
 
 EXPORTS.mozilla += [
@@ -246,6 +247,7 @@ UNIFIED_SOURCES += [
     'VideoTrackList.cpp',
     'VideoUtils.cpp',
     'WebVTTListener.cpp',
+    'XiphExtradata.cpp',
 ]
 
 if CONFIG['OS_TARGET'] == 'WINNT':
diff --git a/dom/media/platforms/PDMFactory.cpp b/dom/media/platforms/PDMFactory.cpp
index a6f0ad4247..e3f9446e52 100644
--- a/dom/media/platforms/PDMFactory.cpp
+++ b/dom/media/platforms/PDMFactory.cpp
@@ -241,10 +241,15 @@ PDMFactory::CreatePDMs()
 {
   RefPtr<PlatformDecoderModule> m;
 
-  if (sGMPDecoderEnabled) {
-    m = new GMPDecoderModule();
+  if (sUseBlankDecoder) {
+    m = CreateBlankDecoderModule();
     StartupPDM(m);
+    // The Blank PDM SupportsMimeType reports true for all codecs; the creation
+    // of its decoder is infallible. As such it will be used for all media, we
+    // can stop creating more PDM from this point.
+    return;
   }
+
 #ifdef MOZ_WIDGET_ANDROID
   if(sAndroidMCDecoderPreferred && sAndroidMCDecoderEnabled) {
     m = new AndroidDecoderModule();
@@ -252,12 +257,16 @@ PDMFactory::CreatePDMs()
   }
 #endif
 #ifdef XP_WIN
-  m = new WMFDecoderModule();
-  StartupPDM(m);
+  if (sWMFDecoderEnabled) {
+    m = new WMFDecoderModule();
+    StartupPDM(m);
+  }
 #endif
 #ifdef MOZ_FFMPEG
-  m = FFmpegRuntimeLinker::CreateDecoderModule();
-  StartupPDM(m);
+  if (sFFmpegDecoderEnabled) {
+    m = FFmpegRuntimeLinker::CreateDecoderModule();
+    StartupPDM(m);
+  }
 #endif
 #ifdef MOZ_APPLEMEDIA
   m = new AppleDecoderModule();
@@ -279,10 +288,10 @@ PDMFactory::CreatePDMs()
   m = new AgnosticDecoderModule();
   StartupPDM(m);
 
-  if (sUseBlankDecoder) {
-    m = CreateBlankDecoderModule();
+  if (sGMPDecoderEnabled) {
+    m = new GMPDecoderModule();
     StartupPDM(m);
-  }
+  }  
 }
 
 bool
diff --git a/dom/media/platforms/PlatformDecoderModule.h b/dom/media/platforms/PlatformDecoderModule.h
index ee8d99ec32..9ce212a4f4 100644
--- a/dom/media/platforms/PlatformDecoderModule.h
+++ b/dom/media/platforms/PlatformDecoderModule.h
@@ -185,7 +185,6 @@ public:
   // The MediaFormatReader will not call Input() while it's calling Flush().
   virtual nsresult Flush() = 0;
 
-
   // Causes all complete samples in the pipeline that can be decoded to be
   // output. If the decoder can't produce samples from the current output,
   // it drops the input samples. The decoder may be holding onto samples
@@ -215,6 +214,8 @@ public:
   // that the format of the next input sample is about to change.
   // If video decoder, aConfig will be a VideoInfo object.
   // If audio decoder, aConfig will be a AudioInfo object.
+  // It is not safe to store a reference to this object and the decoder must
+  // make a copy.
   virtual nsresult ConfigurationChanged(const TrackInfo& aConfig)
   {
     return NS_OK;
diff --git a/dom/media/platforms/agnostic/VorbisDecoder.cpp b/dom/media/platforms/agnostic/VorbisDecoder.cpp
index 7c697fd29b..dce4c8a97e 100644
--- a/dom/media/platforms/agnostic/VorbisDecoder.cpp
+++ b/dom/media/platforms/agnostic/VorbisDecoder.cpp
@@ -6,6 +6,7 @@
 
 #include "VorbisDecoder.h"
 #include "VorbisUtils.h"
+#include "XiphExtradata.h"
 
 #include "mozilla/PodOperations.h"
 #include "nsAutoPtr.h"
@@ -70,23 +71,17 @@ VorbisDataDecoder::Init()
   PodZero(&mVorbisDsp);
   PodZero(&mVorbisBlock);
 
-  size_t available = mInfo.mCodecSpecificConfig->Length();
-  uint8_t *p = mInfo.mCodecSpecificConfig->Elements();
-  for(int i = 0; i < 3; i++) {
-    if (available < 2) {
+  nsAutoTArray<unsigned char*,4> headers;
+  nsAutoTArray<size_t,4> headerLens;
+  if (!XiphExtradataToHeaders(headers, headerLens,
+                              mInfo.mCodecSpecificConfig->Elements(),
+                              mInfo.mCodecSpecificConfig->Length())) {
+    return InitPromise::CreateAndReject(DecoderFailureReason::INIT_ERROR, __func__);
+  }
+  for (size_t i = 0; i < headers.Length(); i++) {
+    if (NS_FAILED(DecodeHeader(headers[i], headerLens[i]))) {
       return InitPromise::CreateAndReject(DecoderFailureReason::INIT_ERROR, __func__);
     }
-    available -= 2;
-    size_t length = BigEndian::readUint16(p);
-    p += 2;
-    if (available < length) {
-      return InitPromise::CreateAndReject(DecoderFailureReason::INIT_ERROR, __func__);
-    }
-    available -= length;
-    if (NS_FAILED(DecodeHeader((const unsigned char*)p, length))) {
-      return InitPromise::CreateAndReject(DecoderFailureReason::INIT_ERROR, __func__);
-    }
-    p += length;
   }
 
   MOZ_ASSERT(mPacketCount == 3);
diff --git a/dom/media/platforms/ffmpeg/FFmpegDecoderModule.h b/dom/media/platforms/ffmpeg/FFmpegDecoderModule.h
index db6b951323..a823cc4a26 100644
--- a/dom/media/platforms/ffmpeg/FFmpegDecoderModule.h
+++ b/dom/media/platforms/ffmpeg/FFmpegDecoderModule.h
@@ -10,7 +10,6 @@
 #include "PlatformDecoderModule.h"
 #include "FFmpegAudioDecoder.h"
 #include "FFmpegH264Decoder.h"
-#include "FFmpegRuntimeLinker.h"
 
 namespace mozilla
 {
diff --git a/dom/media/platforms/wrappers/H264Converter.cpp b/dom/media/platforms/wrappers/H264Converter.cpp
index 34e6e6f79e..104c3c92fc 100644
--- a/dom/media/platforms/wrappers/H264Converter.cpp
+++ b/dom/media/platforms/wrappers/H264Converter.cpp
@@ -22,6 +22,7 @@ H264Converter::H264Converter(PlatformDecoderModule* aPDM,
                              FlushableTaskQueue* aVideoTaskQueue,
                              MediaDataDecoderCallback* aCallback)
   : mPDM(aPDM)
+  , mOriginalConfig(aConfig)
   , mCurrentConfig(aConfig)
   , mLayersBackend(aLayersBackend)
   , mImageContainer(aImageContainer)
@@ -53,14 +54,10 @@ H264Converter::Init()
 nsresult
 H264Converter::Input(MediaRawData* aSample)
 {
-  if (!mNeedAVCC) {
-    if (!mp4_demuxer::AnnexB::ConvertSampleToAnnexB(aSample)) {
-      return NS_ERROR_FAILURE;
-    }
-  } else {
-    if (!mp4_demuxer::AnnexB::ConvertSampleToAVCC(aSample)) {
-      return NS_ERROR_FAILURE;
-    }
+  if (!mp4_demuxer::AnnexB::ConvertSampleToAVCC(aSample)) {
+    // We need AVCC content to be able to later parse the SPS.
+    // This is a no-op if the data is already AVCC.
+    return NS_ERROR_FAILURE;
   }
 
   if (mInitPromiseRequest.Exists()) {
@@ -84,6 +81,11 @@ H264Converter::Input(MediaRawData* aSample)
   }
   NS_ENSURE_SUCCESS(rv, rv);
 
+  if (!mNeedAVCC &&
+      !mp4_demuxer::AnnexB::ConvertSampleToAnnexB(aSample)) {
+    return NS_ERROR_FAILURE;
+  }
+
   aSample->mExtraData = mCurrentConfig.mExtraData;
 
   return mDecoder->Input(aSample);
@@ -138,7 +140,7 @@ H264Converter::CreateDecoder()
   }
   UpdateConfigFromExtraData(mCurrentConfig.mExtraData);
 
-  mDecoder = mPDM->CreateVideoDecoder(mCurrentConfig,
+  mDecoder = mPDM->CreateVideoDecoder(mNeedAVCC ? mCurrentConfig : mOriginalConfig,
                                       mLayersBackend,
                                       mImageContainer,
                                       mVideoTaskQueue,
diff --git a/dom/media/platforms/wrappers/H264Converter.h b/dom/media/platforms/wrappers/H264Converter.h
index 132a3f8e9d..bba2ac6349 100644
--- a/dom/media/platforms/wrappers/H264Converter.h
+++ b/dom/media/platforms/wrappers/H264Converter.h
@@ -53,6 +53,7 @@ private:
   void OnDecoderInitFailed(MediaDataDecoder::DecoderFailureReason aReason);
 
   RefPtr<PlatformDecoderModule> mPDM;
+  const VideoInfo& mOriginalConfig;
   VideoInfo mCurrentConfig;
   layers::LayersBackend mLayersBackend;
   RefPtr<layers::ImageContainer> mImageContainer;
diff --git a/dom/media/webm/WebMDemuxer.cpp b/dom/media/webm/WebMDemuxer.cpp
index e855e3156d..d8687e094c 100644
--- a/dom/media/webm/WebMDemuxer.cpp
+++ b/dom/media/webm/WebMDemuxer.cpp
@@ -17,6 +17,7 @@
 #include "MediaDataDemuxer.h"
 #include "nsAutoRef.h"
 #include "NesteggPacketHolder.h"
+#include "XiphExtradata.h"
 
 #include <algorithm>
 #include <stdint.h>
@@ -289,7 +290,7 @@ WebMDemuxer::ReadMetadata()
       return NS_ERROR_FAILURE;
     }
     int type = nestegg_track_type(mContext, track);
-    if (type == NESTEGG_TRACK_VIDEO) {
+    if (type == NESTEGG_TRACK_VIDEO && !mHasVideo) {
       nestegg_video_params params;
       r = nestegg_track_video_params(mContext, track, &params);
       if (r == -1) {
@@ -364,7 +365,7 @@ WebMDemuxer::ReadMetadata()
       if (!r) {
         mInfo.mVideo.mDuration = media::TimeUnit::FromNanoseconds(duration).ToMicroseconds();
       }
-    } else if (type == NESTEGG_TRACK_AUDIO) {
+    } else if (type == NESTEGG_TRACK_AUDIO && !mHasAudio) {
       nestegg_audio_params params;
       r = nestegg_track_audio_params(mContext, track, &params);
       if (r == -1) {
@@ -393,6 +394,8 @@ WebMDemuxer::ReadMetadata()
         return NS_ERROR_FAILURE;
       }
 
+      nsAutoTArray<const unsigned char*,4> headers;
+      nsAutoTArray<size_t,4> headerLens;
       for (uint32_t header = 0; header < nheaders; ++header) {
         unsigned char* data = 0;
         size_t length = 0;
@@ -400,13 +403,24 @@ WebMDemuxer::ReadMetadata()
         if (r == -1) {
           return NS_ERROR_FAILURE;
         }
-        // Vorbis has 3 headers write length + data for each header
-        if (nheaders > 1) {
-          uint8_t c[2];
-          BigEndian::writeUint16(&c[0], length);
-          mInfo.mAudio.mCodecSpecificConfig->AppendElements(&c[0], 2);
+        headers.AppendElement(data);
+        headerLens.AppendElement(length);
+      }
+
+      // Vorbis has 3 headers, convert to Xiph extradata format to send them to
+      // the demuxer.
+      // TODO: This is already the format WebM stores them in. Would be nice
+      // to avoid having libnestegg split them only for us to pack them again,
+      // but libnestegg does not give us an API to access this data directly.
+      if (nheaders > 1) {
+        if (!XiphHeadersToExtradata(mInfo.mAudio.mCodecSpecificConfig,
+                                    headers, headerLens)) {
+          return NS_ERROR_FAILURE;
         }
-        mInfo.mAudio.mCodecSpecificConfig->AppendElements(data, length);
+      }
+      else {
+        mInfo.mAudio.mCodecSpecificConfig->AppendElements(headers[0],
+                                                          headerLens[0]);
       }
       uint64_t duration = 0;
       r = nestegg_duration(mContext, &duration);
@@ -805,9 +819,8 @@ WebMTrackDemuxer::Seek(media::TimeUnit aTime)
 
   // Check what time we actually seeked to.
   if (mSamples.GetSize() > 0) {
-    RefPtr<MediaRawData> sample(mSamples.PopFront());
+    const RefPtr<MediaRawData>& sample = mSamples.First();
     seekTime = media::TimeUnit::FromMicroseconds(sample->mTime);
-    mSamples.PushFront(sample);
   }
   SetNextKeyFrameTime();
 
@@ -862,40 +875,40 @@ WebMTrackDemuxer::SetNextKeyFrameTime()
   mNextKeyframeTime.reset();
 
   MediaRawDataQueue skipSamplesQueue;
-  RefPtr<MediaRawData> sample;
   bool foundKeyframe = false;
   while (!foundKeyframe && mSamples.GetSize()) {
-    sample = mSamples.PopFront();
+    RefPtr<MediaRawData> sample = mSamples.PopFront();
     if (sample->mKeyframe) {
       frameTime = sample->mTime;
       foundKeyframe = true;
     }
-    skipSamplesQueue.Push(sample);
+    skipSamplesQueue.Push(sample.forget());
   }
   Maybe<int64_t> startTime;
   if (skipSamplesQueue.GetSize()) {
-    sample = skipSamplesQueue.PopFront();
+    const RefPtr<MediaRawData>& sample = skipSamplesQueue.First();
     startTime.emplace(sample->mTimecode);
-    skipSamplesQueue.PushFront(sample);
   }
   // Demux and buffer frames until we find a keyframe.
+  RefPtr<MediaRawData> sample;
   while (!foundKeyframe && (sample = NextSample())) {
     if (sample->mKeyframe) {
       frameTime = sample->mTime;
       foundKeyframe = true;
     }
-    skipSamplesQueue.Push(sample);
+    int64_t sampleTimecode = sample->mTimecode;
+    skipSamplesQueue.Push(sample.forget());
     if (!startTime) {
-      startTime.emplace(sample->mTimecode);
+      startTime.emplace(sampleTimecode);
     } else if (!foundKeyframe &&
-               sample->mTimecode > startTime.ref() + MAX_LOOK_AHEAD) {
+               sampleTimecode > startTime.ref() + MAX_LOOK_AHEAD) {
       WEBM_DEBUG("Couldn't find keyframe in a reasonable time, aborting");
       break;
     }
   }
   // We may have demuxed more than intended, so ensure that all frames are kept
   // in the right order.
-  mSamples.PushFront(skipSamplesQueue);
+  mSamples.PushFront(Move(skipSamplesQueue));
 
   if (frameTime != -1) {
     mNextKeyframeTime.emplace(media::TimeUnit::FromMicroseconds(frameTime));
@@ -958,7 +971,7 @@ WebMTrackDemuxer::SkipToNextRandomAccessPoint(media::TimeUnit aTimeThreshold)
     if (sample->mKeyframe && sample->mTime >= aTimeThreshold.ToMicroseconds()) {
       found = true;
       mSamples.Reset();
-      mSamples.PushFront(sample);
+      mSamples.PushFront(sample.forget());
     }
   }
   SetNextKeyFrameTime();
diff --git a/dom/media/webm/WebMDemuxer.h b/dom/media/webm/WebMDemuxer.h
index 17b019e642..88b236b9d3 100644
--- a/dom/media/webm/WebMDemuxer.h
+++ b/dom/media/webm/WebMDemuxer.h
@@ -9,6 +9,7 @@
 #include "nsTArray.h"
 #include "MediaDataDemuxer.h"
 #include "NesteggPacketHolder.h"
+#include "mozilla/Move.h"
 
 typedef struct nestegg nestegg;
 
@@ -27,16 +28,22 @@ class MediaRawDataQueue {
     mQueue.push_back(aItem);
   }
 
-  void Push(const MediaRawDataQueue& aOther) {
-    mQueue.insert(mQueue.end(), aOther.mQueue.begin(), aOther.mQueue.end());
+  void Push(already_AddRefed<MediaRawData>&& aItem) {
+    mQueue.push_back(Move(aItem));
   }
 
   void PushFront(MediaRawData* aItem) {
     mQueue.push_front(aItem);
   }
 
-  void PushFront(const MediaRawDataQueue& aOther) {
-    mQueue.insert(mQueue.begin(), aOther.mQueue.begin(), aOther.mQueue.end());
+  void PushFront(already_AddRefed<MediaRawData>&& aItem) {
+    mQueue.push_front(Move(aItem));
+  }
+
+  void PushFront(MediaRawDataQueue&& aOther) {
+    while (!aOther.mQueue.empty()) {
+      Push(aOther.PopFront());
+    }
   }
 
   already_AddRefed<MediaRawData> PopFront() {
diff --git a/dom/media/webm/WebMReader.cpp b/dom/media/webm/WebMReader.cpp
index e13e705a2b..9095b5d1c3 100644
--- a/dom/media/webm/WebMReader.cpp
+++ b/dom/media/webm/WebMReader.cpp
@@ -250,9 +250,7 @@ WebMReader::RetrieveWebMMetadata(MediaInfo* aInfo)
   io.seek = webm_seek;
   io.tell = webm_tell;
   io.userdata = &mResource;
-  int64_t maxOffset = mDecoder->HasInitializationData() ?
-    mBufferedState->GetInitEndOffset() : -1;
-  int r = nestegg_init(&mContext, io, &webm_log, maxOffset);
+  int r = nestegg_init(&mContext, io, &webm_log, -1);
   if (r == -1) {
     return NS_ERROR_FAILURE;
   }
@@ -395,7 +393,6 @@ WebMReader::RetrieveWebMMetadata(MediaInfo* aInfo)
           Cleanup();
           return NS_ERROR_FAILURE;
         }
-
         if (NS_FAILED(mAudioDecoder->DecodeHeader(data, length))) {
           Cleanup();
           return NS_ERROR_FAILURE;
@@ -560,7 +557,6 @@ WebMReader::DemuxPacket()
     if (r == -1) {
       return nullptr;
     }
-
     vpx_codec_stream_info_t si;
     memset(&si, 0, sizeof(si));
     si.sz = sizeof(si);
@@ -701,8 +697,16 @@ nsresult WebMReader::SeekInternal(int64_t aTarget)
   uint64_t target = aTarget * NS_PER_USEC;
 
   if (mSeekPreroll) {
-    target = std::max(uint64_t(StartTime() * NS_PER_USEC),
-                      target - mSeekPreroll);
+    uint64_t startTime = uint64_t(StartTime()) * NS_PER_USEC;
+    if (target < mSeekPreroll || target - mSeekPreroll < startTime) {
+      target = startTime;
+    } else {
+      target -= mSeekPreroll;
+    }
+    LOG(LogLevel::Debug,
+        ("Reader [%p] SeekPreroll: %f StartTime: %f AdjustedTarget: %f",
+        this, double(mSeekPreroll) / NS_PER_S,
+        double(startTime) / NS_PER_S, double(target) / NS_PER_S));
   }
   int r = nestegg_track_seek(mContext, trackToSeek, target);
   if (r != 0) {
@@ -775,7 +779,6 @@ media::TimeIntervals WebMReader::GetBuffered()
           endTime = duration / NS_PER_S;
         }
       }
-
       buffered += media::TimeInterval(media::TimeUnit::FromSeconds(startTime),
                                       media::TimeUnit::FromSeconds(endTime));
     }
diff --git a/dom/media/webrtc/MediaEngineDefault.cpp b/dom/media/webrtc/MediaEngineDefault.cpp
index da437c2d3a..a850350d7d 100644
--- a/dom/media/webrtc/MediaEngineDefault.cpp
+++ b/dom/media/webrtc/MediaEngineDefault.cpp
@@ -252,10 +252,16 @@ MediaEngineDefaultVideoSource::Notify(nsITimer* aTimer)
 		     0, 0);
 #endif
 
-  ycbcr_image->SetData(data);
+  bool setData = ycbcr_image->SetData(data);
+  MOZ_ASSERT(setData);
+
   // SetData copies data, so we can free the frame
   ReleaseFrame(data);
 
+  if (!setData) {
+    return NS_ERROR_FAILURE;
+  }
+
   MonitorAutoLock lock(mMonitor);
 
   // implicitly releases last image
diff --git a/dom/media/webrtc/MediaEngineRemoteVideoSource.cpp b/dom/media/webrtc/MediaEngineRemoteVideoSource.cpp
index 32693d71e4..96bc097e58 100644
--- a/dom/media/webrtc/MediaEngineRemoteVideoSource.cpp
+++ b/dom/media/webrtc/MediaEngineRemoteVideoSource.cpp
@@ -310,7 +310,10 @@ MediaEngineRemoteVideoSource::DeliverFrame(unsigned char* buffer,
   data.mPicSize = IntSize(mWidth, mHeight);
   data.mStereoMode = StereoMode::MONO;
 
-  videoImage->SetData(data);
+  if (!videoImage->SetData(data)) {
+    MOZ_ASSERT(false);
+    return 0;
+  }
 
 #ifdef DEBUG
   static uint32_t frame_num = 0;
diff --git a/dom/tests/mochitest/general/test_interfaces.html b/dom/tests/mochitest/general/test_interfaces.html
index 5088068bda..bcc90946cb 100644
--- a/dom/tests/mochitest/general/test_interfaces.html
+++ b/dom/tests/mochitest/general/test_interfaces.html
@@ -239,9 +239,9 @@ var interfaceNamesInGlobalScope =
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "BroadcastChannel",
 // IMPORTANT: Do not change this list without review from a DOM peer!
-    {name: "Cache", release: false},
+    "Cache",
 // IMPORTANT: Do not change this list without review from a DOM peer!
-    {name: "CacheStorage", release: false},
+    "CacheStorage",
 // IMPORTANT: Do not change this list without review from a DOM peer!
     {name: "CallEvent", b2g: true},
 // IMPORTANT: Do not change this list without review from a DOM peer!
@@ -322,8 +322,6 @@ var interfaceNamesInGlobalScope =
     "CSSConditionRule",
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "CSSCounterStyleRule",
-// IMPORTANT: Do not change this list without review from a DOM peer!
-    {name: "CSSFontFaceLoadEvent", release: false},
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "CSSFontFaceRule",
 // IMPORTANT: Do not change this list without review from a DOM peer!
@@ -479,9 +477,11 @@ var interfaceNamesInGlobalScope =
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "FormData",
 // IMPORTANT: Do not change this list without review from a DOM peer!
-    {name: "FontFace", release: false},
+    "FontFace",
 // IMPORTANT: Do not change this list without review from a DOM peer!
-    {name: "FontFaceSet", release: false},
+    "FontFaceSet",
+// IMPORTANT: Do not change this list without review from a DOM peer!
+    "FontFaceSetLoadEvent",
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "GainNode",
 // IMPORTANT: Do not change this list without review from a DOM peer!
@@ -957,9 +957,9 @@ var interfaceNamesInGlobalScope =
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "PropertyNodeList",
 // IMPORTANT: Do not change this list without review from a DOM peer!
-    {name: "PushManager", b2g: false, android: false, release: false},
+    {name: "PushManager", b2g: false, android: false},
 // IMPORTANT: Do not change this list without review from a DOM peer!
-    {name: "PushSubscription", b2g: false, android: false, release: false},
+    {name: "PushSubscription", b2g: false, android: false},
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "RadioNodeList",
 // IMPORTANT: Do not change this list without review from a DOM peer!
@@ -997,11 +997,11 @@ var interfaceNamesInGlobalScope =
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "Selection",
 // IMPORTANT: Do not change this list without review from a DOM peer!
-    {name: "ServiceWorker", release: false, b2g: false},
+    {name: "ServiceWorker", b2g: false, android: false},
 // IMPORTANT: Do not change this list without review from a DOM peer!
-    {name: "ServiceWorkerContainer", release: false, b2g: false},
+    {name: "ServiceWorkerContainer", b2g: false, android: false},
 // IMPORTANT: Do not change this list without review from a DOM peer!
-    {name: "ServiceWorkerRegistration", release: false, b2g: false},
+    {name: "ServiceWorkerRegistration", b2g: false, android: false},
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "SettingsLock",
 // IMPORTANT: Do not change this list without review from a DOM peer!
diff --git a/dom/tv/test/mochitest/head.js b/dom/tv/test/mochitest/head.js
index 6211471b30..78f65a1437 100644
--- a/dom/tv/test/mochitest/head.js
+++ b/dom/tv/test/mochitest/head.js
@@ -22,8 +22,9 @@ function installApp(aTestToken, aTemplate) {
 
     var appId = gAppsService.getAppLocalIdByManifestURL(gApp.manifestURL);
     SpecialPowers.addPermission("tv", true, { url: gApp.origin,
-                                              appId: appId,
-                                              isInBrowserElement: false });
+                                              originAttributes: {
+                                                appId: appId
+                                              }});
 
     runTest();
   }
diff --git a/dom/webidl/CSSFontFaceLoadEvent.webidl b/dom/webidl/FontFaceSetLoadEvent.webidl
similarity index 81%
rename from dom/webidl/CSSFontFaceLoadEvent.webidl
rename to dom/webidl/FontFaceSetLoadEvent.webidl
index 0227639b1c..6090d194ee 100644
--- a/dom/webidl/CSSFontFaceLoadEvent.webidl
+++ b/dom/webidl/FontFaceSetLoadEvent.webidl
@@ -10,12 +10,12 @@
  * liability, trademark and document use rules apply.
  */
 
-dictionary CSSFontFaceLoadEventInit : EventInit {
+dictionary FontFaceSetLoadEventInit : EventInit {
   sequence<FontFace> fontfaces = [];
 };
 
-[Constructor(DOMString type, optional CSSFontFaceLoadEventInit eventInitDict),
+[Constructor(DOMString type, optional FontFaceSetLoadEventInit eventInitDict),
  Pref="layout.css.font-loading-api.enabled"]
-interface CSSFontFaceLoadEvent : Event {
+interface FontFaceSetLoadEvent : Event {
   [Cached, Constant] readonly attribute sequence<FontFace> fontfaces;
 };
diff --git a/dom/webidl/moz.build b/dom/webidl/moz.build
index 62a95f3ea8..8c43becc19 100644
--- a/dom/webidl/moz.build
+++ b/dom/webidl/moz.build
@@ -767,7 +767,6 @@ GENERATED_EVENTS_WEBIDL_FILES = [
     'CaretStateChangedEvent.webidl',
     'CFStateChangeEvent.webidl',
     'CloseEvent.webidl',
-    'CSSFontFaceLoadEvent.webidl',
     'DataErrorEvent.webidl',
     'DataStoreChangeEvent.webidl',
     'DeviceLightEvent.webidl',
@@ -779,6 +778,7 @@ GENERATED_EVENTS_WEBIDL_FILES = [
     'DownloadEvent.webidl',
     'ErrorEvent.webidl',
     'ExternalAppEvent.webidl',
+    'FontFaceSetLoadEvent.webidl',
     'HashChangeEvent.webidl',
     'IccChangeEvent.webidl',
     'ImageCaptureErrorEvent.webidl',
diff --git a/dom/workers/ServiceWorkerManager.cpp b/dom/workers/ServiceWorkerManager.cpp
index 7788206c52..50bbe3a568 100644
--- a/dom/workers/ServiceWorkerManager.cpp
+++ b/dom/workers/ServiceWorkerManager.cpp
@@ -3879,23 +3879,6 @@ ServiceWorkerManager::RemoveAllRegistrations(OriginAttributes* aParams)
   }
 }
 
-NS_IMETHODIMP
-ServiceWorkerManager::UpdateAllRegistrations()
-{
-  AssertIsOnMainThread();
-
-  for (auto it1 = mRegistrationInfos.Iter(); !it1.Done(); it1.Next()) {
-    for (auto it2 = it1.UserData()->mInfos.Iter(); !it2.Done(); it2.Next()) {
-      ServiceWorkerRegistrationInfo* info = it2.UserData();
-      MOZ_ASSERT(!info->mScope.IsEmpty());
-
-      SoftUpdate(info->mPrincipal, info->mScope);
-    }
-  }
-
-  return NS_OK;
-}
-
 NS_IMETHODIMP
 ServiceWorkerManager::Observe(nsISupports* aSubject,
                               const char* aTopic,
diff --git a/dom/workers/ServiceWorkerPeriodicUpdater.cpp b/dom/workers/ServiceWorkerPeriodicUpdater.cpp
deleted file mode 100644
index 941cc5a54a..0000000000
--- a/dom/workers/ServiceWorkerPeriodicUpdater.cpp
+++ /dev/null
@@ -1,84 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "ServiceWorkerPeriodicUpdater.h"
-#include "mozilla/ClearOnShutdown.h"
-#include "mozilla/unused.h"
-#include "mozilla/Services.h"
-#include "mozilla/Preferences.h"
-#include "mozilla/dom/ContentParent.h"
-#include "nsIServiceWorkerManager.h"
-
-#define OBSERVER_TOPIC_IDLE_DAILY "idle-daily"
-
-namespace mozilla {
-namespace dom {
-namespace workers {
-
-NS_IMPL_ISUPPORTS(ServiceWorkerPeriodicUpdater, nsIObserver)
-
-StaticRefPtr<ServiceWorkerPeriodicUpdater>
-ServiceWorkerPeriodicUpdater::sInstance;
-bool
-ServiceWorkerPeriodicUpdater::sPeriodicUpdatesEnabled = true;
-
-already_AddRefed<ServiceWorkerPeriodicUpdater>
-ServiceWorkerPeriodicUpdater::GetSingleton()
-{
-  MOZ_ASSERT(XRE_IsParentProcess());
-
-  if (!sInstance) {
-    sInstance = new ServiceWorkerPeriodicUpdater();
-    ClearOnShutdown(&sInstance);
-  }
-  RefPtr<ServiceWorkerPeriodicUpdater> copy(sInstance.get());
-  return copy.forget();
-}
-
-ServiceWorkerPeriodicUpdater::ServiceWorkerPeriodicUpdater()
-{
-  Preferences::AddBoolVarCache(&sPeriodicUpdatesEnabled,
-                               "dom.serviceWorkers.periodic-updates.enabled",
-                               true);
-}
-
-ServiceWorkerPeriodicUpdater::~ServiceWorkerPeriodicUpdater()
-{
-}
-
-NS_IMETHODIMP
-ServiceWorkerPeriodicUpdater::Observe(nsISupports* aSubject,
-                                      const char* aTopic,
-                                      const char16_t* aData)
-{
-  // In tests, the pref is set to false so that the idle-daily service does not
-  // trigger updates leading to intermittent failures.
-  // We're called from SpecialPowers inside tests, in which case we need to
-  // update during the test run, for which we use a non-empty aData.
-  NS_NAMED_LITERAL_STRING(CallerSpecialPowers, "Caller:SpecialPowers");
-  if (strcmp(aTopic, OBSERVER_TOPIC_IDLE_DAILY) == 0 &&
-      (sPeriodicUpdatesEnabled || (aData && CallerSpecialPowers.Equals(aData)))) {
-    // First, update all registrations in the parent process.
-    nsCOMPtr<nsIServiceWorkerManager> swm =
-      mozilla::services::GetServiceWorkerManager();
-    if (swm) {
-        swm->UpdateAllRegistrations();
-    }
-
-    // Now, tell all child processes to update their registrations as well.
-    nsTArray<ContentParent*> children;
-    ContentParent::GetAll(children);
-    for (uint32_t i = 0; i < children.Length(); i++) {
-      Unused << children[i]->SendUpdateServiceWorkerRegistrations();
-    }
-  }
-
-  return NS_OK;
-}
-
-} // namespace workers
-} // namespace dom
-} // namespace mozilla
diff --git a/dom/workers/ServiceWorkerPeriodicUpdater.h b/dom/workers/ServiceWorkerPeriodicUpdater.h
deleted file mode 100644
index 134e245bca..0000000000
--- a/dom/workers/ServiceWorkerPeriodicUpdater.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef mozilla_ServiceWorkerPeriodicUpdater_h
-#define mozilla_ServiceWorkerPeriodicUpdater_h
-
-#include "nsCOMPtr.h"
-#include "nsIObserver.h"
-#include "mozilla/StaticPtr.h"
-
-namespace mozilla {
-namespace dom {
-namespace workers {
-
-/**
- * This XPCOM component is main-process only, which means that it will never
- * get instantiated in child processes.  When we receive the idle-daily
- * notification in this component, we iterate over all PContent children, and
- * send each one a message that will trigger a call to
- * nsIServiceWorkerManager::UpdateAllRegistrations() in all child processes.
- */
-
-class ServiceWorkerPeriodicUpdater final : public nsIObserver
-{
-public:
-  NS_DECL_ISUPPORTS
-  NS_DECL_NSIOBSERVER
-
-  static already_AddRefed<ServiceWorkerPeriodicUpdater> GetSingleton();
-
-private:
-  ServiceWorkerPeriodicUpdater();
-  ~ServiceWorkerPeriodicUpdater();
-
-  static StaticRefPtr<ServiceWorkerPeriodicUpdater> sInstance;
-  static bool sPeriodicUpdatesEnabled;
-};
-
-} // namespace workers
-} // namespace dom
-} // namespace mozilla
-
-#endif
diff --git a/dom/workers/moz.build b/dom/workers/moz.build
index d7d9b278b9..6d48ea8646 100644
--- a/dom/workers/moz.build
+++ b/dom/workers/moz.build
@@ -19,7 +19,6 @@ EXPORTS.mozilla.dom += [
 
 EXPORTS.mozilla.dom.workers += [
     'ServiceWorkerManager.h',
-    'ServiceWorkerPeriodicUpdater.h',
     'WorkerDebuggerManager.h',
     'Workers.h',
 ]
@@ -72,7 +71,6 @@ UNIFIED_SOURCES += [
     'ServiceWorkerManagerParent.cpp',
     'ServiceWorkerManagerService.cpp',
     'ServiceWorkerMessageEvent.cpp',
-    'ServiceWorkerPeriodicUpdater.cpp',
     'ServiceWorkerPrivate.cpp',
     'ServiceWorkerRegistrar.cpp',
     'ServiceWorkerRegistration.cpp',
diff --git a/dom/workers/test/serviceworkers/mochitest.ini b/dom/workers/test/serviceworkers/mochitest.ini
index 02ca4adcc7..c5af5f438e 100644
--- a/dom/workers/test/serviceworkers/mochitest.ini
+++ b/dom/workers/test/serviceworkers/mochitest.ini
@@ -122,12 +122,6 @@ support-files =
   worker_updatefoundevent2.js
   updatefoundevent.html
   empty.js
-  periodic_update_test.js
-  periodic.sjs
-  periodic/frame.html
-  periodic/register.html
-  periodic/wait_for_update.html
-  periodic/unregister.html
   notification_constructor_error.js
   notification_get_sw.js
   notification/register.html
@@ -223,8 +217,6 @@ skip-if = release_build
 [test_origin_after_redirect_cached.html]
 [test_origin_after_redirect_to_https.html]
 [test_origin_after_redirect_to_https_cached.html]
-[test_periodic_https_update.html]
-[test_periodic_update.html]
 [test_post_message.html]
 [test_post_message_advanced.html]
 [test_post_message_source.html]
diff --git a/dom/workers/test/serviceworkers/periodic.sjs b/dom/workers/test/serviceworkers/periodic.sjs
deleted file mode 100644
index 6fc89d3921..0000000000
--- a/dom/workers/test/serviceworkers/periodic.sjs
+++ /dev/null
@@ -1,24 +0,0 @@
-function handleRequest(request, response) {
-  var stateName = request.scheme + 'periodiccounter';
-  if (request.queryString == 'clearcounter') {
-    setState(stateName, '');
-    return;
-  }
-  
-  if (!getState(stateName)) {
-    setState(stateName, '1');
-  } else {
-    // Make sure that we pass a string value to setState!
-    setState(stateName, "" + (parseInt(getState(stateName)) + 1));
-  }
-  response.setHeader("Content-Type", "application/javascript", false);
-  response.write(getScript(stateName));
-}
-
-function getScript(stateName) {
-  return "onfetch = function(e) {" +
-           "if (e.request.url.indexOf('get-sw-version') > -1) {" +
-             "e.respondWith(new Response('" + getState(stateName) + "'));" +
-           "}" +
-         "};";
-}
diff --git a/dom/workers/test/serviceworkers/periodic/frame.html b/dom/workers/test/serviceworkers/periodic/frame.html
deleted file mode 100644
index 3bb68cc700..0000000000
--- a/dom/workers/test/serviceworkers/periodic/frame.html
+++ /dev/null
@@ -1,8 +0,0 @@
-<!DOCTYPE html>
-<script>
-  fetch("get-sw-version").then(function(r) {
-    return r.text();
-  }).then(function(body) {
-    parent.postMessage({status: "callback", data: body}, "*");
-  });
-</script>
diff --git a/dom/workers/test/serviceworkers/periodic/register.html b/dom/workers/test/serviceworkers/periodic/register.html
deleted file mode 100644
index ebfd53d876..0000000000
--- a/dom/workers/test/serviceworkers/periodic/register.html
+++ /dev/null
@@ -1,9 +0,0 @@
-<!DOCTYPE html>
-<script>
-  function done() {
-    parent.postMessage({status: "callback", data: "done"}, "*");
-  }
-
-  navigator.serviceWorker.ready.then(done);
-  navigator.serviceWorker.register("../periodic.sjs", {scope: "."});
-</script>
diff --git a/dom/workers/test/serviceworkers/periodic/unregister.html b/dom/workers/test/serviceworkers/periodic/unregister.html
deleted file mode 100644
index 0315f25b36..0000000000
--- a/dom/workers/test/serviceworkers/periodic/unregister.html
+++ /dev/null
@@ -1,16 +0,0 @@
-<!DOCTYPE html>
-<script>
-  fetch("../periodic.sjs?clearcounter").then(function() {
-    return navigator.serviceWorker.getRegistration(".");
-  }).then(function(registration) {
-    registration.unregister().then(function(success) {
-      if (success) {
-        parent.postMessage({status: "callback", data: "done"}, "*");
-      } else {
-        dump("Unregister failed\n");
-      }
-    }, function(e) {
-      dump("Unregistering the SW failed with " + e + "\n");
-    });
-  });
-</script>
diff --git a/dom/workers/test/serviceworkers/periodic/wait_for_update.html b/dom/workers/test/serviceworkers/periodic/wait_for_update.html
deleted file mode 100644
index 71a9ba13e9..0000000000
--- a/dom/workers/test/serviceworkers/periodic/wait_for_update.html
+++ /dev/null
@@ -1,15 +0,0 @@
-<!DOCTYPE html>
-<script>
-  navigator.serviceWorker.getRegistration(".").then(function(reg) {
-    reg.onupdatefound = function() {
-      reg.onupdatefound = null;
-      var sw = reg.installing;
-      sw.onstatechange = function() {
-        sw.onstatechange = null;
-        var success = !reg.waiting && reg.active;
-        parent.postMessage({status: "callback", data: "done"}, "*");
-      };
-    };
-    SpecialPowers.startPeriodicServiceWorkerUpdates();
-  });
-</script>
diff --git a/dom/workers/test/serviceworkers/periodic_update_test.js b/dom/workers/test/serviceworkers/periodic_update_test.js
deleted file mode 100644
index 23abaabb3c..0000000000
--- a/dom/workers/test/serviceworkers/periodic_update_test.js
+++ /dev/null
@@ -1,74 +0,0 @@
-var oldSWVersion, newSWVersion;
-// This will be set by the test to the base directory for the test files.
-var gPrefix;
-
-function start() {
-  const Cc = SpecialPowers.Cc;
-  const Ci = SpecialPowers.Ci;
-
-  function testVersion() {
-    // Verify that the service worker has been correctly updated.
-    testFrame(gPrefix + "periodic/frame.html").then(function(body) {
-      newSWVersion = parseInt(body);
-      is(newSWVersion, 2, "Expected correct new version");
-      ok(newSWVersion > oldSWVersion,
-         "The SW should be successfully updated, old: " + oldSWVersion +
-         ", new: " + newSWVersion);
-      unregisterSW().then(function() {
-        SimpleTest.finish();
-      });
-    });
-  }
-
-  registerSW().then(function() {
-    return testFrame(gPrefix + "periodic/frame.html").then(function(body) {
-      oldSWVersion = parseInt(body);
-      is(oldSWVersion, 1, "Expected correct old version");
-    });
-  }).then(function() {
-    return testFrame(gPrefix + "periodic/wait_for_update.html");
-  }).then(function() {
-    return testVersion();
-  });
-}
-
-function testFrame(src) {
-  return new Promise(function(resolve, reject) {
-    var iframe = document.createElement("iframe");
-    iframe.src = src;
-    window.onmessage = function(e) {
-      if (e.data.status == "callback") {
-        window.onmessage = null;
-        var result = e.data.data;
-        iframe.src = "about:blank";
-        document.body.removeChild(iframe);
-        iframe = null;
-        SpecialPowers.exactGC(window, function() {
-          resolve(result);
-        });
-      }
-    };
-    document.body.appendChild(iframe);
-  });
-}
-
-function registerSW() {
-  return testFrame(gPrefix + "periodic/register.html");
-}
-
-function unregisterSW() {
-  return testFrame(gPrefix + "periodic/unregister.html");
-}
-
-function runTheTest() {
-  SimpleTest.waitForExplicitFinish();
-
-  SpecialPowers.pushPrefEnv({"set": [
-    ["dom.serviceWorkers.exemptFromPerDomainMax", true],
-    ["dom.serviceWorkers.interception.enabled", true],
-    ["dom.serviceWorkers.enabled", true],
-    ["dom.serviceWorkers.testing.enabled", true],
-  ]}, function() {
-    start();
-  });
-}
diff --git a/dom/workers/test/serviceworkers/test_app_installation.html b/dom/workers/test/serviceworkers/test_app_installation.html
index 07337213ca..44e675c584 100644
--- a/dom/workers/test/serviceworkers/test_app_installation.html
+++ b/dom/workers/test/serviceworkers/test_app_installation.html
@@ -47,7 +47,8 @@ function setup() {
       ['dom.mozBrowserFramesEnabled', true],
       ['dom.serviceWorkers.exemptFromPerDomainMax', true],
       ['dom.serviceWorkers.enabled', true],
-      ['dom.serviceWorkers.testing.enabled', true]
+      ['dom.serviceWorkers.testing.enabled', true],
+      ['dom.serviceWorkers.interception.enabled', true],
     ]}, () => {
       SpecialPowers.pushPermissions([
         { 'type': 'webapps-manage', 'allow': 1, 'context': document },
diff --git a/dom/workers/test/serviceworkers/test_eval_allowed.html b/dom/workers/test/serviceworkers/test_eval_allowed.html
index 3a4f1abbc9..ee07c3346f 100644
--- a/dom/workers/test/serviceworkers/test_eval_allowed.html
+++ b/dom/workers/test/serviceworkers/test_eval_allowed.html
@@ -34,7 +34,8 @@
   SpecialPowers.pushPrefEnv({"set": [
     ["dom.serviceWorkers.exemptFromPerDomainMax", true],
     ["dom.serviceWorkers.enabled", true],
-    ["dom.serviceWorkers.testing.enabled", true]
+    ["dom.serviceWorkers.testing.enabled", true],
+    ['dom.serviceWorkers.interception.enabled', true],
   ]}, runTest);
 </script>
 </pre>
diff --git a/dom/workers/test/serviceworkers/test_eval_not_allowed.html b/dom/workers/test/serviceworkers/test_eval_not_allowed.html
index f13805f9f0..d69a453b05 100644
--- a/dom/workers/test/serviceworkers/test_eval_not_allowed.html
+++ b/dom/workers/test/serviceworkers/test_eval_not_allowed.html
@@ -37,7 +37,8 @@
   SpecialPowers.pushPrefEnv({"set": [
     ["dom.serviceWorkers.exemptFromPerDomainMax", true],
     ["dom.serviceWorkers.enabled", true],
-    ["dom.serviceWorkers.testing.enabled", true]
+    ["dom.serviceWorkers.testing.enabled", true],
+    ['dom.serviceWorkers.interception.enabled', true],
   ]}, runTest);
 </script>
 </pre>
diff --git a/dom/workers/test/serviceworkers/test_fetch_event_client_postmessage.html b/dom/workers/test/serviceworkers/test_fetch_event_client_postmessage.html
index 5c59f23199..07b9e43fda 100644
--- a/dom/workers/test/serviceworkers/test_fetch_event_client_postmessage.html
+++ b/dom/workers/test/serviceworkers/test_fetch_event_client_postmessage.html
@@ -65,6 +65,8 @@
       ["dom.serviceWorkers.exemptFromPerDomainMax", true],
       ["dom.serviceWorkers.enabled", true],
       ["dom.serviceWorkers.testing.enabled", true],
+      ["dom.serviceWorkers.testing.enabled", true],
+      ['dom.serviceWorkers.interception.enabled', true],
     ]}, runTest);
   </script>
 </body>
diff --git a/dom/workers/test/serviceworkers/test_gzip_redirect.html b/dom/workers/test/serviceworkers/test_gzip_redirect.html
index f21d0fffd2..f8c2ac082c 100644
--- a/dom/workers/test/serviceworkers/test_gzip_redirect.html
+++ b/dom/workers/test/serviceworkers/test_gzip_redirect.html
@@ -76,7 +76,8 @@
   SpecialPowers.pushPrefEnv({"set": [
     ["dom.serviceWorkers.exemptFromPerDomainMax", true],
     ["dom.serviceWorkers.enabled", true],
-    ["dom.serviceWorkers.testing.enabled", true]
+    ["dom.serviceWorkers.testing.enabled", true],
+    ['dom.serviceWorkers.interception.enabled', true],
   ]}, runTest);
 </script>
 </pre>
diff --git a/dom/workers/test/serviceworkers/test_https_origin_after_redirect.html b/dom/workers/test/serviceworkers/test_https_origin_after_redirect.html
index 3878a1df6d..b780bc07b3 100644
--- a/dom/workers/test/serviceworkers/test_https_origin_after_redirect.html
+++ b/dom/workers/test/serviceworkers/test_https_origin_after_redirect.html
@@ -48,6 +48,7 @@
       ["dom.serviceWorkers.exemptFromPerDomainMax", true],
       ["dom.serviceWorkers.enabled", true],
       ["dom.serviceWorkers.testing.enabled", true],
+      ['dom.serviceWorkers.interception.enabled', true],
       ["dom.caches.enabled", true],
     ]}, runTest);
   };
diff --git a/dom/workers/test/serviceworkers/test_https_origin_after_redirect_cached.html b/dom/workers/test/serviceworkers/test_https_origin_after_redirect_cached.html
index 81a1d1da0e..ba2801c1b8 100644
--- a/dom/workers/test/serviceworkers/test_https_origin_after_redirect_cached.html
+++ b/dom/workers/test/serviceworkers/test_https_origin_after_redirect_cached.html
@@ -48,6 +48,7 @@
       ["dom.serviceWorkers.exemptFromPerDomainMax", true],
       ["dom.serviceWorkers.enabled", true],
       ["dom.serviceWorkers.testing.enabled", true],
+      ['dom.serviceWorkers.interception.enabled', true],
       ["dom.caches.enabled", true],
     ]}, runTest);
   };
diff --git a/dom/workers/test/serviceworkers/test_notificationclick.html b/dom/workers/test/serviceworkers/test_notificationclick.html
index 04d63184b0..cb4322c05b 100644
--- a/dom/workers/test/serviceworkers/test_notificationclick.html
+++ b/dom/workers/test/serviceworkers/test_notificationclick.html
@@ -49,6 +49,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=916893
     ["dom.serviceWorkers.enabled", true],
     ["dom.serviceWorkers.testing.enabled", true],
     ["dom.webnotifications.workers.enabled", true],
+    ['dom.serviceWorkers.interception.enabled', true],
     ["notification.prompt.testing", true],
   ]}, runTest);
 </script>
diff --git a/dom/workers/test/serviceworkers/test_opaque_intercept.html b/dom/workers/test/serviceworkers/test_opaque_intercept.html
index fe0598f454..db86ffacec 100644
--- a/dom/workers/test/serviceworkers/test_opaque_intercept.html
+++ b/dom/workers/test/serviceworkers/test_opaque_intercept.html
@@ -77,6 +77,7 @@
     ["dom.serviceWorkers.exemptFromPerDomainMax", true],
     ["dom.serviceWorkers.enabled", true],
     ["dom.serviceWorkers.testing.enabled", true],
+    ['dom.serviceWorkers.interception.enabled', true],
     ["dom.serviceWorkers.interception.opaque.enabled", true],
     ["dom.caches.enabled", true],
   ]}, runTest);
diff --git a/dom/workers/test/serviceworkers/test_origin_after_redirect.html b/dom/workers/test/serviceworkers/test_origin_after_redirect.html
index 42f8b35caa..58efa61b79 100644
--- a/dom/workers/test/serviceworkers/test_origin_after_redirect.html
+++ b/dom/workers/test/serviceworkers/test_origin_after_redirect.html
@@ -48,6 +48,7 @@
       ["dom.serviceWorkers.exemptFromPerDomainMax", true],
       ["dom.serviceWorkers.enabled", true],
       ["dom.serviceWorkers.testing.enabled", true],
+      ['dom.serviceWorkers.interception.enabled', true],
       ["dom.caches.enabled", true],
     ]}, runTest);
   };
diff --git a/dom/workers/test/serviceworkers/test_origin_after_redirect_cached.html b/dom/workers/test/serviceworkers/test_origin_after_redirect_cached.html
index 2a19e20dec..78d44ca530 100644
--- a/dom/workers/test/serviceworkers/test_origin_after_redirect_cached.html
+++ b/dom/workers/test/serviceworkers/test_origin_after_redirect_cached.html
@@ -48,6 +48,7 @@
       ["dom.serviceWorkers.exemptFromPerDomainMax", true],
       ["dom.serviceWorkers.enabled", true],
       ["dom.serviceWorkers.testing.enabled", true],
+      ['dom.serviceWorkers.interception.enabled', true],
       ["dom.caches.enabled", true],
     ]}, runTest);
   };
diff --git a/dom/workers/test/serviceworkers/test_origin_after_redirect_to_https.html b/dom/workers/test/serviceworkers/test_origin_after_redirect_to_https.html
index dcac11aea1..d6b45a6ef4 100644
--- a/dom/workers/test/serviceworkers/test_origin_after_redirect_to_https.html
+++ b/dom/workers/test/serviceworkers/test_origin_after_redirect_to_https.html
@@ -48,6 +48,7 @@
       ["dom.serviceWorkers.exemptFromPerDomainMax", true],
       ["dom.serviceWorkers.enabled", true],
       ["dom.serviceWorkers.testing.enabled", true],
+      ['dom.serviceWorkers.interception.enabled', true],
       ["dom.caches.enabled", true],
     ]}, runTest);
   };
diff --git a/dom/workers/test/serviceworkers/test_origin_after_redirect_to_https_cached.html b/dom/workers/test/serviceworkers/test_origin_after_redirect_to_https_cached.html
index b70d1704e8..e63cb7e753 100644
--- a/dom/workers/test/serviceworkers/test_origin_after_redirect_to_https_cached.html
+++ b/dom/workers/test/serviceworkers/test_origin_after_redirect_to_https_cached.html
@@ -48,6 +48,7 @@
       ["dom.serviceWorkers.exemptFromPerDomainMax", true],
       ["dom.serviceWorkers.enabled", true],
       ["dom.serviceWorkers.testing.enabled", true],
+      ['dom.serviceWorkers.interception.enabled', true],
       ["dom.caches.enabled", true],
     ]}, runTest);
   };
diff --git a/dom/workers/test/serviceworkers/test_periodic_https_update.html b/dom/workers/test/serviceworkers/test_periodic_https_update.html
deleted file mode 100644
index 4a84dd92e8..0000000000
--- a/dom/workers/test/serviceworkers/test_periodic_https_update.html
+++ /dev/null
@@ -1,26 +0,0 @@
-<!--
-  Any copyright is dedicated to the Public Domain.
-  http://creativecommons.org/publicdomain/zero/1.0/
--->
-<!DOCTYPE HTML>
-<html>
-<head>
-  <title>Bug 1159378 - Test the periodic update of service workers</title>
-  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <script type="text/javascript" src="periodic_update_test.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
-</head>
-<body>
-<p id="display"></p>
-<div id="content" style="display: none"></div>
-<pre id="test"></pre>
-<script class="testbody" type="text/javascript">
-
-gPrefix = "https://example.com/tests/dom/workers/test/serviceworkers/";
-runTheTest();
-
-</script>
-</pre>
-</body>
-</html>
-
diff --git a/dom/workers/test/serviceworkers/test_periodic_update.html b/dom/workers/test/serviceworkers/test_periodic_update.html
deleted file mode 100644
index 58ec161288..0000000000
--- a/dom/workers/test/serviceworkers/test_periodic_update.html
+++ /dev/null
@@ -1,26 +0,0 @@
-<!--
-  Any copyright is dedicated to the Public Domain.
-  http://creativecommons.org/publicdomain/zero/1.0/
--->
-<!DOCTYPE HTML>
-<html>
-<head>
-  <title>Bug 1112469 - Test the periodic update of service workers</title>
-  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <script type="text/javascript" src="periodic_update_test.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
-</head>
-<body>
-<p id="display"></p>
-<div id="content" style="display: none"></div>
-<pre id="test"></pre>
-<script class="testbody" type="text/javascript">
-
-gPrefix = "http://mochi.test:8888/tests/dom/workers/test/serviceworkers/";
-runTheTest();
-
-</script>
-</pre>
-</body>
-</html>
-
diff --git a/dom/workers/test/serviceworkers/test_serviceworker_interfaces.js b/dom/workers/test/serviceworkers/test_serviceworker_interfaces.js
index 858be3d56d..4e3a2460db 100644
--- a/dom/workers/test/serviceworkers/test_serviceworker_interfaces.js
+++ b/dom/workers/test/serviceworkers/test_serviceworker_interfaces.js
@@ -172,13 +172,13 @@ var interfaceNamesInGlobalScope =
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "Promise",
 // IMPORTANT: Do not change this list without review from a DOM peer!
-    { name: "PushEvent", b2g: false, android: false, release: false },
+    { name: "PushEvent", b2g: false, android: false},
 // IMPORTANT: Do not change this list without review from a DOM peer!
-    { name: "PushManager", b2g: false, android: false, release: false },
+    { name: "PushManager", b2g: false, android: false},
 // IMPORTANT: Do not change this list without review from a DOM peer!
-    { name: "PushMessageData", b2g: false, android: false, release: false },
+    { name: "PushMessageData", b2g: false, android: false},
 // IMPORTANT: Do not change this list without review from a DOM peer!
-    { name: "PushSubscription", b2g: false, android: false, release: false },
+    { name: "PushSubscription", b2g: false, android: false},
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "Request",
 // IMPORTANT: Do not change this list without review from a DOM peer!
diff --git a/dom/workers/test/serviceworkers/test_third_party_iframes.html b/dom/workers/test/serviceworkers/test_third_party_iframes.html
index ebea682acc..a4cbf04d67 100644
--- a/dom/workers/test/serviceworkers/test_third_party_iframes.html
+++ b/dom/workers/test/serviceworkers/test_third_party_iframes.html
@@ -143,6 +143,7 @@ let steps = [() => {
     ["dom.serviceWorkers.exemptFromPerDomainMax", true],
     ["dom.serviceWorkers.enabled", true],
     ["dom.serviceWorkers.testing.enabled", true],
+    ["dom.serviceWorkers.interception.enabled", true],
     ["browser.dom.window.dump.enabled", true],
     ["network.cookie.cookieBehavior", COOKIE_BEHAVIOR_ACCEPT]
   ]}, next);
diff --git a/dom/workers/test/test_worker_interfaces.js b/dom/workers/test/test_worker_interfaces.js
index 17a4f1215e..1cf807e3d5 100644
--- a/dom/workers/test/test_worker_interfaces.js
+++ b/dom/workers/test/test_worker_interfaces.js
@@ -164,15 +164,15 @@ var interfaceNamesInGlobalScope =
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "Promise",
 // IMPORTANT: Do not change this list without review from a DOM peer!
-    { name: "PushManager", b2g: false, android: false, release: false },
+    { name: "PushManager", b2g: false, android: false},
 // IMPORTANT: Do not change this list without review from a DOM peer!
-    { name: "PushSubscription", b2g: false, android: false, release: false },
+    { name: "PushSubscription", b2g: false, android: false},
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "Request",
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "Response",
 // IMPORTANT: Do not change this list without review from a DOM peer!
-    { name: "ServiceWorkerRegistration", release: false, b2g: false },
+    { name: "ServiceWorkerRegistration", b2g: false, android: false },
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "TextDecoder",
 // IMPORTANT: Do not change this list without review from a DOM peer!
diff --git a/gfx/2d/DataSurfaceHelpers.cpp b/gfx/2d/DataSurfaceHelpers.cpp
index 6776db2439..965e6ead64 100644
--- a/gfx/2d/DataSurfaceHelpers.cpp
+++ b/gfx/2d/DataSurfaceHelpers.cpp
@@ -110,7 +110,7 @@ CopyBGRXSurfaceDataToPackedBGRArray(uint8_t* aSrc, uint8_t* aDst,
   }
 }
 
-uint8_t*
+UniquePtr<uint8_t[]>
 SurfaceToPackedBGRA(DataSourceSurface *aSurface)
 {
   SurfaceFormat format = aSurface->GetFormat();
@@ -120,25 +120,25 @@ SurfaceToPackedBGRA(DataSourceSurface *aSurface)
 
   IntSize size = aSurface->GetSize();
 
-  uint8_t* imageBuffer = new (std::nothrow) uint8_t[size.width * size.height * sizeof(uint32_t)];
+  UniquePtr<uint8_t[]> imageBuffer(
+    new (std::nothrow) uint8_t[size.width * size.height * sizeof(uint32_t)]);
   if (!imageBuffer) {
     return nullptr;
   }
 
   DataSourceSurface::MappedSurface map;
   if (!aSurface->Map(DataSourceSurface::MapType::READ, &map)) {
-    delete [] imageBuffer;
     return nullptr;
   }
 
-  CopySurfaceDataToPackedArray(map.mData, imageBuffer, size,
+  CopySurfaceDataToPackedArray(map.mData, imageBuffer.get(), size,
                                map.mStride, 4 * sizeof(uint8_t));
 
   aSurface->Unmap();
 
   if (format == SurfaceFormat::B8G8R8X8) {
     // Convert BGRX to BGRA by setting a to 255.
-    ConvertBGRXToBGRA(reinterpret_cast<uint8_t *>(imageBuffer), size, size.width * sizeof(uint32_t));
+    ConvertBGRXToBGRA(imageBuffer.get(), size, size.width * sizeof(uint32_t));
   }
 
   return imageBuffer;
diff --git a/gfx/2d/DataSurfaceHelpers.h b/gfx/2d/DataSurfaceHelpers.h
index 40a4db5b3e..6cd837d64b 100644
--- a/gfx/2d/DataSurfaceHelpers.h
+++ b/gfx/2d/DataSurfaceHelpers.h
@@ -8,6 +8,8 @@
 
 #include "2D.h"
 
+#include "mozilla/UniquePtr.h"
+
 namespace mozilla {
 namespace gfx {
 
@@ -25,11 +27,9 @@ CopySurfaceDataToPackedArray(uint8_t* aSrc, uint8_t* aDst, IntSize aSrcSize,
                              int32_t aSrcStride, int32_t aBytesPerPixel);
 
 /**
- * Convert aSurface to a packed buffer in BGRA format. The pixel data is
- * returned in a buffer allocated with new uint8_t[]. The caller then has
- * ownership of the buffer and is responsible for delete[]'ing it.
+ * Convert aSurface to a packed buffer in BGRA format.
  */
-uint8_t*
+UniquePtr<uint8_t[]>
 SurfaceToPackedBGRA(DataSourceSurface *aSurface);
 
 /**
diff --git a/gfx/2d/DrawTargetCairo.cpp b/gfx/2d/DrawTargetCairo.cpp
index 6c39e514a5..0b358703fd 100644
--- a/gfx/2d/DrawTargetCairo.cpp
+++ b/gfx/2d/DrawTargetCairo.cpp
@@ -669,7 +669,7 @@ GfxFormatForCairoSurface(cairo_surface_t* surface)
   // xlib is currently the only Cairo backend that creates 16bpp surfaces
   if (type == CAIRO_SURFACE_TYPE_XLIB &&
       cairo_xlib_surface_get_depth(surface) == 16) {
-    return SurfaceFormat::R5G6B5;
+    return SurfaceFormat::R5G6B5_UINT16;
   }
 #endif
   return CairoContentToGfxFormat(cairo_surface_get_content(surface));
@@ -1100,7 +1100,7 @@ DrawTargetCairo::ClearRect(const Rect& aRect)
   if (!mContext || aRect.Width() <= 0 || aRect.Height() <= 0 ||
       !IsFinite(aRect.X()) || !IsFinite(aRect.Width()) ||
       !IsFinite(aRect.Y()) || !IsFinite(aRect.Height())) {
-    gfxCriticalError(CriticalLog::DefaultOptions(false)) << "ClearRect with invalid argument " << gfx::hexa(mContext) << " with " << aRect.Width() << "x" << aRect.Height() << " [" << aRect.X() << ", " << aRect.Y() << "]";
+    gfxCriticalNote << "ClearRect with invalid argument " << gfx::hexa(mContext) << " with " << aRect.Width() << "x" << aRect.Height() << " [" << aRect.X() << ", " << aRect.Y() << "]";
   }
 
   cairo_set_antialias(mContext, CAIRO_ANTIALIAS_NONE);
@@ -1476,10 +1476,10 @@ DrawTargetCairo::OptimizeSourceSurface(SourceSurface *aSurface) const
   Display *dpy = DisplayOfScreen(screen);
   XRenderPictFormat* xrenderFormat = nullptr;
   switch (format) {
-  case SurfaceFormat::B8G8R8A8:
+  case SurfaceFormat::A8R8G8B8_UINT32:
     xrenderFormat = XRenderFindStandardFormat(dpy, PictStandardARGB32);
     break;
-  case SurfaceFormat::B8G8R8X8:
+  case SurfaceFormat::X8R8G8B8_UINT32:
     xrenderFormat = XRenderFindStandardFormat(dpy, PictStandardRGB24);
     break;
   case SurfaceFormat::A8:
@@ -1587,7 +1587,7 @@ DrawTargetCairo::InitAlreadyReferenced(cairo_surface_t* aSurface, const IntSize&
   cairo_rectangle(mContext, 0, 0, mSize.width, mSize.height);
   cairo_clip(mContext);
 
-  if (mFormat == SurfaceFormat::B8G8R8A8 ||
+  if (mFormat == SurfaceFormat::A8R8G8B8_UINT32 ||
       mFormat == SurfaceFormat::R8G8B8A8) {
     SetPermitSubpixelAA(false);
   } else {
diff --git a/gfx/2d/DrawTargetD2D.cpp b/gfx/2d/DrawTargetD2D.cpp
index 4ff0e59808..9389d24680 100644
--- a/gfx/2d/DrawTargetD2D.cpp
+++ b/gfx/2d/DrawTargetD2D.cpp
@@ -140,7 +140,7 @@ public:
     RefPtr<ID2D1BitmapBrush> brush;
     HRESULT hr = rt->CreateBitmapBrush(mOldSurfBitmap, D2D1::BitmapBrushProperties(), D2D1::BrushProperties(), getter_AddRefs(brush));
     if (FAILED(hr)) {
-      gfxCriticalError(CriticalLog::DefaultOptions(false)) << "[D2D] CreateBitmapBrush failure " << hexa(hr);
+      gfxCriticalNote << "[D2D] CreateBitmapBrush failure " << hexa(hr);
       return;
     }
 
diff --git a/gfx/2d/DrawTargetD2D1.cpp b/gfx/2d/DrawTargetD2D1.cpp
index 41d0eb3bed..6ed9464f5c 100644
--- a/gfx/2d/DrawTargetD2D1.cpp
+++ b/gfx/2d/DrawTargetD2D1.cpp
@@ -905,7 +905,7 @@ DrawTargetD2D1::Init(const IntSize &aSize, SurfaceFormat aFormat)
   if (mDC->GetMaximumBitmapSize() < UINT32(aSize.width) ||
       mDC->GetMaximumBitmapSize() < UINT32(aSize.height)) {
     // This is 'ok', so don't assert
-    gfxCriticalError(CriticalLog::DefaultOptions(false)) << "[D2D1.1] Attempt to use unsupported surface size " << aSize;
+    gfxCriticalNote << "[D2D1.1] Attempt to use unsupported surface size " << aSize;
     return false;
   }
 
diff --git a/gfx/2d/Factory.cpp b/gfx/2d/Factory.cpp
index f4b411cefc..bbca183afb 100644
--- a/gfx/2d/Factory.cpp
+++ b/gfx/2d/Factory.cpp
@@ -953,5 +953,13 @@ CriticalLogger::OutputMessage(const std::string &aString,
   BasicLogger::OutputMessage(aString, aLevel, aNoNewline);
 }
 
+void
+CriticalLogger::CrashAction(LogReason aReason)
+{
+  if (Factory::GetLogForwarder()) {
+    Factory::GetLogForwarder()->CrashAction(aReason);
+  }
+}
+
 } // namespace gfx
 } // namespace mozilla
diff --git a/gfx/2d/FilterNodeD2D1.cpp b/gfx/2d/FilterNodeD2D1.cpp
index c0709f97eb..114e504017 100644
--- a/gfx/2d/FilterNodeD2D1.cpp
+++ b/gfx/2d/FilterNodeD2D1.cpp
@@ -536,6 +536,27 @@ IsTransferFilterType(FilterType aType)
   }
 }
 
+static bool
+HasUnboundedOutputRegion(FilterType aType)
+{
+  if (IsTransferFilterType(aType)) {
+    return true;
+  }
+
+  switch (aType) {
+    case FilterType::COLOR_MATRIX:
+    case FilterType::POINT_DIFFUSE:
+    case FilterType::SPOT_DIFFUSE:
+    case FilterType::DISTANT_DIFFUSE:
+    case FilterType::POINT_SPECULAR:
+    case FilterType::SPOT_SPECULAR:
+    case FilterType::DISTANT_SPECULAR:
+      return true;
+    default:
+      return false;
+  }
+}
+
 /* static */
 already_AddRefed<FilterNode>
 FilterNodeD2D1::Create(ID2D1DeviceContext *aDC, FilterType aType)
@@ -556,7 +577,7 @@ FilterNodeD2D1::Create(ID2D1DeviceContext *aDC, FilterType aType)
 
   RefPtr<FilterNodeD2D1> filter = new FilterNodeD2D1(effect, aType);
 
-  if (IsTransferFilterType(aType) || aType == FilterType::COLOR_MATRIX) {
+  if (HasUnboundedOutputRegion(aType)) {
     // These filters can produce non-transparent output from transparent
     // input pixels, and we want them to have an unbounded output region.
     filter = new FilterNodeExtendInputAdapterD2D1(aDC, filter, aType);
diff --git a/gfx/2d/FilterNodeSoftware.cpp b/gfx/2d/FilterNodeSoftware.cpp
index 08a2f0342f..7a92e7b9f9 100644
--- a/gfx/2d/FilterNodeSoftware.cpp
+++ b/gfx/2d/FilterNodeSoftware.cpp
@@ -3334,7 +3334,7 @@ template<typename LightType, typename LightingType>
 IntRect
 FilterNodeLightingSoftware<LightType, LightingType>::GetOutputRectInRect(const IntRect& aRect)
 {
-  return GetInputRectInRect(IN_LIGHTING_IN, aRect);
+  return aRect;
 }
 
 Point3D
@@ -3479,7 +3479,7 @@ FilterNodeLightingSoftware<LightType, LightingType>::DoRender(const IntRect& aRe
 
   RefPtr<DataSourceSurface> input =
     GetInputDataSourceSurface(IN_LIGHTING_IN, srcRect, CAN_HANDLE_A8,
-                              EDGE_MODE_DUPLICATE);
+                              EDGE_MODE_NONE);
 
   if (!input) {
     return nullptr;
diff --git a/gfx/2d/HelpersCairo.h b/gfx/2d/HelpersCairo.h
index 7f753d0155..9ea88e29a4 100644
--- a/gfx/2d/HelpersCairo.h
+++ b/gfx/2d/HelpersCairo.h
@@ -147,13 +147,13 @@ GfxFormatToCairoFormat(SurfaceFormat format)
 {
   switch (format)
   {
-    case SurfaceFormat::B8G8R8A8:
+    case SurfaceFormat::A8R8G8B8_UINT32:
       return CAIRO_FORMAT_ARGB32;
-    case SurfaceFormat::B8G8R8X8:
+    case SurfaceFormat::X8R8G8B8_UINT32:
       return CAIRO_FORMAT_RGB24;
     case SurfaceFormat::A8:
       return CAIRO_FORMAT_A8;
-    case SurfaceFormat::R5G6B5:
+    case SurfaceFormat::R5G6B5_UINT16:
       return CAIRO_FORMAT_RGB16_565;
     default:
       gfxCriticalError() << "Unknown image format " << (int)format;
@@ -166,10 +166,10 @@ GfxFormatToCairoContent(SurfaceFormat format)
 {
   switch (format)
   {
-    case SurfaceFormat::B8G8R8A8:
+    case SurfaceFormat::A8R8G8B8_UINT32:
       return CAIRO_CONTENT_COLOR_ALPHA;
-    case SurfaceFormat::B8G8R8X8:
-    case SurfaceFormat::R5G6B5:  //fall through
+    case SurfaceFormat::X8R8G8B8_UINT32:
+    case SurfaceFormat::R5G6B5_UINT16:  //fall through
       return CAIRO_CONTENT_COLOR;
     case SurfaceFormat::A8:
       return CAIRO_CONTENT_ALPHA;
@@ -219,10 +219,10 @@ CairoContentToGfxFormat(cairo_content_t content)
   switch (content)
   {
     case CAIRO_CONTENT_COLOR_ALPHA:
-      return SurfaceFormat::B8G8R8A8;
+      return SurfaceFormat::A8R8G8B8_UINT32;
     case CAIRO_CONTENT_COLOR:
       // BEWARE! format may be 565
-      return SurfaceFormat::B8G8R8X8;
+      return SurfaceFormat::X8R8G8B8_UINT32;
     case CAIRO_CONTENT_ALPHA:
       return SurfaceFormat::A8;
   }
@@ -235,13 +235,13 @@ CairoFormatToGfxFormat(cairo_format_t format)
 {
   switch (format) {
     case CAIRO_FORMAT_ARGB32:
-      return SurfaceFormat::B8G8R8A8;
+      return SurfaceFormat::A8R8G8B8_UINT32;
     case CAIRO_FORMAT_RGB24:
-      return SurfaceFormat::B8G8R8X8;
+      return SurfaceFormat::X8R8G8B8_UINT32;
     case CAIRO_FORMAT_A8:
       return SurfaceFormat::A8;
     case CAIRO_FORMAT_RGB16_565:
-      return SurfaceFormat::R5G6B5;
+      return SurfaceFormat::R5G6B5_UINT16;
     default:
       gfxCriticalError() << "Unknown cairo format " << format;
       return SurfaceFormat::UNKNOWN;
diff --git a/gfx/2d/HelpersSkia.h b/gfx/2d/HelpersSkia.h
index 530846716e..7b698520ef 100644
--- a/gfx/2d/HelpersSkia.h
+++ b/gfx/2d/HelpersSkia.h
@@ -30,7 +30,7 @@ GfxFormatToSkiaColorType(SurfaceFormat format)
     case SurfaceFormat::B8G8R8X8:
       // We probably need to do something here.
       return kBGRA_8888_SkColorType;
-    case SurfaceFormat::R5G6B5:
+    case SurfaceFormat::R5G6B5_UINT16:
       return kRGB_565_SkColorType;
     case SurfaceFormat::A8:
       return kAlpha_8_SkColorType;
@@ -47,7 +47,7 @@ SkiaColorTypeToGfxFormat(SkColorType type)
     case kBGRA_8888_SkColorType:
       return SurfaceFormat::B8G8R8A8;
     case kRGB_565_SkColorType:
-      return SurfaceFormat::R5G6B5;
+      return SurfaceFormat::R5G6B5_UINT16;
     case kAlpha_8_SkColorType:
       return SurfaceFormat::A8;
     default:
@@ -66,7 +66,7 @@ GfxFormatToGrConfig(SurfaceFormat format)
     case SurfaceFormat::B8G8R8X8:
       // We probably need to do something here.
       return kBGRA_8888_GrPixelConfig;
-    case SurfaceFormat::R5G6B5:
+    case SurfaceFormat::R5G6B5_UINT16:
       return kRGB_565_GrPixelConfig;
     case SurfaceFormat::A8:
       return kAlpha_8_GrPixelConfig;
diff --git a/gfx/2d/Logging.h b/gfx/2d/Logging.h
index ccfbfb0f61..7941dd9762 100644
--- a/gfx/2d/Logging.h
+++ b/gfx/2d/Logging.h
@@ -127,6 +127,18 @@ private:
 /// is further controlled by "gfx2d" PR logging module.  However, in the case
 /// where such module would disable the output, in all but gfxDebug cases,
 /// we will still send a printf.
+
+// The range is due to the values set in Histograms.json
+enum class LogReason : int {
+  MustBeMoreThanThis = -1,
+  // Start.  Do not insert, always add at end.  If you remove items,
+  // make sure the other items retain their values.
+  D3D11InvalidCallDeviceRemoved = 0,
+  D3D11InvalidCall = 1,
+  // End
+  MustBeLessThanThis = 101,
+};
+
 struct BasicLogger
 {
   // For efficiency, this method exists and copies the logic of the
@@ -151,6 +163,9 @@ struct BasicLogger
     return false;
   }
 
+  // Only for really critical errors.
+  static void CrashAction(LogReason aReason) {}
+
   static void OutputMessage(const std::string &aString,
                             int aLevel,
                             bool aNoNewline) {
@@ -183,6 +198,7 @@ struct BasicLogger
 
 struct CriticalLogger {
   static void OutputMessage(const std::string &aString, int aLevel, bool aNoNewline);
+  static void CrashAction(LogReason aReason);
 };
 
 // Implement this interface and init the Factory with an instance to
@@ -191,6 +207,7 @@ class LogForwarder {
 public:
   virtual ~LogForwarder() {}
   virtual void Log(const std::string &aString) = 0;
+  virtual void CrashAction(LogReason aReason) = 0;
 
   // Provide a copy of the logs to the caller.  The int is the index
   // of the Log call, if the number of logs exceeds some preset capacity
@@ -215,7 +232,8 @@ public:
 enum class LogOptions : int {
   NoNewline = 0x01,
   AutoPrefix = 0x02,
-  AssertOnCall = 0x04
+  AssertOnCall = 0x04,
+  CrashAction = 0x08,
 };
 
 template<typename T>
@@ -241,8 +259,9 @@ public:
   // Logger::ShouldOutputMessage.  Since we currently don't have a different
   // version of that method for different loggers, this is OK. Once we do,
   // change BasicLogger::ShouldOutputMessage to Logger::ShouldOutputMessage.
-  explicit Log(int aOptions = Log::DefaultOptions(L == LOG_CRITICAL)) {
-    Init(aOptions, BasicLogger::ShouldOutputMessage(L));
+  explicit Log(int aOptions = Log::DefaultOptions(L == LOG_CRITICAL),
+               LogReason aReason = LogReason::MustBeMoreThanThis) {
+    Init(aOptions, BasicLogger::ShouldOutputMessage(L), aReason);
   }
 
   ~Log() {
@@ -381,8 +400,8 @@ public:
         case SurfaceFormat::R8G8B8X8:
           mMessage << "SurfaceFormat::R8G8B8X8";
           break;
-        case SurfaceFormat::R5G6B5:
-          mMessage << "SurfaceFormat::R5G6B5";
+        case SurfaceFormat::R5G6B5_UINT16:
+          mMessage << "SurfaceFormat::R5G6B5_UINT16";
           break;
         case SurfaceFormat::A8:
           mMessage << "SurfaceFormat::A8";
@@ -451,22 +470,30 @@ public:
   inline bool LogIt() const { return mLogIt; }
   inline bool NoNewline() const { return mOptions & int(LogOptions::NoNewline); }
   inline bool AutoPrefix() const { return mOptions & int(LogOptions::AutoPrefix); }
+  inline bool ValidReason() const { return (int)mReason > (int)LogReason::MustBeMoreThanThis && (int)mReason < (int)LogReason::MustBeLessThanThis; }
 
   // We do not want this version to do any work, and stringstream can't be
   // copied anyway.  It does come in handy for the "Once" macro defined below.
-  MOZ_IMPLICIT Log(const Log& log) { Init(log.mOptions, false); }
+  MOZ_IMPLICIT Log(const Log& log) { Init(log.mOptions, false, log.mReason); }
 
 private:
   // Initialization common to two constructors
-  void Init(int aOptions, bool aLogIt) {
+  void Init(int aOptions, bool aLogIt, LogReason aReason) {
     mOptions = aOptions;
+    mReason = aReason;
     mLogIt = aLogIt;
-    if (mLogIt && AutoPrefix()) {
-      if (mOptions & int(LogOptions::AssertOnCall)) {
-        mMessage << "[GFX" << L << "]: ";
-      } else {
-        mMessage << "[GFX" << L << "-]: ";
+    if (mLogIt) {
+      if (AutoPrefix()) {
+        if (mOptions & int(LogOptions::AssertOnCall)) {
+          mMessage << "[GFX" << L;
+        } else {
+          mMessage << "[GFX" << L << "-";
+        }
       }
+      if ((mOptions & int(LogOptions::CrashAction)) && ValidReason()) {
+        mMessage << " " << (int)mReason;
+      }
+      mMessage << "]: ";
     }
   }
 
@@ -476,11 +503,15 @@ private:
       if (mOptions & int(LogOptions::AssertOnCall)) {
         MOZ_ASSERT(false, "An assert from the graphics logger");
       }
+      if ((mOptions & int(LogOptions::CrashAction)) && ValidReason()) {
+        Logger::CrashAction(mReason);
+      }
     }
   }
 
   std::stringstream mMessage;
   int mOptions;
+  LogReason mReason;
   bool mLogIt;
 };
 
@@ -531,6 +562,14 @@ typedef Log<LOG_CRITICAL, CriticalLogger> CriticalLog;
 #define gfxWarningOnce if (1) ; else mozilla::gfx::NoLog
 #endif
 
+// In the debug build, this is equivalent to the default gfxCriticalError.
+// In the non-debug build, on nightly and dev edition, it will MOZ_CRASH.
+// On beta and release versions, it will telemetry count, but proceed.
+//
+// You should create a (new) enum in the LogReason and use it for the reason
+// parameter to ensure uniqueness.
+#define gfxDevCrash(reason) gfxCriticalError(int(LogOptions::AutoPrefix) | int(LogOptions::AssertOnCall) | int(LogOptions::CrashAction), (reason))
+
 // See nsDebug.h and the NS_WARN_IF macro
 
 #ifdef __cplusplus
diff --git a/gfx/2d/Tools.h b/gfx/2d/Tools.h
index 2fbefacf1f..c56d4db2a6 100644
--- a/gfx/2d/Tools.h
+++ b/gfx/2d/Tools.h
@@ -86,7 +86,7 @@ BytesPerPixel(SurfaceFormat aFormat)
   switch (aFormat) {
   case SurfaceFormat::A8:
     return 1;
-  case SurfaceFormat::R5G6B5:
+  case SurfaceFormat::R5G6B5_UINT16:
     return 2;
   default:
     return 4;
diff --git a/gfx/2d/Types.h b/gfx/2d/Types.h
index d41417a8c8..7a9d2923c3 100644
--- a/gfx/2d/Types.h
+++ b/gfx/2d/Types.h
@@ -6,6 +6,8 @@
 #ifndef MOZILLA_GFX_TYPES_H_
 #define MOZILLA_GFX_TYPES_H_
 
+#include "mozilla/Endian.h"
+
 #include <stddef.h>
 #include <stdint.h>
 
@@ -30,15 +32,44 @@ enum class SurfaceType : int8_t {
 };
 
 enum class SurfaceFormat : int8_t {
-  B8G8R8A8,
-  B8G8R8X8,
-  R8G8B8A8,
-  R8G8B8X8,
-  R5G6B5,
+  // The following values are named to reflect layout of colors in memory, from
+  // lowest byte to highest byte. The 32-bit value layout depends on machine
+  // endianness.
+  //               in-memory            32-bit LE value   32-bit BE value
+  B8G8R8A8,     // [BB, GG, RR, AA]     0xAARRGGBB        0xBBGGRRAA
+  B8G8R8X8,     // [BB, GG, RR, 00]     0x00RRGGBB        0xBBGGRR00
+  R8G8B8A8,     // [RR, GG, BB, AA]     0xAABBGGRR        0xRRGGBBAA
+  R8G8B8X8,     // [RR, GG, BB, 00]     0x00BBGGRR        0xRRGGBB00
+  A8R8G8B8,     // [AA, RR, GG, BB]     0xBBGGRRAA        0xAARRGGBB
+  X8R8G8B8,     // [00, RR, GG, BB]     0xBBGGRR00        0x00RRGGBB
+
+  // The _UINT16 suffix here indicates that the name reflects the layout when
+  // viewed as a uint16_t value. In memory these values are stored using native
+  // endianness.
+  R5G6B5_UINT16,                    // 0bRRRRRGGGGGGBBBBB
+
+  // This one is a single-byte, so endianness isn't an issue.
   A8,
+
+  // These ones are their own special cases.
   YUV,
   NV12,
-  UNKNOWN
+
+  // This represents the unknown format.
+  UNKNOWN,
+
+  // The following values are endian-independent synonyms. The _UINT32 suffix
+  // indicates that the name reflects the layout when viewed as a uint32_t
+  // value.
+#if MOZ_LITTLE_ENDIAN
+  A8R8G8B8_UINT32 = B8G8R8A8,       // 0xAARRGGBB
+  X8R8G8B8_UINT32 = B8G8R8X8        // 0x00RRGGBB
+#elif MOZ_BIG_ENDIAN
+  A8R8G8B8_UINT32 = A8R8G8B8,       // 0xAARRGGBB
+  X8R8G8B8_UINT32 = X8R8G8B8        // 0x00RRGGBB
+#else
+# error "bad endianness"
+#endif
 };
 
 inline bool IsOpaque(SurfaceFormat aFormat)
@@ -46,7 +77,7 @@ inline bool IsOpaque(SurfaceFormat aFormat)
   switch (aFormat) {
   case SurfaceFormat::B8G8R8X8:
   case SurfaceFormat::R8G8B8X8:
-  case SurfaceFormat::R5G6B5:
+  case SurfaceFormat::R5G6B5_UINT16:
   case SurfaceFormat::YUV:
   case SurfaceFormat::NV12:
     return true;
diff --git a/gfx/2d/moz.build b/gfx/2d/moz.build
index eea261b1a1..def5628f06 100644
--- a/gfx/2d/moz.build
+++ b/gfx/2d/moz.build
@@ -42,6 +42,7 @@ EXPORTS.mozilla.gfx += [
     'ScaleFactor.h',
     'ScaleFactors2D.h',
     'SourceSurfaceCairo.h',
+    'StackArray.h',
     'Tools.h',
     'Types.h',
     'UserData.h',
diff --git a/gfx/gl/GLBlitHelper.cpp b/gfx/gl/GLBlitHelper.cpp
index 82e595fc73..b671c02858 100644
--- a/gfx/gl/GLBlitHelper.cpp
+++ b/gfx/gl/GLBlitHelper.cpp
@@ -12,6 +12,7 @@
 #include "ImageContainer.h"
 #include "HeapCopyOfStackArray.h"
 #include "mozilla/gfx/Matrix.h"
+#include "mozilla/UniquePtr.h"
 
 #ifdef MOZ_WIDGET_GONK
 #include "GrallocImages.h"
@@ -289,8 +290,8 @@ GLBlitHelper::InitTexQuadProgram(BlitType target)
                     break;
                 }
 
-                nsAutoArrayPtr<char> buffer(new char[length]);
-                mGL->fGetShaderInfoLog(mTexBlit_VertShader, length, nullptr, buffer);
+                auto buffer = MakeUnique<char[]>(length);
+                mGL->fGetShaderInfoLog(mTexBlit_VertShader, length, nullptr, buffer.get());
 
                 printf_stderr("Shader info log (%d bytes): %s\n", length, buffer.get());
                 break;
@@ -308,8 +309,8 @@ GLBlitHelper::InitTexQuadProgram(BlitType target)
                     break;
                 }
 
-                nsAutoArrayPtr<char> buffer(new char[length]);
-                mGL->fGetShaderInfoLog(fragShader, length, nullptr, buffer);
+                auto buffer = MakeUnique<char[]>(length);
+                mGL->fGetShaderInfoLog(fragShader, length, nullptr, buffer.get());
 
                 printf_stderr("Shader info log (%d bytes): %s\n", length, buffer.get());
                 break;
@@ -328,8 +329,8 @@ GLBlitHelper::InitTexQuadProgram(BlitType target)
                     break;
                 }
 
-                nsAutoArrayPtr<char> buffer(new char[length]);
-                mGL->fGetProgramInfoLog(program, length, nullptr, buffer);
+                auto buffer = MakeUnique<char[]>(length);
+                mGL->fGetProgramInfoLog(program, length, nullptr, buffer.get());
 
                 printf_stderr("Program info log (%d bytes): %s\n", length, buffer.get());
             }
diff --git a/gfx/gl/GLContext.cpp b/gfx/gl/GLContext.cpp
index 35c8155ffb..4c8e1c74ea 100644
--- a/gfx/gl/GLContext.cpp
+++ b/gfx/gl/GLContext.cpp
@@ -16,6 +16,7 @@
 #include "GLReadTexImageHelper.h"
 #include "GLScreenBuffer.h"
 
+#include "gfxEnv.h"
 #include "gfxUtils.h"
 #include "GLContextProvider.h"
 #include "GLTextureImage.h"
@@ -632,16 +633,16 @@ GLContext::InitWithPrefix(const char *prefix, bool trygl)
 
 
 #ifdef MOZ_GL_DEBUG
-    if (PR_GetEnv("MOZ_GL_DEBUG"))
+    if (gfxEnv::GlDebug())
         sDebugMode |= DebugEnabled;
 
     // enables extra verbose output, informing of the start and finish of every GL call.
     // useful e.g. to record information to investigate graphics system crashes/lockups
-    if (PR_GetEnv("MOZ_GL_DEBUG_VERBOSE"))
+    if (gfxEnv::GlDebugVerbose())
         sDebugMode |= DebugTrace;
 
     // aborts on GL error. Can be useful to debug quicker code that is known not to generate any GL error in principle.
-    if (PR_GetEnv("MOZ_GL_DEBUG_ABORT_ON_ERROR"))
+    if (gfxEnv::GlDebugAbortOnError())
         sDebugMode |= DebugAbortOnError;
 #endif
 
@@ -2570,8 +2571,7 @@ GLContext::FlushIfHeavyGLCallsSinceLastFlush()
 /*static*/ bool
 GLContext::ShouldDumpExts()
 {
-    static bool ret = PR_GetEnv("MOZ_GL_DUMP_EXTS");
-    return ret;
+    return gfxEnv::GlDumpExtensions();
 }
 
 bool
@@ -2601,8 +2601,7 @@ DoesStringMatch(const char* aString, const char *aWantedString)
 /*static*/ bool
 GLContext::ShouldSpew()
 {
-    static bool ret = PR_GetEnv("MOZ_GL_SPEW");
-    return ret;
+    return gfxEnv::GlSpew();
 }
 
 void
diff --git a/gfx/gl/GLContextProviderGLX.cpp b/gfx/gl/GLContextProviderGLX.cpp
index 5a9dd5b6d9..f1129ce8fc 100644
--- a/gfx/gl/GLContextProviderGLX.cpp
+++ b/gfx/gl/GLContextProviderGLX.cpp
@@ -26,6 +26,7 @@
 #include "GLXLibrary.h"
 #include "gfxXlibSurface.h"
 #include "gfxContext.h"
+#include "gfxEnv.h"
 #include "gfxPlatform.h"
 #include "GLContextGLX.h"
 #include "gfxUtils.h"
@@ -96,7 +97,7 @@ GLXLibrary::EnsureInitialized()
         reporter.SetSuccessful();
     }
 
-    if (PR_GetEnv("MOZ_GLX_DEBUG")) {
+    if (gfxEnv::GlxDebug()) {
         mDebug = true;
     }
 
@@ -1281,16 +1282,8 @@ GLContextProviderGLX::CreateOffscreen(const IntSize& size,
 /*static*/ GLContext*
 GLContextProviderGLX::GetGlobalContext()
 {
-    static bool checkedContextSharing = false;
-    static bool useContextSharing = false;
-
-    if (!checkedContextSharing) {
-        useContextSharing = getenv("MOZ_DISABLE_CONTEXT_SHARING_GLX") == 0;
-        checkedContextSharing = true;
-    }
-
     // TODO: get GLX context sharing to work well with multiple threads
-    if (!useContextSharing) {
+    if (gfxEnv::DisableContextSharingGlx()) {
         return nullptr;
     }
 
diff --git a/gfx/gl/GLReadTexImageHelper.cpp b/gfx/gl/GLReadTexImageHelper.cpp
index 92f8871813..a38afdad9b 100644
--- a/gfx/gl/GLReadTexImageHelper.cpp
+++ b/gfx/gl/GLReadTexImageHelper.cpp
@@ -274,7 +274,7 @@ CopyDataSourceSurface(DataSourceSurface* aSource,
                aDest->GetFormat() == SurfaceFormat::R8G8B8X8 ||
                aDest->GetFormat() == SurfaceFormat::B8G8R8A8 ||
                aDest->GetFormat() == SurfaceFormat::B8G8R8X8 ||
-               aDest->GetFormat() == SurfaceFormat::R5G6B5);
+               aDest->GetFormat() == SurfaceFormat::R5G6B5_UINT16);
 
     const bool isSrcBGR = aSource->GetFormat() == SurfaceFormat::B8G8R8A8 ||
                           aSource->GetFormat() == SurfaceFormat::B8G8R8X8;
@@ -288,7 +288,7 @@ CopyDataSourceSurface(DataSourceSurface* aSource,
                               aDest->GetFormat() == SurfaceFormat::B8G8R8A8;
     const bool needsAlphaMask = !srcHasAlpha && destHasAlpha;
 
-    const bool needsConvertTo16Bits = aDest->GetFormat() == SurfaceFormat::R5G6B5;
+    const bool needsConvertTo16Bits = aDest->GetFormat() == SurfaceFormat::R5G6B5_UINT16;
 
     DataSourceSurface::MappedSurface srcMap;
     DataSourceSurface::MappedSurface destMap;
@@ -394,7 +394,7 @@ ReadPixelsIntoDataSurface(GLContext* gl, DataSourceSurface* dest)
         destFormat = LOCAL_GL_RGBA;
         destType = LOCAL_GL_UNSIGNED_BYTE;
         break;
-    case SurfaceFormat::R5G6B5:
+    case SurfaceFormat::R5G6B5_UINT16:
         destFormat = LOCAL_GL_RGB;
         destType = LOCAL_GL_UNSIGNED_SHORT_5_6_5_REV;
         break;
@@ -438,7 +438,7 @@ ReadPixelsIntoDataSurface(GLContext* gl, DataSourceSurface* dest)
             case LOCAL_GL_RGB: {
                 MOZ_ASSERT(destPixelSize == 2);
                 MOZ_ASSERT(readType == LOCAL_GL_UNSIGNED_SHORT_5_6_5_REV);
-                readFormatGFX = SurfaceFormat::R5G6B5;
+                readFormatGFX = SurfaceFormat::R5G6B5_UINT16;
                 break;
             }
             default: {
diff --git a/gfx/gl/GLUploadHelpers.cpp b/gfx/gl/GLUploadHelpers.cpp
index 78867db529..0a65041984 100644
--- a/gfx/gl/GLUploadHelpers.cpp
+++ b/gfx/gl/GLUploadHelpers.cpp
@@ -486,10 +486,10 @@ UploadImageDataToTexture(GLContext* gl,
             }
             internalFormat = LOCAL_GL_RGBA;
             break;
-        case SurfaceFormat::R5G6B5:
+        case SurfaceFormat::R5G6B5_UINT16:
             internalFormat = format = LOCAL_GL_RGB;
             type = LOCAL_GL_UNSIGNED_SHORT_5_6_5;
-            surfaceFormat = SurfaceFormat::R5G6B5;
+            surfaceFormat = SurfaceFormat::R5G6B5_UINT16;
             break;
         case SurfaceFormat::A8:
             internalFormat = format = LOCAL_GL_LUMINANCE;
diff --git a/gfx/gl/GLUploadHelpers.h b/gfx/gl/GLUploadHelpers.h
index 5ce7875fc2..46db6fe068 100644
--- a/gfx/gl/GLUploadHelpers.h
+++ b/gfx/gl/GLUploadHelpers.h
@@ -9,8 +9,7 @@
 #include "GLDefs.h"
 #include "mozilla/gfx/Types.h"
 #include "nsPoint.h"
-
-class nsIntRegion;
+#include "nsRegionFwd.h"
 
 namespace mozilla {
 
diff --git a/gfx/gl/TextureImageEGL.cpp b/gfx/gl/TextureImageEGL.cpp
index 95a4fae8db..1f4323b60e 100644
--- a/gfx/gl/TextureImageEGL.cpp
+++ b/gfx/gl/TextureImageEGL.cpp
@@ -20,7 +20,7 @@ GLFormatForImage(gfx::SurfaceFormat aFormat)
     case gfx::SurfaceFormat::B8G8R8A8:
     case gfx::SurfaceFormat::B8G8R8X8:
         return LOCAL_GL_RGBA;
-    case gfx::SurfaceFormat::R5G6B5:
+    case gfx::SurfaceFormat::R5G6B5_UINT16:
         return LOCAL_GL_RGB;
     case gfx::SurfaceFormat::A8:
         return LOCAL_GL_LUMINANCE;
@@ -38,7 +38,7 @@ GLTypeForImage(gfx::SurfaceFormat aFormat)
     case gfx::SurfaceFormat::B8G8R8X8:
     case gfx::SurfaceFormat::A8:
         return LOCAL_GL_UNSIGNED_BYTE;
-    case gfx::SurfaceFormat::R5G6B5:
+    case gfx::SurfaceFormat::R5G6B5_UINT16:
         return LOCAL_GL_UNSIGNED_SHORT_5_6_5;
     default:
         NS_WARNING("Unknown GL format for Surface format");
@@ -69,7 +69,7 @@ TextureImageEGL::TextureImageEGL(GLuint aTexture,
                 gfxPlatform::GetPlatform()->Optimal2DFormatForContent(GetContentType());
     }
 
-    if (mUpdateFormat == gfx::SurfaceFormat::R5G6B5) {
+    if (mUpdateFormat == gfx::SurfaceFormat::R5G6B5_UINT16) {
         mTextureFormat = gfx::SurfaceFormat::R8G8B8X8;
     } else if (mUpdateFormat == gfx::SurfaceFormat::B8G8R8X8) {
         mTextureFormat = gfx::SurfaceFormat::B8G8R8X8;
diff --git a/gfx/ipc/SharedDIB.h b/gfx/ipc/SharedDIB.h
index b6df420760..6c48b28756 100644
--- a/gfx/ipc/SharedDIB.h
+++ b/gfx/ipc/SharedDIB.h
@@ -17,6 +17,8 @@ class SharedDIB
 public:
   typedef base::SharedMemoryHandle Handle;
 
+  static const uint32_t kBytesPerPixel = 4;
+
 public:
   SharedDIB();
   ~SharedDIB();
diff --git a/gfx/ipc/SharedDIBSurface.cpp b/gfx/ipc/SharedDIBSurface.cpp
index 4760a02971..656abab8fa 100644
--- a/gfx/ipc/SharedDIBSurface.cpp
+++ b/gfx/ipc/SharedDIBSurface.cpp
@@ -12,8 +12,6 @@ namespace gfx {
 
 static const cairo_user_data_key_t SHAREDDIB_KEY = {0};
 
-static const long kBytesPerPixel = 4;
-
 bool
 SharedDIBSurface::Create(HDC adc, uint32_t aWidth, uint32_t aHeight,
                          bool aTransparent)
@@ -42,7 +40,7 @@ void
 SharedDIBSurface::InitSurface(uint32_t aWidth, uint32_t aHeight,
                               bool aTransparent)
 {
-  long stride = long(aWidth * kBytesPerPixel);
+  long stride = long(aWidth * SharedDIB::kBytesPerPixel);
   unsigned char* data = reinterpret_cast<unsigned char*>(mSharedDIB.GetBits());
 
   gfxImageFormat format = aTransparent ? gfxImageFormat::ARGB32 : gfxImageFormat::RGB24;
diff --git a/gfx/ipc/SharedDIBWin.cpp b/gfx/ipc/SharedDIBWin.cpp
index 8296bdc7f7..cd40e835da 100644
--- a/gfx/ipc/SharedDIBWin.cpp
+++ b/gfx/ipc/SharedDIBWin.cpp
@@ -11,7 +11,6 @@
 namespace mozilla {
 namespace gfx {
 
-static const uint32_t kBytesPerPixel = 4;
 static const uint32_t kByteAlign = 1 << gfxAlphaRecovery::GoodAlignmentLog2();
 static const uint32_t kHeaderBytes =
   (sizeof(BITMAPV4HEADER) + kByteAlign - 1) & ~(kByteAlign - 1);
@@ -136,6 +135,5 @@ SharedDIBWin::SetupSurface(HDC aHdc, BITMAPV4HEADER *aHdr)
   return NS_OK;
 }
 
-
 } // gfx
 } // mozilla
diff --git a/gfx/ipc/moz.build b/gfx/ipc/moz.build
index 06742a3609..2051e34a82 100644
--- a/gfx/ipc/moz.build
+++ b/gfx/ipc/moz.build
@@ -17,12 +17,12 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'windows':
         'SharedDIBSurface.h',
         'SharedDIBWin.h',
     ]
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'SharedDIBSurface.cpp',
         'SharedDIBWin.cpp',
     ]
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'SharedDIB.cpp',
 ]
 
@@ -36,3 +36,6 @@ FINAL_LIBRARY = 'xul'
 
 CXXFLAGS += CONFIG['MOZ_CAIRO_CFLAGS']
 CXXFLAGS += CONFIG['TK_CFLAGS']
+
+if CONFIG['GNU_CXX']:
+    CXXFLAGS += ['-Wshadow']
diff --git a/gfx/layers/Compositor.cpp b/gfx/layers/Compositor.cpp
index 2ddf4f05c9..75d4c6acb0 100644
--- a/gfx/layers/Compositor.cpp
+++ b/gfx/layers/Compositor.cpp
@@ -11,6 +11,13 @@
 #include "gfx2DGlue.h"
 #include "nsAppRunner.h"
 
+#if defined(MOZ_WIDGET_GONK) && ANDROID_VERSION >= 17
+#include "libdisplay/GonkDisplay.h"     // for GonkDisplay
+#include <ui/Fence.h>
+#include "nsWindow.h"
+#include "nsScreenManagerGonk.h"
+#endif
+
 namespace mozilla {
 namespace gfx {
 class Matrix4x4;
@@ -104,7 +111,13 @@ Compositor::DrawDiagnosticsInternal(DiagnosticFlags aFlags,
       color = gfx::Color(0.0f, 1.0f, 1.0f, 1.0f); // greenish blue
     }
   } else if (aFlags & DiagnosticFlags::IMAGE) {
-    color = gfx::Color(1.0f, 0.0f, 0.0f, 1.0f); // red
+    if (aFlags & DiagnosticFlags::NV12) {
+      color = gfx::Color(1.0f, 1.0f, 0.0f, 1.0f); // yellow
+    } else if (aFlags & DiagnosticFlags::YCBCR) {
+      color = gfx::Color(1.0f, 0.55f, 0.0f, 1.0f); // orange
+    } else {
+      color = gfx::Color(1.0f, 0.0f, 0.0f, 1.0f); // red
+    }
   } else if (aFlags & DiagnosticFlags::COLOR) {
     color = gfx::Color(0.0f, 0.0f, 1.0f, 1.0f); // blue
   } else if (aFlags & DiagnosticFlags::CONTAINER) {
@@ -353,5 +366,49 @@ DecomposeIntoNoRepeatRects(const gfx::Rect& aRect,
   return 4;
 }
 
+#if defined(MOZ_WIDGET_GONK) && ANDROID_VERSION >= 17
+void
+Compositor::SetDispAcquireFence(Layer* aLayer, nsIWidget* aWidget)
+{
+  // OpenGL does not provide ReleaseFence for rendering.
+  // Instead use DispAcquireFence as layer buffer's ReleaseFence
+  // to prevent flickering and tearing.
+  // DispAcquireFence is DisplaySurface's AcquireFence.
+  // AcquireFence will be signaled when a buffer's content is available.
+  // See Bug 974152.
+
+  if (!aLayer || !aWidget) {
+    return;
+  }
+  nsWindow* window = static_cast<nsWindow*>(aWidget);
+  RefPtr<FenceHandle::FdObj> fence = new FenceHandle::FdObj(
+      window->GetScreen()->GetPrevDispAcquireFd());
+  mReleaseFenceHandle.Merge(FenceHandle(fence));
+}
+
+FenceHandle
+Compositor::GetReleaseFence()
+{
+  if (!mReleaseFenceHandle.IsValid()) {
+    return FenceHandle();
+  }
+
+  RefPtr<FenceHandle::FdObj> fdObj = mReleaseFenceHandle.GetDupFdObj();
+  return FenceHandle(fdObj);
+}
+
+#else
+void
+Compositor::SetDispAcquireFence(Layer* aLayer, nsIWidget* aWidget)
+{
+}
+
+FenceHandle
+Compositor::GetReleaseFence()
+{
+  return FenceHandle();
+}
+#endif
+
 } // namespace layers
 } // namespace mozilla
diff --git a/gfx/layers/Compositor.h b/gfx/layers/Compositor.h
index 13648a9289..77ebeac5cc 100644
--- a/gfx/layers/Compositor.h
+++ b/gfx/layers/Compositor.h
@@ -106,7 +106,6 @@
  */
 
 class nsIWidget;
-class nsIntRegion;
 
 namespace mozilla {
 namespace gfx {
@@ -370,12 +369,9 @@ public:
    */
   virtual void EndFrame() = 0;
 
-  virtual void SetDispAcquireFence(Layer* aLayer, nsIWidget* aWidget) {}
+  virtual void SetDispAcquireFence(Layer* aLayer, nsIWidget* aWidget);
 
-  virtual FenceHandle GetReleaseFence()
-  {
-    return FenceHandle();
-  }
+  virtual FenceHandle GetReleaseFence();
 
   /**
    * Post-rendering stuff if the rendering is done outside of this Compositor
@@ -541,6 +537,10 @@ protected:
   RefPtr<gfx::DrawTarget> mTarget;
   gfx::IntRect mTargetBounds;
 
+#if defined(MOZ_WIDGET_GONK) && ANDROID_VERSION >= 17
+  FenceHandle mReleaseFenceHandle;
+#endif
+
 private:
   static LayersBackend sBackend;
 
diff --git a/gfx/layers/CompositorTypes.h b/gfx/layers/CompositorTypes.h
index e6e56abef3..3b8fb5900b 100644
--- a/gfx/layers/CompositorTypes.h
+++ b/gfx/layers/CompositorTypes.h
@@ -107,7 +107,9 @@ enum class DiagnosticFlags : uint16_t {
   TILE            = 1 << 5,
   BIGIMAGE        = 1 << 6,
   COMPONENT_ALPHA = 1 << 7,
-  REGION_RECT     = 1 << 8
+  REGION_RECT     = 1 << 8,
+  NV12            = 1 << 9,
+  YCBCR           = 1 << 10
 };
 MOZ_MAKE_ENUM_CLASS_BITWISE_OPERATORS(DiagnosticFlags)
 
diff --git a/gfx/layers/Effects.h b/gfx/layers/Effects.h
index 8ae40100e6..2bea06d8a3 100644
--- a/gfx/layers/Effects.h
+++ b/gfx/layers/Effects.h
@@ -267,7 +267,7 @@ CreateTexturedEffect(gfx::SurfaceFormat aFormat,
   case gfx::SurfaceFormat::B8G8R8A8:
   case gfx::SurfaceFormat::B8G8R8X8:
   case gfx::SurfaceFormat::R8G8B8X8:
-  case gfx::SurfaceFormat::R5G6B5:
+  case gfx::SurfaceFormat::R5G6B5_UINT16:
   case gfx::SurfaceFormat::R8G8B8A8:
     result = new EffectRGB(aSource, isAlphaPremultiplied, aFilter);
     break;
diff --git a/gfx/layers/GrallocImages.cpp b/gfx/layers/GrallocImages.cpp
index ab67be169c..e3427001cd 100644
--- a/gfx/layers/GrallocImages.cpp
+++ b/gfx/layers/GrallocImages.cpp
@@ -34,6 +34,7 @@ int32_t GrallocImage::sColorIdMap[] = {
     HAL_PIXEL_FORMAT_YCbCr_420_SP_TILED, HAL_PIXEL_FORMAT_YCbCr_420_SP_TILED,
     HAL_PIXEL_FORMAT_YCbCr_420_SP_VENUS, HAL_PIXEL_FORMAT_YCbCr_420_SP_VENUS,
     HAL_PIXEL_FORMAT_YV12, OMX_COLOR_FormatYUV420Planar,
+    HAL_PIXEL_FORMAT_RGBA_8888, -1,
     0, 0
 };
 
@@ -47,7 +48,7 @@ struct GraphicBufferAutoUnlock {
 };
 
 GrallocImage::GrallocImage()
-  : PlanarYCbCrImage(nullptr)
+  : RecyclingPlanarYCbCrImage(nullptr)
 {
   mFormat = ImageFormat::GRALLOC_PLANAR_YCBCR;
 }
@@ -56,7 +57,7 @@ GrallocImage::~GrallocImage()
 {
 }
 
-void
+bool
 GrallocImage::SetData(const Data& aData)
 {
   MOZ_ASSERT(!mTextureClient, "TextureClient is already set");
@@ -69,7 +70,7 @@ GrallocImage::SetData(const Data& aData)
 
   if (gfxPlatform::GetPlatform()->IsInGonkEmulator()) {
     // Emulator does not support HAL_PIXEL_FORMAT_YV12.
-    return;
+    return false;
   }
 
   RefPtr<GrallocTextureClientOGL> textureClient =
@@ -87,7 +88,7 @@ GrallocImage::SetData(const Data& aData)
   sp<GraphicBuffer> graphicBuffer = textureClient->GetGraphicBuffer();
   if (!result || !graphicBuffer.get()) {
     mTextureClient = nullptr;
-    return;
+    return false;
   }
 
   mTextureClient = textureClient;
@@ -95,7 +96,7 @@ GrallocImage::SetData(const Data& aData)
   void* vaddr;
   if (graphicBuffer->lock(GraphicBuffer::USAGE_SW_WRITE_OFTEN,
                           &vaddr) != OK) {
-    return;
+    return false;
   }
 
   uint8_t* yChannel = static_cast<uint8_t*>(vaddr);
@@ -143,12 +144,14 @@ GrallocImage::SetData(const Data& aData)
   mData.mYChannel     = nullptr;
   mData.mCrChannel    = nullptr;
   mData.mCbChannel    = nullptr;
+  return true;
 }
 
-void GrallocImage::SetData(const GrallocData& aData)
+bool GrallocImage::SetData(const GrallocData& aData)
 {
   mTextureClient = static_cast<GrallocTextureClientOGL*>(aData.mGraphicBuffer.get());
   mSize = aData.mPicSize;
+  return true;
 }
 
 /**
@@ -298,6 +301,7 @@ ConvertOmxYUVFormatToRGB565(android::sp<GraphicBuffer>& aBuffer,
   uint32_t format = aBuffer->getPixelFormat();
   uint32_t width = aSurface->GetSize().width;
   uint32_t height = aSurface->GetSize().height;
+  uint32_t stride = aBuffer->getStride();
 
   if (format == GrallocImage::HAL_PIXEL_FORMAT_YCrCb_420_SP_ADRENO) {
     // The Adreno hardware decoder aligns image dimensions to a multiple of 32,
@@ -316,11 +320,11 @@ ConvertOmxYUVFormatToRGB565(android::sp<GraphicBuffer>& aBuffer,
   }
 
   if (format == HAL_PIXEL_FORMAT_YCrCb_420_SP) {
-    uint32_t uvOffset = height * width;
-    ConvertYVU420SPToRGB565(buffer, width,
+    uint32_t uvOffset = height * stride;
+    ConvertYVU420SPToRGB565(buffer, stride,
                             buffer + uvOffset + 1,
                             buffer + uvOffset,
-                            width,
+                            stride,
                             aMappedSurface->mData,
                             width, height);
     return OK;
@@ -360,6 +364,21 @@ ConvertOmxYUVFormatToRGB565(android::sp<GraphicBuffer>& aBuffer,
     return OK;
   }
 
+  if (format == HAL_PIXEL_FORMAT_RGBA_8888) {
+    uint32_t* src = (uint32_t*)(buffer);
+    uint16_t* dest = (uint16_t*)(aMappedSurface->mData);
+
+    // Convert RGBA8888 to RGB565
+    for (size_t i = 0; i < width * height; i++) {
+      uint32_t r = ((*src >> 0 ) & 0xFF);
+      uint32_t g = ((*src >> 8 ) & 0xFF);
+      uint32_t b = ((*src >> 16) & 0xFF);
+      *dest++ = ((r >> 3) << 11) | ((g >> 2) << 5) | ((b >> 3) << 0);
+      src++;
+    }
+    return OK;
+  }
+
   android::ColorConverter colorConverter((OMX_COLOR_FORMATTYPE)omxFormat,
                                          OMX_COLOR_Format16bitRGB565);
   if (!colorConverter.isValid()) {
@@ -367,7 +386,7 @@ ConvertOmxYUVFormatToRGB565(android::sp<GraphicBuffer>& aBuffer,
     return BAD_VALUE;
   }
 
-  uint32_t pixelStride = aMappedSurface->mStride/gfx::BytesPerPixel(gfx::SurfaceFormat::R5G6B5);
+  uint32_t pixelStride = aMappedSurface->mStride/gfx::BytesPerPixel(gfx::SurfaceFormat::R5G6B5_UINT16);
   rv = colorConverter.convert(buffer, width, height,
                               0, 0, width - 1, height - 1 /* source crop */,
                               aMappedSurface->mData, pixelStride, height,
@@ -380,6 +399,42 @@ ConvertOmxYUVFormatToRGB565(android::sp<GraphicBuffer>& aBuffer,
   return OK;
 }
 
+already_AddRefed<gfx::DataSourceSurface>
+GetDataSourceSurfaceFrom(android::sp<android::GraphicBuffer>& aGraphicBuffer,
+                         gfx::IntSize aSize,
+                         const layers::PlanarYCbCrData& aYcbcrData)
+{
+  MOZ_ASSERT(aGraphicBuffer.get());
+
+  RefPtr<gfx::DataSourceSurface> surface =
+    gfx::Factory::CreateDataSourceSurface(aSize, gfx::SurfaceFormat::R5G6B5_UINT16);
+  if (NS_WARN_IF(!surface)) {
+    return nullptr;
+  }
+
+  gfx::DataSourceSurface::MappedSurface mappedSurface;
+  if (!surface->Map(gfx::DataSourceSurface::WRITE, &mappedSurface)) {
+    NS_WARNING("Could not map DataSourceSurface");
+    return nullptr;
+  }
+
+  int32_t rv;
+  rv = ConvertOmxYUVFormatToRGB565(aGraphicBuffer, surface, &mappedSurface, aYcbcrData);
+  if (rv == OK) {
+    surface->Unmap();
+    return surface.forget();
+  }
+
+  rv = ConvertVendorYUVFormatToRGB565(aGraphicBuffer, surface, &mappedSurface);
+  surface->Unmap();
+  if (rv != OK) {
+    NS_WARNING("Unknown color format");
+    return nullptr;
+  }
+
+  return surface.forget();
+}
+
 already_AddRefed<gfx::SourceSurface>
 GrallocImage::GetAsSourceSurface()
 {
@@ -391,30 +446,7 @@ GrallocImage::GetAsSourceSurface()
     mTextureClient->GetGraphicBuffer();
 
   RefPtr<gfx::DataSourceSurface> surface =
-    gfx::Factory::CreateDataSourceSurface(GetSize(), gfx::SurfaceFormat::R5G6B5);
-  if (NS_WARN_IF(!surface)) {
-    return nullptr;
-  }
-
-  gfx::DataSourceSurface::MappedSurface mappedSurface;
-  if (!surface->Map(gfx::DataSourceSurface::WRITE, &mappedSurface)) {
-    NS_WARNING("Could not map DataSourceSurface");
-    return nullptr;
-  }
-
-  int32_t rv;
-  rv = ConvertOmxYUVFormatToRGB565(graphicBuffer, surface, &mappedSurface, mData);
-  if (rv == OK) {
-    surface->Unmap();
-    return surface.forget();
-  }
-
-  rv = ConvertVendorYUVFormatToRGB565(graphicBuffer, surface, &mappedSurface);
-  surface->Unmap();
-  if (rv != OK) {
-    NS_WARNING("Unknown color format");
-    return nullptr;
-  }
+    GetDataSourceSurfaceFrom(graphicBuffer, mSize, mData);
 
   return surface.forget();
 }
diff --git a/gfx/layers/GrallocImages.h b/gfx/layers/GrallocImages.h
index 727235fc0f..b7fe457543 100644
--- a/gfx/layers/GrallocImages.h
+++ b/gfx/layers/GrallocImages.h
@@ -22,6 +22,11 @@ namespace layers {
 
 class GrallocTextureClientOGL;
 
+already_AddRefed<gfx::DataSourceSurface>
+GetDataSourceSurfaceFrom(android::sp<android::GraphicBuffer>& aGraphicBuffer,
+                         gfx::IntSize aSize,
+                         const layers::PlanarYCbCrData& aYcbcrData);
+
 /**
  * The YUV format supported by Android HAL
  *
@@ -43,7 +48,7 @@ class GrallocTextureClientOGL;
  * mPicX, mPicY and mPicSize. The size of the rendered image is
  * mPicSize, not mYSize or mCbCrSize.
  */
-class GrallocImage : public PlanarYCbCrImage
+class GrallocImage : public RecyclingPlanarYCbCrImage
 {
   typedef PlanarYCbCrData Data;
   static int32_t sColorIdMap[];
@@ -61,13 +66,13 @@ public:
    * This makes a copy of the data buffers, in order to support functioning
    * in all different layer managers.
    */
-  virtual void SetData(const Data& aData);
+  virtual bool SetData(const Data& aData);
 
   /**
    *  Share the SurfaceDescriptor without making the copy, in order
    *  to support functioning in all different layer managers.
    */
-  virtual void SetData(const GrallocData& aData);
+  virtual bool SetData(const GrallocData& aData);
 
   // From [android 4.0.4]/hardware/msm7k/libgralloc-qsd8k/gralloc_priv.h
   enum {
diff --git a/gfx/layers/IMFYCbCrImage.cpp b/gfx/layers/IMFYCbCrImage.cpp
index dde6849265..df49006789 100644
--- a/gfx/layers/IMFYCbCrImage.cpp
+++ b/gfx/layers/IMFYCbCrImage.cpp
@@ -15,7 +15,7 @@ namespace mozilla {
 namespace layers {
 
 IMFYCbCrImage::IMFYCbCrImage(IMFMediaBuffer* aBuffer, IMF2DBuffer* a2DBuffer)
-  : PlanarYCbCrImage(nullptr)
+  : RecyclingPlanarYCbCrImage(nullptr)
   , mBuffer(aBuffer)
   , m2DBuffer(a2DBuffer)
 {}
diff --git a/gfx/layers/IMFYCbCrImage.h b/gfx/layers/IMFYCbCrImage.h
index a17815ae51..4fd8aea404 100644
--- a/gfx/layers/IMFYCbCrImage.h
+++ b/gfx/layers/IMFYCbCrImage.h
@@ -13,7 +13,7 @@
 namespace mozilla {
 namespace layers {
 
-class IMFYCbCrImage : public PlanarYCbCrImage
+class IMFYCbCrImage : public RecyclingPlanarYCbCrImage
 {
 public:
   IMFYCbCrImage(IMFMediaBuffer* aBuffer, IMF2DBuffer* a2DBuffer);
@@ -23,10 +23,6 @@ public:
   virtual TextureClient* GetTextureClient(CompositableClient* aClient) override;
 
 protected:
-  virtual uint8_t* AllocateBuffer(uint32_t aSize) override {
-    MOZ_CRASH("Can't do manual allocations with IMFYCbCrImage");
-    return nullptr;
-  }
 
   TextureClient* GetD3D9TextureClient(CompositableClient* aClient);
 
diff --git a/gfx/layers/ImageContainer.cpp b/gfx/layers/ImageContainer.cpp
index 32863b95be..dda00621a4 100644
--- a/gfx/layers/ImageContainer.cpp
+++ b/gfx/layers/ImageContainer.cpp
@@ -75,7 +75,7 @@ ImageFactory::CreateImage(ImageFormat aFormat,
   }
 #endif
   if (aFormat == ImageFormat::PLANAR_YCBCR) {
-    img = new PlanarYCbCrImage(aRecycleBin);
+    img = new RecyclingPlanarYCbCrImage(aRecycleBin);
     return img.forget();
   }
   if (aFormat == ImageFormat::CAIRO_SURFACE) {
@@ -117,7 +117,7 @@ BufferRecycleBin::BufferRecycleBin()
 }
 
 void
-BufferRecycleBin::RecycleBuffer(uint8_t* aBuffer, uint32_t aSize)
+BufferRecycleBin::RecycleBuffer(UniquePtr<uint8_t[]> aBuffer, uint32_t aSize)
 {
   MutexAutoLock lock(mLock);
 
@@ -125,19 +125,19 @@ BufferRecycleBin::RecycleBuffer(uint8_t* aBuffer, uint32_t aSize)
     mRecycledBuffers.Clear();
   }
   mRecycledBufferSize = aSize;
-  mRecycledBuffers.AppendElement(aBuffer);
+  mRecycledBuffers.AppendElement(Move(aBuffer));
 }
 
-uint8_t*
+UniquePtr<uint8_t[]>
 BufferRecycleBin::GetBuffer(uint32_t aSize)
 {
   MutexAutoLock lock(mLock);
 
   if (mRecycledBuffers.IsEmpty() || mRecycledBufferSize != aSize)
-    return new uint8_t[aSize];
+    return MakeUnique<uint8_t[]>(aSize);
 
   uint32_t last = mRecycledBuffers.Length() - 1;
-  uint8_t* result = mRecycledBuffers[last].forget();
+  UniquePtr<uint8_t[]> result = Move(mRecycledBuffers[last]);
   mRecycledBuffers.RemoveElementAt(last);
   return result;
 }
@@ -263,6 +263,14 @@ ImageContainer::SetCurrentImageInternal(const nsTArray<NonOwningImage>& aImages)
           mFrameIDsNotYetComposited.AppendElement(img.mFrameID);
         }
       }
+
+      // Remove really old frames, assuming they'll never be composited.
+      const uint32_t maxFrames = 100;
+      if (mFrameIDsNotYetComposited.Length() > maxFrames) {
+        uint32_t dropFrames = mFrameIDsNotYetComposited.Length() - maxFrames;
+        mDroppedImageCount += dropFrames;
+        mFrameIDsNotYetComposited.RemoveElementsAt(0, dropFrames);
+      }
     }
   }
 
@@ -398,16 +406,17 @@ ImageContainer::NotifyCompositeInternal(const ImageCompositeNotification& aNotif
   ++mPaintCount;
 
   if (aNotification.producerID() == mCurrentProducerID) {
-    while (!mFrameIDsNotYetComposited.IsEmpty()) {
-      if (mFrameIDsNotYetComposited[0] <= aNotification.frameID()) {
-        if (mFrameIDsNotYetComposited[0] < aNotification.frameID()) {
+    uint32_t i;
+    for (i = 0; i < mFrameIDsNotYetComposited.Length(); ++i) {
+      if (mFrameIDsNotYetComposited[i] <= aNotification.frameID()) {
+        if (mFrameIDsNotYetComposited[i] < aNotification.frameID()) {
           ++mDroppedImageCount;
         }
-        mFrameIDsNotYetComposited.RemoveElementAt(0);
       } else {
         break;
       }
     }
+    mFrameIDsNotYetComposited.RemoveElementsAt(0, i);
     for (auto& img : mCurrentImages) {
       if (img.mFrameID == aNotification.frameID()) {
         img.mComposited = true;
@@ -421,23 +430,22 @@ ImageContainer::NotifyCompositeInternal(const ImageCompositeNotification& aNotif
   }
 }
 
-PlanarYCbCrImage::PlanarYCbCrImage(BufferRecycleBin *aRecycleBin)
+PlanarYCbCrImage::PlanarYCbCrImage()
   : Image(nullptr, ImageFormat::PLANAR_YCBCR)
-  , mBufferSize(0)
   , mOffscreenFormat(gfxImageFormat::Unknown)
-  , mRecycleBin(aRecycleBin)
+  , mBufferSize(0)
 {
 }
 
-PlanarYCbCrImage::~PlanarYCbCrImage()
+RecyclingPlanarYCbCrImage::~RecyclingPlanarYCbCrImage()
 {
   if (mBuffer) {
-    mRecycleBin->RecycleBuffer(mBuffer.forget(), mBufferSize);
+    mRecycleBin->RecycleBuffer(Move(mBuffer), mBufferSize);
   }
 }
 
 size_t
-PlanarYCbCrImage::SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const
+RecyclingPlanarYCbCrImage::SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const
 {
   // Ignoring:
   // - mData - just wraps mBuffer
@@ -447,7 +455,7 @@ PlanarYCbCrImage::SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const
   //   - mImplData is not used
   // Not owned:
   // - mRecycleBin
-  size_t size = mBuffer.SizeOfExcludingThis(aMallocSizeOf);
+  size_t size = aMallocSizeOf(mBuffer.get());
 
   // Could add in the future:
   // - mBackendData (from base class)
@@ -455,8 +463,8 @@ PlanarYCbCrImage::SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const
   return size;
 }
 
-uint8_t*
-PlanarYCbCrImage::AllocateBuffer(uint32_t aSize)
+UniquePtr<uint8_t[]>
+RecyclingPlanarYCbCrImage::AllocateBuffer(uint32_t aSize)
 {
   return mRecycleBin->GetBuffer(aSize);
 }
@@ -488,9 +496,11 @@ CopyPlane(uint8_t *aDst, const uint8_t *aSrc,
   }
 }
 
-void
-PlanarYCbCrImage::CopyData(const Data& aData)
+bool
+RecyclingPlanarYCbCrImage::CopyData(const Data& aData)
 {
+  mData = aData;
+
   // update buffer size
   // Use uint32_t throughout to match AllocateBuffer's param and mBufferSize
   const auto checkedSize =
@@ -498,38 +508,37 @@ PlanarYCbCrImage::CopyData(const Data& aData)
     CheckedInt<uint32_t>(aData.mYStride) * aData.mYSize.height;
 
   if (!checkedSize.isValid())
-    return;
+    return false;
 
   const auto size = checkedSize.value();
 
   // get new buffer
   mBuffer = AllocateBuffer(size);
   if (!mBuffer)
-    return;
+    return false;
 
   // update buffer size
   mBufferSize = size;
 
-  mData = aData;
-  mData.mYChannel = mBuffer;
+  mData.mYChannel = mBuffer.get();
   mData.mCbChannel = mData.mYChannel + mData.mYStride * mData.mYSize.height;
   mData.mCrChannel = mData.mCbChannel + mData.mCbCrStride * mData.mCbCrSize.height;
-  mData.mYSkip = mData.mCbSkip = mData.mCrSkip = 0;
 
   CopyPlane(mData.mYChannel, aData.mYChannel,
-            aData.mYSize, aData.mYStride, aData.mYSkip);
+            mData.mYSize, mData.mYStride, mData.mYSkip);
   CopyPlane(mData.mCbChannel, aData.mCbChannel,
-            aData.mCbCrSize, aData.mCbCrStride, aData.mCbSkip);
+            mData.mCbCrSize, mData.mCbCrStride, mData.mCbSkip);
   CopyPlane(mData.mCrChannel, aData.mCrChannel,
-            aData.mCbCrSize, aData.mCbCrStride, aData.mCrSkip);
+            mData.mCbCrSize, mData.mCbCrStride, mData.mCrSkip);
 
   mSize = aData.mPicSize;
+  return true;
 }
 
-void
-PlanarYCbCrImage::SetData(const Data &aData)
+bool
+RecyclingPlanarYCbCrImage::SetData(const Data &aData)
 {
-  CopyData(aData);
+  return CopyData(aData);
 }
 
 gfxImageFormat
@@ -540,15 +549,16 @@ PlanarYCbCrImage::GetOffscreenFormat()
     mOffscreenFormat;
 }
 
-void
+bool
 PlanarYCbCrImage::SetDataNoCopy(const Data &aData)
 {
   mData = aData;
   mSize = aData.mPicSize;
+  return true;
 }
 
 uint8_t*
-PlanarYCbCrImage::AllocateAndGetNewBuffer(uint32_t aSize)
+RecyclingPlanarYCbCrImage::AllocateAndGetNewBuffer(uint32_t aSize)
 {
   // get new buffer
   mBuffer = AllocateBuffer(aSize);
@@ -556,7 +566,7 @@ PlanarYCbCrImage::AllocateAndGetNewBuffer(uint32_t aSize)
     // update buffer size
     mBufferSize = aSize;
   }
-  return mBuffer;
+  return mBuffer.get();
 }
 
 already_AddRefed<gfx::SourceSurface>
@@ -651,12 +661,11 @@ CairoImage::GetTextureClient(CompositableClient *aClient)
     return nullptr;
   }
 
-  if (!textureClient->Lock(OpenMode::OPEN_WRITE_ONLY)) {
+  TextureClientAutoLock autoLock(textureClient, OpenMode::OPEN_WRITE_ONLY);
+  if (!autoLock.Succeeded()) {
     return nullptr;
   }
 
-  TextureClientAutoUnlock autoUnlock(textureClient);
-
   textureClient->UpdateFromSurface(surface);
 
   textureClient->SyncWithObject(forwarder->GetSyncObject());
@@ -684,12 +693,11 @@ ImageContainer::NotifyComposite(const ImageCompositeNotification& aNotification)
   }
 }
 
-static ImageContainer::ProducerID sProducerID = 0;
-
 ImageContainer::ProducerID
 ImageContainer::AllocateProducerID()
 {
-  NS_ASSERTION(NS_IsMainThread(), "Should be on main thread.");
+  // Callable on all threads.
+  static Atomic<ImageContainer::ProducerID> sProducerID(0u);
   return ++sProducerID;
 }
 
diff --git a/gfx/layers/ImageContainer.h b/gfx/layers/ImageContainer.h
index 70743ecced..4b92af1b66 100644
--- a/gfx/layers/ImageContainer.h
+++ b/gfx/layers/ImageContainer.h
@@ -30,6 +30,7 @@
 #include "mozilla/gfx/2D.h"
 #include "nsDataHashtable.h"
 #include "mozilla/EnumeratedArray.h"
+#include "mozilla/UniquePtr.h"
 
 #ifndef XPCOM_GLUE_AVOID_NSPR
 /**
@@ -203,9 +204,9 @@ class BufferRecycleBin final {
 public:
   BufferRecycleBin();
 
-  void RecycleBuffer(uint8_t* aBuffer, uint32_t aSize);
+  void RecycleBuffer(mozilla::UniquePtr<uint8_t[]> aBuffer, uint32_t aSize);
   // Returns a recycled buffer of the right size, or allocates a new buffer.
-  uint8_t* GetBuffer(uint32_t aSize);
+  mozilla::UniquePtr<uint8_t[]> GetBuffer(uint32_t aSize);
 
 private:
   typedef mozilla::Mutex Mutex;
@@ -221,7 +222,7 @@ private:
 
   // We should probably do something to prune this list on a timer so we don't
   // eat excess memory while video is paused...
-  nsTArray<nsAutoArrayPtr<uint8_t> > mRecycledBuffers;
+  nsTArray<mozilla::UniquePtr<uint8_t[]>> mRecycledBuffers;
   // This is only valid if mRecycledBuffers is non-empty
   uint32_t mRecycledBufferSize;
 };
@@ -650,13 +651,13 @@ public:
     MAX_DIMENSION = 16384
   };
 
-  virtual ~PlanarYCbCrImage();
+  virtual ~PlanarYCbCrImage() {}
 
   /**
    * This makes a copy of the data buffers, in order to support functioning
    * in all different layer managers.
    */
-  virtual void SetData(const Data& aData);
+  virtual bool SetData(const Data& aData) = 0;
 
   /**
    * This doesn't make a copy of the data buffers. Can be used when mBuffer is
@@ -665,12 +666,12 @@ public:
    * The GStreamer media backend uses this to decode into PlanarYCbCrImage(s)
    * directly.
    */
-  virtual void SetDataNoCopy(const Data &aData);
+  virtual bool SetDataNoCopy(const Data &aData);
 
   /**
    * This allocates and returns a new buffer
    */
-  virtual uint8_t* AllocateAndGetNewBuffer(uint32_t aSize);
+  virtual uint8_t* AllocateAndGetNewBuffer(uint32_t aSize) = 0;
 
   /**
    * Ask this Image to not convert YUV to RGB during SetData, and make
@@ -693,7 +694,7 @@ public:
 
   virtual gfx::IntSize GetSize() { return mSize; }
 
-  explicit PlanarYCbCrImage(BufferRecycleBin *aRecycleBin);
+  explicit PlanarYCbCrImage();
 
   virtual SharedPlanarYCbCrImage *AsSharedPlanarYCbCrImage() { return nullptr; }
 
@@ -701,35 +702,43 @@ public:
     return aMallocSizeOf(this) + SizeOfExcludingThis(aMallocSizeOf);
   }
 
-  virtual size_t SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const;
+  virtual size_t SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const = 0;
 
+protected:
+  already_AddRefed<gfx::SourceSurface> GetAsSourceSurface();
+
+  void SetOffscreenFormat(gfxImageFormat aFormat) { mOffscreenFormat = aFormat; }
+  gfxImageFormat GetOffscreenFormat();
+
+  Data mData;
+  gfx::IntSize mSize;
+  gfxImageFormat mOffscreenFormat;
+  nsCountedRef<nsMainThreadSourceSurfaceRef> mSourceSurface;
+  uint32_t mBufferSize;
+};
+
+class RecyclingPlanarYCbCrImage: public PlanarYCbCrImage {
+public:
+  explicit RecyclingPlanarYCbCrImage(BufferRecycleBin *aRecycleBin) : mRecycleBin(aRecycleBin) {}
+  virtual ~RecyclingPlanarYCbCrImage() override;
+  virtual bool SetData(const Data& aData) override;
+  virtual uint8_t* AllocateAndGetNewBuffer(uint32_t aSize) override;
+  virtual size_t SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const override;
 protected:
   /**
    * Make a copy of the YCbCr data into local storage.
    *
    * @param aData           Input image data.
    */
-  void CopyData(const Data& aData);
+  bool CopyData(const Data& aData);
 
   /**
    * Return a buffer to store image data in.
-   * The default implementation returns memory that can
-   * be freed wit delete[]
    */
-  virtual uint8_t* AllocateBuffer(uint32_t aSize);
+  mozilla::UniquePtr<uint8_t[]> AllocateBuffer(uint32_t aSize);
 
-  already_AddRefed<gfx::SourceSurface> GetAsSourceSurface();
-
-  void SetOffscreenFormat(gfxImageFormat aFormat) { mOffscreenFormat = aFormat; }
-  gfxImageFormat GetOffscreenFormat();
-
-  nsAutoArrayPtr<uint8_t> mBuffer;
-  uint32_t mBufferSize;
-  Data mData;
-  gfx::IntSize mSize;
-  gfxImageFormat mOffscreenFormat;
-  nsCountedRef<nsMainThreadSourceSurfaceRef> mSourceSurface;
   RefPtr<BufferRecycleBin> mRecycleBin;
+  mozilla::UniquePtr<uint8_t[]> mBuffer;
 };
 
 /**
diff --git a/gfx/layers/LayerSorter.cpp b/gfx/layers/LayerSorter.cpp
index 4ed5d2228a..c1e2472a7e 100644
--- a/gfx/layers/LayerSorter.cpp
+++ b/gfx/layers/LayerSorter.cpp
@@ -10,6 +10,7 @@
 #include <stdlib.h>                     // for getenv
 #include "DirectedGraph.h"              // for DirectedGraph
 #include "Layers.h"                     // for Layer
+#include "gfxEnv.h"                     // for gfxEnv
 #include "gfxLineSegment.h"             // for gfxLineSegment
 #include "gfxPoint.h"                   // for gfxPoint
 #include "gfxQuad.h"                    // for gfxQuad
@@ -152,8 +153,6 @@ static LayerSortOrder CompareDepth(Layer* aOne, Layer* aTwo) {
 }
 
 #ifdef DEBUG
-static bool gDumpLayerSortList = getenv("MOZ_DUMP_LAYER_SORT_LIST") != 0;
-
 // #define USE_XTERM_COLORING
 #ifdef USE_XTERM_COLORING
 // List of color values, which can be added to the xterm foreground offset or
@@ -251,7 +250,7 @@ void SortLayersBy3DZOrder(nsTArray<Layer*>& aLayers)
   DirectedGraph<Layer*> graph;
 
 #ifdef DEBUG
-  if (gDumpLayerSortList) {
+  if (gfxEnv::DumpLayerSortList()) {
     for (uint32_t i = 0; i < nodeCount; i++) {
       if (aLayers.ElementAt(i)->GetDebugColorIndex() == 0) {
         aLayers.ElementAt(i)->SetDebugColorIndex(gColorIndex++);
@@ -280,7 +279,7 @@ void SortLayersBy3DZOrder(nsTArray<Layer*>& aLayers)
   }
 
 #ifdef DEBUG
-  if (gDumpLayerSortList) {
+  if (gfxEnv::DumpLayerSortList()) {
     fprintf(stderr, " --- Edge List: --- \n");
     DumpEdgeList(graph);
   }
@@ -347,7 +346,7 @@ void SortLayersBy3DZOrder(nsTArray<Layer*>& aLayers)
   } while (!noIncoming.IsEmpty());
   NS_ASSERTION(!graph.GetEdgeCount(), "Cycles detected!");
 #ifdef DEBUG
-  if (gDumpLayerSortList) {
+  if (gfxEnv::DumpLayerSortList()) {
     fprintf(stderr, " --- Layers after sorting: --- \n");
     DumpLayerList(sortedList);
   }
diff --git a/gfx/layers/Layers.cpp b/gfx/layers/Layers.cpp
index 7b6c26a03a..b22e1668c2 100644
--- a/gfx/layers/Layers.cpp
+++ b/gfx/layers/Layers.cpp
@@ -15,6 +15,7 @@
 #include "LayersLogging.h"              // for AppendToString
 #include "ReadbackLayer.h"              // for ReadbackLayer
 #include "UnitTransforms.h"             // for ViewAs
+#include "gfxEnv.h"
 #include "gfxPlatform.h"                // for gfxPlatform
 #include "gfxPrefs.h"
 #include "gfxUtils.h"                   // for gfxUtils, etc
@@ -1367,7 +1368,7 @@ ContainerLayer::DefaultComputeEffectiveTransforms(const Matrix4x4& aTransformToS
       GetForceIsolatedGroup()) {
     useIntermediateSurface = true;
 #ifdef MOZ_DUMP_PAINTING
-  } else if (gfxUtils::sDumpPaintingIntermediate && !Extend3DContext()) {
+  } else if (gfxEnv::DumpPaintIntermediate() && !Extend3DContext()) {
     useIntermediateSurface = true;
 #endif
   } else {
@@ -1702,9 +1703,9 @@ void
 Layer::Dump(std::stringstream& aStream, const char* aPrefix, bool aDumpHtml)
 {
 #ifdef MOZ_DUMP_PAINTING
-  bool dumpCompositorTexture = gfxUtils::sDumpCompositorTextures && AsLayerComposite() &&
+  bool dumpCompositorTexture = gfxEnv::DumpCompositorTextures() && AsLayerComposite() &&
                                AsLayerComposite()->GetCompositableHost();
-  bool dumpClientTexture = gfxUtils::sDumpPainting && AsShadowableLayer() &&
+  bool dumpClientTexture = gfxEnv::DumpPaint() && AsShadowableLayer() &&
                            AsShadowableLayer()->GetCompositableClient();
   nsCString layerId(Name());
   layerId.Append('-');
@@ -1738,6 +1739,11 @@ Layer::Dump(std::stringstream& aStream, const char* aPrefix, bool aDumpHtml)
 
   if (aDumpHtml) {
     aStream << "</a>";
+#ifdef MOZ_DUMP_PAINTING
+    if (dumpClientTexture) {
+      aStream << nsPrintfCString("<br><img id=\"%s\">\n", layerId.BeginReading()).get();
+    }
+#endif
   }
 
   if (Layer* mask = GetMaskLayer()) {
diff --git a/gfx/layers/LayersLogging.cpp b/gfx/layers/LayersLogging.cpp
index df34de79e3..f184090665 100644
--- a/gfx/layers/LayersLogging.cpp
+++ b/gfx/layers/LayersLogging.cpp
@@ -313,7 +313,8 @@ AppendToString(std::stringstream& aStream, mozilla::gfx::SurfaceFormat format,
   case SurfaceFormat::B8G8R8X8:  aStream << "SurfaceFormat::B8G8R8X8"; break;
   case SurfaceFormat::R8G8B8A8:  aStream << "SurfaceFormat::R8G8B8A8"; break;
   case SurfaceFormat::R8G8B8X8:  aStream << "SurfaceFormat::R8G8B8X8"; break;
-  case SurfaceFormat::R5G6B5:    aStream << "SurfaceFormat::R5G6B5"; break;
+  case SurfaceFormat::R5G6B5_UINT16:
+                                 aStream << "SurfaceFormat::R5G6B5_UINT16"; break;
   case SurfaceFormat::A8:        aStream << "SurfaceFormat::A8"; break;
   case SurfaceFormat::YUV:       aStream << "SurfaceFormat::YUV"; break;
   case SurfaceFormat::NV12:      aStream << "SurfaceFormat::NV12"; break;
diff --git a/gfx/layers/MacIOSurfaceImage.cpp b/gfx/layers/MacIOSurfaceImage.cpp
index ac29393d14..4587e18450 100644
--- a/gfx/layers/MacIOSurfaceImage.cpp
+++ b/gfx/layers/MacIOSurfaceImage.cpp
@@ -7,6 +7,7 @@
 #include "mozilla/layers/CompositableClient.h"
 #include "mozilla/layers/CompositableForwarder.h"
 #include "mozilla/layers/MacIOSurfaceTextureClientOGL.h"
+#include "mozilla/UniquePtr.h"
 #include "YCbCrUtils.h"
 
 using namespace mozilla;
@@ -55,12 +56,12 @@ MacIOSurfaceImage::GetAsSourceSurface()
     size_t cbCrWidth = mSurface->GetDevicePixelWidth(1);
     size_t cbCrHeight = mSurface->GetDevicePixelHeight(1);
 
-    nsAutoArrayPtr<uint8_t> cbPlane(new uint8_t[cbCrWidth * cbCrHeight]);
-    nsAutoArrayPtr<uint8_t> crPlane(new uint8_t[cbCrWidth * cbCrHeight]);
+    auto cbPlane = MakeUnique<uint8_t[]>(cbCrWidth * cbCrHeight);
+    auto crPlane = MakeUnique<uint8_t[]>(cbCrWidth * cbCrHeight);
 
     uint8_t* src = (uint8_t*)mSurface->GetBaseAddressOfPlane(1);
-    uint8_t* cbDest = cbPlane;
-    uint8_t* crDest = crPlane;
+    uint8_t* cbDest = cbPlane.get();
+    uint8_t* crDest = crPlane.get();
 
     for (size_t i = 0; i < cbCrHeight; i++) {
       uint8_t* rowSrc = src + cbCrStride * i;
@@ -79,8 +80,8 @@ MacIOSurfaceImage::GetAsSourceSurface()
     data.mYChannel = (uint8_t*)mSurface->GetBaseAddressOfPlane(0);
     data.mYStride = mSurface->GetBytesPerRow(0);
     data.mYSize = IntSize(mSurface->GetDevicePixelWidth(0), mSurface->GetDevicePixelHeight(0));
-    data.mCbChannel = cbPlane;
-    data.mCrChannel = crPlane;
+    data.mCbChannel = cbPlane.get();
+    data.mCrChannel = crPlane.get();
     data.mCbCrStride = cbCrWidth;
     data.mCbCrSize = IntSize(cbCrWidth, cbCrHeight);
     data.mPicSize = data.mYSize;
diff --git a/gfx/layers/ReadbackProcessor.h b/gfx/layers/ReadbackProcessor.h
index 4ca78205ec..b07f796c32 100644
--- a/gfx/layers/ReadbackProcessor.h
+++ b/gfx/layers/ReadbackProcessor.h
@@ -8,9 +8,8 @@
 
 #include <stdint.h>                     // for uint64_t
 #include "nsRect.h"                     // for mozilla::gfx::IntRect
+#include "nsRegionFwd.h"                // for nsIntRegion
 #include "nsTArray.h"                   // for nsTArray
- 
-class nsIntRegion;
 
 namespace mozilla {
 namespace layers {
diff --git a/gfx/layers/basic/BasicCompositor.cpp b/gfx/layers/basic/BasicCompositor.cpp
index 6328cef755..fe602df1e3 100644
--- a/gfx/layers/basic/BasicCompositor.cpp
+++ b/gfx/layers/basic/BasicCompositor.cpp
@@ -69,6 +69,7 @@ public:
 
 BasicCompositor::BasicCompositor(nsIWidget *aWidget)
   : mWidget(aWidget)
+  , mDidExternalComposition(false)
 {
   MOZ_COUNT_CTOR(BasicCompositor);
 
@@ -509,9 +510,16 @@ BasicCompositor::BeginFrame(const nsIntRegion& aInvalidRegion,
   IntRect intRect = gfx::IntRect(IntPoint(), mWidgetSize);
   Rect rect = Rect(0, 0, intRect.width, intRect.height);
 
-  // Sometimes the invalid region is larger than we want to draw.
   nsIntRegion invalidRegionSafe;
-  invalidRegionSafe.And(aInvalidRegion, intRect);
+  if (mDidExternalComposition) {
+    // We do not know rendered region during external composition, just redraw
+    // whole widget.
+    invalidRegionSafe = intRect;
+    mDidExternalComposition = false;
+  } else {
+    // Sometimes the invalid region is larger than we want to draw.
+    invalidRegionSafe.And(aInvalidRegion, intRect);
+  }
 
   IntRect invalidRect = invalidRegionSafe.GetBounds();
   mInvalidRect = IntRect(invalidRect.x, invalidRect.y, invalidRect.width, invalidRect.height);
@@ -610,5 +618,16 @@ BasicCompositor::EndFrame()
   mRenderTarget = nullptr;
 }
 
+void
+BasicCompositor::EndFrameForExternalComposition(const gfx::Matrix& aTransform)
+{
+  MOZ_ASSERT(!mTarget);
+  MOZ_ASSERT(!mDrawTarget);
+  MOZ_ASSERT(!mRenderTarget);
+
+  mDidExternalComposition = true;
+}
+
+
 } // namespace layers
 } // namespace mozilla
diff --git a/gfx/layers/basic/BasicCompositor.h b/gfx/layers/basic/BasicCompositor.h
index 5421a67576..ca06d097d6 100644
--- a/gfx/layers/basic/BasicCompositor.h
+++ b/gfx/layers/basic/BasicCompositor.h
@@ -90,10 +90,7 @@ public:
                           gfx::Rect *aClipRectOut = nullptr,
                           gfx::Rect *aRenderBoundsOut = nullptr) override;
   virtual void EndFrame() override;
-  virtual void EndFrameForExternalComposition(const gfx::Matrix& aTransform) override
-  {
-    NS_RUNTIMEABORT("We shouldn't ever hit this");
-  }
+  virtual void EndFrameForExternalComposition(const gfx::Matrix& aTransform) override;
 
   virtual bool SupportsPartialTextureUpdate() override { return true; }
   virtual bool CanUseCanvasLayerForSize(const gfx::IntSize &aSize) override { return true; }
@@ -132,6 +129,7 @@ private:
 
   gfx::IntRect mInvalidRect;
   nsIntRegion mInvalidRegion;
+  bool mDidExternalComposition;
 
   uint32_t mMaxTextureSize;
 };
diff --git a/gfx/layers/basic/BasicImages.cpp b/gfx/layers/basic/BasicImages.cpp
index e1cf5ee9a3..39b554d7db 100644
--- a/gfx/layers/basic/BasicImages.cpp
+++ b/gfx/layers/basic/BasicImages.cpp
@@ -13,7 +13,8 @@
 #include "gfxUtils.h"                   // for gfxUtils
 #include "mozilla/CheckedInt.h"         // for bounds checks
 #include "mozilla/mozalloc.h"           // for operator delete[], etc
-#include "nsAutoPtr.h"                  // for nsRefPtr, nsAutoArrayPtr
+#include "mozilla/RefPtr.h"
+#include "mozilla/UniquePtr.h"
 #include "nsAutoRef.h"                  // for nsCountedRef
 #include "nsCOMPtr.h"                   // for already_AddRefed
 #include "nsDebug.h"                    // for NS_ERROR, NS_ASSERTION
@@ -29,11 +30,11 @@
 namespace mozilla {
 namespace layers {
 
-class BasicPlanarYCbCrImage : public PlanarYCbCrImage
+class BasicPlanarYCbCrImage : public RecyclingPlanarYCbCrImage
 {
 public:
   BasicPlanarYCbCrImage(const gfx::IntSize& aScaleHint, gfxImageFormat aOffscreenFormat, BufferRecycleBin *aRecycleBin)
-    : PlanarYCbCrImage(aRecycleBin)
+    : RecyclingPlanarYCbCrImage(aRecycleBin)
     , mScaleHint(aScaleHint)
     , mDelayedConversion(false)
   {
@@ -45,11 +46,11 @@ public:
     if (mDecodedBuffer) {
       // Right now this only happens if the Image was never drawn, otherwise
       // this will have been tossed away at surface destruction.
-      mRecycleBin->RecycleBuffer(mDecodedBuffer.forget(), mSize.height * mStride);
+      mRecycleBin->RecycleBuffer(Move(mDecodedBuffer), mSize.height * mStride);
     }
   }
 
-  virtual void SetData(const Data& aData) override;
+  virtual bool SetData(const Data& aData) override;
   virtual void SetDelayedConversion(bool aDelayed) override { mDelayedConversion = aDelayed; }
 
   already_AddRefed<gfx::SourceSurface> GetAsSourceSurface() override;
@@ -61,13 +62,13 @@ public:
 
   virtual size_t SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const override
   {
-    size_t size = PlanarYCbCrImage::SizeOfExcludingThis(aMallocSizeOf);
-    size += mDecodedBuffer.SizeOfExcludingThis(aMallocSizeOf);
+    size_t size = RecyclingPlanarYCbCrImage::SizeOfExcludingThis(aMallocSizeOf);
+    size += aMallocSizeOf(mDecodedBuffer.get());
     return size;
   }
 
 private:
-  nsAutoArrayPtr<uint8_t> mDecodedBuffer;
+  UniquePtr<uint8_t[]> mDecodedBuffer;
   gfx::IntSize mScaleHint;
   int mStride;
   bool mDelayedConversion;
@@ -92,20 +93,20 @@ public:
   }
 };
 
-void
+bool
 BasicPlanarYCbCrImage::SetData(const Data& aData)
 {
-  PlanarYCbCrImage::SetData(aData);
+  RecyclingPlanarYCbCrImage::SetData(aData);
 
   if (mDelayedConversion) {
-    return;
+    return false;
   }
 
   // Do some sanity checks to prevent integer overflow
   if (aData.mYSize.width > PlanarYCbCrImage::MAX_DIMENSION ||
       aData.mYSize.height > PlanarYCbCrImage::MAX_DIMENSION) {
     NS_ERROR("Illegal image source width or height");
-    return;
+    return false;
   }
 
   gfx::SurfaceFormat format = gfx::ImageFormatToSurfaceFormat(GetOffscreenFormat());
@@ -115,7 +116,7 @@ BasicPlanarYCbCrImage::SetData(const Data& aData)
   if (size.width > PlanarYCbCrImage::MAX_DIMENSION ||
       size.height > PlanarYCbCrImage::MAX_DIMENSION) {
     NS_ERROR("Illegal image dest width or height");
-    return;
+    return false;
   }
 
   gfxImageFormat iFormat = gfx::SurfaceFormatToImageFormat(format);
@@ -124,17 +125,19 @@ BasicPlanarYCbCrImage::SetData(const Data& aData)
     mozilla::CheckedInt32(size.height) * mozilla::CheckedInt32(mStride);
   if (!requiredBytes.isValid()) {
     // invalid size
-    return;
+    return false;
   }
   mDecodedBuffer = AllocateBuffer(requiredBytes.value());  
   if (!mDecodedBuffer) {
     // out of memory
-    return;
+    return false;
   }
 
-  gfx::ConvertYCbCrToRGB(aData, format, size, mDecodedBuffer, mStride);
+  gfx::ConvertYCbCrToRGB(aData, format, size, mDecodedBuffer.get(), mStride);
   SetOffscreenFormat(iFormat);
   mSize = size;
+
+  return true;
 }
 
 already_AddRefed<gfx::SourceSurface>
@@ -159,7 +162,7 @@ BasicPlanarYCbCrImage::GetAsSourceSurface()
     // We create the target out of mDecodedBuffer, and get a snapshot from it.
     // The draw target is destroyed on scope exit and the surface owns the data.
     RefPtr<gfx::DrawTarget> drawTarget
-      = gfxPlatform::GetPlatform()->CreateDrawTargetForData(mDecodedBuffer,
+      = gfxPlatform::GetPlatform()->CreateDrawTargetForData(mDecodedBuffer.get(),
                                                             mSize,
                                                             mStride,
                                                             gfx::ImageFormatToSurfaceFormat(format));
@@ -170,7 +173,7 @@ BasicPlanarYCbCrImage::GetAsSourceSurface()
     surface = drawTarget->Snapshot();
   }
 
-  mRecycleBin->RecycleBuffer(mDecodedBuffer.forget(), mSize.height * mStride);
+  mRecycleBin->RecycleBuffer(Move(mDecodedBuffer), mSize.height * mStride);
 
   mSourceSurface = surface;
   return surface.forget();
diff --git a/gfx/layers/basic/GrallocTextureHostBasic.cpp b/gfx/layers/basic/GrallocTextureHostBasic.cpp
new file mode 100644
index 0000000000..15e6c60d04
--- /dev/null
+++ b/gfx/layers/basic/GrallocTextureHostBasic.cpp
@@ -0,0 +1,291 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "GrallocTextureHostBasic.h"
+#include "GrallocImages.h"  // for GetDataSourceSurfaceFrom()
+#include "mozilla/layers/SharedBufferManagerParent.h"
+
+#if ANDROID_VERSION >= 17
+#include <ui/Fence.h>
+#endif
+
+namespace mozilla {
+namespace layers {
+
+static SurfaceFormat
+HalFormatToSurfaceFormat(int aHalFormat, TextureFlags aFlags)
+{
+  bool swapRB = bool(aFlags & TextureFlags::RB_SWAPPED);
+  switch (aHalFormat) {
+  case android::PIXEL_FORMAT_BGRA_8888:
+    return swapRB ? gfx::SurfaceFormat::R8G8B8A8 : gfx::SurfaceFormat::B8G8R8A8;
+  case android::PIXEL_FORMAT_RGBA_8888:
+    return swapRB ? gfx::SurfaceFormat::B8G8R8A8 : gfx::SurfaceFormat::R8G8B8A8;
+  case android::PIXEL_FORMAT_RGBX_8888:
+    return swapRB ? gfx::SurfaceFormat::B8G8R8X8 : gfx::SurfaceFormat::R8G8B8X8;
+  case android::PIXEL_FORMAT_RGB_565:
+    return gfx::SurfaceFormat::R5G6B5_UINT16;
+  case HAL_PIXEL_FORMAT_YCbCr_422_SP:
+  case HAL_PIXEL_FORMAT_YCrCb_420_SP:
+  case HAL_PIXEL_FORMAT_YCbCr_422_I:
+  case GrallocImage::HAL_PIXEL_FORMAT_YCbCr_420_SP_TILED:
+  case GrallocImage::HAL_PIXEL_FORMAT_YCbCr_420_SP_VENUS:
+  case HAL_PIXEL_FORMAT_YV12:
+#if defined(MOZ_WIDGET_GONK) && ANDROID_VERSION >= 17
+  case HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED:
+#endif
+      // Needs convert to RGB565
+      return gfx::SurfaceFormat::R5G6B5_UINT16;
+  default:
+    if (aHalFormat >= 0x100 && aHalFormat <= 0x1FF) {
+      // Reserved range for HAL specific formats.
+      // Needs convert to RGB565
+      return gfx::SurfaceFormat::R5G6B5_UINT16;
+    } else {
+      MOZ_CRASH("Unhandled HAL pixel format");
+      return SurfaceFormat::UNKNOWN; // not reached
+    }
+  }
+}
+
+static bool
+NeedsConvertFromYUVtoRGB565(int aHalFormat)
+{
+  switch (aHalFormat) {
+  case android::PIXEL_FORMAT_BGRA_8888:
+  case android::PIXEL_FORMAT_RGBA_8888:
+  case android::PIXEL_FORMAT_RGBX_8888:
+  case android::PIXEL_FORMAT_RGB_565:
+    return false;
+  case HAL_PIXEL_FORMAT_YCbCr_422_SP:
+  case HAL_PIXEL_FORMAT_YCrCb_420_SP:
+  case HAL_PIXEL_FORMAT_YCbCr_422_I:
+  case GrallocImage::HAL_PIXEL_FORMAT_YCbCr_420_SP_TILED:
+  case GrallocImage::HAL_PIXEL_FORMAT_YCbCr_420_SP_VENUS:
+  case HAL_PIXEL_FORMAT_YV12:
+#if defined(MOZ_WIDGET_GONK) && ANDROID_VERSION >= 17
+  case HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED:
+#endif
+      return true;
+  default:
+    if (aHalFormat >= 0x100 && aHalFormat <= 0x1FF) {
+      // Reserved range for HAL specific formats.
+      return true;
+    } else {
+      MOZ_CRASH("Unhandled HAL pixel format");
+      return false; // not reached
+    }
+  }
+}
+
+GrallocTextureHostBasic::GrallocTextureHostBasic(
+  TextureFlags aFlags,
+  const NewSurfaceDescriptorGralloc& aDescriptor)
+  : TextureHost(aFlags)
+  , mGrallocHandle(aDescriptor)
+  , mSize(0, 0)
+  , mCropSize(0, 0)
+  , mFormat(gfx::SurfaceFormat::UNKNOWN)
+  , mIsOpaque(aDescriptor.isOpaque())
+{
+  android::GraphicBuffer* grallocBuffer = GetGraphicBufferFromDesc(mGrallocHandle).get();
+  MOZ_ASSERT(grallocBuffer);
+
+  if (grallocBuffer) {
+    mFormat =
+      HalFormatToSurfaceFormat(grallocBuffer->getPixelFormat(),
+                               aFlags & TextureFlags::RB_SWAPPED);
+    mSize = gfx::IntSize(grallocBuffer->getWidth(), grallocBuffer->getHeight());
+    mCropSize = mSize;
+  } else {
+    printf_stderr("gralloc buffer is nullptr\n");
+  }
+}
+
+bool
+GrallocTextureHostBasic::Lock()
+{
+  if (!mCompositor || !IsValid()) {
+    return false;
+  }
+
+  if (mTextureSource) {
+    return true;
+  }
+
+  android::sp<android::GraphicBuffer> graphicBuffer =
+    GetGraphicBufferFromDesc(mGrallocHandle);
+  MOZ_ASSERT(graphicBuffer.get());
+
+  RefPtr<gfx::DataSourceSurface> surf;
+  if (NeedsConvertFromYUVtoRGB565(graphicBuffer->getPixelFormat())) {
+    PlanarYCbCrData ycbcrData;
+    surf = GetDataSourceSurfaceFrom(graphicBuffer,
+                                    mCropSize,
+                                    ycbcrData);
+  } else {
+    uint32_t usage = GRALLOC_USAGE_SW_READ_OFTEN;
+    int32_t rv = graphicBuffer->lock(usage,
+                                     reinterpret_cast<void**>(&mMappedBuffer));
+    if (rv) {
+      mMappedBuffer = nullptr;
+      NS_WARNING("Couldn't lock graphic buffer");
+      return false;
+    }
+    surf = Factory::CreateWrappingDataSourceSurface(
+             mMappedBuffer,
+             graphicBuffer->getStride() * gfx::BytesPerPixel(mFormat),
+             mCropSize,
+             mFormat);
+  }
+  mTextureSource = mCompositor->CreateDataTextureSource(mFlags);
+  mTextureSource->Update(surf, nullptr);
+  return true;
+}
+
+bool
+GrallocTextureHostBasic::IsValid() const
+{
+  android::GraphicBuffer* graphicBuffer = GetGraphicBufferFromDesc(mGrallocHandle).get();
+  return graphicBuffer != nullptr;
+}
+
+bool
+GrallocTextureHostBasic::BindTextureSource(CompositableTextureSourceRef& aTexture)
+{
+  aTexture = mTextureSource;
+  return !!aTexture;
+}
+
+void
+GrallocTextureHostBasic::UnbindTextureSource()
+{
+  ClearTextureSource();
+}
+
+void
+GrallocTextureHostBasic::ClearTextureSource()
+{
+  mTextureSource = nullptr;
+  if (mMappedBuffer) {
+    android::GraphicBuffer* graphicBuffer = GetGraphicBufferFromDesc(mGrallocHandle).get();
+    MOZ_ASSERT(graphicBuffer);
+    mMappedBuffer = nullptr;
+    graphicBuffer->unlock();
+  }
+}
+
+void
+GrallocTextureHostBasic::SetCompositor(Compositor* aCompositor)
+{
+  BasicCompositor* compositor = static_cast<BasicCompositor*>(aCompositor);
+  mCompositor = compositor;
+  if (mTextureSource) {
+    mTextureSource->SetCompositor(compositor);
+  }
+}
+
+gfx::SurfaceFormat
+GrallocTextureHostBasic::GetFormat() const {
+  return mFormat;
+}
+
+void
+GrallocTextureHostBasic::WaitAcquireFenceHandleSyncComplete()
+{
+  if (!mAcquireFenceHandle.IsValid()) {
+    return;
+  }
+
+#if ANDROID_VERSION >= 17
+  RefPtr<FenceHandle::FdObj> fdObj = mAcquireFenceHandle.GetAndResetFdObj();
+  android::sp<android::Fence> fence(
+    new android::Fence(fdObj->GetAndResetFd()));
+
+  // Wait fece complete with timeout.
+  // If a source of the fence becomes invalid because of error,
+  // fene complete is not signaled. See Bug 1061435.
+  int rv = fence->wait(400 /*400 msec*/);
+  if (rv != android::OK) {
+    NS_ERROR("failed to wait fence complete");
+  }
+#endif
+}
+
+void
+GrallocTextureHostBasic::SetCropRect(nsIntRect aCropRect)
+{
+  MOZ_ASSERT(aCropRect.TopLeft() == IntPoint(0, 0));
+  MOZ_ASSERT(!aCropRect.IsEmpty());
+  MOZ_ASSERT(aCropRect.width <= mSize.width);
+  MOZ_ASSERT(aCropRect.height <= mSize.height);
+
+  gfx::IntSize cropSize(aCropRect.width, aCropRect.height);
+  if (mCropSize == cropSize) {
+    return;
+  }
+
+  mCropSize = cropSize;
+  ClearTextureSource();
+}
+
+void
+GrallocTextureHostBasic::DeallocateSharedData()
+{
+  ClearTextureSource();
+
+  if (mGrallocHandle.buffer().type() != MaybeMagicGrallocBufferHandle::Tnull_t) {
+    MaybeMagicGrallocBufferHandle handle = mGrallocHandle.buffer();
+    base::ProcessId owner;
+    if (handle.type() == MaybeMagicGrallocBufferHandle::TGrallocBufferRef) {
+      owner = handle.get_GrallocBufferRef().mOwner;
+    }
+    else {
+      owner = handle.get_MagicGrallocBufferHandle().mRef.mOwner;
+    }
+
+    SharedBufferManagerParent::DropGrallocBuffer(owner, mGrallocHandle);
+  }
+}
+
+void
+GrallocTextureHostBasic::ForgetSharedData()
+{
+  ClearTextureSource();
+}
+
+void
+GrallocTextureHostBasic::DeallocateDeviceData()
+{
+  ClearTextureSource();
+}
+
+LayerRenderState
+GrallocTextureHostBasic::GetRenderState()
+{
+  android::GraphicBuffer* graphicBuffer = GetGraphicBufferFromDesc(mGrallocHandle).get();
+
+  if (graphicBuffer) {
+    LayerRenderStateFlags flags = LayerRenderStateFlags::LAYER_RENDER_STATE_DEFAULT;
+    if (mIsOpaque) {
+      flags |= LayerRenderStateFlags::OPAQUE;
+    }
+    if (mFlags & TextureFlags::ORIGIN_BOTTOM_LEFT) {
+      flags |= LayerRenderStateFlags::ORIGIN_BOTTOM_LEFT;
+    }
+    if (mFlags & TextureFlags::RB_SWAPPED) {
+      flags |= LayerRenderStateFlags::FORMAT_RB_SWAP;
+    }
+    return LayerRenderState(graphicBuffer,
+                            mCropSize,
+                            flags,
+                            this);
+  }
+
+  return LayerRenderState();
+}
+
+} // namespace layers
+} // namespace mozilla
diff --git a/gfx/layers/basic/GrallocTextureHostBasic.h b/gfx/layers/basic/GrallocTextureHostBasic.h
new file mode 100644
index 0000000000..b1bcece152
--- /dev/null
+++ b/gfx/layers/basic/GrallocTextureHostBasic.h
@@ -0,0 +1,86 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef MOZILLA_GFX_GRALLOCTEXTUREHOST_BASIC_H
+#define MOZILLA_GFX_GRALLOCTEXTUREHOST_BASIC_H
+
+#include "mozilla/layers/BasicCompositor.h"
+#include "mozilla/layers/ShadowLayerUtilsGralloc.h"
+#include "mozilla/layers/TextureHostBasic.h"
+
+namespace mozilla {
+namespace layers {
+
+class BasicCompositor;
+
+/**
+ * A TextureHost for shared gralloc
+ *
+ * Most of the logic actually happens in GrallocTextureSourceBasic.
+ */
+class GrallocTextureHostBasic : public TextureHost
+{
+public:
+  GrallocTextureHostBasic(TextureFlags aFlags,
+                          const NewSurfaceDescriptorGralloc& aDescriptor);
+
+  virtual void SetCompositor(Compositor* aCompositor) override;
+
+  virtual bool Lock() override;
+
+  virtual gfx::SurfaceFormat GetFormat() const override;
+
+  virtual bool BindTextureSource(CompositableTextureSourceRef& aTexture) override;
+
+  virtual void UnbindTextureSource() override;
+
+  virtual already_AddRefed<gfx::DataSourceSurface> GetAsSurface() override
+  {
+    return nullptr; // XXX - implement this (for MOZ_DUMP_PAINTING)
+  }
+
+  virtual void WaitAcquireFenceHandleSyncComplete() override;
+
+  virtual gfx::IntSize GetSize() const override { return mCropSize; }
+
+  virtual void SetCropRect(nsIntRect aCropRect) override;
+
+  virtual void DeallocateSharedData() override;
+
+  virtual void ForgetSharedData() override;
+
+  virtual void DeallocateDeviceData() override;
+
+  virtual LayerRenderState GetRenderState() override;
+
+  bool IsValid() const;
+
+  void ClearTextureSource();
+
+#ifdef MOZ_LAYERS_HAVE_LOG
+  virtual const char* Name() override { return "GrallocTextureHostBasic"; }
+#endif
+
+protected:
+  RefPtr<BasicCompositor> mCompositor;
+  RefPtr<DataTextureSource> mTextureSource;
+  NewSurfaceDescriptorGralloc mGrallocHandle;
+  // gralloc buffer size.
+  gfx::IntSize mSize;
+  // Size reported by TextureClient, can be different in some cases (video?),
+  // used by LayerRenderState.
+  gfx::IntSize mCropSize;
+  gfx::SurfaceFormat mFormat;
+  bool mIsOpaque;
+  /**
+   * Points to a mapped gralloc buffer when TextureSource is valid.
+   */
+  uint8_t* mMappedBuffer;
+};
+
+} // namespace layers
+} // namespace mozilla
+
+#endif // MOZILLA_GFX_GRALLOCTEXTUREHOST_BASIC_H
diff --git a/gfx/layers/basic/TextureHostBasic.cpp b/gfx/layers/basic/TextureHostBasic.cpp
index 8058e43efc..07949f70a0 100644
--- a/gfx/layers/basic/TextureHostBasic.cpp
+++ b/gfx/layers/basic/TextureHostBasic.cpp
@@ -7,6 +7,9 @@
 #ifdef XP_MACOSX
 #include "MacIOSurfaceTextureHostBasic.h"
 #endif
+#ifdef MOZ_WIDGET_GONK
+#include "GrallocTextureHostBasic.h"
+#endif
 
 using namespace mozilla::gl;
 using namespace mozilla::gfx;
@@ -25,6 +28,13 @@ CreateTextureHostBasic(const SurfaceDescriptor& aDesc,
       aDesc.get_SurfaceDescriptorMacIOSurface();
     return MakeAndAddRef<MacIOSurfaceTextureHostBasic>(aFlags, desc);
   }
+#endif
+#ifdef MOZ_WIDGET_GONK
+  if (aDesc.type() == SurfaceDescriptor::TNewSurfaceDescriptorGralloc) {
+      const NewSurfaceDescriptorGralloc& desc =
+        aDesc.get_NewSurfaceDescriptorGralloc();
+    return MakeAndAddRef<GrallocTextureHostBasic>(aFlags, desc);
+    }
 #endif
   return CreateBackendIndependentTextureHost(aDesc, aDeallocator, aFlags);
 }
diff --git a/gfx/layers/client/CanvasClient.cpp b/gfx/layers/client/CanvasClient.cpp
index 5b722c63aa..ebde0aff72 100644
--- a/gfx/layers/client/CanvasClient.cpp
+++ b/gfx/layers/client/CanvasClient.cpp
@@ -98,22 +98,20 @@ CanvasClient2D::Update(gfx::IntSize aSize, ClientCanvasLayer* aLayer)
     bufferCreated = true;
   }
 
-  if (!mBuffer->Lock(OpenMode::OPEN_WRITE_ONLY)) {
-    mBuffer = nullptr;
-    return;
-  }
-
   bool updated = false;
   {
-    // Restrict drawTarget to a scope so that terminates before Unlock.
-    RefPtr<DrawTarget> target =
-      mBuffer->BorrowDrawTarget();
+    TextureClientAutoLock autoLock(mBuffer, OpenMode::OPEN_WRITE_ONLY);
+    if (!autoLock.Succeeded()) {
+      mBuffer = nullptr;
+      return;
+    }
+
+    RefPtr<DrawTarget> target = mBuffer->BorrowDrawTarget();
     if (target) {
       aLayer->UpdateTarget(target);
       updated = true;
     }
   }
-  mBuffer->Unlock();
 
   if (bufferCreated && !AddTextureClient(mBuffer)) {
     mBuffer = nullptr;
@@ -285,7 +283,9 @@ TexClientFromReadback(SharedSurface* src, ISurfaceAllocator* allocator,
         return nullptr;
 
     // With a texClient, we can lock for writing.
-    MOZ_ALWAYS_TRUE( texClient->Lock(OpenMode::OPEN_WRITE) );
+    TextureClientAutoLock autoLock(texClient, OpenMode::OPEN_WRITE);
+    DebugOnly<bool> succeeded = autoLock.Succeeded();
+    MOZ_ASSERT(succeeded, "texture should have locked");
 
     uint8_t* lockedBytes = texClient->GetLockedData();
 
@@ -317,8 +317,6 @@ TexClientFromReadback(SharedSurface* src, ISurfaceAllocator* allocator,
 
       texClient->RemoveFlags(TextureFlags::RB_SWAPPED);
     }
-
-    texClient->Unlock();
   }
 
   return texClient.forget();
diff --git a/gfx/layers/client/ContentClient.cpp b/gfx/layers/client/ContentClient.cpp
index 3e98eaf90c..a661c5ecd2 100644
--- a/gfx/layers/client/ContentClient.cpp
+++ b/gfx/layers/client/ContentClient.cpp
@@ -7,12 +7,14 @@
 #include "BasicLayers.h"                // for BasicLayerManager
 #include "gfxContext.h"                 // for gfxContext, etc
 #include "gfxPlatform.h"                // for gfxPlatform
+#include "gfxEnv.h"                     // for gfxEnv
 #include "gfxPrefs.h"                   // for gfxPrefs
 #include "gfxPoint.h"                   // for IntSize, gfxPoint
 #include "gfxTeeSurface.h"              // for gfxTeeSurface
 #include "gfxUtils.h"                   // for gfxUtils
 #include "ipc/ShadowLayers.h"           // for ShadowLayerForwarder
 #include "mozilla/ArrayUtils.h"         // for ArrayLength
+#include "mozilla/Maybe.h"
 #include "mozilla/gfx/2D.h"             // for DrawTarget, Factory
 #include "mozilla/gfx/BasePoint.h"      // for BasePoint
 #include "mozilla/gfx/BaseSize.h"       // for BaseSize
@@ -26,7 +28,6 @@
 #include "nsDebug.h"                    // for NS_ASSERTION, NS_WARNING, etc
 #include "nsISupportsImpl.h"            // for gfxContext::Release, etc
 #include "nsIWidget.h"                  // for nsIWidget
-#include "prenv.h"                      // for PR_GetEnv
 #include "nsLayoutUtils.h"
 #ifdef XP_WIN
 #include "gfxWindowsPlatform.h"
@@ -88,7 +89,7 @@ ContentClient::CreateContentClient(CompositableForwarder* aForwarder)
                          backend == LayersBackend::LAYERS_BASIC;
   }
 
-  if (useDoubleBuffering || PR_GetEnv("MOZ_FORCE_DOUBLE_BUFFERING")) {
+  if (useDoubleBuffering || gfxEnv::ForceDoubleBuffering()) {
     return MakeAndAddRef<ContentClientDoubleBuffered>(aForwarder);
   }
   return MakeAndAddRef<ContentClientSingleBuffered>(aForwarder);
@@ -570,33 +571,30 @@ ContentClientDoubleBuffered::FinalizeFrame(const nsIntRegion& aRegionToDraw)
 
   // We need to ensure that we lock these two buffers in the same
   // order as the compositor to prevent deadlocks.
-  if (!mFrontClient->Lock(OpenMode::OPEN_READ_ONLY)) {
+  TextureClientAutoLock frontLock(mFrontClient, OpenMode::OPEN_READ_ONLY);
+  if (!frontLock.Succeeded()) {
     return;
   }
-  if (mFrontClientOnWhite &&
-      !mFrontClientOnWhite->Lock(OpenMode::OPEN_READ_ONLY)) {
-    mFrontClient->Unlock();
-    return;
-  }
-  {
-    // Restrict the DrawTargets and frontBuffer to a scope to make
-    // sure there is no more external references to the DrawTargets
-    // when we Unlock the TextureClients.
-    RefPtr<SourceSurface> surf = mFrontClient->BorrowDrawTarget()->Snapshot();
-    RefPtr<SourceSurface> surfOnWhite = mFrontClientOnWhite
-      ? mFrontClientOnWhite->BorrowDrawTarget()->Snapshot()
-      : nullptr;
-    SourceRotatedBuffer frontBuffer(surf,
-                                    surfOnWhite,
-                                    mFrontBufferRect,
-                                    mFrontBufferRotation);
-    UpdateDestinationFrom(frontBuffer, updateRegion);
+  Maybe<TextureClientAutoLock> frontOnWhiteLock;
+  if (mFrontClientOnWhite) {
+    frontOnWhiteLock.emplace(mFrontClientOnWhite, OpenMode::OPEN_READ_ONLY);
+    if (!frontOnWhiteLock->Succeeded()) {
+      return;
+    }
   }
 
-  mFrontClient->Unlock();
-  if (mFrontClientOnWhite) {
-    mFrontClientOnWhite->Unlock();
-  }
+  // Restrict the DrawTargets and frontBuffer to a scope to make
+  // sure there is no more external references to the DrawTargets
+  // when we Unlock the TextureClients.
+  RefPtr<SourceSurface> surf = mFrontClient->BorrowDrawTarget()->Snapshot();
+  RefPtr<SourceSurface> surfOnWhite = mFrontClientOnWhite
+    ? mFrontClientOnWhite->BorrowDrawTarget()->Snapshot()
+    : nullptr;
+  SourceRotatedBuffer frontBuffer(surf,
+                                  surfOnWhite,
+                                  mFrontBufferRect,
+                                  mFrontBufferRotation);
+  UpdateDestinationFrom(frontBuffer, updateRegion);
 }
 
 void
diff --git a/gfx/layers/client/ImageClient.cpp b/gfx/layers/client/ImageClient.cpp
index f9029b551a..cc1ad1dbdd 100644
--- a/gfx/layers/client/ImageClient.cpp
+++ b/gfx/layers/client/ImageClient.cpp
@@ -185,17 +185,20 @@ ImageClientSingle::UpdateImage(ImageContainer* aContainer, uint32_t aContentFlag
           data->mYSize, data->mCbCrSize, data->mStereoMode,
           TextureFlags::DEFAULT | mTextureFlags
         );
-        if (!texture || !texture->Lock(OpenMode::OPEN_WRITE_ONLY)) {
+        if (!texture) {
           return false;
         }
+
+        TextureClientAutoLock autoLock(texture, OpenMode::OPEN_WRITE_ONLY);
+        if (!autoLock.Succeeded()) {
+          return false;
+        }
+
         bool status = texture->AsTextureClientYCbCr()->UpdateYCbCr(*data);
         MOZ_ASSERT(status);
-
-        texture->Unlock();
         if (!status) {
           return false;
         }
-
       } else if (image->GetFormat() == ImageFormat::SURFACE_TEXTURE ||
                  image->GetFormat() == ImageFormat::EGLIMAGE) {
         gfx::IntSize size = image->GetSize();
diff --git a/gfx/layers/client/TextureClient.h b/gfx/layers/client/TextureClient.h
index f7710db22a..469efed1d8 100644
--- a/gfx/layers/client/TextureClient.h
+++ b/gfx/layers/client/TextureClient.h
@@ -12,6 +12,7 @@
 #include "ImageTypes.h"                 // for StereoMode
 #include "mozilla/Assertions.h"         // for MOZ_ASSERT, etc
 #include "mozilla/Attributes.h"         // for override
+#include "mozilla/DebugOnly.h"
 #include "mozilla/RefPtr.h"             // for RefPtr, RefCounted
 #include "mozilla/gfx/2D.h"             // for DrawTarget
 #include "mozilla/gfx/Point.h"          // for IntSize
@@ -720,17 +721,39 @@ protected:
   size_t mBufSize;
 };
 
-struct TextureClientAutoUnlock
+// Automatically lock and unlock a texture. Since texture locking is fallible,
+// Succeeded() must be checked on the guard object before proceeding.
+class MOZ_RAII TextureClientAutoLock
 {
-  TextureClient* mTexture;
+  MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER;
 
-  explicit TextureClientAutoUnlock(TextureClient* aTexture)
-  : mTexture(aTexture) {}
-
-  ~TextureClientAutoUnlock()
+public:
+  TextureClientAutoLock(TextureClient* aTexture, OpenMode aMode
+                        MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
+   : mTexture(aTexture),
+     mSucceeded(false)
   {
-    mTexture->Unlock();
+    MOZ_GUARD_OBJECT_NOTIFIER_INIT;
+
+    mSucceeded = mTexture->Lock(aMode);
+    mChecked = false;
   }
+  ~TextureClientAutoLock() {
+    MOZ_ASSERT(mChecked);
+    if (mSucceeded) {
+      mTexture->Unlock();
+    }
+  }
+
+  bool Succeeded() {
+    mChecked = true;
+    return mSucceeded;
+  }
+
+private:
+  TextureClient* mTexture;
+  DebugOnly<bool> mChecked;
+  bool mSucceeded;
 };
 
 class KeepAlive
diff --git a/gfx/layers/client/TextureClientSharedSurface.cpp b/gfx/layers/client/TextureClientSharedSurface.cpp
index 909362ae50..271fe40973 100644
--- a/gfx/layers/client/TextureClientSharedSurface.cpp
+++ b/gfx/layers/client/TextureClientSharedSurface.cpp
@@ -14,9 +14,12 @@
 #include "SharedSurface.h"
 
 #ifdef MOZ_WIDGET_GONK
+#include "mozilla/layers/GrallocTextureClient.h"
 #include "SharedSurfaceGralloc.h"
 #endif
 
+using namespace mozilla::gl;
+
 namespace mozilla {
 namespace layers {
 
diff --git a/gfx/layers/client/TiledContentClient.cpp b/gfx/layers/client/TiledContentClient.cpp
index 5217df0369..eaf75824b4 100644
--- a/gfx/layers/client/TiledContentClient.cpp
+++ b/gfx/layers/client/TiledContentClient.cpp
@@ -601,7 +601,8 @@ CopyFrontToBack(TextureClient* aFront,
                 TextureClient* aBack,
                 const gfx::IntRect& aRectToCopy)
 {
-  if (!aFront->Lock(OpenMode::OPEN_READ)) {
+  TextureClientAutoLock frontLock(aFront, OpenMode::OPEN_READ);
+  if (!frontLock.Succeeded()) {
     gfxCriticalError() << "[Tiling:Client] Failed to lock the tile's front buffer";
     return false;
   }
@@ -613,8 +614,6 @@ CopyFrontToBack(TextureClient* aFront,
 
   gfx::IntPoint rectToCopyTopLeft = aRectToCopy.TopLeft();
   aFront->CopyToTextureClient(aBack, &aRectToCopy, &rectToCopyTopLeft);
-
-  aFront->Unlock();
   return true;
 }
 
diff --git a/gfx/layers/composite/CanvasLayerComposite.cpp b/gfx/layers/composite/CanvasLayerComposite.cpp
index daab686554..2550a73d2e 100644
--- a/gfx/layers/composite/CanvasLayerComposite.cpp
+++ b/gfx/layers/composite/CanvasLayerComposite.cpp
@@ -6,7 +6,7 @@
 #include "CanvasLayerComposite.h"
 #include "composite/CompositableHost.h"  // for CompositableHost
 #include "gfx2DGlue.h"                  // for ToFilter
-#include "gfxUtils.h"                   // for gfxUtils, etc
+#include "gfxEnv.h"                     // for gfxEnv, etc
 #include "mozilla/gfx/Matrix.h"         // for Matrix4x4
 #include "mozilla/gfx/Point.h"          // for Point
 #include "mozilla/gfx/Rect.h"           // for Rect
@@ -88,7 +88,7 @@ CanvasLayerComposite::RenderLayer(const IntRect& aClipRect)
   mCompositor->MakeCurrent();
 
 #ifdef MOZ_DUMP_PAINTING
-  if (gfxUtils::sDumpPainting) {
+  if (gfxEnv::DumpCompositorTextures()) {
     RefPtr<gfx::DataSourceSurface> surf = mCompositableHost->GetAsSurface();
     WriteSnapshotToDumpFile(this, surf);
   }
diff --git a/gfx/layers/composite/ContainerLayerComposite.cpp b/gfx/layers/composite/ContainerLayerComposite.cpp
index 661fb3ec74..58eab816db 100755
--- a/gfx/layers/composite/ContainerLayerComposite.cpp
+++ b/gfx/layers/composite/ContainerLayerComposite.cpp
@@ -8,8 +8,8 @@
 #include "apz/src/AsyncPanZoomController.h"  // for AsyncPanZoomController
 #include "FrameMetrics.h"               // for FrameMetrics
 #include "Units.h"                      // for LayerRect, LayerPixel, etc
+#include "gfxEnv.h"                     // for gfxEnv
 #include "gfxPrefs.h"                   // for gfxPrefs
-#include "gfxUtils.h"                   // for gfxUtils, etc
 #include "mozilla/Assertions.h"         // for MOZ_ASSERT, etc
 #include "mozilla/RefPtr.h"             // for RefPtr
 #include "mozilla/UniquePtr.h"          // for UniquePtr
@@ -40,7 +40,7 @@
 #define CULLING_LOG(...)
 // #define CULLING_LOG(...) printf_stderr("CULLING: " __VA_ARGS__)
 
-#define DUMP(...) do { if (getenv("DUMP_DEBUG")) { printf_stderr(__VA_ARGS__); } } while(0)
+#define DUMP(...) do { if (gfxEnv::DumpDebug()) { printf_stderr(__VA_ARGS__); } } while(0)
 #define XYWH(k)  (k).x, (k).y, (k).width, (k).height
 #define XY(k)    (k).x, (k).y
 #define WH(k)    (k).width, (k).height
@@ -163,7 +163,7 @@ ContainerRenderVR(ContainerT* aContainer,
   surfaceRect.height = std::min(maxTextureSize, surfaceRect.height);
 
   gfx::VRHMDRenderingSupport *vrRendering = aHMD->GetRenderingSupport();
-  if (PR_GetEnv("NO_VR_RENDERING")) vrRendering = nullptr;
+  if (gfxEnv::NoVRRendering()) vrRendering = nullptr;
   if (vrRendering) {
     if (!aContainer->mVRRenderTargetSet || aContainer->mVRRenderTargetSet->size != surfaceRect.Size()) {
       aContainer->mVRRenderTargetSet = vrRendering->CreateRenderTargetSet(compositor, surfaceRect.Size());
@@ -297,7 +297,7 @@ ContainerRenderVR(ContainerT* aContainer,
 
   // draw the temporary surface with VR distortion to the original destination
   EffectChain vrEffect(aContainer);
-  bool skipDistortion = vrRendering || PR_GetEnv("MOZ_GFX_VR_NO_DISTORTION");
+  bool skipDistortion = vrRendering || gfxEnv::VRNoDistortion();
   if (skipDistortion) {
     vrEffect.mPrimaryEffect = new EffectRenderTarget(surface);
   } else {
@@ -709,7 +709,7 @@ ContainerRender(ContainerT* aContainer,
     gfx::Rect visibleRect(aContainer->GetEffectiveVisibleRegion().GetBounds());
     RefPtr<Compositor> compositor = aManager->GetCompositor();
 #ifdef MOZ_DUMP_PAINTING
-    if (gfxUtils::sDumpPainting) {
+    if (gfxEnv::DumpCompositorTextures()) {
       RefPtr<gfx::DataSourceSurface> surf = surface->Dump(compositor);
       if (surf) {
         WriteSnapshotToDumpFile(aContainer, surf);
diff --git a/gfx/layers/composite/ImageHost.cpp b/gfx/layers/composite/ImageHost.cpp
index ddf540aab1..b240c1cf3c 100644
--- a/gfx/layers/composite/ImageHost.cpp
+++ b/gfx/layers/composite/ImageHost.cpp
@@ -17,7 +17,7 @@
 #include "nsPrintfCString.h"            // for nsPrintfCString
 #include "nsString.h"                   // for nsAutoCString
 
-class nsIntRegion;
+#define BIAS_TIME_MS 1.0
 
 namespace mozilla {
 namespace gfx {
@@ -102,6 +102,22 @@ ImageHost::UseTextureHost(const nsTArray<TimedTexture>& aTextures)
     img.mFrontBuffer->PrepareTextureSource(img.mTextureSource);
   }
   mImages.SwapElements(newImages);
+
+  // Video producers generally send replacement images with the same frameID but
+  // slightly different timestamps in order to sync with the audio clock. This
+  // means that any CompositeUntil() call we made in Composite() may no longer
+  // guarantee that we'll composite until the next frame is ready. Fix that here.
+  if (GetCompositor() && mLastFrameID >= 0) {
+    for (size_t i = 0; i < mImages.Length(); ++i) {
+      bool frameComesAfter = mImages[i].mFrameID > mLastFrameID ||
+                             mImages[i].mProducerID != mLastProducerID;
+      if (frameComesAfter && !mImages[i].mTimeStamp.IsNull()) {
+        GetCompositor()->CompositeUntil(mImages[i].mTimeStamp +
+                                        TimeDuration::FromMilliseconds(BIAS_TIME_MS));
+        break;
+      }
+    }
+  }
 }
 
 void
@@ -124,9 +140,9 @@ GetBiasedTime(const TimeStamp& aInput, ImageHost::Bias aBias)
 {
   switch (aBias) {
   case ImageHost::BIAS_NEGATIVE:
-    return aInput - TimeDuration::FromMilliseconds(1.0);
+    return aInput - TimeDuration::FromMilliseconds(BIAS_TIME_MS);
   case ImageHost::BIAS_POSITIVE:
-    return aInput + TimeDuration::FromMilliseconds(1.0);
+    return aInput + TimeDuration::FromMilliseconds(BIAS_TIME_MS);
   default:
     return aInput;
   }
@@ -257,7 +273,7 @@ ImageHost::Composite(LayerComposite* aLayer,
   }
 
   if (uint32_t(imageIndex) + 1 < mImages.Length()) {
-    GetCompositor()->CompositeUntil(mImages[imageIndex + 1].mTimeStamp);
+    GetCompositor()->CompositeUntil(mImages[imageIndex + 1].mTimeStamp + TimeDuration::FromMilliseconds(BIAS_TIME_MS));
   }
 
   TimedImage* img = &mImages[imageIndex];
@@ -298,6 +314,13 @@ ImageHost::Composite(LayerComposite* aLayer,
       return;
     }
 
+    DiagnosticFlags diagnosticFlags = DiagnosticFlags::IMAGE;
+    if (effect->mType == EffectTypes::NV12) {
+      diagnosticFlags |= DiagnosticFlags::NV12;
+    } else if (effect->mType == EffectTypes::YCBCR) {
+      diagnosticFlags |= DiagnosticFlags::YCBCR;
+    }
+
     if (mLastFrameID != img->mFrameID || mLastProducerID != img->mProducerID) {
       if (mImageContainer) {
         aLayer->GetLayerManager()->
@@ -345,12 +368,12 @@ ImageHost::Composite(LayerComposite* aLayer,
         }
         GetCompositor()->DrawQuad(rect, aClipRect, aEffectChain,
                                   aOpacity, aTransform);
-        GetCompositor()->DrawDiagnostics(DiagnosticFlags::IMAGE | DiagnosticFlags::BIGIMAGE,
+        GetCompositor()->DrawDiagnostics(diagnosticFlags | DiagnosticFlags::BIGIMAGE,
                                          rect, aClipRect, aTransform, mFlashCounter);
       } while (it->NextTile());
       it->EndBigImageIteration();
       // layer border
-      GetCompositor()->DrawDiagnostics(DiagnosticFlags::IMAGE, pictureRect,
+      GetCompositor()->DrawDiagnostics(diagnosticFlags, pictureRect,
                                        aClipRect, aTransform, mFlashCounter);
     } else {
       IntSize textureSize = img->mTextureSource->GetSize();
@@ -366,7 +389,7 @@ ImageHost::Composite(LayerComposite* aLayer,
 
       GetCompositor()->DrawQuad(pictureRect, aClipRect, aEffectChain,
                                 aOpacity, aTransform);
-      GetCompositor()->DrawDiagnostics(DiagnosticFlags::IMAGE,
+      GetCompositor()->DrawDiagnostics(diagnosticFlags,
                                        pictureRect, aClipRect,
                                        aTransform, mFlashCounter);
     }
diff --git a/gfx/layers/composite/ImageHost.h b/gfx/layers/composite/ImageHost.h
index e77afa9a00..c710705e64 100644
--- a/gfx/layers/composite/ImageHost.h
+++ b/gfx/layers/composite/ImageHost.h
@@ -20,10 +20,9 @@
 #include "mozilla/mozalloc.h"           // for operator delete
 #include "nsCOMPtr.h"                   // for already_AddRefed
 #include "nsRect.h"                     // for mozilla::gfx::IntRect
+#include "nsRegionFwd.h"                // for nsIntRegion
 #include "nscore.h"                     // for nsACString
 
-class nsIntRegion;
-
 namespace mozilla {
 namespace gfx {
 class Matrix4x4;
diff --git a/gfx/layers/composite/ImageLayerComposite.cpp b/gfx/layers/composite/ImageLayerComposite.cpp
index a0d3c5d50a..55d748e25d 100644
--- a/gfx/layers/composite/ImageLayerComposite.cpp
+++ b/gfx/layers/composite/ImageLayerComposite.cpp
@@ -7,8 +7,8 @@
 #include "CompositableHost.h"           // for CompositableHost
 #include "Layers.h"                     // for WriteSnapshotToDumpFile, etc
 #include "gfx2DGlue.h"                  // for ToFilter
+#include "gfxEnv.h"                     // for gfxEnv
 #include "gfxRect.h"                    // for gfxRect
-#include "gfxUtils.h"                   // for gfxUtils, etc
 #include "mozilla/Assertions.h"         // for MOZ_ASSERT, etc
 #include "mozilla/gfx/Matrix.h"         // for Matrix4x4
 #include "mozilla/gfx/Point.h"          // for IntSize, Point
@@ -87,7 +87,7 @@ ImageLayerComposite::RenderLayer(const IntRect& aClipRect)
   }
 
 #ifdef MOZ_DUMP_PAINTING
-  if (gfxUtils::sDumpPainting) {
+  if (gfxEnv::DumpCompositorTextures()) {
     RefPtr<gfx::DataSourceSurface> surf = mImageHost->GetAsSurface();
     WriteSnapshotToDumpFile(this, surf);
   }
diff --git a/gfx/layers/composite/PaintedLayerComposite.cpp b/gfx/layers/composite/PaintedLayerComposite.cpp
index 33e9e7a393..c00aec3c0d 100644
--- a/gfx/layers/composite/PaintedLayerComposite.cpp
+++ b/gfx/layers/composite/PaintedLayerComposite.cpp
@@ -7,7 +7,7 @@
 #include "CompositableHost.h"           // for TiledLayerProperties, etc
 #include "FrameMetrics.h"               // for FrameMetrics
 #include "Units.h"                      // for CSSRect, LayerPixel, etc
-#include "gfxUtils.h"                   // for gfxUtils, etc
+#include "gfxEnv.h"                     // for gfxEnv
 #include "mozilla/Assertions.h"         // for MOZ_ASSERT, etc
 #include "mozilla/gfx/Matrix.h"         // for Matrix4x4
 #include "mozilla/gfx/Point.h"          // for Point
@@ -115,7 +115,7 @@ PaintedLayerComposite::RenderLayer(const gfx::IntRect& aClipRect)
   const nsIntRegion& visibleRegion = GetEffectiveVisibleRegion();
 
 #ifdef MOZ_DUMP_PAINTING
-  if (gfxUtils::sDumpPainting) {
+  if (gfxEnv::DumpCompositorTextures()) {
     RefPtr<gfx::DataSourceSurface> surf = mBuffer->GetAsSurface();
     if (surf) {
       WriteSnapshotToDumpFile(this, surf);
diff --git a/gfx/layers/composite/TextureHost.cpp b/gfx/layers/composite/TextureHost.cpp
index 87d208cf0a..161e74e8a2 100644
--- a/gfx/layers/composite/TextureHost.cpp
+++ b/gfx/layers/composite/TextureHost.cpp
@@ -214,10 +214,10 @@ TextureHost::Create(const SurfaceDescriptor& aDesc,
       return CreateBackendIndependentTextureHost(aDesc, aDeallocator, aFlags);
 
     case SurfaceDescriptor::TEGLImageDescriptor:
-    case SurfaceDescriptor::TNewSurfaceDescriptorGralloc:
     case SurfaceDescriptor::TSurfaceTextureDescriptor:
       return CreateTextureHostOGL(aDesc, aDeallocator, aFlags);
 
+    case SurfaceDescriptor::TNewSurfaceDescriptorGralloc:
     case SurfaceDescriptor::TSurfaceDescriptorMacIOSurface:
       if (aBackend == LayersBackend::LAYERS_OPENGL) {
         return CreateTextureHostOGL(aDesc, aDeallocator, aFlags);
diff --git a/gfx/layers/d3d11/CompositorD3D11.cpp b/gfx/layers/d3d11/CompositorD3D11.cpp
index 130e6832a1..cadc5d56c9 100644
--- a/gfx/layers/d3d11/CompositorD3D11.cpp
+++ b/gfx/layers/d3d11/CompositorD3D11.cpp
@@ -18,6 +18,7 @@
 #include "gfxPrefs.h"
 #include "gfxCrashReporterUtils.h"
 #include "gfxVR.h"
+#include "mozilla/gfx/StackArray.h"
 
 #include "mozilla/EnumeratedArray.h"
 
@@ -65,7 +66,6 @@ struct DeviceAttachmentsD3D11
   VertexShaderArray mVSQuadShader;
   PixelShaderArray mSolidColorShader;
   PixelShaderArray mRGBAShader;
-  PixelShaderArray mRGBAShaderPremul;
   PixelShaderArray mRGBShader;
   PixelShaderArray mYCbCrShader;
   PixelShaderArray mComponentAlphaShader;
@@ -76,8 +76,6 @@ struct DeviceAttachmentsD3D11
   RefPtr<ID3D11SamplerState> mPointSamplerState;
   RefPtr<ID3D11BlendState> mPremulBlendState;
   RefPtr<ID3D11BlendState> mNonPremulBlendState;
-  RefPtr<ID3D11BlendState> mPremulBlendMultiplyState;
-  RefPtr<ID3D11BlendState> mPremulBlendScreenState;
   RefPtr<ID3D11BlendState> mComponentBlendState;
   RefPtr<ID3D11BlendState> mDisabledBlendState;
   RefPtr<IDXGIResource> mSyncTexture;
@@ -134,8 +132,7 @@ private:
     if (SUCCEEDED(hr))
       return false;
 
-    gfxCriticalError(CriticalLog::DefaultOptions(false))
-      << "[D3D11] " << aContext << " failed: " << hexa(hr);
+    gfxCriticalNote << "[D3D11] " << aContext << " failed: " << hexa(hr);
     return true;
   }
 
@@ -149,6 +146,7 @@ CompositorD3D11::CompositorD3D11(nsIWidget* aWidget)
   , mWidget(aWidget)
   , mHwnd(nullptr)
   , mDisableSequenceForNextFrame(false)
+  , mVerifyBuffersFailed(false)
 {
 }
 
@@ -197,8 +195,7 @@ CompositorD3D11::Initialize()
   mDevice->GetImmediateContext(getter_AddRefs(mContext));
 
   if (!mContext) {
-    gfxCriticalError(CriticalLog::DefaultOptions(false))
-      << "[D3D11] failed to get immediate context";
+    gfxCriticalNote << "[D3D11] failed to get immediate context";
     return false;
   }
 
@@ -306,30 +303,6 @@ CompositorD3D11::Initialize()
       return false;
     }
 
-    D3D11_RENDER_TARGET_BLEND_DESC rtBlendMultiplyPremul = {
-      TRUE,
-      D3D11_BLEND_DEST_COLOR, D3D11_BLEND_INV_SRC_ALPHA, D3D11_BLEND_OP_ADD,
-      D3D11_BLEND_ONE, D3D11_BLEND_INV_SRC_ALPHA, D3D11_BLEND_OP_ADD,
-      D3D11_COLOR_WRITE_ENABLE_ALL
-    };
-    blendDesc.RenderTarget[0] = rtBlendMultiplyPremul;
-    hr = mDevice->CreateBlendState(&blendDesc, getter_AddRefs(mAttachments->mPremulBlendMultiplyState));
-    if (Failed(hr, "create pm-mul blender")) {
-      return false;
-    }
-
-    D3D11_RENDER_TARGET_BLEND_DESC rtBlendScreenPremul = {
-      TRUE,
-      D3D11_BLEND_ONE, D3D11_BLEND_INV_SRC_COLOR, D3D11_BLEND_OP_ADD,
-      D3D11_BLEND_ONE, D3D11_BLEND_INV_SRC_ALPHA, D3D11_BLEND_OP_ADD,
-      D3D11_COLOR_WRITE_ENABLE_ALL
-    };
-    blendDesc.RenderTarget[0] = rtBlendScreenPremul;
-    hr = mDevice->CreateBlendState(&blendDesc, getter_AddRefs(mAttachments->mPremulBlendScreenState));
-    if (Failed(hr, "create pm-scn blender")) {
-      return false;
-    }
-
     D3D11_RENDER_TARGET_BLEND_DESC rtBlendNonPremul = {
       TRUE,
       D3D11_BLEND_SRC_ALPHA, D3D11_BLEND_INV_SRC_ALPHA, D3D11_BLEND_OP_ADD,
@@ -471,8 +444,6 @@ CompositorD3D11::GetTextureFactoryIdentifier()
   ident.mParentProcessId = XRE_GetProcessType();
   ident.mParentBackend = LayersBackend::LAYERS_D3D11;
   ident.mSyncHandle = mAttachments->mSyncHandle;
-  ident.mSupportedBlendModes += gfx::CompositionOp::OP_SCREEN;
-  ident.mSupportedBlendModes += gfx::CompositionOp::OP_MULTIPLY;
   return ident;
 }
 
@@ -507,10 +478,14 @@ CompositorD3D11::CreateRenderTarget(const gfx::IntRect& aRect,
   CD3D11_TEXTURE2D_DESC desc(DXGI_FORMAT_B8G8R8A8_UNORM, aRect.width, aRect.height, 1, 1,
                              D3D11_BIND_SHADER_RESOURCE | D3D11_BIND_RENDER_TARGET);
 
+  if (mDevice != gfxWindowsPlatform::GetPlatform()->GetD3D11Device()) {
+    gfxCriticalError() << "Out of sync D3D11 devices in CreateRenderTarget";
+  }
+
   RefPtr<ID3D11Texture2D> texture;
   HRESULT hr = mDevice->CreateTexture2D(&desc, nullptr, getter_AddRefs(texture));
   if (Failed(hr) || !texture) {
-    gfxCriticalError(gfxCriticalError::DefaultOptions(false)) << "Failed in CreateRenderTarget";
+    gfxCriticalNote << "Failed in CreateRenderTarget " << hexa(hr);
     return nullptr;
   }
 
@@ -540,11 +515,15 @@ CompositorD3D11::CreateRenderTargetFromSource(const gfx::IntRect &aRect,
                              aRect.width, aRect.height, 1, 1,
                              D3D11_BIND_SHADER_RESOURCE | D3D11_BIND_RENDER_TARGET);
 
+  if (mDevice != gfxWindowsPlatform::GetPlatform()->GetD3D11Device()) {
+    gfxCriticalError() << "Out of sync D3D11 devices in CreateRenderTargetFromSource";
+  }
+
   RefPtr<ID3D11Texture2D> texture;
   HRESULT hr = mDevice->CreateTexture2D(&desc, nullptr, getter_AddRefs(texture));
   NS_ASSERTION(texture, "Could not create texture");
   if (Failed(hr) || !texture) {
-    gfxCriticalError(gfxCriticalError::DefaultOptions(false)) << "Failed in CreateRenderTargetFromSource";
+    gfxCriticalNote << "Failed in CreateRenderTargetFromSource " << hexa(hr);
     return nullptr;
   }
 
@@ -614,6 +593,14 @@ CompositorD3D11::SetPSForEffect(Effect* aEffect, MaskType aMaskType, gfx::Surfac
   case EffectTypes::SOLID_COLOR:
     mContext->PSSetShader(mAttachments->mSolidColorShader[aMaskType], nullptr, 0);
     return;
+  case EffectTypes::RENDER_TARGET:
+    mContext->PSSetShader(mAttachments->mRGBAShader[aMaskType], nullptr, 0);
+    return;
+  case EffectTypes::RGB:
+    mContext->PSSetShader((aFormat == SurfaceFormat::B8G8R8A8 || aFormat == SurfaceFormat::R8G8B8A8)
+                          ? mAttachments->mRGBAShader[aMaskType]
+                          : mAttachments->mRGBShader[aMaskType], nullptr, 0);
+    return;
   case EffectTypes::YCBCR:
     mContext->PSSetShader(mAttachments->mYCbCrShader[aMaskType], nullptr, 0);
     return;
@@ -621,7 +608,6 @@ CompositorD3D11::SetPSForEffect(Effect* aEffect, MaskType aMaskType, gfx::Surfac
     mContext->PSSetShader(mAttachments->mComponentAlphaShader[aMaskType], nullptr, 0);
     return;
   default:
-    // Note: the RGB and RENDER_TARGET cases are handled in-line in DrawQuad().
     NS_WARNING("No shader to load");
     return;
   }
@@ -883,11 +869,6 @@ CompositorD3D11::DrawQuad(const gfx::Rect& aRect,
 
   const Rect* pTexCoordRect = nullptr;
 
-  gfx::CompositionOp blendMode = gfx::CompositionOp::OP_OVER;
-  if (Effect* effect = aEffectChain.mSecondaryEffects[EffectTypes::BLEND_MODE].get()) {
-    blendMode = static_cast<EffectBlendMode*>(effect)->mBlendMode;
-  }
-
   switch (aEffectChain.mPrimaryEffect->mType) {
   case EffectTypes::SOLID_COLOR: {
       SetPSForEffect(aEffectChain.mPrimaryEffect, maskType, SurfaceFormat::UNKNOWN);
@@ -898,8 +879,6 @@ CompositorD3D11::DrawQuad(const gfx::Rect& aRect,
       mPSConstants.layerColor[1] = color.g * color.a * aOpacity;
       mPSConstants.layerColor[2] = color.b * color.a * aOpacity;
       mPSConstants.layerColor[3] = color.a * aOpacity;
-
-      restoreBlendMode = SetBlendMode(blendMode);
     }
     break;
   case EffectTypes::RGB:
@@ -917,27 +896,15 @@ CompositorD3D11::DrawQuad(const gfx::Rect& aRect,
         return;
       }
 
-      SurfaceFormat format = texturedEffect->mTexture->GetFormat();
-      bool useRGBAShader = (format == SurfaceFormat::B8G8R8A8 || format == SurfaceFormat::R8G8B8A8) ||
-                           (texturedEffect->mType == EffectTypes::RENDER_TARGET);
-
-      bool premultiplied = texturedEffect->mPremultiplied;
-      if (!premultiplied && useRGBAShader &&
-          (blendMode == CompositionOp::OP_MULTIPLY ||
-           blendMode == CompositionOp::OP_SCREEN))
-      {
-        mContext->PSSetShader(mAttachments->mRGBAShaderPremul[maskType], nullptr, 0);
-        premultiplied = true;
-      } else if (useRGBAShader) {
-        mContext->PSSetShader(mAttachments->mRGBAShader[maskType], nullptr, 0);
-      } else {
-        mContext->PSSetShader(mAttachments->mRGBShader[maskType], nullptr, 0);
-      }
+      SetPSForEffect(aEffectChain.mPrimaryEffect, maskType, texturedEffect->mTexture->GetFormat());
 
       ID3D11ShaderResourceView* srView = source->GetShaderResourceView();
       mContext->PSSetShaderResources(0, 1, &srView);
 
-      restoreBlendMode = SetBlendMode(blendMode, premultiplied);
+      if (!texturedEffect->mPremultiplied) {
+        mContext->OMSetBlendState(mAttachments->mNonPremulBlendState, sBlendFactor, 0xFFFFFFFF);
+        restoreBlendMode = true;
+      }
 
       SetSamplerForFilter(texturedEffect->mFilter);
     }
@@ -974,8 +941,6 @@ CompositorD3D11::DrawQuad(const gfx::Rect& aRect,
                                                sourceCb->GetShaderResourceView(),
                                                sourceCr->GetShaderResourceView() };
       mContext->PSSetShaderResources(0, 3, srViews);
-
-      restoreBlendMode = SetBlendMode(blendMode);
     }
     break;
   case EffectTypes::COMPONENT_ALPHA:
@@ -1003,7 +968,6 @@ CompositorD3D11::DrawQuad(const gfx::Rect& aRect,
                                                sourceOnWhite->GetShaderResourceView() };
       mContext->PSSetShaderResources(0, 2, srViews);
 
-      // Note: component alpha is never used in blend containers.
       mContext->OMSetBlendState(mAttachments->mComponentBlendState, sBlendFactor, 0xFFFFFFFF);
       restoreBlendMode = true;
     }
@@ -1045,39 +1009,6 @@ CompositorD3D11::DrawQuad(const gfx::Rect& aRect,
   }
 }
 
-bool
-CompositorD3D11::SetBlendMode(gfx::CompositionOp aOp, bool aPremultiplied)
-{
-  if (aOp == gfx::CompositionOp::OP_OVER && aPremultiplied) {
-    return false;
-  }
-
-  ID3D11BlendState* blendState = nullptr;
-
-  switch (aOp) {
-    case gfx::CompositionOp::OP_OVER:
-      MOZ_ASSERT(!aPremultiplied);
-      blendState = mAttachments->mNonPremulBlendState;
-      break;
-    case gfx::CompositionOp::OP_MULTIPLY:
-      // Premultiplication is handled in the shader.
-      MOZ_ASSERT(aPremultiplied);
-      blendState = mAttachments->mPremulBlendMultiplyState;
-      break;
-    case gfx::CompositionOp::OP_SCREEN:
-      // Premultiplication is handled in the shader.
-      MOZ_ASSERT(aPremultiplied);
-      blendState = mAttachments->mPremulBlendScreenState;
-      break;
-    default:
-      MOZ_ASSERT_UNREACHABLE("Unsupported blend mode!");
-      return false;
-  }
-
-  mContext->OMSetBlendState(blendState, sBlendFactor, 0xFFFFFFFF);
-  return true;
-}
-
 void
 CompositorD3D11::BeginFrame(const nsIntRegion& aInvalidRegion,
                             const Rect* aClipRectIn,
@@ -1085,6 +1016,10 @@ CompositorD3D11::BeginFrame(const nsIntRegion& aInvalidRegion,
                             Rect* aClipRectOut,
                             Rect* aRenderBoundsOut)
 {
+  if (mDevice != gfxWindowsPlatform::GetPlatform()->GetD3D11Device()) {
+    gfxCriticalError() << "Out of sync D3D11 devices in BeginFrame";
+  }
+
   // Don't composite if we are minimised. Other than for the sake of efficency,
   // this is important because resizing our buffers when mimised will fail and
   // cause a crash when we're restored.
@@ -1095,10 +1030,9 @@ CompositorD3D11::BeginFrame(const nsIntRegion& aInvalidRegion,
   }
 
   IntSize oldSize = mSize;
-  UpdateRenderTarget();
 
   // Failed to create a render target or the view.
-  if (!mDefaultRT || !mDefaultRT->mRTView ||
+  if (!UpdateRenderTarget() || !mDefaultRT || !mDefaultRT->mRTView ||
       mSize.width <= 0 || mSize.height <= 0) {
     *aRenderBoundsOut = Rect();
     return;
@@ -1190,26 +1124,26 @@ CompositorD3D11::EndFrame()
       DXGI_PRESENT_PARAMETERS params;
       PodZero(&params);
       params.DirtyRectsCount = mInvalidRegion.GetNumRects();
-      std::vector<RECT> rects;
-      rects.reserve(params.DirtyRectsCount);
+      StackArray<RECT, 4> rects(params.DirtyRectsCount);
 
       nsIntRegionRectIterator iter(mInvalidRegion);
       const IntRect* r;
       uint32_t i = 0;
       while ((r = iter.Next()) != nullptr) {
-        RECT rect;
-        rect.left = r->x;
-        rect.top = r->y;
-        rect.bottom = r->YMost();
-        rect.right = r->XMost();
-
-        rects.push_back(rect);
+        rects[i].left = r->x;
+        rects[i].top = r->y;
+        rects[i].bottom = r->YMost();
+        rects[i].right = r->XMost();
+        i++;
       }
 
-      params.pDirtyRects = &rects.front();
+      params.pDirtyRects = params.DirtyRectsCount ? rects.data() : nullptr;
       chain->Present1(presentInterval, mDisableSequenceForNextFrame ? DXGI_PRESENT_DO_NOT_SEQUENCE : 0, &params);
     } else {
-      mSwapChain->Present(presentInterval, mDisableSequenceForNextFrame ? DXGI_PRESENT_DO_NOT_SEQUENCE : 0);
+      hr = mSwapChain->Present(presentInterval, mDisableSequenceForNextFrame ? DXGI_PRESENT_DO_NOT_SEQUENCE : 0);
+      if (Failed(hr)) {
+        gfxCriticalNote << "D3D11 swap chain preset failed " << hexa(hr);
+      }
     }
     mDisableSequenceForNextFrame = false;
     if (mTarget) {
@@ -1274,9 +1208,10 @@ CompositorD3D11::VerifyBufferSize()
     return false;
   }
 
-  if ((swapDesc.BufferDesc.Width == mSize.width &&
+  if (((swapDesc.BufferDesc.Width == mSize.width &&
        swapDesc.BufferDesc.Height == mSize.height) ||
-      mSize.width <= 0 || mSize.height <= 0) {
+       mSize.width <= 0 || mSize.height <= 0) &&
+      !mVerifyBuffersFailed) {
     return true;
   }
 
@@ -1293,26 +1228,34 @@ CompositorD3D11::VerifyBufferSize()
   hr = mSwapChain->ResizeBuffers(1, mSize.width, mSize.height,
                                  DXGI_FORMAT_B8G8R8A8_UNORM,
                                  0);
+  if (Failed(hr)) {
+    gfxCriticalNote << "D3D11 swap resize buffers failed " << hexa(hr) << " on " << mSize;
+  }
+  mVerifyBuffersFailed = FAILED(hr);
 
   return Succeeded(hr);
 }
 
-void
+bool
 CompositorD3D11::UpdateRenderTarget()
 {
+  if (mDevice != gfxWindowsPlatform::GetPlatform()->GetD3D11Device()) {
+    gfxCriticalError() << "Out of sync D3D11 devices in UpdateRenderTarget";
+  }
+
   EnsureSize();
   if (!VerifyBufferSize()) {
-    gfxCriticalError(gfxCriticalError::DefaultOptions(false)) << "Failed VerifyBufferSize in UpdateRenderTarget " << mSize;
-    return;
+    gfxCriticalNote << "Failed VerifyBufferSize in UpdateRenderTarget " << mSize;
+    return false;
   }
 
   if (mDefaultRT) {
-    return;
+    return true;
   }
 
   if (mSize.width <= 0 || mSize.height <= 0) {
-    gfxCriticalError(gfxCriticalError::DefaultOptions(false)) << "Invalid size in UpdateRenderTarget " << mSize;
-    return;
+    gfxCriticalNote << "Invalid size in UpdateRenderTarget " << mSize;
+    return false;
   }
 
   HRESULT hr;
@@ -1324,16 +1267,18 @@ CompositorD3D11::UpdateRenderTarget()
     // This happens on some GPUs/drivers when there's a TDR.
     if (mDevice->GetDeviceRemovedReason() != S_OK) {
       gfxCriticalError() << "GetBuffer returned invalid call!";
-      return;
+      return false;
     }
   }
   if (Failed(hr)) {
-    gfxCriticalError(gfxCriticalError::DefaultOptions(false)) << "Failed in UpdateRenderTarget";
-    return;
+    gfxCriticalNote << "Failed in UpdateRenderTarget " << hexa(hr);
+    return false;
   }
 
   mDefaultRT = new CompositingRenderTargetD3D11(backBuf, IntPoint(0, 0));
   mDefaultRT->SetSize(mSize);
+
+  return true;
 }
 
 bool
@@ -1351,6 +1296,10 @@ DeviceAttachmentsD3D11::InitSyncObject()
                              D3D11_BIND_RENDER_TARGET);
   desc.MiscFlags = D3D11_RESOURCE_MISC_SHARED_KEYEDMUTEX;
 
+  if (mDevice != gfxWindowsPlatform::GetPlatform()->GetD3D11Device()) {
+    gfxCriticalError() << "Out of sync D3D11 devices in InitSyncObject";
+  }
+
   RefPtr<ID3D11Texture2D> texture;
   HRESULT hr = mDevice->CreateTexture2D(&desc, nullptr, getter_AddRefs(texture));
   if (Failed(hr, "create sync texture")) {
@@ -1386,9 +1335,6 @@ DeviceAttachmentsD3D11::CreateShaders()
   InitPixelShader(sRGBAShader, mRGBAShader, MaskType::MaskNone);
   InitPixelShader(sRGBAShaderMask, mRGBAShader, MaskType::Mask2d);
   InitPixelShader(sRGBAShaderMask3D, mRGBAShader, MaskType::Mask3d);
-  InitPixelShader(sRGBAShaderPremul, mRGBAShaderPremul, MaskType::MaskNone);
-  InitPixelShader(sRGBAShaderMaskPremul, mRGBAShaderPremul, MaskType::Mask2d);
-  InitPixelShader(sRGBAShaderMask3DPremul, mRGBAShaderPremul, MaskType::Mask3d);
   InitPixelShader(sYCbCrShader, mYCbCrShader, MaskType::MaskNone);
   InitPixelShader(sYCbCrShaderMask, mYCbCrShader, MaskType::Mask2d);
   if (gfxPrefs::ComponentAlphaEnabled()) {
@@ -1479,6 +1425,10 @@ CompositorD3D11::PaintToTarget()
 
   RefPtr<ID3D11Texture2D> readTexture;
 
+  if (mDevice != gfxWindowsPlatform::GetPlatform()->GetD3D11Device()) {
+    gfxCriticalError() << "Out of sync D3D11 devices in PaintToTarget";
+  }
+
   hr = mDevice->CreateTexture2D(&softDesc, nullptr, getter_AddRefs(readTexture));
   if (Failed(hr)) {
     gfxCriticalErrorOnce(gfxCriticalError::DefaultOptions(false)) << "Failed in PaintToTarget 2";
@@ -1511,8 +1461,7 @@ CompositorD3D11::Failed(HRESULT hr, const char* aContext)
   if (SUCCEEDED(hr))
     return false;
 
-  gfxCriticalError(CriticalLog::DefaultOptions(false))
-    << "[D3D11] " << aContext << " failed: " << hexa(hr);
+  gfxCriticalNote << "[D3D11] " << aContext << " failed: " << hexa(hr);
   return true;
 }
 
@@ -1522,21 +1471,37 @@ CompositorD3D11::HandleError(HRESULT hr, Severity aSeverity)
   if (SUCCEEDED(hr)) {
     return;
   }
-  // XXX - It would be nice to use gfxCriticalError, but it needs to
-  // be made to work off the main thread first.
-  //MOZ_ASSERT(aSeverity != DebugAssert);
 
   if (aSeverity == Critical) {
     MOZ_CRASH("Unrecoverable D3D11 error");
   }
 
-  if (mDevice && hr == DXGI_ERROR_DEVICE_REMOVED) {
-    hr = mDevice->GetDeviceRemovedReason();
+  if (mDevice != gfxWindowsPlatform::GetPlatform()->GetD3D11Device()) {
+    gfxCriticalError() << "Out of sync D3D11 devices in HandleError";
   }
 
-  // Always crash if we are making invalid calls
+  HRESULT hrOnReset = S_OK;
+  bool deviceRemoved = hr == DXGI_ERROR_DEVICE_REMOVED;
+
+  if (deviceRemoved && mDevice) {
+    hrOnReset = mDevice->GetDeviceRemovedReason();
+  } else if (hr == DXGI_ERROR_INVALID_CALL && mDevice) {
+    hrOnReset = mDevice->GetDeviceRemovedReason();
+    if (hrOnReset != S_OK) {
+      deviceRemoved = true;
+    }
+  }
+
+  // Device reset may not be an error on our side, but can mess things up so
+  // it's useful to see it in the reports.
+  gfxCriticalError(CriticalLog::DefaultOptions(!deviceRemoved))
+    << (deviceRemoved ? "[CompositorD3D11] device removed with error code: "
+                      : "[CompositorD3D11] error code: ")
+    << hexa(hr) << ", " << hexa(hrOnReset);
+
+  // Crash if we are making invalid calls outside of device removal
   if (hr == DXGI_ERROR_INVALID_CALL) {
-    MOZ_CRASH("Invalid D3D11 api call");
+    gfxDevCrash(deviceRemoved ? LogReason::D3D11InvalidCallDeviceRemoved : LogReason::D3D11InvalidCall) << "Invalid D3D11 api call";
   }
 
   if (aSeverity == Recoverable) {
diff --git a/gfx/layers/d3d11/CompositorD3D11.h b/gfx/layers/d3d11/CompositorD3D11.h
index f56aca029e..65cc9121e8 100644
--- a/gfx/layers/d3d11/CompositorD3D11.h
+++ b/gfx/layers/d3d11/CompositorD3D11.h
@@ -167,12 +167,11 @@ private:
   // ensure mSize is up to date with respect to mWidget
   void EnsureSize();
   bool VerifyBufferSize();
-  void UpdateRenderTarget();
+  bool UpdateRenderTarget();
   bool UpdateConstantBuffers();
   void SetSamplerForFilter(gfx::Filter aFilter);
   void SetPSForEffect(Effect *aEffect, MaskType aMaskType, gfx::SurfaceFormat aFormat);
   void PaintToTarget();
-  bool SetBlendMode(gfx::CompositionOp aOp, bool aPremultipled = true);
 
   virtual gfx::IntSize GetWidgetSize() const override { return mSize; }
 
@@ -200,6 +199,8 @@ private:
   // This is the clip rect applied to the default DrawTarget (i.e. the window)
   gfx::IntRect mCurrentClip;
   nsIntRegion mInvalidRegion;
+
+  bool mVerifyBuffersFailed;
 };
 
 }
diff --git a/gfx/layers/d3d11/TextureD3D11.cpp b/gfx/layers/d3d11/TextureD3D11.cpp
index d09b485d43..d515110a01 100644
--- a/gfx/layers/d3d11/TextureD3D11.cpp
+++ b/gfx/layers/d3d11/TextureD3D11.cpp
@@ -75,7 +75,7 @@ TextureSourceD3D11::GetShaderResourceView()
     mTexture->GetDevice(getter_AddRefs(device));
     HRESULT hr = device->CreateShaderResourceView(mTexture, nullptr, getter_AddRefs(mSRV));
     if (FAILED(hr)) {
-      gfxCriticalError(CriticalLog::DefaultOptions(false)) << "[D3D11] TextureSourceD3D11:GetShaderResourceView CreateSRV failure " << gfx::hexa(hr);
+      gfxCriticalNote << "[D3D11] TextureSourceD3D11:GetShaderResourceView CreateSRV failure " << gfx::hexa(hr);
       return nullptr;
     }
   }
@@ -1050,7 +1050,7 @@ DataTextureSourceD3D11::GetShaderResourceView()
       mTileTextures[mCurrentTile]->GetDevice(getter_AddRefs(device));
       HRESULT hr = device->CreateShaderResourceView(mTileTextures[mCurrentTile], nullptr, getter_AddRefs(mTileSRVs[mCurrentTile]));
       if (FAILED(hr)) {
-        gfxCriticalError(CriticalLog::DefaultOptions(false)) << "[D3D11] DataTextureSourceD3D11:GetShaderResourceView CreateSRV failure " << gfx::hexa(hr);
+        gfxCriticalNote << "[D3D11] DataTextureSourceD3D11:GetShaderResourceView CreateSRV failure " << gfx::hexa(hr);
         return nullptr;
       }
     }
diff --git a/gfx/layers/d3d9/DeviceManagerD3D9.cpp b/gfx/layers/d3d9/DeviceManagerD3D9.cpp
index 9c4373af97..99ecd4620c 100644
--- a/gfx/layers/d3d9/DeviceManagerD3D9.cpp
+++ b/gfx/layers/d3d9/DeviceManagerD3D9.cpp
@@ -240,7 +240,7 @@ DeviceManagerD3D9::Init()
     mD3D9 = dont_AddRef(d3d9Create(D3D_SDK_VERSION));
 
     if (!mD3D9) {
-      gfxCriticalError() << "[D3D9] Failed to create the device";
+      gfxCriticalError() << "[D3D9] Failed to create the IDirect3D9 object";
       return false;
     }
   }
@@ -249,7 +249,7 @@ DeviceManagerD3D9::Init()
   hr = mD3D9->GetAdapterIdentifier(D3DADAPTER_DEFAULT, 0, &ident);
 
   if (FAILED(hr)) {
-    gfxCriticalError() << "[D3D9] Failed to create the environment";
+    gfxCriticalError() << "[D3D9] Failed to create the environment code: " << gfx::hexa(hr);
     return false;
   }
 
@@ -359,13 +359,13 @@ DeviceManagerD3D9::Init()
     mNv3DVUtils->SetDeviceInfo(devUnknown); 
   } 
 
-  auto failCreateShaderMsg = "[D3D9] failed to create a critical resource (shader)";
+  auto failCreateShaderMsg = "[D3D9] failed to create a critical resource (shader) code: ";
 
   hr = mDevice->CreateVertexShader((DWORD*)LayerQuadVS,
                                    getter_AddRefs(mLayerVS));
 
   if (FAILED(hr)) {
-    gfxCriticalError() << failCreateShaderMsg;
+    gfxCriticalError() << failCreateShaderMsg << gfx::hexa(hr);
     return false;
   }
 
@@ -373,7 +373,7 @@ DeviceManagerD3D9::Init()
                                   getter_AddRefs(mRGBPS));
 
   if (FAILED(hr)) {
-    gfxCriticalError() << failCreateShaderMsg;
+    gfxCriticalError() << failCreateShaderMsg << gfx::hexa(hr);
     return false;
   }
 
@@ -381,7 +381,7 @@ DeviceManagerD3D9::Init()
                                   getter_AddRefs(mRGBAPS));
 
   if (FAILED(hr)) {
-    gfxCriticalError() << failCreateShaderMsg;
+    gfxCriticalError() << failCreateShaderMsg << gfx::hexa(hr);
     return false;
   }
 
@@ -389,7 +389,7 @@ DeviceManagerD3D9::Init()
                                   getter_AddRefs(mComponentPass1PS));
 
   if (FAILED(hr)) {
-    gfxCriticalError() << failCreateShaderMsg;
+    gfxCriticalError() << failCreateShaderMsg << gfx::hexa(hr);
     return false;
   }
 
@@ -397,7 +397,7 @@ DeviceManagerD3D9::Init()
                                   getter_AddRefs(mComponentPass2PS));
 
   if (FAILED(hr)) {
-    gfxCriticalError() << failCreateShaderMsg;
+    gfxCriticalError() << failCreateShaderMsg << gfx::hexa(hr);
     return false;
   }
 
@@ -405,7 +405,7 @@ DeviceManagerD3D9::Init()
                                   getter_AddRefs(mYCbCrPS));
 
   if (FAILED(hr)) {
-    gfxCriticalError() << failCreateShaderMsg;
+    gfxCriticalError() << failCreateShaderMsg << gfx::hexa(hr);
     return false;
   }
 
@@ -421,14 +421,14 @@ DeviceManagerD3D9::Init()
                                    getter_AddRefs(mLayerVSMask));
 
   if (FAILED(hr)) {
-    gfxCriticalError() << failCreateShaderMsg;
+    gfxCriticalError() << failCreateShaderMsg << gfx::hexa(hr);
     return false;
   }
   hr = mDevice->CreateVertexShader((DWORD*)LayerQuadVSMask3D,
                                    getter_AddRefs(mLayerVSMask3D));
 
   if (FAILED(hr)) {
-    gfxCriticalError() << failCreateShaderMsg;
+    gfxCriticalError() << failCreateShaderMsg << gfx::hexa(hr);
     return false;
   }
 
@@ -436,7 +436,7 @@ DeviceManagerD3D9::Init()
                                   getter_AddRefs(mRGBPSMask));
 
   if (FAILED(hr)) {
-    gfxCriticalError() << failCreateShaderMsg;
+    gfxCriticalError() << failCreateShaderMsg << gfx::hexa(hr);
     return false;
   }
 
@@ -444,7 +444,7 @@ DeviceManagerD3D9::Init()
                                   getter_AddRefs(mRGBAPSMask));
 
   if (FAILED(hr)) {
-    gfxCriticalError() << failCreateShaderMsg;
+    gfxCriticalError() << failCreateShaderMsg << gfx::hexa(hr);
     return false;
   }
 
@@ -452,7 +452,7 @@ DeviceManagerD3D9::Init()
                                   getter_AddRefs(mRGBAPSMask3D));
 
   if (FAILED(hr)) {
-    gfxCriticalError() << failCreateShaderMsg;
+    gfxCriticalError() << failCreateShaderMsg << gfx::hexa(hr);
     return false;
   }
 
@@ -460,7 +460,7 @@ DeviceManagerD3D9::Init()
                                   getter_AddRefs(mComponentPass1PSMask));
 
   if (FAILED(hr)) {
-    gfxCriticalError() << failCreateShaderMsg;
+    gfxCriticalError() << failCreateShaderMsg << gfx::hexa(hr);
     return false;
   }
 
@@ -476,7 +476,7 @@ DeviceManagerD3D9::Init()
                                   getter_AddRefs(mYCbCrPSMask));
 
   if (FAILED(hr)) {
-    gfxCriticalError() << failCreateShaderMsg;
+    gfxCriticalError() << failCreateShaderMsg << gfx::hexa(hr);
     return false;
   }
 
@@ -484,7 +484,7 @@ DeviceManagerD3D9::Init()
                                   getter_AddRefs(mSolidColorPSMask));
 
   if (FAILED(hr)) {
-    gfxCriticalError() << failCreateShaderMsg;
+    gfxCriticalError() << failCreateShaderMsg << gfx::hexa(hr);
     return false;
   }
 
@@ -495,7 +495,7 @@ DeviceManagerD3D9::Init()
 
   hr = mDevice->SetStreamSource(0, mVB, 0, sizeof(vertex));
   if (FAILED(hr)) {
-    gfxCriticalError() << "[D3D9] Failed to set the stream source";
+    gfxCriticalError() << "[D3D9] Failed to set the stream source code: " << gfx::hexa(hr);
     return false;
   }
 
diff --git a/gfx/layers/ipc/CompositorParent.cpp b/gfx/layers/ipc/CompositorParent.cpp
index 94eff04217..9a02642b4c 100644
--- a/gfx/layers/ipc/CompositorParent.cpp
+++ b/gfx/layers/ipc/CompositorParent.cpp
@@ -587,9 +587,7 @@ CompositorParent::CompositorParent(nsIWidget* aWidget,
     mApzcTreeManager = new APZCTreeManager();
   }
 
-  gfxDebugOnce() << "Enabling vsync compositor";
   mCompositorScheduler = new CompositorVsyncScheduler(this, aWidget);
-
   LayerScope::SetPixelScale(mWidget->GetDefaultScale().scale);
 }
 
@@ -1472,8 +1470,6 @@ CompositorParent::AllocPLayerTransactionParent(const nsTArray<LayersBackend>& aB
 {
   MOZ_ASSERT(aId == 0);
 
-  gfx::IntRect rect;
-  mWidget->GetClientBounds(rect);
   InitializeLayerManager(aBackendHints);
 
   if (!mLayerManager) {
diff --git a/gfx/layers/ipc/ShadowLayerUtilsX11.cpp b/gfx/layers/ipc/ShadowLayerUtilsX11.cpp
index 9408b1f2e5..e6041c809d 100644
--- a/gfx/layers/ipc/ShadowLayerUtilsX11.cpp
+++ b/gfx/layers/ipc/ShadowLayerUtilsX11.cpp
@@ -25,10 +25,10 @@
 #include "mozilla/layers/LayersSurfaces.h"  // for SurfaceDescriptor, etc
 #include "mozilla/layers/ShadowLayers.h"  // for ShadowLayerForwarder, etc
 #include "mozilla/mozalloc.h"           // for operator new
+#include "gfxEnv.h"
 #include "nsAutoPtr.h"                  // for nsRefPtr
 #include "nsCOMPtr.h"                   // for already_AddRefed
 #include "nsDebug.h"                    // for NS_ERROR
-#include "prenv.h"                      // for PR_GetEnv
 
 using namespace mozilla::gl;
 
@@ -45,7 +45,7 @@ namespace layers {
 static bool
 UsingXCompositing()
 {
-  if (!PR_GetEnv("MOZ_LAYERS_ENABLE_XLIB_SURFACES")) {
+  if (!gfxEnv::LayersEnableXlibSurfaces()) {
       return false;
   }
   return (gfxSurfaceType::Xlib ==
diff --git a/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp b/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
index 0fab48f0b9..daee9d3d9c 100644
--- a/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
+++ b/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
@@ -26,8 +26,7 @@ namespace layers {
 using namespace mozilla::ipc;
 
 SharedPlanarYCbCrImage::SharedPlanarYCbCrImage(ImageClient* aCompositable)
-: PlanarYCbCrImage(nullptr)
-, mCompositable(aCompositable)
+: mCompositable(aCompositable)
 {
   MOZ_COUNT_CTOR(SharedPlanarYCbCrImage);
 }
@@ -52,8 +51,7 @@ SharedPlanarYCbCrImage::SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const
   //     at time of allocation in GfxMemoryImageReporter.
   // Not owned:
   // - mCompositable
-  size_t size = PlanarYCbCrImage::SizeOfExcludingThis(aMallocSizeOf);
-  return size;
+  return 0;
 }
 
 TextureClient*
@@ -78,7 +76,7 @@ SharedPlanarYCbCrImage::GetAsSourceSurface()
   return PlanarYCbCrImage::GetAsSourceSurface();
 }
 
-void
+bool
 SharedPlanarYCbCrImage::SetData(const PlanarYCbCrData& aData)
 {
   // If mTextureClient has not already been allocated (through Allocate(aData))
@@ -86,20 +84,23 @@ SharedPlanarYCbCrImage::SetData(const PlanarYCbCrData& aData)
   // been called since it will trigger a full copy.
   PlanarYCbCrData data = aData;
   if (!mTextureClient && !Allocate(data)) {
-    return;
+    return false;
   }
 
   MOZ_ASSERT(mTextureClient->AsTextureClientYCbCr());
-  if (!mTextureClient->Lock(OpenMode::OPEN_WRITE_ONLY)) {
+
+  TextureClientAutoLock autoLock(mTextureClient, OpenMode::OPEN_WRITE_ONLY);
+  if (!autoLock.Succeeded()) {
     MOZ_ASSERT(false, "Failed to lock the texture.");
-    return;
+    return false;
   }
-  TextureClientAutoUnlock unlock(mTextureClient);
+
   if (!mTextureClient->AsTextureClientYCbCr()->UpdateYCbCr(aData)) {
     MOZ_ASSERT(false, "Failed to copy YCbCr data into the TextureClient");
-    return;
+    return false;
   }
   mTextureClient->MarkImmutable();
+  return true;
 }
 
 // needs to be overriden because the parent class sets mBuffer which we
@@ -129,12 +130,12 @@ SharedPlanarYCbCrImage::AllocateAndGetNewBuffer(uint32_t aSize)
   return serializer.GetData();
 }
 
-void
+bool
 SharedPlanarYCbCrImage::SetDataNoCopy(const Data &aData)
 {
   MOZ_ASSERT(mTextureClient, "This Image should have already allocated data");
   if (!mTextureClient) {
-    return;
+    return false;
   }
   mData = aData;
   mSize = aData.mPicSize;
@@ -157,20 +158,7 @@ SharedPlanarYCbCrImage::SetDataNoCopy(const Data &aData)
                                   aData.mYSize,
                                   aData.mCbCrSize,
                                   aData.mStereoMode);
-}
-
-uint8_t*
-SharedPlanarYCbCrImage::AllocateBuffer(uint32_t aSize)
-{
-  MOZ_ASSERT(!mTextureClient,
-             "This image already has allocated data");
-  mTextureClient = TextureClient::CreateWithBufferSize(mCompositable->GetForwarder(),
-                                                       gfx::SurfaceFormat::YUV, aSize,
-                                                       mCompositable->GetTextureFlags());
-  if (!mTextureClient) {
-    return nullptr;
-  }
-  return mTextureClient->GetBuffer();
+  return true;
 }
 
 bool
diff --git a/gfx/layers/ipc/SharedPlanarYCbCrImage.h b/gfx/layers/ipc/SharedPlanarYCbCrImage.h
index b8b4162c73..39132ab3ed 100644
--- a/gfx/layers/ipc/SharedPlanarYCbCrImage.h
+++ b/gfx/layers/ipc/SharedPlanarYCbCrImage.h
@@ -35,13 +35,10 @@ public:
   virtual uint8_t* GetBuffer() override;
 
   virtual already_AddRefed<gfx::SourceSurface> GetAsSourceSurface() override;
-  virtual void SetData(const PlanarYCbCrData& aData) override;
-  virtual void SetDataNoCopy(const Data &aData) override;
+  virtual bool SetData(const PlanarYCbCrData& aData) override;
+  virtual bool SetDataNoCopy(const Data &aData) override;
 
   virtual bool Allocate(PlanarYCbCrData& aData);
-  virtual uint8_t* AllocateBuffer(uint32_t aSize) override;
-  // needs to be overriden because the parent class sets mBuffer which we
-  // do not want to happen.
   virtual uint8_t* AllocateAndGetNewBuffer(uint32_t aSize) override;
 
   virtual bool IsValid() override;
diff --git a/gfx/layers/moz.build b/gfx/layers/moz.build
index 427013dde9..f34253ed1d 100644
--- a/gfx/layers/moz.build
+++ b/gfx/layers/moz.build
@@ -214,9 +214,11 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'cocoa':
 # has full system permissions there.
 if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'gonk':
     EXPORTS.mozilla.layers += [
+        'basic/GrallocTextureHostBasic.h',
         'ipc/ShadowLayerUtilsGralloc.h',
     ]
     UNIFIED_SOURCES += [
+        'basic/GrallocTextureHostBasic.cpp',
         'GrallocImages.cpp',
         'opengl/EGLImageHelpers.cpp',
         'opengl/GrallocTextureClient.cpp',
diff --git a/gfx/layers/opengl/CompositorOGL.cpp b/gfx/layers/opengl/CompositorOGL.cpp
index 7222418cdd..872d4da37f 100644
--- a/gfx/layers/opengl/CompositorOGL.cpp
+++ b/gfx/layers/opengl/CompositorOGL.cpp
@@ -13,10 +13,11 @@
 #include "Layers.h"                     // for WriteSnapshotToDumpFile
 #include "LayerScope.h"                 // for LayerScope
 #include "gfxCrashReporterUtils.h"      // for ScopedGfxFeatureReporter
+#include "gfxEnv.h"                     // for gfxEnv
 #include "gfxPlatform.h"                // for gfxPlatform
 #include "gfxPrefs.h"                   // for gfxPrefs
 #include "gfxRect.h"                    // for gfxRect
-#include "gfxUtils.h"                   // for NextPowerOfTwo, gfxUtils, etc
+#include "gfxUtils.h"                   // for gfxUtils, etc
 #include "mozilla/ArrayUtils.h"         // for ArrayLength
 #include "mozilla/Preferences.h"        // for Preferences
 #include "mozilla/gfx/BasePoint.h"      // for BasePoint
@@ -51,13 +52,6 @@
 
 #include "GeckoProfiler.h"
 
-#if defined(MOZ_WIDGET_GONK) && ANDROID_VERSION >= 17
-#include "libdisplay/GonkDisplay.h"     // for GonkDisplay
-#include <ui/Fence.h>
-#include "nsWindow.h"
-#include "nsScreenManagerGonk.h"
-#endif
-
 namespace mozilla {
 
 using namespace std;
@@ -111,14 +105,14 @@ CompositorOGL::CreateContext()
   }
 
 #ifdef XP_WIN
-  if (PR_GetEnv("MOZ_LAYERS_PREFER_EGL")) {
+  if (gfxEnv::LayersPreferEGL()) {
     printf_stderr("Trying GL layers...\n");
     context = gl::GLContextProviderEGL::CreateForWindow(mWidget);
   }
 #endif
 
   // Allow to create offscreen GL context for main Layer Manager
-  if (!context && PR_GetEnv("MOZ_LAYERS_PREFER_OFFSCREEN")) {
+  if (!context && gfxEnv::LayersPreferOffscreen()) {
     SurfaceCaps caps = SurfaceCaps::ForRGB();
     caps.preserve = false;
     caps.bpp16 = gfxPlatform::GetPlatform()->GetOffscreenFormat() == gfxImageFormat::RGB16_565;
@@ -240,7 +234,7 @@ CompositorOGL::Initialize()
     mGLContext->IsExtensionSupported(gl::GLContext::EXT_bgra);
 
   mGLContext->fBlendFuncSeparate(LOCAL_GL_ONE, LOCAL_GL_ONE_MINUS_SRC_ALPHA,
-                                 LOCAL_GL_ONE, LOCAL_GL_ONE);
+                                 LOCAL_GL_ONE, LOCAL_GL_ONE_MINUS_SRC_ALPHA);
   mGLContext->fEnable(LOCAL_GL_BLEND);
 
   // initialise a common shader to check that we can actually compile a shader
@@ -615,7 +609,6 @@ CompositorOGL::BeginFrame(const nsIntRegion& aInvalidRegion,
 
   MOZ_ASSERT(!mFrameInProgress, "frame still in progress (should have called EndFrame");
 
-  mFrameInProgress = true;
   gfx::Rect rect;
   if (mUseExternalSurfaceSize) {
     rect = gfx::Rect(0, 0, mSurfaceSize.width, mSurfaceSize.height);
@@ -635,6 +628,9 @@ CompositorOGL::BeginFrame(const nsIntRegion& aInvalidRegion,
   if (width == 0 || height == 0)
     return;
 
+  // We're about to actually draw a frame.
+  mFrameInProgress = true;
+
   // If the widget size changed, we have to force a MakeCurrent
   // to make sure that GL sees the updated widget size.
   if (mWidgetSize.width != width ||
@@ -657,7 +653,7 @@ CompositorOGL::BeginFrame(const nsIntRegion& aInvalidRegion,
 
   // Default blend function implements "OVER"
   mGLContext->fBlendFuncSeparate(LOCAL_GL_ONE, LOCAL_GL_ONE_MINUS_SRC_ALPHA,
-                                 LOCAL_GL_ONE, LOCAL_GL_ONE);
+                                 LOCAL_GL_ONE, LOCAL_GL_ONE_MINUS_SRC_ALPHA);
   mGLContext->fEnable(LOCAL_GL_BLEND);
 
   // Make sure SCISSOR is enabled before setting the render target, since the RT
@@ -743,13 +739,13 @@ CompositorOGL::CreateFBOWithTexture(const IntRect& aRect, bool aCopyFromSource,
 
       // RGBA
       size_t bufferSize = clampedRect.width * clampedRect.height * 4;
-      nsAutoArrayPtr<uint8_t> buf(new uint8_t[bufferSize]);
+      auto buf = MakeUnique<uint8_t[]>(bufferSize);
 
       mGLContext->fReadPixels(clampedRect.x, clampedRect.y,
                               clampedRect.width, clampedRect.height,
                               LOCAL_GL_RGBA,
                               LOCAL_GL_UNSIGNED_BYTE,
-                              buf);
+                              buf.get());
       mGLContext->fTexImage2D(mFBOTextureTarget,
                               0,
                               LOCAL_GL_RGBA,
@@ -757,7 +753,7 @@ CompositorOGL::CreateFBOWithTexture(const IntRect& aRect, bool aCopyFromSource,
                               0,
                               LOCAL_GL_RGBA,
                               LOCAL_GL_UNSIGNED_BYTE,
-                              buf);
+                              buf.get());
     }
     GLenum error = mGLContext->fGetError();
     if (error != LOCAL_GL_NO_ERROR) {
@@ -837,16 +833,9 @@ CompositorOGL::GetShaderConfigFor(Effect *aEffect,
     MOZ_ASSERT_IF(source->GetTextureTarget() == LOCAL_GL_TEXTURE_RECTANGLE_ARB,
                   source->GetFormat() == gfx::SurfaceFormat::R8G8B8A8 ||
                   source->GetFormat() == gfx::SurfaceFormat::R8G8B8X8 ||
-                  source->GetFormat() == gfx::SurfaceFormat::R5G6B5);
+                  source->GetFormat() == gfx::SurfaceFormat::R5G6B5_UINT16);
     config = ShaderConfigFromTargetAndFormat(source->GetTextureTarget(),
                                              source->GetFormat());
-    if ((aOp == gfx::CompositionOp::OP_MULTIPLY ||
-         aOp == gfx::CompositionOp::OP_SCREEN) &&
-        !texturedEffect->mPremultiplied) {
-      // We can do these blend modes just using glBlendFunc but we need the data
-      // to be premultiplied first.
-      config.SetPremultiply(true);
-    }
     break;
   }
   }
@@ -901,7 +890,7 @@ static bool SetBlendMode(GLContext* aGL, gfx::CompositionOp aBlendMode, bool aIs
   GLenum srcBlend;
   GLenum dstBlend;
   GLenum srcAlphaBlend = LOCAL_GL_ONE;
-  GLenum dstAlphaBlend = LOCAL_GL_ONE;
+  GLenum dstAlphaBlend = LOCAL_GL_ONE_MINUS_SRC_ALPHA;
 
   switch (aBlendMode) {
     case gfx::CompositionOp::OP_OVER:
@@ -909,18 +898,6 @@ static bool SetBlendMode(GLContext* aGL, gfx::CompositionOp aBlendMode, bool aIs
       srcBlend = LOCAL_GL_SRC_ALPHA;
       dstBlend = LOCAL_GL_ONE_MINUS_SRC_ALPHA;
       break;
-    case gfx::CompositionOp::OP_SCREEN:
-      // If the source data was un-premultiplied we should have already
-      // asked the fragment shader to fix that.
-      srcBlend = LOCAL_GL_ONE;
-      dstBlend = LOCAL_GL_ONE_MINUS_SRC_COLOR;
-      break;
-    case gfx::CompositionOp::OP_MULTIPLY:
-      // If the source data was un-premultiplied we should have already
-      // asked the fragment shader to fix that.
-      srcBlend = LOCAL_GL_DST_COLOR;
-      dstBlend = LOCAL_GL_ONE_MINUS_SRC_ALPHA;
-      break;
     case gfx::CompositionOp::OP_SOURCE:
       srcBlend = aIsPremultiplied ? LOCAL_GL_ONE : LOCAL_GL_SRC_ALPHA;
       dstBlend = LOCAL_GL_ZERO;
@@ -984,13 +961,17 @@ CompositorOGL::DrawQuad(const Rect& aRect,
     return;
   }
 
+  IntPoint offset = mCurrentRenderTarget->GetOrigin();
+  Rect renderBound = mRenderBound;
+  renderBound.IntersectRect(renderBound, aClipRect);
+  renderBound.MoveBy(offset);
+
+  Rect destRect = aTransform.TransformAndClipBounds(aRect, renderBound);
+
   // XXX: This doesn't handle 3D transforms. It also doesn't handled rotated
   //      quads. Fix me.
-  Rect destRect = aTransform.TransformAndClipBounds(aRect, aClipRect);
   mPixelsFilled += destRect.width * destRect.height;
 
-  IntPoint offset = mCurrentRenderTarget->GetOrigin();
-
   // Do a simple culling if this rect is out of target buffer.
   // Inflate a small size to avoid some numerical imprecision issue.
   destRect.Inflate(1, 1);
@@ -1380,7 +1361,7 @@ CompositorOGL::DrawQuad(const Rect& aRect,
                                      effectComponentAlpha->mOnBlack);
 
       mGLContext->fBlendFuncSeparate(LOCAL_GL_ONE, LOCAL_GL_ONE_MINUS_SRC_ALPHA,
-                                     LOCAL_GL_ONE, LOCAL_GL_ONE);
+                                     LOCAL_GL_ONE, LOCAL_GL_ONE_MINUS_SRC_ALPHA);
     }
     break;
   default:
@@ -1390,7 +1371,7 @@ CompositorOGL::DrawQuad(const Rect& aRect,
 
   if (didSetBlendMode) {
     gl()->fBlendFuncSeparate(LOCAL_GL_ONE, LOCAL_GL_ONE_MINUS_SRC_ALPHA,
-                             LOCAL_GL_ONE, LOCAL_GL_ONE);
+                             LOCAL_GL_ONE, LOCAL_GL_ONE_MINUS_SRC_ALPHA);
   }
 
   // in case rendering has used some other GL context
@@ -1407,7 +1388,7 @@ CompositorOGL::EndFrame()
   MOZ_ASSERT(mCurrentRenderTarget == mWindowRenderTarget, "Rendering target not properly restored");
 
 #ifdef MOZ_DUMP_PAINTING
-  if (gfxUtils::sDumpPainting) {
+  if (gfxEnv::DumpCompositorTextures()) {
     IntRect rect;
     if (mUseExternalSurfaceSize) {
       rect = IntRect(0, 0, mSurfaceSize.width, mSurfaceSize.height);
@@ -1470,59 +1451,10 @@ CompositorOGL::EndFrame()
   }
 }
 
-#if defined(MOZ_WIDGET_GONK) && ANDROID_VERSION >= 17
-void
-CompositorOGL::SetDispAcquireFence(Layer* aLayer, nsIWidget* aWidget)
-{
-  // OpenGL does not provide ReleaseFence for rendering.
-  // Instead use DispAcquireFence as layer buffer's ReleaseFence
-  // to prevent flickering and tearing.
-  // DispAcquireFence is DisplaySurface's AcquireFence.
-  // AcquireFence will be signaled when a buffer's content is available.
-  // See Bug 974152.
-
-  if (!aLayer || !aWidget) {
-    return;
-  }
-  nsWindow* window = static_cast<nsWindow*>(aWidget);
-  RefPtr<FenceHandle::FdObj> fence = new FenceHandle::FdObj(
-      window->GetScreen()->GetPrevDispAcquireFd());
-  mReleaseFenceHandle.Merge(FenceHandle(fence));
-}
-
-FenceHandle
-CompositorOGL::GetReleaseFence()
-{
-  if (!mReleaseFenceHandle.IsValid()) {
-    return FenceHandle();
-  }
-
-  RefPtr<FenceHandle::FdObj> fdObj = mReleaseFenceHandle.GetDupFdObj();
-  return FenceHandle(fdObj);
-}
-
-#else
-void
-CompositorOGL::SetDispAcquireFence(Layer* aLayer, nsIWidget* aWidget)
-{
-}
-
-FenceHandle
-CompositorOGL::GetReleaseFence()
-{
-  return FenceHandle();
-}
-#endif
-
 void
 CompositorOGL::EndFrameForExternalComposition(const gfx::Matrix& aTransform)
 {
-  // This lets us reftest and screenshot content rendered externally
-  if (mTarget) {
-    MakeCurrent();
-    CopyToTarget(mTarget, mTargetBounds.TopLeft(), aTransform);
-    mGLContext->fBindBuffer(LOCAL_GL_ARRAY_BUFFER, 0);
-  }
+  MOZ_ASSERT(!mTarget);
   if (mTexturePool) {
     mTexturePool->EndFrame();
   }
@@ -1600,7 +1532,7 @@ CompositorOGL::Pause()
 bool
 CompositorOGL::Resume()
 {
-#ifdef MOZ_WIDGET_ANDROID
+#if defined(MOZ_WIDGET_ANDROID) || defined(MOZ_WIDGET_UIKIT)
   if (!gl() || gl()->IsDestroyed())
     return false;
 
diff --git a/gfx/layers/opengl/CompositorOGL.h b/gfx/layers/opengl/CompositorOGL.h
index a7eeb6c3ed..f6f57bc07b 100644
--- a/gfx/layers/opengl/CompositorOGL.h
+++ b/gfx/layers/opengl/CompositorOGL.h
@@ -209,8 +209,6 @@ public:
                                GetMaxTextureSize(),
                                mFBOTextureTarget == LOCAL_GL_TEXTURE_2D,
                                SupportsPartialTextureUpdate());
-    result.mSupportedBlendModes += gfx::CompositionOp::OP_SCREEN;
-    result.mSupportedBlendModes += gfx::CompositionOp::OP_MULTIPLY;
     result.mSupportedBlendModes += gfx::CompositionOp::OP_SOURCE;
     return result;
   }
@@ -234,8 +232,6 @@ public:
                         const gfx::Rect& aVisibleRect) override;
 
   virtual void EndFrame() override;
-  virtual void SetDispAcquireFence(Layer* aLayer, nsIWidget* aWidget) override;
-  virtual FenceHandle GetReleaseFence() override;
   virtual void EndFrameForExternalComposition(const gfx::Matrix& aTransform) override;
 
   virtual bool SupportsPartialTextureUpdate() override;
@@ -454,7 +450,6 @@ private:
    */
   gfx::IntSize mViewportSize;
 
-  FenceHandle mReleaseFenceHandle;
   ShaderProgramOGL *mCurrentProgram;
 
   gfx::Rect mRenderBound;
diff --git a/gfx/layers/opengl/GrallocTextureClient.cpp b/gfx/layers/opengl/GrallocTextureClient.cpp
index 78bb32060e..f55c53a404 100644
--- a/gfx/layers/opengl/GrallocTextureClient.cpp
+++ b/gfx/layers/opengl/GrallocTextureClient.cpp
@@ -181,7 +181,7 @@ SurfaceFormatForPixelFormat(android::PixelFormat aFormat)
   case PIXEL_FORMAT_RGBX_8888:
     return gfx::SurfaceFormat::R8G8B8X8;
   case PIXEL_FORMAT_RGB_565:
-    return gfx::SurfaceFormat::R5G6B5;
+    return gfx::SurfaceFormat::R5G6B5_UINT16;
   case HAL_PIXEL_FORMAT_YV12:
     return gfx::SurfaceFormat::YUV;
   default:
@@ -284,7 +284,7 @@ GrallocTextureClientOGL::AllocateForSurface(gfx::IntSize aSize,
      format = android::PIXEL_FORMAT_RGBX_8888;
      mFlags |= TextureFlags::RB_SWAPPED;
     break;
-  case gfx::SurfaceFormat::R5G6B5:
+  case gfx::SurfaceFormat::R5G6B5_UINT16:
     format = android::PIXEL_FORMAT_RGB_565;
     break;
   case gfx::SurfaceFormat::YUV:
@@ -329,7 +329,7 @@ GrallocTextureClientOGL::AllocateForGLRendering(gfx::IntSize aSize)
     // there is no android BGRX format?
     format = android::PIXEL_FORMAT_RGBX_8888;
     break;
-  case gfx::SurfaceFormat::R5G6B5:
+  case gfx::SurfaceFormat::R5G6B5_UINT16:
     format = android::PIXEL_FORMAT_RGB_565;
     break;
   default:
diff --git a/gfx/layers/opengl/GrallocTextureHost.cpp b/gfx/layers/opengl/GrallocTextureHost.cpp
index 49141b5852..28cea35c5c 100644
--- a/gfx/layers/opengl/GrallocTextureHost.cpp
+++ b/gfx/layers/opengl/GrallocTextureHost.cpp
@@ -35,7 +35,7 @@ SurfaceFormatForAndroidPixelFormat(android::PixelFormat aFormat,
   case android::PIXEL_FORMAT_RGBX_8888:
     return swapRB ? gfx::SurfaceFormat::B8G8R8X8 : gfx::SurfaceFormat::R8G8B8X8;
   case android::PIXEL_FORMAT_RGB_565:
-    return gfx::SurfaceFormat::R5G6B5;
+    return gfx::SurfaceFormat::R5G6B5_UINT16;
   case HAL_PIXEL_FORMAT_YCbCr_422_SP:
   case HAL_PIXEL_FORMAT_YCrCb_420_SP:
   case HAL_PIXEL_FORMAT_YCbCr_422_I:
@@ -118,7 +118,7 @@ GrallocTextureHostOGL::GrallocTextureHostOGL(TextureFlags aFlags,
     mSize = gfx::IntSize(graphicBuffer->getWidth(), graphicBuffer->getHeight());
     mCropSize = mSize;
   } else {
-    printf_stderr("gralloc buffer is nullptr");
+    printf_stderr("gralloc buffer is nullptr\n");
   }
 }
 
@@ -419,7 +419,7 @@ GrallocTextureHostOGL::WaitAcquireFenceHandleSyncComplete()
   EGLint status = sEGLLibrary.fClientWaitSync(EGL_DISPLAY(),
                                               sync,
                                               0,
-                                              400000000 /*400 usec*/);
+                                              400000000 /*400 msec*/);
   if (status != LOCAL_EGL_CONDITION_SATISFIED) {
     NS_ERROR("failed to wait native fence sync");
   }
diff --git a/gfx/layers/opengl/OGLShaderProgram.cpp b/gfx/layers/opengl/OGLShaderProgram.cpp
index 4aa8d17a90..59dacb75d1 100644
--- a/gfx/layers/opengl/OGLShaderProgram.cpp
+++ b/gfx/layers/opengl/OGLShaderProgram.cpp
@@ -5,12 +5,12 @@
 #include "OGLShaderProgram.h"
 #include <stdint.h>                     // for uint32_t
 #include <sstream>                      // for ostringstream
+#include "gfxEnv.h"
 #include "gfxRect.h"                    // for gfxRect
 #include "mozilla/DebugOnly.h"          // for DebugOnly
 #include "nsAString.h"
 #include "nsAutoPtr.h"                  // for nsRefPtr
 #include "nsString.h"                   // for nsAutoCString
-#include "prenv.h"                      // for PR_GetEnv
 #include "Layers.h"
 #include "GLContext.h"
 
@@ -570,7 +570,7 @@ ShaderProgramOGL::CreateShader(GLenum aShaderType, const char *aShaderSource)
    */
   if (!success
 #ifdef DEBUG
-      || (len > 10 && PR_GetEnv("MOZ_DEBUG_SHADERS"))
+      || (len > 10 && gfxEnv::DebugShaders())
 #endif
       )
   {
@@ -623,7 +623,7 @@ ShaderProgramOGL::CreateProgram(const char *aVertexShaderString,
    */
   if (!success
 #ifdef DEBUG
-      || (len > 10 && PR_GetEnv("MOZ_DEBUG_SHADERS"))
+      || (len > 10 && gfxEnv::DebugShaders())
 #endif
       )
   {
diff --git a/gfx/layers/opengl/OGLShaderProgram.h b/gfx/layers/opengl/OGLShaderProgram.h
index f1d5ae1b70..f0243c53bd 100644
--- a/gfx/layers/opengl/OGLShaderProgram.h
+++ b/gfx/layers/opengl/OGLShaderProgram.h
@@ -249,7 +249,7 @@ ShaderConfigFromTargetAndFormat(GLenum aTarget,
                    aFormat == gfx::SurfaceFormat::B8G8R8X8);
   config.SetNoAlpha(aFormat == gfx::SurfaceFormat::B8G8R8X8 ||
                     aFormat == gfx::SurfaceFormat::R8G8B8X8 ||
-                    aFormat == gfx::SurfaceFormat::R5G6B5);
+                    aFormat == gfx::SurfaceFormat::R5G6B5_UINT16);
   return config;
 }
 
diff --git a/gfx/layers/opengl/TextureHostOGL.h b/gfx/layers/opengl/TextureHostOGL.h
index d028cad8e6..b775e93511 100644
--- a/gfx/layers/opengl/TextureHostOGL.h
+++ b/gfx/layers/opengl/TextureHostOGL.h
@@ -29,10 +29,9 @@
 #include "nsCOMPtr.h"                   // for already_AddRefed
 #include "nsDebug.h"                    // for NS_WARNING
 #include "nsISupportsImpl.h"            // for TextureImage::Release, etc
+#include "nsRegionFwd.h"                // for nsIntRegion
 #include "OGLShaderProgram.h"           // for ShaderProgramType, etc
 
-class nsIntRegion;
-
 namespace mozilla {
 namespace gfx {
 class DataSourceSurface;
diff --git a/gfx/src/DriverCrashGuard.cpp b/gfx/src/DriverCrashGuard.cpp
index 47907957fa..af21b14be8 100644
--- a/gfx/src/DriverCrashGuard.cpp
+++ b/gfx/src/DriverCrashGuard.cpp
@@ -3,9 +3,13 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 #include "DriverCrashGuard.h"
+#include "gfxEnv.h"
 #include "gfxPrefs.h"
 #include "nsAppDirectoryServiceDefs.h"
 #include "nsDirectoryServiceUtils.h"
+#ifdef MOZ_CRASHREPORTER
+#include "nsExceptionHandler.h"
+#endif
 #include "nsServiceManagerUtils.h"
 #include "nsString.h"
 #include "nsXULAppAPI.h"
@@ -52,6 +56,13 @@ DriverCrashGuard::InitializeIfNeeded()
 void
 DriverCrashGuard::Initialize()
 {
+#ifdef NIGHTLY_BUILD
+  // We only use the crash guard on non-nightly channels, since the nightly
+  // channel is for development and having graphics features perma-disabled
+  // is rather annoying.
+  return;
+#endif
+
   // Using DriverCrashGuard off the main thread currently does not work. Under
   // e10s it could conceivably work by dispatching the IPC calls via the main
   // thread. In the parent process this would be harder. For now, we simply
@@ -60,6 +71,11 @@ DriverCrashGuard::Initialize()
     return;
   }
 
+  // Check to see if all guards have been disabled through the environment.
+  if (gfxEnv::DisableCrashGuard()) {
+    return;
+  }
+
   mGfxInfo = services::GetGfxInfo();
 
   if (XRE_IsContentProcess()) {
@@ -123,6 +139,12 @@ DriverCrashGuard::~DriverCrashGuard()
   } else {
     dom::ContentChild::GetSingleton()->SendEndDriverCrashGuard(uint32_t(mType));
   }
+
+#ifdef MOZ_CRASHREPORTER
+  // Remove the crash report annotation.
+  CrashReporter::AnnotateCrashReport(NS_LITERAL_CSTRING("GraphicsStartupTest"),
+                                     NS_LITERAL_CSTRING(""));
+#endif
 }
 
 bool
@@ -183,6 +205,7 @@ DriverCrashGuard::ActivateGuard()
     // In parent process guards, we use two tombstones to detect crashes: a
     // preferences and a zero-byte file on the filesystem.
     FlushPreferences();
+
     // Create a temporary tombstone/lockfile.
     FILE* fp = nullptr;
     mGuardFile = GetGuardFile();
@@ -401,14 +424,14 @@ void
 D3D11LayersCrashGuard::LogCrashRecovery()
 {
   RecordTelemetry(TelemetryState::RecoveredFromCrash);
-  gfxCriticalError(CriticalLog::DefaultOptions(false)) << "D3D11 layers just crashed; D3D11 will be disabled.";
+  gfxCriticalNote << "D3D11 layers just crashed; D3D11 will be disabled.";
 }
 
 void
 D3D11LayersCrashGuard::LogFeatureDisabled()
 {
   RecordTelemetry(TelemetryState::FeatureDisabled);
-  gfxCriticalError(CriticalLog::DefaultOptions(false)) << "D3D11 layers disabled due to a prior crash.";
+  gfxCriticalNote << "D3D11 layers disabled due to a prior crash.";
 }
 
 void
@@ -445,13 +468,13 @@ D3D9VideoCrashGuard::UpdateEnvironment()
 void
 D3D9VideoCrashGuard::LogCrashRecovery()
 {
-  gfxCriticalError(CriticalLog::DefaultOptions(false)) << "DXVA2D3D9 just crashed; hardware video will be disabled.";
+  gfxCriticalNote << "DXVA2D3D9 just crashed; hardware video will be disabled.";
 }
 
 void
 D3D9VideoCrashGuard::LogFeatureDisabled()
 {
-  gfxCriticalError(CriticalLog::DefaultOptions(false)) << "DXVA2D3D9 video decoding is disabled due to a previous crash.";
+  gfxCriticalNote << "DXVA2D3D9 video decoding is disabled due to a previous crash.";
 }
 
 GLContextCrashGuard::GLContextCrashGuard(dom::ContentParent* aContentParent)
@@ -459,6 +482,18 @@ GLContextCrashGuard::GLContextCrashGuard(dom::ContentParent* aContentParent)
 {
 }
 
+void
+GLContextCrashGuard::Initialize()
+{
+  if (XRE_IsContentProcess()) {
+    // Disable the GL crash guard in content processes, since we're not going
+    // to lose the entire browser and we don't want to hinder WebGL availability.
+    return;
+  }
+
+  DriverCrashGuard::Initialize();
+}
+
 bool
 GLContextCrashGuard::UpdateEnvironment()
 {
@@ -490,13 +525,13 @@ GLContextCrashGuard::UpdateEnvironment()
 void
 GLContextCrashGuard::LogCrashRecovery()
 {
-  gfxCriticalError(CriticalLog::DefaultOptions(false)) << "GLContext just crashed and is now disabled.";
+  gfxCriticalNote << "GLContext just crashed and is now disabled.";
 }
 
 void
 GLContextCrashGuard::LogFeatureDisabled()
 {
-  gfxCriticalError(CriticalLog::DefaultOptions(false)) << "GLContext is disabled due to a previous crash.";
+  gfxCriticalNote << "GLContext is disabled due to a previous crash.";
 }
 
 } // namespace gfx
diff --git a/gfx/src/DriverCrashGuard.h b/gfx/src/DriverCrashGuard.h
index 368d4b4a54..df07e56969 100644
--- a/gfx/src/DriverCrashGuard.h
+++ b/gfx/src/DriverCrashGuard.h
@@ -146,6 +146,7 @@ class GLContextCrashGuard final : public DriverCrashGuard
 {
  public:
   explicit GLContextCrashGuard(dom::ContentParent* aContentParent = nullptr);
+  void Initialize() override;
 
  protected:
   bool UpdateEnvironment() override;
diff --git a/gfx/src/FilterSupport.cpp b/gfx/src/FilterSupport.cpp
index 5b1a82453d..7ada5c6b9f 100644
--- a/gfx/src/FilterSupport.cpp
+++ b/gfx/src/FilterSupport.cpp
@@ -1232,9 +1232,6 @@ FilterNodeGraphFromDescription(DrawTarget* aDT,
 {
   const nsTArray<FilterPrimitiveDescription>& primitives = aFilter.mPrimitives;
 
-  Rect resultNeededRect(aResultNeededRect);
-  resultNeededRect.RoundOut();
-
   RefPtr<FilterCachedColorModels> sourceFilters[4];
   nsTArray<RefPtr<FilterCachedColorModels> > primitiveFilters;
 
@@ -1407,6 +1404,9 @@ ResultChangeRegionForPrimitive(const FilterPrimitiveDescription& aDescription,
 
     case PrimitiveType::ConvolveMatrix:
     {
+      if (atts.GetUint(eConvolveMatrixEdgeMode) != EDGE_MODE_NONE) {
+        return aDescription.PrimitiveSubregion();
+      }
       Size kernelUnitLength = atts.GetSize(eConvolveMatrixKernelUnitLength);
       IntSize kernelSize = atts.GetIntSize(eConvolveMatrixKernelSize);
       IntPoint target = atts.GetIntPoint(eConvolveMatrixTarget);
@@ -1603,6 +1603,8 @@ FilterSupport::PostFilterExtentsForPrimitive(const FilterPrimitiveDescription& a
 
     case PrimitiveType::Turbulence:
     case PrimitiveType::Image:
+    case PrimitiveType::DiffuseLighting:
+    case PrimitiveType::SpecularLighting:
     {
       return aDescription.PrimitiveSubregion();
     }
diff --git a/gfx/src/FilterSupport.h b/gfx/src/FilterSupport.h
index baaf898c57..8b836b3c93 100644
--- a/gfx/src/FilterSupport.h
+++ b/gfx/src/FilterSupport.h
@@ -435,7 +435,8 @@ public:
 
   /**
    * Computes the region that changes in the filter output due to a change in
-   * input.
+   * input.  This is primarily needed when an individual piece of content inside
+   * a filtered container element changes.
    */
   static nsIntRegion
   ComputeResultChangeRegion(const FilterDescription& aFilter,
diff --git a/gfx/src/RegionTyped.h b/gfx/src/RegionTyped.h
deleted file mode 100644
index 7547511762..0000000000
--- a/gfx/src/RegionTyped.h
+++ /dev/null
@@ -1,54 +0,0 @@
-/* -*- Mode: C++; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef mozilla_RegionTyped_h
-#define mozilla_RegionTyped_h
-
-#include "nsRegion.h"
-#include "mozilla/gfx/Rect.h"
-
-namespace mozilla {
-
-namespace gfx {
-
-template <class units>
-class IntRegionTyped :
-    public BaseIntRegion<IntRegionTyped<units>, IntRectTyped<units>, IntPointTyped<units>, IntMarginTyped<units>>
-{
-  typedef BaseIntRegion<IntRegionTyped<units>, IntRectTyped<units>, IntPointTyped<units>, IntMarginTyped<units>> Super;
-public:
-  // Forward constructors.
-  IntRegionTyped() {}
-  MOZ_IMPLICIT IntRegionTyped(const IntRectTyped<units>& aRect) : Super(aRect) {}
-  IntRegionTyped(const IntRegionTyped& aRegion) : Super(aRegion) {}
-  IntRegionTyped(IntRegionTyped&& aRegion) : Super(mozilla::Move(aRegion)) {}
-
-  // Assignment operators need to be forwarded as well, otherwise the compiler
-  // will declare deleted ones.
-  IntRegionTyped& operator=(const IntRegionTyped& aRegion)
-  {
-    return Super::operator=(aRegion);
-  }
-  IntRegionTyped& operator=(IntRegionTyped&& aRegion)
-  {
-    return Super::operator=(mozilla::Move(aRegion));
-  }
-
-  static IntRegionTyped FromUntyped(const nsIntRegion& aRegion)
-  {
-    return IntRegionTyped(aRegion.Impl());
-  }
-private:
-  // This is deliberately private, so calling code uses FromUntyped().
-  explicit IntRegionTyped(const nsRegion& aRegion) : Super(aRegion) {}
-};
-
-}
-
-}
-
-
-
-#endif /* mozilla_RegionTyped_h */
diff --git a/gfx/src/moz.build b/gfx/src/moz.build
index eacb6e6b71..9575ba51a5 100644
--- a/gfx/src/moz.build
+++ b/gfx/src/moz.build
@@ -32,6 +32,7 @@ EXPORTS += [
     'nsPoint.h',
     'nsRect.h',
     'nsRegion.h',
+    'nsRegionFwd.h',
     'nsRenderingContext.h',
     'nsSize.h',
     'nsThemeConstants.h',
@@ -42,10 +43,6 @@ EXPORTS.mozilla += [
     'AppUnits.h',
 ]
 
-EXPORTS.mozilla.gfx += [
-    'RegionTyped.h',
-]
-
 if CONFIG['MOZ_X11']:
     EXPORTS.mozilla += ['X11Util.h']
     SOURCES += [
diff --git a/gfx/src/nsIScriptableRegion.idl b/gfx/src/nsIScriptableRegion.idl
index 84ee20bf07..1e32fdd1ba 100644
--- a/gfx/src/nsIScriptableRegion.idl
+++ b/gfx/src/nsIScriptableRegion.idl
@@ -7,7 +7,7 @@
 #include "nsISupports.idl"
 
 %{C++
-class nsIntRegion;
+#include "nsRegionFwd.h"
 %}
 
 native nsIntRegion(nsIntRegion);
diff --git a/gfx/src/nsITheme.h b/gfx/src/nsITheme.h
index 4b458faf1b..d0d7838b6a 100644
--- a/gfx/src/nsITheme.h
+++ b/gfx/src/nsITheme.h
@@ -15,7 +15,6 @@
 #include "Units.h"
 
 struct nsRect;
-struct nsIntMargin;
 class nsPresContext;
 class nsRenderingContext;
 class nsDeviceContext;
diff --git a/gfx/src/nsMargin.h b/gfx/src/nsMargin.h
index cf824cc9e0..d9b0b8bd9a 100644
--- a/gfx/src/nsMargin.h
+++ b/gfx/src/nsMargin.h
@@ -9,6 +9,7 @@
 #include "nsCoord.h"
 #include "nsPoint.h"
 #include "mozilla/gfx/BaseMargin.h"
+#include "mozilla/gfx/Rect.h"
 
 struct nsMargin : public mozilla::gfx::BaseMargin<nscoord, nsMargin> {
   typedef mozilla::gfx::BaseMargin<nscoord, nsMargin> Super;
@@ -20,14 +21,6 @@ struct nsMargin : public mozilla::gfx::BaseMargin<nscoord, nsMargin> {
     : Super(aTop, aRight, aBottom, aLeft) {}
 };
 
-struct nsIntMargin : public mozilla::gfx::BaseMargin<int32_t, nsIntMargin> {
-  typedef mozilla::gfx::BaseMargin<int32_t, nsIntMargin> Super;
-
-  // Constructors
-  nsIntMargin() : Super() {}
-  nsIntMargin(const nsIntMargin& aMargin) : Super(aMargin) {}
-  nsIntMargin(int32_t aTop, int32_t aRight, int32_t aBottom, int32_t aLeft)
-    : Super(aTop, aRight, aBottom, aLeft) {}
-};
+typedef mozilla::gfx::IntMargin nsIntMargin;
 
 #endif /* NSMARGIN_H */
diff --git a/gfx/src/nsRect.h b/gfx/src/nsRect.h
index 9b986e8bf5..2907628cd4 100644
--- a/gfx/src/nsRect.h
+++ b/gfx/src/nsRect.h
@@ -15,12 +15,10 @@
 #include "nsCoord.h"                    // for nscoord, etc
 #include "nsISupportsImpl.h"            // for MOZ_COUNT_CTOR, etc
 #include "nsPoint.h"                    // for nsIntPoint, nsPoint
+#include "nsMargin.h"                   // for nsIntMargin, nsMargin
 #include "nsSize.h"                     // for IntSize, nsSize
 #include "nscore.h"                     // for NS_BUILD_REFCNT_LOGGING
 
-struct nsMargin;
-struct nsIntMargin;
-
 typedef mozilla::gfx::IntRect nsIntRect;
 
 struct nsRect :
diff --git a/gfx/src/nsRegion.h b/gfx/src/nsRegion.h
index 315db6d78e..0244c842c7 100644
--- a/gfx/src/nsRegion.h
+++ b/gfx/src/nsRegion.h
@@ -15,11 +15,11 @@
 #include "nsPoint.h"                    // for nsIntPoint, nsPoint
 #include "nsRect.h"                     // for mozilla::gfx::IntRect, nsRect
 #include "nsMargin.h"                   // for nsIntMargin
+#include "nsRegionFwd.h"                // for nsIntRegion
 #include "nsStringGlue.h"               // for nsCString
 #include "xpcom-config.h"               // for CPP_THROW_NEW
 #include "mozilla/Move.h"               // for mozilla::Move
 
-class nsIntRegion;
 namespace mozilla {
 namespace gfx {
 class Matrix4x4;
@@ -821,30 +821,42 @@ private:
   }
 };
 
-} // namespace gfx
-} // namespace mozilla
-
-class nsIntRegion : public mozilla::gfx::BaseIntRegion<nsIntRegion, mozilla::gfx::IntRect, nsIntPoint, nsIntMargin>
+template <class units>
+class IntRegionTyped :
+    public BaseIntRegion<IntRegionTyped<units>, IntRectTyped<units>, IntPointTyped<units>, IntMarginTyped<units>>
 {
+  typedef BaseIntRegion<IntRegionTyped<units>, IntRectTyped<units>, IntPointTyped<units>, IntMarginTyped<units>> Super;
 public:
   // Forward constructors.
-  nsIntRegion() {}
-  MOZ_IMPLICIT nsIntRegion(const mozilla::gfx::IntRect& aRect) : BaseIntRegion(aRect) {}
-  nsIntRegion(const nsIntRegion& aRegion) : BaseIntRegion(aRegion) {}
-  nsIntRegion(nsIntRegion&& aRegion) : BaseIntRegion(mozilla::Move(aRegion)) {}
+  IntRegionTyped() {}
+  MOZ_IMPLICIT IntRegionTyped(const IntRectTyped<units>& aRect) : Super(aRect) {}
+  IntRegionTyped(const IntRegionTyped& aRegion) : Super(aRegion) {}
+  IntRegionTyped(IntRegionTyped&& aRegion) : Super(mozilla::Move(aRegion)) {}
 
   // Assignment operators need to be forwarded as well, otherwise the compiler
   // will declare deleted ones.
-  nsIntRegion& operator=(const nsIntRegion& aRegion)
+  IntRegionTyped& operator=(const IntRegionTyped& aRegion)
   {
-    return BaseIntRegion::operator=(aRegion);
+    return Super::operator=(aRegion);
   }
-  nsIntRegion& operator=(nsIntRegion&& aRegion)
+  IntRegionTyped& operator=(IntRegionTyped&& aRegion)
   {
-    return BaseIntRegion::operator=(mozilla::Move(aRegion));
+    return Super::operator=(mozilla::Move(aRegion));
   }
+
+  static IntRegionTyped FromUntyped(const IntRegionTyped<UnknownUnits>& aRegion)
+  {
+    return IntRegionTyped(aRegion.Impl());
+  }
+private:
+  // This is deliberately private, so calling code uses FromUntyped().
+  explicit IntRegionTyped(const nsRegion& aRegion) : Super(aRegion) {}
 };
 
+} // namespace gfx
+} // namespace mozilla
+
+typedef mozilla::gfx::IntRegion nsIntRegion;
 typedef nsIntRegion::RectIterator nsIntRegionRectIterator;
 
 #endif
diff --git a/gfx/src/nsRegionFwd.h b/gfx/src/nsRegionFwd.h
new file mode 100644
index 0000000000..6d5345d145
--- /dev/null
+++ b/gfx/src/nsRegionFwd.h
@@ -0,0 +1,26 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+
+#ifndef nsRegionFwd_h__
+#define nsRegionFwd_h__
+
+// Forward declare enough things to define the typedef |nsIntRegion|.
+
+namespace mozilla {
+namespace gfx {
+
+struct UnknownUnits;
+
+template <class units>
+class IntRegionTyped;
+
+typedef IntRegionTyped<UnknownUnits> IntRegion;
+
+} // namespace gfx
+} // namespace mozilla
+
+typedef mozilla::gfx::IntRegion nsIntRegion;
+
+#endif
diff --git a/gfx/tests/gtest/TestVsync.cpp b/gfx/tests/gtest/TestVsync.cpp
index 18237b02ee..d50ebbd4f1 100644
--- a/gfx/tests/gtest/TestVsync.cpp
+++ b/gfx/tests/gtest/TestVsync.cpp
@@ -147,10 +147,6 @@ TEST_F(VsyncTester, CompositorGetVsyncNotifications)
 // Test that if we have vsync enabled, the parent refresh driver should get notifications
 TEST_F(VsyncTester, ParentRefreshDriverGetVsyncNotifications)
 {
-  if (!gfxPrefs::VsyncAlignedRefreshDriver()) {
-    return;
-  }
-
   VsyncSource::Display& globalDisplay = mVsyncSource->GetGlobalDisplay();
   globalDisplay.DisableVsync();
   ASSERT_FALSE(globalDisplay.IsVsyncEnabled());
@@ -177,10 +173,6 @@ TEST_F(VsyncTester, ParentRefreshDriverGetVsyncNotifications)
 // Test that child refresh vsync observers get vsync notifications
 TEST_F(VsyncTester, ChildRefreshDriverGetVsyncNotifications)
 {
-  if (!gfxPrefs::VsyncAlignedRefreshDriver()) {
-    return;
-  }
-
   VsyncSource::Display& globalDisplay = mVsyncSource->GetGlobalDisplay();
   globalDisplay.DisableVsync();
   ASSERT_FALSE(globalDisplay.IsVsyncEnabled());
diff --git a/gfx/thebes/SoftwareVsyncSource.cpp b/gfx/thebes/SoftwareVsyncSource.cpp
index cabc2cda7d..25f5e28d16 100644
--- a/gfx/thebes/SoftwareVsyncSource.cpp
+++ b/gfx/thebes/SoftwareVsyncSource.cpp
@@ -112,6 +112,12 @@ SoftwareDisplay::NotifyVsync(mozilla::TimeStamp aVsyncTimestamp)
   ScheduleNextVsync(aVsyncTimestamp);
 }
 
+mozilla::TimeDuration
+SoftwareDisplay::GetVsyncRate()
+{
+  return mVsyncRate;
+}
+
 void
 SoftwareDisplay::ScheduleNextVsync(mozilla::TimeStamp aVsyncTimestamp)
 {
diff --git a/gfx/thebes/SoftwareVsyncSource.h b/gfx/thebes/SoftwareVsyncSource.h
index e648b64b6e..5aaa53dd09 100644
--- a/gfx/thebes/SoftwareVsyncSource.h
+++ b/gfx/thebes/SoftwareVsyncSource.h
@@ -27,6 +27,7 @@ public:
   virtual bool IsVsyncEnabled() override;
   bool IsInSoftwareVsyncThread();
   virtual void NotifyVsync(mozilla::TimeStamp aVsyncTimestamp) override;
+  virtual mozilla::TimeDuration GetVsyncRate() override;
   void ScheduleNextVsync(mozilla::TimeStamp aVsyncTimestamp);
   void Shutdown();
 
diff --git a/gfx/thebes/VsyncSource.cpp b/gfx/thebes/VsyncSource.cpp
index d25119d9af..71734157b2 100644
--- a/gfx/thebes/VsyncSource.cpp
+++ b/gfx/thebes/VsyncSource.cpp
@@ -68,6 +68,13 @@ VsyncSource::Display::NotifyVsync(TimeStamp aVsyncTimestamp)
   mRefreshTimerVsyncDispatcher->NotifyVsync(aVsyncTimestamp);
 }
 
+TimeDuration
+VsyncSource::Display::GetVsyncRate()
+{
+  // If hardware queries fail / are unsupported, we have to just guess.
+  return TimeDuration::FromMilliseconds(1000.0 / 60.0);
+}
+
 void
 VsyncSource::Display::AddCompositorVsyncDispatcher(CompositorVsyncDispatcher* aCompositorVsyncDispatcher)
 {
diff --git a/gfx/thebes/VsyncSource.h b/gfx/thebes/VsyncSource.h
index bd1b5bb0b2..4c268ddbb5 100644
--- a/gfx/thebes/VsyncSource.h
+++ b/gfx/thebes/VsyncSource.h
@@ -39,7 +39,7 @@ public:
       // However, different platforms give different vsync notification times.
       // b2g - The vsync timestamp of the previous frame that was just displayed
       // OSX - The vsync timestamp of the upcoming frame, in the future
-      // TODO: Windows / Linux. DOCUMENT THIS WHEN IMPLEMENTING ON THOSE PLATFORMS
+      // Windows: It's messy, see gfxWindowsPlatform.
       // Android: TODO
       // All platforms should normalize to the vsync that just occured.
       // Large parts of Gecko assume TimeStamps should not be in the future such as animations
@@ -50,6 +50,7 @@ public:
       void AddCompositorVsyncDispatcher(CompositorVsyncDispatcher* aCompositorVsyncDispatcher);
       void RemoveCompositorVsyncDispatcher(CompositorVsyncDispatcher* aCompositorVsyncDispatcher);
       void NotifyRefreshTimerVsyncStatus(bool aEnable);
+      virtual TimeDuration GetVsyncRate();
 
       // These should all only be called on the main thread
       virtual void EnableVsync() = 0;
diff --git a/gfx/thebes/gfx2DGlue.h b/gfx/thebes/gfx2DGlue.h
index 5c79a951a3..214e997f25 100644
--- a/gfx/thebes/gfx2DGlue.h
+++ b/gfx/thebes/gfx2DGlue.h
@@ -88,7 +88,7 @@ inline gfxImageFormat SurfaceFormatToImageFormat(SurfaceFormat aFormat)
     return gfxImageFormat::ARGB32;
   case SurfaceFormat::B8G8R8X8:
     return gfxImageFormat::RGB24;
-  case SurfaceFormat::R5G6B5:
+  case SurfaceFormat::R5G6B5_UINT16:
     return gfxImageFormat::RGB16_565;
   case SurfaceFormat::A8:
     return gfxImageFormat::A8;
@@ -105,7 +105,7 @@ inline SurfaceFormat ImageFormatToSurfaceFormat(gfxImageFormat aFormat)
   case gfxImageFormat::RGB24:
     return SurfaceFormat::B8G8R8X8;
   case gfxImageFormat::RGB16_565:
-    return SurfaceFormat::R5G6B5;
+    return SurfaceFormat::R5G6B5_UINT16;
   case gfxImageFormat::A8:
     return SurfaceFormat::A8;
   default:
@@ -117,7 +117,7 @@ inline SurfaceFormat ImageFormatToSurfaceFormat(gfxImageFormat aFormat)
 inline gfxContentType ContentForFormat(const SurfaceFormat &aFormat)
 {
   switch (aFormat) {
-  case SurfaceFormat::R5G6B5:
+  case SurfaceFormat::R5G6B5_UINT16:
   case SurfaceFormat::B8G8R8X8:
   case SurfaceFormat::R8G8B8X8:
     return gfxContentType::COLOR;
diff --git a/gfx/thebes/gfxASurface.cpp b/gfx/thebes/gfxASurface.cpp
index 828bd5807a..a4b7e8d93d 100644
--- a/gfx/thebes/gfxASurface.cpp
+++ b/gfx/thebes/gfxASurface.cpp
@@ -424,7 +424,8 @@ gfxASurface::CheckSurfaceSize(const IntSize& sz, int32_t limit)
 int32_t
 gfxASurface::FormatStrideForWidth(gfxImageFormat format, int32_t width)
 {
-    return cairo_format_stride_for_width((cairo_format_t)(int)format, (int)width);
+    cairo_format_t cformat = gfxImageFormatToCairoFormat(format);
+    return cairo_format_stride_for_width(cformat, (int)width);
 }
 
 nsresult
@@ -467,7 +468,6 @@ gfxASurface::ContentFromFormat(gfxImageFormat format)
         case gfxImageFormat::RGB16_565:
             return gfxContentType::COLOR;
         case gfxImageFormat::A8:
-        case gfxImageFormat::A1:
             return gfxContentType::ALPHA;
 
         case gfxImageFormat::Unknown:
@@ -674,8 +674,6 @@ gfxASurface::BytesPerPixel(gfxImageFormat aImageFormat)
       return 2;
     case gfxImageFormat::A8:
       return 1;
-    case gfxImageFormat::A1:
-      return 1; // Close enough
     case gfxImageFormat::Unknown:
     default:
       NS_NOTREACHED("Not really sure what you want me to say here");
diff --git a/gfx/thebes/gfxAndroidPlatform.cpp b/gfx/thebes/gfxAndroidPlatform.cpp
index 7212f9f6df..812870222d 100644
--- a/gfx/thebes/gfxAndroidPlatform.cpp
+++ b/gfx/thebes/gfxAndroidPlatform.cpp
@@ -328,26 +328,26 @@ gfxFontEntry*
 gfxAndroidPlatform::LookupLocalFont(const nsAString& aFontName,
                                     uint16_t aWeight,
                                     int16_t aStretch,
-                                    bool aItalic)
+                                    uint8_t aStyle)
 {
     return gfxPlatformFontList::PlatformFontList()->LookupLocalFont(aFontName,
                                                                     aWeight,
                                                                     aStretch,
-                                                                    aItalic);
+                                                                    aStyle);
 }
 
 gfxFontEntry* 
 gfxAndroidPlatform::MakePlatformFont(const nsAString& aFontName,
                                      uint16_t aWeight,
                                      int16_t aStretch,
-                                     bool aItalic,
+                                     uint8_t aStyle,
                                      const uint8_t* aFontData,
                                      uint32_t aLength)
 {
     return gfxPlatformFontList::PlatformFontList()->MakePlatformFont(aFontName,
                                                                      aWeight,
                                                                      aStretch,
-                                                                     aItalic,
+                                                                     aStyle,
                                                                      aFontData,
                                                                      aLength);
 }
diff --git a/gfx/thebes/gfxAndroidPlatform.h b/gfx/thebes/gfxAndroidPlatform.h
index 3b93b0cd7d..c5fae09512 100644
--- a/gfx/thebes/gfxAndroidPlatform.h
+++ b/gfx/thebes/gfxAndroidPlatform.h
@@ -48,11 +48,11 @@ public:
     virtual gfxFontEntry* LookupLocalFont(const nsAString& aFontName,
                                           uint16_t aWeight,
                                           int16_t aStretch,
-                                          bool aItalic);
+                                          uint8_t aStyle);
     virtual gfxFontEntry* MakePlatformFont(const nsAString& aFontName,
                                            uint16_t aWeight,
                                            int16_t aStretch,
-                                           bool aItalic,
+                                           uint8_t aStyle,
                                            const uint8_t* aFontData,
                                            uint32_t aLength);
 
diff --git a/gfx/thebes/gfxBaseSharedMemorySurface.h b/gfx/thebes/gfxBaseSharedMemorySurface.h
index 06dbebb3f7..a4b28877ef 100644
--- a/gfx/thebes/gfxBaseSharedMemorySurface.h
+++ b/gfx/thebes/gfxBaseSharedMemorySurface.h
@@ -77,8 +77,8 @@ public:
         mozilla::gfx::IntSize size(shmInfo->width, shmInfo->height);
         if (!gfxASurface::CheckSurfaceSize(size))
             return nullptr;
-       
-        gfxImageFormat format = (gfxImageFormat)shmInfo->format;
+
+        gfxImageFormat format = shmInfo->format;
         long stride = gfxImageSurface::ComputeStride(size, format);
 
         RefPtr<Sub> s =
diff --git a/gfx/thebes/gfxCoreTextShaper.cpp b/gfx/thebes/gfxCoreTextShaper.cpp
index a35ba362b3..331c38dd8f 100644
--- a/gfx/thebes/gfxCoreTextShaper.cpp
+++ b/gfx/thebes/gfxCoreTextShaper.cpp
@@ -9,6 +9,7 @@
 #include "gfxFontUtils.h"
 #include "gfxTextRun.h"
 #include "mozilla/gfx/2D.h"
+#include "mozilla/UniquePtrExtensions.h"
 
 #include <algorithm>
 
@@ -216,9 +217,9 @@ gfxCoreTextShaper::SetGlyphsFromRun(gfxShapedText *aShapedText,
     }
 
     // retrieve the laid-out glyph data from the CTRun
-    nsAutoArrayPtr<CGGlyph> glyphsArray;
-    nsAutoArrayPtr<CGPoint> positionsArray;
-    nsAutoArrayPtr<CFIndex> glyphToCharArray;
+    UniquePtr<CGGlyph[]> glyphsArray;
+    UniquePtr<CGPoint[]> positionsArray;
+    UniquePtr<CFIndex[]> glyphToCharArray;
     const CGGlyph* glyphs = nullptr;
     const CGPoint* positions = nullptr;
     const CFIndex* glyphToChar = nullptr;
@@ -233,7 +234,7 @@ gfxCoreTextShaper::SetGlyphsFromRun(gfxShapedText *aShapedText,
     // may become an attractive option.
     glyphs = ::CTRunGetGlyphsPtr(aCTRun);
     if (!glyphs) {
-        glyphsArray = new (std::nothrow) CGGlyph[numGlyphs];
+        glyphsArray = MakeUniqueFallible<CGGlyph[]>(numGlyphs);
         if (!glyphsArray) {
             return NS_ERROR_OUT_OF_MEMORY;
         }
@@ -243,7 +244,7 @@ gfxCoreTextShaper::SetGlyphsFromRun(gfxShapedText *aShapedText,
 
     positions = ::CTRunGetPositionsPtr(aCTRun);
     if (!positions) {
-        positionsArray = new (std::nothrow) CGPoint[numGlyphs];
+        positionsArray = MakeUniqueFallible<CGPoint[]>(numGlyphs);
         if (!positionsArray) {
             return NS_ERROR_OUT_OF_MEMORY;
         }
@@ -256,7 +257,7 @@ gfxCoreTextShaper::SetGlyphsFromRun(gfxShapedText *aShapedText,
     // or the stringRange of the glyph run
     glyphToChar = ::CTRunGetStringIndicesPtr(aCTRun);
     if (!glyphToChar) {
-        glyphToCharArray = new (std::nothrow) CFIndex[numGlyphs];
+        glyphToCharArray = MakeUniqueFallible<CFIndex[]>(numGlyphs);
         if (!glyphToCharArray) {
             return NS_ERROR_OUT_OF_MEMORY;
         }
diff --git a/gfx/thebes/gfxDWriteFontList.cpp b/gfx/thebes/gfxDWriteFontList.cpp
index 9cd719523e..0e61a250a1 100644
--- a/gfx/thebes/gfxDWriteFontList.cpp
+++ b/gfx/thebes/gfxDWriteFontList.cpp
@@ -217,7 +217,8 @@ gfxDWriteFontFamily::FindStyleVariations(FontInfoData *aFontInfoData)
                  " with style: %s weight: %d stretch: %d psname: %s fullname: %s",
                  NS_ConvertUTF16toUTF8(fe->Name()).get(),
                  NS_ConvertUTF16toUTF8(Name()).get(),
-                 (fe->IsItalic()) ? "italic" : "normal",
+                 (fe->IsItalic()) ?
+                  "italic" : (fe->IsOblique() ? "oblique" : "normal"),
                  fe->Weight(), fe->Stretch(),
                  NS_ConvertUTF16toUTF8(psname).get(),
                  NS_ConvertUTF16toUTF8(fullname).get()));
@@ -388,7 +389,7 @@ gfxDWriteFontEntry::CopyFontTable(uint32_t aTableTag,
     // potential cmap discrepancies, see bug 629386.
     // Ditto for Hebrew, bug 837498.
     if (mFont && pFontList->UseGDIFontTableAccess() &&
-        !(mItalic && UsingArabicOrHebrewScriptSystemLocale()) &&
+        !(mStyle && UsingArabicOrHebrewScriptSystemLocale()) &&
         !mFont->IsSymbolFont())
     {
         LOGFONTW logfont = { 0 };
@@ -746,7 +747,7 @@ gfxFontEntry *
 gfxDWriteFontList::LookupLocalFont(const nsAString& aFontName,
                                    uint16_t aWeight,
                                    int16_t aStretch,
-                                   bool aItalic)
+                                   uint8_t aStyle)
 {
     gfxFontEntry *lookup;
 
@@ -761,7 +762,7 @@ gfxDWriteFontList::LookupLocalFont(const nsAString& aFontName,
                                dwriteLookup->mFont,
                                aWeight,
                                aStretch,
-                               aItalic);
+                               aStyle);
     fe->SetForceGDIClassic(dwriteLookup->GetForceGDIClassic());
     return fe;
 }
@@ -770,7 +771,7 @@ gfxFontEntry *
 gfxDWriteFontList::MakePlatformFont(const nsAString& aFontName,
                                     uint16_t aWeight,
                                     int16_t aStretch,
-                                    bool aItalic,
+                                    uint8_t aStyle,
                                     const uint8_t* aFontData,
                                     uint32_t aLength)
 {
@@ -835,7 +836,7 @@ gfxDWriteFontList::MakePlatformFont(const nsAString& aFontName,
                                fontFile,
                                aWeight,
                                aStretch,
-                               aItalic);
+                               aStyle);
 
     fontFile->Analyze(&isSupported, &fileType, &entry->mFaceType, &numFaces);
     if (!isSupported || numFaces > 1) {
@@ -977,7 +978,8 @@ gfxDWriteFontList::InitFontList()
                          " with style: %s weight: %d stretch: %d",
                          NS_ConvertUTF16toUTF8(fe->Name()).get(),
                          NS_ConvertUTF16toUTF8(gillSansMTFamily->Name()).get(),
-                         (fe->IsItalic()) ? "italic" : "normal",
+                         (fe->IsItalic()) ?
+                          "italic" : (fe->IsOblique() ? "oblique" : "normal"),
                          fe->Weight(), fe->Stretch()));
                 }
             }
@@ -1258,9 +1260,7 @@ gfxDWriteFontList::GetStandardFamilyName(const nsAString& aFontName,
 }
 
 gfxFontFamily*
-gfxDWriteFontList::FindFamily(const nsAString& aFamily,
-                              nsIAtom* aLanguage,
-                              bool aUseSystemFonts)
+gfxDWriteFontList::FindFamily(const nsAString& aFamily, gfxFontStyle* aStyle)
 {
     nsAutoString keyName(aFamily);
     BuildKeyNameFromFontName(keyName);
diff --git a/gfx/thebes/gfxDWriteFontList.h b/gfx/thebes/gfxDWriteFontList.h
index ce034a2164..9ce3361364 100644
--- a/gfx/thebes/gfxDWriteFontList.h
+++ b/gfx/thebes/gfxDWriteFontList.h
@@ -80,8 +80,11 @@ public:
       : gfxFontEntry(aFaceName), mFont(aFont), mFontFile(nullptr),
         mForceGDIClassic(false)
     {
-        mItalic = (aFont->GetStyle() == DWRITE_FONT_STYLE_ITALIC ||
-                   aFont->GetStyle() == DWRITE_FONT_STYLE_OBLIQUE);
+        DWRITE_FONT_STYLE dwriteStyle = aFont->GetStyle();
+        mStyle = (dwriteStyle == DWRITE_FONT_STYLE_ITALIC ?
+                  NS_FONT_STYLE_ITALIC :
+                  (dwriteStyle == DWRITE_FONT_STYLE_OBLIQUE ?
+                   NS_FONT_STYLE_OBLIQUE : NS_FONT_STYLE_NORMAL));
         mStretch = FontStretchFromDWriteStretch(aFont->GetStretch());
         uint16_t weight = NS_ROUNDUP(aFont->GetWeight() - 50, 100);
 
@@ -101,19 +104,19 @@ public:
      * \param aFont DirectWrite font object
      * \param aWeight Weight of the font
      * \param aStretch Stretch of the font
-     * \param aItalic True if italic
+     * \param aStyle italic or oblique of font
      */
     gfxDWriteFontEntry(const nsAString& aFaceName,
                               IDWriteFont *aFont,
                               uint16_t aWeight,
                               int16_t aStretch,
-                              bool aItalic)
+                              uint8_t aStyle)
       : gfxFontEntry(aFaceName), mFont(aFont), mFontFile(nullptr),
         mForceGDIClassic(false)
     {
         mWeight = aWeight;
         mStretch = aStretch;
-        mItalic = aItalic;
+        mStyle = aStyle;
         mIsLocalUserFont = true;
         mIsCJK = UNINITIALIZED_VALUE;
     }
@@ -125,19 +128,19 @@ public:
      * \param aFontFile DirectWrite fontfile object
      * \param aWeight Weight of the font
      * \param aStretch Stretch of the font
-     * \param aItalic True if italic
+     * \param aStyle italic or oblique of font
      */
     gfxDWriteFontEntry(const nsAString& aFaceName,
                               IDWriteFontFile *aFontFile,
                               uint16_t aWeight,
                               int16_t aStretch,
-                              bool aItalic)
+                              uint8_t aStyle)
       : gfxFontEntry(aFaceName), mFont(nullptr), mFontFile(aFontFile),
         mForceGDIClassic(false)
     {
         mWeight = aWeight;
         mStretch = aStretch;
-        mItalic = aItalic;
+        mStyle = aStyle;
         mIsDataUserFont = true;
         mIsCJK = UNINITIALIZED_VALUE;
     }
@@ -349,12 +352,12 @@ public:
     virtual gfxFontEntry* LookupLocalFont(const nsAString& aFontName,
                                           uint16_t aWeight,
                                           int16_t aStretch,
-                                          bool aItalic);
+                                          uint8_t aStyle);
 
     virtual gfxFontEntry* MakePlatformFont(const nsAString& aFontName,
                                            uint16_t aWeight,
                                            int16_t aStretch,
-                                           bool aItalic,
+                                           uint8_t aStyle,
                                            const uint8_t* aFontData,
                                            uint32_t aLength);
     
@@ -364,9 +367,8 @@ public:
     IDWriteGdiInterop *GetGDIInterop() { return mGDIInterop; }
     bool UseGDIFontTableAccess() { return mGDIFontTableAccess; }
 
-    virtual gfxFontFamily* FindFamily(const nsAString& aFamily,
-                                      nsIAtom* aLanguage = nullptr,
-                                      bool aUseSystemFonts = false);
+    gfxFontFamily* FindFamily(const nsAString& aFamily,
+                              gfxFontStyle* aStyle = nullptr) override;
 
     gfxFloat GetForceGDIClassicMaxFontSize() { return mForceGDIClassicMaxFontSize; }
 
diff --git a/gfx/thebes/gfxDWriteFonts.cpp b/gfx/thebes/gfxDWriteFonts.cpp
index 3f387615a7..72a5c1f45b 100644
--- a/gfx/thebes/gfxDWriteFonts.cpp
+++ b/gfx/thebes/gfxDWriteFonts.cpp
@@ -85,8 +85,9 @@ gfxDWriteFont::gfxDWriteFont(gfxFontEntry *aFontEntry,
         static_cast<gfxDWriteFontEntry*>(aFontEntry);
     nsresult rv;
     DWRITE_FONT_SIMULATIONS sims = DWRITE_FONT_SIMULATIONS_NONE;
-    if ((GetStyle()->style & (NS_FONT_STYLE_ITALIC | NS_FONT_STYLE_OBLIQUE)) &&
-        !fe->IsItalic() && GetStyle()->allowSyntheticStyle) {
+    if ((GetStyle()->style != NS_FONT_STYLE_NORMAL) &&
+        fe->IsUpright() &&
+        GetStyle()->allowSyntheticStyle) {
             // For this we always use the font_matrix for uniformity. Not the
             // DWrite simulation.
             mNeedsOblique = true;
diff --git a/gfx/thebes/gfxEnv.h b/gfx/thebes/gfxEnv.h
new file mode 100644
index 0000000000..7ee393eeb4
--- /dev/null
+++ b/gfx/thebes/gfxEnv.h
@@ -0,0 +1,124 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef GFX_ENV_H
+#define GFX_ENV_H
+
+#include "prenv.h"
+
+// To register the check for an environment variable existence (and not empty),
+// add a line in this file using the DECL_GFX_ENV macro.
+//
+// For example this line in the .h:
+//   DECL_GFX_ENV_ONCE("MOZ_DISABLE_CONTEXT_SHARING_GLX",DisableContextSharingGLX);
+// means that you can call
+//   bool var = gfxEnv::DisableContextSharingGLX();
+// and that the value will be checked only once, first time we call it, then cached.
+
+#define DECL_GFX_ENV_LIVE(Env, Name)  \
+  static bool Name() {                \
+    return IsEnvSet(Env);             \
+  }
+
+#define DECL_GFX_ENV_ONCE(Env, Name)  \
+  static bool Name() {                \
+    static bool isSet = IsEnvSet(Env);\
+    return isSet;                     \
+  }
+
+class gfxEnv final
+{
+public:
+  // This is where DECL_GFX_ENV for each of the environment variables should go.
+  // We will keep these in an alphabetical order by the environment variable,
+  // to make it easier to see if a method accessing an entry already exists.
+  // Just insert yours in the list.
+
+  // Debugging inside of ContainerLayerComposite
+  DECL_GFX_ENV_LIVE("DUMP_DEBUG", DumpDebug);
+
+  // OpenGL shader debugging in OGLShaderProgram, in DEBUG only
+  DECL_GFX_ENV_LIVE("MOZ_DEBUG_SHADERS", DebugShaders);
+
+  // Disabling context sharing in GLContextProviderGLX
+  DECL_GFX_ENV_ONCE("MOZ_DISABLE_CONTEXT_SHARING_GLX", DisableContextSharingGlx);
+
+  // Disabling the crash guard in DriverCrashGuard
+  DECL_GFX_ENV_ONCE("MOZ_DISABLE_CRASH_GUARD", DisableCrashGuard);
+
+  // Together with paint dumping, only when MOZ_DUMP_PAINTING is defined.
+  // Dumping compositor textures is broken pretty badly. For example,
+  // on Linux it crashes TextureHost::GetAsSurface() returns null.
+  // Expect to have to fix things like this if you turn it on.
+  // Meanwhile, content-side texture dumping
+  // (conditioned on DebugDumpPainting()) is a good replacement.
+  DECL_GFX_ENV_ONCE("MOZ_DUMP_COMPOSITOR_TEXTURES", DumpCompositorTextures);
+
+  // Dumping the layer list in LayerSorter
+  DECL_GFX_ENV_ONCE("MOZ_DUMP_LAYER_SORT_LIST", DumpLayerSortList);
+
+  // Paint dumping, only when MOZ_DUMP_PAINTING is defined.
+  DECL_GFX_ENV_ONCE("MOZ_DUMP_PAINT", DumpPaint);
+  DECL_GFX_ENV_ONCE("MOZ_DUMP_PAINT_INTERMEDIATE", DumpPaintIntermediate);
+  DECL_GFX_ENV_ONCE("MOZ_DUMP_PAINT_ITEMS", DumpPaintItems);
+  DECL_GFX_ENV_ONCE("MOZ_DUMP_PAINT_TO_FILE", DumpPaintToFile);
+
+  // Force double buffering in ContentClient
+  DECL_GFX_ENV_LIVE("MOZ_FORCE_DOUBLE_BUFFERING", ForceDoubleBuffering);
+
+  // Force gfxDevCrash to use MOZ_CRASH in Beta and Release
+  DECL_GFX_ENV_ONCE("MOZ_GFX_CRASH_MOZ_CRASH", GfxDevCrashMozCrash);
+  // Force gfxDevCrash to use telemetry in Nightly and Aurora
+  DECL_GFX_ENV_ONCE("MOZ_GFX_CRASH_TELEMETRY", GfxDevCrashTelemetry);
+
+  DECL_GFX_ENV_LIVE("MOZ_GFX_VR_NO_DISTORTION", VRNoDistortion);
+
+  // Debugging in GLContext
+  DECL_GFX_ENV_LIVE("MOZ_GL_DEBUG", GlDebug);
+  DECL_GFX_ENV_LIVE("MOZ_GL_DEBUG_VERBOSE", GlDebugVerbose);
+  DECL_GFX_ENV_LIVE("MOZ_GL_DEBUG_ABORT_ON_ERROR", GlDebugAbortOnError);
+
+  // Count GL extensions
+  DECL_GFX_ENV_ONCE("MOZ_GL_DUMP_EXTS", GlDumpExtensions);
+
+  // Very noisy GLContext and GLContextProviderELG
+  DECL_GFX_ENV_ONCE("MOZ_GL_SPEW", GlSpew);
+
+  // Do extra work before and after each GLX call in GLContextProviderGLX 
+  DECL_GFX_ENV_LIVE("MOZ_GLX_DEBUG", GlxDebug);
+
+  // Use X compositing
+  DECL_GFX_ENV_LIVE("MOZ_LAYERS_ENABLE_XLIB_SURFACES", LayersEnableXlibSurfaces);
+
+  // GL compositing on Windows
+  DECL_GFX_ENV_LIVE("MOZ_LAYERS_PREFER_EGL", LayersPreferEGL);
+
+  // Offscreen GL context for main layer manager
+  DECL_GFX_ENV_LIVE("MOZ_LAYERS_PREFER_OFFSCREEN", LayersPreferOffscreen);
+
+  // Stop the VR rendering
+  DECL_GFX_ENV_LIVE("NO_VR_RENDERING", NoVRRendering);
+
+  // WARNING:
+  // Please make sure that you've added your new envvar to the list above in
+  // alphabetical order. Please do not just append it to the end of the list.
+
+private:
+  // Helper function, can be re-used in the other macros
+  static bool IsEnvSet(const char* aName) {
+    char* val = PR_GetEnv(aName);
+    return (val != 0 && *val != '\0');
+  }
+
+  gfxEnv() {};
+  ~gfxEnv() {};
+  gfxEnv(const gfxEnv&) = delete;
+  gfxEnv& operator=(const gfxEnv&) = delete;
+};
+
+#undef DECL_GFX_ENV_LIVE
+#undef DECL_GFX_ENV_ONCE
+
+#endif /* GFX_ENV_H */
diff --git a/gfx/thebes/gfxFT2FontList.cpp b/gfx/thebes/gfxFT2FontList.cpp
index 839c4bede7..a510396c21 100644
--- a/gfx/thebes/gfxFT2FontList.cpp
+++ b/gfx/thebes/gfxFT2FontList.cpp
@@ -10,7 +10,8 @@
 #include "mozilla/dom/ContentChild.h"
 #include "gfxAndroidPlatform.h"
 #include "mozilla/Omnijar.h"
-#include "nsAutoPtr.h"
+#include "mozilla/UniquePtr.h"
+#include "mozilla/UniquePtrExtensions.h"
 #include "nsIInputStream.h"
 #define gfxToolkitPlatform gfxAndroidPlatform
 
@@ -188,9 +189,9 @@ FT2FontEntry::CreateScaledFont(const gfxFontStyle *aStyle)
     cairo_matrix_init_identity(&identityMatrix);
 
     // synthetic oblique by skewing via the font matrix
-    bool needsOblique = !IsItalic() &&
-            (aStyle->style & (NS_FONT_STYLE_ITALIC | NS_FONT_STYLE_OBLIQUE)) &&
-            aStyle->allowSyntheticStyle;
+    bool needsOblique = IsUpright() &&
+                        aStyle->style != NS_FONT_STYLE_NORMAL &&
+                        aStyle->allowSyntheticStyle;
 
     if (needsOblique) {
         cairo_matrix_t style;
@@ -251,7 +252,7 @@ FT2FontEntry*
 FT2FontEntry::CreateFontEntry(const nsAString& aFontName,
                               uint16_t aWeight,
                               int16_t aStretch,
-                              bool aItalic,
+                              uint8_t aStyle,
                               const uint8_t* aFontData,
                               uint32_t aLength)
 {
@@ -277,7 +278,7 @@ FT2FontEntry::CreateFontEntry(const nsAString& aFontName,
         FT2FontEntry::CreateFontEntry(face, nullptr, 0, aFontName,
                                       aFontData);
     if (fe) {
-        fe->mItalic = aItalic;
+        fe->mStyle = aStyle;
         fe->mWeight = aWeight;
         fe->mStretch = aStretch;
         fe->mIsDataUserFont = true;
@@ -323,7 +324,7 @@ FT2FontEntry::CreateFontEntry(const FontListEntry& aFLE)
     fe->mFTFontIndex = aFLE.index();
     fe->mWeight = aFLE.weight();
     fe->mStretch = aFLE.stretch();
-    fe->mItalic = aFLE.italic();
+    fe->mStyle = (aFLE.italic() ? NS_FONT_STYLE_ITALIC : NS_FONT_STYLE_NORMAL);
     return fe;
 }
 
@@ -380,7 +381,8 @@ FT2FontEntry::CreateFontEntry(FT_Face aFace,
                               const uint8_t* aFontData)
 {
     FT2FontEntry *fe = new FT2FontEntry(aName);
-    fe->mItalic = FTFaceIsItalic(aFace);
+    fe->mStyle = (FTFaceIsItalic(aFace) ?
+                  NS_FONT_STYLE_ITALIC : NS_FONT_STYLE_NORMAL);
     fe->mWeight = FTFaceGetWeight(aFace);
     fe->mFilename = aFilename;
     fe->mFTFontIndex = aIndex;
@@ -596,7 +598,7 @@ FT2FontFamily::AddFacesToFontList(InfallibleTArray<FontListEntry>* aFontList,
         aFontList->AppendElement(FontListEntry(Name(), fe->Name(),
                                                fe->mFilename,
                                                fe->Weight(), fe->Stretch(),
-                                               fe->IsItalic(),
+                                               fe->mStyle,
                                                fe->mFTFontIndex,
                                                aVisibility == kHidden));
     }
@@ -1083,12 +1085,12 @@ gfxFT2FontList::AppendFacesFromOmnijarEntry(nsZipArchive* aArchive,
     uint32_t bufSize = item->RealSize();
     // We use fallible allocation here; if there's not enough RAM, we'll simply
     // ignore the bundled fonts and fall back to the device's installed fonts.
-    nsAutoArrayPtr<uint8_t> buf(new (fallible) uint8_t[bufSize]);
+    auto buf = MakeUniqueFallible<uint8_t[]>(bufSize);
     if (!buf) {
         return;
     }
 
-    nsZipCursor cursor(item, aArchive, buf, bufSize);
+    nsZipCursor cursor(item, aArchive, buf.get(), bufSize);
     uint8_t* data = cursor.Copy(&bufSize);
     NS_ASSERTION(data && bufSize == item->RealSize(),
                  "error reading bundled font");
@@ -1099,13 +1101,13 @@ gfxFT2FontList::AppendFacesFromOmnijarEntry(nsZipArchive* aArchive,
     FT_Library ftLibrary = gfxAndroidPlatform::GetPlatform()->GetFTLibrary();
 
     FT_Face dummy;
-    if (FT_Err_Ok != FT_New_Memory_Face(ftLibrary, buf, bufSize, 0, &dummy)) {
+    if (FT_Err_Ok != FT_New_Memory_Face(ftLibrary, buf.get(), bufSize, 0, &dummy)) {
         return;
     }
 
     for (FT_Long i = 0; i < dummy->num_faces; i++) {
         FT_Face face;
-        if (FT_Err_Ok != FT_New_Memory_Face(ftLibrary, buf, bufSize, i, &face)) {
+        if (FT_Err_Ok != FT_New_Memory_Face(ftLibrary, buf.get(), bufSize, i, &face)) {
             continue;
         }
         AddFaceToList(aEntryName, i, kStandard, FT2FontFamily::kVisible,
@@ -1444,7 +1446,7 @@ gfxFontEntry*
 gfxFT2FontList::LookupLocalFont(const nsAString& aFontName,
                                 uint16_t aWeight,
                                 int16_t aStretch,
-                                bool aItalic)
+                                uint8_t aStyle)
 {
     // walk over list of names
     FT2FontEntry* fontEntry = nullptr;
@@ -1501,7 +1503,7 @@ searchDone:
                                       fontEntry->mFTFontIndex,
                                       fontEntry->Name(), nullptr);
     if (fe) {
-        fe->mItalic = aItalic;
+        fe->mStyle = aStyle;
         fe->mWeight = aWeight;
         fe->mStretch = aStretch;
         fe->mIsLocalUserFont = true;
@@ -1530,7 +1532,7 @@ gfxFontEntry*
 gfxFT2FontList::MakePlatformFont(const nsAString& aFontName,
                                  uint16_t aWeight,
                                  int16_t aStretch,
-                                 bool aItalic,
+                                 uint8_t aStyle,
                                  const uint8_t* aFontData,
                                  uint32_t aLength)
 {
@@ -1538,7 +1540,7 @@ gfxFT2FontList::MakePlatformFont(const nsAString& aFontName,
     // but instead pass ownership to the font entry.
     // Deallocation will happen later, when the font face is destroyed.
     return FT2FontEntry::CreateFontEntry(aFontName, aWeight, aStretch,
-                                         aItalic, aFontData, aLength);
+                                         aStyle, aFontData, aLength);
 }
 
 void
diff --git a/gfx/thebes/gfxFT2FontList.h b/gfx/thebes/gfxFT2FontList.h
index ecccf2b12e..c5748a704b 100644
--- a/gfx/thebes/gfxFT2FontList.h
+++ b/gfx/thebes/gfxFT2FontList.h
@@ -42,7 +42,7 @@ public:
     CreateFontEntry(const nsAString& aFontName,
                     uint16_t aWeight,
                     int16_t aStretch,
-                    bool aItalic,
+                    uint8_t aStyle,
                     const uint8_t* aFontData,
                     uint32_t aLength);
 
@@ -125,12 +125,12 @@ public:
     virtual gfxFontEntry* LookupLocalFont(const nsAString& aFontName,
                                           uint16_t aWeight,
                                           int16_t aStretch,
-                                          bool aItalic);
+                                          uint8_t aStyle);
 
     virtual gfxFontEntry* MakePlatformFont(const nsAString& aFontName,
                                            uint16_t aWeight,
                                            int16_t aStretch,
-                                           bool aItalic,
+                                           uint8_t aStyle,
                                            const uint8_t* aFontData,
                                            uint32_t aLength);
 
diff --git a/gfx/thebes/gfxFcPlatformFontList.cpp b/gfx/thebes/gfxFcPlatformFontList.cpp
index 47e070f646..7e005e5dff 100644
--- a/gfx/thebes/gfxFcPlatformFontList.cpp
+++ b/gfx/thebes/gfxFcPlatformFontList.cpp
@@ -60,6 +60,7 @@ ToCharPtr(const FcChar8 *aStr)
 }
 
 FT_Library gfxFcPlatformFontList::sCairoFTLibrary = nullptr;
+
 static cairo_user_data_key_t sFcFontlistUserFontDataKey;
 
 // canonical name ==> first en name or first name if no en name
@@ -255,8 +256,10 @@ gfxFontconfigFontEntry::gfxFontconfigFontEntry(const nsAString& aFaceName,
     if (FcPatternGetInteger(aFontPattern, FC_SLANT, 0, &slant) != FcResultMatch) {
         slant = FC_SLANT_ROMAN;
     }
-    if (slant > 0) {
-        mItalic = true;
+    if (slant == FC_SLANT_OBLIQUE) {
+        mStyle = NS_FONT_STYLE_OBLIQUE;
+    } else if (slant > 0) {
+        mStyle = NS_FONT_STYLE_ITALIC;
     }
 
     // weight
@@ -277,18 +280,36 @@ gfxFontconfigFontEntry::gfxFontconfigFontEntry(const nsAString& aFaceName,
 gfxFontconfigFontEntry::gfxFontconfigFontEntry(const nsAString& aFaceName,
                                                uint16_t aWeight,
                                                int16_t aStretch,
-                                               bool aItalic,
+                                               uint8_t aStyle,
                                                const uint8_t *aData,
                                                FT_Face aFace)
-    : gfxFontEntry(aFaceName), mFontPattern(FcPatternCreate()),
+    : gfxFontEntry(aFaceName),
       mFTFace(aFace), mFTFaceInitialized(true),
       mAspect(0.0), mFontData(aData)
 {
     mWeight = aWeight;
-    mItalic = aItalic;
+    mStyle = aStyle;
     mStretch = aStretch;
     mIsDataUserFont = true;
 
+    // Use fontconfig to fill out the pattern from the FTFace.
+    // The "file" argument cannot be nullptr (in fontconfig-2.6.0 at
+    // least). The dummy file passed here is removed below.
+    //
+    // When fontconfig scans the system fonts, FcConfigGetBlanks(nullptr)
+    // is passed as the "blanks" argument, which provides that unexpectedly
+    // blank glyphs are elided.  Here, however, we pass nullptr for
+    // "blanks", effectively assuming that, if the font has a blank glyph,
+    // then the author intends any associated character to be rendered
+    // blank.
+    mFontPattern = FcFreeTypeQueryFace(mFTFace, ToFcChar8Ptr(""), 0, nullptr);
+    // given that we have a FT_Face, not really sure this is possible...
+    if (!mFontPattern) {
+        mFontPattern = FcPatternCreate();
+    }
+    FcPatternDel(mFontPattern, FC_FILE);
+    FcPatternDel(mFontPattern, FC_INDEX);
+
     // Make a new pattern and store the face in it so that cairo uses
     // that when creating a cairo font face.
     FcPatternAddFTFace(mFontPattern, FC_FT_FACE, mFTFace);
@@ -300,13 +321,13 @@ gfxFontconfigFontEntry::gfxFontconfigFontEntry(const nsAString& aFaceName,
                                                FcPattern* aFontPattern,
                                                uint16_t aWeight,
                                                int16_t aStretch,
-                                               bool aItalic)
+                                               uint8_t aStyle)
         : gfxFontEntry(aFaceName), mFontPattern(aFontPattern),
           mFTFace(nullptr), mFTFaceInitialized(false),
           mAspect(0.0), mFontData(nullptr)
 {
     mWeight = aWeight;
-    mItalic = aItalic;
+    mStyle = aStyle;
     mStretch = aStretch;
     mIsLocalUserFont = true;
 }
@@ -651,9 +672,9 @@ gfxFontconfigFontEntry::CreateScaledFont(FcPattern* aRenderPattern,
     }
 
     // synthetic oblique by skewing via the font matrix
-    bool needsOblique = !IsItalic() &&
-            (aStyle->style & (NS_FONT_STYLE_ITALIC | NS_FONT_STYLE_OBLIQUE)) &&
-            aStyle->allowSyntheticStyle;
+    bool needsOblique = IsUpright() &&
+                        aStyle->style != NS_FONT_STYLE_NORMAL &&
+                        aStyle->allowSyntheticStyle;
 
     if (needsOblique) {
         // disable embedded bitmaps (mimics behavior in 90-synthetic.conf)
@@ -724,6 +745,8 @@ static void ApplyGdkScreenFontOptions(FcPattern *aPattern);
 static void
 PreparePattern(FcPattern* aPattern, bool aIsPrinterFont)
 {
+    FcConfigSubstitute(nullptr, aPattern, FcMatchPattern);
+
     // This gets cairo_font_options_t for the Screen.  We should have
     // different font options for printing (no hinting) but we are not told
     // what we are measuring for.
@@ -822,9 +845,9 @@ gfxFontconfigFontFamily::FindStyleVariations(FontInfoData *aFontInfoData)
     }
 
     // add font entries for each of the faces
-    gfxPlatformFontList *fp = gfxPlatformFontList::PlatformFontList();
     uint32_t numFonts = mFontPatterns.Length();
     NS_ASSERTION(numFonts, "font family containing no faces!!");
+    uint32_t numRegularFaces = 0;
     for (uint32_t i = 0; i < numFonts; i++) {
         FcPattern* face = mFontPatterns[i];
 
@@ -837,13 +860,10 @@ gfxFontconfigFontFamily::FindStyleVariations(FontInfoData *aFontInfoData)
             new gfxFontconfigFontEntry(faceName, face);
         AddFontEntry(fontEntry);
 
-        // add entry to local name lists
-        if (!psname.IsEmpty()) {
-            fp->AddPostscriptName(fontEntry, psname);
-        }
-        NS_ASSERTION(!fullname.IsEmpty(), "empty font fullname");
-        if (!fullname.IsEmpty()) {
-            fp->AddFullname(fontEntry, fullname);
+        if (fontEntry->IsUpright() &&
+            fontEntry->Weight() == NS_FONT_WEIGHT_NORMAL &&
+            fontEntry->Stretch() == NS_FONT_STRETCH_NORMAL) {
+            numRegularFaces++;
         }
 
         if (LOG_FONTLIST_ENABLED()) {
@@ -852,12 +872,19 @@ gfxFontconfigFontFamily::FindStyleVariations(FontInfoData *aFontInfoData)
                  " psname: %s fullname: %s",
                  NS_ConvertUTF16toUTF8(fontEntry->Name()).get(),
                  NS_ConvertUTF16toUTF8(Name()).get(),
-                 fontEntry->IsItalic() ? "italic" : "normal",
+                 (fontEntry->IsItalic()) ?
+                  "italic" : (fontEntry->IsOblique() ? "oblique" : "normal"),
                  fontEntry->Weight(), fontEntry->Stretch(),
                  NS_ConvertUTF16toUTF8(psname).get(),
                  NS_ConvertUTF16toUTF8(fullname).get()));
         }
     }
+
+    // somewhat arbitrary, but define a family with two or more regular
+    // faces as a family for which intra-family fallback should be used
+    if (numRegularFaces > 1) {
+        mCheckForFallbackFaces = true;
+    }
     mFaceNamesInitialized = true;
     mFontPatterns.Clear();
     SetHasStyles(true);
@@ -909,7 +936,10 @@ gfxFontconfigFont::GetGlyphRenderingOptions(const TextRunDrawParams* aRunParams)
 #endif
 
 gfxFcPlatformFontList::gfxFcPlatformFontList()
-    : mLocalNames(64), mGenericMappings(32), mLastConfig(nullptr)
+    : mLocalNames(64)
+    , mGenericMappings(32)
+    , mFcSubstituteCache(64)
+    , mLastConfig(nullptr)
 {
     // if the rescan interval is set, start the timer
     int rescanInterval = FcConfigGetRescanInterval(nullptr);
@@ -949,6 +979,11 @@ gfxFcPlatformFontList::AddFontSetFamilies(FcFontSet* aFontSet)
     // excluding non-scalable fonts such as X11 bitmap fonts, which
     // Chrome Skia/Webkit code does also.
 
+    if (!aFontSet) {
+        NS_WARNING("AddFontSetFamilies called with a null font set.");
+        return;
+    }
+
     FcChar8* lastFamilyName = (FcChar8*)"";
     gfxFontFamily* fontFamily = nullptr;
     nsAutoString familyName;
@@ -1011,11 +1046,11 @@ gfxFcPlatformFontList::AddFontSetFamilies(FcFontSet* aFontSet)
         GetFaceNames(font, familyName, psname, fullname);
         if (!psname.IsEmpty()) {
             ToLowerCase(psname);
-            mLocalNames.Put(psname, fontFamily);
+            mLocalNames.Put(psname, font);
         }
         if (!fullname.IsEmpty()) {
             ToLowerCase(fullname);
-            mLocalNames.Put(fullname, fontFamily);
+            mLocalNames.Put(fullname, font);
         }
     }
 }
@@ -1030,6 +1065,7 @@ gfxFcPlatformFontList::InitFontList()
 
     mLocalNames.Clear();
     mGenericMappings.Clear();
+    mFcSubstituteCache.Clear();
 
     // iterate over available fonts
     FcFontSet* systemFonts = FcConfigGetFonts(nullptr, FcSetSystem);
@@ -1042,6 +1078,7 @@ gfxFcPlatformFontList::InitFontList()
 #endif
 
     mOtherFamilyNamesInitialized = true;
+
     return NS_OK;
 }
 
@@ -1128,7 +1165,7 @@ gfxFcPlatformFontList::GetFontList(nsIAtom *aLangGroup,
         NS_NOTREACHED("unexpected CSS generic font family");
 
     // The first in the list becomes the default in
-    // gFontsDialog.readFontSelection() if the preference-selected font is not
+    // FontBuilder.readFontSelection() if the preference-selected font is not
     // available, so put system configured defaults first.
     if (monospace)
         aListOfFonts.InsertElementAt(0, NS_LITERAL_STRING("monospace"));
@@ -1141,54 +1178,37 @@ gfxFcPlatformFontList::GetFontList(nsIAtom *aLangGroup,
 gfxFontFamily*
 gfxFcPlatformFontList::GetDefaultFont(const gfxFontStyle* aStyle)
 {
-    return FindGenericFamily(NS_LITERAL_STRING("serif"), nsGkAtoms::x_western);
+    // Get the default font by using a fake name to retrieve the first
+    // scalable font that fontconfig suggests for the given language.
+    return FindGenericFamily(NS_LITERAL_STRING("-moz-default"),
+                             aStyle->language);
 }
 
 gfxFontEntry*
 gfxFcPlatformFontList::LookupLocalFont(const nsAString& aFontName,
                                        uint16_t aWeight,
                                        int16_t aStretch,
-                                       bool aItalic)
+                                       uint8_t aStyle)
 {
-    gfxFontEntry* lookup;
+    nsAutoString keyName(aFontName);
+    ToLowerCase(keyName);
 
-    // first, lookup in face name lists
-    lookup = FindFaceName(aFontName);
-    if (!lookup) {
-        // if not found, check in global facename ==> family list
-        nsAutoString keyName(aFontName);
-        ToLowerCase(keyName);
-        gfxFontFamily* fontFamily = mLocalNames.GetWeak(keyName);
-
-        // name is not in the global list, done
-        if (!fontFamily) {
-            return nullptr;
-        }
-
-        // name is in global list but family needs enumeration
-        fontFamily->FindStyleVariations();
-
-        // facename ==> font entry should now be in the list
-        lookup = FindFaceName(aFontName);
-        NS_ASSERTION(lookup, "facename to family mapping failure");
-        if (!lookup) {
-            return nullptr;
-        }
+    // if name is not in the global list, done
+    FcPattern* fontPattern = mLocalNames.Get(keyName);
+    if (!fontPattern) {
+        return nullptr;
     }
 
-    gfxFontconfigFontEntry* fcFontEntry =
-        static_cast<gfxFontconfigFontEntry*>(lookup);
-
-    return new gfxFontconfigFontEntry(fcFontEntry->Name(),
-                                      fcFontEntry->GetPattern(),
-                                      aWeight, aStretch, aItalic);
+    return new gfxFontconfigFontEntry(aFontName,
+                                      fontPattern,
+                                      aWeight, aStretch, aStyle);
 }
 
 gfxFontEntry*
 gfxFcPlatformFontList::MakePlatformFont(const nsAString& aFontName,
                                         uint16_t aWeight,
                                         int16_t aStretch,
-                                        bool aItalic,
+                                        uint8_t aStyle,
                                         const uint8_t* aFontData,
                                         uint32_t aLength)
 {
@@ -1206,17 +1226,16 @@ gfxFcPlatformFontList::MakePlatformFont(const nsAString& aFontName,
         return nullptr;
     }
 
-    return new gfxFontconfigFontEntry(aFontName, aWeight, aStretch, aItalic,
-                                      aFontData, face);
+    return new gfxFontconfigFontEntry(aFontName, aWeight, aStretch,
+                                      aStyle, aFontData, face);
 }
 
 gfxFontFamily*
-gfxFcPlatformFontList::FindFamily(const nsAString& aFamily,
-                                  nsIAtom* aLanguage,
-                                  bool aUseSystemFonts)
+gfxFcPlatformFontList::FindFamily(const nsAString& aFamily, gfxFontStyle* aStyle)
 {
     nsAutoString familyName(aFamily);
     ToLowerCase(familyName);
+    nsIAtom* language = (aStyle ? aStyle->language.get() : nullptr);
 
     // deprecated generic names are explicitly converted to standard generics
     bool isDeprecatedGeneric = false;
@@ -1232,7 +1251,7 @@ gfxFcPlatformFontList::FindFamily(const nsAString& aFamily,
     // fontconfig generics? use fontconfig to determine the family for lang
     if (isDeprecatedGeneric ||
         mozilla::FontFamilyName::Convert(familyName).IsGeneric()) {
-        return FindGenericFamily(familyName, aLanguage);
+        return FindGenericFamily(familyName, language);
     }
 
     // fontconfig allows conditional substitutions in such a way that it's
@@ -1249,22 +1268,29 @@ gfxFcPlatformFontList::FindFamily(const nsAString& aFamily,
     // In this case fontconfig is including Tex Gyre Heros and
     // Nimbus Sans L as alternatives for Helvetica.
 
-    // substitutions for serif pattern
+    // Because the FcConfigSubstitute call is quite expensive, we cache the
+    // actual font family found via this process. So check the cache first:
+    NS_ConvertUTF16toUTF8 familyToFind(familyName);
+    gfxFontFamily* cached = mFcSubstituteCache.GetWeak(familyToFind);
+    if (cached) {
+        return cached;
+    }
+
     const FcChar8* kSentinelName = ToFcChar8Ptr("-moz-sentinel");
+    FcChar8* sentinelFirstFamily = nullptr;
     nsAutoRef<FcPattern> sentinelSubst(FcPatternCreate());
     FcPatternAddString(sentinelSubst, FC_FAMILY, kSentinelName);
     FcConfigSubstitute(nullptr, sentinelSubst, FcMatchPattern);
-    FcChar8* sentinelFirstFamily = nullptr;
     FcPatternGetString(sentinelSubst, FC_FAMILY, 0, &sentinelFirstFamily);
 
     // substitutions for font, -moz-sentinel pattern
     nsAutoRef<FcPattern> fontWithSentinel(FcPatternCreate());
-    NS_ConvertUTF16toUTF8 familyToFind(familyName);
-    FcPatternAddString(fontWithSentinel, FC_FAMILY, ToFcChar8Ptr(familyToFind.get()));
+    FcPatternAddString(fontWithSentinel, FC_FAMILY,
+                       ToFcChar8Ptr(familyToFind.get()));
     FcPatternAddString(fontWithSentinel, FC_FAMILY, kSentinelName);
     FcConfigSubstitute(nullptr, fontWithSentinel, FcMatchPattern);
 
-    // iterate through substitutions until hitting the first serif font
+    // iterate through substitutions until hitting the sentinel
     FcChar8* substName = nullptr;
     for (int i = 0;
          FcPatternGetString(fontWithSentinel, FC_FAMILY,
@@ -1272,11 +1298,15 @@ gfxFcPlatformFontList::FindFamily(const nsAString& aFamily,
          i++)
     {
         NS_ConvertUTF8toUTF16 subst(ToCharPtr(substName));
-        if (sentinelFirstFamily && FcStrCmp(substName, sentinelFirstFamily) == 0) {
+        if (sentinelFirstFamily &&
+            FcStrCmp(substName, sentinelFirstFamily) == 0) {
             break;
         }
         gfxFontFamily* foundFamily = gfxPlatformFontList::FindFamily(subst);
         if (foundFamily) {
+            // We've figured out what family the given name maps to, after any
+            // fontconfig subsitutions. Cache it to speed up future lookups.
+            mFcSubstituteCache.Put(familyToFind, foundFamily);
             return foundFamily;
         }
     }
@@ -1370,6 +1400,9 @@ gfxFcPlatformFontList::FindGenericFamily(const nsAString& aGeneric,
     FcPatternAddString(genericPattern, FC_FAMILY,
                        ToFcChar8Ptr(generic.get()));
 
+    // -- prefer scalable fonts
+    FcPatternAddBool(genericPattern, FC_SCALABLE, FcTrue);
+
     // -- add the lang to the pattern
     if (!fcLang.IsEmpty()) {
         FcPatternAddString(genericPattern, FC_LANG,
@@ -1385,6 +1418,10 @@ gfxFcPlatformFontList::FindGenericFamily(const nsAString& aGeneric,
     nsAutoRef<FcFontSet> faces(FcFontSort(nullptr, genericPattern, FcFalse,
                                           nullptr, &result));
 
+    if (!faces) {
+      return nullptr;
+    }
+
     // -- pick the first font for which a font family exists
     for (int i = 0; i < faces->nfont; i++) {
         FcPattern* font = faces->fonts[i];
diff --git a/gfx/thebes/gfxFcPlatformFontList.h b/gfx/thebes/gfxFcPlatformFontList.h
index 73f0122686..4f5ec324a0 100644
--- a/gfx/thebes/gfxFcPlatformFontList.h
+++ b/gfx/thebes/gfxFcPlatformFontList.h
@@ -99,7 +99,7 @@ public:
     explicit gfxFontconfigFontEntry(const nsAString& aFaceName,
                                     uint16_t aWeight,
                                     int16_t aStretch,
-                                    bool aItalic,
+                                    uint8_t aStyle,
                                     const uint8_t *aData,
                                     FT_Face aFace);
 
@@ -108,7 +108,7 @@ public:
                                     FcPattern* aFontPattern,
                                     uint16_t aWeight,
                                     int16_t aStretch,
-                                    bool aItalic);
+                                    uint8_t aStyle);
 
     FcPattern* GetPattern() { return mFontPattern; }
 
@@ -209,17 +209,17 @@ public:
 
     gfxFontEntry*
     LookupLocalFont(const nsAString& aFontName, uint16_t aWeight,
-                    int16_t aStretch, bool aItalic) override;
+                    int16_t aStretch, uint8_t aStyle) override;
 
     gfxFontEntry*
     MakePlatformFont(const nsAString& aFontName, uint16_t aWeight,
-                     int16_t aStretch, bool aItalic,
+                     int16_t aStretch,
+                     uint8_t aStyle,
                      const uint8_t* aFontData,
                      uint32_t aLength) override;
 
     gfxFontFamily* FindFamily(const nsAString& aFamily,
-                              nsIAtom* aLanguage = nullptr,
-                              bool aUseSystemFonts = false) override;
+                              gfxFontStyle* aStyle = nullptr) override;
 
     bool GetStandardFamilyName(const nsAString& aFontName,
                                nsAString& aFamilyName) override;
@@ -249,11 +249,16 @@ protected:
 
     // to avoid enumerating all fonts, maintain a mapping of local font
     // names to family
-    nsRefPtrHashtable<nsStringHashKey, gfxFontFamily> mLocalNames;
+    nsBaseHashtable<nsStringHashKey,
+                    nsCountedRef<FcPattern>,
+                    FcPattern*> mLocalNames;
 
     // caching generic/lang ==> font family
     nsRefPtrHashtable<nsCStringHashKey, gfxFontFamily> mGenericMappings;
 
+    // caching family lookups as found by FindFamily after resolving substitutions
+    nsRefPtrHashtable<nsCStringHashKey, gfxFontFamily> mFcSubstituteCache;
+
     nsCOMPtr<nsITimer> mCheckFontUpdatesTimer;
     nsCountedRef<FcConfig> mLastConfig;
 
diff --git a/gfx/thebes/gfxFont.cpp b/gfx/thebes/gfxFont.cpp
index 0b2aaa17c0..bee6f60e48 100644
--- a/gfx/thebes/gfxFont.cpp
+++ b/gfx/thebes/gfxFont.cpp
@@ -2283,7 +2283,9 @@ gfxFont::Measure(gfxTextRun *aTextRun,
     // If the font may be rendered with a fake-italic effect, we need to allow
     // for the top-right of the glyphs being skewed to the right, and the
     // bottom-left being skewed further left.
-    if (mStyle.style != NS_FONT_STYLE_NORMAL && !mFontEntry->IsItalic()) {
+    if (mStyle.style != NS_FONT_STYLE_NORMAL &&
+        mFontEntry->IsUpright() &&
+        mStyle.allowSyntheticStyle) {
         gfxFloat extendLeftEdge =
             ceil(OBLIQUE_SKEW_FACTOR * metrics.mBoundingBox.YMost());
         gfxFloat extendRightEdge =
diff --git a/gfx/thebes/gfxFontEntry.cpp b/gfx/thebes/gfxFontEntry.cpp
index 0ae9184ecf..44854dae43 100644
--- a/gfx/thebes/gfxFontEntry.cpp
+++ b/gfx/thebes/gfxFontEntry.cpp
@@ -68,7 +68,7 @@ gfxCharacterMap::NotifyReleased()
 }
 
 gfxFontEntry::gfxFontEntry() :
-    mItalic(false), mFixedPitch(false),
+    mStyle(NS_FONT_STYLE_NORMAL), mFixedPitch(false),
     mIsValid(true),
     mIsBadUnderlineFont(false),
     mIsUserFontContainer(false),
@@ -108,7 +108,7 @@ gfxFontEntry::gfxFontEntry() :
 }
 
 gfxFontEntry::gfxFontEntry(const nsAString& aName, bool aIsStandardFace) :
-    mName(aName), mItalic(false), mFixedPitch(false),
+    mName(aName), mStyle(NS_FONT_STYLE_NORMAL), mFixedPitch(false),
     mIsValid(true),
     mIsBadUnderlineFont(false),
     mIsUserFontContainer(false),
@@ -211,7 +211,7 @@ nsresult gfxFontEntry::InitializeUVSMap()
             return NS_ERROR_FAILURE;
         }
 
-        uint8_t* uvsData;
+        UniquePtr<uint8_t[]> uvsData;
         unsigned int cmapLen;
         const char* cmapData = hb_blob_get_data(cmapTable, &cmapLen);
         nsresult rv = gfxFontUtils::ReadCMAPTableFormat14(
@@ -223,7 +223,7 @@ nsresult gfxFontEntry::InitializeUVSMap()
             return rv;
         }
 
-        mUVSData = uvsData;
+        mUVSData = Move(uvsData);
     }
 
     return NS_OK;
@@ -234,7 +234,7 @@ uint16_t gfxFontEntry::GetUVSGlyph(uint32_t aCh, uint32_t aVS)
     InitializeUVSMap();
 
     if (mUVSData) {
-        return gfxFontUtils::MapUVSToGlyphFormat14(mUVSData, aCh, aVS);
+        return gfxFontUtils::MapUVSToGlyphFormat14(mUVSData.get(), aCh, aVS);
     }
 
     return 0;
@@ -1115,15 +1115,15 @@ gfxFontEntry::AddSizeOfIncludingThis(MallocSizeOf aMallocSizeOf,
 //
 //////////////////////////////////////////////////////////////////////////////
 
-// we consider faces with mStandardFace == true to be "greater than" those with false,
-// because during style matching, later entries will replace earlier ones
+// we consider faces with mStandardFace == true to be "less than" those with false,
+// because during style matching, earlier entries are tried first
 class FontEntryStandardFaceComparator {
   public:
     bool Equals(const RefPtr<gfxFontEntry>& a, const RefPtr<gfxFontEntry>& b) const {
         return a->mStandardFace == b->mStandardFace;
     }
     bool LessThan(const RefPtr<gfxFontEntry>& a, const RefPtr<gfxFontEntry>& b) const {
-        return (a->mStandardFace == false && b->mStandardFace == true);
+        return (a->mStandardFace == true && b->mStandardFace == false);
     }
 };
 
@@ -1155,57 +1155,69 @@ gfxFontFamily::FindFontForStyle(const gfxFontStyle& aFontStyle,
     return nullptr;
 }
 
-static inline uint32_t
-StyleStretchDistance(gfxFontEntry *aFontEntry, bool aTargetItalic,
-                     int16_t aTargetStretch)
-{
-    // Compute a measure of the "distance" between the requested style
-    // and the given fontEntry,
-    // considering italicness and font-stretch but not weight.
+#define STYLE_SHIFT 2 // number of bits to contain style distance
 
+// style distance ==> [0,2]
+static inline uint32_t
+StyleDistance(uint32_t aFontStyle, uint32_t aTargetStyle)
+{
+    if (aFontStyle == aTargetStyle) {
+        return 0; // styles match exactly ==> 0
+    }
+    if (aFontStyle == NS_FONT_STYLE_NORMAL ||
+        aTargetStyle == NS_FONT_STYLE_NORMAL) {
+        return 2; // one is normal (but not the other) ==> 2
+    }
+    return 1; // neither is normal; must be italic vs oblique ==> 1
+}
+
+#define REVERSE_STRETCH_DISTANCE 5
+
+// stretch distance ==> [0,13]
+static inline uint32_t
+StretchDistance(int16_t aFontStretch, int16_t aTargetStretch)
+{
     int32_t distance = 0;
-    if (aTargetStretch != aFontEntry->mStretch) {
+    if (aTargetStretch != aFontStretch) {
         // stretch values are in the range -4 .. +4
         // if aTargetStretch is positive, we prefer more-positive values;
         // if zero or negative, prefer more-negative
         if (aTargetStretch > 0) {
-            distance = (aFontEntry->mStretch - aTargetStretch) * 2;
+            distance = (aFontStretch - aTargetStretch);
         } else {
-            distance = (aTargetStretch - aFontEntry->mStretch) * 2;
+            distance = (aTargetStretch - aFontStretch);
         }
         // if the computed "distance" here is negative, it means that
         // aFontEntry lies in the "non-preferred" direction from aTargetStretch,
         // so we treat that as larger than any preferred-direction distance
-        // (max possible is 8) by adding an extra 10 to the absolute value
+        // (max possible is 4) by adding an extra 5 to the absolute value
         if (distance < 0) {
-            distance = -distance + 10;
+            distance = -distance + REVERSE_STRETCH_DISTANCE;
         }
     }
-    if (aFontEntry->IsItalic() != aTargetItalic) {
-        distance += 1;
-    }
     return uint32_t(distance);
 }
 
-#define NON_DESIRED_DIRECTION_DISTANCE 1000
-#define MAX_WEIGHT_DISTANCE            2000
-
 // CSS currently limits font weights to multiples of 100 but the weight
 // matching code below does not assume this.
 //
-// Calculate weight values with range (0..1000). In general, heavier weights
-// match towards even heavier weights while lighter weights match towards even
-// lighter weights. Target weight values in the range [400..500] are special,
-// since they will first match up to 500, then down to 0, then up again
-// towards 999.
+// Calculate weight distance with values in the range (0..1000). In general,
+// heavier weights match towards even heavier weights while lighter weights
+// match towards even lighter weights. Target weight values in the range
+// [400..500] are special, since they will first match up to 500, then down
+// towards 0, then up again towards 999.
 //
 // Example: with target 600 and font weight 800, distance will be 200. With
-// target 300 and font weight 600, distance will be 1300, since heavier weights
-// are farther away than lighter weights. If the target is 5 and the font weight
-// 995, the distance would be 1990 for the same reason.
+// target 300 and font weight 600, distance will be 900, since heavier
+// weights are farther away than lighter weights. If the target is 5 and the
+// font weight 995, the distance would be 1590 for the same reason.
 
+#define REVERSE_WEIGHT_DISTANCE 600
+#define WEIGHT_SHIFT             11 // number of bits to contain weight distance
+
+// weight distance ==> [0,1598]
 static inline uint32_t
-WeightDistance(uint32_t aTargetWeight, uint32_t aFontWeight)
+WeightDistance(uint32_t aFontWeight, uint32_t aTargetWeight)
 {
     // Compute a measure of the "distance" between the requested
     // weight and the given fontEntry
@@ -1235,13 +1247,34 @@ WeightDistance(uint32_t aTargetWeight, uint32_t aFontWeight)
             }
         }
         if (distance < 0) {
-            distance = -distance + NON_DESIRED_DIRECTION_DISTANCE;
+            distance = -distance + REVERSE_WEIGHT_DISTANCE;
         }
         distance += addedDistance;
     }
     return uint32_t(distance);
 }
 
+#define MAX_DISTANCE 0xffffffff
+
+static inline uint32_t
+WeightStyleStretchDistance(gfxFontEntry* aFontEntry,
+                           const gfxFontStyle& aTargetStyle)
+{
+    // weight/style/stretch priority: stretch >> style >> weight
+    uint32_t stretchDist =
+        StretchDistance(aFontEntry->mStretch, aTargetStyle.stretch);
+    uint32_t styleDist = StyleDistance(aFontEntry->mStyle, aTargetStyle.style);
+    uint32_t weightDist =
+        WeightDistance(aFontEntry->Weight(), aTargetStyle.weight);
+
+    NS_ASSERTION(weightDist < (1 << WEIGHT_SHIFT), "weight value out of bounds");
+    NS_ASSERTION(styleDist < (1 << STYLE_SHIFT), "slope value out of bounds");
+
+    return (stretchDist << (STYLE_SHIFT + WEIGHT_SHIFT)) |
+           (styleDist << WEIGHT_SHIFT) |
+           weightDist;
+}
+
 void
 gfxFontFamily::FindAllFontsForStyle(const gfxFontStyle& aFontStyle,
                                     nsTArray<gfxFontEntry*>& aFontEntryList,
@@ -1271,9 +1304,6 @@ gfxFontFamily::FindAllFontsForStyle(const gfxFontStyle& aFontStyle,
         return;
     }
 
-    bool wantItalic = (aFontStyle.style &
-                       (NS_FONT_STYLE_ITALIC | NS_FONT_STYLE_OBLIQUE)) != 0;
-
     // Most families are "simple", having just Regular/Bold/Italic/BoldItalic,
     // or some subset of these. In this case, we have exactly 4 entries in mAvailableFonts,
     // stored in the above order; note that some of the entries may be nullptr.
@@ -1285,6 +1315,7 @@ gfxFontFamily::FindAllFontsForStyle(const gfxFontStyle& aFontStyle,
         // Family has no more than the "standard" 4 faces, at fixed indexes;
         // calculate which one we want.
         // Note that we cannot simply return it as not all 4 faces are necessarily present.
+        bool wantItalic = (aFontStyle.style != NS_FONT_STYLE_NORMAL);
         uint8_t faceIndex = (wantItalic ? kItalicMask : 0) |
                             (wantBold ? kBoldMask : 0);
 
@@ -1332,16 +1363,14 @@ gfxFontFamily::FindAllFontsForStyle(const gfxFontStyle& aFontStyle,
     // weight/style/stretch combination, only the last matched font entry will
     // be added.
 
-    uint32_t minDistance = 0xffffffff;
+    uint32_t minDistance = MAX_DISTANCE;
     gfxFontEntry* matched = nullptr;
     // iterate in forward order so that faces like 'Bold' are matched before
     // matching style distance faces such as 'Bold Outline' (see bug 1185812)
     for (uint32_t i = 0; i < count; i++) {
         fe = mAvailableFonts[i];
-        uint32_t distance =
-            WeightDistance(aFontStyle.weight, fe->Weight()) +
-            (StyleStretchDistance(fe, wantItalic, aFontStyle.stretch) *
-             MAX_WEIGHT_DISTANCE);
+        // weight/style/stretch priority: stretch >> style >> weight
+        uint32_t distance = WeightStyleStretchDistance(fe, aFontStyle);
         if (distance < minDistance) {
             matched = fe;
             if (!aFontEntryList.IsEmpty()) {
@@ -1391,8 +1420,9 @@ gfxFontFamily::CheckForSimpleFamily()
     gfxFontEntry *faces[4] = { 0 };
     for (uint8_t i = 0; i < count; ++i) {
         gfxFontEntry *fe = mAvailableFonts[i];
-        if (fe->Stretch() != firstStretch) {
-            return; // font-stretch doesn't match, don't treat as simple family
+        if (fe->Stretch() != firstStretch || fe->IsOblique()) {
+            // simple families don't have varying font-stretch or oblique
+            return;
         }
         uint8_t faceIndex = (fe->IsItalic() ? kItalicMask : 0) |
                             (fe->Weight() >= 600 ? kBoldMask : 0);
@@ -1448,9 +1478,8 @@ CalcStyleMatch(gfxFontEntry *aFontEntry, const gfxFontStyle *aStyle)
     int32_t rank = 0;
     if (aStyle) {
          // italics
-         bool wantItalic =
-             (aStyle->style & (NS_FONT_STYLE_ITALIC | NS_FONT_STYLE_OBLIQUE)) != 0;
-         if (aFontEntry->IsItalic() == wantItalic) {
+         bool wantUpright = (aStyle->style == NS_FONT_STYLE_NORMAL);
+         if (aFontEntry->IsUpright() == wantUpright) {
              rank += 10;
          }
 
@@ -1458,7 +1487,7 @@ CalcStyleMatch(gfxFontEntry *aFontEntry, const gfxFontStyle *aStyle)
         rank += 9 - DeprecatedAbs(aFontEntry->Weight() / 100 - aStyle->ComputeWeight());
     } else {
         // if no font to match, prefer non-bold, non-italic fonts
-        if (!aFontEntry->IsItalic()) {
+        if (aFontEntry->IsUpright()) {
             rank += 3;
         }
         if (!aFontEntry->IsBold()) {
diff --git a/gfx/thebes/gfxFontEntry.h b/gfx/thebes/gfxFontEntry.h
index c1e1a365d5..392ff720da 100644
--- a/gfx/thebes/gfxFontEntry.h
+++ b/gfx/thebes/gfxFontEntry.h
@@ -8,6 +8,7 @@
 
 #include "gfxTypes.h"
 #include "nsString.h"
+#include "gfxFontConstants.h"
 #include "gfxFontFeatures.h"
 #include "gfxFontUtils.h"
 #include "nsTArray.h"
@@ -19,6 +20,7 @@
 #include "nsDataHashtable.h"
 #include "harfbuzz/hb.h"
 #include "mozilla/gfx/2D.h"
+#include "mozilla/UniquePtr.h"
 
 typedef struct gr_face gr_face;
 
@@ -121,7 +123,9 @@ public:
     bool IsUserFont() const { return mIsDataUserFont || mIsLocalUserFont; }
     bool IsLocalUserFont() const { return mIsLocalUserFont; }
     bool IsFixedPitch() const { return mFixedPitch; }
-    bool IsItalic() const { return mItalic; }
+    bool IsItalic() const { return mStyle == NS_FONT_STYLE_ITALIC; }
+    bool IsOblique() const { return mStyle == NS_FONT_STYLE_OBLIQUE; }
+    bool IsUpright() const { return mStyle == NS_FONT_STYLE_NORMAL; }
     bool IsBold() const { return mWeight >= 600; } // bold == weights 600 and above
     bool IgnoreGDEF() const { return mIgnoreGDEF; }
     bool IgnoreGSUB() const { return mIgnoreGSUB; }
@@ -388,7 +392,7 @@ public:
     nsString         mName;
     nsString         mFamilyName;
 
-    bool             mItalic      : 1;
+    uint8_t          mStyle       : 2; // italic/oblique
     bool             mFixedPitch  : 1;
     bool             mIsValid     : 1;
     bool             mIsBadUnderlineFont : 1;
@@ -426,7 +430,7 @@ public:
 
     RefPtr<gfxCharacterMap> mCharacterMap;
     uint32_t         mUVSOffset;
-    nsAutoArrayPtr<uint8_t> mUVSData;
+    mozilla::UniquePtr<uint8_t[]> mUVSData;
     nsAutoPtr<gfxUserFontData> mUserFontData;
     nsAutoPtr<gfxSVGGlyphs> mSVGGlyphs;
     // list of gfxFonts that are using SVG glyphs
@@ -660,7 +664,8 @@ public:
         mIsSimpleFamily(false),
         mIsBadUnderlineFamily(false),
         mFamilyCharacterMapInitialized(false),
-        mSkipDefaultFeatureSpaceCheck(false)
+        mSkipDefaultFeatureSpaceCheck(false),
+        mCheckForFallbackFaces(false)
         { }
 
     const nsString& Name() { return mName; }
@@ -764,6 +769,7 @@ public:
     }
 
     bool IsBadUnderlineFamily() const { return mIsBadUnderlineFamily; }
+    bool CheckForFallbackFaces() const { return mCheckForFallbackFaces; }
 
     // sort available fonts to put preferred (standard) faces towards the end
     void SortAvailableFonts();
@@ -819,6 +825,7 @@ protected:
     bool mIsBadUnderlineFamily : 1;
     bool mFamilyCharacterMapInitialized : 1;
     bool mSkipDefaultFeatureSpaceCheck : 1;
+    bool mCheckForFallbackFaces : 1;  // check other faces for character
 
     enum {
         // for "simple" families, the faces are stored in mAvailableFonts
diff --git a/gfx/thebes/gfxFontUtils.cpp b/gfx/thebes/gfxFontUtils.cpp
index 5bfdd58e88..6b7b0ef9fb 100644
--- a/gfx/thebes/gfxFontUtils.cpp
+++ b/gfx/thebes/gfxFontUtils.cpp
@@ -289,7 +289,7 @@ gfxFontUtils::ReadCMAPTableFormat4(const uint8_t *aBuf, uint32_t aLength,
 
 nsresult
 gfxFontUtils::ReadCMAPTableFormat14(const uint8_t *aBuf, uint32_t aLength,
-                                    uint8_t*& aTable)
+                                    UniquePtr<uint8_t[]>& aTable)
 {
     enum {
         OffsetFormat = 0,
@@ -371,8 +371,8 @@ gfxFontUtils::ReadCMAPTableFormat14(const uint8_t *aBuf, uint32_t aLength,
         }
     }
 
-    aTable = new uint8_t[tablelen];
-    memcpy(aTable, aBuf, tablelen);
+    aTable = MakeUnique<uint8_t[]>(tablelen);
+    memcpy(aTable.get(), aBuf, tablelen);
 
     return NS_OK;
 }
diff --git a/gfx/thebes/gfxFontUtils.h b/gfx/thebes/gfxFontUtils.h
index dba58fb893..58b4da8d08 100644
--- a/gfx/thebes/gfxFontUtils.h
+++ b/gfx/thebes/gfxFontUtils.h
@@ -13,6 +13,7 @@
 #include "mozilla/Likely.h"
 #include "mozilla/Endian.h"
 #include "mozilla/MemoryReporting.h"
+#include "mozilla/UniquePtr.h"
 
 #include "zlib.h"
 #include <algorithm>
@@ -787,7 +788,7 @@ public:
 
     static nsresult
     ReadCMAPTableFormat14(const uint8_t *aBuf, uint32_t aLength, 
-                          uint8_t*& aTable);
+                          mozilla::UniquePtr<uint8_t[]>& aTable);
 
     static uint32_t
     FindPreferredSubtable(const uint8_t *aBuf, uint32_t aBufLength,
diff --git a/gfx/thebes/gfxFontconfigFonts.cpp b/gfx/thebes/gfxFontconfigFonts.cpp
index 7fd8526838..2943a0e386 100644
--- a/gfx/thebes/gfxFontconfigFonts.cpp
+++ b/gfx/thebes/gfxFontconfigFonts.cpp
@@ -335,10 +335,10 @@ protected:
     explicit gfxUserFcFontEntry(const nsAString& aFontName,
                        uint16_t aWeight,
                        int16_t aStretch,
-                       bool aItalic)
+                       uint8_t aStyle)
         : gfxFcFontEntry(aFontName)
     {
-        mItalic = aItalic;
+        mStyle = aStyle;
         mWeight = aWeight;
         mStretch = aStretch;
     }
@@ -421,9 +421,9 @@ public:
     gfxLocalFcFontEntry(const nsAString& aFontName,
                         uint16_t aWeight,
                         int16_t aStretch,
-                        bool aItalic,
+                        uint8_t aStyle,
                         const nsTArray< nsCountedRef<FcPattern> >& aPatterns)
-        : gfxUserFcFontEntry(aFontName, aWeight, aStretch, aItalic)
+        : gfxUserFcFontEntry(aFontName, aWeight, aStretch, aStyle)
     {
         if (!mPatterns.SetCapacity(aPatterns.Length(), fallible))
             return; // OOM
@@ -458,9 +458,9 @@ public:
     gfxDownloadedFcFontEntry(const nsAString& aFontName,
                              uint16_t aWeight,
                              int16_t aStretch,
-                             bool aItalic,
+                             uint8_t aStyle,
                              const uint8_t *aData, FT_Face aFace)
-        : gfxUserFcFontEntry(aFontName, aWeight, aStretch, aItalic),
+        : gfxUserFcFontEntry(aFontName, aWeight, aStretch, aStyle),
           mFontData(aData), mFace(aFace)
     {
         NS_PRECONDITION(aFace != nullptr, "aFace is NULL!");
@@ -1748,7 +1748,7 @@ gfxPangoFontGroup::Shutdown()
 gfxPangoFontGroup::NewFontEntry(const nsAString& aFontName,
                                 uint16_t aWeight,
                                 int16_t aStretch,
-                                bool aItalic)
+                                uint8_t aStyle)
 {
     gfxFontconfigUtils *utils = gfxFontconfigUtils::GetFontconfigUtils();
     if (!utils)
@@ -1791,7 +1791,7 @@ gfxPangoFontGroup::NewFontEntry(const nsAString& aFontName,
             return new gfxLocalFcFontEntry(aFontName,
                                            aWeight,
                                            aStretch,
-                                           aItalic,
+                                           aStyle,
                                            fonts);
     }
 
@@ -1833,7 +1833,7 @@ gfxPangoFontGroup::GetFTLibrary()
 gfxPangoFontGroup::NewFontEntry(const nsAString& aFontName,
                                 uint16_t aWeight,
                                 int16_t aStretch,
-                                bool aItalic,
+                                uint8_t aStyle,
                                 const uint8_t* aFontData,
                                 uint32_t aLength)
 {
@@ -1851,7 +1851,7 @@ gfxPangoFontGroup::NewFontEntry(const nsAString& aFontName,
     }
 
     return new gfxDownloadedFcFontEntry(aFontName, aWeight,
-                                        aStretch, aItalic,
+                                        aStretch, aStyle,
                                         aFontData, face);
 }
 
diff --git a/gfx/thebes/gfxFontconfigFonts.h b/gfx/thebes/gfxFontconfigFonts.h
index fe77332e89..0d91a2a24a 100644
--- a/gfx/thebes/gfxFontconfigFonts.h
+++ b/gfx/thebes/gfxFontconfigFonts.h
@@ -45,12 +45,12 @@ public:
     static gfxFontEntry *NewFontEntry(const nsAString& aFontName,
                                       uint16_t aWeight,
                                       int16_t aStretch,
-                                      bool aItalic);
+                                      uint8_t aStyle);
     // Used for @font-face { src: url(); }
     static gfxFontEntry *NewFontEntry(const nsAString& aFontName,
                                       uint16_t aWeight,
                                       int16_t aStretch,
-                                      bool aItalic,
+                                      uint8_t aStyle,
                                       const uint8_t* aFontData,
                                       uint32_t aLength);
 
diff --git a/gfx/thebes/gfxFontconfigUtils.cpp b/gfx/thebes/gfxFontconfigUtils.cpp
index f5d3e9c91d..6b2633bf43 100644
--- a/gfx/thebes/gfxFontconfigUtils.cpp
+++ b/gfx/thebes/gfxFontconfigUtils.cpp
@@ -361,7 +361,7 @@ gfxFontconfigUtils::GetFontList(nsIAtom *aLangGroup,
         NS_NOTREACHED("unexpected CSS generic font family");
 
     // The first in the list becomes the default in
-    // gFontsDialog.readFontSelection() if the preference-selected font is not
+    // FontBuilder.readFontSelection() if the preference-selected font is not
     // available, so put system configured defaults first.
     if (monospace)
         aListOfFonts.InsertElementAt(0, NS_LITERAL_STRING("monospace"));
diff --git a/gfx/thebes/gfxGDIFont.cpp b/gfx/thebes/gfxGDIFont.cpp
index 6e6e708290..89883e3fac 100644
--- a/gfx/thebes/gfxGDIFont.cpp
+++ b/gfx/thebes/gfxGDIFont.cpp
@@ -177,9 +177,8 @@ gfxGDIFont::Initialize()
 
     // Figure out if we want to do synthetic oblique styling.
     GDIFontEntry* fe = static_cast<GDIFontEntry*>(GetFontEntry());
-    bool wantFakeItalic =
-        (mStyle.style & (NS_FONT_STYLE_ITALIC | NS_FONT_STYLE_OBLIQUE)) &&
-        !fe->IsItalic() && mStyle.allowSyntheticStyle;
+    bool wantFakeItalic = mStyle.style != NS_FONT_STYLE_NORMAL &&
+                          fe->IsUpright() && mStyle.allowSyntheticStyle;
 
     // If the font's family has an actual italic face (but font matching
     // didn't choose it), we have to use a cairo transform instead of asking
diff --git a/gfx/thebes/gfxGDIFontList.cpp b/gfx/thebes/gfxGDIFontList.cpp
index 089f67cc39..9be175a996 100644
--- a/gfx/thebes/gfxGDIFontList.cpp
+++ b/gfx/thebes/gfxGDIFontList.cpp
@@ -118,7 +118,8 @@ FontTypeToOutPrecision(uint8_t fontType)
 
 GDIFontEntry::GDIFontEntry(const nsAString& aFaceName,
                            gfxWindowsFontType aFontType,
-                           bool aItalic, uint16_t aWeight, int16_t aStretch,
+                           uint8_t aStyle, uint16_t aWeight,
+                           int16_t aStretch,
                            gfxUserFontData *aUserFontData,
                            bool aFamilyHasItalicFace)
     : gfxFontEntry(aFaceName),
@@ -129,7 +130,7 @@ GDIFontEntry::GDIFontEntry(const nsAString& aFaceName,
       mCharset(), mUnicodeRanges()
 {
     mUserFontData = aUserFontData;
-    mItalic = aItalic;
+    mStyle = aStyle;
     mWeight = aWeight;
     mStretch = aStretch;
     if (IsType1())
@@ -306,9 +307,10 @@ GDIFontEntry::TestCharacterMap(uint32_t aCh)
             return false;
 
         // previous code was using the group style
-        gfxFontStyle fakeStyle;  
-        if (mItalic)
+        gfxFontStyle fakeStyle;
+        if (!IsUpright()) {
             fakeStyle.style = NS_FONT_STYLE_ITALIC;
+        }
         fakeStyle.weight = mWeight * 100;
 
         RefPtr<gfxFont> tempFont = FindOrMakeFont(&fakeStyle, false);
@@ -387,7 +389,7 @@ GDIFontEntry::InitLogFont(const nsAString& aName,
     // do its best to give us an italic font entry, but if no face exists
     // it may give us a regular one based on weight.  Windows should
     // do fake italic for us in that case.
-    mLogFont.lfItalic         = mItalic;
+    mLogFont.lfItalic         = !IsUpright();
     mLogFont.lfWeight         = mWeight;
 
     int len = std::min<int>(aName.Length(), LF_FACESIZE - 1);
@@ -397,14 +399,15 @@ GDIFontEntry::InitLogFont(const nsAString& aName,
 
 GDIFontEntry* 
 GDIFontEntry::CreateFontEntry(const nsAString& aName,
-                              gfxWindowsFontType aFontType, bool aItalic,
+                              gfxWindowsFontType aFontType,
+                              uint8_t aStyle,
                               uint16_t aWeight, int16_t aStretch,
                               gfxUserFontData* aUserFontData,
                               bool aFamilyHasItalicFace)
 {
     // jtdfix - need to set charset, unicode ranges, pitch/family
 
-    GDIFontEntry *fe = new GDIFontEntry(aName, aFontType, aItalic,
+    GDIFontEntry *fe = new GDIFontEntry(aName, aFontType, aStyle,
                                         aWeight, aStretch, aUserFontData,
                                         aFamilyHasItalicFace);
 
@@ -456,7 +459,7 @@ GDIFontFamily::FamilyAddStylesProc(const ENUMLOGFONTEXW *lpelfe,
         fe = static_cast<GDIFontEntry*>(ff->mAvailableFonts[i].get());
         // check if we already know about this face
         if (fe->mWeight == logFont.lfWeight &&
-            fe->mItalic == (logFont.lfItalic == 0xFF)) {
+            fe->IsItalic() == (logFont.lfItalic == 0xFF)) {
             // update the charset bit here since this could be different
             fe->mCharset.set(metrics.tmCharSet);
             return 1; 
@@ -466,8 +469,10 @@ GDIFontFamily::FamilyAddStylesProc(const ENUMLOGFONTEXW *lpelfe,
     // We can't set the hasItalicFace flag correctly here,
     // because we might not have seen the family's italic face(s) yet.
     // So we'll set that flag for all members after loading all the faces.
+    uint8_t italicStyle = (logFont.lfItalic == 0xFF ?
+                           NS_FONT_STYLE_ITALIC : NS_FONT_STYLE_NORMAL);
     fe = GDIFontEntry::CreateFontEntry(nsDependentString(lpelfe->elfFullName),
-                                       feType, (logFont.lfItalic == 0xFF),
+                                       feType, italicStyle,
                                        (uint16_t) (logFont.lfWeight), 0,
                                        nullptr, false);
     if (!fe)
@@ -712,7 +717,7 @@ gfxFontEntry*
 gfxGDIFontList::LookupLocalFont(const nsAString& aFontName,
                                 uint16_t aWeight,
                                 int16_t aStretch,
-                                bool aItalic)
+                                uint8_t aStyle)
 {
     gfxFontEntry *lookup;
 
@@ -729,10 +734,9 @@ gfxGDIFontList::LookupLocalFont(const nsAString& aFontName,
     // 'Arial Vet' which can be used as a key in GDI font lookups).
     GDIFontEntry *fe = GDIFontEntry::CreateFontEntry(lookup->Name(), 
         gfxWindowsFontType(isCFF ? GFX_FONT_TYPE_PS_OPENTYPE : GFX_FONT_TYPE_TRUETYPE) /*type*/, 
-        lookup->mItalic ? NS_FONT_STYLE_ITALIC : NS_FONT_STYLE_NORMAL,
-        lookup->mWeight, aStretch, nullptr,
+        lookup->mStyle, lookup->mWeight, aStretch, nullptr,
         static_cast<GDIFontEntry*>(lookup)->mFamilyHasItalicFace);
-        
+
     if (!fe)
         return nullptr;
 
@@ -740,7 +744,7 @@ gfxGDIFontList::LookupLocalFont(const nsAString& aFontName,
 
     // make the new font entry match the userfont entry style characteristics
     fe->mWeight = (aWeight == 0 ? 400 : aWeight);
-    fe->mItalic = aItalic;
+    fe->mStyle = aStyle;
 
     return fe;
 }
@@ -806,7 +810,7 @@ gfxFontEntry*
 gfxGDIFontList::MakePlatformFont(const nsAString& aFontName,
                                  uint16_t aWeight,
                                  int16_t aStretch,
-                                 bool aItalic,
+                                 uint8_t aStyle,
                                  const uint8_t* aFontData,
                                  uint32_t aLength)
 {
@@ -871,17 +875,16 @@ gfxGDIFontList::MakePlatformFont(const nsAString& aFontName,
     WinUserFontData *winUserFontData = new WinUserFontData(fontRef);
     uint16_t w = (aWeight == 0 ? 400 : aWeight);
 
-    GDIFontEntry *fe = GDIFontEntry::CreateFontEntry(uniqueName, 
-        gfxWindowsFontType(isCFF ? GFX_FONT_TYPE_PS_OPENTYPE : GFX_FONT_TYPE_TRUETYPE) /*type*/, 
-        uint32_t(aItalic ? NS_FONT_STYLE_ITALIC : NS_FONT_STYLE_NORMAL),
-        w, aStretch, winUserFontData, false);
+    GDIFontEntry *fe = GDIFontEntry::CreateFontEntry(uniqueName,
+        gfxWindowsFontType(isCFF ? GFX_FONT_TYPE_PS_OPENTYPE : GFX_FONT_TYPE_TRUETYPE) /*type*/,
+        aStyle, w, aStretch, winUserFontData, false);
 
     if (!fe)
         return fe;
 
     fe->mIsDataUserFont = true;
 
-    // Uniscribe doesn't place CFF fonts loaded privately 
+    // Uniscribe doesn't place CFF fonts loaded privately
     // via AddFontMemResourceEx on XP/Vista
     if (isCFF && !IsWin7OrLater()) {
         fe->mForceGDI = true;
@@ -891,9 +894,7 @@ gfxGDIFontList::MakePlatformFont(const nsAString& aFontName,
 }
 
 gfxFontFamily*
-gfxGDIFontList::FindFamily(const nsAString& aFamily,
-                           nsIAtom* aLanguage,
-                           bool aUseSystemFonts)
+gfxGDIFontList::FindFamily(const nsAString& aFamily, gfxFontStyle* aStyle)
 {
     nsAutoString keyName(aFamily);
     BuildKeyNameFromFontName(keyName);
diff --git a/gfx/thebes/gfxGDIFontList.h b/gfx/thebes/gfxGDIFontList.h
index 0a588deb7e..3f00be6caa 100644
--- a/gfx/thebes/gfxGDIFontList.h
+++ b/gfx/thebes/gfxGDIFontList.h
@@ -240,7 +240,7 @@ public:
     // create a font entry for a font with a given name
     static GDIFontEntry* CreateFontEntry(const nsAString& aName,
                                          gfxWindowsFontType aFontType,
-                                         bool aItalic,
+                                         uint8_t aStyle,
                                          uint16_t aWeight, int16_t aStretch,
                                          gfxUserFontData* aUserFontData,
                                          bool aFamilyHasItalicFace);
@@ -249,7 +249,7 @@ public:
     static GDIFontEntry* LoadLocalFont(const nsAString& aFontName,
                                        uint16_t aWeight,
                                        int16_t aStretch,
-                                       bool aItalic);
+                                       uint8_t aStyle);
 
     uint8_t mWindowsFamily;
     uint8_t mWindowsPitch;
@@ -270,7 +270,7 @@ protected:
     friend class gfxWindowsFont;
 
     GDIFontEntry(const nsAString& aFaceName, gfxWindowsFontType aFontType,
-                 bool aItalic, uint16_t aWeight, int16_t aStretch,
+                 uint8_t aStyle, uint16_t aWeight, int16_t aStretch,
                  gfxUserFontData *aUserFontData, bool aFamilyHasItalicFace);
 
     void InitLogFont(const nsAString& aName, gfxWindowsFontType aFontType);
@@ -309,19 +309,18 @@ public:
 
     virtual gfxFontFamily* GetDefaultFont(const gfxFontStyle* aStyle);
 
-    virtual gfxFontFamily* FindFamily(const nsAString& aFamily,
-                                      nsIAtom* aLanguage = nullptr,
-                                      bool aUseSystemFonts = false);
+    gfxFontFamily* FindFamily(const nsAString& aFamily,
+                              gfxFontStyle* aStyle = nullptr) override;
 
     virtual gfxFontEntry* LookupLocalFont(const nsAString& aFontName,
                                           uint16_t aWeight,
                                           int16_t aStretch,
-                                          bool aItalic);
+                                          uint8_t aStyle);
 
     virtual gfxFontEntry* MakePlatformFont(const nsAString& aFontName,
                                            uint16_t aWeight,
                                            int16_t aStretch,
-                                           bool aItalic,
+                                           uint8_t aStyle,
                                            const uint8_t* aFontData,
                                            uint32_t aLength);
 
diff --git a/gfx/thebes/gfxImageSurface.cpp b/gfx/thebes/gfxImageSurface.cpp
index 013f056e8d..974ecce0a8 100644
--- a/gfx/thebes/gfxImageSurface.cpp
+++ b/gfx/thebes/gfxImageSurface.cpp
@@ -32,7 +32,7 @@ gfxImageSurface::InitFromSurface(cairo_surface_t *csurf)
     mSize.width = cairo_image_surface_get_width(csurf);
     mSize.height = cairo_image_surface_get_height(csurf);
     mData = cairo_image_surface_get_data(csurf);
-    mFormat = (gfxImageFormat) cairo_image_surface_get_format(csurf);
+    mFormat = gfxCairoFormatToImageFormat(cairo_image_surface_get_format(csurf));
     mOwnsData = false;
     mStride = cairo_image_surface_get_stride(csurf);
 
@@ -66,9 +66,10 @@ gfxImageSurface::InitWithData(unsigned char *aData, const IntSize& aSize,
     if (!CheckSurfaceSize(aSize))
         MakeInvalid();
 
+    cairo_format_t cformat = gfxImageFormatToCairoFormat(mFormat);
     cairo_surface_t *surface =
         cairo_image_surface_create_for_data((unsigned char*)mData,
-                                            (cairo_format_t)(int)mFormat,
+                                            cformat,
                                             mSize.width,
                                             mSize.height,
                                             mStride);
@@ -135,9 +136,10 @@ gfxImageSurface::AllocateAndInit(long aStride, int32_t aMinimalAllocation,
 
     mOwnsData = true;
 
+    cairo_format_t cformat = gfxImageFormatToCairoFormat(mFormat);
     cairo_surface_t *surface =
         cairo_image_surface_create_for_data((unsigned char*)mData,
-                                            (cairo_format_t)(int)mFormat,
+                                            cformat,
                                             mSize.width,
                                             mSize.height,
                                             mStride);
@@ -162,7 +164,7 @@ gfxImageSurface::gfxImageSurface(cairo_surface_t *csurf)
     mSize.width = cairo_image_surface_get_width(csurf);
     mSize.height = cairo_image_surface_get_height(csurf);
     mData = cairo_image_surface_get_data(csurf);
-    mFormat = (gfxImageFormat) cairo_image_surface_get_format(csurf);
+    mFormat = gfxCairoFormatToImageFormat(cairo_image_surface_get_format(csurf));
     mOwnsData = false;
     mStride = cairo_image_surface_get_stride(csurf);
 
@@ -188,9 +190,7 @@ gfxImageSurface::ComputeStride(const IntSize& aSize, gfxImageFormat aFormat)
         stride = aSize.width * 2;
     else if (aFormat == gfxImageFormat::A8)
         stride = aSize.width;
-    else if (aFormat == gfxImageFormat::A1) {
-        stride = (aSize.width + 7) / 8;
-    } else {
+    else {
         NS_WARNING("Unknown format specified to gfxImageSurface!");
         stride = aSize.width * 4;
     }
diff --git a/gfx/thebes/gfxMacFont.cpp b/gfx/thebes/gfxMacFont.cpp
index 1e0600c891..239899b010 100644
--- a/gfx/thebes/gfxMacFont.cpp
+++ b/gfx/thebes/gfxMacFont.cpp
@@ -61,11 +61,10 @@ gfxMacFont::gfxMacFont(MacOSFontEntry *aFontEntry, const gfxFontStyle *aFontStyl
     cairo_matrix_init_scale(&sizeMatrix, mAdjustedSize, mAdjustedSize);
 
     // synthetic oblique by skewing via the font matrix
-    bool needsOblique =
-        (mFontEntry != nullptr) &&
-        (!mFontEntry->IsItalic() &&
-         (mStyle.style & (NS_FONT_STYLE_ITALIC | NS_FONT_STYLE_OBLIQUE))) &&
-        mStyle.allowSyntheticStyle;
+    bool needsOblique = mFontEntry != nullptr &&
+                        mFontEntry->IsUpright() &&
+                        mStyle.style != NS_FONT_STYLE_NORMAL &&
+                        mStyle.allowSyntheticStyle;
 
     if (needsOblique) {
         cairo_matrix_t style;
diff --git a/gfx/thebes/gfxMacPlatformFontList.h b/gfx/thebes/gfxMacPlatformFontList.h
index 78d0c2eda4..7804cde413 100644
--- a/gfx/thebes/gfxMacPlatformFontList.h
+++ b/gfx/thebes/gfxMacPlatformFontList.h
@@ -18,6 +18,7 @@
 
 #include "nsUnicharUtils.h"
 #include "nsTArray.h"
+#include "mozilla/LookAndFeel.h"
 
 class gfxMacPlatformFontList;
 
@@ -32,7 +33,7 @@ public:
 
     // for use with data fonts
     MacOSFontEntry(const nsAString& aPostscriptName, CGFontRef aFontRef,
-                   uint16_t aWeight, uint16_t aStretch, uint32_t aItalicStyle,
+                   uint16_t aWeight, uint16_t aStretch, uint8_t aStyle,
                    bool aIsDataUserFont, bool aIsLocal);
 
     virtual ~MacOSFontEntry() {
@@ -67,6 +68,7 @@ protected:
     bool mRequiresAAT;
     bool mIsCFF;
     bool mIsCFFInitialized;
+    nsTHashtable<nsUint32HashKey> mAvailableTables;
 };
 
 class gfxMacPlatformFontList : public gfxPlatformFontList {
@@ -77,21 +79,31 @@ public:
 
     static int32_t AppleWeightToCSSWeight(int32_t aAppleWeight);
 
-    virtual gfxFontFamily* GetDefaultFont(const gfxFontStyle* aStyle);
+    gfxFontFamily* GetDefaultFont(const gfxFontStyle* aStyle) override;
 
-    virtual bool GetStandardFamilyName(const nsAString& aFontName, nsAString& aFamilyName);
+    bool GetStandardFamilyName(const nsAString& aFontName, nsAString& aFamilyName) override;
 
-    virtual gfxFontEntry* LookupLocalFont(const nsAString& aFontName,
-                                          uint16_t aWeight,
-                                          int16_t aStretch,
-                                          bool aItalic);
-    
-    virtual gfxFontEntry* MakePlatformFont(const nsAString& aFontName,
-                                           uint16_t aWeight,
-                                           int16_t aStretch,
-                                           bool aItalic,
-                                           const uint8_t* aFontData,
-                                           uint32_t aLength);
+    gfxFontEntry* LookupLocalFont(const nsAString& aFontName,
+                                  uint16_t aWeight,
+                                  int16_t aStretch,
+                                  uint8_t aStyle) override;
+
+    gfxFontEntry* MakePlatformFont(const nsAString& aFontName,
+                                   uint16_t aWeight,
+                                   int16_t aStretch,
+                                   uint8_t aStyle,
+                                   const uint8_t* aFontData,
+                                   uint32_t aLength) override;
+
+    gfxFontFamily* FindFamily(const nsAString& aFamily,
+                              gfxFontStyle* aStyle = nullptr) override;
+
+    // lookup the system font for a particular system font type and set
+    // the name and style characteristics
+    void LookupSystemFont(mozilla::LookAndFeel::FontID aSystemFontID,
+                          nsAString& aSystemFontName,
+                          gfxFontStyle &aFontStyle,
+                          float aDevPixPerCSSPixel);
 
 private:
     friend class gfxPlatformMac;
@@ -100,11 +112,17 @@ private:
     virtual ~gfxMacPlatformFontList();
 
     // initialize font lists
-    virtual nsresult InitFontList();
+    nsresult InitFontList() override;
 
     // special case font faces treated as font families (set via prefs)
     void InitSingleFaceList();
 
+    // initialize system fonts
+    void InitSystemFonts();
+
+    // helper function to lookup in both hidden system fonts and normal fonts
+    gfxFontFamily* FindSystemFontFamily(const nsAString& aFamily);
+
     static void RegisteredFontsChangedNotificationCallback(CFNotificationCenterRef center,
                                                            void *observer,
                                                            CFStringRef name,
@@ -112,15 +130,22 @@ private:
                                                            CFDictionaryRef userInfo);
 
     // search fonts system-wide for a given character, null otherwise
-    virtual gfxFontEntry* GlobalFontFallback(const uint32_t aCh,
-                                             int32_t aRunScript,
-                                             const gfxFontStyle* aMatchStyle,
-                                             uint32_t& aCmapCount,
-                                             gfxFontFamily** aMatchedFamily);
+    gfxFontEntry* GlobalFontFallback(const uint32_t aCh,
+                                     int32_t aRunScript,
+                                     const gfxFontStyle* aMatchStyle,
+                                     uint32_t& aCmapCount,
+                                     gfxFontFamily** aMatchedFamily) override;
 
-    virtual bool UsesSystemFallback() { return true; }
+    bool UsesSystemFallback() override { return true; }
 
-    virtual already_AddRefed<FontInfoData> CreateFontInfoData();
+    already_AddRefed<FontInfoData> CreateFontInfoData() override;
+
+    // Add the specified family to mSystemFontFamilies or mFontFamilies.
+    // Ideally we'd use NSString* instead of CFStringRef here, but this header
+    // file is included in .cpp files, so we can't use objective C classes here.
+    // But CFStringRef and NSString* are the same thing anyway (they're
+    // toll-free bridged).
+    void AddFamily(CFStringRef aFamily);
 
 #ifdef MOZ_BUNDLED_FONTS
     void ActivateBundledFonts();
@@ -132,6 +157,18 @@ private:
 
     // default font for use with system-wide font fallback
     CTFontRef mDefaultFont;
+
+    // hidden system fonts used within UI elements, there may be a whole set
+    // for different locales (e.g. .Helvetica Neue UI, .SF NS Text)
+    FontFamilyTable mSystemFontFamilies;
+
+    // font families that -apple-system maps to
+    // Pre-10.11 this was always a single font family, such as Lucida Grande
+    // or Helvetica Neue. For OSX 10.11, Apple uses pair of families
+    // for the UI, one for text sizes and another for display sizes
+    bool mUseSizeSensitiveSystemFont;
+    RefPtr<gfxFontFamily> mSystemTextFontFamily;
+    RefPtr<gfxFontFamily> mSystemDisplayFontFamily; // only used on OSX 10.11
 };
 
 #endif /* gfxMacPlatformFontList_H_ */
diff --git a/gfx/thebes/gfxMacPlatformFontList.mm b/gfx/thebes/gfxMacPlatformFontList.mm
index c1ea0411f6..7a4b07f058 100644
--- a/gfx/thebes/gfxMacPlatformFontList.mm
+++ b/gfx/thebes/gfxMacPlatformFontList.mm
@@ -59,6 +59,7 @@
 #include "nsISimpleEnumerator.h"
 #include "nsCharTraits.h"
 #include "nsCocoaFeatures.h"
+#include "nsCocoaUtils.h"
 #include "gfxFontConstants.h"
 
 #include "mozilla/MemoryReporting.h"
@@ -71,20 +72,6 @@
 
 using namespace mozilla;
 
-class nsAutoreleasePool {
-public:
-    nsAutoreleasePool()
-    {
-        mLocalPool = [[NSAutoreleasePool alloc] init];
-    }
-    ~nsAutoreleasePool()
-    {
-        [mLocalPool release];
-    }
-private:
-    NSAutoreleasePool *mLocalPool;
-};
-
 // indexes into the NSArray objects that the Cocoa font manager returns
 // as the available members of a family
 #define INDEX_FONT_POSTSCRIPT_NAME 0
@@ -298,7 +285,7 @@ MacOSFontEntry::MacOSFontEntry(const nsAString& aPostscriptName,
 MacOSFontEntry::MacOSFontEntry(const nsAString& aPostscriptName,
                                CGFontRef aFontRef,
                                uint16_t aWeight, uint16_t aStretch,
-                               uint32_t aItalicStyle,
+                               uint8_t aStyle,
                                bool aIsDataUserFont,
                                bool aIsLocalUserFont)
     : gfxFontEntry(aPostscriptName, false),
@@ -315,7 +302,7 @@ MacOSFontEntry::MacOSFontEntry(const nsAString& aPostscriptName,
     mWeight = aWeight;
     mStretch = aStretch;
     mFixedPitch = false; // xxx - do we need this for downloaded fonts?
-    mItalic = (aItalicStyle & (NS_FONT_STYLE_ITALIC | NS_FONT_STYLE_OBLIQUE)) != 0;
+    mStyle = aStyle;
 
     NS_ASSERTION(!(aIsDataUserFont && aIsLocalUserFont),
                  "userfont is either a data font or a local font");
@@ -392,20 +379,26 @@ MacOSFontEntry::GetFontTable(uint32_t aTag)
 bool
 MacOSFontEntry::HasFontTable(uint32_t aTableTag)
 {
-    nsAutoreleasePool localPool;
+    if (mAvailableTables.Count() == 0) {
+        nsAutoreleasePool localPool;
 
-    CGFontRef fontRef = GetFontRef();
-    if (!fontRef) {
-        return false;
+        CGFontRef fontRef = GetFontRef();
+        if (!fontRef) {
+            return false;
+        }
+        CFArrayRef tags = ::CGFontCopyTableTags(fontRef);
+        if (!tags) {
+            return false;
+        }
+        int numTags = (int) ::CFArrayGetCount(tags);
+        for (int t = 0; t < numTags; t++) {
+            uint32_t tag = (uint32_t)(uintptr_t)::CFArrayGetValueAtIndex(tags, t);
+            mAvailableTables.PutEntry(tag);
+        }
+        ::CFRelease(tags);
     }
 
-    CFDataRef tableData = ::CGFontCopyTableForTag(fontRef, aTableTag);
-    if (!tableData) {
-        return false;
-    }
-
-    ::CFRelease(tableData);
-    return true;
+    return mAvailableTables.GetEntry(aTableTag);
 }
 
 void
@@ -547,7 +540,7 @@ gfxMacFontFamily::FindStyleVariations(FontInfoData *aFontInfoData)
             [facename hasSuffix:@"Italic"] ||
             [facename hasSuffix:@"Oblique"])
         {
-            fontEntry->mItalic = true;
+            fontEntry->mStyle = NS_FONT_STYLE_ITALIC;
         }
         if (macTraits & NSFixedPitchFontMask) {
             fontEntry->mFixedPitch = true;
@@ -576,7 +569,6 @@ gfxMacFontFamily::FindStyleVariations(FontInfoData *aFontInfoData)
     }
 }
 
-
 /* gfxSingleFaceMacFontFamily */
 #pragma mark-
 
@@ -653,7 +645,8 @@ gfxSingleFaceMacFontFamily::ReadOtherFamilyNames(gfxPlatformFontList *aPlatformF
 
 gfxMacPlatformFontList::gfxMacPlatformFontList() :
     gfxPlatformFontList(false),
-    mDefaultFont(nullptr)
+    mDefaultFont(nullptr),
+    mUseSizeSensitiveSystemFont(false)
 {
 #ifdef MOZ_BUNDLED_FONTS
     ActivateBundledFonts();
@@ -669,6 +662,18 @@ gfxMacPlatformFontList::gfxMacPlatformFontList() :
     // cache this in a static variable so that MacOSFontFamily objects
     // don't have to repeatedly look it up
     sFontManager = [NSFontManager sharedFontManager];
+
+#ifdef DEBUG
+    // different system font API's always map to the same family under OSX, so
+    // just assume that and emit a warning if that ever changes
+    NSString *sysFamily = [[NSFont systemFontOfSize:0.0] familyName];
+    if ([sysFamily compare:[[NSFont boldSystemFontOfSize:0.0] familyName]] != NSOrderedSame ||
+        [sysFamily compare:[[NSFont controlContentFontOfSize:0.0] familyName]] != NSOrderedSame ||
+        [sysFamily compare:[[NSFont menuBarFontOfSize:0.0] familyName]] != NSOrderedSame ||
+        [sysFamily compare:[[NSFont toolTipsFontOfSize:0.0] familyName]] != NSOrderedSame) {
+        NS_WARNING("system font types map to different font families -- please log a bug!!");
+    }
+#endif
 }
 
 gfxMacPlatformFontList::~gfxMacPlatformFontList()
@@ -678,6 +683,37 @@ gfxMacPlatformFontList::~gfxMacPlatformFontList()
     }
 }
 
+void
+gfxMacPlatformFontList::AddFamily(CFStringRef aFamily)
+{
+    NSString* family = (NSString*)aFamily;
+
+    // CTFontManager includes weird internal family names and
+    // LastResort, skip over those
+    if (!family || [family caseInsensitiveCompare:@"LastResort"] == NSOrderedSame) {
+        return;
+    }
+
+    bool hiddenSystemFont = [family hasPrefix:@"."];
+
+    FontFamilyTable& table =
+        hiddenSystemFont ? mSystemFontFamilies : mFontFamilies;
+
+    nsAutoString familyName;
+    nsCocoaUtils::GetStringForNSString(family, familyName);
+
+    nsAutoString key;
+    ToLowerCase(familyName, key);
+
+    gfxFontFamily* familyEntry = new gfxMacFontFamily(familyName);
+    table.Put(key, familyEntry);
+
+    // check the bad underline blacklist
+    if (mBadUnderlineFamilyNames.Contains(key)) {
+        familyEntry->SetBadUnderlineFamily();
+    }
+}
+
 nsresult
 gfxMacPlatformFontList::InitFontList()
 {
@@ -693,55 +729,16 @@ gfxMacPlatformFontList::InitFontList()
 
     CFArrayRef familyNames = CTFontManagerCopyAvailableFontFamilyNames();
 
-    // iterate over families
-    uint32_t i, numFamilies;
-
-    numFamilies = CFArrayGetCount(familyNames);
-    for (i = 0; i < numFamilies; i++) {
-        CFStringRef family = (CFStringRef)CFArrayGetValueAtIndex(familyNames, i);
-
-        // CTFontManager includes weird internal family names and
-        // LastResort, skip over those
-        if (!family ||
-            CFStringCompare(family, CFSTR("LastResort"),
-                            kCFCompareCaseInsensitive) == kCFCompareEqualTo) {
-            continue;
-        }
-
-        bool hiddenSystemFont = false;
-        if (::CFStringHasPrefix(family, CFSTR("."))) {
-            hiddenSystemFont = true;
-        }
-
-        nsAutoTArray<UniChar, 1024> buffer;
-        CFIndex len = ::CFStringGetLength(family);
-        buffer.SetLength(len+1);
-        ::CFStringGetCharacters(family, ::CFRangeMake(0, len),
-                                buffer.Elements());
-        buffer[len] = 0;
-        nsAutoString familyName(reinterpret_cast<char16_t*>(buffer.Elements()), len);
-
-        // create a family entry
-        gfxFontFamily *familyEntry = new gfxMacFontFamily(familyName);
-        if (!familyEntry) break;
-
-        // add the family entry to the hash table
-        ToLowerCase(familyName);
-        if (!hiddenSystemFont) {
-            mFontFamilies.Put(familyName, familyEntry);
-        } else {
-            mSystemFontFamilies.Put(familyName, familyEntry);
-        }
-
-        // check the bad underline blacklist
-        if (mBadUnderlineFamilyNames.Contains(familyName))
-            familyEntry->SetBadUnderlineFamily();
+    for (NSString* familyName in (NSArray*)familyNames) {
+        AddFamily((CFStringRef)familyName);
     }
 
     CFRelease(familyNames);
 
     InitSingleFaceList();
 
+    InitSystemFonts();
+
     // to avoid full search of font name tables, seed the other names table with localized names from
     // some of the prefs fonts which are accessed via their localized names.  changes in the pref fonts will only cause
     // a font lookup miss earlier. this is a simple optimization, it's not required for correctness
@@ -791,6 +788,90 @@ gfxMacPlatformFontList::InitSingleFaceList()
     }
 }
 
+// System fonts under OSX may contain weird "meta" names but if we create
+// a new font using just the Postscript name, the NSFont api returns an object
+// with the actual real family name. For example, under OSX 10.11:
+//
+// [[NSFont menuFontOfSize:8.0] familyName] ==> .AppleSystemUIFont
+// [[NSFont fontWithName:[[[NSFont menuFontOfSize:8.0] fontDescriptor] postscriptName]
+//          size:8.0] familyName] ==> .SF NS Text
+
+static NSString* GetRealFamilyName(NSFont* aFont)
+{
+    NSFont* f = [NSFont fontWithName: [[aFont fontDescriptor] postscriptName]
+                        size: 0.0];
+    return [f familyName];
+}
+
+// System fonts under OSX 10.11 use a combination of two families, one
+// for text sizes and another for larger, display sizes. Each has a
+// different number of weights. There aren't efficient API's for looking
+// this information up, so hard code the logic here but confirm via
+// debug assertions that the logic is correct.
+
+const CGFloat kTextDisplayCrossover = 20.0; // use text family below this size
+
+void
+gfxMacPlatformFontList::InitSystemFonts()
+{
+    // system font under 10.11 are two distinct families for text/display sizes
+    if (nsCocoaFeatures::OnElCapitanOrLater()) {
+        mUseSizeSensitiveSystemFont = true;
+    }
+
+    // text font family
+    NSFont* sys = [NSFont systemFontOfSize: 0.0];
+    NSString* textFamilyName = GetRealFamilyName(sys);
+    nsAutoString familyName;
+    nsCocoaUtils::GetStringForNSString(textFamilyName, familyName);
+    mSystemTextFontFamily = FindSystemFontFamily(familyName);
+    NS_ASSERTION(mSystemTextFontFamily, "null system display font family");
+
+    // display font family, if on OSX 10.11
+    if (mUseSizeSensitiveSystemFont) {
+        sys = [NSFont systemFontOfSize: 128.0];
+        NSString* displayFamilyName = GetRealFamilyName(sys);
+        nsCocoaUtils::GetStringForNSString(displayFamilyName, familyName);
+        mSystemDisplayFontFamily = FindSystemFontFamily(familyName);
+        NS_ASSERTION(mSystemDisplayFontFamily, "null system display font family");
+
+#if DEBUG
+        // confirm that the optical size switch is at 20.0
+        NS_ASSERTION(mSystemTextFontFamily && mSystemDisplayFontFamily &&
+                     [textFamilyName compare:displayFamilyName] != NSOrderedSame,
+                     "system text/display fonts are the same!");
+        NSString* fam19 = GetRealFamilyName([NSFont systemFontOfSize:
+                                             (kTextDisplayCrossover - 1.0)]);
+        NSString* fam20 = GetRealFamilyName([NSFont systemFontOfSize:
+                                             kTextDisplayCrossover]);
+        NS_ASSERTION(fam19 && fam20 && [fam19 compare:fam20] != NSOrderedSame,
+                     "system text/display font size switch point is not as expected!");
+#endif
+    }
+
+}
+
+gfxFontFamily*
+gfxMacPlatformFontList::FindSystemFontFamily(const nsAString& aFamily)
+{
+    nsAutoString key;
+    GenerateFontListKey(aFamily, key);
+
+    gfxFontFamily* familyEntry;
+
+    // lookup in hidden system family name list
+    if ((familyEntry = mSystemFontFamilies.GetWeak(key))) {
+        return CheckFamily(familyEntry);
+    }
+
+    // lookup in user-exposed family name list
+    if ((familyEntry = mFontFamilies.GetWeak(key))) {
+        return CheckFamily(familyEntry);
+    }
+
+    return nullptr;
+}
+
 bool
 gfxMacPlatformFontList::GetStandardFamilyName(const nsAString& aFontName, nsAString& aFamilyName)
 {
@@ -945,7 +1026,7 @@ gfxFontEntry*
 gfxMacPlatformFontList::LookupLocalFont(const nsAString& aFontName,
                                         uint16_t aWeight,
                                         int16_t aStretch,
-                                        bool aItalic)
+                                        uint8_t aStyle)
 {
     nsAutoreleasePool localPool;
 
@@ -962,10 +1043,7 @@ gfxMacPlatformFontList::LookupLocalFont(const nsAString& aFontName,
                  "bogus font weight value!");
 
     newFontEntry =
-        new MacOSFontEntry(aFontName, fontRef,
-                           aWeight, aStretch,
-                           aItalic ?
-                               NS_FONT_STYLE_ITALIC : NS_FONT_STYLE_NORMAL,
+        new MacOSFontEntry(aFontName, fontRef, aWeight, aStretch, aStyle,
                            false, true);
     ::CFRelease(fontRef);
 
@@ -981,7 +1059,7 @@ gfxFontEntry*
 gfxMacPlatformFontList::MakePlatformFont(const nsAString& aFontName,
                                          uint16_t aWeight,
                                          int16_t aStretch,
-                                         bool aItalic,
+                                         uint8_t aStyle,
                                          const uint8_t* aFontData,
                                          uint32_t aLength)
 {
@@ -1009,11 +1087,7 @@ gfxMacPlatformFontList::MakePlatformFont(const nsAString& aFontName,
 
     nsAutoPtr<MacOSFontEntry>
         newFontEntry(new MacOSFontEntry(uniqueName, fontRef, aWeight,
-                                        aStretch,
-                                        aItalic ?
-                                            NS_FONT_STYLE_ITALIC :
-                                            NS_FONT_STYLE_NORMAL,
-                                        true, false));
+                                        aStretch, aStyle, true, false));
     ::CFRelease(fontRef);
 
     // if succeeded and font cmap is good, return the new font
@@ -1030,6 +1104,97 @@ gfxMacPlatformFontList::MakePlatformFont(const nsAString& aFontName,
     return nullptr;
 }
 
+// Webkit code uses a system font meta name, so mimic that here
+// WebCore/platform/graphics/mac/FontCacheMac.mm
+static const char kSystemFont_system[] = "-apple-system";
+
+gfxFontFamily*
+gfxMacPlatformFontList::FindFamily(const nsAString& aFamily, gfxFontStyle* aStyle)
+{
+    // search for special system font name, -apple-system
+    if (aFamily.EqualsLiteral(kSystemFont_system)) {
+        if (mUseSizeSensitiveSystemFont &&
+            aStyle && aStyle->size >= kTextDisplayCrossover) {
+            return mSystemDisplayFontFamily;
+        }
+        return mSystemTextFontFamily;
+    }
+
+    return gfxPlatformFontList::FindFamily(aFamily, aStyle);
+}
+
+void
+gfxMacPlatformFontList::LookupSystemFont(LookAndFeel::FontID aSystemFontID,
+                                         nsAString& aSystemFontName,
+                                         gfxFontStyle &aFontStyle,
+                                         float aDevPixPerCSSPixel)
+{
+    // code moved here from widget/cocoa/nsLookAndFeel.mm
+    NSFont *font = nullptr;
+    char* systemFontName = nullptr;
+    switch (aSystemFontID) {
+        case LookAndFeel::eFont_MessageBox:
+        case LookAndFeel::eFont_StatusBar:
+        case LookAndFeel::eFont_List:
+        case LookAndFeel::eFont_Field:
+        case LookAndFeel::eFont_Button:
+        case LookAndFeel::eFont_Widget:
+            font = [NSFont systemFontOfSize:[NSFont smallSystemFontSize]];
+            systemFontName = (char*) kSystemFont_system;
+            break;
+
+        case LookAndFeel::eFont_SmallCaption:
+            font = [NSFont boldSystemFontOfSize:[NSFont smallSystemFontSize]];
+            systemFontName = (char*) kSystemFont_system;
+            break;
+
+        case LookAndFeel::eFont_Icon: // used in urlbar; tried labelFont, but too small
+        case LookAndFeel::eFont_Workspace:
+        case LookAndFeel::eFont_Desktop:
+        case LookAndFeel::eFont_Info:
+            font = [NSFont controlContentFontOfSize:0.0];
+            systemFontName = (char*) kSystemFont_system;
+            break;
+
+        case LookAndFeel::eFont_PullDownMenu:
+            font = [NSFont menuBarFontOfSize:0.0];
+            systemFontName = (char*) kSystemFont_system;
+            break;
+
+        case LookAndFeel::eFont_Tooltips:
+            font = [NSFont toolTipsFontOfSize:0.0];
+            systemFontName = (char*) kSystemFont_system;
+            break;
+
+        case LookAndFeel::eFont_Caption:
+        case LookAndFeel::eFont_Menu:
+        case LookAndFeel::eFont_Dialog:
+        default:
+            font = [NSFont systemFontOfSize:0.0];
+            systemFontName = (char*) kSystemFont_system;
+            break;
+    }
+    NS_ASSERTION(font, "system font not set");
+    NS_ASSERTION(systemFontName, "system font name not set");
+
+    if (systemFontName) {
+        aSystemFontName.AssignASCII(systemFontName);
+    }
+
+    NSFontSymbolicTraits traits = [[font fontDescriptor] symbolicTraits];
+    aFontStyle.style =
+        (traits & NSFontItalicTrait) ?  NS_FONT_STYLE_ITALIC : NS_FONT_STYLE_NORMAL;
+    aFontStyle.weight =
+        (traits & NSFontBoldTrait) ? NS_FONT_WEIGHT_BOLD : NS_FONT_WEIGHT_NORMAL;
+    aFontStyle.stretch =
+        (traits & NSFontExpandedTrait) ?
+            NS_FONT_STRETCH_EXPANDED : (traits & NSFontCondensedTrait) ?
+                NS_FONT_STRETCH_CONDENSED : NS_FONT_STRETCH_NORMAL;
+    // convert size from css pixels to device pixels
+    aFontStyle.size = [font pointSize] * aDevPixPerCSSPixel;
+    aFontStyle.systemFont = true;
+}
+
 // used to load system-wide font info on off-main thread
 class MacFontInfo : public FontInfoData {
 public:
diff --git a/gfx/thebes/gfxPlatform.cpp b/gfx/thebes/gfxPlatform.cpp
index fe2cd75d32..1b3da03e51 100644
--- a/gfx/thebes/gfxPlatform.cpp
+++ b/gfx/thebes/gfxPlatform.cpp
@@ -9,6 +9,7 @@
 #include "mozilla/layers/ImageBridgeChild.h"
 #include "mozilla/layers/SharedBufferManagerChild.h"
 #include "mozilla/layers/ISurfaceAllocator.h"     // for GfxMemoryImageReporter
+#include "mozilla/Telemetry.h"
 
 #include "mozilla/Logging.h"
 #include "mozilla/Services.h"
@@ -16,6 +17,7 @@
 
 #include "gfxPlatform.h"
 #include "gfxPrefs.h"
+#include "gfxEnv.h"
 #include "gfxTextRun.h"
 #include "gfxVR.h"
 
@@ -186,6 +188,7 @@ class CrashStatsLogForwarder: public mozilla::gfx::LogForwarder
 public:
   explicit CrashStatsLogForwarder(const char* aKey);
   virtual void Log(const std::string& aString) override;
+  virtual void CrashAction(LogReason aReason) override;
 
   virtual std::vector<std::pair<int32_t,std::string> > StringsVectorCopy() override;
 
@@ -262,7 +265,12 @@ void CrashStatsLogForwarder::UpdateCrashReport()
     message << "|[" << (*it).first << "]" << (*it).second;
   }
 
+#ifdef MOZ_CRASHREPORTER
+  nsCString reportString(message.str().c_str());
+  nsresult annotated = CrashReporter::AnnotateCrashReport(mCrashCriticalKey, reportString);
+#else
   nsresult annotated = NS_ERROR_NOT_IMPLEMENTED;
+#endif
   if (annotated != NS_OK) {
     printf("Crash Annotation %s: %s",
            mCrashCriticalKey.get(), message.str().c_str());
@@ -278,6 +286,54 @@ void CrashStatsLogForwarder::Log(const std::string& aString)
   }
 }
 
+class CrashTelemetryEvent : public nsRunnable
+{
+  virtual ~CrashTelemetryEvent() {}
+
+  NS_DECL_ISUPPORTS_INHERITED
+
+  explicit CrashTelemetryEvent(uint32_t aReason) : mReason(aReason) {}
+
+  NS_IMETHOD Run() override {
+    MOZ_ASSERT(NS_IsMainThread());
+    Telemetry::Accumulate(Telemetry::GFX_CRASH, mReason);
+    return NS_OK;
+  }
+
+protected:
+  uint32_t mReason;
+};
+
+NS_IMPL_ISUPPORTS_INHERITED0(CrashTelemetryEvent, nsRunnable);
+
+void
+CrashStatsLogForwarder::CrashAction(LogReason aReason)
+{
+#ifndef RELEASE_BUILD
+  // Non-release builds crash by default, but will use telemetry
+  // if this environment variable is present.
+  static bool useTelemetry = gfxEnv::GfxDevCrashTelemetry();
+#else
+  // Release builds use telemetry by default, but will crash instead
+  // if this environment variable is present.
+  static bool useTelemetry = !gfxEnv::GfxDevCrashMozCrash();
+#endif
+
+  if (useTelemetry) {
+    // The callers need to assure that aReason is in the range
+    // that the telemetry call below supports.
+    if (NS_IsMainThread()) {
+      Telemetry::Accumulate(Telemetry::GFX_CRASH, (uint32_t)aReason);
+    } else {
+      nsCOMPtr<nsIRunnable> r1 = new CrashTelemetryEvent((uint32_t)aReason);
+      NS_DispatchToMainThread(r1);
+    }
+  } else {
+    // ignoring aReason, we can get the information we need from the stack
+    MOZ_CRASH("GFX_CRASH");
+  }
+}
+
 NS_IMPL_ISUPPORTS(SRGBOverrideObserver, nsIObserver, nsISupportsWeakReference)
 
 #define GFX_DOWNLOADABLE_FONTS_ENABLED "gfx.downloadable_fonts.enabled"
@@ -758,7 +814,7 @@ gfxPlatform::CreateDrawTargetForUpdateSurface(gfxASurface *aSurface, const IntSi
     return Factory::CreateDrawTargetForCairoCGContext(static_cast<gfxQuartzSurface*>(aSurface)->GetCGContext(), aSize);
   }
 #endif
-  MOZ_CRASH();
+  MOZ_CRASH("unused function");
   return nullptr;
 }
 
@@ -1328,7 +1384,7 @@ gfxFontEntry*
 gfxPlatform::MakePlatformFont(const nsAString& aFontName,
                               uint16_t aWeight,
                               int16_t aStretch,
-                              bool aItalic,
+                              uint8_t aStyle,
                               const uint8_t* aFontData,
                               uint32_t aLength)
 {
@@ -1805,7 +1861,7 @@ gfxPlatform::Optimal2DFormatForContent(gfxContentType aContent)
     case gfxImageFormat::RGB24:
       return mozilla::gfx::SurfaceFormat::B8G8R8X8;
     case gfxImageFormat::RGB16_565:
-      return mozilla::gfx::SurfaceFormat::R5G6B5;
+      return mozilla::gfx::SurfaceFormat::R5G6B5_UINT16;
     default:
       NS_NOTREACHED("unknown gfxImageFormat for gfxContentType::COLOR");
       return mozilla::gfx::SurfaceFormat::B8G8R8A8;
@@ -2140,7 +2196,7 @@ gfxPlatform::GetApzSupportInfo(mozilla::widget::InfoObject& aObj)
 /*static*/ bool
 gfxPlatform::AsyncPanZoomEnabled()
 {
-#if !defined(MOZ_B2G) && !defined(MOZ_WIDGET_ANDROID)
+#if !defined(MOZ_B2G) && !defined(MOZ_WIDGET_ANDROID) && !defined(MOZ_WIDGET_UIKIT)
   // For XUL applications (everything but B2G on mobile and desktop, and
   // Firefox on Android) we only want to use APZ when E10S is enabled. If
   // we ever get input events off the main thread we can consider relaxing
@@ -2164,13 +2220,9 @@ gfxPlatform::PerfWarnings()
   return gfxPrefs::PerfWarnings();
 }
 
-void
-gfxPlatform::GetAcceleratedCompositorBackends(nsTArray<LayersBackend>& aBackends)
+static inline bool
+AllowOpenGL(bool* aWhitelisted)
 {
-  // Being whitelisted is not enough to accelerate, but not being whitelisted is
-  // enough not to:
-  bool whitelisted = false;
-
   nsCOMPtr<nsIGfxInfo> gfxInfo = do_GetService("@mozilla.org/gfx/info;1");
   if (gfxInfo) {
     // bug 655578: on X11 at least, we must always call GetData (even if we don't need that information)
@@ -2182,12 +2234,26 @@ gfxPlatform::GetAcceleratedCompositorBackends(nsTArray<LayersBackend>& aBackends
     int32_t status;
     if (NS_SUCCEEDED(gfxInfo->GetFeatureStatus(nsIGfxInfo::FEATURE_OPENGL_LAYERS, &status))) {
       if (status == nsIGfxInfo::FEATURE_STATUS_OK) {
-        aBackends.AppendElement(LayersBackend::LAYERS_OPENGL);
-        whitelisted = true;
+        *aWhitelisted = true;
+        return true;
       }
     }
   }
 
+  return gfxPrefs::LayersAccelerationForceEnabled();
+}
+
+void
+gfxPlatform::GetAcceleratedCompositorBackends(nsTArray<LayersBackend>& aBackends)
+{
+  // Being whitelisted is not enough to accelerate, but not being whitelisted is
+  // enough not to:
+  bool whitelisted = false;
+
+  if (AllowOpenGL(&whitelisted)) {
+    aBackends.AppendElement(LayersBackend::LAYERS_OPENGL);
+  }
+
   if (!whitelisted) {
     static int tell_me_once = 0;
     if (!tell_me_once) {
diff --git a/gfx/thebes/gfxPlatform.h b/gfx/thebes/gfxPlatform.h
index 2b23ce625d..3ab789f10f 100644
--- a/gfx/thebes/gfxPlatform.h
+++ b/gfx/thebes/gfxPlatform.h
@@ -348,7 +348,7 @@ public:
     virtual gfxFontEntry* LookupLocalFont(const nsAString& aFontName,
                                           uint16_t aWeight,
                                           int16_t aStretch,
-                                          bool aItalic)
+                                          uint8_t aStyle)
     { return nullptr; }
 
     /**
@@ -362,7 +362,7 @@ public:
     virtual gfxFontEntry* MakePlatformFont(const nsAString& aFontName,
                                            uint16_t aWeight,
                                            int16_t aStretch,
-                                           bool aItalic,
+                                           uint8_t aStyle,
                                            const uint8_t* aFontData,
                                            uint32_t aLength);
 
diff --git a/gfx/thebes/gfxPlatformFontList.cpp b/gfx/thebes/gfxPlatformFontList.cpp
index 3e4dc1270e..e986a37090 100644
--- a/gfx/thebes/gfxPlatformFontList.cpp
+++ b/gfx/thebes/gfxPlatformFontList.cpp
@@ -657,9 +657,7 @@ gfxPlatformFontList::CheckFamily(gfxFontFamily *aFamily)
 }
 
 gfxFontFamily* 
-gfxPlatformFontList::FindFamily(const nsAString& aFamily,
-                                nsIAtom* aLanguage,
-                                bool aUseSystemFonts)
+gfxPlatformFontList::FindFamily(const nsAString& aFamily, gfxFontStyle* aStyle)
 {
     nsAutoString key;
     gfxFontFamily *familyEntry;
@@ -672,15 +670,6 @@ gfxPlatformFontList::FindFamily(const nsAString& aFamily,
         return CheckFamily(familyEntry);
     }
 
-#if defined(XP_MACOSX)
-    // for system font types allow hidden system fonts to be referenced
-    if (aUseSystemFonts) {
-        if ((familyEntry = mSystemFontFamilies.GetWeak(key)) != nullptr) {
-            return CheckFamily(familyEntry);
-        }
-    }
-#endif
-
     // lookup in other family names list (mostly localized names)
     if ((familyEntry = mOtherFamilyNames.GetWeak(key)) != nullptr) {
         return CheckFamily(familyEntry);
@@ -874,8 +863,11 @@ gfxPlatformFontList::ResolveGenericFontNames(
 
     // lookup and add platform fonts uniquely
     for (const nsString& genericFamily : genericFamilies) {
+        gfxFontStyle style;
+        style.language = langGroup;
+        style.systemFont = false;
         RefPtr<gfxFontFamily> family =
-            FindFamily(genericFamily, langGroup, false);
+            FindFamily(genericFamily, &style);
         if (family) {
             bool notFound = true;
             for (const gfxFontFamily* f : *aGenericFamilies) {
diff --git a/gfx/thebes/gfxPlatformFontList.h b/gfx/thebes/gfxPlatformFontList.h
index b16c38b3e3..29f9793885 100644
--- a/gfx/thebes/gfxPlatformFontList.h
+++ b/gfx/thebes/gfxPlatformFontList.h
@@ -130,8 +130,7 @@ public:
                           const gfxFontStyle* aStyle);
 
     virtual gfxFontFamily* FindFamily(const nsAString& aFamily,
-                                      nsIAtom* aLanguage = nullptr,
-                                      bool aUseSystemFonts = false);
+                                      gfxFontStyle* aStyle = nullptr);
 
     gfxFontEntry* FindFontForFamily(const nsAString& aFamily, const gfxFontStyle* aStyle, bool& aNeedsBold);
 
@@ -154,14 +153,14 @@ public:
     virtual gfxFontEntry* LookupLocalFont(const nsAString& aFontName,
                                           uint16_t aWeight,
                                           int16_t aStretch,
-                                          bool aItalic) = 0;
+                                          uint8_t aStyle) = 0;
 
     // create a new platform font from downloaded data (@font-face)
     // this method is responsible to ensure aFontData is NS_Free()'d
     virtual gfxFontEntry* MakePlatformFont(const nsAString& aFontName,
                                            uint16_t aWeight,
                                            int16_t aStretch,
-                                           bool aItalic,
+                                           uint8_t aStyle,
                                            const uint8_t* aFontData,
                                            uint32_t aLength) = 0;
 
@@ -347,11 +346,6 @@ protected:
     // canonical family name ==> family entry (unique, one name per family entry)
     FontFamilyTable mFontFamilies;
 
-#if defined(XP_MACOSX)
-    // hidden system fonts used within UI elements
-    FontFamilyTable mSystemFontFamilies;
-#endif
-
     // other family name ==> family entry (not unique, can have multiple names per
     // family entry, only names *other* than the canonical names are stored here)
     FontFamilyTable mOtherFamilyNames;
diff --git a/gfx/thebes/gfxPlatformGtk.cpp b/gfx/thebes/gfxPlatformGtk.cpp
index a77ec23950..74ac7af7d6 100644
--- a/gfx/thebes/gfxPlatformGtk.cpp
+++ b/gfx/thebes/gfxPlatformGtk.cpp
@@ -256,34 +256,35 @@ gfxFontEntry*
 gfxPlatformGtk::LookupLocalFont(const nsAString& aFontName,
                                 uint16_t aWeight,
                                 int16_t aStretch,
-                                bool aItalic)
+                                uint8_t aStyle)
 {
     if (sUseFcFontList) {
         gfxPlatformFontList* pfl = gfxPlatformFontList::PlatformFontList();
-        return pfl->LookupLocalFont(aFontName, aWeight, aStretch, aItalic);
+        return pfl->LookupLocalFont(aFontName, aWeight, aStretch,
+                                    aStyle);
     }
 
     return gfxPangoFontGroup::NewFontEntry(aFontName, aWeight,
-                                           aStretch, aItalic);
+                                           aStretch, aStyle);
 }
 
 gfxFontEntry* 
 gfxPlatformGtk::MakePlatformFont(const nsAString& aFontName,
                                  uint16_t aWeight,
                                  int16_t aStretch,
-                                 bool aItalic,
+                                 uint8_t aStyle,
                                  const uint8_t* aFontData,
                                  uint32_t aLength)
 {
     if (sUseFcFontList) {
         gfxPlatformFontList* pfl = gfxPlatformFontList::PlatformFontList();
-        return pfl->MakePlatformFont(aFontName, aWeight, aStretch, aItalic,
-                                     aFontData, aLength);
+        return pfl->MakePlatformFont(aFontName, aWeight, aStretch,
+                                     aStyle, aFontData, aLength);
     }
 
     // passing ownership of the font data to the new font entry
     return gfxPangoFontGroup::NewFontEntry(aFontName, aWeight,
-                                           aStretch, aItalic,
+                                           aStretch, aStyle,
                                            aFontData, aLength);
 }
 
diff --git a/gfx/thebes/gfxPlatformGtk.h b/gfx/thebes/gfxPlatformGtk.h
index 548d7b704d..b32ac6b99f 100644
--- a/gfx/thebes/gfxPlatformGtk.h
+++ b/gfx/thebes/gfxPlatformGtk.h
@@ -63,7 +63,7 @@ public:
     virtual gfxFontEntry* LookupLocalFont(const nsAString& aFontName,
                                           uint16_t aWeight,
                                           int16_t aStretch,
-                                          bool aItalic) override;
+                                          uint8_t aStyle) override;
 
     /**
      * Activate a platform font (needed to support @font-face src url() )
@@ -72,7 +72,7 @@ public:
     virtual gfxFontEntry* MakePlatformFont(const nsAString& aFontName,
                                            uint16_t aWeight,
                                            int16_t aStretch,
-                                           bool aItalic,
+                                           uint8_t aStyle,
                                            const uint8_t* aFontData,
                                            uint32_t aLength) override;
 
diff --git a/gfx/thebes/gfxPlatformMac.cpp b/gfx/thebes/gfxPlatformMac.cpp
index bf891f2ad4..79dd9d47ad 100644
--- a/gfx/thebes/gfxPlatformMac.cpp
+++ b/gfx/thebes/gfxPlatformMac.cpp
@@ -152,19 +152,19 @@ gfxFontEntry*
 gfxPlatformMac::LookupLocalFont(const nsAString& aFontName,
                                 uint16_t aWeight,
                                 int16_t aStretch,
-                                bool aItalic)
+                                uint8_t aStyle)
 {
     return gfxPlatformFontList::PlatformFontList()->LookupLocalFont(aFontName,
                                                                     aWeight,
                                                                     aStretch,
-                                                                    aItalic);
+                                                                    aStyle);
 }
 
 gfxFontEntry* 
 gfxPlatformMac::MakePlatformFont(const nsAString& aFontName,
                                  uint16_t aWeight,
                                  int16_t aStretch,
-                                 bool aItalic,
+                                 uint8_t aStyle,
                                  const uint8_t* aFontData,
                                  uint32_t aLength)
 {
@@ -174,7 +174,7 @@ gfxPlatformMac::MakePlatformFont(const nsAString& aFontName,
     return gfxPlatformFontList::PlatformFontList()->MakePlatformFont(aFontName,
                                                                      aWeight,
                                                                      aStretch,
-                                                                     aItalic,
+                                                                     aStyle,
                                                                      aFontData,
                                                                      aLength);
 }
@@ -388,6 +388,17 @@ gfxPlatformMac::GetCommonFallbackFonts(uint32_t aCh, uint32_t aNextCh,
     aFontList.AppendElement(kFontArialUnicodeMS);
 }
 
+/*static*/ void
+gfxPlatformMac::LookupSystemFont(mozilla::LookAndFeel::FontID aSystemFontID,
+                                 nsAString& aSystemFontName,
+                                 gfxFontStyle& aFontStyle,
+                                 float aDevPixPerCSSPixel)
+{
+    gfxMacPlatformFontList* pfl = gfxMacPlatformFontList::PlatformFontList();
+    return pfl->LookupSystemFont(aSystemFontID, aSystemFontName, aFontStyle,
+                                 aDevPixPerCSSPixel);
+}
+
 uint32_t
 gfxPlatformMac::ReadAntiAliasingThreshold()
 {
@@ -531,6 +542,18 @@ public:
         CVDisplayLinkRelease(mDisplayLink);
         mDisplayLink = nullptr;
       }
+
+      CVTime vsyncRate = CVDisplayLinkGetNominalOutputVideoRefreshPeriod(mDisplayLink);
+      if (vsyncRate.flags & kCVTimeIsIndefinite) {
+        NS_WARNING("Could not get vsync rate, setting to 60.");
+        mVsyncRate = TimeDuration::FromMilliseconds(1000.0 / 60.0);
+      } else {
+        int64_t timeValue = vsyncRate.timeValue;
+        int64_t timeScale = vsyncRate.timeScale;
+        const int milliseconds = 1000;
+        float rateInMs = ((double) timeValue / (double) timeScale) * milliseconds;
+        mVsyncRate = TimeDuration::FromMilliseconds(rateInMs);
+      }
     }
 
     virtual void DisableVsync() override
@@ -553,6 +576,11 @@ public:
       return mDisplayLink != nullptr;
     }
 
+    virtual TimeDuration GetVsyncRate() override
+    {
+      return mVsyncRate;
+    }
+
     // The vsync timestamps given by the CVDisplayLinkCallback are
     // in the future for the NEXT frame. Large parts of Gecko, such
     // as animations assume a timestamp at either now or in the past.
@@ -564,6 +592,7 @@ public:
     // Manages the display link render thread
     CVDisplayLinkRef   mDisplayLink;
     RefPtr<nsITimer> mTimer;
+    TimeDuration mVsyncRate;
   }; // OSXDisplay
 
 private:
diff --git a/gfx/thebes/gfxPlatformMac.h b/gfx/thebes/gfxPlatformMac.h
index 4c28df91b6..e0edb9cdeb 100644
--- a/gfx/thebes/gfxPlatformMac.h
+++ b/gfx/thebes/gfxPlatformMac.h
@@ -8,6 +8,7 @@
 
 #include "nsTArrayForwardDeclare.h"
 #include "gfxPlatform.h"
+#include "mozilla/LookAndFeel.h"
 
 namespace mozilla {
 namespace gfx {
@@ -43,14 +44,14 @@ public:
     virtual gfxFontEntry* LookupLocalFont(const nsAString& aFontName,
                                           uint16_t aWeight,
                                           int16_t aStretch,
-                                          bool aItalic) override;
+                                          uint8_t aStyle) override;
 
     virtual gfxPlatformFontList* CreatePlatformFontList() override;
 
     virtual gfxFontEntry* MakePlatformFont(const nsAString& aFontName,
                                            uint16_t aWeight,
                                            int16_t aStretch,
-                                           bool aItalic,
+                                           uint8_t aStyle,
                                            const uint8_t* aFontData,
                                            uint32_t aLength) override;
 
@@ -65,6 +66,14 @@ public:
                                         int32_t aRunScript,
                                         nsTArray<const char*>& aFontList) override;
 
+    // lookup the system font for a particular system font type and set
+    // the name and style characteristics
+    static void
+    LookupSystemFont(mozilla::LookAndFeel::FontID aSystemFontID,
+                     nsAString& aSystemFontName,
+                     gfxFontStyle &aFontStyle,
+                     float aDevPixPerCSSPixel);
+
     virtual bool CanRenderContentToDataSurface() const override {
       return true;
     }
diff --git a/gfx/thebes/gfxPrefs.h b/gfx/thebes/gfxPrefs.h
index ec96f4bb8a..a8017d3cb1 100644
--- a/gfx/thebes/gfxPrefs.h
+++ b/gfx/thebes/gfxPrefs.h
@@ -270,7 +270,6 @@ private:
   // processing them. So 80 ms / 16 = 5 vsync events. Double it up just to be on the safe side, so 10.
   DECL_GFX_PREF(Once, "gfx.vsync.compositor.unobserve-count",  CompositorUnobserveCount, int32_t, 10);
   // Use vsync events generated by hardware
-  DECL_GFX_PREF(Once, "gfx.vsync.refreshdriver",               VsyncAlignedRefreshDriver, bool, false);
   DECL_GFX_PREF(Once, "gfx.work-around-driver-bugs",           WorkAroundDriverBugs, bool, true);
   DECL_GFX_PREF(Once, "gfx.screen-mirroring.enabled",          ScreenMirroringEnabled, bool, false);
 
diff --git a/gfx/thebes/gfxQPainterSurface.cpp b/gfx/thebes/gfxQPainterSurface.cpp
index 31e809a184..de3f804e15 100644
--- a/gfx/thebes/gfxQPainterSurface.cpp
+++ b/gfx/thebes/gfxQPainterSurface.cpp
@@ -21,9 +21,9 @@ gfxQPainterSurface::gfxQPainterSurface(QPainter *painter)
 
 gfxQPainterSurface::gfxQPainterSurface(const mozilla::gfx::IntSize& size, gfxImageFormat format)
 {
-    cairo_surface_t *csurf = cairo_qt_surface_create_with_qimage ((cairo_format_t) format,
-                                                                        size.width,
-                                                                        size.height);
+    cairo_format_t cformat = gfxImageFormatToCairoFormat(format);
+    cairo_surface_t *csurf =
+        cairo_qt_surface_create_with_qimage(cformat, size.width, size.height);
     mPainter = cairo_qt_surface_get_qpainter (csurf);
 
     Init (csurf);
diff --git a/gfx/thebes/gfxQtPlatform.cpp b/gfx/thebes/gfxQtPlatform.cpp
index 371d847618..1aed17ccaa 100644
--- a/gfx/thebes/gfxQtPlatform.cpp
+++ b/gfx/thebes/gfxQtPlatform.cpp
@@ -132,23 +132,23 @@ gfxFontEntry*
 gfxQtPlatform::LookupLocalFont(const nsAString& aFontName,
                                uint16_t aWeight,
                                int16_t aStretch,
-                               bool aItalic)
+                               uint8_t aStyle)
 {
     return gfxPangoFontGroup::NewFontEntry(aFontName, aWeight,
-                                           aStretch, aItalic);
+                                           aStretch, aStyle);
 }
 
 gfxFontEntry*
 gfxQtPlatform::MakePlatformFont(const nsAString& aFontName,
                                 uint16_t aWeight,
                                 int16_t aStretch,
-                                bool aItalic,
+                                uint8_t aStyle,
                                 const uint8_t* aFontData,
                                 uint32_t aLength)
 {
     // passing ownership of the font data to the new font entry
     return gfxPangoFontGroup::NewFontEntry(aFontName, aWeight,
-                                           aStretch, aItalic,
+                                           aStretch, aStyle,
                                            aFontData, aLength);
 }
 
diff --git a/gfx/thebes/gfxQtPlatform.h b/gfx/thebes/gfxQtPlatform.h
index fad09180df..ed5c26e942 100644
--- a/gfx/thebes/gfxQtPlatform.h
+++ b/gfx/thebes/gfxQtPlatform.h
@@ -54,7 +54,7 @@ public:
     virtual gfxFontEntry* LookupLocalFont(const nsAString& aFontName,
                                           uint16_t aWeight,
                                           int16_t aStretch,
-                                          bool aItalic) override;
+                                          uint8_t aStyle) override;
 
     /**
      * Activate a platform font (needed to support @font-face src url() )
@@ -63,7 +63,7 @@ public:
     virtual gfxFontEntry* MakePlatformFont(const nsAString& aFontName,
                                            uint16_t aWeight,
                                            int16_t aStretch,
-                                           bool aItalic,
+                                           uint8_t aStyle,
                                            const uint8_t* aFontData,
                                            uint32_t aLength) override;
 
diff --git a/gfx/thebes/gfxQuartzSurface.cpp b/gfx/thebes/gfxQuartzSurface.cpp
index a5069d8429..23941b97f6 100644
--- a/gfx/thebes/gfxQuartzSurface.cpp
+++ b/gfx/thebes/gfxQuartzSurface.cpp
@@ -26,8 +26,8 @@ gfxQuartzSurface::gfxQuartzSurface(const gfxSize& desiredSize, gfxImageFormat fo
     unsigned int width = static_cast<unsigned int>(mSize.width);
     unsigned int height = static_cast<unsigned int>(mSize.height);
 
-    cairo_surface_t *surf = cairo_quartz_surface_create
-        ((cairo_format_t) format, width, height);
+    cairo_format_t cformat = gfxImageFormatToCairoFormat(format);
+    cairo_surface_t *surf = cairo_quartz_surface_create(cformat, width, height);
 
     mCGContext = cairo_quartz_surface_get_cg_context (surf);
 
@@ -109,8 +109,9 @@ gfxQuartzSurface::gfxQuartzSurface(unsigned char *data,
     unsigned int width = static_cast<unsigned int>(mSize.width);
     unsigned int height = static_cast<unsigned int>(mSize.height);
 
+    cairo_format_t cformat = gfxImageFormatToCairoFormat(format);
     cairo_surface_t *surf = cairo_quartz_surface_create_for_data
-        (data, (cairo_format_t) format, width, height, stride);
+        (data, cformat, width, height, stride);
 
     mCGContext = cairo_quartz_surface_get_cg_context (surf);
 
@@ -131,8 +132,9 @@ gfxQuartzSurface::gfxQuartzSurface(unsigned char *data,
     if (!CheckSurfaceSize(aSize))
         MakeInvalid();
 
+    cairo_format_t cformat = gfxImageFormatToCairoFormat(format);
     cairo_surface_t *surf = cairo_quartz_surface_create_for_data
-        (data, (cairo_format_t) format, aSize.width, aSize.height, stride);
+        (data, cformat, aSize.width, aSize.height, stride);
 
     mCGContext = cairo_quartz_surface_get_cg_context (surf);
 
diff --git a/gfx/thebes/gfxTextRun.cpp b/gfx/thebes/gfxTextRun.cpp
index 69475dc5a5..2a6560f2dd 100644
--- a/gfx/thebes/gfxTextRun.cpp
+++ b/gfx/thebes/gfxTextRun.cpp
@@ -24,6 +24,7 @@
 #include "mozilla/Likely.h"
 #include "gfx2DGlue.h"
 #include "mozilla/gfx/Logging.h"        // for gfxCriticalError
+#include "mozilla/UniquePtr.h"
 
 #if defined(MOZ_WIDGET_GTK)
 #include "gfxPlatformGtk.h" // xxx - for UseFcFontList
@@ -1618,7 +1619,7 @@ gfxFontGroup::AddPlatformFont(const nsAString& aName,
     // Not known in the user font set ==> check system fonts
     if (!family) {
         gfxPlatformFontList* fontList = gfxPlatformFontList::PlatformFontList();
-        family = fontList->FindFamily(aName, mStyle.language, mStyle.systemFont);
+        family = fontList->FindFamily(aName, &mStyle);
     }
 
     if (family) {
@@ -1643,6 +1644,12 @@ gfxFontGroup::AddFamilyToFontList(gfxFontFamily* aFamily)
             mFonts.AppendElement(ff);
         }
     }
+    // for a family marked as "check fallback faces", only mark the last
+    // entry so that fallbacks for a family are only checked once
+    if (aFamily->CheckForFallbackFaces() &&
+        !fontEntryList.IsEmpty() && !mFonts.IsEmpty()) {
+        mFonts.LastElement().SetCheckForFallbackFaces();
+    }
 }
 
 bool
@@ -2100,7 +2107,7 @@ gfxFontGroup::InitTextRun(gfxContext *aContext,
     // we need to do numeral processing even on 8-bit text,
     // in case we're converting Western to Hindi/Arabic digits
     int32_t numOption = gfxPlatform::GetPlatform()->GetBidiNumeralOption();
-    nsAutoArrayPtr<char16_t> transformedString;
+    UniquePtr<char16_t[]> transformedString;
     if (numOption != IBMBIDI_NUMERAL_NOMINAL) {
         // scan the string for numerals that may need to be transformed;
         // if we find any, we'll make a local copy here and use that for
@@ -2112,7 +2119,7 @@ gfxFontGroup::InitTextRun(gfxContext *aContext,
             char16_t newCh = HandleNumberInChar(origCh, prevIsArabic, numOption);
             if (newCh != origCh) {
                 if (!transformedString) {
-                    transformedString = new char16_t[aLength];
+                    transformedString = MakeUnique<char16_t[]>(aLength);
                     if (sizeof(T) == sizeof(char16_t)) {
                         memcpy(transformedString.get(), aString, i * sizeof(char16_t));
                     } else {
@@ -2549,6 +2556,23 @@ gfxFontGroup::FindNonItalicFaceForChar(gfxFontFamily* aFamily, uint32_t aCh)
     return font.forget();
 }
 
+already_AddRefed<gfxFont>
+gfxFontGroup::FindFallbackFaceForChar(gfxFontFamily* aFamily, uint32_t aCh,
+                                      int32_t aRunScript)
+{
+    GlobalFontMatch data(aCh, aRunScript, &mStyle);
+    aFamily->SearchAllFontsForChar(&data);
+    gfxFontEntry* fe = data.mBestMatch;
+    if (!fe) {
+        return nullptr;
+    }
+
+    bool needsBold = mStyle.weight >= 600 && !fe->IsBold() &&
+                     mStyle.allowSyntheticWeight;
+    RefPtr<gfxFont> font = fe->FindOrMakeFont(&mStyle, needsBold);
+    return font.forget();
+}
+
 gfxFloat
 gfxFontGroup::GetUnderlineOffset()
 {
@@ -2613,10 +2637,17 @@ gfxFontGroup::FindFontForChar(uint32_t aCh, uint32_t aPrevCh, uint32_t aNextCh,
                 return firstFont.forget();
             }
 
-            // If italic, test the regular face to see if it supports character.
-            // Only do this for platform fonts, not userfonts.
-            if (mStyle.style != NS_FONT_STYLE_NORMAL &&
-                !firstFont->GetFontEntry()->IsUserFont()) {
+            if (mFonts[0].CheckForFallbackFaces()) {
+                RefPtr<gfxFont> font =
+                    FindFallbackFaceForChar(mFonts[0].Family(), aCh, aRunScript);
+                if (font) {
+                    *aMatchType = gfxTextRange::kFontGroup;
+                    return font.forget();
+                }
+            } else if (mStyle.style != NS_FONT_STYLE_NORMAL &&
+                       !firstFont->GetFontEntry()->IsUserFont()) {
+                // If italic, test the regular face to see if it supports
+                // character. Only do this for platform fonts, not userfonts.
                 RefPtr<gfxFont> font =
                     FindNonItalicFaceForChar(mFonts[0].Family(), aCh);
                 if (font) {
@@ -2716,17 +2747,30 @@ gfxFontGroup::FindFontForChar(uint32_t aCh, uint32_t aPrevCh, uint32_t aNextCh,
             }
         }
 
-        // If italic, test the regular face to see if it supports the character.
-        // Only do this for platform fonts, not userfonts.
-        fe = ff.FontEntry();
-        if (mStyle.style != NS_FONT_STYLE_NORMAL &&
-            !fe->mIsUserFontContainer &&
-            !fe->IsUserFont()) {
-            font = FindNonItalicFaceForChar(ff.Family(), aCh);
+        // check other family faces if needed
+        if (ff.CheckForFallbackFaces()) {
+            NS_ASSERTION(i == 0 ? true :
+                         !mFonts[i-1].CheckForFallbackFaces() ||
+                         !mFonts[i-1].Family()->Name().Equals(ff.Family()->Name()),
+                         "should only do fallback once per font family");
+            font = FindFallbackFaceForChar(ff.Family(), aCh, aRunScript);
             if (font) {
                 *aMatchType = gfxTextRange::kFontGroup;
                 return font.forget();
             }
+        } else {
+            // If italic, test the regular face to see if it supports the
+            // character. Only do this for platform fonts, not userfonts.
+            fe = ff.FontEntry();
+            if (mStyle.style != NS_FONT_STYLE_NORMAL &&
+                !fe->mIsUserFontContainer &&
+                !fe->IsUserFont()) {
+                font = FindNonItalicFaceForChar(ff.Family(), aCh);
+                if (font) {
+                    *aMatchType = gfxTextRange::kFontGroup;
+                    return font.forget();
+                }
+            }
         }
     }
 
@@ -3018,28 +3062,6 @@ gfxFontGroup::ContainsUserFont(const gfxUserFontEntry* aUserFont)
     return false;
 }
 
-struct PrefFontCallbackData {
-    explicit PrefFontCallbackData(nsTArray<RefPtr<gfxFontFamily> >& aFamiliesArray)
-        : mPrefFamilies(aFamiliesArray)
-    {}
-
-    nsTArray<RefPtr<gfxFontFamily> >& mPrefFamilies;
-
-    static bool AddFontFamilyEntry(eFontPrefLang aLang, const nsAString& aName, void *aClosure)
-    {
-        PrefFontCallbackData *prefFontData = static_cast<PrefFontCallbackData*>(aClosure);
-
-        // map pref lang to langGroup for language-sensitive lookups
-        nsIAtom* lang = gfxPlatformFontList::GetLangGroupForPrefLang(aLang);
-        gfxFontFamily *family =
-            gfxPlatformFontList::PlatformFontList()->FindFamily(aName, lang);
-        if (family) {
-            prefFontData->mPrefFamilies.AppendElement(family);
-        }
-        return true;
-    }
-};
-
 already_AddRefed<gfxFont>
 gfxFontGroup::WhichPrefFontSupportsChar(uint32_t aCh)
 {
diff --git a/gfx/thebes/gfxTextRun.h b/gfx/thebes/gfxTextRun.h
index 00b231d93c..315a1a92af 100644
--- a/gfx/thebes/gfxTextRun.h
+++ b/gfx/thebes/gfxTextRun.h
@@ -890,12 +890,13 @@ protected:
     public:
         FamilyFace() : mFamily(nullptr), mFontEntry(nullptr),
                        mNeedsBold(false), mFontCreated(false),
-                       mLoading(false), mInvalid(false)
+                       mLoading(false), mInvalid(false),
+                       mCheckForFallbackFaces(false)
         { }
 
         FamilyFace(gfxFontFamily* aFamily, gfxFont* aFont)
             : mFamily(aFamily), mNeedsBold(false), mFontCreated(true),
-              mLoading(false), mInvalid(false)
+              mLoading(false), mInvalid(false), mCheckForFallbackFaces(false)
         {
             NS_ASSERTION(aFont, "font pointer must not be null");
             NS_ASSERTION(!aFamily ||
@@ -908,7 +909,7 @@ protected:
         FamilyFace(gfxFontFamily* aFamily, gfxFontEntry* aFontEntry,
                    bool aNeedsBold)
             : mFamily(aFamily), mNeedsBold(aNeedsBold), mFontCreated(false),
-              mLoading(false), mInvalid(false)
+              mLoading(false), mInvalid(false), mCheckForFallbackFaces(false)
         {
             NS_ASSERTION(aFontEntry, "font entry pointer must not be null");
             NS_ASSERTION(!aFamily ||
@@ -923,7 +924,8 @@ protected:
               mNeedsBold(aOtherFamilyFace.mNeedsBold),
               mFontCreated(aOtherFamilyFace.mFontCreated),
               mLoading(aOtherFamilyFace.mLoading),
-              mInvalid(aOtherFamilyFace.mInvalid)
+              mInvalid(aOtherFamilyFace.mInvalid),
+              mCheckForFallbackFaces(aOtherFamilyFace.mCheckForFallbackFaces)
         {
             if (mFontCreated) {
                 mFont = aOtherFamilyFace.mFont;
@@ -986,6 +988,8 @@ protected:
         void CheckState(bool& aSkipDrawing);
         void SetLoading(bool aIsLoading) { mLoading = aIsLoading; }
         void SetInvalid() { mInvalid = true; }
+        bool CheckForFallbackFaces() const { return mCheckForFallbackFaces; }
+        void SetCheckForFallbackFaces() { mCheckForFallbackFaces = true; }
 
         void SetFont(gfxFont* aFont)
         {
@@ -1014,6 +1018,7 @@ protected:
         bool                    mFontCreated : 1;
         bool                    mLoading     : 1;
         bool                    mInvalid     : 1;
+        bool                    mCheckForFallbackFaces : 1;
     };
 
     // List of font families, either named or generic.
@@ -1110,7 +1115,13 @@ protected:
     already_AddRefed<gfxFont>
     FindNonItalicFaceForChar(gfxFontFamily* aFamily, uint32_t aCh);
 
-    // helper methods for looking up fonts
+    // search all faces in a family for a fallback in cases where it's unclear
+    // whether the family might have a font for a given character
+    already_AddRefed<gfxFont>
+    FindFallbackFaceForChar(gfxFontFamily* aFamily, uint32_t aCh,
+                            int32_t aRunScript);
+
+   // helper methods for looking up fonts
 
     // lookup and add a font with a given name (i.e. *not* a generic!)
     void AddPlatformFont(const nsAString& aName,
diff --git a/gfx/thebes/gfxTypes.h b/gfx/thebes/gfxTypes.h
index 2c923e78eb..1dad160e60 100644
--- a/gfx/thebes/gfxTypes.h
+++ b/gfx/thebes/gfxTypes.h
@@ -52,11 +52,22 @@ enum class gfxImageFormat {
   ARGB32, ///< ARGB data in native endianness, using premultiplied alpha
   RGB24,  ///< xRGB data in native endianness
   A8,     ///< Only an alpha channel
-  A1,     ///< Packed transparency information (one byte refers to 8 pixels)
   RGB16_565,  ///< RGB_565 data in native endianness
   Unknown
 };
 
+// XXX: temporary
+// This works because the gfxImageFormat enum is defined so as to match the
+// _cairo_format enum.
+#define gfxCairoFormatToImageFormat(aFormat) \
+    ((gfxImageFormat)aFormat)
+
+// XXX: temporary
+// This works because the gfxImageFormat enum is defined so as to match the
+// _cairo_format enum.
+#define gfxImageFormatToCairoFormat(aFormat) \
+    ((cairo_format_t)aFormat)
+
 enum class gfxSurfaceType {
   Image,
   PDF,
diff --git a/gfx/thebes/gfxUserFontSet.cpp b/gfx/thebes/gfxUserFontSet.cpp
index 2e576040f2..f15188475d 100644
--- a/gfx/thebes/gfxUserFontSet.cpp
+++ b/gfx/thebes/gfxUserFontSet.cpp
@@ -109,7 +109,7 @@ gfxUserFontEntry::gfxUserFontEntry(gfxUserFontSet* aFontSet,
              const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
              uint32_t aWeight,
              int32_t aStretch,
-             uint32_t aItalicStyle,
+             uint8_t aStyle,
              const nsTArray<gfxFontFeature>& aFeatureSettings,
              uint32_t aLanguageOverride,
              gfxSparseBitSet* aUnicodeRanges)
@@ -127,9 +127,7 @@ gfxUserFontEntry::gfxUserFontEntry(gfxUserFontSet* aFontSet,
     mSrcIndex = 0;
     mWeight = aWeight;
     mStretch = aStretch;
-    // XXX Currently, we don't distinguish 'italic' and 'oblique' styles;
-    // we need to fix this. (Bug 543715)
-    mItalic = (aItalicStyle & (NS_FONT_STYLE_ITALIC | NS_FONT_STYLE_OBLIQUE)) != 0;
+    mStyle = aStyle;
     mFeatureSettings.AppendElements(aFeatureSettings);
     mLanguageOverride = aLanguageOverride;
 
@@ -147,18 +145,14 @@ bool
 gfxUserFontEntry::Matches(const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
                           uint32_t aWeight,
                           int32_t aStretch,
-                          uint32_t aItalicStyle,
+                          uint8_t aStyle,
                           const nsTArray<gfxFontFeature>& aFeatureSettings,
                           uint32_t aLanguageOverride,
                           gfxSparseBitSet* aUnicodeRanges)
 {
-    // XXX font entries don't distinguish italic from oblique (bug 543715)
-    bool isItalic =
-        (aItalicStyle & (NS_FONT_STYLE_ITALIC | NS_FONT_STYLE_OBLIQUE)) != 0;
-
     return mWeight == aWeight &&
            mStretch == aStretch &&
-           mItalic == isItalic &&
+           mStyle == aStyle &&
            mFeatureSettings == aFeatureSettings &&
            mLanguageOverride == aLanguageOverride &&
            mSrcList == aFontFaceSrcList &&
@@ -183,10 +177,10 @@ public:
 
     virtual ots::TableAction GetTableAction(uint32_t aTag) override {
         // Preserve Graphite, color glyph and SVG tables
-        // Also allow OT Layout tables (GDEF/GPOS/GSUB) through
-        // unchecked, and rely on harfbuzz to handle them safely.
-        if (aTag == TRUETYPE_TAG('G', 'D', 'E', 'F') ||
-            aTag == TRUETYPE_TAG('G', 'P', 'O', 'S') ||
+        // Also allow OT Layout tables (GDEF/GPOS/GSUB) through
+        // unchecked, and rely on harfbuzz to handle them safely.
+        if (aTag == TRUETYPE_TAG('G', 'D', 'E', 'F') ||
+            aTag == TRUETYPE_TAG('G', 'P', 'O', 'S') ||
             aTag == TRUETYPE_TAG('G', 'S', 'U', 'B') ||
             aTag == TRUETYPE_TAG('S', 'i', 'l', 'f') ||
             aTag == TRUETYPE_TAG('S', 'i', 'l', 'l') ||
@@ -417,8 +411,14 @@ gfxUserFontEntry::LoadNextSrc()
                 gfxPlatform::GetPlatform()->LookupLocalFont(currSrc.mLocalName,
                                                             mWeight,
                                                             mStretch,
-                                                            mItalic);
-            mFontSet->SetLocalRulesUsed();
+                                                            mStyle);
+            nsTArray<gfxUserFontSet*> fontSets;
+            GetUserFontSets(fontSets);
+            for (gfxUserFontSet* fontSet : fontSets) {
+                // We need to note on each gfxUserFontSet that contains the user
+                // font entry that we used a local() rule.
+                fontSet->SetLocalRulesUsed();
+            }
             if (fe) {
                 LOG(("userfonts (%p) [src %d] loaded local: (%s) for (%s) gen: %8.8x\n",
                      mFontSet, mSrcIndex,
@@ -611,11 +611,10 @@ gfxUserFontEntry::LoadPlatformFont(const uint8_t* aFontData, uint32_t& aLength)
                                           originalFullName);
         // Here ownership of saneData is passed to the platform,
         // which will delete it when no longer required
-
         fe = gfxPlatform::GetPlatform()->MakePlatformFont(mName,
                                                           mWeight,
                                                           mStretch,
-                                                          mItalic,
+                                                          mStyle,
                                                           saneData,
                                                           saneLen);
         if (!fe) {
@@ -685,6 +684,16 @@ gfxUserFontEntry::Load()
     }
 }
 
+void
+gfxUserFontEntry::IncrementGeneration()
+{
+    nsTArray<gfxUserFontSet*> fontSets;
+    GetUserFontSets(fontSets);
+    for (gfxUserFontSet* fontSet : fontSets) {
+        fontSet->IncrementGeneration();
+    }
+}
+
 // This is called when a font download finishes.
 // Ownership of aFontData passes in here, and the font set must
 // ensure that it is eventually deleted via moz_free().
@@ -703,7 +712,7 @@ gfxUserFontEntry::FontDataDownloadComplete(const uint8_t* aFontData,
         aFontData = nullptr;
 
         if (loaded) {
-            mFontSet->IncrementGeneration();
+            IncrementGeneration();
             return true;
         }
 
@@ -725,10 +734,17 @@ gfxUserFontEntry::FontDataDownloadComplete(const uint8_t* aFontData,
     // even if loading failed, we need to bump the font-set generation
     // and return true in order to trigger reflow, so that fallback
     // will be used where the text was "masked" by the pending download
-    mFontSet->IncrementGeneration();
+    IncrementGeneration();
     return true;
 }
 
+void
+gfxUserFontEntry::GetUserFontSets(nsTArray<gfxUserFontSet*>& aResult)
+{
+    aResult.Clear();
+    aResult.AppendElement(mFontSet);
+}
+
 gfxUserFontSet::gfxUserFontSet()
     : mFontFamilies(4), mLocalRulesUsed(false)
 {
@@ -753,7 +769,7 @@ gfxUserFontSet::FindOrCreateUserFontEntry(
                                const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
                                uint32_t aWeight,
                                int32_t aStretch,
-                               uint32_t aItalicStyle,
+                               uint8_t aStyle,
                                const nsTArray<gfxFontFeature>& aFeatureSettings,
                                uint32_t aLanguageOverride,
                                gfxSparseBitSet* aUnicodeRanges)
@@ -769,14 +785,14 @@ gfxUserFontSet::FindOrCreateUserFontEntry(
     gfxUserFontFamily* family = LookupFamily(aFamilyName);
     if (family) {
         entry = FindExistingUserFontEntry(family, aFontFaceSrcList, aWeight,
-                                          aStretch, aItalicStyle,
+                                          aStretch, aStyle,
                                           aFeatureSettings, aLanguageOverride,
                                           aUnicodeRanges);
     }
 
     if (!entry) {
       entry = CreateUserFontEntry(aFontFaceSrcList, aWeight, aStretch,
-                                  aItalicStyle, aFeatureSettings,
+                                  aStyle, aFeatureSettings,
                                   aLanguageOverride, aUnicodeRanges);
       entry->mFamilyName = aFamilyName;
     }
@@ -789,7 +805,7 @@ gfxUserFontSet::CreateUserFontEntry(
                                const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
                                uint32_t aWeight,
                                int32_t aStretch,
-                               uint32_t aItalicStyle,
+                               uint8_t aStyle,
                                const nsTArray<gfxFontFeature>& aFeatureSettings,
                                uint32_t aLanguageOverride,
                                gfxSparseBitSet* aUnicodeRanges)
@@ -797,7 +813,7 @@ gfxUserFontSet::CreateUserFontEntry(
 
     RefPtr<gfxUserFontEntry> userFontEntry =
         new gfxUserFontEntry(this, aFontFaceSrcList, aWeight,
-                              aStretch, aItalicStyle, aFeatureSettings,
+                              aStretch, aStyle, aFeatureSettings,
                               aLanguageOverride, aUnicodeRanges);
     return userFontEntry.forget();
 }
@@ -808,7 +824,7 @@ gfxUserFontSet::FindExistingUserFontEntry(
                                const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
                                uint32_t aWeight,
                                int32_t aStretch,
-                               uint32_t aItalicStyle,
+                               uint8_t aStyle,
                                const nsTArray<gfxFontFeature>& aFeatureSettings,
                                uint32_t aLanguageOverride,
                                gfxSparseBitSet* aUnicodeRanges)
@@ -826,7 +842,7 @@ gfxUserFontSet::FindExistingUserFontEntry(
         gfxUserFontEntry* existingUserFontEntry =
             static_cast<gfxUserFontEntry*>(fontList[i].get());
         if (!existingUserFontEntry->Matches(aFontFaceSrcList,
-                                            aWeight, aStretch, aItalicStyle,
+                                            aWeight, aStretch, aStyle,
                                             aFeatureSettings, aLanguageOverride,
                                             aUnicodeRanges)) {
             continue;
@@ -849,7 +865,8 @@ gfxUserFontSet::AddUserFontEntry(const nsAString& aFamilyName,
         LOG(("userfonts (%p) added to \"%s\" (%p) style: %s weight: %d "
              "stretch: %d",
              this, NS_ConvertUTF16toUTF8(aFamilyName).get(), aUserFontEntry,
-             (aUserFontEntry->IsItalic() ? "italic" : "normal"),
+             (aUserFontEntry->IsItalic() ? "italic" :
+              (aUserFontEntry->IsOblique() ? "oblique" : "normal")),
              aUserFontEntry->Weight(), aUserFontEntry->Stretch()));
     }
 }
@@ -1032,7 +1049,7 @@ gfxUserFontSet::UserFontCache::Entry::KeyEquals(const KeyTypePointer aKey) const
         }
     }
 
-    if (mFontEntry->mItalic           != fe->mItalic          ||
+    if (mFontEntry->mStyle            != fe->mStyle     ||
         mFontEntry->mWeight           != fe->mWeight          ||
         mFontEntry->mStretch          != fe->mStretch         ||
         mFontEntry->mFeatureSettings  != fe->mFeatureSettings ||
diff --git a/gfx/thebes/gfxUserFontSet.h b/gfx/thebes/gfxUserFontSet.h
index 8fde8272bf..e96c90acdc 100644
--- a/gfx/thebes/gfxUserFontSet.h
+++ b/gfx/thebes/gfxUserFontSet.h
@@ -16,6 +16,7 @@
 #include "nsIScriptError.h"
 #include "nsURIHashKey.h"
 #include "mozilla/net/ReferrerPolicy.h"
+#include "gfxFontConstants.h"
 
 class nsFontFaceLoader;
 
@@ -210,7 +211,7 @@ public:
                               const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
                               uint32_t aWeight,
                               int32_t aStretch,
-                              uint32_t aItalicStyle,
+                              uint8_t aStyle,
                               const nsTArray<gfxFontFeature>& aFeatureSettings,
                               uint32_t aLanguageOverride,
                               gfxSparseBitSet* aUnicodeRanges) = 0;
@@ -222,7 +223,7 @@ public:
                                const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
                                uint32_t aWeight,
                                int32_t aStretch,
-                               uint32_t aItalicStyle,
+                               uint8_t aStyle,
                                const nsTArray<gfxFontFeature>& aFeatureSettings,
                                uint32_t aLanguageOverride,
                                gfxSparseBitSet* aUnicodeRanges);
@@ -416,9 +417,9 @@ public:
                                             nsURIHashKey::HashKey(aKey->mURI),
                                             HashFeatures(aKey->mFontEntry->mFeatureSettings),
                                             mozilla::HashString(aKey->mFontEntry->mFamilyName),
-                                            ((uint32_t)aKey->mFontEntry->mItalic |
-                                             (aKey->mFontEntry->mWeight << 1) |
-                                             (aKey->mFontEntry->mStretch << 10) ) ^
+                                            (aKey->mFontEntry->mStyle |
+                                             (aKey->mFontEntry->mWeight << 2) |
+                                             (aKey->mFontEntry->mStretch << 11) ) ^
                                              aKey->mFontEntry->mLanguageOverride);
             }
 
@@ -495,7 +496,7 @@ protected:
                                    const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
                                    uint32_t aWeight,
                                    int32_t aStretch,
-                                   uint32_t aItalicStyle,
+                                   uint8_t aStyle,
                                    const nsTArray<gfxFontFeature>& aFeatureSettings,
                                    uint32_t aLanguageOverride,
                                    gfxSparseBitSet* aUnicodeRanges);
@@ -534,7 +535,7 @@ public:
                      const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
                      uint32_t aWeight,
                      int32_t aStretch,
-                     uint32_t aItalicStyle,
+                     uint8_t aStyle,
                      const nsTArray<gfxFontFeature>& aFeatureSettings,
                      uint32_t aLanguageOverride,
                      gfxSparseBitSet* aUnicodeRanges);
@@ -545,7 +546,7 @@ public:
     bool Matches(const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
                  uint32_t aWeight,
                  int32_t aStretch,
-                 uint32_t aItalicStyle,
+                 uint8_t aStyle,
                  const nsTArray<gfxFontFeature>& aFeatureSettings,
                  uint32_t aLanguageOverride,
                  gfxSparseBitSet* aUnicodeRanges);
@@ -629,6 +630,15 @@ protected:
                            uint32_t           aMetaOrigLen,
                            uint8_t            aCompression);
 
+    // Clears and then adds to aResult all of the user font sets that this user
+    // font entry has been added to.  This will at least include mFontSet, the
+    // owner of this user font entry.
+    virtual void GetUserFontSets(nsTArray<gfxUserFontSet*>& aResult);
+
+    // Calls IncrementGeneration() on all user font sets that contain this
+    // user font entry.
+    void IncrementGeneration();
+
     // general load state
     UserFontLoadState        mUserFontLoadState;
 
@@ -654,7 +664,7 @@ protected:
     // This field is managed by the nsFontFaceLoader. In the destructor and Cancel()
     // methods of nsFontFaceLoader this reference is nulled out.
     nsFontFaceLoader* MOZ_NON_OWNING_REF mLoader; // current loader for this entry, if any
-    gfxUserFontSet*          mFontSet; // font-set to which the userfont entry belongs
+    gfxUserFontSet*          mFontSet; // font-set which owns this userfont entry
     nsCOMPtr<nsIPrincipal>   mPrincipal;
 };
 
diff --git a/gfx/thebes/gfxUtils.cpp b/gfx/thebes/gfxUtils.cpp
index 8bd543e155..0b40285d5f 100644
--- a/gfx/thebes/gfxUtils.cpp
+++ b/gfx/thebes/gfxUtils.cpp
@@ -7,6 +7,7 @@
 
 #include "cairo.h"
 #include "gfxContext.h"
+#include "gfxEnv.h"
 #include "gfxImageSurface.h"
 #include "gfxPlatform.h"
 #include "gfxDrawable.h"
@@ -20,6 +21,7 @@
 #include "mozilla/gfx/Logging.h"
 #include "mozilla/Maybe.h"
 #include "mozilla/RefPtr.h"
+#include "mozilla/UniquePtrExtensions.h"
 #include "mozilla/Vector.h"
 #include "nsComponentManagerUtils.h"
 #include "nsIClipboardHelper.h"
@@ -73,7 +75,7 @@ void mozilla_dump_image(void* bytes, int width, int height, int bytepp,
     // TODO more flexible; parse string?
     switch (bytepp) {
     case 2:
-        format = SurfaceFormat::R5G6B5;
+        format = SurfaceFormat::R5G6B5_UINT16;
         break;
     case 4:
     default:
@@ -395,7 +397,7 @@ IsSafeImageTransformComponent(gfxFloat aValue)
   return aValue >= -32768 && aValue <= 32767;
 }
 
-#if !defined(MOZ_GFX_OPTIMIZE_MOBILE) && !defined(MOZ_WIDGET_COCOA)
+#if !defined(MOZ_GFX_OPTIMIZE_MOBILE)
 /**
  * This returns the fastest operator to use for solid surfaces which have no
  * alpha channel or their alpha channel is uniformly opaque.
@@ -464,7 +466,7 @@ CreateSamplingRestrictedDrawable(gfxDrawable* aDrawable,
     RefPtr<gfxDrawable> drawable = new gfxSurfaceDrawable(surface, size, gfxMatrix::Translation(-needed.TopLeft()));
     return drawable.forget();
 }
-#endif // !MOZ_GFX_OPTIMIZE_MOBILE && !MOZ_WIDGET_COCOA
+#endif // !MOZ_GFX_OPTIMIZE_MOBILE
 
 // working around cairo/pixman bug (bug 364968)
 // Our device-space-to-image-space transform may not be acceptable to pixman.
@@ -761,7 +763,7 @@ gfxUtils::DrawPixelSnapped(gfxContext*         aContext,
             // On Mobile, we don't ever want to do this; it has the potential for
             // allocating very large temporary surfaces, especially since we'll
             // do full-page snapshots often (see bug 749426).
-#if !defined(MOZ_GFX_OPTIMIZE_MOBILE) && !defined(MOZ_WIDGET_COCOA)
+#if !defined(MOZ_GFX_OPTIMIZE_MOBILE)
             RefPtr<gfxDrawable> restrictedDrawable =
               CreateSamplingRestrictedDrawable(aDrawable, aContext,
                                                aRegion, aFormat);
@@ -1546,26 +1548,24 @@ gfxUtils::CopyAsDataURI(DrawTarget* aDT)
   }
 }
 
-/* static */ void
+/* static */ UniquePtr<uint8_t[]>
 gfxUtils::GetImageBuffer(gfx::DataSourceSurface* aSurface,
                          bool aIsAlphaPremultiplied,
-                         uint8_t** outImageBuffer,
                          int32_t* outFormat)
 {
-    *outImageBuffer = nullptr;
     *outFormat = 0;
 
     DataSourceSurface::MappedSurface map;
     if (!aSurface->Map(DataSourceSurface::MapType::READ, &map))
-        return;
+        return nullptr;
 
     uint32_t bufferSize = aSurface->GetSize().width * aSurface->GetSize().height * 4;
-    uint8_t* imageBuffer = new (fallible) uint8_t[bufferSize];
+    auto imageBuffer = MakeUniqueFallible<uint8_t[]>(bufferSize);
     if (!imageBuffer) {
         aSurface->Unmap();
-        return;
+        return nullptr;
     }
-    memcpy(imageBuffer, map.mData, bufferSize);
+    memcpy(imageBuffer.get(), map.mData, bufferSize);
 
     aSurface->Unmap();
 
@@ -1576,12 +1576,12 @@ gfxUtils::GetImageBuffer(gfx::DataSourceSurface* aSurface,
         // Yes, it is THAT silly.
         // Except for different lossy conversions by color,
         // we could probably just change the label, and not change the data.
-        gfxUtils::ConvertBGRAtoRGBA(imageBuffer, bufferSize);
+        gfxUtils::ConvertBGRAtoRGBA(imageBuffer.get(), bufferSize);
         format = imgIEncoder::INPUT_FORMAT_RGBA;
     }
 
-    *outImageBuffer = imageBuffer;
     *outFormat = format;
+    return imageBuffer;
 }
 
 /* static */ nsresult
@@ -1597,15 +1597,14 @@ gfxUtils::GetInputStream(gfx::DataSourceSurface* aSurface,
     if (!encoder)
         return NS_ERROR_FAILURE;
 
-    nsAutoArrayPtr<uint8_t> imageBuffer;
     int32_t format = 0;
-    GetImageBuffer(aSurface, aIsAlphaPremultiplied, getter_Transfers(imageBuffer), &format);
+    UniquePtr<uint8_t[]> imageBuffer = GetImageBuffer(aSurface, aIsAlphaPremultiplied, &format);
     if (!imageBuffer)
         return NS_ERROR_FAILURE;
 
     return dom::ImageEncoder::GetInputStream(aSurface->GetSize().width,
                                              aSurface->GetSize().height,
-                                             imageBuffer, format,
+                                             imageBuffer.get(), format,
                                              encoder, aEncoderOptions, outStream);
 }
 
@@ -1672,18 +1671,6 @@ gfxUtils::DumpDisplayList() {
 
 FILE *gfxUtils::sDumpPaintFile = stderr;
 
-#ifdef MOZ_DUMP_PAINTING
-bool gfxUtils::sDumpPainting = getenv("MOZ_DUMP_PAINT") != 0;
-bool gfxUtils::sDumpPaintingIntermediate = getenv("MOZ_DUMP_PAINT_INTERMEDIATE") != 0;
-bool gfxUtils::sDumpPaintingToFile = getenv("MOZ_DUMP_PAINT_TO_FILE") != 0;
-bool gfxUtils::sDumpPaintItems = getenv("MOZ_DUMP_PAINT_ITEMS") != 0;
-#else
-bool gfxUtils::sDumpPainting = false;
-bool gfxUtils::sDumpPaintingIntermediate = false;
-bool gfxUtils::sDumpPaintingToFile = false;
-bool gfxUtils::sDumpPaintItems = false;
-#endif
-
 namespace mozilla {
 namespace gfx {
 
diff --git a/gfx/thebes/gfxUtils.h b/gfx/thebes/gfxUtils.h
index 1058dd58cd..a90987445b 100644
--- a/gfx/thebes/gfxUtils.h
+++ b/gfx/thebes/gfxUtils.h
@@ -10,15 +10,16 @@
 #include "imgIContainer.h"
 #include "mozilla/gfx/2D.h"
 #include "mozilla/RefPtr.h"
+#include "mozilla/UniquePtr.h"
 #include "nsColor.h"
 #include "nsPrintfCString.h"
+#include "nsRegionFwd.h"
 #include "mozilla/gfx/Rect.h"
 
 class gfxASurface;
 class gfxDrawable;
 class nsIInputStream;
 class nsIGfxInfo;
-class nsIntRegion;
 class nsIPresShell;
 
 namespace mozilla {
@@ -282,10 +283,9 @@ public:
     static nsCString GetAsDataURI(DrawTarget* aDT);
     static nsCString GetAsLZ4Base64Str(DataSourceSurface* aSourceSurface);
 
-    static void GetImageBuffer(DataSourceSurface* aSurface,
-                               bool aIsAlphaPremultiplied,
-                               uint8_t** outImageBuffer,
-                               int32_t* outFormat);
+    static mozilla::UniquePtr<uint8_t[]> GetImageBuffer(DataSourceSurface* aSurface,
+                                                        bool aIsAlphaPremultiplied,
+                                                        int32_t* outFormat);
 
     static nsresult GetInputStream(DataSourceSurface* aSurface,
                                    bool aIsAlphaPremultiplied,
@@ -305,10 +305,6 @@ public:
 
     static bool DumpDisplayList();
 
-    static bool sDumpPainting;
-    static bool sDumpPaintingIntermediate;
-    static bool sDumpPaintingToFile;
-    static bool sDumpPaintItems;
     static FILE* sDumpPaintFile;
 };
 
diff --git a/gfx/thebes/gfxWindowsPlatform.cpp b/gfx/thebes/gfxWindowsPlatform.cpp
index da45b650c8..745f04b260 100644
--- a/gfx/thebes/gfxWindowsPlatform.cpp
+++ b/gfx/thebes/gfxWindowsPlatform.cpp
@@ -100,11 +100,13 @@ DCFromDrawTarget::DCFromDrawTarget(DrawTarget& aDrawTarget)
         cairo_win32_scaled_font_select_font(scaled, mDC);
       }
     }
-    if (!mDC) {
-      mDC = GetDC(nullptr);
-      SetGraphicsMode(mDC, GM_ADVANCED);
-      mNeedsRelease = true;
-    }
+  }
+
+  if (!mDC) {
+    // Get the whole screen DC:
+    mDC = GetDC(nullptr);
+    SetGraphicsMode(mDC, GM_ADVANCED);
+    mNeedsRelease = true;
   }
 }
 
@@ -193,7 +195,7 @@ public:
         IDXGIAdapter *DXGIAdapter;
 
         HMODULE gdi32Handle;
-        PFND3DKMTQS queryD3DKMTStatistics;
+        PFND3DKMTQS queryD3DKMTStatistics = nullptr;
 
         // GPU memory reporting is not available before Windows 7
         if (!IsWin7OrLater())
@@ -686,10 +688,13 @@ gfxPlatformFontList*
 gfxWindowsPlatform::CreatePlatformFontList()
 {
     gfxPlatformFontList *pfl;
+
 #ifdef CAIRO_HAS_DWRITE_FONT
     // bug 630201 - older pre-RTM versions of Direct2D/DirectWrite cause odd
     // crashers so blacklist them altogether
-    if (IsNotWin7PreRTM() && GetDWriteFactory()) {
+    if (IsNotWin7PreRTM() && GetDWriteFactory() &&
+        // Skia doesn't support DirectWrite fonts yet.
+       (gfxPlatform::GetDefaultContentBackend() != BackendType::SKIA)) {
         pfl = new gfxDWriteFontList();
         if (NS_SUCCEEDED(pfl->InitFontList())) {
             return pfl;
@@ -1057,26 +1062,26 @@ gfxFontEntry*
 gfxWindowsPlatform::LookupLocalFont(const nsAString& aFontName,
                                     uint16_t aWeight,
                                     int16_t aStretch,
-                                    bool aItalic)
+                                    uint8_t aStyle)
 {
     return gfxPlatformFontList::PlatformFontList()->LookupLocalFont(aFontName,
                                                                     aWeight,
                                                                     aStretch,
-                                                                    aItalic);
+                                                                    aStyle);
 }
 
 gfxFontEntry* 
 gfxWindowsPlatform::MakePlatformFont(const nsAString& aFontName,
                                      uint16_t aWeight,
                                      int16_t aStretch,
-                                     bool aItalic,
+                                     uint8_t aStyle,
                                      const uint8_t* aFontData,
                                      uint32_t aLength)
 {
     return gfxPlatformFontList::PlatformFontList()->MakePlatformFont(aFontName,
                                                                      aWeight,
                                                                      aStretch,
-                                                                     aItalic,
+                                                                     aStyle,
                                                                      aFontData,
                                                                      aLength);
 }
@@ -1870,7 +1875,7 @@ bool DoesD3D11TextureSharingWorkInternal(ID3D11Device *device, DXGI_FORMAT forma
 
   // This if(FAILED()) is the one that actually fails on systems affected by bug 1083071.
   if (FAILED(device->CreateShaderResourceView(sharedTexture, NULL, getter_AddRefs(sharedView)))) {
-    gfxCriticalError(CriticalLog::DefaultOptions(false)) << "CreateShaderResourceView failed for format" << format;
+    gfxCriticalNote << "CreateShaderResourceView failed for format" << format;
     return false;
   }
 
@@ -1930,6 +1935,10 @@ gfxWindowsPlatform::CheckD3D11Support(bool* aCanUseHardware)
     *aCanUseHardware = false;
     return FeatureStatus::Available;
   }
+  if (gfxPrefs::LayersAccelerationForceEnabled()) {
+    *aCanUseHardware = true;
+    return FeatureStatus::Available;
+  }
 
   if (nsCOMPtr<nsIGfxInfo> gfxInfo = services::GetGfxInfo()) {
     int32_t status;
@@ -2443,12 +2452,36 @@ public:
     public:
       D3DVsyncDisplay()
         : mVsyncEnabledLock("D3DVsyncEnabledLock")
+        , mPrevVsync(TimeStamp::Now())
         , mVsyncEnabled(false)
       {
         mVsyncThread = new base::Thread("WindowsVsyncThread");
         const double rate = 1000 / 60.0;
         mSoftwareVsyncRate = TimeDuration::FromMilliseconds(rate);
         MOZ_RELEASE_ASSERT(mVsyncThread->Start(), "Could not start Windows vsync thread");
+        SetVsyncRate();
+      }
+
+      void SetVsyncRate()
+      {
+        if (!DwmCompositionEnabled()) {
+          mVsyncRate = TimeDuration::FromMilliseconds(1000.0 / 60.0);
+          return;
+        }
+
+        DWM_TIMING_INFO vblankTime;
+        // Make sure to init the cbSize, otherwise GetCompositionTiming will fail
+        vblankTime.cbSize = sizeof(DWM_TIMING_INFO);
+        HRESULT hr = WinUtils::dwmGetCompositionTimingInfoPtr(0, &vblankTime);
+        if (SUCCEEDED(hr)) {
+          UNSIGNED_RATIO refreshRate = vblankTime.rateRefresh;
+          // We get the rate in hertz / time, but we want the rate in ms.
+          float rate = ((float) refreshRate.uiDenominator
+                       / (float) refreshRate.uiNumerator) * 1000;
+          mVsyncRate = TimeDuration::FromMilliseconds(rate);
+        } else {
+          mVsyncRate = TimeDuration::FromMilliseconds(1000.0 / 60.0);
+        }
       }
 
       virtual void EnableVsync() override
@@ -2486,6 +2519,11 @@ public:
         return mVsyncEnabled;
       }
 
+      virtual TimeDuration GetVsyncRate() override
+      {
+        return mVsyncRate;
+      }
+
       void ScheduleSoftwareVsync(TimeStamp aVsyncTimestamp)
       {
         MOZ_ASSERT(IsInVsyncThread());
@@ -2502,6 +2540,53 @@ public:
             delay.ToMilliseconds());
       }
 
+      TimeStamp GetAdjustedVsyncTimeStamp(LARGE_INTEGER& aFrequency,
+                                          QPC_TIME& aQpcVblankTime)
+      {
+        TimeStamp vsync = TimeStamp::Now();
+        LARGE_INTEGER qpcNow;
+        QueryPerformanceCounter(&qpcNow);
+
+        const int microseconds = 1000000;
+        int64_t adjust = qpcNow.QuadPart - aQpcVblankTime;
+        int64_t usAdjust = (adjust * microseconds) / aFrequency.QuadPart;
+        vsync -= TimeDuration::FromMicroseconds((double) usAdjust);
+
+        if (IsWin10OrLater()) {
+          // On Windows 10 and on, DWMGetCompositionTimingInfo, mostly
+          // reports the upcoming vsync time, which is in the future.
+          // It can also sometimes report a vblank time in the past.
+          // Since large parts of Gecko assume TimeStamps can't be in future,
+          // use the previous vsync.
+
+          // Windows 10 and Intel HD vsync timestamps are messy and
+          // all over the place once in a while. Most of the time,
+          // it reports the upcoming vsync. Sometimes, that upcoming
+          // vsync is in the past. Sometimes that upcoming vsync is before
+          // the previously seen vsync. Sometimes, the previous vsync
+          // is still in the future. In these error cases,
+          // we try to normalize to Now().
+          TimeStamp upcomingVsync = vsync;
+          if (upcomingVsync < mPrevVsync) {
+            // Windows can report a vsync that's before
+            // the previous one. So update it to sometime in the future.
+            upcomingVsync = TimeStamp::Now() + TimeDuration::FromMilliseconds(1);
+          }
+
+          vsync = mPrevVsync;
+          mPrevVsync = upcomingVsync;
+        }
+        // On Windows 7 and 8, DwmFlush wakes up AFTER qpcVBlankTime
+        // from DWMGetCompositionTimingInfo. We can return the adjusted vsync.
+
+        // Once in a while, the reported vsync timestamp can be in the future.
+        // Normalize the reported timestamp to now.
+        if (vsync >= TimeStamp::Now()) {
+          vsync = TimeStamp::Now();
+        }
+        return vsync;
+      }
+
       void VBlankLoop()
       {
         MOZ_ASSERT(IsInVsyncThread());
@@ -2511,12 +2596,9 @@ public:
         // Make sure to init the cbSize, otherwise GetCompositionTiming will fail
         vblankTime.cbSize = sizeof(DWM_TIMING_INFO);
 
-        LARGE_INTEGER qpcNow;
         LARGE_INTEGER frequency;
         QueryPerformanceFrequency(&frequency);
         TimeStamp vsync = TimeStamp::Now();
-        TimeStamp previousVsync = vsync;
-        const int microseconds = 1000000;
 
         for (;;) {
           { // scope lock
@@ -2524,12 +2606,9 @@ public:
             if (!mVsyncEnabled) return;
           }
 
-          if (previousVsync > vsync) {
-            vsync = TimeStamp::Now();
-            NS_WARNING("Previous vsync timestamp is ahead of the calculated vsync timestamp.");
-          }
-
-          previousVsync = vsync;
+          // Large parts of gecko assume that the refresh driver timestamp
+          // must be <= Now() and cannot be in the future.
+          MOZ_ASSERT(vsync <= TimeStamp::Now());
           Display::NotifyVsync(vsync);
 
           // DwmComposition can be dynamically enabled/disabled
@@ -2547,13 +2626,7 @@ public:
           HRESULT hr = WinUtils::dwmGetCompositionTimingInfoPtr(0, &vblankTime);
           vsync = TimeStamp::Now();
           if (SUCCEEDED(hr)) {
-            QueryPerformanceCounter(&qpcNow);
-            // Adjust the timestamp to be the vsync timestamp since when
-            // DwmFlush wakes up and when the actual vsync occurred are not the
-            // same.
-            int64_t adjust = qpcNow.QuadPart - vblankTime.qpcVBlank;
-            int64_t usAdjust = (adjust * microseconds) / frequency.QuadPart;
-            vsync -= TimeDuration::FromMicroseconds((double) usAdjust);
+            vsync = GetAdjustedVsyncTimeStamp(frequency, vblankTime.qpcVBlank);
           }
         } // end for
       }
@@ -2573,8 +2646,10 @@ public:
       }
 
       TimeDuration mSoftwareVsyncRate;
+      TimeStamp mPrevVsync; // Only used on Windows 10
       Monitor mVsyncEnabledLock;
       base::Thread* mVsyncThread;
+      TimeDuration mVsyncRate;
       bool mVsyncEnabled;
   }; // end d3dvsyncdisplay
 
diff --git a/gfx/thebes/gfxWindowsPlatform.h b/gfx/thebes/gfxWindowsPlatform.h
index c3183830f4..fa6da9c01c 100644
--- a/gfx/thebes/gfxWindowsPlatform.h
+++ b/gfx/thebes/gfxWindowsPlatform.h
@@ -192,7 +192,7 @@ public:
     virtual gfxFontEntry* LookupLocalFont(const nsAString& aFontName,
                                           uint16_t aWeight,
                                           int16_t aStretch,
-                                          bool aItalic);
+                                          uint8_t aStyle);
 
     /**
      * Activate a platform font (needed to support @font-face src url() )
@@ -200,7 +200,7 @@ public:
     virtual gfxFontEntry* MakePlatformFont(const nsAString& aFontName,
                                            uint16_t aWeight,
                                            int16_t aStretch,
-                                           bool aItalic,
+                                           uint8_t aStyle,
                                            const uint8_t* aFontData,
                                            uint32_t aLength);
 
diff --git a/gfx/thebes/gfxWindowsSurface.cpp b/gfx/thebes/gfxWindowsSurface.cpp
index 868d5efa6d..d219a454d5 100644
--- a/gfx/thebes/gfxWindowsSurface.cpp
+++ b/gfx/thebes/gfxWindowsSurface.cpp
@@ -31,7 +31,7 @@ gfxWindowsSurface::gfxWindowsSurface(HDC dc, uint32_t flags) :
         Init(cairo_win32_printing_surface_create(mDC));
         mForPrinting = true;
         if (!mSurfaceValid) {
-            gfxCriticalError(gfxCriticalError::DefaultOptions(false)) << "Invalid printing surface";
+            gfxCriticalNote << "Invalid printing surface";
         }
     } else
 #endif
@@ -59,8 +59,9 @@ gfxWindowsSurface::gfxWindowsSurface(const mozilla::gfx::IntSize& realSize, gfxI
     if (!CheckSurfaceSize(size))
         MakeInvalid(size);
 
-    cairo_surface_t *surf = cairo_win32_surface_create_with_dib((cairo_format_t)(int)imageFormat,
-                                                                size.width, size.height);
+    cairo_format_t cformat = gfxImageFormatToCairoFormat(imageFormat);
+    cairo_surface_t *surf =
+        cairo_win32_surface_create_with_dib(cformat, size.width, size.height);
 
     Init(surf);
 
@@ -79,8 +80,10 @@ gfxWindowsSurface::gfxWindowsSurface(HDC dc, const mozilla::gfx::IntSize& realSi
     if (!CheckSurfaceSize(size))
         MakeInvalid(size);
 
-    cairo_surface_t *surf = cairo_win32_surface_create_with_ddb(dc, (cairo_format_t)(int)imageFormat,
-                                                                size.width, size.height);
+    cairo_format_t cformat = gfxImageFormatToCairoFormat(imageFormat);
+    cairo_surface_t *surf =
+        cairo_win32_surface_create_with_ddb(dc, cformat,
+                                            size.width, size.height);
 
     Init(surf);
 
@@ -138,9 +141,11 @@ gfxWindowsSurface::CreateSimilarSurface(gfxContentType aContent,
         // a surface that's the result of create_similar(gfxContentType::COLOR_ALPHA)
         // (e.g. a backbuffer for the window) --- that new surface *would*
         // have a DIB.
-        surface =
-          cairo_win32_surface_create_with_dib((cairo_format_t)(int)gfxPlatform::GetPlatform()->OptimalFormatForContent(aContent),
-                                              aSize.width, aSize.height);
+        gfxImageFormat gformat =
+            gfxPlatform::GetPlatform()->OptimalFormatForContent(aContent);
+        cairo_format_t cformat = gfxImageFormatToCairoFormat(gformat);
+        surface = cairo_win32_surface_create_with_dib(cformat, aSize.width,
+                                                      aSize.height);
     } else {
         surface =
           cairo_surface_create_similar(mSurface, (cairo_content_t)(int)aContent,
diff --git a/gfx/thebes/gfxXlibNativeRenderer.cpp b/gfx/thebes/gfxXlibNativeRenderer.cpp
index 6f5abcae96..d048652b77 100644
--- a/gfx/thebes/gfxXlibNativeRenderer.cpp
+++ b/gfx/thebes/gfxXlibNativeRenderer.cpp
@@ -352,7 +352,7 @@ CreateTempXlibSurface (cairo_surface_t* cairoTarget,
         } else if (cairoTargetType == CAIRO_SURFACE_TYPE_IMAGE || drawTarget) {
             gfxImageFormat imageFormat =
                 drawTarget ? SurfaceFormatToImageFormat(drawTarget->GetFormat()) :
-                    (gfxImageFormat)cairo_image_surface_get_format(cairoTarget);
+                    gfxCairoFormatToImageFormat(cairo_image_surface_get_format(cairoTarget));
             target_visual = gfxXlibSurface::FindVisual(screen, imageFormat);
             Display *dpy = DisplayOfScreen(screen);
             if (target_visual) {
diff --git a/gfx/thebes/gfxXlibSurface.cpp b/gfx/thebes/gfxXlibSurface.cpp
index 5132a22829..f86c030d8a 100644
--- a/gfx/thebes/gfxXlibSurface.cpp
+++ b/gfx/thebes/gfxXlibSurface.cpp
@@ -523,7 +523,6 @@ gfxXlibSurface::FindVisual(Screen *screen, gfxImageFormat format)
             blue_mask = 0x1f;
             break;
         case gfxImageFormat::A8:
-        case gfxImageFormat::A1:
         default:
             return nullptr;
     }
@@ -567,8 +566,6 @@ gfxXlibSurface::FindRenderFormat(Display *dpy, gfxImageFormat format)
         }
         case gfxImageFormat::A8:
             return XRenderFindStandardFormat (dpy, PictStandardA8);
-        case gfxImageFormat::A1:
-            return XRenderFindStandardFormat (dpy, PictStandardA1);
         default:
             break;
     }
diff --git a/gfx/thebes/moz.build b/gfx/thebes/moz.build
index 845a85092c..408d314a42 100644
--- a/gfx/thebes/moz.build
+++ b/gfx/thebes/moz.build
@@ -15,6 +15,7 @@ EXPORTS += [
     'gfxColor.h',
     'gfxContext.h',
     'gfxDrawable.h',
+    'gfxEnv.h',
     'gfxFailure.h',
     'gfxFont.h',
     'gfxFontConstants.h',
diff --git a/gfx/ycbcr/YCbCrUtils.cpp b/gfx/ycbcr/YCbCrUtils.cpp
index ea3fb7c8f4..024520c788 100644
--- a/gfx/ycbcr/YCbCrUtils.cpp
+++ b/gfx/ycbcr/YCbCrUtils.cpp
@@ -28,7 +28,7 @@ GetYCbCrToRGBDestFormatAndSize(const layers::PlanarYCbCrData& aData,
   bool prescale = aSuggestedSize.width > 0 && aSuggestedSize.height > 0 &&
                   aSuggestedSize != aData.mPicSize;
 
-  if (aSuggestedFormat == SurfaceFormat::R5G6B5) {
+  if (aSuggestedFormat == SurfaceFormat::R5G6B5_UINT16) {
 #if defined(HAVE_YCBCR_TO_RGB565)
     if (prescale &&
         !IsScaleYCbCrToRGB565Fast(aData.mPicX,
@@ -88,7 +88,7 @@ ConvertYCbCrToRGB(const layers::PlanarYCbCrData& aData,
   // Convert from YCbCr to RGB now, scaling the image if needed.
   if (aDestSize != aData.mPicSize) {
 #if defined(HAVE_YCBCR_TO_RGB565)
-    if (aDestFormat == SurfaceFormat::R5G6B5) {
+    if (aDestFormat == SurfaceFormat::R5G6B5_UINT16) {
       ScaleYCbCrToRGB565(aData.mYChannel,
                          aData.mCbChannel,
                          aData.mCrChannel,
@@ -122,7 +122,7 @@ ConvertYCbCrToRGB(const layers::PlanarYCbCrData& aData,
                         FILTER_BILINEAR);
   } else { // no prescale
 #if defined(HAVE_YCBCR_TO_RGB565)
-    if (aDestFormat == SurfaceFormat::R5G6B5) {
+    if (aDestFormat == SurfaceFormat::R5G6B5_UINT16) {
       ConvertYCbCrToRGB565(aData.mYChannel,
                            aData.mCbChannel,
                            aData.mCrChannel,
diff --git a/image/BMPFileHeaders.h b/image/BMPFileHeaders.h
deleted file mode 100644
index dc762f9ecb..0000000000
--- a/image/BMPFileHeaders.h
+++ /dev/null
@@ -1,156 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef mozilla_image_BMPFileHeaders_h
-#define mozilla_image_BMPFileHeaders_h
-
-#include <stddef.h>
-#include <stdint.h>
-
-namespace mozilla {
-namespace image {
-
-// This is the real BIH size (as contained in the bihsize field of
-// BMPFILEHEADER).
-struct BIH_LENGTH {
-  enum {
-    OS2 = 12,
-    WIN_V3 = 40,
-    WIN_V5 = 124
-  };
-};
-
-struct BIH_INTERNAL_LENGTH {
-  enum {
-    OS2 = 8,
-    WIN_V3 = 36,
-    WIN_V5 = 120
-  };
-};
-
-struct BMPFILEHEADER {
-  char signature[2];   // String "BM"
-  uint32_t filesize;
-  int32_t reserved;    // Zero
-  uint32_t dataoffset; // Offset to raster data
-
-  uint32_t bihsize;
-
-  // The length of the bitmap file header as defined in the BMP spec.
-  static const size_t LENGTH = 14;
-
-  // Internally we store the bitmap file header with an additional 4 bytes which
-  // is used to store the bitmap information header size.
-  static const size_t INTERNAL_LENGTH = 18;
-};
-
-struct BMP_HEADER_LENGTH {
-  enum {
-    OS2 = BMPFILEHEADER::INTERNAL_LENGTH + BIH_INTERNAL_LENGTH::OS2,
-    WIN_V3 = BMPFILEHEADER::INTERNAL_LENGTH + BIH_INTERNAL_LENGTH::WIN_V3,
-    WIN_V5 = BMPFILEHEADER::INTERNAL_LENGTH + BIH_INTERNAL_LENGTH::WIN_V5
-  };
-};
-
-struct xyz {
-  int32_t x, y, z;
-};
-
-struct xyzTriple {
-  xyz r, g, b;
-};
-
-struct BITMAPV5HEADER {
-  int32_t width;             // Uint16 in OS/2 BMPs
-  int32_t height;            // Uint16 in OS/2 BMPs
-  uint16_t planes;           // =1
-  uint16_t bpp;              // Bits per pixel.
-  // The rest of the header is not available in OS/2 BMP Files
-  uint32_t compression;      // 0=no compression 1=8bit RLE 2=4bit RLE
-  uint32_t image_size;       // (compressed) image size. Can be 0 if
-                             // compression==0
-  uint32_t xppm;             // Pixels per meter, horizontal
-  uint32_t yppm;             // Pixels per meter, vertical
-  uint32_t colors;           // Used Colors
-  uint32_t important_colors; // Number of important colors. 0=all
-  uint32_t red_mask;         // Bits used for red component
-  uint32_t green_mask;       // Bits used for green component
-  uint32_t blue_mask;        // Bits used for blue component
-  uint32_t alpha_mask;       // Bits used for alpha component
-  uint32_t color_space;      // 0x73524742=LCS_sRGB ...
-  // These members are unused unless color_space == LCS_CALIBRATED_RGB
-  xyzTriple white_point;     // Logical white point
-  uint32_t gamma_red;        // Red gamma component
-  uint32_t gamma_green;      // Green gamma component
-  uint32_t gamma_blue;       // Blue gamma component
-  uint32_t intent;           // Rendering intent
-  // These members are unused unless color_space == LCS_PROFILE_*
-  uint32_t profile_offset;   // Offset to profile data in bytes
-  uint32_t profile_size;     // Size of profile data in bytes
-  uint32_t reserved;         // =0
-
-  static const uint32_t COLOR_SPACE_LCS_SRGB = 0x73524742;
-};
-
-struct colorTable {
-  uint8_t red;
-  uint8_t green;
-  uint8_t blue;
-};
-
-struct bitFields {
-  uint32_t red;
-  uint32_t green;
-  uint32_t blue;
-  uint8_t redLeftShift;
-  uint8_t redRightShift;
-  uint8_t greenLeftShift;
-  uint8_t greenRightShift;
-  uint8_t blueLeftShift;
-  uint8_t blueRightShift;
-
-  // Length of the bitfields structure in the BMP file.
-  static const size_t LENGTH = 12;
-};
-
-struct BMPINFOHEADER {
-  // BMPINFOHEADER.compression definitions.
-  enum {
-    RGB = 0,
-    RLE8 = 1,
-    RLE4 = 2,
-    BITFIELDS = 3,
-
-    // ALPHABITFIELDS means no compression and specifies alpha bits. Valid only
-    // for 32bpp and 16bpp.
-    ALPHABITFIELDS = 4
-  };
-};
-
-// RLE escape codes.
-struct RLE {
-  enum {
-    ESCAPE = 0,
-    ESCAPE_EOL = 0,
-    ESCAPE_EOF = 1,
-    ESCAPE_DELTA = 2
-  };
-};
-
-/// enums for mState
-enum ERLEState {
-  eRLEStateInitial,
-  eRLEStateNeedSecondEscapeByte,
-  eRLEStateNeedXDelta,
-  eRLEStateNeedYDelta,        ///< mStateData will hold x delta
-  eRLEStateAbsoluteMode,      ///< mStateData will hold count of existing data
-                              ///< to read
-  eRLEStateAbsoluteModePadded ///< As above, but another byte of data has to
-                              ///< be read as padding
-};
-
-} // namespace image
-} // namespace mozilla
-
-#endif // mozilla_image_BMPFileHeaders_h
diff --git a/image/BMPHeaders.h b/image/BMPHeaders.h
new file mode 100644
index 0000000000..0fdc806bc1
--- /dev/null
+++ b/image/BMPHeaders.h
@@ -0,0 +1,38 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_image_BMPHeaders_h
+#define mozilla_image_BMPHeaders_h
+
+#include <stddef.h>
+#include <stdint.h>
+
+namespace mozilla {
+namespace image {
+namespace bmp {
+
+// The length of the file header as defined in the BMP spec.
+static const size_t FILE_HEADER_LENGTH = 14;
+
+// This lengths of the info header for the different BMP versions.
+struct InfoHeaderLength {
+  enum {
+    WIN_V2 = 12,
+    WIN_V3 = 40,
+    WIN_V4 = 108,
+    WIN_V5 = 124,
+
+    // OS2_V1 is omitted; it's the same as WIN_V2.
+    OS2_V2_MIN = 16,    // Minimum allowed value for OS2v2.
+    OS2_V2_MAX = 64,    // Maximum allowed value for OS2v2.
+
+    WIN_ICO = WIN_V3,
+  };
+};
+
+} // namespace bmp
+} // namespace image
+} // namespace mozilla
+
+#endif // mozilla_image_BMPHeaders_h
diff --git a/image/ClippedImage.cpp b/image/ClippedImage.cpp
index daa0d5cdef..468eb65d01 100644
--- a/image/ClippedImage.cpp
+++ b/image/ClippedImage.cpp
@@ -11,7 +11,10 @@
 #include "gfxPlatform.h"
 #include "gfxUtils.h"
 #include "mozilla/gfx/2D.h"
+#include "mozilla/Move.h"
 #include "mozilla/RefPtr.h"
+#include "mozilla/Pair.h"
+#include "mozilla/Tuple.h"
 
 #include "ImageRegion.h"
 #include "Orientation.h"
@@ -37,22 +40,22 @@ public:
                             const nsIntSize& aSize,
                             const Maybe<SVGImageContext>& aSVGContext,
                             float aFrame,
-                            uint32_t aFlags)
+                            uint32_t aFlags,
+                            DrawResult aDrawResult)
     : mSurface(aSurface)
     , mSize(aSize)
+    , mSVGContext(aSVGContext)
     , mFrame(aFrame)
     , mFlags(aFlags)
+    , mDrawResult(aDrawResult)
   {
     MOZ_ASSERT(mSurface, "Must have a valid surface");
-    if (aSVGContext) {
-      mSVGContext.emplace(*aSVGContext);
-    }
   }
 
   bool Matches(const nsIntSize& aSize,
                const Maybe<SVGImageContext>& aSVGContext,
                float aFrame,
-               uint32_t aFlags)
+               uint32_t aFlags) const
   {
     return mSize == aSize &&
            mSVGContext == aSVGContext &&
@@ -60,17 +63,30 @@ public:
            mFlags == aFlags;
   }
 
-  already_AddRefed<SourceSurface> Surface() {
+  already_AddRefed<SourceSurface> Surface() const
+  {
     RefPtr<SourceSurface> surf(mSurface);
     return surf.forget();
   }
 
+  DrawResult GetDrawResult() const
+  {
+    return mDrawResult;
+  }
+
+  bool NeedsRedraw() const
+  {
+    return mDrawResult != DrawResult::SUCCESS &&
+           mDrawResult != DrawResult::BAD_IMAGE;
+  }
+
 private:
   RefPtr<SourceSurface>  mSurface;
   const nsIntSize        mSize;
   Maybe<SVGImageContext> mSVGContext;
   const float            mFrame;
   const uint32_t         mFlags;
+  const DrawResult       mDrawResult;
 };
 
 class DrawSingleTileCallback : public gfxDrawingCallback
@@ -86,6 +102,7 @@ public:
     , mSVGContext(aSVGContext)
     , mWhichFrame(aWhichFrame)
     , mFlags(aFlags)
+    , mDrawResult(DrawResult::NOT_READY)
   {
     MOZ_ASSERT(mImage, "Must have an image to clip");
   }
@@ -101,18 +118,22 @@ public:
 
     // Draw the image. |gfxCallbackDrawable| always calls this function with
     // arguments that guarantee we never tile.
-    mImage->DrawSingleTile(aContext, mSize, ImageRegion::Create(aFillRect),
-                           mWhichFrame, aFilter, mSVGContext, mFlags);
+    mDrawResult =
+      mImage->DrawSingleTile(aContext, mSize, ImageRegion::Create(aFillRect),
+                             mWhichFrame, aFilter, mSVGContext, mFlags);
 
     return true;
   }
 
+  DrawResult GetDrawResult() { return mDrawResult; }
+
 private:
   RefPtr<ClippedImage>        mImage;
   const nsIntSize               mSize;
   const Maybe<SVGImageContext>& mSVGContext;
   const uint32_t                mWhichFrame;
   const uint32_t                mFlags;
+  DrawResult                    mDrawResult;
 };
 
 ClippedImage::ClippedImage(Image* aImage,
@@ -217,7 +238,10 @@ NS_IMETHODIMP_(already_AddRefed<SourceSurface>)
 ClippedImage::GetFrame(uint32_t aWhichFrame,
                        uint32_t aFlags)
 {
-  return GetFrameInternal(mClip.Size(), Nothing(), aWhichFrame, aFlags);
+  DrawResult result;
+  RefPtr<SourceSurface> surface;
+  Tie(result, surface) = GetFrameInternal(mClip.Size(), Nothing(), aWhichFrame, aFlags);
+  return surface.forget();
 }
 
 NS_IMETHODIMP_(already_AddRefed<SourceSurface>)
@@ -230,34 +254,35 @@ ClippedImage::GetFrameAtSize(const IntSize& aSize,
   return GetFrame(aWhichFrame, aFlags);
 }
 
-already_AddRefed<SourceSurface>
+Pair<DrawResult, RefPtr<SourceSurface>>
 ClippedImage::GetFrameInternal(const nsIntSize& aSize,
                                const Maybe<SVGImageContext>& aSVGContext,
                                uint32_t aWhichFrame,
                                uint32_t aFlags)
 {
   if (!ShouldClip()) {
-    return InnerImage()->GetFrame(aWhichFrame, aFlags);
+    RefPtr<SourceSurface> surface = InnerImage()->GetFrame(aWhichFrame, aFlags);
+    return MakePair(surface ? DrawResult::SUCCESS : DrawResult::NOT_READY,
+                    Move(surface));
   }
 
   float frameToDraw = InnerImage()->GetFrameIndex(aWhichFrame);
-  if (!mCachedSurface || !mCachedSurface->Matches(aSize,
-                                                  aSVGContext,
-                                                  frameToDraw,
-                                                  aFlags)) {
+  if (!mCachedSurface ||
+      !mCachedSurface->Matches(aSize, aSVGContext, frameToDraw, aFlags) ||
+      mCachedSurface->NeedsRedraw()) {
     // Create a surface to draw into.
     RefPtr<DrawTarget> target = gfxPlatform::GetPlatform()->
       CreateOffscreenContentDrawTarget(IntSize(aSize.width, aSize.height),
                                        SurfaceFormat::B8G8R8A8);
     if (!target) {
       NS_ERROR("Could not create a DrawTarget");
-      return nullptr;
+      return MakePair(DrawResult::TEMPORARY_ERROR, RefPtr<SourceSurface>());
     }
 
     RefPtr<gfxContext> ctx = new gfxContext(target);
 
     // Create our callback.
-    RefPtr<gfxDrawingCallback> drawTileCallback =
+    RefPtr<DrawSingleTileCallback> drawTileCallback =
       new DrawSingleTileCallback(this, aSize, aSVGContext, aWhichFrame, aFlags);
     RefPtr<gfxDrawable> drawable =
       new gfxCallbackDrawable(drawTileCallback, aSize);
@@ -270,13 +295,15 @@ ClippedImage::GetFrameInternal(const nsIntSize& aSize,
                                imgIContainer::FLAG_CLAMP);
 
     // Cache the resulting surface.
-    mCachedSurface = new ClippedImageCachedSurface(target->Snapshot(), aSize,
-                                                   aSVGContext, frameToDraw,
-                                                   aFlags);
+    mCachedSurface =
+      MakeUnique<ClippedImageCachedSurface>(target->Snapshot(), aSize, aSVGContext,
+                                            frameToDraw, aFlags,
+                                            drawTileCallback->GetDrawResult());
   }
 
   MOZ_ASSERT(mCachedSurface, "Should have a cached surface now");
-  return mCachedSurface->Surface();
+  RefPtr<SourceSurface> surface = mCachedSurface->Surface();
+  return MakePair(mCachedSurface->GetDrawResult(), Move(surface));
 }
 
 NS_IMETHODIMP_(bool)
@@ -337,10 +364,13 @@ ClippedImage::Draw(gfxContext* aContext,
   if (MustCreateSurface(aContext, aSize, aRegion, aFlags)) {
     // Create a temporary surface containing a single tile of this image.
     // GetFrame will call DrawSingleTile internally.
-    RefPtr<SourceSurface> surface =
+    DrawResult result;
+    RefPtr<SourceSurface> surface;
+    Tie(result, surface) =
       GetFrameInternal(aSize, aSVGContext, aWhichFrame, aFlags);
     if (!surface) {
-      return DrawResult::TEMPORARY_ERROR;
+      MOZ_ASSERT(result != DrawResult::SUCCESS);
+      return result;
     }
 
     // Create a drawable from that surface.
@@ -351,7 +381,7 @@ ClippedImage::Draw(gfxContext* aContext,
     gfxUtils::DrawPixelSnapped(aContext, drawable, aSize, aRegion,
                                SurfaceFormat::B8G8R8A8, aFilter);
 
-    return DrawResult::SUCCESS;
+    return result;
   }
 
   return DrawSingleTile(aContext, aSize, aRegion, aWhichFrame,
diff --git a/image/ClippedImage.h b/image/ClippedImage.h
index 621d572d21..6b16f57496 100644
--- a/image/ClippedImage.h
+++ b/image/ClippedImage.h
@@ -10,6 +10,7 @@
 #include "mozilla/gfx/2D.h"
 #include "mozilla/Maybe.h"
 #include "mozilla/RefPtr.h"
+#include "mozilla/UniquePtr.h"
 
 namespace mozilla {
 namespace image {
@@ -68,7 +69,7 @@ protected:
   virtual ~ClippedImage();
 
 private:
-  already_AddRefed<SourceSurface>
+  Pair<DrawResult, RefPtr<SourceSurface>>
     GetFrameInternal(const nsIntSize& aSize,
                      const Maybe<SVGImageContext>& aSVGContext,
                      uint32_t aWhichFrame,
@@ -83,7 +84,7 @@ private:
                             uint32_t aFlags);
 
   // If we are forced to draw a temporary surface, we cache it here.
-  nsAutoPtr<ClippedImageCachedSurface> mCachedSurface;
+  UniquePtr<ClippedImageCachedSurface> mCachedSurface;
 
   nsIntRect   mClip;              // The region to clip to.
   Maybe<bool> mShouldClip;        // Memoized ShouldClip() if present.
diff --git a/image/DecodePool.cpp b/image/DecodePool.cpp
index 0834826380..f87c26646b 100644
--- a/image/DecodePool.cpp
+++ b/image/DecodePool.cpp
@@ -9,7 +9,6 @@
 
 #include "mozilla/ClearOnShutdown.h"
 #include "mozilla/Monitor.h"
-#include "nsAutoPtr.h"
 #include "nsCOMPtr.h"
 #include "nsIObserverService.h"
 #include "nsIThreadPool.h"
diff --git a/image/Downscaler.cpp b/image/Downscaler.cpp
index 43541e1d8e..db317c2547 100644
--- a/image/Downscaler.cpp
+++ b/image/Downscaler.cpp
@@ -57,6 +57,7 @@ Downscaler::ReleaseWindow()
 
 nsresult
 Downscaler::BeginFrame(const nsIntSize& aOriginalSize,
+                       const Maybe<nsIntRect>& aFrameRect,
                        uint8_t* aOutputBuffer,
                        bool aHasAlpha,
                        bool aFlipVertically /* = false */)
@@ -71,6 +72,17 @@ Downscaler::BeginFrame(const nsIntSize& aOriginalSize,
   MOZ_ASSERT(aOriginalSize.width > 0 && aOriginalSize.height > 0,
              "Invalid original size");
 
+  mFrameRect = aFrameRect.valueOr(nsIntRect(nsIntPoint(), aOriginalSize));
+  MOZ_ASSERT(mFrameRect.x >= 0 && mFrameRect.y >= 0 &&
+             mFrameRect.width > 0 && mFrameRect.height > 0,
+             "Frame rect must have positive components");
+  MOZ_ASSERT(nsIntRect(0, 0, aOriginalSize.width, aOriginalSize.height)
+               .Contains(mFrameRect),
+             "Frame rect must fit inside image");
+  MOZ_ASSERT_IF(!nsIntRect(0, 0, aOriginalSize.width, aOriginalSize.height)
+                  .IsEqualEdges(mFrameRect),
+                aHasAlpha);
+
   mOriginalSize = aOriginalSize;
   mScale = gfxSize(double(mOriginalSize.width) / mTargetSize.width,
                    double(mOriginalSize.height) / mTargetSize.height);
@@ -78,7 +90,6 @@ Downscaler::BeginFrame(const nsIntSize& aOriginalSize,
   mHasAlpha = aHasAlpha;
   mFlipVertically = aFlipVertically;
 
-  ResetForNextProgressivePass();
   ReleaseWindow();
 
   auto resizeMethod = skia::ImageOperations::RESIZE_LANCZOS3;
@@ -129,9 +140,22 @@ Downscaler::BeginFrame(const nsIntSize& aOriginalSize,
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
+  ResetForNextProgressivePass();
+
   return NS_OK;
 }
 
+void
+Downscaler::SkipToRow(int32_t aRow)
+{
+  if (mCurrentInLine < aRow) {
+    ClearRow();
+    do {
+      CommitRow();
+    } while (mCurrentInLine < aRow);
+  }
+}
+
 void
 Downscaler::ResetForNextProgressivePass()
 {
@@ -139,6 +163,9 @@ Downscaler::ResetForNextProgressivePass()
   mCurrentOutLine = 0;
   mCurrentInLine = 0;
   mLinesInBuffer = 0;
+
+  // If we have a vertical offset, commit rows to shift us past it.
+  SkipToRow(mFrameRect.y);
 }
 
 static void
@@ -199,6 +226,12 @@ Downscaler::CommitRow()
   }
 
   mCurrentInLine += 1;
+
+  // If we're at the end of the part of the original image that has data, commit
+  // rows to shift us to the end.
+  if (mCurrentInLine == (mFrameRect.y + mFrameRect.height)) {
+    SkipToRow(mOriginalSize.height - 1);
+  }
 }
 
 bool
diff --git a/image/Downscaler.h b/image/Downscaler.h
index 53dea0f0a2..907f12118a 100644
--- a/image/Downscaler.h
+++ b/image/Downscaler.h
@@ -12,10 +12,10 @@
 #ifndef mozilla_image_Downscaler_h
 #define mozilla_image_Downscaler_h
 
+#include "mozilla/Maybe.h"
 #include "mozilla/UniquePtr.h"
 #include "nsRect.h"
 
-
 namespace skia {
   class ConvolutionFilter1D;
 } // namespace skia
@@ -64,6 +64,9 @@ public:
    * Begins a new frame and reinitializes the Downscaler.
    *
    * @param aOriginalSize The original size of this frame, before scaling.
+   * @param aFrameRect The region of  the original image which has data.
+   *                   Every pixel outside @aFrameRect is considered blank and
+   *                   has zero alpha.
    * @param aOutputBuffer The buffer to which the Downscaler should write its
    *                      output; this is the same buffer where the Decoder
    *                      would write its output when not downscaling during
@@ -75,12 +78,16 @@ public:
    *                        the way they are stored in some image formats.
    */
   nsresult BeginFrame(const nsIntSize& aOriginalSize,
+                      const Maybe<nsIntRect>& aFrameRect,
                       uint8_t* aOutputBuffer,
                       bool aHasAlpha,
                       bool aFlipVertically = false);
 
   /// Retrieves the buffer into which the Decoder should write each row.
-  uint8_t* RowBuffer() { return mRowBuffer.get(); }
+  uint8_t* RowBuffer()
+  {
+    return mRowBuffer.get() + mFrameRect.x * sizeof(uint32_t);
+  }
 
   /// Clears the current row buffer (optionally starting at @aStartingAtCol).
   void ClearRow(uint32_t aStartingAtCol = 0);
@@ -104,9 +111,11 @@ public:
 private:
   void DownscaleInputLine();
   void ReleaseWindow();
+  void SkipToRow(int32_t aRow);
 
   nsIntSize mOriginalSize;
   nsIntSize mTargetSize;
+  nsIntRect mFrameRect;
   gfxSize mScale;
 
   uint8_t* mOutputBuffer;
@@ -147,7 +156,7 @@ public:
   const nsIntSize& TargetSize() const { return nsIntSize(); }
   const gfxSize& Scale() const { return gfxSize(1.0, 1.0); }
 
-  nsresult BeginFrame(const nsIntSize&, uint8_t*, bool, bool = false)
+  nsresult BeginFrame(const nsIntSize&, const Maybe<nsIntRect>&, uint8_t*, bool, bool = false)
   {
     return NS_ERROR_FAILURE;
   }
diff --git a/image/RasterImage.cpp b/image/RasterImage.cpp
index 0533db5f8b..5afe7a1a82 100644
--- a/image/RasterImage.cpp
+++ b/image/RasterImage.cpp
@@ -14,7 +14,6 @@
 #include "nsComponentManagerUtils.h"
 #include "nsError.h"
 #include "Decoder.h"
-#include "nsAutoPtr.h"
 #include "prenv.h"
 #include "prsystem.h"
 #include "ImageContainer.h"
diff --git a/image/ShutdownTracker.cpp b/image/ShutdownTracker.cpp
index e7bcb982d7..dd073d0119 100644
--- a/image/ShutdownTracker.cpp
+++ b/image/ShutdownTracker.cpp
@@ -6,7 +6,6 @@
 #include "ShutdownTracker.h"
 
 #include "mozilla/Services.h"
-#include "nsAutoPtr.h"
 #include "nsIObserver.h"
 #include "nsIObserverService.h"
 
diff --git a/image/SourceBuffer.h b/image/SourceBuffer.h
index c4e826dc1e..f006f71814 100644
--- a/image/SourceBuffer.h
+++ b/image/SourceBuffer.h
@@ -273,15 +273,13 @@ private:
       , mLength(0)
     {
       MOZ_ASSERT(aCapacity > 0, "Creating zero-capacity chunk");
-      mData = new (fallible) char[mCapacity];
+      mData.reset(new (fallible) char[mCapacity]);
     }
 
-    ~Chunk() { delete[] mData; }
-
     Chunk(Chunk&& aOther)
       : mCapacity(aOther.mCapacity)
       , mLength(aOther.mLength)
-      , mData(aOther.mData)
+      , mData(Move(aOther.mData))
     {
       aOther.mCapacity = aOther.mLength = 0;
       aOther.mData = nullptr;
@@ -291,7 +289,7 @@ private:
     {
       mCapacity = aOther.mCapacity;
       mLength = aOther.mLength;
-      mData = aOther.mData;
+      mData = Move(aOther.mData);
       aOther.mCapacity = aOther.mLength = 0;
       aOther.mData = nullptr;
       return *this;
@@ -304,7 +302,7 @@ private:
     char* Data() const
     {
       MOZ_ASSERT(mData, "Allocation failed but nobody checked for it");
-      return mData;
+      return mData.get();
     }
 
     void AddLength(size_t aAdditionalLength)
@@ -319,7 +317,7 @@ private:
 
     size_t mCapacity;
     size_t mLength;
-    char* mData;
+    UniquePtr<char[]> mData;
   };
 
   nsresult AppendChunk(Maybe<Chunk>&& aChunk);
diff --git a/image/SurfaceCache.cpp b/image/SurfaceCache.cpp
index ec18bc1849..8791cc0dfa 100644
--- a/image/SurfaceCache.cpp
+++ b/image/SurfaceCache.cpp
@@ -28,7 +28,6 @@
 #include "imgFrame.h"
 #include "Image.h"
 #include "LookupResult.h"
-#include "nsAutoPtr.h"
 #include "nsExpirationTracker.h"
 #include "nsHashKeys.h"
 #include "nsRefPtrHashtable.h"
diff --git a/image/decoders/icon/win/nsIconChannel.cpp b/image/decoders/icon/win/nsIconChannel.cpp
index 367d46beae..1ce4ee2e01 100644
--- a/image/decoders/icon/win/nsIconChannel.cpp
+++ b/image/decoders/icon/win/nsIconChannel.cpp
@@ -575,11 +575,11 @@ nsIconChannel::MakeInputStream(nsIInputStream** _retval, bool aNonBlocking)
                             colorHeader.biSizeImage +
                             maskHeader.biSizeImage;
 
-        char* buffer = new char[iconSize];
+        UniquePtr<char[]> buffer = MakeUnique<char[]>(iconSize);
         if (!buffer) {
           rv = NS_ERROR_OUT_OF_MEMORY;
         } else {
-          char* whereTo = buffer;
+          char* whereTo = buffer.get();
           int howMuch;
 
           // the data starts with an icon file header
@@ -640,7 +640,7 @@ nsIconChannel::MakeInputStream(nsIInputStream** _retval, bool aNonBlocking)
                               iconSize, iconSize, aNonBlocking);
               if (NS_SUCCEEDED(rv)) {
                 uint32_t written;
-                rv = outStream->Write(buffer, iconSize, &written);
+                rv = outStream->Write(buffer.get(), iconSize, &written);
                 if (NS_SUCCEEDED(rv)) {
                   NS_ADDREF(*_retval = inStream);
                 }
@@ -650,7 +650,6 @@ nsIconChannel::MakeInputStream(nsIInputStream** _retval, bool aNonBlocking)
             delete maskInfo;
           } // if we got mask bits
           delete colorInfo;
-          delete [] buffer;
         } // if we allocated the buffer
       } // if we got mask size
 
diff --git a/image/decoders/nsBMPDecoder.cpp b/image/decoders/nsBMPDecoder.cpp
index e8674dc047..26aa8fcde9 100644
--- a/image/decoders/nsBMPDecoder.cpp
+++ b/image/decoders/nsBMPDecoder.cpp
@@ -1,16 +1,91 @@
-/* vim:set tw=80 expandtab softtabstop=4 ts=4 sw=4: */
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-// I got the format description from http://www.daubnet.com/formats/BMP.html
-
-// This is a Cross-Platform BMP Decoder, which should work everywhere, including
-// Big-Endian machines like the PowerPC.
+// This is a cross-platform BMP Decoder, which should work everywhere,
+// including big-endian machines like the PowerPC.
+//
+// BMP is a format that has been extended multiple times. To understand the
+// decoder you need to understand this history. The summary of the history
+// below was determined from the following documents.
+//
+// - http://www.fileformat.info/format/bmp/egff.htm
+// - http://www.fileformat.info/format/os2bmp/egff.htm
+// - http://fileformats.archiveteam.org/wiki/BMP
+// - http://fileformats.archiveteam.org/wiki/OS/2_BMP
+// - https://en.wikipedia.org/wiki/BMP_file_format
+// - https://upload.wikimedia.org/wikipedia/commons/c/c4/BMPfileFormat.png
+//
+// WINDOWS VERSIONS OF THE BMP FORMAT
+// ----------------------------------
+// WinBMPv1.
+// - This version is no longer used and can be ignored.
+//
+// WinBMPv2.
+// - First is a 14 byte file header that includes: the magic number ("BM"),
+//   file size, and offset to the pixel data (|mDataOffset|).
+// - Next is a 12 byte info header which includes: the info header size
+//   (mBIHSize), width, height, number of color planes, and bits-per-pixel
+//   (|mBpp|) which must be 1, 4, 8 or 24.
+// - Next is the semi-optional color table, which has length 2^|mBpp| and has 3
+//   bytes per value (BGR). The color table is required if |mBpp| is 1, 4, or 8.
+// - Next is an optional gap.
+// - Next is the pixel data, which is pointed to by |mDataOffset|.
+//
+// WinBMPv3. This is the most widely used version.
+// - It changed the info header to 40 bytes by taking the WinBMPv2 info
+//   header, enlargening its width and height fields, and adding more fields
+//   including: a compression type (|mCompression|) and number of colors
+//   (|mNumColors|).
+// - The semi-optional color table is now 4 bytes per value (BGR0), and its
+//   length is |mNumColors|, or 2^|mBpp| if |mNumColors| is zero.
+// - |mCompression| can be RGB (i.e. no compression), RLE4 (if |mBpp|==4) or
+//   RLE8 (if |mBpp|==8) values.
+//
+// WinBMPv3-NT. A variant of WinBMPv3.
+// - It did not change the info header layout from WinBMPv3.
+// - |mBpp| can now be 16 or 32, in which case |mCompression| can be RGB or the
+//   new BITFIELDS value; in the latter case an additional 12 bytes of color
+//   bitfields follow the info header.
+//
+// WinBMPv4.
+// - It extended the info header to 108 bytes, including the 12 bytes of color
+//   mask data from WinBMPv3-NT, plus alpha mask data, and also color-space and
+//   gamma correction fields.
+//
+// WinBMPv5.
+// - It extended the info header to 124 bytes, adding color profile data.
+// - It also added an optional color profile table after the pixel data (and
+//   another optional gap).
+//
+// WinBMPv3-ICO. This is a variant of WinBMPv3.
+// - It's the BMP format used for BMP images within ICO files.
+// - The only difference with WinBMPv3 is that if an image is 32bpp and has no
+//   compression, then instead of treating the pixel data as 0RGB it is treated
+//   as ARGB, but only if one or more of the A values are non-zero.
+//
+// OS/2 VERSIONS OF THE BMP FORMAT
+// -------------------------------
+// OS2-BMPv1.
+// - Almost identical to WinBMPv2; the differences are basically ignorable.
+//
+// OS2-BMPv2.
+// - Similar to WinBMPv3.
+// - The info header is 64 bytes but can be reduced to as little as 16; any
+//   omitted fields are treated as zero. The first 40 bytes of these fields are
+//   nearly identical to the WinBMPv3 info header; the remaining 24 bytes are
+//   different.
+// - Also adds compression types "Huffman 1D" and "RLE24", which we don't
+//   support.
+// - We treat OS2-BMPv2 files as if they are WinBMPv3 (i.e. ignore the extra 24
+//   bytes in the info header), which in practice is good enough.
 
 #include <stdlib.h>
 
 #include "ImageLogging.h"
+#include "mozilla/Attributes.h"
 #include "mozilla/Endian.h"
 #include "mozilla/Likely.h"
 #include "nsBMPDecoder.h"
@@ -23,6 +98,69 @@ using namespace mozilla::gfx;
 
 namespace mozilla {
 namespace image {
+namespace bmp {
+
+struct Compression {
+  enum {
+    RGB = 0,
+    RLE8 = 1,
+    RLE4 = 2,
+    BITFIELDS = 3
+  };
+};
+
+// RLE escape codes and constants.
+struct RLE {
+  enum {
+    ESCAPE = 0,
+    ESCAPE_EOL = 0,
+    ESCAPE_EOF = 1,
+    ESCAPE_DELTA = 2,
+
+    SEGMENT_LENGTH = 2,
+    DELTA_LENGTH = 2
+  };
+};
+
+} // namespace bmp
+
+using namespace bmp;
+
+/// Sets the pixel data in aDecoded to the given values.
+/// @param aDecoded pointer to pixel to be set, will be incremented to point to
+/// the next pixel.
+static void
+SetPixel(uint32_t*& aDecoded, uint8_t aRed, uint8_t aGreen,
+         uint8_t aBlue, uint8_t aAlpha = 0xFF)
+{
+  *aDecoded++ = gfxPackedPixel(aAlpha, aRed, aGreen, aBlue);
+}
+
+static void
+SetPixel(uint32_t*& aDecoded, uint8_t idx,
+         const UniquePtr<ColorTableEntry[]>& aColors)
+{
+  SetPixel(aDecoded,
+           aColors[idx].mRed, aColors[idx].mGreen, aColors[idx].mBlue);
+}
+
+/// Sets two (or one if aCount = 1) pixels
+/// @param aDecoded where the data is stored. Will be moved 4 resp 8 bytes
+/// depending on whether one or two pixels are written.
+/// @param aData The values for the two pixels
+/// @param aCount Current count. Is decremented by one or two.
+static void
+Set4BitPixel(uint32_t*& aDecoded, uint8_t aData, uint32_t& aCount,
+             const UniquePtr<ColorTableEntry[]>& aColors)
+{
+  uint8_t idx = aData >> 4;
+  SetPixel(aDecoded, idx, aColors);
+  if (--aCount > 0) {
+    idx = aData & 0xF;
+    SetPixel(aDecoded, idx, aColors);
+    --aCount;
+  }
+}
 
 static PRLogModuleInfo*
 GetBMPLog()
@@ -34,969 +172,863 @@ GetBMPLog()
   return sBMPLog;
 }
 
-// Convert from row (1..height) to absolute line (0..height-1)
-#define LINE(row) ((mBIH.height < 0) ? (-mBIH.height - (row)) : ((row) - 1))
-#define PIXEL_OFFSET(row, col) (LINE(row) * mBIH.width + col)
+// The length of the mBIHSize field in the info header.
+static const uint32_t BIHSIZE_FIELD_LENGTH = 4;
 
-nsBMPDecoder::nsBMPDecoder(RasterImage* aImage)
+nsBMPDecoder::nsBMPDecoder(RasterImage* aImage, State aState, size_t aLength)
   : Decoder(aImage)
-  , mPos(0)
-  , mLOH(BMP_HEADER_LENGTH::WIN_V3)
+  , mLexer(Transition::To(aState, aLength))
+  , mIsWithinICO(false)
+  , mMayHaveTransparency(false)
+  , mDoesHaveTransparency(false)
   , mNumColors(0)
   , mColors(nullptr)
-  , mRow(nullptr)
-  , mRowBytes(0)
-  , mCurLine(1)  // Otherwise decoder will never start.
-  , mOldLine(1)
-  , mCurPos(0)
-  , mState(eRLEStateInitial)
-  , mStateData(0)
-  , mProcessedHeader(false)
-  , mUseAlphaData(false)
-  , mHaveAlphaData(false)
-{ }
+  , mBytesPerColor(0)
+  , mPreGapLength(0)
+  , mCurrentRow(0)
+  , mCurrentPos(0)
+  , mAbsoluteModeNumPixels(0)
+{
+}
+
+// Constructor for normal BMP files.
+nsBMPDecoder::nsBMPDecoder(RasterImage* aImage)
+  : nsBMPDecoder(aImage, State::FILE_HEADER, FILE_HEADER_LENGTH)
+{
+}
+
+// Constructor used for WinBMPv3-ICO files, which lack a file header.
+nsBMPDecoder::nsBMPDecoder(RasterImage* aImage, uint32_t aDataOffset)
+  : nsBMPDecoder(aImage, State::INFO_HEADER_SIZE, BIHSIZE_FIELD_LENGTH)
+{
+  SetIsWithinICO();
+
+  // Even though the file header isn't present in this case, the dataOffset
+  // field is set as if it is, and so we must increment mPreGapLength
+  // accordingly.
+  mPreGapLength += FILE_HEADER_LENGTH;
+
+  // This is the one piece of data we normally get from a BMP file header, so
+  // it must be provided via an argument.
+  mH.mDataOffset = aDataOffset;
+}
 
 nsBMPDecoder::~nsBMPDecoder()
 {
-  delete[] mColors;
-  if (mRow) {
-      moz_free(mRow);
-  }
 }
 
-// Sets whether or not the BMP will use alpha data
-void
-nsBMPDecoder::SetUseAlphaData(bool useAlphaData)
-{
-  mUseAlphaData = useAlphaData;
-}
-
-// Obtains the bits per pixel from the internal BIH header
+// Obtains the bits per pixel from the internal BIH header.
 int32_t
 nsBMPDecoder::GetBitsPerPixel() const
 {
-  return mBIH.bpp;
+  return mH.mBpp;
 }
 
-// Obtains the width from the internal BIH header
+// Obtains the width from the internal BIH header.
 int32_t
 nsBMPDecoder::GetWidth() const
 {
-  return mBIH.width;
+  return mH.mWidth;
 }
 
-// Obtains the abs-value of the height from the internal BIH header
+// Obtains the absolute value of the height from the internal BIH header.
+// If it's positive the bitmap is stored bottom to top, otherwise top to bottom.
 int32_t
 nsBMPDecoder::GetHeight() const
 {
-  return abs(mBIH.height);
+  return abs(mH.mHeight);
 }
 
-// Obtains the internal output image buffer
+// Obtains the internal output image buffer.
 uint32_t*
 nsBMPDecoder::GetImageData()
 {
   return reinterpret_cast<uint32_t*>(mImageData);
 }
 
-// Obtains the size of the compressed image resource
+// Obtains the size of the compressed image resource.
 int32_t
 nsBMPDecoder::GetCompressedImageSize() const
 {
-  // For everything except BMPINFOHEADER::RGB the header field must be defined
-  if (mBIH.compression != BMPINFOHEADER::RGB) {
-    return mBIH.image_size;
-  }
-
-  // mBIH.image_size isn't always filled for BMPINFOHEADER::RGB so calculate it
-  // manually. The pixel array size is calculated based on extra 4 byte
-  // boundary padding.
-  uint32_t rowSize = (mBIH.bpp * mBIH.width + 7) / 8; // + 7 to round up
-
-  // Pad to DWORD Boundary
-  if (rowSize % 4) {
-    rowSize += (4 - (rowSize % 4));
-  }
-
-  // The height should be the absolute value of what the height is in the BIH.
-  // If positive the bitmap is stored bottom to top, otherwise top to bottom
-  int32_t pixelArraySize = rowSize * GetHeight();
-  return pixelArraySize;
+  // In the RGB case mImageSize might not be set, so compute it manually.
+  MOZ_ASSERT(mPixelRowSize != 0);
+  return mH.mCompression == Compression::RGB
+       ? mPixelRowSize * GetHeight()
+       : mH.mImageSize;
 }
 
 void
 nsBMPDecoder::FinishInternal()
 {
-    // We shouldn't be called in error cases
-    MOZ_ASSERT(!HasError(), "Can't call FinishInternal on error!");
+  // We shouldn't be called in error cases.
+  MOZ_ASSERT(!HasError(), "Can't call FinishInternal on error!");
 
-    // We should never make multiple frames
-    MOZ_ASSERT(GetFrameCount() <= 1, "Multiple BMP frames?");
+  // We should never make multiple frames.
+  MOZ_ASSERT(GetFrameCount() <= 1, "Multiple BMP frames?");
 
-    // Send notifications if appropriate
-    if (!IsMetadataDecode() && HasSize()) {
+  // Send notifications if appropriate.
+  if (!IsMetadataDecode() && HasSize()) {
 
-        // Invalidate
-        nsIntRect r(0, 0, mBIH.width, GetHeight());
-        PostInvalidation(r);
+    // Invalidate.
+    nsIntRect r(0, 0, mH.mWidth, GetHeight());
+    PostInvalidation(r);
 
-        if (mUseAlphaData && mHaveAlphaData) {
-          PostFrameStop(Opacity::SOME_TRANSPARENCY);
-        } else {
-          PostFrameStop(Opacity::OPAQUE);
-        }
-        PostDecodeDone();
+    if (mDoesHaveTransparency) {
+      MOZ_ASSERT(mMayHaveTransparency);
+      PostFrameStop(Opacity::SOME_TRANSPARENCY);
+    } else {
+      PostFrameStop(Opacity::OPAQUE);
     }
+    PostDecodeDone();
+  }
 }
 
 // ----------------------------------------
 // Actual Data Processing
 // ----------------------------------------
 
-static void
-calcBitmask(uint32_t aMask, uint8_t& aBegin, uint8_t& aLength)
+void
+BitFields::Value::Set(uint32_t aMask)
 {
-    // find the rightmost 1
-    uint8_t pos;
-    bool started = false;
-    aBegin = aLength = 0;
-    for (pos = 0; pos <= 31; pos++) {
-        if (!started && (aMask & (1 << pos))) {
-            aBegin = pos;
-            started = true;
-        } else if (started && !(aMask & (1 << pos))) {
-            aLength = pos - aBegin;
-            break;
-        }
+  mMask = aMask;
+
+  // Handle this exceptional case first. The chosen values don't matter
+  // (because a mask of zero will always give a value of zero) except that
+  // mBitWidth:
+  // - shouldn't be zero, because that would cause an infinite loop in Get();
+  // - shouldn't be 5 or 8, because that could cause a false positive match in
+  //   IsR5G5B5() or IsR8G8B8().
+  if (mMask == 0x0) {
+    mRightShift = 0;
+    mBitWidth = 1;
+    return;
+  }
+
+  // Find the rightmost 1.
+  uint8_t i;
+  for (i = 0; i < 32; i++) {
+    if (mMask & (1 << i)) {
+      break;
     }
+  }
+  mRightShift = i;
+
+  // Now find the leftmost 1 in the same run of 1s. (If there are multiple runs
+  // of 1s -- which isn't valid -- we'll behave as if only the lowest run was
+  // present, which seems reasonable.)
+  for (i = i + 1; i < 32; i++) {
+    if (!(mMask & (1 << i))) {
+      break;
+    }
+  }
+  mBitWidth = i - mRightShift;
 }
 
-NS_METHOD
-nsBMPDecoder::CalcBitShift()
+MOZ_ALWAYS_INLINE uint8_t
+BitFields::Value::Get(uint32_t aValue) const
 {
-    uint8_t begin, length;
-    // red
-    calcBitmask(mBitFields.red, begin, length);
-    mBitFields.redRightShift = begin;
-    mBitFields.redLeftShift = 8 - length;
-    // green
-    calcBitmask(mBitFields.green, begin, length);
-    mBitFields.greenRightShift = begin;
-    mBitFields.greenLeftShift = 8 - length;
-    // blue
-    calcBitmask(mBitFields.blue, begin, length);
-    mBitFields.blueRightShift = begin;
-    mBitFields.blueLeftShift = 8 - length;
-    return NS_OK;
+  // Extract the unscaled value.
+  uint32_t v = (aValue & mMask) >> mRightShift;
+
+  // Idea: to upscale v precisely we need to duplicate its bits, possibly
+  // repeatedly, possibly partially in the last case, from bit 7 down to bit 0
+  // in v2. For example:
+  //
+  // - mBitWidth=1:  v2 = v<<7 | v<<6 | ... | v<<1 | v>>0     k -> kkkkkkkk
+  // - mBitWidth=2:  v2 = v<<6 | v<<4 | v<<2 | v>>0          jk -> jkjkjkjk
+  // - mBitWidth=3:  v2 = v<<5 | v<<2 | v>>1                ijk -> ijkijkij
+  // - mBitWidth=4:  v2 = v<<4 | v>>0                      hijk -> hijkhijk
+  // - mBitWidth=5:  v2 = v<<3 | v>>2                     ghijk -> ghijkghi
+  // - mBitWidth=6:  v2 = v<<2 | v>>4                    fghijk -> fghijkfg
+  // - mBitWidth=7:  v2 = v<<1 | v>>6                   efghijk -> efghijke
+  // - mBitWidth=8:  v2 = v>>0                         defghijk -> defghijk
+  // - mBitWidth=9:  v2 = v>>1                        cdefghijk -> cdefghij
+  // - mBitWidth=10: v2 = v>>2                       bcdefghijk -> bcdefghi
+  // - mBitWidth=11: v2 = v>>3                      abcdefghijk -> abcdefgh
+  // - etc.
+  //
+  uint8_t v2 = 0;
+  int32_t i;      // must be a signed integer
+  for (i = 8 - mBitWidth; i > 0; i -= mBitWidth) {
+    v2 |= v << uint32_t(i);
+  }
+  v2 |= v >> uint32_t(-i);
+  return v2;
+}
+
+MOZ_ALWAYS_INLINE uint8_t
+BitFields::Value::GetAlpha(uint32_t aValue, bool& aHasAlphaOut) const
+{
+  if (mMask == 0x0) {
+    return 0xff;
+  }
+  aHasAlphaOut = true;
+  return Get(aValue);
+}
+
+MOZ_ALWAYS_INLINE uint8_t
+BitFields::Value::Get5(uint32_t aValue) const
+{
+  MOZ_ASSERT(mBitWidth == 5);
+  uint32_t v = (aValue & mMask) >> mRightShift;
+  return (v << 3u) | (v >> 2u);
+}
+
+MOZ_ALWAYS_INLINE uint8_t
+BitFields::Value::Get8(uint32_t aValue) const
+{
+  MOZ_ASSERT(mBitWidth == 8);
+  uint32_t v = (aValue & mMask) >> mRightShift;
+  return v;
+}
+
+void
+BitFields::SetR5G5B5()
+{
+  mRed.Set(0x7c00);
+  mGreen.Set(0x03e0);
+  mBlue.Set(0x001f);
+}
+
+void
+BitFields::SetR8G8B8()
+{
+  mRed.Set(0xff0000);
+  mGreen.Set(0xff00);
+  mBlue.Set(0x00ff);
+}
+
+bool
+BitFields::IsR5G5B5() const
+{
+  return mRed.mBitWidth == 5 &&
+         mGreen.mBitWidth == 5 &&
+         mBlue.mBitWidth == 5 &&
+         mAlpha.mMask == 0x0;
+}
+
+bool
+BitFields::IsR8G8B8() const
+{
+  return mRed.mBitWidth == 8 &&
+         mGreen.mBitWidth == 8 &&
+         mBlue.mBitWidth == 8 &&
+         mAlpha.mMask == 0x0;
+}
+
+uint32_t*
+nsBMPDecoder::RowBuffer()
+{
+  if (mDownscaler) {
+    return reinterpret_cast<uint32_t*>(mDownscaler->RowBuffer()) + mCurrentPos;
+  }
+
+  // Convert from row (1..mHeight) to absolute line (0..mHeight-1).
+  int32_t line = (mH.mHeight < 0)
+               ? -mH.mHeight - mCurrentRow
+               : mCurrentRow - 1;
+  int32_t offset = line * mH.mWidth + mCurrentPos;
+  return reinterpret_cast<uint32_t*>(mImageData) + offset;
+}
+
+void
+nsBMPDecoder::FinishRow()
+{
+  if (mDownscaler) {
+    mDownscaler->CommitRow();
+
+    if (mDownscaler->HasInvalidation()) {
+      DownscalerInvalidRect invalidRect = mDownscaler->TakeInvalidRect();
+      PostInvalidation(invalidRect.mOriginalSizeRect,
+                       Some(invalidRect.mTargetSizeRect));
+    }
+  } else {
+    PostInvalidation(IntRect(0, mCurrentRow, mH.mWidth, 1));
+  }
+  mCurrentRow--;
 }
 
 void
 nsBMPDecoder::WriteInternal(const char* aBuffer, uint32_t aCount)
 {
   MOZ_ASSERT(!HasError(), "Shouldn't call WriteInternal after error!");
+  MOZ_ASSERT(aBuffer);
+  MOZ_ASSERT(aCount > 0);
 
-  // aCount=0 means EOF, mCurLine=0 means we're past end of image
-  if (!aCount || !mCurLine) {
-      return;
+  Maybe<State> terminalState =
+    mLexer.Lex(aBuffer, aCount, [=](State aState,
+                                    const char* aData, size_t aLength) {
+      switch (aState) {
+        case State::FILE_HEADER:      return ReadFileHeader(aData, aLength);
+        case State::INFO_HEADER_SIZE: return ReadInfoHeaderSize(aData, aLength);
+        case State::INFO_HEADER_REST: return ReadInfoHeaderRest(aData, aLength);
+        case State::BITFIELDS:        return ReadBitfields(aData, aLength);
+        case State::COLOR_TABLE:      return ReadColorTable(aData, aLength);
+        case State::GAP:              return SkipGap();
+        case State::PIXEL_ROW:        return ReadPixelRow(aData);
+        case State::RLE_SEGMENT:      return ReadRLESegment(aData);
+        case State::RLE_DELTA:        return ReadRLEDelta(aData);
+        case State::RLE_ABSOLUTE:     return ReadRLEAbsolute(aData, aLength);
+        default:
+          MOZ_ASSERT_UNREACHABLE("Unknown State");
+          return Transition::Terminate(State::FAILURE);
+      }
+    });
+
+  if (!terminalState) {
+    return;  // Need more data.
   }
 
-  // This code assumes that mRawBuf == BIH_INTERNAL_LENGTH::WIN_V3
-  // and that sizeof(mRawBuf) >= BMPFILEHEADER::INTERNAL_LENGTH
-  MOZ_ASSERT(sizeof(mRawBuf) == BIH_INTERNAL_LENGTH::WIN_V3);
-  MOZ_ASSERT(sizeof(mRawBuf) >= BMPFILEHEADER::INTERNAL_LENGTH);
-  MOZ_ASSERT(BIH_INTERNAL_LENGTH::OS2 < BIH_INTERNAL_LENGTH::WIN_V3);
-
-  // This code also assumes it's working with a byte array
-  MOZ_ASSERT(sizeof(mRawBuf[0]) == 1);
-
-  if (mPos < BMPFILEHEADER::INTERNAL_LENGTH) { /* In BITMAPFILEHEADER */
-      // BMPFILEHEADER::INTERNAL_LENGTH < sizeof(mRawBuf)
-      // mPos < BMPFILEHEADER::INTERNAL_LENGTH
-      // BMPFILEHEADER::INTERNAL_LENGTH - mPos < sizeof(mRawBuf)
-      // so toCopy <= BMPFILEHEADER::INTERNAL_LENGTH
-      // so toCopy < sizeof(mRawBuf)
-      // so toCopy > 0 && toCopy <= BMPFILEHEADER::INTERNAL_LENGTH
-      uint32_t toCopy = BMPFILEHEADER::INTERNAL_LENGTH - mPos;
-      if (toCopy > aCount) {
-          toCopy = aCount;
-      }
-
-      // mRawBuf is a byte array of size BIH_INTERNAL_LENGTH::WIN_V3
-      // (verified above)
-      // mPos is < BMPFILEHEADER::INTERNAL_LENGTH
-      // BMPFILEHEADER::INTERNAL_LENGTH < BIH_INTERNAL_LENGTH::WIN_V3
-      // so mPos < sizeof(mRawBuf)
-      //
-      // Therefore this assert should hold
-      MOZ_ASSERT(mPos < sizeof(mRawBuf));
-
-      // toCopy <= BMPFILEHEADER::INTERNAL_LENGTH
-      // mPos >= 0 && mPos < BMPFILEHEADER::INTERNAL_LENGTH
-      // sizeof(mRawBuf) >= BMPFILEHEADER::INTERNAL_LENGTH (verified above)
-      //
-      // Therefore this assert should hold
-      MOZ_ASSERT(mPos + toCopy <= sizeof(mRawBuf));
-
-      memcpy(mRawBuf + mPos, aBuffer, toCopy);
-      mPos += toCopy;
-      aCount -= toCopy;
-      aBuffer += toCopy;
-  }
-  if (mPos == BMPFILEHEADER::INTERNAL_LENGTH) {
-      ProcessFileHeader();
-      if (mBFH.signature[0] != 'B' || mBFH.signature[1] != 'M') {
-          PostDataError();
-          return;
-      }
-      if (mBFH.bihsize == BIH_LENGTH::OS2) {
-          mLOH = BMP_HEADER_LENGTH::OS2;
-      }
-  }
-  if (mPos >= BMPFILEHEADER::INTERNAL_LENGTH && mPos < mLOH) { /* In BITMAPINFOHEADER */
-      // mLOH == BMP_HEADER_LENGTH::WIN_V3 || mLOH == BMP_HEADER_LENGTH::OS2
-      // BMP_HEADER_LENGTH::OS2 < BMP_HEADER_LENGTH::WIN_V3
-      // BMPFILEHEADER::INTERNAL_LENGTH < BMP_HEADER_LENGTH::OS2
-      // BMPFILEHEADER::INTERNAL_LENGTH < BMP_HEADER_LENGTH::WIN_V3
-      //
-      // So toCopy is in the range
-      //      1 to (BMP_HEADER_LENGTH::WIN_V3 - BMPFILEHEADER::INTERNAL_LENGTH)
-      // or   1 to (BMP_HEADER_LENGTH::OS2 - BMPFILEHEADER::INTERNAL_LENGTH)
-      //
-      // But BMP_HEADER_LENGTH::WIN_V3 =
-      //     BMPFILEHEADER::INTERNAL_LENGTH + BIH_INTERNAL_LENGTH::WIN_V3
-      // and BMP_HEADER_LENGTH::OS2 = BMPFILEHEADER::INTERNAL_LENGTH + BIH_INTERNAL_LENGTH::OS2
-      //
-      // So toCopy is in the range
-      //
-      //      1 to BIH_INTERNAL_LENGTH::WIN_V3
-      // or   1 to BIH_INTERNAL_LENGTH::OS2
-      // and  BIH_INTERNAL_LENGTH::OS2 < BIH_INTERNAL_LENGTH::WIN_V3
-      //
-      // sizeof(mRawBuf) = BIH_INTERNAL_LENGTH::WIN_V3
-      // so toCopy <= sizeof(mRawBuf)
-      uint32_t toCopy = mLOH - mPos;
-      if (toCopy > aCount) {
-          toCopy = aCount;
-      }
-
-      // mPos is in the range
-      //      BMPFILEHEADER::INTERNAL_LENGTH to (BMP_HEADER_LENGTH::WIN_V3 - 1)
-      //
-      // offset is then in the range (see toCopy comments for more details)
-      //      0 to (BIH_INTERNAL_LENGTH::WIN_V3 - 1)
-      //
-      // sizeof(mRawBuf) is BIH_INTERNAL_LENGTH::WIN_V3 so this
-      // offset stays within bounds and this assert should hold
-      const uint32_t offset = mPos - BMPFILEHEADER::INTERNAL_LENGTH;
-      MOZ_ASSERT(offset < sizeof(mRawBuf));
-
-      // Two cases:
-      //      mPos = BMPFILEHEADER::INTERNAL_LENGTH
-      //      mLOH = BMP_HEADER_LENGTH::WIN_V3
-      //
-      // offset = 0
-      // toCopy = BIH_INTERNAL_LENGTH::WIN_V3
-      //
-      //      This will be in the bounds of sizeof(mRawBuf)
-      //
-      // Second Case:
-      //      mPos = BMP_HEADER_LENGTH::WIN_V3 - 1
-      //      mLOH = BMP_HEADER_LENGTH::WIN_V3
-      //
-      // offset = BIH_INTERNAL_LENGTH::WIN_V3 - 1
-      // toCopy = 1
-      //
-      //      This will be in the bounds of sizeof(mRawBuf)
-      //
-      // As sizeof(mRawBuf) == BIH_INTERNAL_LENGTH::WIN_V3 (verified above)
-      // and BMP_HEADER_LENGTH::WIN_V3 is the largest range of values. If mLOH
-      // was equal to BMP_HEADER_LENGTH::OS2 then the ranges are smaller.
-      MOZ_ASSERT(offset + toCopy <= sizeof(mRawBuf));
-
-      memcpy(mRawBuf + offset, aBuffer, toCopy);
-      mPos += toCopy;
-      aCount -= toCopy;
-      aBuffer += toCopy;
+  if (*terminalState == State::FAILURE) {
+    PostDataError();
+    return;
   }
 
-  // At this point mPos should be >= mLOH unless aBuffer did not have enough
-  // data. In the latter case aCount should be 0.
-  MOZ_ASSERT(mPos >= mLOH || aCount == 0);
-
-  // mProcessedHeader is checked to ensure that if at this point mPos == mLOH
-  // but we have no data left to process, the next time WriteInternal is called
-  // we won't enter this condition again.
-  if (mPos == mLOH && !mProcessedHeader) {
-      mProcessedHeader = true;
-
-      ProcessInfoHeader();
-      MOZ_LOG(GetBMPLog(), LogLevel::Debug,
-             ("BMP is %lix%lix%lu. compression=%lu\n",
-             mBIH.width, mBIH.height, mBIH.bpp, mBIH.compression));
-      // Verify we support this bit depth
-      if (mBIH.bpp != 1 && mBIH.bpp != 4 && mBIH.bpp != 8 &&
-          mBIH.bpp != 16 && mBIH.bpp != 24 && mBIH.bpp != 32) {
-        PostDataError();
-        return;
-      }
-
-      // BMPs with negative width are invalid
-      // Reject extremely wide images to keep the math sane
-      const int32_t k64KWidth = 0x0000FFFF;
-      if (mBIH.width < 0 || mBIH.width > k64KWidth) {
-        PostDataError();
-        return;
-      }
-
-      if (mBIH.height == INT_MIN) {
-        PostDataError();
-        return;
-      }
-
-      uint32_t real_height = GetHeight();
-
-      // Post our size to the superclass
-      PostSize(mBIH.width, real_height);
-      if (HasError()) {
-        // Setting the size led to an error.
-        return;
-      }
-
-      // We treat BMPs as transparent if they're 32bpp and alpha is enabled, but
-      // also if they use RLE encoding, because the 'delta' mode can skip pixels
-      // and cause implicit transparency.
-      bool hasTransparency = (mBIH.compression == BMPINFOHEADER::RLE8) ||
-                             (mBIH.compression == BMPINFOHEADER::RLE4) ||
-                             (mBIH.bpp == 32 && mUseAlphaData);
-      if (hasTransparency) {
-        PostHasTransparency();
-      }
-
-      // We have the size. If we're doing a metadata decode, we're done.
-      if (IsMetadataDecode()) {
-        return;
-      }
-
-      // We're doing a real decode.
-      mOldLine = mCurLine = real_height;
-
-      if (mBIH.bpp <= 8) {
-        mNumColors = 1 << mBIH.bpp;
-        if (mBIH.colors && mBIH.colors < mNumColors) {
-            mNumColors = mBIH.colors;
-        }
-
-        // Always allocate 256 even though mNumColors might be smaller
-        mColors = new colorTable[256];
-        memset(mColors, 0, 256 * sizeof(colorTable));
-      } else if (mBIH.compression != BMPINFOHEADER::BITFIELDS &&
-                 mBIH.bpp == 16) {
-        // Use default 5-5-5 format
-        mBitFields.red   = 0x7C00;
-        mBitFields.green = 0x03E0;
-        mBitFields.blue  = 0x001F;
-        CalcBitShift();
-      }
-
-      // Make sure we have a valid value for our supported compression modes
-      // before adding the frame
-      if (mBIH.compression != BMPINFOHEADER::RGB &&
-          mBIH.compression != BMPINFOHEADER::RLE8 &&
-          mBIH.compression != BMPINFOHEADER::RLE4 &&
-          mBIH.compression != BMPINFOHEADER::BITFIELDS) {
-        PostDataError();
-        return;
-      }
-
-      // If we have RLE4 or RLE8 or BMPINFOHEADER::ALPHABITFIELDS, then ensure
-      // we have valid BPP values before adding the frame.
-      if (mBIH.compression == BMPINFOHEADER::RLE8 && mBIH.bpp != 8) {
-        MOZ_LOG(GetBMPLog(), LogLevel::Debug,
-               ("BMP RLE8 compression only supports 8 bits per pixel\n"));
-        PostDataError();
-        return;
-      }
-      if (mBIH.compression == BMPINFOHEADER::RLE4 &&
-          mBIH.bpp != 4 && mBIH.bpp != 1) {
-        MOZ_LOG(GetBMPLog(), LogLevel::Debug,
-               ("BMP RLE4 compression only supports 4 bits per pixel\n"));
-        PostDataError();
-        return;
-      }
-      if (mBIH.compression == BMPINFOHEADER::ALPHABITFIELDS &&
-          mBIH.bpp != 16 && mBIH.bpp != 32) {
-        MOZ_LOG(GetBMPLog(), LogLevel::Debug,
-               ("BMP ALPHABITFIELDS only supports 16 or 32 bits per pixel\n"
-                ));
-        PostDataError();
-        return;
-      }
-
-      if (mBIH.compression != BMPINFOHEADER::RLE8 &&
-          mBIH.compression != BMPINFOHEADER::RLE4 &&
-          mBIH.compression != BMPINFOHEADER::ALPHABITFIELDS) {
-        // mRow is not used for RLE encoded images
-        mRow = (uint8_t*)moz_malloc((mBIH.width * mBIH.bpp) / 8 + 4);
-        // + 4 because the line is padded to a 4 bit boundary, but
-        // I don't want to make exact calculations here, that's unnecessary.
-        // Also, it compensates rounding error.
-        if (!mRow) {
-          PostDataError();
-          return;
-        }
-      }
-
-      MOZ_ASSERT(!mImageData, "Already have a buffer allocated?");
-      IntSize targetSize = mDownscaler ? mDownscaler->TargetSize()
-                                       : GetSize();
-      nsresult rv = AllocateFrame(/* aFrameNum = */ 0, targetSize,
-                                  IntRect(IntPoint(), targetSize),
-                                  SurfaceFormat::B8G8R8A8);
-      if (NS_FAILED(rv)) {
-          return;
-      }
-
-      MOZ_ASSERT(mImageData, "Should have a buffer now");
-
-      if (mDownscaler) {
-        // BMPs store their rows in reverse order, so the downscaler needs to
-        // reverse them again when writing its output.
-        rv = mDownscaler->BeginFrame(GetSize(), mImageData, hasTransparency,
-                                     /* aFlipVertically = */ true);
-        if (NS_FAILED(rv)) {
-          return;
-        }
-      }
-  }
-
-  if (mColors && mPos >= mLOH) {
-    // OS/2 Bitmaps have no padding byte
-    uint8_t bytesPerColor = (mBFH.bihsize == BIH_LENGTH::OS2) ? 3 : 4;
-    if (mPos < (mLOH + mNumColors * bytesPerColor)) {
-      // Number of bytes already received
-      uint32_t colorBytes = mPos - mLOH;
-      // Color which is currently received
-      uint8_t colorNum = colorBytes / bytesPerColor;
-      uint8_t at = colorBytes % bytesPerColor;
-      while (aCount && (mPos < (mLOH + mNumColors * bytesPerColor))) {
-        switch (at) {
-          case 0:
-            mColors[colorNum].blue = *aBuffer;
-            break;
-          case 1:
-            mColors[colorNum].green = *aBuffer;
-            break;
-          case 2:
-            mColors[colorNum].red = *aBuffer;
-            // If there is no padding byte, increment the color index
-            // since we're done with the current color.
-            if (bytesPerColor == 3) {
-              colorNum++;
-            }
-            break;
-          case 3:
-            // This is a padding byte only in Windows BMPs. Increment
-            // the color index since we're done with the current color.
-            colorNum++;
-            break;
-        }
-        mPos++; aBuffer++; aCount--;
-        at = (at + 1) % bytesPerColor;
-      }
-    }
-  } else if (aCount &&
-             mBIH.compression == BMPINFOHEADER::BITFIELDS &&
-             mPos < (BMP_HEADER_LENGTH::WIN_V3 + bitFields::LENGTH)) {
-    // If compression is used, this is a windows bitmap (compression can't be
-    // used with OS/2 bitmaps), hence we can use BMP_HEADER_LENGTH::WIN_V3
-    // instead of mLOH.  (verified below)
-
-    // If aCount != 0 then mPos should be >= mLOH due to the if statements
-    // at the beginning of the function
-    MOZ_ASSERT(mPos >= mLOH);
-    MOZ_ASSERT(mLOH == BMP_HEADER_LENGTH::WIN_V3);
-
-    // mLOH == BMP_HEADER_LENGTH::WIN_V3 (verified above)
-    // mPos >= mLOH (verified above)
-    // mPos < BMP_HEADER_LENGTH::WIN_V3 + bitFields::LENGTH
-    //
-    // So toCopy is in the range
-    //      0 to (bitFields::LENGTH - 1)
-    uint32_t toCopy = (BMP_HEADER_LENGTH::WIN_V3 + bitFields::LENGTH) - mPos;
-    if (toCopy > aCount) {
-      toCopy = aCount;
-    }
-
-    // mPos >= BMP_HEADER_LENGTH::WIN_V3
-    // mPos < BMP_HEADER_LENGTH::WIN_V3 + bitFields::LENGTH
-    //
-    // offset is in the range
-    //      0 to (bitFields::LENGTH - 1)
-    //
-    // bitFields::LENGTH < BIH_INTERNAL_LENGTH::WIN_V3
-    // and sizeof(mRawBuf) == BIH_INTERNAL_LENGTH::WIN_V3 (verified at
-    // top of function)
-    //
-    // Therefore this assert should hold
-    const uint32_t offset = mPos - BMP_HEADER_LENGTH::WIN_V3;
-    MOZ_ASSERT(offset < sizeof(mRawBuf));
-
-    // Two cases:
-    //      mPos = BMP_HEADER_LENGTH::WIN_V3
-    //
-    // offset = 0
-    // toCopy = bitFields::LENGTH
-    //
-    //      This will be in the bounds of sizeof(mRawBuf)
-    //
-    // Second case:
-    //
-    //      mPos = BMP_HEADER_LENGTH::WIN_V3 + bitFields::LENGTH - 1
-    //
-    // offset = bitFields::LENGTH - 1
-    // toCopy = 1
-    //
-    //      This will be in the bounds of sizeof(mRawBuf)
-    //
-    // As bitFields::LENGTH < BIH_INTERNAL_LENGTH::WIN_V3 and
-    // sizeof(mRawBuf) == BIH_INTERNAL_LENGTH::WIN_V3
-    //
-    // Therefore this assert should hold
-    MOZ_ASSERT(offset + toCopy <= sizeof(mRawBuf));
-
-    memcpy(mRawBuf + offset, aBuffer, toCopy);
-    mPos += toCopy;
-    aBuffer += toCopy;
-    aCount -= toCopy;
-  }
-  if (mPos == BMP_HEADER_LENGTH::WIN_V3 + bitFields::LENGTH &&
-      mBIH.compression == BMPINFOHEADER::BITFIELDS) {
-    mBitFields.red = LittleEndian::readUint32(reinterpret_cast<uint32_t*>
-                                              (mRawBuf));
-    mBitFields.green = LittleEndian::readUint32(reinterpret_cast<uint32_t*>
-                                                (mRawBuf + 4));
-    mBitFields.blue = LittleEndian::readUint32(reinterpret_cast<uint32_t*>
-                                               (mRawBuf + 8));
-    CalcBitShift();
-  }
-  while (aCount && (mPos < mBFH.dataoffset)) { // Skip whatever is between
-                                               // header and data
-    mPos++; aBuffer++; aCount--;
-  }
-  if (aCount && ++mPos >= mBFH.dataoffset) {
-    // Need to increment mPos, else we might get to mPos==mLOH again
-    // From now on, mPos is irrelevant
-    if (!mBIH.compression || mBIH.compression == BMPINFOHEADER::BITFIELDS) {
-        uint32_t rowSize = (mBIH.bpp * mBIH.width + 7) / 8; // + 7 to
-                                                            // round up
-        if (rowSize % 4) {
-          rowSize += (4 - (rowSize % 4)); // Pad to DWORD Boundary
-        }
-        uint32_t toCopy;
-        do {
-          toCopy = rowSize - mRowBytes;
-          if (toCopy) {
-            if (toCopy > aCount) {
-              toCopy = aCount;
-            }
-            memcpy(mRow + mRowBytes, aBuffer, toCopy);
-            aCount -= toCopy;
-            aBuffer += toCopy;
-            mRowBytes += toCopy;
-        }
-        if (rowSize == mRowBytes) {
-          // Collected a whole row into mRow, process it
-          uint8_t* p = mRow;
-          uint32_t* d = mDownscaler
-                      ? reinterpret_cast<uint32_t*>(mDownscaler->RowBuffer())
-                      : reinterpret_cast<uint32_t*>(mImageData)
-                        + PIXEL_OFFSET(mCurLine, 0);
-          uint32_t lpos = mBIH.width;
-          switch (mBIH.bpp) {
-            case 1:
-              while (lpos > 0) {
-                int8_t bit;
-                uint8_t idx;
-                for (bit = 7; bit >= 0 && lpos > 0; bit--) {
-                  idx = (*p >> bit) & 1;
-                  SetPixel(d, idx, mColors);
-                  --lpos;
-                }
-                ++p;
-              }
-              break;
-            case 4:
-              while (lpos > 0) {
-                Set4BitPixel(d, *p, lpos, mColors);
-                ++p;
-              }
-              break;
-            case 8:
-              while (lpos > 0) {
-                SetPixel(d, *p, mColors);
-                --lpos;
-                ++p;
-              }
-              break;
-            case 16:
-              while (lpos > 0) {
-                uint16_t val = LittleEndian::
-                               readUint16(reinterpret_cast<uint16_t*>(p));
-                SetPixel(d,
-                         (val & mBitFields.red) >>
-                         mBitFields.redRightShift <<
-                         mBitFields.redLeftShift,
-                         (val & mBitFields.green) >>
-                         mBitFields.greenRightShift <<
-                         mBitFields.greenLeftShift,
-                         (val & mBitFields.blue) >>
-                         mBitFields.blueRightShift <<
-                         mBitFields.blueLeftShift);
-                --lpos;
-                p+=2;
-              }
-              break;
-            case 24:
-              while (lpos > 0) {
-                SetPixel(d, p[2], p[1], p[0]);
-                p += 2;
-                --lpos;
-                ++p;
-              }
-              break;
-            case 32:
-              while (lpos > 0) {
-                if (mUseAlphaData) {
-                  if (MOZ_UNLIKELY(!mHaveAlphaData && p[3])) {
-                    PostHasTransparency();
-                    mHaveAlphaData = true;
-                  }
-                  SetPixel(d, p[2], p[1], p[0], p[3]);
-                } else {
-                  SetPixel(d, p[2], p[1], p[0]);
-                }
-                p += 4;
-                --lpos;
-              }
-              break;
-            default:
-              NS_NOTREACHED("Unsupported color depth,"
-                            " but earlier check didn't catch it");
-          }
-
-          if (mDownscaler) {
-            mDownscaler->CommitRow();
-          }
-          
-          mCurLine --;
-          if (mCurLine == 0) { // Finished last line
-            break;
-          }
-          mRowBytes = 0;
-        }
-      } while (aCount > 0);
-    } else if ((mBIH.compression == BMPINFOHEADER::RLE8) ||
-               (mBIH.compression == BMPINFOHEADER::RLE4)) {
-      if (((mBIH.compression == BMPINFOHEADER::RLE8) && (mBIH.bpp != 8)) ||
-          ((mBIH.compression == BMPINFOHEADER::RLE4) && (mBIH.bpp != 4) &&
-           (mBIH.bpp != 1))) {
-        MOZ_LOG(GetBMPLog(), LogLevel::Debug,
-               ("BMP RLE8/RLE4 compression only supports 8/4 bits per"
-               " pixel\n"));
-        PostDataError();
-        return;
-      }
-
-      while (aCount > 0) {
-        uint8_t byte;
-
-        switch(mState) {
-          case eRLEStateInitial:
-            mStateData = (uint8_t)*aBuffer++;
-            aCount--;
-
-            mState = eRLEStateNeedSecondEscapeByte;
-            continue;
-
-          case eRLEStateNeedSecondEscapeByte:
-            byte = *aBuffer++;
-            aCount--;
-            if (mStateData != RLE::ESCAPE) { // encoded mode
-              // Encoded mode consists of two bytes:
-              // the first byte (mStateData) specifies the
-              // number of consecutive pixels to be drawn
-              // using the color index contained in
-              // the second byte
-              // Work around bitmaps that specify too many pixels
-              mState = eRLEStateInitial;
-              uint32_t pixelsNeeded = std::min<uint32_t>(mBIH.width - mCurPos,
-                                    mStateData);
-              if (pixelsNeeded) {
-                uint32_t* d = mDownscaler
-                  ? reinterpret_cast<uint32_t*>(mDownscaler->RowBuffer())
-                      + mCurPos
-                  : reinterpret_cast<uint32_t*>(mImageData)
-                      + PIXEL_OFFSET(mCurLine, mCurPos);
-
-                mCurPos += pixelsNeeded;
-                if (mBIH.compression == BMPINFOHEADER::RLE8) {
-                  do {
-                    SetPixel(d, byte, mColors);
-                    pixelsNeeded --;
-                  } while (pixelsNeeded);
-                } else {
-                    do {
-                      Set4BitPixel(d, byte, pixelsNeeded, mColors);
-                  } while (pixelsNeeded);
-                }
-              }
-              continue;
-            }
-
-            switch(byte) {
-              case RLE::ESCAPE_EOL:
-                // End of Line: Go to next row
-                if (mDownscaler) {
-                  mDownscaler->CommitRow();
-                }
-
-                mCurLine --;
-                mCurPos = 0;
-                mState = eRLEStateInitial;
-                break;
-
-              case RLE::ESCAPE_EOF: // EndOfFile
-                mCurPos = mCurLine = 0;
-                break;
-
-              case RLE::ESCAPE_DELTA:
-                mState = eRLEStateNeedXDelta;
-                continue;
-
-              default : // absolute mode
-                // Save the number of pixels to read
-                mStateData = byte;
-                if (mCurPos + mStateData > (uint32_t)mBIH.width) {
-                  // We can work around bitmaps that specify
-                  // one pixel too many, but only if their
-                  // width is odd.
-                  mStateData -= mBIH.width & 1;
-                  if (mCurPos + mStateData > (uint32_t)mBIH.width) {
-                      PostDataError();
-                      return;
-                  }
-                }
-
-              // See if we will need to skip a byte
-              // to word align the pixel data
-              // mStateData is a number of pixels
-              // so allow for the RLE compression type
-              // Pixels RLE8=1 RLE4=2
-              //    1    Pad    Pad
-              //    2    No     Pad
-              //    3    Pad    No
-              //    4    No     No
-              if (((mStateData - 1) & mBIH.compression) != 0) {
-                  mState = eRLEStateAbsoluteMode;
-              } else {
-                  mState = eRLEStateAbsoluteModePadded;
-              }
-              continue;
-            }
-            break;
-
-          case eRLEStateNeedXDelta:
-            // Handle the XDelta and proceed to get Y Delta
-            byte = *aBuffer++;
-            aCount--;
-
-            if (mDownscaler) {
-              // Clear the skipped pixels. (This clears to the end of the row,
-              // which is perfect if there's a Y delta and harmless if not).
-              mDownscaler->ClearRow(/* aStartingAtCol = */ mCurPos);
-            }
-
-            mCurPos += byte;
-
-            // Delta encoding makes it possible to skip pixels
-            // making the image transparent.
-            if (MOZ_UNLIKELY(!mHaveAlphaData)) {
-                PostHasTransparency();
-                mHaveAlphaData = true;
-            }
-            mUseAlphaData = mHaveAlphaData = true;
-            if (mCurPos > mBIH.width) {
-                mCurPos = mBIH.width;
-            }
-
-            mState = eRLEStateNeedYDelta;
-            continue;
-
-          case eRLEStateNeedYDelta: {
-            // Get the Y Delta and then "handle" the move
-            byte = *aBuffer++;
-            aCount--;
-            mState = eRLEStateInitial;
-            // Delta encoding makes it possible to skip pixels
-            // making the image transparent.
-            if (MOZ_UNLIKELY(!mHaveAlphaData)) {
-                PostHasTransparency();
-                mHaveAlphaData = true;
-            }
-            mUseAlphaData = mHaveAlphaData = true;
-
-            int32_t yDelta = std::min<int32_t>(byte, mCurLine);
-            mCurLine -= yDelta;
-
-            if (mDownscaler && yDelta > 0) {
-              // Commit the current row (the first of the skipped rows).
-              mDownscaler->CommitRow();
-
-              // Clear and commit the remaining skipped rows. 
-              for (int32_t line = 1 ; line < yDelta ; ++line) {
-                mDownscaler->ClearRow();
-                mDownscaler->CommitRow();
-              }
-            }
-
-            break;
-          }
-
-          case eRLEStateAbsoluteMode: // Absolute Mode
-          case eRLEStateAbsoluteModePadded:
-            if (mStateData) {
-              // In absolute mode, the second byte (mStateData)
-              // represents the number of pixels
-              // that follow, each of which contains
-              // the color index of a single pixel.
-              uint32_t* d = mDownscaler
-                ? reinterpret_cast<uint32_t*>(mDownscaler->RowBuffer())
-                    + mCurPos
-                : reinterpret_cast<uint32_t*>(mImageData)
-                    + PIXEL_OFFSET(mCurLine, mCurPos);
-
-              uint32_t* oldPos = d;
-              if (mBIH.compression == BMPINFOHEADER::RLE8) {
-                  while (aCount > 0 && mStateData > 0) {
-                    byte = *aBuffer++;
-                    aCount--;
-                    SetPixel(d, byte, mColors);
-                    mStateData--;
-                  }
-              } else {
-                  while (aCount > 0 && mStateData > 0) {
-                    byte = *aBuffer++;
-                    aCount--;
-                    Set4BitPixel(d, byte, mStateData, mColors);
-                  }
-              }
-              mCurPos += d - oldPos;
-            }
-
-            if (mStateData == 0) {
-              // In absolute mode, each run must
-              // be aligned on a word boundary
-
-              if (mState == eRLEStateAbsoluteMode) {
-                // word aligned
-                mState = eRLEStateInitial;
-              } else if (aCount > 0) {
-                // not word aligned
-                // "next" byte is just a padding byte
-                // so "move" past it and we can continue
-                aBuffer++;
-                aCount--;
-                mState = eRLEStateInitial;
-              }
-            }
-            // else state is still eRLEStateAbsoluteMode
-            continue;
-
-          default :
-            MOZ_ASSERT(0, "BMP RLE decompression: unknown state!");
-            PostDecoderError(NS_ERROR_UNEXPECTED);
-            return;
-        }
-        // Because of the use of the continue statement
-        // we only get here for eol, eof or y delta
-        if (mCurLine == 0) {
-          // Finished last line
-          break;
-        }
-      }
-    }
-  }
-
-  const uint32_t rows = mOldLine - mCurLine;
-  if (rows) {
-    // Invalidate
-    if (!mDownscaler) {
-      nsIntRect r(0, mBIH.height < 0 ? -mBIH.height - mOldLine : mCurLine,
-                  mBIH.width, rows);
-      PostInvalidation(r);
-    } else if (mDownscaler->HasInvalidation()) {
-      DownscalerInvalidRect invalidRect = mDownscaler->TakeInvalidRect();
-      PostInvalidation(invalidRect.mOriginalSizeRect,
-                       Some(invalidRect.mTargetSizeRect));
-    }
-
-    mOldLine = mCurLine;
-  }
+  MOZ_ASSERT(*terminalState == State::SUCCESS);
 
   return;
 }
 
-void
-nsBMPDecoder::ProcessFileHeader()
+LexerTransition<nsBMPDecoder::State>
+nsBMPDecoder::ReadFileHeader(const char* aData, size_t aLength)
 {
-  memset(&mBFH, 0, sizeof(mBFH));
-  memcpy(&mBFH.signature, mRawBuf, sizeof(mBFH.signature));
-  memcpy(&mBFH.filesize, mRawBuf + 2, sizeof(mBFH.filesize));
-  memcpy(&mBFH.reserved, mRawBuf + 6, sizeof(mBFH.reserved));
-  memcpy(&mBFH.dataoffset, mRawBuf + 10, sizeof(mBFH.dataoffset));
-  memcpy(&mBFH.bihsize, mRawBuf + 14, sizeof(mBFH.bihsize));
+  mPreGapLength += aLength;
 
-  // Now correct the endianness of the header
-  mBFH.filesize = LittleEndian::readUint32(&mBFH.filesize);
-  mBFH.dataoffset = LittleEndian::readUint32(&mBFH.dataoffset);
-  mBFH.bihsize = LittleEndian::readUint32(&mBFH.bihsize);
+  bool signatureOk = aData[0] == 'B' && aData[1] == 'M';
+  if (!signatureOk) {
+    PostDataError();
+    return Transition::Terminate(State::FAILURE);
+  }
+
+  // We ignore the filesize (aData + 2) and reserved (aData + 6) fields.
+
+  mH.mDataOffset = LittleEndian::readUint32(aData + 10);
+
+  return Transition::To(State::INFO_HEADER_SIZE, BIHSIZE_FIELD_LENGTH);
+}
+
+// We read the info header in two steps: (a) read the mBIHSize field to
+// determine how long the header is; (b) read the rest of the header.
+LexerTransition<nsBMPDecoder::State>
+nsBMPDecoder::ReadInfoHeaderSize(const char* aData, size_t aLength)
+{
+  mPreGapLength += aLength;
+
+  mH.mBIHSize = LittleEndian::readUint32(aData);
+
+  bool bihSizeOk = mH.mBIHSize == InfoHeaderLength::WIN_V2 ||
+                   mH.mBIHSize == InfoHeaderLength::WIN_V3 ||
+                   mH.mBIHSize == InfoHeaderLength::WIN_V4 ||
+                   mH.mBIHSize == InfoHeaderLength::WIN_V5 ||
+                   (mH.mBIHSize >= InfoHeaderLength::OS2_V2_MIN &&
+                    mH.mBIHSize <= InfoHeaderLength::OS2_V2_MAX);
+  if (!bihSizeOk) {
+    PostDataError();
+    return Transition::Terminate(State::FAILURE);
+  }
+  // ICO BMPs must have a WinVMPv3 header. nsICODecoder should have already
+  // terminated decoding if this isn't the case.
+  MOZ_ASSERT_IF(mIsWithinICO, mH.mBIHSize == InfoHeaderLength::WIN_V3);
+
+  return Transition::To(State::INFO_HEADER_REST,
+                        mH.mBIHSize - BIHSIZE_FIELD_LENGTH);
+}
+
+LexerTransition<nsBMPDecoder::State>
+nsBMPDecoder::ReadInfoHeaderRest(const char* aData, size_t aLength)
+{
+  mPreGapLength += aLength;
+
+  // |mWidth| and |mHeight| may be signed (Windows) or unsigned (OS/2). We just
+  // read as unsigned because in practice that's good enough.
+  if (mH.mBIHSize == InfoHeaderLength::WIN_V2) {
+    mH.mWidth  = LittleEndian::readUint16(aData + 0);
+    mH.mHeight = LittleEndian::readUint16(aData + 2);
+    // We ignore the planes (aData + 4) field; it should always be 1.
+    mH.mBpp    = LittleEndian::readUint16(aData + 6);
+  } else {
+    mH.mWidth  = LittleEndian::readUint32(aData + 0);
+    mH.mHeight = LittleEndian::readUint32(aData + 4);
+    // We ignore the planes (aData + 4) field; it should always be 1.
+    mH.mBpp    = LittleEndian::readUint16(aData + 10);
+
+    // For OS2-BMPv2 the info header may be as little as 16 bytes, so be
+    // careful for these fields.
+    mH.mCompression = aLength >= 16 ? LittleEndian::readUint32(aData + 12) : 0;
+    mH.mImageSize   = aLength >= 20 ? LittleEndian::readUint32(aData + 16) : 0;
+    // We ignore the xppm (aData + 20) and yppm (aData + 24) fields.
+    mH.mNumColors   = aLength >= 32 ? LittleEndian::readUint32(aData + 28) : 0;
+    // We ignore the important_colors (aData + 36) field.
+
+    // For WinBMPv4, WinBMPv5 and (possibly) OS2-BMPv2 there are additional
+    // fields in the info header which we ignore, with the possible exception
+    // of the color bitfields (see below).
+  }
+
+  // Run with NSPR_LOG_MODULES=BMPDecoder:4 set to see this output.
+  MOZ_LOG(GetBMPLog(), LogLevel::Debug,
+          ("BMP: bihsize=%u, %d x %d, bpp=%u, compression=%u, colors=%u\n",
+          mH.mBIHSize, mH.mWidth, mH.mHeight, uint32_t(mH.mBpp),
+          mH.mCompression, mH.mNumColors));
+
+  // BMPs with negative width are invalid. Also, reject extremely wide images
+  // to keep the math sane. And reject INT_MIN as a height because you can't
+  // get its absolute value (because -INT_MIN is one more than INT_MAX).
+  const int32_t k64KWidth = 0x0000FFFF;
+  bool sizeOk = 0 <= mH.mWidth && mH.mWidth <= k64KWidth &&
+                mH.mHeight != INT_MIN;
+  if (!sizeOk) {
+    PostDataError();
+    return Transition::Terminate(State::FAILURE);
+  }
+
+  // Check mBpp and mCompression.
+  bool bppCompressionOk =
+    (mH.mCompression == Compression::RGB &&
+      (mH.mBpp ==  1 || mH.mBpp ==  4 || mH.mBpp ==  8 ||
+       mH.mBpp == 16 || mH.mBpp == 24 || mH.mBpp == 32)) ||
+    (mH.mCompression == Compression::RLE8 && mH.mBpp == 8) ||
+    (mH.mCompression == Compression::RLE4 && mH.mBpp == 4) ||
+    (mH.mCompression == Compression::BITFIELDS &&
+      (mH.mBpp == 16 || mH.mBpp == 32));
+  if (!bppCompressionOk) {
+    PostDataError();
+    return Transition::Terminate(State::FAILURE);
+  }
+
+  // Post our size to the superclass.
+  uint32_t realHeight = GetHeight();
+  PostSize(mH.mWidth, realHeight);
+  mCurrentRow = realHeight;
+
+  // Round it up to the nearest byte count, then pad to 4-byte boundary.
+  // Compute this even for a metadate decode because GetCompressedImageSize()
+  // relies on it.
+  mPixelRowSize = (mH.mBpp * mH.mWidth + 7) / 8;
+  uint32_t surplus = mPixelRowSize % 4;
+  if (surplus != 0) {
+    mPixelRowSize += 4 - surplus;
+  }
+
+  size_t bitFieldsLengthStillToRead = 0;
+  if (mH.mCompression == Compression::BITFIELDS) {
+    // Need to read bitfields.
+    if (mH.mBIHSize >= InfoHeaderLength::WIN_V4) {
+      // Bitfields are present in the info header, so we can read them
+      // immediately.
+      mBitFields.ReadFromHeader(aData + 36, /* aReadAlpha = */ true);
+    } else {
+      // Bitfields are present after the info header, so we will read them in
+      // ReadBitfields().
+      bitFieldsLengthStillToRead = BitFields::LENGTH;
+    }
+  } else if (mH.mBpp == 16) {
+    // No bitfields specified; use the default 5-5-5 values.
+    mBitFields.SetR5G5B5();
+  } else if (mH.mBpp == 32) {
+    // No bitfields specified; use the default 8-8-8 values.
+    mBitFields.SetR8G8B8();
+  }
+
+  return Transition::To(State::BITFIELDS, bitFieldsLengthStillToRead);
 }
 
 void
-nsBMPDecoder::ProcessInfoHeader()
+BitFields::ReadFromHeader(const char* aData, bool aReadAlpha)
 {
-  memset(&mBIH, 0, sizeof(mBIH));
-  if (mBFH.bihsize == 12) { // OS/2 Bitmap
-    memcpy(&mBIH.width, mRawBuf, 2);
-    memcpy(&mBIH.height, mRawBuf + 2, 2);
-    memcpy(&mBIH.planes, mRawBuf + 4, sizeof(mBIH.planes));
-    memcpy(&mBIH.bpp, mRawBuf + 6, sizeof(mBIH.bpp));
-  } else {
-    memcpy(&mBIH.width, mRawBuf, sizeof(mBIH.width));
-    memcpy(&mBIH.height, mRawBuf + 4, sizeof(mBIH.height));
-    memcpy(&mBIH.planes, mRawBuf + 8, sizeof(mBIH.planes));
-    memcpy(&mBIH.bpp, mRawBuf + 10, sizeof(mBIH.bpp));
-    memcpy(&mBIH.compression, mRawBuf + 12, sizeof(mBIH.compression));
-    memcpy(&mBIH.image_size, mRawBuf + 16, sizeof(mBIH.image_size));
-    memcpy(&mBIH.xppm, mRawBuf + 20, sizeof(mBIH.xppm));
-    memcpy(&mBIH.yppm, mRawBuf + 24, sizeof(mBIH.yppm));
-    memcpy(&mBIH.colors, mRawBuf + 28, sizeof(mBIH.colors));
-    memcpy(&mBIH.important_colors, mRawBuf + 32,
-           sizeof(mBIH.important_colors));
+  mRed.Set  (LittleEndian::readUint32(aData + 0));
+  mGreen.Set(LittleEndian::readUint32(aData + 4));
+  mBlue.Set (LittleEndian::readUint32(aData + 8));
+  if (aReadAlpha) {
+    mAlpha.Set(LittleEndian::readUint32(aData + 12));
+  }
+}
+
+LexerTransition<nsBMPDecoder::State>
+nsBMPDecoder::ReadBitfields(const char* aData, size_t aLength)
+{
+  mPreGapLength += aLength;
+
+  // If aLength is zero there are no bitfields to read, or we already read them
+  // in ReadInfoHeader().
+  if (aLength != 0) {
+    mBitFields.ReadFromHeader(aData, /* aReadAlpha = */ false);
   }
 
-  // Convert endianness
-  mBIH.width = LittleEndian::readUint32(&mBIH.width);
-  mBIH.height = LittleEndian::readUint32(&mBIH.height);
-  mBIH.planes = LittleEndian::readUint16(&mBIH.planes);
-  mBIH.bpp = LittleEndian::readUint16(&mBIH.bpp);
+  // Note that RLE-encoded BMPs might be transparent because the 'delta' mode
+  // can skip pixels and cause implicit transparency.
+  mMayHaveTransparency =
+    (mH.mCompression == Compression::RGB && mIsWithinICO && mH.mBpp == 32) ||
+    mH.mCompression == Compression::RLE8 ||
+    mH.mCompression == Compression::RLE4 ||
+    (mH.mCompression == Compression::BITFIELDS &&
+     mBitFields.mAlpha.IsPresent());
+  if (mMayHaveTransparency) {
+    PostHasTransparency();
+  }
 
-  mBIH.compression = LittleEndian::readUint32(&mBIH.compression);
-  mBIH.image_size = LittleEndian::readUint32(&mBIH.image_size);
-  mBIH.xppm = LittleEndian::readUint32(&mBIH.xppm);
-  mBIH.yppm = LittleEndian::readUint32(&mBIH.yppm);
-  mBIH.colors = LittleEndian::readUint32(&mBIH.colors);
-  mBIH.important_colors = LittleEndian::readUint32(&mBIH.important_colors);
+  // We've now read all the headers. If we're doing a metadata decode, we're
+  // done.
+  if (IsMetadataDecode()) {
+    return Transition::Terminate(State::SUCCESS);
+  }
+
+  // Set up the color table, if present; it'll be filled in by ReadColorTable().
+  if (mH.mBpp <= 8) {
+    mNumColors = 1 << mH.mBpp;
+    if (0 < mH.mNumColors && mH.mNumColors < mNumColors) {
+      mNumColors = mH.mNumColors;
+    }
+
+    // Always allocate and zero 256 entries, even though mNumColors might be
+    // smaller, because the file might erroneously index past mNumColors.
+    mColors = MakeUnique<ColorTableEntry[]>(256);
+    memset(mColors.get(), 0, 256 * sizeof(ColorTableEntry));
+
+    // OS/2 Bitmaps have no padding byte.
+    mBytesPerColor = (mH.mBIHSize == InfoHeaderLength::WIN_V2) ? 3 : 4;
+  }
+
+  MOZ_ASSERT(!mImageData, "Already have a buffer allocated?");
+  IntSize targetSize = mDownscaler ? mDownscaler->TargetSize() : GetSize();
+  nsresult rv = AllocateFrame(/* aFrameNum = */ 0, targetSize,
+                              IntRect(IntPoint(), targetSize),
+                              SurfaceFormat::B8G8R8A8);
+  if (NS_FAILED(rv)) {
+    return Transition::Terminate(State::FAILURE);
+  }
+  MOZ_ASSERT(mImageData, "Should have a buffer now");
+
+  if (mDownscaler) {
+    // BMPs store their rows in reverse order, so the downscaler needs to
+    // reverse them again when writing its output.
+    rv = mDownscaler->BeginFrame(GetSize(), Nothing(),
+                                 mImageData, mMayHaveTransparency,
+                                 /* aFlipVertically = */ true);
+    if (NS_FAILED(rv)) {
+      return Transition::Terminate(State::FAILURE);
+    }
+  }
+
+  return Transition::To(State::COLOR_TABLE, mNumColors * mBytesPerColor);
+}
+
+LexerTransition<nsBMPDecoder::State>
+nsBMPDecoder::ReadColorTable(const char* aData, size_t aLength)
+{
+  MOZ_ASSERT_IF(aLength != 0, mNumColors > 0 && mColors);
+
+  mPreGapLength += aLength;
+
+  for (uint32_t i = 0; i < mNumColors; i++) {
+    // The format is BGR or BGR0.
+    mColors[i].mBlue  = uint8_t(aData[0]);
+    mColors[i].mGreen = uint8_t(aData[1]);
+    mColors[i].mRed   = uint8_t(aData[2]);
+    aData += mBytesPerColor;
+  }
+
+  // We know how many bytes we've read so far (mPreGapLength) and we know the
+  // offset of the pixel data (mH.mDataOffset), so we can determine the length
+  // of the gap (possibly zero) between the color table and the pixel data.
+  //
+  // If the gap is negative the file must be malformed (e.g. mH.mDataOffset
+  // points into the middle of the color palette instead of past the end) and
+  // we give up.
+  if (mPreGapLength > mH.mDataOffset) {
+    PostDataError();
+    return Transition::Terminate(State::FAILURE);
+  }
+  uint32_t gapLength = mH.mDataOffset - mPreGapLength;
+  return Transition::To(State::GAP, gapLength);
+}
+
+LexerTransition<nsBMPDecoder::State>
+nsBMPDecoder::SkipGap()
+{
+  bool hasRLE = mH.mCompression == Compression::RLE8 ||
+                mH.mCompression == Compression::RLE4;
+  return hasRLE
+       ? Transition::To(State::RLE_SEGMENT, RLE::SEGMENT_LENGTH)
+       : Transition::To(State::PIXEL_ROW, mPixelRowSize);
+}
+
+LexerTransition<nsBMPDecoder::State>
+nsBMPDecoder::ReadPixelRow(const char* aData)
+{
+  MOZ_ASSERT(mCurrentPos == 0);
+
+  const uint8_t* src = reinterpret_cast<const uint8_t*>(aData);
+  uint32_t* dst = RowBuffer();
+  uint32_t lpos = mH.mWidth;
+  switch (mH.mBpp) {
+    case 1:
+      while (lpos > 0) {
+        int8_t bit;
+        uint8_t idx;
+        for (bit = 7; bit >= 0 && lpos > 0; bit--) {
+          idx = (*src >> bit) & 1;
+          SetPixel(dst, idx, mColors);
+          --lpos;
+        }
+        ++src;
+      }
+      break;
+
+    case 4:
+      while (lpos > 0) {
+        Set4BitPixel(dst, *src, lpos, mColors);
+        ++src;
+      }
+      break;
+
+    case 8:
+      while (lpos > 0) {
+        SetPixel(dst, *src, mColors);
+        --lpos;
+        ++src;
+      }
+      break;
+
+    case 16:
+      if (mBitFields.IsR5G5B5()) {
+        // Specialize this common case.
+        while (lpos > 0) {
+          uint16_t val = LittleEndian::readUint16(src);
+          SetPixel(dst, mBitFields.mRed.Get5(val),
+                        mBitFields.mGreen.Get5(val),
+                        mBitFields.mBlue.Get5(val));
+          --lpos;
+          src += 2;
+        }
+      } else {
+        bool anyHasAlpha = false;
+        while (lpos > 0) {
+          uint16_t val = LittleEndian::readUint16(src);
+          SetPixel(dst, mBitFields.mRed.Get(val),
+                        mBitFields.mGreen.Get(val),
+                        mBitFields.mBlue.Get(val),
+                        mBitFields.mAlpha.GetAlpha(val, anyHasAlpha));
+          --lpos;
+          src += 2;
+        }
+        if (anyHasAlpha) {
+          MOZ_ASSERT(mMayHaveTransparency);
+          mDoesHaveTransparency = true;
+        }
+      }
+      break;
+
+    case 24:
+      while (lpos > 0) {
+        SetPixel(dst, src[2], src[1], src[0]);
+        --lpos;
+        src += 3;
+      }
+      break;
+
+    case 32:
+      if (mH.mCompression == Compression::RGB && mIsWithinICO &&
+          mH.mBpp == 32) {
+        // This is a special case only used for 32bpp WinBMPv3-ICO files, which
+        // could be in either 0RGB or ARGB format.
+        while (lpos > 0) {
+          // If src[3] is zero, we can't tell at this point if the image is
+          // 0RGB or ARGB. So we just use 0 value as-is. If the image is 0RGB
+          // then mDoesHaveTransparency will be false at the end, we'll treat
+          // the image as opaque, and the 0 alpha values will be ignored. If
+          // the image is ARGB then mDoesHaveTransparency will be true at the
+          // end and we'll treat the image as non-opaque. (Note: a
+          // fully-transparent ARGB image is indistinguishable from a 0RGB
+          // image, and we will render such an image as a 0RGB image, i.e.
+          // opaquely. This is unlikely to be a problem in practice.)
+          if (src[3] != 0) {
+            MOZ_ASSERT(mMayHaveTransparency);
+            mDoesHaveTransparency = true;
+          }
+          SetPixel(dst, src[2], src[1], src[0], src[3]);
+          src += 4;
+          --lpos;
+        }
+      } else if (mBitFields.IsR8G8B8()) {
+        // Specialize this common case.
+        while (lpos > 0) {
+          uint32_t val = LittleEndian::readUint32(src);
+          SetPixel(dst, mBitFields.mRed.Get8(val),
+                        mBitFields.mGreen.Get8(val),
+                        mBitFields.mBlue.Get8(val));
+          --lpos;
+          src += 4;
+        }
+      } else {
+        bool anyHasAlpha = false;
+        while (lpos > 0) {
+          uint32_t val = LittleEndian::readUint32(src);
+          SetPixel(dst, mBitFields.mRed.Get(val),
+                        mBitFields.mGreen.Get(val),
+                        mBitFields.mBlue.Get(val),
+                        mBitFields.mAlpha.GetAlpha(val, anyHasAlpha));
+          --lpos;
+          src += 4;
+        }
+        if (anyHasAlpha) {
+          MOZ_ASSERT(mMayHaveTransparency);
+          mDoesHaveTransparency = true;
+        }
+      }
+      break;
+
+    default:
+      MOZ_CRASH("Unsupported color depth; earlier check didn't catch it?");
+  }
+
+  FinishRow();
+  return mCurrentRow == 0
+       ? Transition::Terminate(State::SUCCESS)
+       : Transition::To(State::PIXEL_ROW, mPixelRowSize);
+}
+
+LexerTransition<nsBMPDecoder::State>
+nsBMPDecoder::ReadRLESegment(const char* aData)
+{
+  if (mCurrentRow == 0) {
+    return Transition::Terminate(State::SUCCESS);
+  }
+
+  uint8_t byte1 = uint8_t(aData[0]);
+  uint8_t byte2 = uint8_t(aData[1]);
+
+  if (byte1 != RLE::ESCAPE) {
+    // Encoded mode consists of two bytes: byte1 specifies the number of
+    // consecutive pixels to be drawn using the color index contained in
+    // byte2.
+    //
+    // Work around bitmaps that specify too many pixels.
+    uint32_t pixelsNeeded =
+      std::min<uint32_t>(mH.mWidth - mCurrentPos, byte1);
+    if (pixelsNeeded) {
+      uint32_t* dst = RowBuffer();
+      mCurrentPos += pixelsNeeded;
+      if (mH.mCompression == Compression::RLE8) {
+        do {
+          SetPixel(dst, byte2, mColors);
+          pixelsNeeded --;
+        } while (pixelsNeeded);
+      } else {
+        do {
+          Set4BitPixel(dst, byte2, pixelsNeeded, mColors);
+        } while (pixelsNeeded);
+      }
+    }
+    return Transition::To(State::RLE_SEGMENT, RLE::SEGMENT_LENGTH);
+  }
+
+  if (byte2 == RLE::ESCAPE_EOL) {
+    mCurrentPos = 0;
+    FinishRow();
+    return mCurrentRow == 0
+         ? Transition::Terminate(State::SUCCESS)
+         : Transition::To(State::RLE_SEGMENT, RLE::SEGMENT_LENGTH);
+  }
+
+  if (byte2 == RLE::ESCAPE_EOF) {
+    return Transition::Terminate(State::SUCCESS);
+  }
+
+  if (byte2 == RLE::ESCAPE_DELTA) {
+    return Transition::To(State::RLE_DELTA, RLE::DELTA_LENGTH);
+  }
+
+  // Absolute mode. |byte2| gives the number of pixels. The length depends on
+  // whether it's 4-bit or 8-bit RLE. Also, the length must be even (and zero
+  // padding is used to achieve this when necessary).
+  MOZ_ASSERT(mAbsoluteModeNumPixels == 0);
+  mAbsoluteModeNumPixels = byte2;
+  uint32_t length = byte2;
+  if (mH.mCompression == Compression::RLE4) {
+    length = (length + 1) / 2;    // halve, rounding up
+  }
+  if (length & 1) {
+    length++;
+  }
+  return Transition::To(State::RLE_ABSOLUTE, length);
+}
+
+LexerTransition<nsBMPDecoder::State>
+nsBMPDecoder::ReadRLEDelta(const char* aData)
+{
+  // Delta encoding makes it possible to skip pixels making part of the image
+  // transparent.
+  MOZ_ASSERT(mMayHaveTransparency);
+  mDoesHaveTransparency = true;
+
+  if (mDownscaler) {
+    // Clear the skipped pixels. (This clears to the end of the row,
+    // which is perfect if there's a Y delta and harmless if not).
+    mDownscaler->ClearRow(/* aStartingAtCol = */ mCurrentPos);
+  }
+
+  // Handle the XDelta.
+  mCurrentPos += uint8_t(aData[0]);
+  if (mCurrentPos > mH.mWidth) {
+    mCurrentPos = mH.mWidth;
+  }
+
+  // Handle the Y Delta.
+  int32_t yDelta = std::min<int32_t>(uint8_t(aData[1]), mCurrentRow);
+  mCurrentRow -= yDelta;
+
+  if (mDownscaler && yDelta > 0) {
+    // Commit the current row (the first of the skipped rows).
+    mDownscaler->CommitRow();
+
+    // Clear and commit the remaining skipped rows.
+    for (int32_t line = 1; line < yDelta; line++) {
+      mDownscaler->ClearRow();
+      mDownscaler->CommitRow();
+    }
+  }
+
+  return mCurrentRow == 0
+       ? Transition::Terminate(State::SUCCESS)
+       : Transition::To(State::RLE_SEGMENT, RLE::SEGMENT_LENGTH);
+}
+
+LexerTransition<nsBMPDecoder::State>
+nsBMPDecoder::ReadRLEAbsolute(const char* aData, size_t aLength)
+{
+  uint32_t n = mAbsoluteModeNumPixels;
+  mAbsoluteModeNumPixels = 0;
+
+  if (mCurrentPos + n > uint32_t(mH.mWidth)) {
+    // Bad data. Stop decoding; at least part of the image may have been
+    // decoded.
+    return Transition::Terminate(State::SUCCESS);
+  }
+
+  // In absolute mode, n represents the number of pixels that follow, each of
+  // which contains the color index of a single pixel.
+  uint32_t* dst = RowBuffer();
+  uint32_t iSrc = 0;
+  uint32_t* oldPos = dst;
+  if (mH.mCompression == Compression::RLE8) {
+    while (n > 0) {
+      SetPixel(dst, aData[iSrc], mColors);
+      n--;
+      iSrc++;
+    }
+  } else {
+    while (n > 0) {
+      Set4BitPixel(dst, aData[iSrc], n, mColors);
+      iSrc++;
+    }
+  }
+  mCurrentPos += dst - oldPos;
+
+  // We should read all the data (unless the last byte is zero padding).
+  MOZ_ASSERT(iSrc == aLength - 1 || iSrc == aLength);
+
+  return Transition::To(State::RLE_SEGMENT, RLE::SEGMENT_LENGTH);
 }
 
 } // namespace image
diff --git a/image/decoders/nsBMPDecoder.h b/image/decoders/nsBMPDecoder.h
index f803302e01..efae6dcc48 100644
--- a/image/decoders/nsBMPDecoder.h
+++ b/image/decoders/nsBMPDecoder.h
@@ -1,158 +1,247 @@
-/* vim:set tw=80 expandtab softtabstop=4 ts=4 sw=4: */
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-
 #ifndef mozilla_image_decoders_nsBMPDecoder_h
 #define mozilla_image_decoders_nsBMPDecoder_h
 
-#include "BMPFileHeaders.h"
+#include "BMPHeaders.h"
 #include "Decoder.h"
 #include "gfxColor.h"
-#include "nsAutoPtr.h"
+#include "StreamingLexer.h"
+#include "mozilla/UniquePtr.h"
 
 namespace mozilla {
 namespace image {
 
+namespace bmp {
+
+/// This struct contains the fields from the file header and info header that
+/// we use during decoding. (Excluding bitfields fields, which are kept in
+/// BitFields.)
+struct Header {
+  uint32_t mDataOffset;     // Offset to raster data.
+  uint32_t mBIHSize;        // Header size.
+  int32_t  mWidth;          // Image width.
+  int32_t  mHeight;         // Image height.
+  uint16_t mBpp;            // Bits per pixel.
+  uint32_t mCompression;    // See struct Compression for valid values.
+  uint32_t mImageSize;      // (compressed) image size. Can be 0 if
+                            // mCompression==0.
+  uint32_t mNumColors;      // Used colors.
+
+  Header()
+   : mDataOffset(0)
+   , mBIHSize(0)
+   , mWidth(0)
+   , mHeight(0)
+   , mBpp(0)
+   , mCompression(0)
+   , mImageSize(0)
+   , mNumColors(0)
+  {}
+};
+
+/// An entry in the color table.
+struct ColorTableEntry {
+  uint8_t mRed;
+  uint8_t mGreen;
+  uint8_t mBlue;
+};
+
+/// All the color-related bitfields for 16bpp and 32bpp images. We use this
+/// even for older format BMPs that don't have explicit bitfields.
+class BitFields {
+  class Value {
+    friend class BitFields;
+
+    uint32_t mMask;       // The mask for the value.
+    uint8_t mRightShift;  // The amount to right-shift after masking.
+    uint8_t mBitWidth;    // The width (in bits) of the value.
+
+    /// Sets the mask (and thus the right-shift and bit-width as well).
+    void Set(uint32_t aMask);
+
+  public:
+    Value()
+    {
+      mMask = 0;
+      mRightShift = 0;
+      mBitWidth = 0;
+    }
+
+    /// Returns true if this channel is used. Only used for alpha.
+    bool IsPresent() const { return mMask != 0x0; }
+
+    /// Extracts the single color value from the multi-color value.
+    uint8_t Get(uint32_t aVal) const;
+
+    /// Like Get(), but specially for alpha.
+    uint8_t GetAlpha(uint32_t aVal, bool& aHasAlphaOut) const;
+
+    /// Specialized versions of Get() for when the bit-width is 5 or 8.
+    /// (They will assert if called and the bit-width is not 5 or 8.)
+    uint8_t Get5(uint32_t aVal) const;
+    uint8_t Get8(uint32_t aVal) const;
+  };
+
+public:
+  /// The individual color channels.
+  Value mRed;
+  Value mGreen;
+  Value mBlue;
+  Value mAlpha;
+
+  /// Set bitfields to the standard 5-5-5 16bpp values.
+  void SetR5G5B5();
+
+  /// Set bitfields to the standard 8-8-8 32bpp values.
+  void SetR8G8B8();
+
+  /// Test if bitfields have the standard 5-5-5 16bpp values.
+  bool IsR5G5B5() const;
+
+  /// Test if bitfields have the standard 8-8-8 32bpp values.
+  bool IsR8G8B8() const;
+
+  /// Read the bitfields from a header. The reading of the alpha mask is
+  /// optional.
+  void ReadFromHeader(const char* aData, bool aReadAlpha);
+
+  /// Length of the bitfields structure in the BMP file.
+  static const size_t LENGTH = 12;
+};
+
+} // namespace bmp
+
 class RasterImage;
 
-/// Decoder for BMP-Files, as used by Windows and OS/2
+/// Decoder for BMP-Files, as used by Windows and OS/2.
 
 class nsBMPDecoder : public Decoder
 {
 public:
-    ~nsBMPDecoder();
+  ~nsBMPDecoder();
 
-    // Specifies whether or not the BMP file will contain alpha data
-    // If set to true and the BMP is 32BPP, the alpha data will be
-    // retrieved from the 4th byte of image data per pixel
-    void SetUseAlphaData(bool useAlphaData);
+  /// Obtains the bits per pixel from the internal BIH header.
+  int32_t GetBitsPerPixel() const;
 
-    // Obtains the bits per pixel from the internal BIH header
-    int32_t GetBitsPerPixel() const;
+  /// Obtains the width from the internal BIH header.
+  int32_t GetWidth() const;
 
-    // Obtains the width from the internal BIH header
-    int32_t GetWidth() const;
+  /// Obtains the abs-value of the height from the internal BIH header.
+  int32_t GetHeight() const;
 
-    // Obtains the abs-value of the height from the internal BIH header
-    int32_t GetHeight() const;
+  /// Obtains the internal output image buffer.
+  uint32_t* GetImageData();
+  size_t GetImageDataLength() const { return mImageDataLength; }
 
-    // Obtains the internal output image buffer
-    uint32_t* GetImageData();
-    size_t GetImageDataLength() const { return mImageDataLength; }
+  /// Obtains the size of the compressed image resource.
+  int32_t GetCompressedImageSize() const;
 
-    // Obtains the size of the compressed image resource
-    int32_t GetCompressedImageSize() const;
+  /// Mark this BMP as being within an ICO file. Only used for testing purposes
+  /// because the ICO-specific constructor does this marking automatically.
+  void SetIsWithinICO() { mIsWithinICO = true; }
 
-    // Obtains whether or not a BMP file had alpha data in its 4th byte
-    // for 32BPP bitmaps.  Only use after the bitmap has been processed.
-    bool HasAlphaData() const { return mHaveAlphaData; }
+  /// Did the BMP file have alpha data of any kind? (Only use this after the
+  /// bitmap has been fully decoded.)
+  bool HasTransparency() const { return mDoesHaveTransparency; }
 
-    /// Marks this BMP as having alpha data (due to e.g. an ICO alpha mask).
-    void SetHasAlphaData() { mHaveAlphaData = true; }
+  /// Force transparency from outside. (Used by the ICO decoder.)
+  void SetHasTransparency()
+  {
+    mMayHaveTransparency = true;
+    mDoesHaveTransparency = true;
+  }
 
-    virtual void WriteInternal(const char* aBuffer,
-                               uint32_t aCount) override;
-    virtual void FinishInternal() override;
+  virtual void WriteInternal(const char* aBuffer,
+                             uint32_t aCount) override;
+  virtual void FinishInternal() override;
 
 private:
-    friend class DecoderFactory;
-    friend class nsICODecoder;
+  friend class DecoderFactory;
+  friend class nsICODecoder;
 
-    // Decoders should only be instantiated via DecoderFactory.
-    // XXX(seth): nsICODecoder is temporarily an exception to this rule.
-    explicit nsBMPDecoder(RasterImage* aImage);
+  enum class State {
+    FILE_HEADER,
+    INFO_HEADER_SIZE,
+    INFO_HEADER_REST,
+    BITFIELDS,
+    COLOR_TABLE,
+    GAP,
+    PIXEL_ROW,
+    RLE_SEGMENT,
+    RLE_DELTA,
+    RLE_ABSOLUTE,
+    SUCCESS,
+    FAILURE
+  };
 
-    /// Calculates the red-, green- and blueshift in mBitFields using
-    /// the bitmasks from mBitFields
-    NS_METHOD CalcBitShift();
+  // This is the constructor used by DecoderFactory.
+  explicit nsBMPDecoder(RasterImage* aImage);
 
-    uint32_t mPos; //< Number of bytes read from aBuffer in WriteInternal()
+  // This is the constructor used by nsICODecoder.
+  // XXX(seth): nsICODecoder is temporarily an exception to the rule that
+  //            decoders should only be instantiated via DecoderFactory.
+  nsBMPDecoder(RasterImage* aImage, uint32_t aDataOffset);
 
-    BMPFILEHEADER mBFH;
-    BITMAPV5HEADER mBIH;
-    char mRawBuf[BIH_INTERNAL_LENGTH::WIN_V3]; //< If this is changed,
-                                               // WriteInternal() MUST be updated
+  // Helper constructor called by the other two.
+  nsBMPDecoder(RasterImage* aImage, State aState, size_t aLength);
 
-    uint32_t mLOH; //< Length of the header
+  uint32_t* RowBuffer();
 
-    uint32_t mNumColors; //< The number of used colors, i.e. the number of
-                         // entries in mColors
-    colorTable* mColors;
+  void FinishRow();
 
-    bitFields mBitFields;
+  LexerTransition<State> ReadFileHeader(const char* aData, size_t aLength);
+  LexerTransition<State> ReadInfoHeaderSize(const char* aData, size_t aLength);
+  LexerTransition<State> ReadInfoHeaderRest(const char* aData, size_t aLength);
+  LexerTransition<State> ReadBitfields(const char* aData, size_t aLength);
+  LexerTransition<State> ReadColorTable(const char* aData, size_t aLength);
+  LexerTransition<State> SkipGap();
+  LexerTransition<State> ReadPixelRow(const char* aData);
+  LexerTransition<State> ReadRLESegment(const char* aData);
+  LexerTransition<State> ReadRLEDelta(const char* aData);
+  LexerTransition<State> ReadRLEAbsolute(const char* aData, size_t aLength);
 
-    uint8_t* mRow;      //< Holds one raw line of the image
-    uint32_t mRowBytes; //< How many bytes of the row were already received
-    int32_t mCurLine;   //< Index of the line of the image that's currently
-                        // being decoded: [height,1]
-    int32_t mOldLine;   //< Previous index of the line
-    int32_t mCurPos;    //< Index in the current line of the image
+  StreamingLexer<State> mLexer;
 
-    ERLEState mState;   //< Maintains the current state of the RLE decoding
-    uint32_t mStateData;//< Decoding information that is needed depending
-                        // on mState
+  bmp::Header mH;
 
-    /// Set mBFH from the raw data in mRawBuf, converting from little-endian
-    /// data to native data as necessary
-    void ProcessFileHeader();
+  // If the BMP is within an ICO file our treatment of it differs slightly.
+  bool mIsWithinICO;
 
-    /// Set mBIH from the raw data in mRawBuf, converting from little-endian
-    /// data to native data as necessary
-    void ProcessInfoHeader();
+  bmp::BitFields mBitFields;
 
-    /// True if we've already processed the BMP header.
-    bool mProcessedHeader;
+  // Might the image have transparency? Determined from the headers during
+  // metadata decode. (Does not guarantee the image actually has transparency.)
+  bool mMayHaveTransparency;
 
-    // Stores whether the image data may store alpha data, or if
-    // the alpha data is unspecified and filled with a padding byte of 0.
-    // When a 32BPP bitmap is stored in an ICO or CUR file, its 4th byte
-    // is used for alpha transparency.  When it is stored in a BMP, its
-    // 4th byte is reserved and is always 0.
-    // Reference:
-    // http://en.wikipedia.org/wiki/ICO_(file_format)#cite_note-9
-    // Bitmaps where the alpha bytes are all 0 should be fully visible.
-    bool mUseAlphaData;
+  // Does the image have transparency? Determined during full decoding, so only
+  // use this after that has been completed.
+  bool mDoesHaveTransparency;
 
-    // Whether the 4th byte alpha data was found to be non zero and hence used.
-    bool mHaveAlphaData;
+  uint32_t mNumColors;      // The number of used colors, i.e. the number of
+                            // entries in mColors, if it's present.
+  UniquePtr<bmp::ColorTableEntry[]> mColors; // The color table, if it's present.
+  uint32_t mBytesPerColor;  // 3 or 4, depending on the format
+
+  // The number of bytes prior to the optional gap that have been read. This
+  // is used to find the start of the pixel data.
+  uint32_t mPreGapLength;
+
+  uint32_t mPixelRowSize;   // The number of bytes per pixel row.
+
+  int32_t mCurrentRow;      // Index of the row of the image that's currently
+                            // being decoded: [height,1].
+  int32_t mCurrentPos;      // Index into the current line; only used when
+                            // doing RLE decoding.
+
+  // Only used in RLE_ABSOLUTE state: the number of pixels to read.
+  uint32_t mAbsoluteModeNumPixels;
 };
 
-/// Sets the pixel data in aDecoded to the given values.
-/// @param aDecoded pointer to pixel to be set, will be incremented to point to
-/// the next pixel.
-static inline void
-SetPixel(uint32_t*& aDecoded, uint8_t aRed, uint8_t aGreen,
-         uint8_t aBlue, uint8_t aAlpha = 0xFF)
-{
-    *aDecoded++ = gfxPackedPixel(aAlpha, aRed, aGreen, aBlue);
-}
-
-static inline void
-SetPixel(uint32_t*& aDecoded, uint8_t idx, colorTable* aColors)
-{
-    SetPixel(aDecoded, aColors[idx].red, aColors[idx].green, aColors[idx].blue);
-}
-
-/// Sets two (or one if aCount = 1) pixels
-/// @param aDecoded where the data is stored. Will be moved 4 resp 8 bytes
-/// depending on whether one or two pixels are written.
-/// @param aData The values for the two pixels
-/// @param aCount Current count. Is decremented by one or two.
-inline void
-Set4BitPixel(uint32_t*& aDecoded, uint8_t aData, uint32_t& aCount,
-             colorTable* aColors)
-{
-    uint8_t idx = aData >> 4;
-    SetPixel(aDecoded, idx, aColors);
-    if (--aCount > 0) {
-        idx = aData & 0xF;
-        SetPixel(aDecoded, idx, aColors);
-        --aCount;
-    }
-}
-
 } // namespace image
 } // namespace mozilla
 
diff --git a/image/decoders/nsGIFDecoder2.cpp b/image/decoders/nsGIFDecoder2.cpp
index 76b6453ce0..2f382cfbca 100644
--- a/image/decoders/nsGIFDecoder2.cpp
+++ b/image/decoders/nsGIFDecoder2.cpp
@@ -206,17 +206,17 @@ nsGIFDecoder2::BeginGIF()
   PostSize(mGIFStruct.screen_width, mGIFStruct.screen_height);
 }
 
-void
+bool
 nsGIFDecoder2::CheckForTransparency(IntRect aFrameRect)
 {
   // Check if the image has a transparent color in its palette.
   if (mGIFStruct.is_transparent) {
     PostHasTransparency();
-    return;
+    return true;
   }
 
   if (mGIFStruct.images_decoded > 0) {
-    return;  // We only care about first frame padding below.
+    return false;  // We only care about first frame padding below.
   }
 
   // If we need padding on the first frame, that means we don't draw into part
@@ -224,7 +224,11 @@ nsGIFDecoder2::CheckForTransparency(IntRect aFrameRect)
   IntRect imageRect(0, 0, mGIFStruct.screen_width, mGIFStruct.screen_height);
   if (!imageRect.IsEqualEdges(aFrameRect)) {
     PostHasTransparency();
+    mSawTransparency = true;  // Make sure we don't optimize it away.
+    return true;
   }
+
+  return false;
 }
 
 //******************************************************************************
@@ -233,31 +237,23 @@ nsGIFDecoder2::BeginImageFrame(uint16_t aDepth)
 {
   MOZ_ASSERT(HasSize());
 
-  gfx::SurfaceFormat format;
-  if (mGIFStruct.is_transparent) {
-    format = gfx::SurfaceFormat::B8G8R8A8;
-  } else {
-    format = gfx::SurfaceFormat::B8G8R8X8;
-  }
-
   IntRect frameRect(mGIFStruct.x_offset, mGIFStruct.y_offset,
                     mGIFStruct.width, mGIFStruct.height);
 
-  CheckForTransparency(frameRect);
+  bool hasTransparency = CheckForTransparency(frameRect);
+  gfx::SurfaceFormat format = hasTransparency ? SurfaceFormat::B8G8R8A8
+                                              : SurfaceFormat::B8G8R8X8;
 
   // Make sure there's no animation if we're downscaling.
   MOZ_ASSERT_IF(mDownscaler, !GetImageMetadata().HasAnimation());
 
+  // Compute the target size and target frame rect. If we're downscaling,
+  // Downscaler will automatically strip out first-frame padding, so the target
+  // frame rect takes up the entire frame regardless.
   IntSize targetSize = mDownscaler ? mDownscaler->TargetSize()
                                    : GetSize();
-
-  // Rescale the frame rect for the target size.
-  IntRect targetFrameRect = frameRect;
-  if (mDownscaler) {
-    IntSize originalSize = GetSize();
-    targetFrameRect.ScaleRoundOut(double(targetSize.width) / originalSize.width,
-                                  double(targetSize.height) / originalSize.height);
-  }
+  IntRect targetFrameRect = mDownscaler ? IntRect(IntPoint(), targetSize)
+                                        : frameRect;
 
   // Use correct format, RGB for first frame, PAL for following frames
   // and include transparency to allow for optimization of opaque images
@@ -279,8 +275,8 @@ nsGIFDecoder2::BeginImageFrame(uint16_t aDepth)
   }
 
   if (mDownscaler) {
-    rv = mDownscaler->BeginFrame(frameRect.Size(), mImageData,
-                                 mGIFStruct.is_transparent);
+    rv = mDownscaler->BeginFrame(GetSize(), Some(frameRect), mImageData,
+                                 hasTransparency);
   }
 
   return rv;
@@ -318,7 +314,7 @@ nsGIFDecoder2::EndImageFrame()
     // should fix that. We can also mark it opaque unconditionally if we didn't
     // actually see any transparent pixels - this test is only valid for the
     // first frame.
-    if (!mGIFStruct.is_transparent || !mSawTransparency) {
+    if (!mGIFStruct.is_transparent && !mSawTransparency) {
       opacity = Opacity::OPAQUE;
     }
   }
diff --git a/image/decoders/nsGIFDecoder2.h b/image/decoders/nsGIFDecoder2.h
index 5a54b17599..952c6015a6 100644
--- a/image/decoders/nsGIFDecoder2.h
+++ b/image/decoders/nsGIFDecoder2.h
@@ -50,7 +50,7 @@ private:
   bool      DoLzw(const uint8_t* q);
   bool      SetHold(const uint8_t* buf, uint32_t count,
                     const uint8_t* buf2 = nullptr, uint32_t count2 = 0);
-  void      CheckForTransparency(gfx::IntRect aFrameRect);
+  bool      CheckForTransparency(gfx::IntRect aFrameRect);
 
   inline int ClearCode() const { return 1 << mGIFStruct.datasize; }
 
diff --git a/image/decoders/nsICODecoder.cpp b/image/decoders/nsICODecoder.cpp
index 3ad8ab0a38..c3cf987099 100644
--- a/image/decoders/nsICODecoder.cpp
+++ b/image/decoders/nsICODecoder.cpp
@@ -21,7 +21,7 @@ namespace image {
 
 // Constants.
 static const uint32_t ICOHEADERSIZE = 6;
-static const uint32_t BITMAPINFOSIZE = 40;
+static const uint32_t BITMAPINFOSIZE = bmp::InfoHeaderLength::WIN_ICO;
 
 // ----------------------------------------
 // Actual Data Processing
@@ -110,42 +110,6 @@ nsICODecoder::GetFinalStateFromContainedDecoder()
   MOZ_ASSERT(HasError() || !mCurrentFrame || mCurrentFrame->IsImageComplete());
 }
 
-// Returns a buffer filled with the bitmap file header in little endian:
-// Signature 2 bytes 'BM'
-// FileSize      4 bytes File size in bytes
-// reserved      4 bytes unused (=0)
-// DataOffset    4 bytes File offset to Raster Data
-// Returns true if successful
-bool
-nsICODecoder::FillBitmapFileHeaderBuffer(int8_t* bfh)
-{
-  memset(bfh, 0, 14);
-  bfh[0] = 'B';
-  bfh[1] = 'M';
-  int32_t dataOffset = 0;
-  int32_t fileSize = 0;
-  dataOffset = BMPFILEHEADER::LENGTH + BITMAPINFOSIZE;
-
-  // The color table is present only if BPP is <= 8
-  if (mDirEntry.mBitCount <= 8) {
-    uint16_t numColors = GetNumColors();
-    if (numColors == (uint16_t)-1) {
-      return false;
-    }
-    dataOffset += 4 * numColors;
-    fileSize = dataOffset + GetRealWidth() * GetRealHeight();
-  } else {
-    fileSize = dataOffset + (mDirEntry.mBitCount * GetRealWidth() *
-                             GetRealHeight()) / 8;
-  }
-
-  NativeEndian::swapToLittleEndianInPlace(&fileSize, 1);
-  memcpy(bfh + 2, &fileSize, sizeof(fileSize));
-  NativeEndian::swapToLittleEndianInPlace(&dataOffset, 1);
-  memcpy(bfh + 10, &dataOffset, sizeof(dataOffset));
-  return true;
-}
-
 bool
 nsICODecoder::CheckAndFixBitmapSize(int8_t* bih)
 {
@@ -389,19 +353,6 @@ nsICODecoder::SniffResource(const char* aData)
                                     ICOState::READ_PNG,
                                     toRead);
   } else {
-    // Create a BMP decoder which will do most of the work for us; the exception
-    // is the AND mask, which isn't present in standalone BMPs.
-    nsBMPDecoder* bmpDecoder = new nsBMPDecoder(mImage);
-    mContainedDecoder = bmpDecoder;
-    bmpDecoder->SetUseAlphaData(true);
-    mContainedDecoder->SetMetadataDecode(IsMetadataDecode());
-    mContainedDecoder->SetDecoderFlags(GetDecoderFlags());
-    mContainedDecoder->SetSurfaceFlags(GetSurfaceFlags());
-    if (mDownscaler) {
-      mContainedDecoder->SetTargetSize(mDownscaler->TargetSize());
-    }
-    mContainedDecoder->Init();
-
     // Make sure we have a sane size for the bitmap information header.
     int32_t bihSize = ReadBIHSize(aData);
     if (bihSize != static_cast<int32_t>(BITMAPINFOSIZE)) {
@@ -444,17 +395,30 @@ nsICODecoder::ReadBIH(const char* aData)
   mBPP = ReadBPP(mBIHraw);
 
   // The ICO format when containing a BMP does not include the 14 byte
-  // bitmap file header. To use the code of the BMP decoder we need to
-  // generate this header ourselves and feed it to the BMP decoder.
-  int8_t bfhBuffer[BMPFILEHEADERSIZE];
-  if (!FillBitmapFileHeaderBuffer(bfhBuffer)) {
-    return Transition::Terminate(ICOState::FAILURE);
+  // bitmap file header. So we create the BMP decoder via the constructor that
+  // tells it to skip this, and pass in the required data (dataOffset) that
+  // would have been present in the header.
+  uint32_t dataOffset = bmp::FILE_HEADER_LENGTH + BITMAPINFOSIZE;
+  if (mDirEntry.mBitCount <= 8) {
+    // The color table is present only if BPP is <= 8.
+    uint16_t numColors = GetNumColors();
+    if (numColors == (uint16_t)-1) {
+      return Transition::Terminate(ICOState::FAILURE);
+    }
+    dataOffset += 4 * numColors;
   }
 
-  if (!WriteToContainedDecoder(reinterpret_cast<const char*>(bfhBuffer),
-                               sizeof(bfhBuffer))) {
-    return Transition::Terminate(ICOState::FAILURE);
+  // Create a BMP decoder which will do most of the work for us; the exception
+  // is the AND mask, which isn't present in standalone BMPs.
+  RefPtr<nsBMPDecoder> bmpDecoder = new nsBMPDecoder(mImage, dataOffset);
+  mContainedDecoder = bmpDecoder;
+  mContainedDecoder->SetMetadataDecode(IsMetadataDecode());
+  mContainedDecoder->SetDecoderFlags(GetDecoderFlags());
+  mContainedDecoder->SetSurfaceFlags(GetSurfaceFlags());
+  if (mDownscaler) {
+    mContainedDecoder->SetTargetSize(mDownscaler->TargetSize());
   }
+  mContainedDecoder->Init();
 
   // Verify that the BIH width and height values match the ICO directory entry,
   // and fix the BIH height value to compensate for the fact that the underlying
@@ -472,8 +436,6 @@ nsICODecoder::ReadBIH(const char* aData)
   // contained resource over our own information.
   // XXX(seth): Is this ever different than the value we obtained from
   // ReadBPP() above?
-  RefPtr<nsBMPDecoder> bmpDecoder =
-    static_cast<nsBMPDecoder*>(mContainedDecoder.get());
   mBPP = bmpDecoder->GetBitsPerPixel();
 
   // Check to make sure we have valid color settings.
@@ -520,9 +482,9 @@ nsICODecoder::PrepareForMask()
   MOZ_ASSERT(bmpLengthWithHeader < mDirEntry.mBytesInRes);
   uint32_t maskLength = mDirEntry.mBytesInRes - bmpLengthWithHeader;
 
-  // If we have a 32-bpp BMP with alpha data, we ignore the AND mask. We can
+  // If the BMP provides its own transparency, we ignore the AND mask. We can
   // also obviously ignore it if the image has zero width or zero height.
-  if ((bmpDecoder->GetBitsPerPixel() == 32 && bmpDecoder->HasAlphaData()) ||
+  if (bmpDecoder->HasTransparency() ||
       GetRealWidth() == 0 || GetRealHeight() == 0) {
     return Transition::ToUnbuffered(ICOState::FINISHED_RESOURCE,
                                     ICOState::SKIP_MASK,
@@ -548,7 +510,7 @@ nsICODecoder::PrepareForMask()
                  mDownscaler->TargetSize().height *
                  sizeof(uint32_t));
     mMaskBuffer = MakeUnique<uint8_t[]>(bmpDecoder->GetImageDataLength());
-    nsresult rv = mDownscaler->BeginFrame(GetRealSize(),
+    nsresult rv = mDownscaler->BeginFrame(GetRealSize(), Nothing(),
                                           mMaskBuffer.get(),
                                           /* aHasAlpha = */ true,
                                           /* aFlipVertically = */ true);
@@ -653,7 +615,7 @@ nsICODecoder::FinishMask()
 
     RefPtr<nsBMPDecoder> bmpDecoder =
       static_cast<nsBMPDecoder*>(mContainedDecoder.get());
-    bmpDecoder->SetHasAlphaData();
+    bmpDecoder->SetHasTransparency();
   }
 
   return Transition::To(ICOState::FINISHED_RESOURCE, 0);
diff --git a/image/decoders/nsICODecoder.h b/image/decoders/nsICODecoder.h
index 80c57d56cd..9e724520ce 100644
--- a/image/decoders/nsICODecoder.h
+++ b/image/decoders/nsICODecoder.h
@@ -7,7 +7,6 @@
 #ifndef mozilla_image_decoders_nsICODecoder_h
 #define mozilla_image_decoders_nsICODecoder_h
 
-#include "nsAutoPtr.h"
 #include "StreamingLexer.h"
 #include "Decoder.h"
 #include "imgFrame.h"
@@ -88,8 +87,6 @@ private:
   // Gets decoder state from the contained decoder so it's visible externally.
   void GetFinalStateFromContainedDecoder();
 
-  // Creates a bitmap file header buffer, returns true if successful
-  bool FillBitmapFileHeaderBuffer(int8_t* bfh);
   /**
    * Verifies that the width and height values in @aBIH are valid and match the
    * values we read from the ICO directory entry. If everything looks OK, the
@@ -122,7 +119,7 @@ private:
   StreamingLexer<ICOState, 32> mLexer; // The lexer.
   RefPtr<Decoder> mContainedDecoder; // Either a BMP or PNG decoder.
   UniquePtr<uint8_t[]> mMaskBuffer;    // A temporary buffer for the alpha mask.
-  char mBIHraw[40];                    // The bitmap information header.
+  char mBIHraw[bmp::InfoHeaderLength::WIN_ICO]; // The bitmap information header.
   IconDirEntry mDirEntry;              // The dir entry for the selected resource.
   gfx::IntSize mBiggestResourceSize;        // Used to select the intrinsic size.
   gfx::IntSize mBiggestResourceHotSpot;     // Used to select the intrinsic size.
diff --git a/image/decoders/nsIconDecoder.cpp b/image/decoders/nsIconDecoder.cpp
index 55666f67dd..72df5913d3 100644
--- a/image/decoders/nsIconDecoder.cpp
+++ b/image/decoders/nsIconDecoder.cpp
@@ -93,7 +93,7 @@ nsIconDecoder::WriteInternal(const char* aBuffer, uint32_t aCount)
         MOZ_ASSERT(mImageData, "Should have a buffer now");
 
         if (mDownscaler) {
-          nsresult rv = mDownscaler->BeginFrame(GetSize(),
+          nsresult rv = mDownscaler->BeginFrame(GetSize(), Nothing(),
                                                 mImageData,
                                                 /* aHasAlpha = */ true);
           if (NS_FAILED(rv)) {
diff --git a/image/decoders/nsJPEGDecoder.cpp b/image/decoders/nsJPEGDecoder.cpp
index 61d32c0d53..b9d8619a74 100644
--- a/image/decoders/nsJPEGDecoder.cpp
+++ b/image/decoders/nsJPEGDecoder.cpp
@@ -398,7 +398,7 @@ nsJPEGDecoder::WriteInternal(const char* aBuffer, uint32_t aCount)
     MOZ_ASSERT(mImageData, "Should have a buffer now");
 
     if (mDownscaler) {
-      nsresult rv = mDownscaler->BeginFrame(GetSize(),
+      nsresult rv = mDownscaler->BeginFrame(GetSize(), Nothing(),
                                             mImageData,
                                             /* aHasAlpha = */ false);
       if (NS_FAILED(rv)) {
diff --git a/image/decoders/nsJPEGDecoder.h b/image/decoders/nsJPEGDecoder.h
index f916c1c8fb..318b46a0bb 100644
--- a/image/decoders/nsJPEGDecoder.h
+++ b/image/decoders/nsJPEGDecoder.h
@@ -15,8 +15,6 @@
 
 #include "Decoder.h"
 
-#include "nsAutoPtr.h"
-
 #include "nsIInputStream.h"
 #include "nsIPipe.h"
 #include "qcms.h"
diff --git a/image/decoders/nsPNGDecoder.cpp b/image/decoders/nsPNGDecoder.cpp
index 8fde776a05..eb3af9860d 100644
--- a/image/decoders/nsPNGDecoder.cpp
+++ b/image/decoders/nsPNGDecoder.cpp
@@ -216,7 +216,8 @@ nsPNGDecoder::CreateFrame(png_uint_32 aXOffset, png_uint_32 aYOffset,
 
   if (mDownscaler) {
     bool hasAlpha = aFormat != SurfaceFormat::B8G8R8X8;
-    rv = mDownscaler->BeginFrame(frameRect.Size(), mImageData, hasAlpha);
+    rv = mDownscaler->BeginFrame(frameRect.Size(), Nothing(),
+                                 mImageData, hasAlpha);
     if (NS_FAILED(rv)) {
       return rv;
     }
diff --git a/image/encoders/bmp/nsBMPEncoder.cpp b/image/encoders/bmp/nsBMPEncoder.cpp
index 9ab83d7163..9b47b62ff2 100644
--- a/image/encoders/bmp/nsBMPEncoder.cpp
+++ b/image/encoders/bmp/nsBMPEncoder.cpp
@@ -1,18 +1,20 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsCRT.h"
 #include "mozilla/Endian.h"
+#include "mozilla/UniquePtrExtensions.h"
 #include "nsBMPEncoder.h"
 #include "prprf.h"
 #include "nsString.h"
 #include "nsStreamUtils.h"
 #include "nsTArray.h"
-#include "nsAutoPtr.h"
 
 using namespace mozilla;
 using namespace mozilla::image;
+using namespace mozilla::image::bmp;
 
 NS_IMPL_ISUPPORTS(nsBMPEncoder, imgIEncoder, nsIInputStream,
                   nsIAsyncInputStream)
@@ -186,9 +188,8 @@ nsBMPEncoder::AddImageFrame(const uint8_t* aData,
     return NS_ERROR_INVALID_ARG;
   }
 
-  nsAutoArrayPtr<uint8_t> row(new (fallible)
-                              uint8_t[mBMPInfoHeader.width *
-                              BytesPerPixel(mBMPInfoHeader.bpp)]);
+  auto row = MakeUniqueFallible<uint8_t[]>(mBMPInfoHeader.width *
+                                           BytesPerPixel(mBMPInfoHeader.bpp));
   if (!row) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
@@ -200,18 +201,18 @@ nsBMPEncoder::AddImageFrame(const uint8_t* aData,
     for (int32_t y = mBMPInfoHeader.height - 1; y >= 0 ; y --) {
       ConvertHostARGBRow(&aData[y * aStride], row, mBMPInfoHeader.width);
       if(mBMPInfoHeader.bpp == 24) {
-        EncodeImageDataRow24(row);
+        EncodeImageDataRow24(row.get());
       } else {
-        EncodeImageDataRow32(row);
+        EncodeImageDataRow32(row.get());
       }
     }
   } else if (aInputFormat == INPUT_FORMAT_RGBA) {
     // simple RGBA, no conversion needed
     for (int32_t y = 0; y < mBMPInfoHeader.height; y++) {
       if (mBMPInfoHeader.bpp == 24) {
-        EncodeImageDataRow24(row);
+        EncodeImageDataRow24(row.get());
       } else {
-        EncodeImageDataRow32(row);
+        EncodeImageDataRow32(row.get());
       }
     }
   } else if (aInputFormat == INPUT_FORMAT_RGB) {
@@ -424,7 +425,8 @@ nsBMPEncoder::CloseWithStatus(nsresult aStatus)
 //    an output with no alpha in machine-independent byte order.
 //
 void
-nsBMPEncoder::ConvertHostARGBRow(const uint8_t* aSrc, uint8_t* aDest,
+nsBMPEncoder::ConvertHostARGBRow(const uint8_t* aSrc,
+                                 const UniquePtr<uint8_t[]>& aDest,
                                  uint32_t aPixelWidth)
 {
   int bytes = BytesPerPixel(mBMPInfoHeader.bpp);
@@ -485,9 +487,9 @@ nsBMPEncoder::InitFileHeader(Version aVersion, uint32_t aBPP, uint32_t aWidth,
   mBMPFileHeader.signature[1] = 'M';
 
   if (aVersion == VERSION_3) {
-    mBMPFileHeader.dataoffset = BMP_HEADER_LENGTH::WIN_V3;
+    mBMPFileHeader.dataoffset = FILE_HEADER_LENGTH + InfoHeaderLength::WIN_V3;
   } else { // aVersion == 5
-    mBMPFileHeader.dataoffset = BMP_HEADER_LENGTH::WIN_V5;
+    mBMPFileHeader.dataoffset = FILE_HEADER_LENGTH + InfoHeaderLength::WIN_V5;
   }
 
   // The color table is present only if BPP is <= 8
@@ -501,12 +503,6 @@ nsBMPEncoder::InitFileHeader(Version aVersion, uint32_t aBPP, uint32_t aWidth,
   }
 
   mBMPFileHeader.reserved = 0;
-
-  if (aVersion == VERSION_3) {
-    mBMPFileHeader.bihsize = BIH_LENGTH::WIN_V3;
-  } else { // aVersion == VERSION_5
-    mBMPFileHeader.bihsize = BIH_LENGTH::WIN_V5;
-  }
 }
 
 #define ENCODE(pImageBufferCurr, value) \
@@ -519,6 +515,12 @@ nsBMPEncoder::InitInfoHeader(Version aVersion, uint32_t aBPP, uint32_t aWidth,
                              uint32_t aHeight)
 {
   memset(&mBMPInfoHeader, 0, sizeof(mBMPInfoHeader));
+  if (aVersion == VERSION_3) {
+    mBMPInfoHeader.bihsize = InfoHeaderLength::WIN_V3;
+  } else {
+    MOZ_ASSERT(aVersion == VERSION_5);
+    mBMPInfoHeader.bihsize = InfoHeaderLength::WIN_V5;
+  }
   mBMPInfoHeader.width = aWidth;
   mBMPInfoHeader.height = aHeight;
   mBMPInfoHeader.planes = 1;
@@ -539,7 +541,7 @@ nsBMPEncoder::InitInfoHeader(Version aVersion, uint32_t aBPP, uint32_t aWidth,
       mBMPInfoHeader.green_mask = 0x0000FF00;
       mBMPInfoHeader.blue_mask  = 0x00FF0000;
       mBMPInfoHeader.alpha_mask = 0xFF000000;
-      mBMPInfoHeader.color_space = BITMAPV5HEADER::COLOR_SPACE_LCS_SRGB;
+      mBMPInfoHeader.color_space = V5InfoHeader::COLOR_SPACE_LCS_SRGB;
       mBMPInfoHeader.white_point.r.x = 0;
       mBMPInfoHeader.white_point.r.y = 0;
       mBMPInfoHeader.white_point.r.z = 0;
@@ -563,24 +565,23 @@ nsBMPEncoder::InitInfoHeader(Version aVersion, uint32_t aBPP, uint32_t aWidth,
 void
 nsBMPEncoder::EncodeFileHeader()
 {
-  mozilla::image::BMPFILEHEADER littleEndianBFH = mBMPFileHeader;
+  FileHeader littleEndianBFH = mBMPFileHeader;
   NativeEndian::swapToLittleEndianInPlace(&littleEndianBFH.filesize, 1);
   NativeEndian::swapToLittleEndianInPlace(&littleEndianBFH.reserved, 1);
   NativeEndian::swapToLittleEndianInPlace(&littleEndianBFH.dataoffset, 1);
-  NativeEndian::swapToLittleEndianInPlace(&littleEndianBFH.bihsize, 1);
 
   ENCODE(&mImageBufferCurr, littleEndianBFH.signature);
   ENCODE(&mImageBufferCurr, littleEndianBFH.filesize);
   ENCODE(&mImageBufferCurr, littleEndianBFH.reserved);
   ENCODE(&mImageBufferCurr, littleEndianBFH.dataoffset);
-  ENCODE(&mImageBufferCurr, littleEndianBFH.bihsize);
 }
 
 // Encodes the BMP infor header mBMPInfoHeader
 void
 nsBMPEncoder::EncodeInfoHeader()
 {
-  mozilla::image::BITMAPV5HEADER littleEndianmBIH = mBMPInfoHeader;
+  V5InfoHeader littleEndianmBIH = mBMPInfoHeader;
+  NativeEndian::swapToLittleEndianInPlace(&littleEndianmBIH.bihsize, 1);
   NativeEndian::swapToLittleEndianInPlace(&littleEndianmBIH.width, 1);
   NativeEndian::swapToLittleEndianInPlace(&littleEndianmBIH.height, 1);
   NativeEndian::swapToLittleEndianInPlace(&littleEndianmBIH.planes, 1);
@@ -613,29 +614,19 @@ nsBMPEncoder::EncodeInfoHeader()
   NativeEndian::swapToLittleEndianInPlace(&littleEndianmBIH.profile_offset, 1);
   NativeEndian::swapToLittleEndianInPlace(&littleEndianmBIH.profile_size, 1);
 
-  if (mBMPFileHeader.bihsize == BIH_LENGTH::OS2) {
-      uint16_t width = (uint16_t) littleEndianmBIH.width;
-      ENCODE(&mImageBufferCurr, width);
-      uint16_t height = (uint16_t) littleEndianmBIH.width;
-      ENCODE(&mImageBufferCurr, height);
-  } else {
-      ENCODE(&mImageBufferCurr, littleEndianmBIH.width);
-      ENCODE(&mImageBufferCurr, littleEndianmBIH.height);
-  }
-
+  ENCODE(&mImageBufferCurr, littleEndianmBIH.bihsize);
+  ENCODE(&mImageBufferCurr, littleEndianmBIH.width);
+  ENCODE(&mImageBufferCurr, littleEndianmBIH.height);
   ENCODE(&mImageBufferCurr, littleEndianmBIH.planes);
   ENCODE(&mImageBufferCurr, littleEndianmBIH.bpp);
+  ENCODE(&mImageBufferCurr, littleEndianmBIH.compression);
+  ENCODE(&mImageBufferCurr, littleEndianmBIH.image_size);
+  ENCODE(&mImageBufferCurr, littleEndianmBIH.xppm);
+  ENCODE(&mImageBufferCurr, littleEndianmBIH.yppm);
+  ENCODE(&mImageBufferCurr, littleEndianmBIH.colors);
+  ENCODE(&mImageBufferCurr, littleEndianmBIH.important_colors);
 
-  if (mBMPFileHeader.bihsize > BIH_LENGTH::OS2) {
-    ENCODE(&mImageBufferCurr, littleEndianmBIH.compression);
-    ENCODE(&mImageBufferCurr, littleEndianmBIH.image_size);
-    ENCODE(&mImageBufferCurr, littleEndianmBIH.xppm);
-    ENCODE(&mImageBufferCurr, littleEndianmBIH.yppm);
-    ENCODE(&mImageBufferCurr, littleEndianmBIH.colors);
-    ENCODE(&mImageBufferCurr, littleEndianmBIH.important_colors);
-  }
-
-  if (mBMPFileHeader.bihsize > BIH_LENGTH::WIN_V3) {
+  if (mBMPInfoHeader.bihsize > InfoHeaderLength::WIN_V3) {
     ENCODE(&mImageBufferCurr, littleEndianmBIH.red_mask);
     ENCODE(&mImageBufferCurr, littleEndianmBIH.green_mask);
     ENCODE(&mImageBufferCurr, littleEndianmBIH.blue_mask);
diff --git a/image/encoders/bmp/nsBMPEncoder.h b/image/encoders/bmp/nsBMPEncoder.h
index 5abfd50dec..0d3a5e2146 100644
--- a/image/encoders/bmp/nsBMPEncoder.h
+++ b/image/encoders/bmp/nsBMPEncoder.h
@@ -1,3 +1,4 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
@@ -7,9 +8,10 @@
 
 #include "mozilla/Attributes.h"
 #include "mozilla/ReentrantMonitor.h"
+#include "mozilla/UniquePtr.h"
 
 #include "imgIEncoder.h"
-#include "BMPFileHeaders.h"
+#include "BMPHeaders.h"
 
 #include "nsCOMPtr.h"
 
@@ -21,6 +23,62 @@
     {0xbd, 0x16, 0xb0, 0x81, 0xa3, 0Xba, 0x8c, 0x0b} \
 }
 
+namespace mozilla {
+namespace image {
+namespace bmp {
+
+struct FileHeader {
+  char signature[2];   // String "BM".
+  uint32_t filesize;   // File size.
+  int32_t reserved;    // Zero.
+  uint32_t dataoffset; // Offset to raster data.
+};
+
+struct XYZ {
+  int32_t x, y, z;
+};
+
+struct XYZTriple {
+  XYZ r, g, b;
+};
+
+struct V5InfoHeader {
+  uint32_t bihsize;          // Header size
+  int32_t width;             // Uint16 in OS/2 BMPs
+  int32_t height;            // Uint16 in OS/2 BMPs
+  uint16_t planes;           // =1
+  uint16_t bpp;              // Bits per pixel.
+  uint32_t compression;      // See Compression for valid values
+  uint32_t image_size;       // (compressed) image size. Can be 0 if
+                             // compression==0
+  uint32_t xppm;             // Pixels per meter, horizontal
+  uint32_t yppm;             // Pixels per meter, vertical
+  uint32_t colors;           // Used Colors
+  uint32_t important_colors; // Number of important colors. 0=all
+  // The rest of the header is not available in WIN_V3 BMP Files
+  uint32_t red_mask;         // Bits used for red component
+  uint32_t green_mask;       // Bits used for green component
+  uint32_t blue_mask;        // Bits used for blue component
+  uint32_t alpha_mask;       // Bits used for alpha component
+  uint32_t color_space;      // 0x73524742=LCS_sRGB ...
+  // These members are unused unless color_space == LCS_CALIBRATED_RGB
+  XYZTriple white_point;     // Logical white point
+  uint32_t gamma_red;        // Red gamma component
+  uint32_t gamma_green;      // Green gamma component
+  uint32_t gamma_blue;       // Blue gamma component
+  uint32_t intent;           // Rendering intent
+  // These members are unused unless color_space == LCS_PROFILE_*
+  uint32_t profile_offset;   // Offset to profile data in bytes
+  uint32_t profile_size;     // Size of profile data in bytes
+  uint32_t reserved;         // =0
+
+  static const uint32_t COLOR_SPACE_LCS_SRGB = 0x73524742;
+};
+
+} // namespace bmp
+} // namespace image
+} // namespace mozilla
+
 // Provides BMP encoding functionality. Use InitFromData() to do the
 // encoding. See that function definition for encoding options.
 
@@ -48,7 +106,8 @@ protected:
   nsresult ParseOptions(const nsAString& aOptions, Version* version,
                         uint32_t* bpp);
   // Obtains data with no alpha in machine-independent byte order
-  void ConvertHostARGBRow(const uint8_t* aSrc, uint8_t* aDest,
+  void ConvertHostARGBRow(const uint8_t* aSrc,
+                          const mozilla::UniquePtr<uint8_t[]>& aDest,
                           uint32_t aPixelWidth);
   // Thread safe notify listener
   void NotifyListener();
@@ -76,8 +135,8 @@ protected:
 
   // These headers will always contain endian independent stuff
   // They store the BMP headers which will be encoded
-  mozilla::image::BMPFILEHEADER mBMPFileHeader;
-  mozilla::image::BITMAPV5HEADER mBMPInfoHeader;
+  mozilla::image::bmp::FileHeader mBMPFileHeader;
+  mozilla::image::bmp::V5InfoHeader mBMPInfoHeader;
 
   // Keeps track of the start of the image buffer
   uint8_t* mImageBufferStart;
diff --git a/image/encoders/ico/nsICOEncoder.cpp b/image/encoders/ico/nsICOEncoder.cpp
index 2340ecb50f..61db59a7ae 100644
--- a/image/encoders/ico/nsICOEncoder.cpp
+++ b/image/encoders/ico/nsICOEncoder.cpp
@@ -162,9 +162,10 @@ nsICOEncoder::AddImageFrame(const uint8_t* aData,
 
     // Icon files that wrap a BMP file must not include the BITMAPFILEHEADER
     // section at the beginning of the encoded BMP data, so we must skip over
-    // BMPFILEHEADER::LENGTH bytes when adding the BMP content to the icon file.
+    // bmp::FILE_HEADER_LENGTH bytes when adding the BMP content to the icon
+    // file.
     mICODirEntry.mBytesInRes =
-      BMPImageBufferSize - BMPFILEHEADER::LENGTH + andMaskSize;
+      BMPImageBufferSize - bmp::FILE_HEADER_LENGTH + andMaskSize;
 
     // Encode the icon headers
     EncodeFileHeader();
@@ -173,14 +174,14 @@ nsICOEncoder::AddImageFrame(const uint8_t* aData,
     char* imageBuffer;
     rv = mContainedEncoder->GetImageBuffer(&imageBuffer);
     NS_ENSURE_SUCCESS(rv, rv);
-    memcpy(mImageBufferCurr, imageBuffer + BMPFILEHEADER::LENGTH,
-           BMPImageBufferSize - BMPFILEHEADER::LENGTH);
+    memcpy(mImageBufferCurr, imageBuffer + bmp::FILE_HEADER_LENGTH,
+           BMPImageBufferSize - bmp::FILE_HEADER_LENGTH);
     // We need to fix the BMP height to be *2 for the AND mask
     uint32_t fixedHeight = GetRealHeight() * 2;
     NativeEndian::swapToLittleEndianInPlace(&fixedHeight, 1);
     // The height is stored at an offset of 8 from the DIB header
     memcpy(mImageBufferCurr + 8, &fixedHeight, sizeof(fixedHeight));
-    mImageBufferCurr += BMPImageBufferSize - BMPFILEHEADER::LENGTH;
+    mImageBufferCurr += BMPImageBufferSize - bmp::FILE_HEADER_LENGTH;
 
     // Calculate rowsize in DWORD's
     uint32_t rowSize = ((GetRealWidth() + 31) / 32) * 4; // + 31 to round up
diff --git a/image/encoders/ico/nsICOEncoder.h b/image/encoders/ico/nsICOEncoder.h
index 9bf9b49f58..9c37d5b05f 100644
--- a/image/encoders/ico/nsICOEncoder.h
+++ b/image/encoders/ico/nsICOEncoder.h
@@ -10,7 +10,6 @@
 
 #include "imgIEncoder.h"
 
-#include "nsAutoPtr.h"
 #include "nsCOMPtr.h"
 #include "ICOFileHeaders.h"
 
diff --git a/image/encoders/jpeg/nsJPEGEncoder.cpp b/image/encoders/jpeg/nsJPEGEncoder.cpp
index 998e85d05d..b110a2abec 100644
--- a/image/encoders/jpeg/nsJPEGEncoder.cpp
+++ b/image/encoders/jpeg/nsJPEGEncoder.cpp
@@ -162,19 +162,19 @@ nsJPEGEncoder::InitFromData(const uint8_t* aData,
       jpeg_write_scanlines(&cinfo, const_cast<uint8_t**>(&row), 1);
     }
   } else if (aInputFormat == INPUT_FORMAT_RGBA) {
-    uint8_t* row = new uint8_t[aWidth * 3];
+    UniquePtr<uint8_t[]> rowptr = MakeUnique<uint8_t[]>(aWidth * 3);
+    uint8_t* row = rowptr.get();
     while (cinfo.next_scanline < cinfo.image_height) {
       ConvertRGBARow(&aData[cinfo.next_scanline * aStride], row, aWidth);
       jpeg_write_scanlines(&cinfo, &row, 1);
     }
-    delete[] row;
   } else if (aInputFormat == INPUT_FORMAT_HOSTARGB) {
-    uint8_t* row = new uint8_t[aWidth * 3];
+    UniquePtr<uint8_t[]> rowptr = MakeUnique<uint8_t[]>(aWidth * 3);
+    uint8_t* row = rowptr.get();
     while (cinfo.next_scanline < cinfo.image_height) {
       ConvertHostARGBRow(&aData[cinfo.next_scanline * aStride], row, aWidth);
       jpeg_write_scanlines(&cinfo, &row, 1);
     }
-    delete[] row;
   }
 
   jpeg_finish_compress(&cinfo);
diff --git a/image/encoders/png/nsPNGEncoder.cpp b/image/encoders/png/nsPNGEncoder.cpp
index f3340860e6..34b4c11eee 100644
--- a/image/encoders/png/nsPNGEncoder.cpp
+++ b/image/encoders/png/nsPNGEncoder.cpp
@@ -287,22 +287,18 @@ nsPNGEncoder::AddImageFrame(const uint8_t* aData,
   if (aInputFormat == INPUT_FORMAT_HOSTARGB) {
     // PNG requires RGBA with post-multiplied alpha, so we need to
     // convert
-    uint8_t* row = new uint8_t[aWidth * 4];
+    UniquePtr<uint8_t[]> row = MakeUnique<uint8_t[]>(aWidth * 4);
     for (uint32_t y = 0; y < aHeight; y++) {
-      ConvertHostARGBRow(&aData[y * aStride], row, aWidth, useTransparency);
-      png_write_row(mPNG, row);
+      ConvertHostARGBRow(&aData[y * aStride], row.get(), aWidth, useTransparency);
+      png_write_row(mPNG, row.get());
     }
-    delete[] row;
-
   } else if (aInputFormat == INPUT_FORMAT_RGBA && !useTransparency) {
     // RBGA, but we need to strip the alpha
-    uint8_t* row = new uint8_t[aWidth * 4];
+    UniquePtr<uint8_t[]> row = MakeUnique<uint8_t[]>(aWidth * 4);
     for (uint32_t y = 0; y < aHeight; y++) {
-      StripAlpha(&aData[y * aStride], row, aWidth);
-      png_write_row(mPNG, row);
+      StripAlpha(&aData[y * aStride], row.get(), aWidth);
+      png_write_row(mPNG, row.get());
     }
-    delete[] row;
-
   } else if (aInputFormat == INPUT_FORMAT_RGB ||
              aInputFormat == INPUT_FORMAT_RGBA) {
     // simple RBG(A), no conversion needed
diff --git a/image/imgFrame.cpp b/image/imgFrame.cpp
index 03782426a8..737e46f14a 100644
--- a/image/imgFrame.cpp
+++ b/image/imgFrame.cpp
@@ -396,7 +396,7 @@ imgFrame::Optimize()
     ->Optimal2DFormatForContent(gfxContentType::COLOR);
 
   if (mFormat != SurfaceFormat::B8G8R8A8 &&
-      optFormat == SurfaceFormat::R5G6B5) {
+      optFormat == SurfaceFormat::R5G6B5_UINT16) {
     RefPtr<VolatileBuffer> buf =
       AllocateBufferForImage(mSize, optFormat);
     if (!buf) {
diff --git a/image/imgLoader.cpp b/image/imgLoader.cpp
index 73ad226165..18f3d60715 100644
--- a/image/imgLoader.cpp
+++ b/image/imgLoader.cpp
@@ -863,6 +863,7 @@ imgCacheEntry::imgCacheEntry(imgLoader* loader, imgRequest* request,
    mRequest(request),
    mDataSize(0),
    mTouchedTime(SecondsFromPRTime(PR_Now())),
+   mLoadTime(SecondsFromPRTime(PR_Now())),
    mExpiryTime(0),
    mMustValidate(false),
    // We start off as evicted so we don't try to update the cache. PutIntoCache
@@ -899,6 +900,11 @@ imgCacheEntry::UpdateCache(int32_t diff /* = 0 */)
   }
 }
 
+void imgCacheEntry::UpdateLoadTime()
+{
+  mLoadTime = SecondsFromPRTime(PR_Now());
+}
+
 void
 imgCacheEntry::SetHasNoProxies(bool hasNoProxies)
 {
@@ -1225,7 +1231,7 @@ imgLoader::VerifyCacheSizes()
   uint32_t queuesize =
     mCacheQueue.GetNumElements() + mChromeCacheQueue.GetNumElements();
   uint32_t trackersize = 0;
-  for (nsExpirationTracker<imgCacheEntry, 3>::Iterator it(mCacheTracker);
+  for (nsExpirationTracker<imgCacheEntry, 3>::Iterator it(mCacheTracker.get());
        it.Next(); ){
     trackersize++;
   }
@@ -1288,7 +1294,7 @@ imgLoader::InitCache()
   os->AddObserver(this, "profile-before-change", false);
   os->AddObserver(this, "xpcom-shutdown", false);
 
-  mCacheTracker = new imgCacheExpirationTracker();
+  mCacheTracker = MakeUnique<imgCacheExpirationTracker>();
 
   return NS_OK;
 }
@@ -1803,7 +1809,7 @@ imgLoader::ValidateEntry(imgCacheEntry* aEntry,
   // Special treatment for file URLs - aEntry has expired if file has changed
   nsCOMPtr<nsIFileURL> fileUrl(do_QueryInterface(aURI));
   if (fileUrl) {
-    uint32_t lastModTime = aEntry->GetTouchedTime();
+    uint32_t lastModTime = aEntry->GetLoadTime();
 
     nsCOMPtr<nsIFile> theFile;
     rv = fileUrl->GetFile(getter_AddRefs(theFile));
diff --git a/image/imgLoader.h b/image/imgLoader.h
index eef2f83798..d5e456096a 100644
--- a/image/imgLoader.h
+++ b/image/imgLoader.h
@@ -9,6 +9,7 @@
 
 #include "mozilla/Attributes.h"
 #include "mozilla/Mutex.h"
+#include "mozilla/UniquePtr.h"
 
 #include "imgILoader.h"
 #include "imgICache.h"
@@ -16,7 +17,6 @@
 #include "nsIContentSniffer.h"
 #include "nsRefPtrHashtable.h"
 #include "nsExpirationTracker.h"
-#include "nsAutoPtr.h"
 #include "ImageCacheKey.h"
 #include "imgRequest.h"
 #include "nsIProgressEventSink.h"
@@ -91,6 +91,13 @@ public:
     Touch(/* updateTime = */ false);
   }
 
+  uint32_t GetLoadTime() const
+  {
+    return mLoadTime;
+  }
+
+  void UpdateLoadTime();
+
   int32_t GetExpiryTime() const
   {
     return mExpiryTime;
@@ -164,6 +171,7 @@ private: // data
   RefPtr<imgRequest> mRequest;
   uint32_t mDataSize;
   int32_t mTouchedTime;
+  uint32_t mLoadTime;
   int32_t mExpiryTime;
   nsExpirationState mExpirationState;
   bool mMustValidate : 1;
@@ -217,10 +225,10 @@ enum class AcceptedMimeTypes : uint8_t {
 };
 
 class imgLoader final : public imgILoader,
-                            public nsIContentSniffer,
-                            public imgICache,
-                            public nsSupportsWeakReference,
-                            public nsIObserver
+                        public nsIContentSniffer,
+                        public imgICache,
+                        public nsSupportsWeakReference,
+                        public nsIObserver
 {
   virtual ~imgLoader();
 
@@ -448,7 +456,7 @@ private: // data
 
   nsCString mAcceptHeader;
 
-  nsAutoPtr<imgCacheExpirationTracker> mCacheTracker;
+  mozilla::UniquePtr<imgCacheExpirationTracker> mCacheTracker;
   bool mRespectPrivacy;
 
 #ifdef MOZ_JXR
@@ -562,4 +570,4 @@ private:
   bool mHadInsecureRedirect;
 };
 
-#endif  // mozilla_image_imgLoader_h
+#endif // mozilla_image_imgLoader_h
diff --git a/image/imgRequest.cpp b/image/imgRequest.cpp
index e5815fd05c..55356982ac 100644
--- a/image/imgRequest.cpp
+++ b/image/imgRequest.cpp
@@ -159,6 +159,7 @@ imgRequest::Init(nsIURI *aURI,
   mChannel->SetNotificationCallbacks(this);
 
   mCacheEntry = aCacheEntry;
+  mCacheEntry->UpdateLoadTime();
 
   SetLoadId(aCX);
 
diff --git a/image/imgRequest.h b/image/imgRequest.h
index aac7d71845..520ca16f59 100644
--- a/image/imgRequest.h
+++ b/image/imgRequest.h
@@ -13,7 +13,6 @@
 #include "nsIThreadRetargetableStreamListener.h"
 #include "nsIPrincipal.h"
 
-#include "nsAutoPtr.h"
 #include "nsCOMPtr.h"
 #include "nsProxyRelease.h"
 #include "nsStringGlue.h"
diff --git a/image/imgRequestProxy.cpp b/image/imgRequestProxy.cpp
index 3e76e196dc..2a3facbd3b 100644
--- a/image/imgRequestProxy.cpp
+++ b/image/imgRequestProxy.cpp
@@ -1067,7 +1067,7 @@ imgRequestProxyStatic::imgRequestProxyStatic(mozilla::image::Image* aImage,
                                              nsIPrincipal* aPrincipal)
 : mPrincipal(aPrincipal)
 {
-  mBehaviour = new StaticBehaviour(aImage);
+  mBehaviour = mozilla::MakeUnique<StaticBehaviour>(aImage);
 }
 
 NS_IMETHODIMP
diff --git a/image/imgRequestProxy.h b/image/imgRequestProxy.h
index 473938706a..dd61fbb808 100644
--- a/image/imgRequestProxy.h
+++ b/image/imgRequestProxy.h
@@ -14,9 +14,9 @@
 #include "nsISupportsPriority.h"
 #include "nsITimedChannel.h"
 #include "nsCOMPtr.h"
-#include "nsAutoPtr.h"
 #include "nsThreadUtils.h"
 #include "mozilla/TimeStamp.h"
+#include "mozilla/UniquePtr.h"
 #include "mozilla/gfx/Rect.h"
 
 #include "imgRequest.h"
@@ -191,7 +191,7 @@ public:
   NS_FORWARD_SAFE_NSITIMEDCHANNEL(TimedChannel())
 
 protected:
-  nsAutoPtr<ProxyBehaviour> mBehaviour;
+  mozilla::UniquePtr<ProxyBehaviour> mBehaviour;
 
 private:
   friend class imgCacheValidator;
diff --git a/image/test/gtest/Common.cpp b/image/test/gtest/Common.cpp
index 812513dd1a..a13b1a6b61 100644
--- a/image/test/gtest/Common.cpp
+++ b/image/test/gtest/Common.cpp
@@ -188,13 +188,13 @@ ImageTestCase FirstFramePaddingGIFTestCase()
                        TEST_CASE_IS_TRANSPARENT);
 }
 
-ImageTestCase TransparentBMPWhenBMPAlphaEnabledTestCase()
+ImageTestCase TransparentIfWithinICOBMPTestCase(TestCaseFlags aFlags)
 {
-  // Note that we only decode this test case as transparent when the BMP decoder
-  // is set to use alpha data. (That's not the default, which is why it's not marked
-  // TEST_CASE_IS_TRANSPARENT; tests that want to treat this testcase as
-  // transparent need to handle this case manually.)
-  return ImageTestCase("transparent.bmp", "image/bmp", IntSize(32, 32));
+  // This is a BMP that is only transparent when decoded as if it is within an
+  // ICO file. (Note: aFlags needs to be set to TEST_CASE_DEFAULT_FLAGS or
+  // TEST_CASE_IS_TRANSPARENT accordingly.)
+  return ImageTestCase("transparent-if-within-ico.bmp", "image/bmp",
+                       IntSize(32, 32), aFlags);
 }
 
 ImageTestCase RLE4BMPTestCase()
diff --git a/image/test/gtest/TestMetadata.cpp b/image/test/gtest/TestMetadata.cpp
index 7f20d27950..7d764b04c7 100644
--- a/image/test/gtest/TestMetadata.cpp
+++ b/image/test/gtest/TestMetadata.cpp
@@ -38,15 +38,15 @@ TEST(ImageMetadata, ImageModuleAvailable)
   EXPECT_TRUE(imgTools != nullptr);
 }
 
-enum class BMPAlpha
+enum class BMPWithinICO
 {
-  DISABLED,
-  ENABLED
+  NO,
+  YES
 };
 
 static void
 CheckMetadata(const ImageTestCase& aTestCase,
-              BMPAlpha aBMPAlpha = BMPAlpha::DISABLED)
+              BMPWithinICO aBMPWithinICO = BMPWithinICO::NO)
 {
   nsCOMPtr<nsIInputStream> inputStream = LoadFile(aTestCase.mPath);
   ASSERT_TRUE(inputStream != nullptr);
@@ -70,13 +70,13 @@ CheckMetadata(const ImageTestCase& aTestCase,
     DecoderFactory::CreateAnonymousMetadataDecoder(decoderType, sourceBuffer);
   ASSERT_TRUE(decoder != nullptr);
 
-  if (aBMPAlpha == BMPAlpha::ENABLED) {
-    static_cast<nsBMPDecoder*>(decoder.get())->SetUseAlphaData(true);
+  if (aBMPWithinICO == BMPWithinICO::YES) {
+    static_cast<nsBMPDecoder*>(decoder.get())->SetIsWithinICO();
   }
 
   // Run the metadata decoder synchronously.
   decoder->Decode();
-  
+
   // Ensure that the metadata decoder didn't make progress it shouldn't have
   // (which would indicate that it decoded past the header of the image).
   Progress metadataProgress = decoder->TakeProgress();
@@ -100,7 +100,7 @@ CheckMetadata(const ImageTestCase& aTestCase,
   EXPECT_EQ(aTestCase.mSize.width, metadataSize.width);
   EXPECT_EQ(aTestCase.mSize.height, metadataSize.height);
 
-  bool expectTransparency = aBMPAlpha == BMPAlpha::ENABLED
+  bool expectTransparency = aBMPWithinICO == BMPWithinICO::YES
                           ? true
                           : bool(aTestCase.mFlags & TEST_CASE_IS_TRANSPARENT);
   EXPECT_EQ(expectTransparency, bool(metadataProgress & FLAG_HAS_TRANSPARENCY));
@@ -114,13 +114,13 @@ CheckMetadata(const ImageTestCase& aTestCase,
                                            DefaultSurfaceFlags());
   ASSERT_TRUE(decoder != nullptr);
 
-  if (aBMPAlpha == BMPAlpha::ENABLED) {
-    static_cast<nsBMPDecoder*>(decoder.get())->SetUseAlphaData(true);
+  if (aBMPWithinICO == BMPWithinICO::YES) {
+    static_cast<nsBMPDecoder*>(decoder.get())->SetIsWithinICO();
   }
 
   // Run the full decoder synchronously.
   decoder->Decode();
-  
+
   EXPECT_TRUE(decoder->GetDecodeDone() && !decoder->HasError());
   Progress fullProgress = decoder->TakeProgress();
 
@@ -163,14 +163,16 @@ TEST(ImageMetadata, FirstFramePaddingGIF)
   CheckMetadata(FirstFramePaddingGIFTestCase());
 }
 
-TEST(ImageMetadata, TransparentBMPWithBMPAlphaOff)
+TEST(ImageMetadata, TransparentIfWithinICOBMPNotWithinICO)
 {
-  CheckMetadata(TransparentBMPWhenBMPAlphaEnabledTestCase(), BMPAlpha::ENABLED);
+  CheckMetadata(TransparentIfWithinICOBMPTestCase(TEST_CASE_DEFAULT_FLAGS),
+                BMPWithinICO::NO);
 }
 
-TEST(ImageMetadata, TransparentBMPWithBMPAlphaOn)
+TEST(ImageMetadata, TransparentIfWithinICOBMPWithinICO)
 {
-  CheckMetadata(TransparentBMPWhenBMPAlphaEnabledTestCase(), BMPAlpha::ENABLED);
+  CheckMetadata(TransparentIfWithinICOBMPTestCase(TEST_CASE_IS_TRANSPARENT),
+                BMPWithinICO::YES);
 }
 
 TEST(ImageMetadata, RLE4BMP) { CheckMetadata(RLE4BMPTestCase()); }
diff --git a/image/test/gtest/moz.build b/image/test/gtest/moz.build
index 0e768241de..7f45b1deb2 100644
--- a/image/test/gtest/moz.build
+++ b/image/test/gtest/moz.build
@@ -28,7 +28,7 @@ TEST_HARNESS_FILES.gtest += [
     'no-frame-delay.gif',
     'rle4.bmp',
     'rle8.bmp',
-    'transparent.bmp',
+    'transparent-if-within-ico.bmp',
     'transparent.gif',
     'transparent.png',
 ]
diff --git a/image/test/gtest/transparent.bmp b/image/test/gtest/transparent-if-within-ico.bmp
similarity index 100%
rename from image/test/gtest/transparent.bmp
rename to image/test/gtest/transparent-if-within-ico.bmp
diff --git a/image/test/reftest/bmp/bmpsuite/COPYING.txt b/image/test/reftest/bmp/bmpsuite/COPYING.txt
new file mode 100644
index 0000000000..10926e87f1
--- /dev/null
+++ b/image/test/reftest/bmp/bmpsuite/COPYING.txt
@@ -0,0 +1,675 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<http://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<http://www.gnu.org/philosophy/why-not-lgpl.html>.
+
diff --git a/image/test/reftest/bmp/bmpsuite/README.mozilla b/image/test/reftest/bmp/bmpsuite/README.mozilla
new file mode 100644
index 0000000000..87d185e897
--- /dev/null
+++ b/image/test/reftest/bmp/bmpsuite/README.mozilla
@@ -0,0 +1,39 @@
+bmpsuite, by Jason Summers, is an excellent BMP test suite that covers many
+obscure corners of the BMP format. All the test images can be seen here:
+
+  http://entropymine.com/jason/bmpsuite/bmpsuite/html/bmpsuite.html
+
+The code used to generate the test images is available here:
+
+  https://github.com/jsummers/bmpsuite/
+
+The readme.txt file states that the code is GPLv3 and the generated image files
+are in the public domain. We have not included the code, but we have included:
+(a) some quotes from the documentation and (b) some of the reference PNG
+images. However, (a) and (b) are for testing purposes only and are not included
+in Firefox releases.
+
+The BMP files within this directory were generated with bmpsuite v2.3 (git
+revision 3adcc9e20c0b6d2d665966b7e047b6f9474cef12).
+
+There are three sub-directories.
+- g/: for "good" images.
+- q/: for "questionable" images.
+- b/: for "bad" images.
+
+Each file listed in a reftest.list file is annotated with the following lines.
+
+- The first line starts with "BMP:" and is the output of the MOZ_LOG call in
+  nsBMPDecoder.cpp. It has basic image info.
+
+- Next is a quote from the bmpsuite docs, which describes the particulars of
+  the file.
+
+- Some files also have additional notes in square brackets. These explain
+  anything non-obvious about the file, such as how we handle things that are
+  ambiguous, any shortcomings in our decoding, and how Chromium handles the
+  image.
+
+Some of the reference PNGs need a small amount of fuzziness to match the BMPs.
+This might be due to PNG color correction.
+
diff --git a/image/test/reftest/bmp/bmpsuite/b/badbitcount.bmp b/image/test/reftest/bmp/bmpsuite/b/badbitcount.bmp
new file mode 100644
index 0000000000..d4fa4e8b88
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/b/badbitcount.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/b/badbitssize.bmp b/image/test/reftest/bmp/bmpsuite/b/badbitssize.bmp
new file mode 100644
index 0000000000..0a99a605af
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/b/badbitssize.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/b/baddens1.bmp b/image/test/reftest/bmp/bmpsuite/b/baddens1.bmp
new file mode 100644
index 0000000000..a6150a6fe7
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/b/baddens1.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/b/baddens2.bmp b/image/test/reftest/bmp/bmpsuite/b/baddens2.bmp
new file mode 100644
index 0000000000..f2c1dfb665
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/b/baddens2.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/b/badfilesize.bmp b/image/test/reftest/bmp/bmpsuite/b/badfilesize.bmp
new file mode 100644
index 0000000000..da52cb51d7
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/b/badfilesize.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/b/badheadersize.bmp b/image/test/reftest/bmp/bmpsuite/b/badheadersize.bmp
new file mode 100644
index 0000000000..2a4083a6f9
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/b/badheadersize.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/b/badpalettesize.bmp b/image/test/reftest/bmp/bmpsuite/b/badpalettesize.bmp
new file mode 100644
index 0000000000..7d9d1b745d
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/b/badpalettesize.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/b/badplanes.bmp b/image/test/reftest/bmp/bmpsuite/b/badplanes.bmp
new file mode 100644
index 0000000000..92d2855b62
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/b/badplanes.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/b/badrle.bmp b/image/test/reftest/bmp/bmpsuite/b/badrle.bmp
new file mode 100644
index 0000000000..cbf8fdc2e1
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/b/badrle.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/b/badrle.png b/image/test/reftest/bmp/bmpsuite/b/badrle.png
new file mode 100644
index 0000000000..1764ef9f98
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/b/badrle.png differ
diff --git a/image/test/reftest/bmp/bmpsuite/b/badwidth.bmp b/image/test/reftest/bmp/bmpsuite/b/badwidth.bmp
new file mode 100644
index 0000000000..9fca005dc3
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/b/badwidth.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/b/pal1.png b/image/test/reftest/bmp/bmpsuite/b/pal1.png
new file mode 100644
index 0000000000..89a433ed76
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/b/pal1.png differ
diff --git a/image/test/reftest/bmp/bmpsuite/b/pal8.png b/image/test/reftest/bmp/bmpsuite/b/pal8.png
new file mode 100644
index 0000000000..2bfd3e650f
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/b/pal8.png differ
diff --git a/image/test/reftest/bmp/bmpsuite/b/pal8badindex.bmp b/image/test/reftest/bmp/bmpsuite/b/pal8badindex.bmp
new file mode 100644
index 0000000000..efe16c05c1
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/b/pal8badindex.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/b/pal8badindex.png b/image/test/reftest/bmp/bmpsuite/b/pal8badindex.png
new file mode 100644
index 0000000000..0efb392b9e
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/b/pal8badindex.png differ
diff --git a/image/test/reftest/bmp/bmpsuite/b/reallybig.bmp b/image/test/reftest/bmp/bmpsuite/b/reallybig.bmp
new file mode 100644
index 0000000000..101e0b4943
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/b/reallybig.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/b/reftest.list b/image/test/reftest/bmp/bmpsuite/b/reftest.list
new file mode 100644
index 0000000000..2d8ef5c757
--- /dev/null
+++ b/image/test/reftest/bmp/bmpsuite/b/reftest.list
@@ -0,0 +1,84 @@
+# bmpsuite "bad" tests
+
+# See ../README.mozilla for details.
+
+# BMP: bihsize=40, 127 x 64, bpp=30000, compression=0, colors=2
+# "Header indicates an absurdly large number of bits/pixel."
+# [We reject it. So does Chromium.]
+== wrapper.html?badbitcount.bmp about:blank
+
+# BMP: bihsize=40, 127 x 64, bpp=1, compression=0, colors=2
+# "Header incorrectly indicates that the bitmap is several GB in size."
+# [We accept it. So does Chromium.]
+== badbitssize.bmp pal1.png
+
+# BMP: bihsize=40, 127 x 64, bpp=1, compression=0, colors=2
+# BMP: bihsize=40, 127 x 64, bpp=1, compression=0, colors=2
+# "Density (pixels per meter) suggests the image is much larger in one
+# dimension than the other."
+# [We accept them. So does Chromium.]
+== baddens1.bmp pal1.png
+== baddens2.bmp pal1.png
+
+# BMP: bihsize=40, 127 x 64, bpp=1, compression=0, colors=2
+# "Header incorrectly indicates that the file is several GB in size."
+# [We accept it. So does Chromium.]
+== badfilesize.bmp pal1.png
+
+# BMP: <no "BMP:" output is produced for files with bad header sizes>
+# "Header size is 66 bytes, which is not a valid size for any known BMP
+# version."
+# [We reject it. So does Chromium.]
+== wrapper.html?badheadersize.bmp about:blank
+
+# BMP: bihsize=40, 127 x 64, bpp=8, compression=0, colors=305402420
+# "Header incorrectly indicates that the palette contains an absurdly large
+# number of colors."
+# [We reject it. Chromium accepts it but draws nothing. Rejecting seems
+# preferable give that the data is clearly untrustworthy.]
+== wrapper.html?badpalettesize.bmp about:blank
+
+# BMP: bihsize=40, 127 x 64, bpp=1, compression=0, colors=2
+# "The 'planes' setting, which is required to be 1, is not 1."
+# [We accept it. So does Chromium.]
+== badplanes.bmp pal1.png
+
+# BMP: bihsize=40, 127 x 64, bpp=8, compression=1, colors=253
+# "An invalid RLE-compressed image that tries to cause buffer overruns."
+# [We accept it, drawing the valid first part and leaving the rest black.
+# Chromium accepts it, drawing the valid first part and leaving the rest
+# transparent. Using black for the invalid part is arguably better because it
+# makes the image edges more obvious.]
+== badrle.bmp badrle.png
+
+# BMP: bihsize=40, -127 x 64, bpp=1, compression=0, colors=2
+# "The image claims to be a negative number of pixels in width."
+# [We reject it. So does Chromium.]
+== wrapper.html?badwidth.bmp about:blank
+
+# BMP: bihsize=40, 127 x 64, bpp=8, compression=0, colors=101
+# "Many of the palette indices used in the image are not present in the
+# palette."
+# [We accept it and use black for the missing colors. So does Chromium.]
+== pal8badindex.bmp pal8badindex.png
+
+# BMP: bihsize=40, 3000000 x 2000000, bpp=24, compression=0, colors=0
+# "An image with a very large reported width and height."
+# [We reject it. So does Chromium.]
+== wrapper.html?reallybig.bmp about:blank
+
+# BMP: bihsize=40, 127 x -64, bpp=8, compression=1, colors=252
+# "An RLE-compressed image that tries to use top-down orientation, which isn’t
+# allowed."
+# [We accept it. Chromium rejects it. Accepting seems better given that we can
+# decode it perfectly well.]
+fuzzy(1,899) == rletopdown.bmp pal8.png
+
+# BMP: bihsize=40, 127 x 64, bpp=1, compression=0, colors=2
+# "A file that has been truncated in the middle of the bitmap."
+# [We accept it, drawing the part that is present and leaving the rest black.
+# Chromium draws the part that is present and leaves the rest transparent.
+# Using black for the invalid part is arguably better because it makes the
+# image edges more obvious.]
+== shortfile.bmp shortfile.png
+
diff --git a/image/test/reftest/bmp/bmpsuite/b/rletopdown.bmp b/image/test/reftest/bmp/bmpsuite/b/rletopdown.bmp
new file mode 100644
index 0000000000..21a909fda9
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/b/rletopdown.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/b/shortfile.bmp b/image/test/reftest/bmp/bmpsuite/b/shortfile.bmp
new file mode 100644
index 0000000000..73960797b9
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/b/shortfile.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/b/shortfile.png b/image/test/reftest/bmp/bmpsuite/b/shortfile.png
new file mode 100644
index 0000000000..0ec21d9295
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/b/shortfile.png differ
diff --git a/image/test/reftest/bmp/bmpsuite/b/wrapper.html b/image/test/reftest/bmp/bmpsuite/b/wrapper.html
new file mode 100644
index 0000000000..47e68959fd
--- /dev/null
+++ b/image/test/reftest/bmp/bmpsuite/b/wrapper.html
@@ -0,0 +1,28 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<head>
+<title>Image reftest wrapper</title>
+<style type="text/css">
+  #image1 { background-color: rgb(10, 100, 250); }
+</style>
+<script>
+  // The image is loaded async after the page loads
+  // wait for it to finish loading
+  function onImageLoad() { 
+    document.documentElement.removeAttribute("class");
+  };
+</script>
+</head>
+<body>
+<img id="image1">
+<script>
+  // Use as "wrapper.html?image.png"
+  var imgURL = document.location.search.substr(1);
+  document.images[0].onload = onImageLoad;
+  document.images[0].onerror = onImageLoad;
+  document.images[0].alt = "";
+  document.images[0].src = imgURL;
+</script>
+</body>
+</html>
+
diff --git a/image/test/reftest/bmp/bmpsuite/g/pal1.bmp b/image/test/reftest/bmp/bmpsuite/g/pal1.bmp
new file mode 100644
index 0000000000..4776f82778
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/pal1.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/pal1.png b/image/test/reftest/bmp/bmpsuite/g/pal1.png
new file mode 100644
index 0000000000..89a433ed76
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/pal1.png differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/pal1bg.bmp b/image/test/reftest/bmp/bmpsuite/g/pal1bg.bmp
new file mode 100644
index 0000000000..466d0ba727
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/pal1bg.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/pal1bg.png b/image/test/reftest/bmp/bmpsuite/g/pal1bg.png
new file mode 100644
index 0000000000..20c4bb838f
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/pal1bg.png differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/pal1wb.bmp b/image/test/reftest/bmp/bmpsuite/g/pal1wb.bmp
new file mode 100644
index 0000000000..56cb93203e
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/pal1wb.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/pal4.bmp b/image/test/reftest/bmp/bmpsuite/g/pal4.bmp
new file mode 100644
index 0000000000..7fd36303ca
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/pal4.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/pal4.png b/image/test/reftest/bmp/bmpsuite/g/pal4.png
new file mode 100644
index 0000000000..188bb0499e
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/pal4.png differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/pal4rle.bmp b/image/test/reftest/bmp/bmpsuite/g/pal4rle.bmp
new file mode 100644
index 0000000000..a5672aebd6
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/pal4rle.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/pal8-0.bmp b/image/test/reftest/bmp/bmpsuite/g/pal8-0.bmp
new file mode 100644
index 0000000000..ab8815a360
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/pal8-0.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/pal8.bmp b/image/test/reftest/bmp/bmpsuite/g/pal8.bmp
new file mode 100644
index 0000000000..96b2f86680
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/pal8.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/pal8.png b/image/test/reftest/bmp/bmpsuite/g/pal8.png
new file mode 100644
index 0000000000..2bfd3e650f
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/pal8.png differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/pal8nonsquare-e.png b/image/test/reftest/bmp/bmpsuite/g/pal8nonsquare-e.png
new file mode 100644
index 0000000000..646665f2d0
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/pal8nonsquare-e.png differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/pal8nonsquare.bmp b/image/test/reftest/bmp/bmpsuite/g/pal8nonsquare.bmp
new file mode 100644
index 0000000000..0aa8de04cb
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/pal8nonsquare.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/pal8nonsquare.png b/image/test/reftest/bmp/bmpsuite/g/pal8nonsquare.png
new file mode 100644
index 0000000000..9648cb6825
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/pal8nonsquare.png differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/pal8os2.bmp b/image/test/reftest/bmp/bmpsuite/g/pal8os2.bmp
new file mode 100644
index 0000000000..14901b3882
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/pal8os2.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/pal8rle.bmp b/image/test/reftest/bmp/bmpsuite/g/pal8rle.bmp
new file mode 100644
index 0000000000..d43101490f
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/pal8rle.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/pal8topdown.bmp b/image/test/reftest/bmp/bmpsuite/g/pal8topdown.bmp
new file mode 100644
index 0000000000..4b2f8e019f
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/pal8topdown.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/pal8v4.bmp b/image/test/reftest/bmp/bmpsuite/g/pal8v4.bmp
new file mode 100644
index 0000000000..7064be3154
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/pal8v4.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/pal8v5.bmp b/image/test/reftest/bmp/bmpsuite/g/pal8v5.bmp
new file mode 100644
index 0000000000..c54647a31a
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/pal8v5.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/pal8w124.bmp b/image/test/reftest/bmp/bmpsuite/g/pal8w124.bmp
new file mode 100644
index 0000000000..b7cc2d8bf7
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/pal8w124.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/pal8w124.png b/image/test/reftest/bmp/bmpsuite/g/pal8w124.png
new file mode 100644
index 0000000000..f80236df60
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/pal8w124.png differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/pal8w125.bmp b/image/test/reftest/bmp/bmpsuite/g/pal8w125.bmp
new file mode 100644
index 0000000000..06efed7443
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/pal8w125.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/pal8w125.png b/image/test/reftest/bmp/bmpsuite/g/pal8w125.png
new file mode 100644
index 0000000000..2a45116b91
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/pal8w125.png differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/pal8w126.bmp b/image/test/reftest/bmp/bmpsuite/g/pal8w126.bmp
new file mode 100644
index 0000000000..112aa9fe67
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/pal8w126.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/pal8w126.png b/image/test/reftest/bmp/bmpsuite/g/pal8w126.png
new file mode 100644
index 0000000000..a41eab93d0
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/pal8w126.png differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/reftest.list b/image/test/reftest/bmp/bmpsuite/g/reftest.list
new file mode 100644
index 0000000000..9715b1ac82
--- /dev/null
+++ b/image/test/reftest/bmp/bmpsuite/g/reftest.list
@@ -0,0 +1,112 @@
+# bmpsuite "good" tests
+
+# See ../README.mozilla for details.
+
+# BMP: bihsize=40, 127 x 64, bpp=1, compression=0, colors=2
+# "1 bit/pixel paletted image, in which black is the first color in the
+# palette."
+== pal1.bmp pal1.png
+
+# BMP: bihsize=40, 127 x 64, bpp=1, compression=0, colors=2
+# "1 bit/pixel paletted image, in which white is the first color in the
+# palette."
+== pal1wb.bmp pal1.png
+
+# BMP: bihsize=40, 127 x 64, bpp=1, compression=0, colors=2
+# "1 bit/pixel paletted image, with colors other than black and white."
+== pal1bg.bmp pal1bg.png
+
+# BMP: bihsize=40, 127 x 64, bpp=4, compression=0, colors=12
+# "Paletted image with 12 palette colors, and 4 bits/pixel."
+== pal4.bmp pal4.png
+
+# BMP: bihsize=40, 127 x 64, bpp=4, compression=2, colors=12
+# "4-bit image that uses RLE compression."
+== pal4rle.bmp pal4.png
+
+# BMP: bihsize=40, 127 x 64, bpp=8, compression=0, colors=252
+# "Our standard paletted image, with 252 palette colors, and 8 bits/pixel."
+fuzzy(1,899) == pal8.bmp pal8.png
+
+# BMP: bihsize=40, 127 x 64, bpp=8, compression=0, colors=0
+# "Every field that can be set to 0 is set to 0: pixels/meter=0; colors used=0
+# (meaning the default 256); size-of-image=0."
+fuzzy(1,899) == pal8-0.bmp pal8.png
+
+# BMP: bihsize=40, 127 x 64, bpp=8, compression=1, colors=252
+# "8-bit image that uses RLE compression."
+fuzzy(1,899) == pal8rle.bmp pal8.png
+
+# BMP: bihsize=40, 126 x 63, bpp=8, compression=0, colors=252
+# BMP: bihsize=40, 125 x 62, bpp=8, compression=0, colors=252
+# BMP: bihsize=40, 124 x 61, bpp=8, compression=0, colors=252
+# "Images with different widths and heights. In BMP format, rows are padded to
+# a multiple of four bytes, so we test all four possibilities."
+fuzzy(1,889) == pal8w126.bmp pal8w126.png
+fuzzy(1,879) == pal8w125.bmp pal8w125.png
+fuzzy(1,869) == pal8w124.bmp pal8w124.png
+
+# BMP: bihsize=40, 127 x -64, bpp=8, compression=0, colors=252
+# "BMP images are normally stored from the bottom up, but there is a way to
+# store them from the top down."
+fuzzy(1,899) == pal8topdown.bmp pal8.png
+
+# BMP: bihsize=40, 127 x 32, bpp=8, compression=0, colors=252
+# "An image with non-square pixels: the X pixels/meter is twice the Y
+# pixels/meter. Image editors can be expected to leave the image 'squashed';
+# image viewers should consider stretching it to its correct proportions."
+# [We leave it squashed, as does Chromium.]
+fuzzy(1,473) == pal8nonsquare.bmp pal8nonsquare-e.png
+
+# BMP: bihsize=12, 127 x 64, bpp=8, compression=0, colors=0
+# "An OS/2-style bitmap."
+fuzzy(1,899) == pal8os2.bmp pal8.png
+
+# BMP: bihsize=108, 127 x 64, bpp=8, compression=0, colors=252
+# "A v4 bitmap. I’m not sure that the gamma and chromaticity values in this
+# file are sensible, because I can’t find any detailed documentation of them."
+fuzzy(1,899) == pal8v4.bmp pal8.png
+
+# BMP: bihsize=124, 127 x 64, bpp=8, compression=0, colors=252
+# "A v5 bitmap. Version 5 has additional colorspace options over v4, so it is
+# easier to create, and ought to be more portable."
+fuzzy(1,899) == pal8v5.bmp pal8.png
+
+# BMP: bihsize=40, 127 x 64, bpp=16, compression=0, colors=0
+# "A 16-bit image with the default color format: 5 bits each for red, green, and
+# blue, and 1 unused bit. The whitest colors should (I assume) be displayed as
+# pure white: (255,255,255), not (248,248,248)."
+fuzzy(1,1296) == rgb16.bmp rgb16.png
+
+# BMP: bihsize=40, 127 x 64, bpp=16, compression=3, colors=0
+# "A 16-bit image with a BITFIELDS segment indicating 5 red, 6 green, and 5 blue
+# bits. This is a standard 16-bit format, even supported by old versions of
+# Windows that don’t support any other non-default 16-bit formats. The whitest
+# colors should be displayed as pure white: (255,255,255), not (248,252,248)."
+fuzzy(1,1296) == rgb16.bmp rgb16.png
+
+# BMP: bihsize=40, 127 x 64, bpp=16, compression=3, colors=256
+# "A 16-bit image with both a BITFIELDS segment and a palette."
+fuzzy(1,1516) == rgb16.bmp rgb16.png
+
+# BMP: bihsize=40, 127 x 64, bpp=24, compression=0, colors=0
+# "A perfectly ordinary 24-bit (truecolor) image."
+== rgb24.bmp rgb24.png
+
+# BMP: bihsize=40, 127 x 64, bpp=24, compression=0, colors=256
+# "A 24-bit image, with a palette containing 256 colors. There is little if any
+# reason for a truecolor image to contain a palette, but it is legal."
+== rgb24pal.bmp rgb24.png
+
+# BMP: bihsize=40, 127 x 64, bpp=32, compression=0, colors=0
+# "A 32-bit image using the default color format for 32-bit images (no
+# BITFIELDS segment). There are 8 bits per color channel, and 8 unused bits.
+# The unused bits are set to 0."
+== rgb32.bmp rgb24.png
+
+# BMP: bihsize=40, 127 x 64, bpp=32, compression=3, colors=0
+# "A 32-bit image with a BITFIELDS segment. As usual, there are 8 bits per color
+# channel, and 8 unused bits. But the color channels are in an unusual order,
+# so the viewer must read the BITFIELDS, and not just guess."
+== rgb32bf.bmp rgb24.png
+
diff --git a/image/test/reftest/bmp/bmpsuite/g/rgb16-565.bmp b/image/test/reftest/bmp/bmpsuite/g/rgb16-565.bmp
new file mode 100644
index 0000000000..c03a27975a
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/rgb16-565.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/rgb16-565.png b/image/test/reftest/bmp/bmpsuite/g/rgb16-565.png
new file mode 100644
index 0000000000..04a3121d24
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/rgb16-565.png differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/rgb16-565pal.bmp b/image/test/reftest/bmp/bmpsuite/g/rgb16-565pal.bmp
new file mode 100644
index 0000000000..e7632e344b
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/rgb16-565pal.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/rgb16.bmp b/image/test/reftest/bmp/bmpsuite/g/rgb16.bmp
new file mode 100644
index 0000000000..6bfe47af4f
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/rgb16.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/rgb16.png b/image/test/reftest/bmp/bmpsuite/g/rgb16.png
new file mode 100644
index 0000000000..d9545840ab
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/rgb16.png differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/rgb24.bmp b/image/test/reftest/bmp/bmpsuite/g/rgb24.bmp
new file mode 100644
index 0000000000..40f8bb094b
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/rgb24.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/rgb24.png b/image/test/reftest/bmp/bmpsuite/g/rgb24.png
new file mode 100644
index 0000000000..86a9c945b0
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/rgb24.png differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/rgb24pal.bmp b/image/test/reftest/bmp/bmpsuite/g/rgb24pal.bmp
new file mode 100644
index 0000000000..102e971dd3
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/rgb24pal.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/rgb32.bmp b/image/test/reftest/bmp/bmpsuite/g/rgb32.bmp
new file mode 100644
index 0000000000..5d57eaaea8
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/rgb32.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/g/rgb32bf.bmp b/image/test/reftest/bmp/bmpsuite/g/rgb32bf.bmp
new file mode 100644
index 0000000000..20fa9a1326
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/g/rgb32bf.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/pal1p1.bmp b/image/test/reftest/bmp/bmpsuite/q/pal1p1.bmp
new file mode 100644
index 0000000000..b68321c4c1
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/pal1p1.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/pal1p1.png b/image/test/reftest/bmp/bmpsuite/q/pal1p1.png
new file mode 100644
index 0000000000..92fc0f945b
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/pal1p1.png differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/pal2.bmp b/image/test/reftest/bmp/bmpsuite/q/pal2.bmp
new file mode 100644
index 0000000000..983e9fa92d
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/pal2.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/pal4rletrns.bmp b/image/test/reftest/bmp/bmpsuite/q/pal4rletrns.bmp
new file mode 100644
index 0000000000..58994e92ba
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/pal4rletrns.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/pal4rletrns.png b/image/test/reftest/bmp/bmpsuite/q/pal4rletrns.png
new file mode 100644
index 0000000000..9b0c044364
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/pal4rletrns.png differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/pal8.png b/image/test/reftest/bmp/bmpsuite/q/pal8.png
new file mode 100644
index 0000000000..2bfd3e650f
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/pal8.png differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/pal8offs.bmp b/image/test/reftest/bmp/bmpsuite/q/pal8offs.bmp
new file mode 100644
index 0000000000..8673e9740b
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/pal8offs.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/pal8os2sp.bmp b/image/test/reftest/bmp/bmpsuite/q/pal8os2sp.bmp
new file mode 100644
index 0000000000..e532c89863
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/pal8os2sp.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/pal8os2v2-16.bmp b/image/test/reftest/bmp/bmpsuite/q/pal8os2v2-16.bmp
new file mode 100644
index 0000000000..95a1d2345a
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/pal8os2v2-16.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/pal8os2v2.bmp b/image/test/reftest/bmp/bmpsuite/q/pal8os2v2.bmp
new file mode 100644
index 0000000000..1324a40d00
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/pal8os2v2.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/pal8oversizepal.bmp b/image/test/reftest/bmp/bmpsuite/q/pal8oversizepal.bmp
new file mode 100644
index 0000000000..93b8187ca1
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/pal8oversizepal.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/pal8rletrns.bmp b/image/test/reftest/bmp/bmpsuite/q/pal8rletrns.bmp
new file mode 100644
index 0000000000..a2af88d87c
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/pal8rletrns.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/pal8rletrns.png b/image/test/reftest/bmp/bmpsuite/q/pal8rletrns.png
new file mode 100644
index 0000000000..2d8e957f1f
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/pal8rletrns.png differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/reftest.list b/image/test/reftest/bmp/bmpsuite/q/reftest.list
new file mode 100644
index 0000000000..80da580cc8
--- /dev/null
+++ b/image/test/reftest/bmp/bmpsuite/q/reftest.list
@@ -0,0 +1,130 @@
+# bmpsuite "questionable" tests
+
+# See ../README.mozilla for details.
+
+# BMP: bihsize=40, 127 x 64, bpp=1, compression=0, colors=1
+# "1 bit/pixel paletted image, with only one color in the palette. The
+# documentation says that 1-bpp images have a palette size of 2 (not 'up to
+# 2'), but it would be silly for a viewer not to support a size of 1."
+# [We accept it. So does Chromium.]
+== pal1p1.bmp pal1p1.png
+
+# BMP: bihsize=40, 127 x 64, bpp=2, compression=0, colors=4
+# "A paletted image with 2 bits/pixel. Usually only 1, 4, and 8 are allowed,
+# but 2 is legal on Windows CE."
+# [We reject it. So does Chromium.]
+== wrapper.html?pal2.bmp about:blank
+
+# BMP: bihsize=40, 127 x 64, bpp=4, compression=2, colors=13
+# "An RLE-compressed image that used 'delta' codes to skip over some pixels,
+# leaving them undefined. Some viewers make undefined pixels transparent,
+# others make them black, and others assign them palette color 0 (purple, in
+# this case)."
+# [We make the undefined pixels transparent. So does Chromium.]
+== pal4rletrns.bmp pal4rletrns.png
+
+# BMP: bihsize=40, 127 x 64, bpp=8, compression=1, colors=253
+# "8-bit version of q/pal4rletrns.bmp."
+# [Ditto.]
+== pal8rletrns.bmp pal8rletrns.png
+
+# BMP: bihsize=40, 127 x 64, bpp=8, compression=0, colors=252
+# "A file with some unused bytes between the palette and the image. This is
+# probably valid, but I’m not 100% sure."
+# [We accept it. So does Chromium.]
+fuzzy(1,899) == pal8offs.bmp pal8.png
+
+# BMP: bihsize=40, 127 x 64, bpp=8, compression=0, colors=300
+# "An 8-bit image with 300 palette colors. This may be invalid, because the
+# documentation could be interpreted to imply that 8-bit images aren’t allowed
+# to have more than 256 colors."
+# [We accept it. So does Chromium.]
+fuzzy(1,899) == pal8oversizepal.bmp pal8.png
+
+# BMP: bihsize=12, 127 x 64, bpp=8, compression=0, colors=0
+# "An OS/2v1 with a less-than-full-sized palette. Probably not valid, but such
+# files have been seen in the wild."
+# [We reject it. Chromium accepts it but draws nothing. Rejecting seems
+# preferable given that the color and pixel data must overlap, which can only
+# lead to rubbish results.]
+== wrapper.html?pal8os2sp.bmp about:blank
+
+# BMP: bihsize=64, 127 x 64, bpp=8, compression=0, colors=252
+# "My attempt to make an OS/2v2 bitmap."
+# [We accept it. So does Chromium.]
+fuzzy(1,899) == pal8os2v2.bmp pal8.png
+
+# BMP: bihsize=16, 127 x 64, bpp=8, compression=0, colors=0
+# "An OS/2v2 bitmap whose header has only 16 bytes, instead of the full 64."
+# [We accept it. So does Chromium.]
+fuzzy(1,899) == pal8os2v2-16.bmp pal8.png
+
+# BMP: bihsize=40, 127 x 64, bpp=16, compression=3, colors=0
+# "An unusual and silly 16-bit image, with 2 red bits, 3 green bits, and 1 blue
+# bit. Most viewers do support this image, but the colors may be darkened with
+# a yellow-green shadow. That’s because they’re doing simple bit-shifting
+# (possibly including one round of bit replication), instead of proper
+# scaling."
+== rgb16-231.bmp rgb16-231.png
+
+# BMP: bihsize=124, 127 x 64, bpp=16, compression=3, colors=0
+# "A 16-bit image with an alpha channel. There are 4 bits for each color
+# channel, and 4 bits for the alpha channel. It’s not clear if this is valid,
+# but I can’t find anything that suggests it isn’t."
+== rgba16-4444.bmp rgba16-4444.png
+
+# BMP: bihsize=40, 127 x 64, bpp=24, compression=0, colors=300
+# "A 24-bit image, with a palette containing 300 colors. The fact that the
+# palette has more than 256 colors may cause some viewers to complain, but the
+# documentation does not mention a size limit."
+# [We accept it. So does Chromium.]
+== rgb24largepal.bmp rgb24.png
+
+# BMP: bihsize=124, 127 x 64, bpp=24, compression=0, colors=0
+# "My attempt to make a BMP file with an embedded color profile."
+# [We support it, though we don't do anything with the color profile. Chromium
+# also handles it.]
+== rgb24prof.bmp rgb24.png
+
+# BMP: bihsize=124, 127 x 64, bpp=24, compression=0, colors=0
+# "My attempt to make a BMP file with a linked color profile."
+# [We accept it, though we don't do anything with the color profile. Chromium
+# also handles it.]
+== rgb24lprof.bmp rgb24.png
+
+# BMP: bihsize=124, 127 x 64, bpp=0, compression=4, colors=0
+# BMP: bihsize=124, 127 x 64, bpp=0, compression=5, colors=0
+# "My attempt to make BMP files with embedded JPEG and PNG images. These are
+# not likely to be supported by much of anything (they’re intended for 
+# printers)."
+# [We reject them. So does Chromium.]
+== wrapper.html?rgb24jpeg.bmp about:blank
+== wrapper.html?rgb24png.bmp about:blank
+
+# BMP: bihsize=40, 127 x 64, bpp=32, compression=0, colors=0
+# "Same as g/rgb32.bmp, except that the unused bits are set to something other
+# than 0. If the image becomes transparent toward the bottom, it probably means
+# the viewer uses heuristics to guess whether the undefined data represents
+# transparency."
+# [We don't apply transparency here. Chromium does the same.]
+== rgb32fakealpha.bmp rgb24.png
+
+# BMP: bihsize=40, 127 x 64, bpp=32, compression=3, colors=0
+# "A 32 bits/pixel image, with all 32 bits used: 11 each for red and green, and
+# 10 for blue. As far as I know, this is perfectly valid, but it is unusual."
+fuzzy(1,1408) == rgb32-111110.bmp rgb24.png
+
+# BMP: bihsize=124, 127 x 64, bpp=32, compression=3, colors=0
+# "A BMP with an alpha channel. Transparency is barely documented, so it’s
+# possible that this file is not correctly formed. The color channels are in an
+# unusual order, to prevent viewers from passing this test by making a lucky
+# guess."
+== rgba32.bmp rgba32.png
+
+# BMP: bihsize=40, 127 x 64, bpp=32, compression=6, colors=0
+# "An image of type BI_ALPHABITFIELDS. Supposedly, this was used on Windows CE.
+# I don’t know whether it is constructed correctly."
+# [We reject it. So does Chromium.]
+== wrapper.html?rgba32abf.bmp about:blank
+
+
diff --git a/image/test/reftest/bmp/bmpsuite/q/rgb16-231.bmp b/image/test/reftest/bmp/bmpsuite/q/rgb16-231.bmp
new file mode 100644
index 0000000000..6300f69f0c
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/rgb16-231.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/rgb16-231.png b/image/test/reftest/bmp/bmpsuite/q/rgb16-231.png
new file mode 100644
index 0000000000..76efe526e5
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/rgb16-231.png differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/rgb24.png b/image/test/reftest/bmp/bmpsuite/q/rgb24.png
new file mode 100644
index 0000000000..86a9c945b0
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/rgb24.png differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/rgb24jpeg.bmp b/image/test/reftest/bmp/bmpsuite/q/rgb24jpeg.bmp
new file mode 100644
index 0000000000..87d73d75b8
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/rgb24jpeg.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/rgb24largepal.bmp b/image/test/reftest/bmp/bmpsuite/q/rgb24largepal.bmp
new file mode 100644
index 0000000000..d5e418c2d4
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/rgb24largepal.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/rgb24lprof.bmp b/image/test/reftest/bmp/bmpsuite/q/rgb24lprof.bmp
new file mode 100644
index 0000000000..b868b88f20
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/rgb24lprof.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/rgb24png.bmp b/image/test/reftest/bmp/bmpsuite/q/rgb24png.bmp
new file mode 100644
index 0000000000..e87ec7adda
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/rgb24png.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/rgb24prof.bmp b/image/test/reftest/bmp/bmpsuite/q/rgb24prof.bmp
new file mode 100644
index 0000000000..627e676eae
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/rgb24prof.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/rgb32-111110.bmp b/image/test/reftest/bmp/bmpsuite/q/rgb32-111110.bmp
new file mode 100644
index 0000000000..ec07d89b5b
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/rgb32-111110.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/rgb32fakealpha.bmp b/image/test/reftest/bmp/bmpsuite/q/rgb32fakealpha.bmp
new file mode 100644
index 0000000000..cb544da5b6
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/rgb32fakealpha.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/rgba16-4444.bmp b/image/test/reftest/bmp/bmpsuite/q/rgba16-4444.bmp
new file mode 100644
index 0000000000..051ff23589
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/rgba16-4444.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/rgba16-4444.png b/image/test/reftest/bmp/bmpsuite/q/rgba16-4444.png
new file mode 100644
index 0000000000..bfeda6faed
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/rgba16-4444.png differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/rgba32.bmp b/image/test/reftest/bmp/bmpsuite/q/rgba32.bmp
new file mode 100644
index 0000000000..829c7c7e34
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/rgba32.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/rgba32.png b/image/test/reftest/bmp/bmpsuite/q/rgba32.png
new file mode 100644
index 0000000000..25e542a655
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/rgba32.png differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/rgba32abf.bmp b/image/test/reftest/bmp/bmpsuite/q/rgba32abf.bmp
new file mode 100644
index 0000000000..d9bb0189c4
Binary files /dev/null and b/image/test/reftest/bmp/bmpsuite/q/rgba32abf.bmp differ
diff --git a/image/test/reftest/bmp/bmpsuite/q/wrapper.html b/image/test/reftest/bmp/bmpsuite/q/wrapper.html
new file mode 100644
index 0000000000..47e68959fd
--- /dev/null
+++ b/image/test/reftest/bmp/bmpsuite/q/wrapper.html
@@ -0,0 +1,28 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<head>
+<title>Image reftest wrapper</title>
+<style type="text/css">
+  #image1 { background-color: rgb(10, 100, 250); }
+</style>
+<script>
+  // The image is loaded async after the page loads
+  // wait for it to finish loading
+  function onImageLoad() { 
+    document.documentElement.removeAttribute("class");
+  };
+</script>
+</head>
+<body>
+<img id="image1">
+<script>
+  // Use as "wrapper.html?image.png"
+  var imgURL = document.location.search.substr(1);
+  document.images[0].onload = onImageLoad;
+  document.images[0].onerror = onImageLoad;
+  document.images[0].alt = "";
+  document.images[0].src = imgURL;
+</script>
+</body>
+</html>
+
diff --git a/image/test/reftest/bmp/bmpsuite/reftest.list b/image/test/reftest/bmp/bmpsuite/reftest.list
new file mode 100644
index 0000000000..8f48430f95
--- /dev/null
+++ b/image/test/reftest/bmp/bmpsuite/reftest.list
@@ -0,0 +1,7 @@
+# bmpsuite tests
+
+# See README.mozilla for details about these tests.
+
+include g/reftest.list
+include q/reftest.list
+include b/reftest.list
diff --git a/image/test/reftest/bmp/reftest.list b/image/test/reftest/bmp/reftest.list
index 681f9f0eaf..36b6938500 100644
--- a/image/test/reftest/bmp/reftest.list
+++ b/image/test/reftest/bmp/reftest.list
@@ -5,3 +5,4 @@ include bmp-4bpp/reftest.list
 include bmp-8bpp/reftest.list
 include bmp-24bpp/reftest.list
 include bmp-corrupted/reftest.list
+include bmpsuite/reftest.list
diff --git a/intl/locale/nsLocaleService.cpp b/intl/locale/nsLocaleService.cpp
index 079e626894..76d89abcb5 100644
--- a/intl/locale/nsLocaleService.cpp
+++ b/intl/locale/nsLocaleService.cpp
@@ -17,6 +17,7 @@
 #include "prprf.h"
 #include "nsTArray.h"
 #include "nsString.h"
+#include "mozilla/UniquePtr.h"
 
 #include <ctype.h>
 
@@ -268,11 +269,11 @@ nsLocaleService::GetLocaleFromAcceptLanguage(const char *acceptLanguage, nsILoca
   char	acceptLanguageList[NSILOCALE_MAX_ACCEPT_LANGUAGE][NSILOCALE_MAX_ACCEPT_LENGTH];
   nsresult	result;
 
-  nsAutoArrayPtr<char> input(new char[strlen(acceptLanguage)+1]);
+  auto input = MakeUnique<char[]>(strlen(acceptLanguage)+1);
 
-  strcpy(input, acceptLanguage);
-  cPtr1 = input-1;
-  cPtr2 = input;
+  strcpy(input.get(), acceptLanguage);
+  cPtr1 = input.get()-1;
+  cPtr2 = input.get();
 
   /* put in standard form */
   while (*(++cPtr1)) {
@@ -286,7 +287,7 @@ nsLocaleService::GetLocaleFromAcceptLanguage(const char *acceptLanguage, nsILoca
 
   countLang = 0;
 
-  if (strchr(input,';')) {
+  if (strchr(input.get(), ';')) {
     /* deal with the quality values */
 
     float qvalue[NSILOCALE_MAX_ACCEPT_LANGUAGE];
@@ -295,7 +296,7 @@ nsLocaleService::GetLocaleFromAcceptLanguage(const char *acceptLanguage, nsILoca
     char* ptrLanguage[NSILOCALE_MAX_ACCEPT_LANGUAGE];
     char* ptrSwap;
 
-    cPtr = nsCRT::strtok(input,",",&cPtr2);
+    cPtr = nsCRT::strtok(input.get(),",",&cPtr2);
     while (cPtr) {
       qvalue[countLang] = 1.0f;
       /* add extra parens to get rid of warning */
@@ -332,7 +333,7 @@ nsLocaleService::GetLocaleFromAcceptLanguage(const char *acceptLanguage, nsILoca
   } else {
     /* simple case: no quality values */
 
-    cPtr = nsCRT::strtok(input,",",&cPtr2);
+    cPtr = nsCRT::strtok(input.get(),",",&cPtr2);
     while (cPtr) {
       if (strlen(cPtr)<NSILOCALE_MAX_ACCEPT_LENGTH) {        /* ignore if too long */
         PL_strncpyz(acceptLanguageList[countLang++],cPtr,NSILOCALE_MAX_ACCEPT_LENGTH);
diff --git a/intl/uconv/nsUTF8ConverterService.cpp b/intl/uconv/nsUTF8ConverterService.cpp
index a28a5d9980..184f729819 100644
--- a/intl/uconv/nsUTF8ConverterService.cpp
+++ b/intl/uconv/nsUTF8ConverterService.cpp
@@ -10,6 +10,7 @@
 #include "nsAutoPtr.h"
 #include "nsIUnicodeDecoder.h"
 #include "mozilla/dom/EncodingUtils.h"
+#include "mozilla/UniquePtr.h"
 
 using mozilla::dom::EncodingUtils;
 
@@ -40,13 +41,12 @@ ToUTF8(const nsACString &aString, const char *aCharset,
   rv = unicodeDecoder->GetMaxLength(inStr.get(), srcLen, &dstLen);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsAutoArrayPtr<char16_t> ustr(new char16_t[dstLen]);
+  auto ustr = mozilla::MakeUnique<char16_t[]>(dstLen);
   NS_ENSURE_TRUE(ustr, NS_ERROR_OUT_OF_MEMORY);
 
-  rv = unicodeDecoder->Convert(inStr.get(), &srcLen, ustr, &dstLen);
+  rv = unicodeDecoder->Convert(inStr.get(), &srcLen, ustr.get(), &dstLen);
   if (NS_SUCCEEDED(rv)){
-    // Tru64 Cxx needs an explicit get()
-    CopyUTF16toUTF8(Substring(ustr.get(), ustr + dstLen), aResult);
+    CopyUTF16toUTF8(Substring(ustr.get(), ustr.get() + dstLen), aResult);
   }
   return rv;
 }
diff --git a/intl/uconv/util/nsUnicodeDecodeHelper.cpp b/intl/uconv/util/nsUnicodeDecodeHelper.cpp
index 9a6ebd29bd..9d3491d86a 100644
--- a/intl/uconv/util/nsUnicodeDecodeHelper.cpp
+++ b/intl/uconv/util/nsUnicodeDecodeHelper.cpp
@@ -5,7 +5,7 @@
 
 #include "unicpriv.h"
 #include "nsUnicodeDecodeHelper.h"
-#include "nsAutoPtr.h"
+#include "mozilla/UniquePtr.h"
 
 //----------------------------------------------------------------------
 // Class nsUnicodeDecodeHelper [implementation]
@@ -224,11 +224,11 @@ nsresult nsUnicodeDecodeHelper::CreateFastTable(
 {
   int32_t tableSize = aTableSize;
   int32_t buffSize = aTableSize;
-  nsAutoArrayPtr<char> buff(new char [buffSize]);
+  auto buff = mozilla::MakeUnique<char[]>(buffSize);
 
-  char * p = buff;
+  char * p = buff.get();
   for (int32_t i=0; i<aTableSize; i++) *(p++) = i;
-  return ConvertByTable(buff, &buffSize, aFastTable, &tableSize, 
+  return ConvertByTable(buff.get(), &buffSize, aFastTable, &tableSize, 
                         u1ByteCharset, nullptr, aMappingTable);
 }
 
diff --git a/ipc/chromium/chromium-config.mozbuild b/ipc/chromium/chromium-config.mozbuild
index 3cf4f52e2a..520d9db048 100644
--- a/ipc/chromium/chromium-config.mozbuild
+++ b/ipc/chromium/chromium-config.mozbuild
@@ -5,14 +5,11 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 LOCAL_INCLUDES += [
+    '!/ipc/ipdl/_ipdlheaders',
     '/ipc/chromium/src',
     '/ipc/glue',
 ]
 
-GENERATED_INCLUDES += [
-    '/ipc/ipdl/_ipdlheaders',
-]
-
 if CONFIG['OS_ARCH'] == 'WINNT':
     OS_LIBS += [
         'psapi',
diff --git a/js/public/StructuredClone.h b/js/public/StructuredClone.h
index 87f3ad15fc..e3077c72a5 100644
--- a/js/public/StructuredClone.h
+++ b/js/public/StructuredClone.h
@@ -134,7 +134,7 @@ typedef void (*FreeTransferStructuredCloneOp)(uint32_t tag, JS::TransferableOwne
 // Increment this when anything at all changes in the serialization format.
 // (Note that this does not need to be bumped for Transferable-only changes,
 // since they are never saved to persistent storage.)
-#define JS_STRUCTURED_CLONE_VERSION 5
+#define JS_STRUCTURED_CLONE_VERSION 6
 
 struct JSStructuredCloneCallbacks {
     ReadStructuredCloneOp read;
diff --git a/js/src/configure.in b/js/src/configure.in
index 2483feca2d..ec5ddeed77 100644
--- a/js/src/configure.in
+++ b/js/src/configure.in
@@ -344,7 +344,10 @@ case "$target" in
         # that behavior) that it's better to turn it off.
         # _CRT_SECURE_NO_WARNINGS disables warnings about using MSVC-specific
         # secure CRT functions.
-        CXXFLAGS="$CXXFLAGS -wd4345 -wd4351 -wd4800 -D_CRT_SECURE_NO_WARNINGS"
+        # MSVC warning C4819 warns some UTF-8 characters (e.g. copyright sign)
+        # on non-Western system locales even if it is in a comment.
+        CFLAGS="$CFLAGS -wd4819"
+        CXXFLAGS="$CXXFLAGS -wd4345 -wd4351 -wd4800 -wd4819 -D_CRT_SECURE_NO_WARNINGS"
         AC_LANG_SAVE
         AC_LANG_C
         AC_TRY_COMPILE([#include <stdio.h>],
@@ -974,6 +977,10 @@ mips|mipsel)
     CPU_ARCH="mips32"
     ;;
 
+mips64|mips64el)
+    CPU_ARCH="mips64"
+    ;;
+
 aarch64*)
     CPU_ARCH=aarch64
     ;;
@@ -2064,18 +2071,11 @@ mips*-*)
     ;;
 esac
 
-case "$target" in
-mips*-*)
-     AC_DEFINE(JS_NUNBOX32)
-     ;;
-*)
-    if test "$HAVE_64BIT_BUILD" ; then
-        AC_DEFINE(JS_PUNBOX64)
-    else
-        AC_DEFINE(JS_NUNBOX32)
-    fi
-    ;;
-esac
+if test "$HAVE_64BIT_BUILD" ; then
+    AC_DEFINE(JS_PUNBOX64)
+else
+    AC_DEFINE(JS_NUNBOX32)
+fi
 
 MOZ_ARG_DISABLE_BOOL(ion,
 [  --disable-ion      Disable use of the IonMonkey JIT],
@@ -3060,16 +3060,16 @@ dnl ========================================================
 MOZ_ARG_ENABLE_STRING(simulator,
 [  --enable-simulator=ARCH
                           Enable a JIT code simulator for the specified arch.
-                          (arm, arm64, mips32).],
+                          (arm, arm64, mips32, mips64).],
     JS_SIMULATOR="$enableval")
 
 if test -n "$JS_SIMULATOR"; then
     case "$JS_SIMULATOR" in
-        arm|arm64|mips32) ;;
+        arm|arm64|mips32|mips64) ;;
         no)
             JS_SIMULATOR=
             ;;
-        *) AC_MSG_ERROR([Invalid simulator. Valid simulators are: arm, arm64, mips32.]) ;;
+        *) AC_MSG_ERROR([Invalid simulator. Valid simulators are: arm, arm64, mips32, mips64.]) ;;
     esac
 fi
 
@@ -3105,6 +3105,15 @@ elif test "$JS_SIMULATOR" = mips32; then
     AC_DEFINE(JS_CODEGEN_MIPS32)
     JS_SIMULATOR_MIPS32=1
     JS_CODEGEN_MIPS32=1
+elif test "$JS_SIMULATOR" = mips64; then
+    if test "$CPU_ARCH" != "x86_64"; then
+        AC_MSG_ERROR([The MIPS64 simulator only works on x86_64.])
+    fi
+    AC_DEFINE(JS_SIMULATOR)
+    AC_DEFINE(JS_SIMULATOR_MIPS64)
+    AC_DEFINE(JS_CODEGEN_MIPS64)
+    JS_SIMULATOR_MIPS64=1
+    JS_CODEGEN_MIPS64=1
 elif test "$CPU_ARCH" = "x86"; then
     AC_DEFINE(JS_CODEGEN_X86)
     JS_CODEGEN_X86=1
@@ -3126,15 +3135,20 @@ elif test "$CPU_ARCH" = "arm"; then
 elif test "$CPU_ARCH" = "mips32"; then
     AC_DEFINE(JS_CODEGEN_MIPS32)
     JS_CODEGEN_MIPS32=1
+elif test "$CPU_ARCH" = "mips64"; then
+    AC_DEFINE(JS_CODEGEN_MIPS64)
+    JS_CODEGEN_MIPS64=1
 fi
 
 AC_SUBST(JS_SIMULATOR)
 AC_SUBST(JS_SIMULATOR_ARM)
 AC_SUBST(JS_SIMULATOR_ARM64)
 AC_SUBST(JS_SIMULATOR_MIPS32)
+AC_SUBST(JS_SIMULATOR_MIPS64)
 AC_SUBST(JS_CODEGEN_ARM)
 AC_SUBST(JS_CODEGEN_ARM64)
 AC_SUBST(JS_CODEGEN_MIPS32)
+AC_SUBST(JS_CODEGEN_MIPS64)
 AC_SUBST(JS_CODEGEN_X86)
 AC_SUBST(JS_CODEGEN_X64)
 AC_SUBST(JS_CODEGEN_NONE)
diff --git a/js/src/gdb/moz.build b/js/src/gdb/moz.build
index e385acaafd..56378f7672 100644
--- a/js/src/gdb/moz.build
+++ b/js/src/gdb/moz.build
@@ -23,8 +23,10 @@ UNIFIED_SOURCES += [
 
 DEFINES['EXPORT_JS_API'] = True
 
-LOCAL_INCLUDES += ['..']
-GENERATED_INCLUDES += ['..']
+LOCAL_INCLUDES += [
+    '!..',
+    '..',
+]
 
 USE_LIBS += [
     'static:js',
diff --git a/js/src/jit-test/tests/gc/bug-1215363-1.js b/js/src/jit-test/tests/gc/bug-1215363-1.js
new file mode 100644
index 0000000000..d3a2bae651
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-1215363-1.js
@@ -0,0 +1,4 @@
+if (!('oomTest' in this))
+    quit();
+
+oomTest(() => parseModule(10));
diff --git a/js/src/jit-test/tests/gc/bug-1215363-2.js b/js/src/jit-test/tests/gc/bug-1215363-2.js
new file mode 100644
index 0000000000..92c6c64d0c
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-1215363-2.js
@@ -0,0 +1,7 @@
+if (!('oomTest' in this))
+    quit();
+
+var lfcode = new Array();
+oomTest((function(x) {
+    assertEq(...Object);
+}));
diff --git a/js/src/jit-test/tests/gc/bug-1215363-3.js b/js/src/jit-test/tests/gc/bug-1215363-3.js
new file mode 100644
index 0000000000..558e1c0f3d
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-1215363-3.js
@@ -0,0 +1,5 @@
+if (!('oomTest' in this))
+    quit();
+
+var lfcode = new Array();
+oomTest(() => getBacktrace({}));
diff --git a/js/src/jit-test/tests/gc/bug-1215678.js b/js/src/jit-test/tests/gc/bug-1215678.js
new file mode 100644
index 0000000000..121a356cc0
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-1215678.js
@@ -0,0 +1,10 @@
+// |jit-test| error: ReferenceError
+if (!('oomTest' in this))
+    a;
+
+enableShellObjectMetadataCallback()
+oomTest(() => {
+  newGlobal()
+})
+gczeal(9, 1);
+a;
diff --git a/js/src/jsapi-tests/moz.build b/js/src/jsapi-tests/moz.build
index 9ad38d24dd..c62193e2d3 100644
--- a/js/src/jsapi-tests/moz.build
+++ b/js/src/jsapi-tests/moz.build
@@ -104,8 +104,10 @@ if CONFIG['ENABLE_ION']:
 
 DEFINES['EXPORT_JS_API'] = True
 
-LOCAL_INCLUDES += ['..']
-GENERATED_INCLUDES += ['..']
+LOCAL_INCLUDES += [
+    '!..',
+    '..',
+]
 
 USE_LIBS += [
     'static:js',
diff --git a/js/src/jsapi-tests/testStructuredClone.cpp b/js/src/jsapi-tests/testStructuredClone.cpp
index 0cfa966d9d..4f5d29a193 100644
--- a/js/src/jsapi-tests/testStructuredClone.cpp
+++ b/js/src/jsapi-tests/testStructuredClone.cpp
@@ -78,3 +78,151 @@ BEGIN_TEST(testStructuredClone_string)
     return true;
 }
 END_TEST(testStructuredClone_string)
+
+struct StructuredCloneTestPrincipals final : public JSPrincipals {
+    uint32_t rank;
+
+    explicit StructuredCloneTestPrincipals(uint32_t rank, int32_t rc = 1) : rank(rank) {
+        this->refcount = rc;
+    }
+
+    bool write(JSContext* cx, JSStructuredCloneWriter* writer) override {
+        return JS_WriteUint32Pair(writer, rank, 0);
+    }
+
+    static bool read(JSContext* cx, JSStructuredCloneReader *reader, JSPrincipals** outPrincipals) {
+        uint32_t rank;
+        uint32_t unused;
+        if (!JS_ReadUint32Pair(reader, &rank, &unused))
+            return false;
+
+        *outPrincipals = new StructuredCloneTestPrincipals(rank);
+        return !!*outPrincipals;
+    }
+
+    static void destroy(JSPrincipals* p) {
+        auto p1 = static_cast<StructuredCloneTestPrincipals*>(p);
+        delete p1;
+    }
+
+    static uint32_t getRank(JSPrincipals* p) {
+        if (!p)
+            return 0;
+        return static_cast<StructuredCloneTestPrincipals*>(p)->rank;
+    }
+
+    static bool subsumes(JSPrincipals* a, JSPrincipals* b) {
+        return getRank(a) > getRank(b);
+    }
+
+    static JSSecurityCallbacks securityCallbacks;
+
+    static StructuredCloneTestPrincipals testPrincipals;
+};
+
+JSSecurityCallbacks StructuredCloneTestPrincipals::securityCallbacks = {
+    nullptr, // contentSecurityPolicyAllows
+    subsumes
+};
+
+BEGIN_TEST(testStructuredClone_SavedFrame)
+{
+    JS_SetSecurityCallbacks(rt, &StructuredCloneTestPrincipals::securityCallbacks);
+    JS_InitDestroyPrincipalsCallback(rt, StructuredCloneTestPrincipals::destroy);
+    JS_InitReadPrincipalsCallback(rt, StructuredCloneTestPrincipals::read);
+
+    auto testPrincipals = new StructuredCloneTestPrincipals(42, 0);
+    CHECK(testPrincipals);
+
+    auto DONE = (JSPrincipals*) 0xDEADBEEF;
+
+    struct {
+        const char* name;
+        JSPrincipals* principals;
+    } principalsToTest[] = {
+        { "IsSystem", &js::ReconstructedSavedFramePrincipals::IsSystem },
+        { "IsNotSystem", &js::ReconstructedSavedFramePrincipals::IsNotSystem },
+        { "testPrincipals", testPrincipals },
+        { "nullptr principals", nullptr },
+        { "DONE", DONE }
+    };
+
+    const char* FILENAME = "filename.js";
+
+    for (auto* pp = principalsToTest; pp->principals != DONE; pp++) {
+        fprintf(stderr, "Testing with principals '%s'\n", pp->name);
+
+        JS::RootedObject g(cx, JS_NewGlobalObject(cx, getGlobalClass(), pp->principals,
+                                                  JS::FireOnNewGlobalHook));
+        CHECK(g);
+        JSAutoCompartment ac(cx, g);
+
+        CHECK(js::DefineTestingFunctions(cx, g, false, false));
+
+        JS::RootedValue srcVal(cx);
+        CHECK(evaluate("(function one() {                      \n"  // 1
+                       "  return (function two() {             \n"  // 2
+                       "    return (function three() {         \n"  // 3
+                       "      return saveStack();              \n"  // 4
+                       "    }());                              \n"  // 5
+                       "  }());                                \n"  // 6
+                       "}());                                  \n", // 7
+                       FILENAME,
+                       1,
+                       &srcVal));
+
+        CHECK(srcVal.isObject());
+        JS::RootedObject srcObj(cx, &srcVal.toObject());
+
+        CHECK(srcObj->is<js::SavedFrame>());
+        js::RootedSavedFrame srcFrame(cx, &srcObj->as<js::SavedFrame>());
+
+        CHECK(srcFrame->getPrincipals() == pp->principals);
+
+        JS::RootedValue destVal(cx);
+        CHECK(JS_StructuredClone(cx, srcVal, &destVal, nullptr, nullptr));
+
+        CHECK(destVal.isObject());
+        JS::RootedObject destObj(cx, &destVal.toObject());
+
+        CHECK(destObj->is<js::SavedFrame>());
+        auto destFrame = &destObj->as<js::SavedFrame>();
+
+        size_t framesCopied = 0;
+        for (auto& f : *destFrame) {
+            framesCopied++;
+
+            CHECK(&f != srcFrame);
+
+            if (pp->principals == testPrincipals) {
+                // We shouldn't get a pointer to the same
+                // StructuredCloneTestPrincipals instance since we should have
+                // serialized and then deserialized it into a new instance.
+                CHECK(f.getPrincipals() != pp->principals);
+
+                // But it should certainly have the same rank.
+                CHECK(StructuredCloneTestPrincipals::getRank(f.getPrincipals()) ==
+                      StructuredCloneTestPrincipals::getRank(pp->principals));
+            } else {
+                // For our singleton principals, we should always get the same
+                // pointer back.
+                CHECK(js::ReconstructedSavedFramePrincipals::is(pp->principals) ||
+                      pp->principals == nullptr);
+                CHECK(f.getPrincipals() == pp->principals);
+            }
+
+            CHECK(EqualStrings(f.getSource(), srcFrame->getSource()));
+            CHECK(f.getLine() == srcFrame->getLine());
+            CHECK(f.getColumn() == srcFrame->getColumn());
+            CHECK(EqualStrings(f.getFunctionDisplayName(), srcFrame->getFunctionDisplayName()));
+
+            srcFrame = srcFrame->getParent();
+        }
+
+        // Four function frames + one global frame.
+        CHECK(framesCopied == 4);
+    }
+
+    return true;
+}
+END_TEST(testStructuredClone_SavedFrame)
diff --git a/js/src/jscntxt.cpp b/js/src/jscntxt.cpp
index a10cae3ee6..8b235c33e4 100644
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@@ -60,7 +60,7 @@ using mozilla::UniquePtr;
 bool
 js::AutoCycleDetector::init()
 {
-    ObjectSet& set = cx->cycleDetectorSet;
+    AutoCycleDetector::Set& set = cx->cycleDetectorSet;
     hashsetAddPointer = set.lookupForAdd(obj);
     if (!hashsetAddPointer) {
         if (!set.add(hashsetAddPointer, obj))
@@ -82,14 +82,10 @@ js::AutoCycleDetector::~AutoCycleDetector()
 }
 
 void
-js::TraceCycleDetectionSet(JSTracer* trc, js::ObjectSet& set)
+js::TraceCycleDetectionSet(JSTracer* trc, AutoCycleDetector::Set& set)
 {
-    for (js::ObjectSet::Enum e(set); !e.empty(); e.popFront()) {
-        JSObject* key = e.front();
-        TraceRoot(trc, &key, "cycle detector table entry");
-        if (key != e.front())
-            e.rekeyFront(key);
-    }
+    for (AutoCycleDetector::Set::Enum e(set); !e.empty(); e.popFront())
+        TraceRoot(trc, &e.mutableFront(), "cycle detector table entry");
 }
 
 JSContext*
@@ -433,8 +429,10 @@ js::ReportErrorVA(JSContext* cx, unsigned flags, const char* format, va_list ap)
         return true;
 
     message = JS_vsmprintf(format, ap);
-    if (!message)
+    if (!message) {
+        ReportOutOfMemory(cx);
         return false;
+    }
     messagelen = strlen(message);
 
     report.flags = flags;
diff --git a/js/src/jscntxt.h b/js/src/jscntxt.h
index 179bb90282..2bf252bca8 100644
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -29,20 +29,14 @@ class JitContext;
 class DebugModeOSRVolatileJitFrameIterator;
 } // namespace jit
 
-typedef HashSet<JSObject*> ObjectSet;
 typedef HashSet<Shape*> ShapeSet;
 
 /* Detects cycles when traversing an object graph. */
 class MOZ_RAII AutoCycleDetector
 {
-    Generation hashsetGenerationAtInit;
-    JSContext* cx;
-    RootedObject obj;
-    ObjectSet::AddPtr hashsetAddPointer;
-    bool cyclic;
-    MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
-
   public:
+    using Set = HashSet<JSObject*, MovableCellHasher<JSObject*>>;
+
     AutoCycleDetector(JSContext* cx, HandleObject objArg
                       MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
       : cx(cx), obj(cx, objArg), cyclic(true)
@@ -55,11 +49,19 @@ class MOZ_RAII AutoCycleDetector
     bool init();
 
     bool foundCycle() { return cyclic; }
+
+  private:
+    Generation hashsetGenerationAtInit;
+    JSContext* cx;
+    RootedObject obj;
+    Set::AddPtr hashsetAddPointer;
+    bool cyclic;
+    MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
 };
 
 /* Updates references in the cycle detection set if the GC moves them. */
 extern void
-TraceCycleDetectionSet(JSTracer* trc, ObjectSet& set);
+TraceCycleDetectionSet(JSTracer* trc, AutoCycleDetector::Set& set);
 
 struct AutoResolving;
 
@@ -349,7 +351,7 @@ struct JSContext : public js::ExclusiveContext,
 
   public:
     /* State for object and array toSource conversion. */
-    js::ObjectSet       cycleDetectorSet;
+    js::AutoCycleDetector::Set cycleDetectorSet;
 
     /* Client opaque pointers. */
     void*               data;
diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp
index 1f42f544ea..b297641636 100644
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -436,7 +436,6 @@ JSCompartment::wrap(JSContext* cx, MutableHandleObject obj, HandleObject existin
     if (obj->compartment() == this)
         return true;
 
-
     // If we already have a wrapper for this value, use it.
     RootedValue key(cx, ObjectValue(*obj));
     if (WrapperMap::Ptr p = crossCompartmentWrappers.lookup(CrossCompartmentKey(key))) {
@@ -457,15 +456,27 @@ JSCompartment::wrap(JSContext* cx, MutableHandleObject obj, HandleObject existin
         }
     }
 
-    obj.set(cb->wrap(cx, existing, obj));
-    if (!obj)
+    RootedObject wrapper(cx, cb->wrap(cx, existing, obj));
+    if (!wrapper)
         return false;
 
     // We maintain the invariant that the key in the cross-compartment wrapper
     // map is always directly wrapped by the value.
-    MOZ_ASSERT(Wrapper::wrappedObject(obj) == &key.get().toObject());
+    MOZ_ASSERT(Wrapper::wrappedObject(wrapper) == &key.get().toObject());
 
-    return putWrapper(cx, CrossCompartmentKey(key), ObjectValue(*obj));
+    if (!putWrapper(cx, CrossCompartmentKey(key), ObjectValue(*wrapper))) {
+        // Enforce the invariant that all cross-compartment wrapper object are
+        // in the map by nuking the wrapper if we couldn't add it.
+        // Unfortunately it's possible for the wrapper to still be marked if we
+        // took this path, for example if the object metadata callback stashes a
+        // reference to it.
+        if (wrapper->is<CrossCompartmentWrapperObject>())
+            NukeCrossCompartmentWrapper(cx, wrapper);
+        return false;
+    }
+
+    obj.set(wrapper);
+    return true;
 }
 
 bool
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index 30e43d4454..a533a9e0ca 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -35,6 +35,7 @@
 #include "jstypes.h"
 #include "jsutil.h"
 #include "jswatchpoint.h"
+#include "jswin.h"
 #include "jswrapper.h"
 
 #include "asmjs/AsmJSModule.h"
@@ -2384,7 +2385,7 @@ JSObject::reportNotExtensible(JSContext* cx, unsigned report)
 // immutable-prototype behavior is enforced; if it's false, behavior is not
 // enforced, and immutable-prototype bits stored on objects are completely
 // ignored.
-static const bool ImmutablePrototypesEnabled = false;
+static const bool ImmutablePrototypesEnabled = true;
 
 JS_FRIEND_API(bool)
 JS_ImmutablePrototypesEnabled()
@@ -2456,6 +2457,15 @@ js::SetPrototype(JSContext* cx, HandleObject obj, HandleObject proto, JS::Object
     if (!extensible)
         return result.fail(JSMSG_CANT_SET_PROTO);
 
+    // If this is a global object, resolve the Object class so that its
+    // [[Prototype]] chain is always properly immutable, even in the presence
+    // of lazy standard classes.
+    if (obj->is<GlobalObject>()) {
+        Rooted<GlobalObject*> global(cx, &obj->as<GlobalObject>());
+        if (!GlobalObject::ensureConstructor(cx, global, JSProto_Object))
+            return false;
+    }
+
     /*
      * ES6 9.1.2 step 6 forbids generating cyclical prototype chains. But we
      * have to do this comparison on the observable WindowProxy, not on the
@@ -3507,8 +3517,15 @@ js::DumpBacktrace(JSContext* cx)
         const char* filename = JS_GetScriptFilename(i.script());
         unsigned line = PCToLineNumber(i.script(), i.pc());
         JSScript* script = i.script();
-        sprinter.printf("#%d %14p   %s:%d (%p @ %d)\n",
-                        depth, (i.isJit() ? 0 : i.interpFrame()), filename, line,
+        char frameType =
+            i.isInterp() ? 'i' :
+            i.isBaseline() ? 'b' :
+            i.isIon() ? 'I' :
+            i.isAsmJS() ? 'A' :
+            '?';
+
+        sprinter.printf("#%d %14p %c   %s:%d (%p @ %d)\n",
+                        depth, i.rawFramePtr(), frameType, filename, line,
                         script, script->pcToOffset(i.pc()));
     }
     fprintf(stdout, "%s", sprinter.string());
@@ -3715,11 +3732,15 @@ JSObject::traceChildren(JSTracer* trc)
             GetObjectSlotNameFunctor func(nobj);
             JS::AutoTracingDetails ctx(trc, func);
             JS::AutoTracingIndex index(trc);
-            for (uint32_t i = 0; i < nobj->slotSpan(); ++i) {
+            // Tracing can mutate the target but cannot change the slot count,
+            // but the compiler has no way of knowing this.
+            const uint32_t nslots = nobj->slotSpan();
+            for (uint32_t i = 0; i < nslots; ++i) {
                 TraceManuallyBarrieredEdge(trc, nobj->getSlotRef(i).unsafeUnbarrieredForTracing(),
                                            "object slot");
                 ++index;
             }
+            MOZ_ASSERT(nslots == nobj->slotSpan());
         }
 
         do {
diff --git a/js/src/json.cpp b/js/src/json.cpp
index 38c797b159..5f55f8a6c8 100644
--- a/js/src/json.cpp
+++ b/js/src/json.cpp
@@ -136,7 +136,7 @@ class StringifyContext
       : sb(sb),
         gap(gap),
         replacer(cx, replacer),
-        stack(cx, TraceableHashSet<JSObject*>(cx)),
+        stack(cx, TraceableHashSet<JSObject*, MovableCellHasher<JSObject*>>(cx)),
         propertyList(propertyList),
         depth(0)
     {}
@@ -148,7 +148,7 @@ class StringifyContext
     StringBuffer& sb;
     const StringBuffer& gap;
     RootedObject replacer;
-    Rooted<TraceableHashSet<JSObject*>> stack;
+    Rooted<TraceableHashSet<JSObject*, MovableCellHasher<JSObject*>>> stack;
     const AutoIdVector& propertyList;
     uint32_t depth;
 };
@@ -324,7 +324,7 @@ class CycleDetector
     }
 
   private:
-    MutableHandle<TraceableHashSet<JSObject*>> stack;
+    MutableHandle<TraceableHashSet<JSObject*, MovableCellHasher<JSObject*>>> stack;
     HandleObject obj_;
 };
 
diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
index 50acb568de..c22ba58177 100644
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -36,6 +36,7 @@
 #include "asmjs/AsmJSModule.h"
 #include "frontend/BytecodeCompiler.h"
 #include "frontend/SourceNotes.h"
+#include "gc/GCInternals.h"
 #include "js/CharacterEncoding.h"
 #include "vm/CodeCoverage.h"
 #include "vm/Opcodes.h"
@@ -1973,6 +1974,9 @@ GenerateLcovInfo(JSContext* cx, JSCompartment* comp, GenericPrinter& out)
     JSRuntime* rt = cx->runtime();
 
     // Collect the list of scripts which are part of the current compartment.
+    {
+        js::gc::AutoPrepareForTracing apft(rt, SkipAtoms);
+    }
     Rooted<ScriptVector> topScripts(cx, ScriptVector(cx));
     for (ZonesIter zone(rt, SkipAtoms); !zone.done(); zone.next()) {
         for (ZoneCellIter i(zone, AllocKind::SCRIPT); !i.done(); i.next()) {
diff --git a/js/src/jsprf.cpp b/js/src/jsprf.cpp
index b5bdb7cc35..b148196709 100644
--- a/js/src/jsprf.cpp
+++ b/js/src/jsprf.cpp
@@ -375,11 +375,11 @@ BuildArgArray(const char* fmt, va_list ap, NumArgStateVector& nas)
             if (c > '9' || c < '0') {
                 if (c == '$') {         // numbered argument case
                     if (i > 0)
-                        return false;
+                        MOZ_CRASH("Bad format string");
                     number++;
                 } else {                // non-numbered argument case
                     if (number > 0)
-                        return false;
+                        MOZ_CRASH("Bad format string");
                     i = 1;
                 }
                 break;
@@ -417,7 +417,7 @@ BuildArgArray(const char* fmt, va_list ap, NumArgStateVector& nas)
         }
 
         if (!c || cn < 1 || cn > number)
-            return false;
+            MOZ_CRASH("Bad format string");
 
         // nas[cn] starts from 0, and make sure nas[cn].type is not assigned.
         cn--;
@@ -429,7 +429,7 @@ BuildArgArray(const char* fmt, va_list ap, NumArgStateVector& nas)
         // width
         if (c == '*') {
             // not supported feature, for the argument is not numbered
-            return false;
+            MOZ_CRASH("Bad format string");
         }
 
         while ((c >= '0') && (c <= '9')) {
@@ -441,7 +441,7 @@ BuildArgArray(const char* fmt, va_list ap, NumArgStateVector& nas)
             c = *p++;
             if (c == '*') {
                 // not supported feature, for the argument is not numbered
-                return false;
+                MOZ_CRASH("Bad format string");
             }
 
             while ((c >= '0') && (c <= '9')) {
@@ -527,7 +527,7 @@ BuildArgArray(const char* fmt, va_list ap, NumArgStateVector& nas)
 
         // get a legal para.
         if (nas[cn].type == TYPE_UNKNOWN)
-            return false;
+            MOZ_CRASH("Bad format string");
     }
 
 
@@ -557,7 +557,7 @@ BuildArgArray(const char* fmt, va_list ap, NumArgStateVector& nas)
         case TYPE_INTSTR:       (void) va_arg(ap, int*);        break;
         case TYPE_DOUBLE:       (void) va_arg(ap, double);      break;
 
-        default: return false;
+        default: MOZ_CRASH();
         }
 
         cn++;
@@ -599,8 +599,7 @@ dosprintf(SprintfState* ss, const char* fmt, va_list ap)
     NumArgStateVector nas;
     if (!BuildArgArray(fmt, ap, nas)) {
         // the fmt contains error Numbered Argument format, jliu@netscape.com
-        MOZ_ASSERT(0);
-        return false;
+        MOZ_CRASH("Bad format string");
     }
 
     while ((c = *fmt++) != 0) {
@@ -633,7 +632,7 @@ dosprintf(SprintfState* ss, const char* fmt, va_list ap)
             }
 
             if (nas[i - 1].type == TYPE_UNKNOWN)
-                return false;
+                MOZ_CRASH("Bad format string");
 
             ap = nas[i - 1].ap;
             dolPt = fmt;
diff --git a/js/src/jspropertytree.cpp b/js/src/jspropertytree.cpp
index 7e45aa0c85..253d86c907 100644
--- a/js/src/jspropertytree.cpp
+++ b/js/src/jspropertytree.cpp
@@ -312,24 +312,43 @@ Shape::fixupAfterMovingGC()
 void
 Shape::fixupGetterSetterForBarrier(JSTracer* trc)
 {
-    // Relocating the getterObj or setterObj will change our location in our
-    // parent's KidsHash, so remove ourself first if we're going to get moved.
-    if (parent && !parent->inDictionary() && parent->kids.isHash()) {
-        KidsHash* kh = parent->kids.toHash();
-        MOZ_ASSERT(kh->lookup(StackShape(this)));
-        kh->remove(StackShape(this));
-    }
+    if (!hasGetterValue() && !hasSetterValue())
+        return;
 
-    if (hasGetterObject())
-        TraceManuallyBarrieredEdge(trc, &asAccessorShape().getterObj, "getterObj");
-    if (hasSetterObject())
-        TraceManuallyBarrieredEdge(trc, &asAccessorShape().setterObj, "setterObj");
+    JSObject* priorGetter = asAccessorShape().getterObj;
+    JSObject* priorSetter = asAccessorShape().setterObj;
+    if (!priorGetter && !priorSetter)
+        return;
+
+    JSObject* postGetter = priorGetter;
+    JSObject* postSetter = priorSetter;
+    if (priorGetter)
+        TraceManuallyBarrieredEdge(trc, &postGetter, "getterObj");
+    if (priorSetter)
+        TraceManuallyBarrieredEdge(trc, &postSetter, "setterObj");
+    if (priorGetter == postGetter && priorSetter == postSetter)
+        return;
 
     if (parent && !parent->inDictionary() && parent->kids.isHash()) {
+        // Relocating the getterObj or setterObj will have changed our location
+        // in our parent's KidsHash, so take care to update it.  We must do this
+        // before we update the shape itself, since the shape is used to match
+        // the original entry in the hash set.
+
+        StackShape original(this);
+        StackShape updated(this);
+        updated.rawGetter = reinterpret_cast<GetterOp>(postGetter);
+        updated.rawSetter = reinterpret_cast<SetterOp>(postSetter);
+
         KidsHash* kh = parent->kids.toHash();
-        MOZ_ASSERT(!kh->lookup(StackShape(this)));
-        MOZ_ALWAYS_TRUE(kh->putNew(StackShape(this), this));
+        MOZ_ALWAYS_TRUE(kh->rekeyAs(original, updated, this));
     }
+
+    asAccessorShape().getterObj = postGetter;
+    asAccessorShape().setterObj = postSetter;
+
+    MOZ_ASSERT_IF(parent && !parent->inDictionary() && parent->kids.isHash(),
+                  parent->kids.toHash()->has(StackShape(this)));
 }
 
 #ifdef DEBUG
diff --git a/js/src/moz.build b/js/src/moz.build
index fb709990a6..9043ff3238 100644
--- a/js/src/moz.build
+++ b/js/src/moz.build
@@ -551,8 +551,8 @@ if CONFIG['JS_HAS_CTYPES']:
         'ctypes/Library.cpp',
     ]
     if not CONFIG['MOZ_NATIVE_FFI']:
-        GENERATED_INCLUDES += [
-            'ctypes/libffi/include',
+        LOCAL_INCLUDES += [
+            '!ctypes/libffi/include',
         ]
 
 if CONFIG['MOZ_VTUNE']:
diff --git a/js/src/proxy/Proxy.cpp b/js/src/proxy/Proxy.cpp
index 55ede8c021..6ae8b0abb2 100644
--- a/js/src/proxy/Proxy.cpp
+++ b/js/src/proxy/Proxy.cpp
@@ -610,7 +610,7 @@ ProxyObject::trace(JSTracer* trc, JSObject* obj)
 
 #ifdef DEBUG
     if (trc->runtime()->gc.isStrictProxyCheckingEnabled() && proxy->is<WrapperObject>()) {
-        JSObject* referent = MaybeForwarded(&proxy->private_().toObject());
+        JSObject* referent = MaybeForwarded(proxy->target());
         if (referent->compartment() != proxy->compartment()) {
             /*
              * Assert that this proxy is tracked in the wrapper map. We maintain
diff --git a/js/src/shell/moz.build b/js/src/shell/moz.build
index be315c60bb..bb35df206c 100644
--- a/js/src/shell/moz.build
+++ b/js/src/shell/moz.build
@@ -24,8 +24,10 @@ if CONFIG['_MSC_VER']:
     # for PGO.
     NO_PGO = True
 
-LOCAL_INCLUDES += ['..']
-GENERATED_INCLUDES += ['..']
+LOCAL_INCLUDES += [
+    '!..',
+    '..',
+]
 
 OS_LIBS += CONFIG['EDITLINE_LIBS']
 OS_LIBS += CONFIG['MOZ_ZLIB_LIBS']
diff --git a/js/src/vm/ObjectGroup.cpp b/js/src/vm/ObjectGroup.cpp
index 978139cf24..506d284800 100644
--- a/js/src/vm/ObjectGroup.cpp
+++ b/js/src/vm/ObjectGroup.cpp
@@ -1435,8 +1435,10 @@ ObjectGroup::allocationSiteGroup(JSContext* cx, JSScript* script, jsbytecode* pc
             cx->recoverFromOutOfMemory();
     }
 
-    if (!table->add(p, key, res))
+    if (!table->add(p, key, res)) {
+        ReportOutOfMemory(cx);
         return nullptr;
+    }
 
     return res;
 }
diff --git a/js/src/vm/SavedFrame.h b/js/src/vm/SavedFrame.h
index df050453e3..b1b22d299b 100644
--- a/js/src/vm/SavedFrame.h
+++ b/js/src/vm/SavedFrame.h
@@ -7,12 +7,15 @@
 #ifndef vm_SavedFrame_h
 #define vm_SavedFrame_h
 
+#include "jswrapper.h"
+
 #include "js/UbiNode.h"
 
 namespace js {
 
 class SavedFrame : public NativeObject {
     friend class SavedStacks;
+    friend struct ::JSStructuredCloneReader;
 
   public:
     static const Class          class_;
@@ -120,6 +123,12 @@ class SavedFrame : public NativeObject {
                !obj.as<SavedFrame>().getReservedSlot(JSSLOT_SOURCE).isNull();
     }
 
+    static bool isSavedFrameOrWrapperAndNotProto(JSObject& obj) {
+        auto unwrapped = CheckedUnwrap(&obj);
+        MOZ_ASSERT(unwrapped);
+        return isSavedFrameAndNotProto(*unwrapped);
+    }
+
     struct Lookup;
     struct HashPolicy;
 
@@ -142,8 +151,17 @@ class SavedFrame : public NativeObject {
     };
 
   private:
+    static SavedFrame* create(JSContext* cx);
     static bool finishSavedFrameInit(JSContext* cx, HandleObject ctor, HandleObject proto);
     void initFromLookup(HandleLookup lookup);
+    void initSource(JSAtom* source);
+    void initLine(uint32_t line);
+    void initColumn(uint32_t column);
+    void initFunctionDisplayName(JSAtom* maybeName);
+    void initAsyncCause(JSAtom* maybeCause);
+    void initParent(SavedFrame* maybeParent);
+    void initPrincipalsAlreadyHeld(JSPrincipals* principals);
+    void initPrincipals(JSPrincipals* principals);
 
     enum {
         // The reserved slots in the SavedFrame class.
diff --git a/js/src/vm/SavedStacks-inl.h b/js/src/vm/SavedStacks-inl.h
index 768c228aca..dd05760b4e 100644
--- a/js/src/vm/SavedStacks-inl.h
+++ b/js/src/vm/SavedStacks-inl.h
@@ -22,13 +22,7 @@
 inline void
 js::AssertObjectIsSavedFrameOrWrapper(JSContext* cx, HandleObject stack)
 {
-#ifdef DEBUG
-    if (stack) {
-        RootedObject savedFrameObj(cx, CheckedUnwrap(stack));
-        MOZ_ASSERT(savedFrameObj);
-        MOZ_ASSERT(js::SavedFrame::isSavedFrameAndNotProto(*savedFrameObj));
-    }
-#endif
+    MOZ_ASSERT_IF(stack, js::SavedFrame::isSavedFrameOrWrapperAndNotProto(*stack));
 }
 
 #endif // vm_SavedStacksInl_h
diff --git a/js/src/vm/SavedStacks.cpp b/js/src/vm/SavedStacks.cpp
index da5aca9991..99ca2085e6 100644
--- a/js/src/vm/SavedStacks.cpp
+++ b/js/src/vm/SavedStacks.cpp
@@ -403,29 +403,91 @@ SavedFrame::getPrincipals()
     return static_cast<JSPrincipals*>(v.toPrivate());
 }
 
+void
+SavedFrame::initSource(JSAtom* source)
+{
+    MOZ_ASSERT(source);
+    initReservedSlot(JSSLOT_SOURCE, StringValue(source));
+}
+
+void
+SavedFrame::initLine(uint32_t line)
+{
+    initReservedSlot(JSSLOT_LINE, PrivateUint32Value(line));
+}
+
+void
+SavedFrame::initColumn(uint32_t column)
+{
+    initReservedSlot(JSSLOT_COLUMN, PrivateUint32Value(column));
+}
+
+void
+SavedFrame::initPrincipals(JSPrincipals* principals)
+{
+    if (principals)
+        JS_HoldPrincipals(principals);
+    initPrincipalsAlreadyHeld(principals);
+}
+
+void
+SavedFrame::initPrincipalsAlreadyHeld(JSPrincipals* principals)
+{
+    MOZ_ASSERT_IF(principals, principals->refcount > 0);
+    initReservedSlot(JSSLOT_PRINCIPALS, PrivateValue(principals));
+}
+
+void
+SavedFrame::initFunctionDisplayName(JSAtom* maybeName)
+{
+    initReservedSlot(JSSLOT_FUNCTIONDISPLAYNAME, maybeName ? StringValue(maybeName) : NullValue());
+}
+
+void
+SavedFrame::initAsyncCause(JSAtom* maybeCause)
+{
+    initReservedSlot(JSSLOT_ASYNCCAUSE, maybeCause ? StringValue(maybeCause) : NullValue());
+}
+
+void
+SavedFrame::initParent(SavedFrame* maybeParent)
+{
+    initReservedSlot(JSSLOT_PARENT, ObjectOrNullValue(maybeParent));
+}
+
 void
 SavedFrame::initFromLookup(SavedFrame::HandleLookup lookup)
 {
-    MOZ_ASSERT(lookup->source);
-    MOZ_ASSERT(getReservedSlot(JSSLOT_SOURCE).isUndefined());
-    setReservedSlot(JSSLOT_SOURCE, StringValue(lookup->source));
+    initSource(lookup->source);
+    initLine(lookup->line);
+    initColumn(lookup->column);
+    initFunctionDisplayName(lookup->functionDisplayName);
+    initAsyncCause(lookup->asyncCause);
+    initParent(lookup->parent);
+    initPrincipals(lookup->principals);
+}
 
-    setReservedSlot(JSSLOT_LINE, PrivateUint32Value(lookup->line));
-    setReservedSlot(JSSLOT_COLUMN, PrivateUint32Value(lookup->column));
-    setReservedSlot(JSSLOT_FUNCTIONDISPLAYNAME,
-                    lookup->functionDisplayName
-                        ? StringValue(lookup->functionDisplayName)
-                        : NullValue());
-    setReservedSlot(JSSLOT_ASYNCCAUSE,
-                    lookup->asyncCause
-                        ? StringValue(lookup->asyncCause)
-                        : NullValue());
-    setReservedSlot(JSSLOT_PARENT, ObjectOrNullValue(lookup->parent));
+/* static */ SavedFrame*
+SavedFrame::create(JSContext* cx)
+{
+    RootedGlobalObject global(cx, cx->global());
+    assertSameCompartment(cx, global);
 
-    MOZ_ASSERT(getReservedSlot(JSSLOT_PRINCIPALS).isUndefined());
-    if (lookup->principals)
-        JS_HoldPrincipals(lookup->principals);
-    setReservedSlot(JSSLOT_PRINCIPALS, PrivateValue(lookup->principals));
+    // Ensure that we don't try to capture the stack again in the
+    // `SavedStacksMetadataCallback` for this new SavedFrame object, and
+    // accidentally cause O(n^2) behavior.
+    SavedStacks::AutoReentrancyGuard guard(cx->compartment()->savedStacks());
+
+    RootedNativeObject proto(cx, GlobalObject::getOrCreateSavedFramePrototype(cx, global));
+    if (!proto)
+        return nullptr;
+    assertSameCompartment(cx, proto);
+
+    RootedObject frameObj(cx, NewObjectWithGivenProto(cx, &SavedFrame::class_, proto));
+    if (!frameObj)
+        return nullptr;
+
+    return &frameObj->as<SavedFrame>();
 }
 
 bool
@@ -1252,30 +1314,15 @@ SavedStacks::getOrCreateSavedFrame(JSContext* cx, SavedFrame::HandleLookup looku
 SavedFrame*
 SavedStacks::createFrameFromLookup(JSContext* cx, SavedFrame::HandleLookup lookup)
 {
-    RootedGlobalObject global(cx, cx->global());
-    assertSameCompartment(cx, global);
-
-    // Ensure that we don't try to capture the stack again in the
-    // `SavedStacksMetadataCallback` for this new SavedFrame object, and
-    // accidentally cause O(n^2) behavior.
-    SavedStacks::AutoReentrancyGuard guard(*this);
-
-    RootedNativeObject proto(cx, GlobalObject::getOrCreateSavedFramePrototype(cx, global));
-    if (!proto)
+    RootedSavedFrame frame(cx, SavedFrame::create(cx));
+    if (!frame)
         return nullptr;
-    assertSameCompartment(cx, proto);
+    frame->initFromLookup(lookup);
 
-    RootedObject frameObj(cx, NewObjectWithGivenProto(cx, &SavedFrame::class_, proto));
-    if (!frameObj)
+    if (!FreezeObject(cx, frame))
         return nullptr;
 
-    RootedSavedFrame f(cx, &frameObj->as<SavedFrame>());
-    f->initFromLookup(lookup);
-
-    if (!FreezeObject(cx, frameObj))
-        return nullptr;
-
-    return f.get();
+    return frame;
 }
 
 /*
diff --git a/js/src/vm/SavedStacks.h b/js/src/vm/SavedStacks.h
index 851d6b0768..2ad0a48c2c 100644
--- a/js/src/vm/SavedStacks.h
+++ b/js/src/vm/SavedStacks.h
@@ -146,6 +146,7 @@ namespace js {
 // principals.
 
 class SavedStacks {
+    friend class SavedFrame;
     friend JSObject* SavedStacksMetadataCallback(JSContext* cx, JSObject* target);
     friend bool JS::ubi::ConstructSavedFrameStackSlow(JSContext* cx,
                                                       JS::ubi::StackFrame& ubiFrame,
diff --git a/js/src/vm/SelfHosting.cpp b/js/src/vm/SelfHosting.cpp
index a00f8158bb..2e855b89e8 100644
--- a/js/src/vm/SelfHosting.cpp
+++ b/js/src/vm/SelfHosting.cpp
@@ -2086,11 +2086,18 @@ static JSObject*
 CloneObject(JSContext* cx, HandleNativeObject selfHostedObject)
 {
 #ifdef DEBUG
-    AutoCycleDetector detect(cx, selfHostedObject);
-    if (!detect.init())
-        return nullptr;
-    if (detect.foundCycle())
-        MOZ_CRASH("SelfHosted cloning cannot handle cyclic object graphs.");
+    // Object hash identities are owned by the hashed object, which may be on a
+    // different thread than the clone target. In theory, these objects are all
+    // tenured and will not be compacted; however, we simply avoid the issue
+    // altogether by skipping the cycle-detection when off the main thread.
+    Maybe<AutoCycleDetector> detect;
+    if (js::CurrentThreadCanAccessZone(selfHostedObject->zoneFromAnyThread())) {
+        detect.emplace(cx, selfHostedObject);
+        if (!detect->init())
+            return nullptr;
+        if (detect->foundCycle())
+            MOZ_CRASH("SelfHosted cloning cannot handle cyclic object graphs.");
+    }
 #endif
 
     RootedObject clone(cx);
diff --git a/js/src/vm/Stack.cpp b/js/src/vm/Stack.cpp
index 6b8bda0f1a..bd666acaf2 100644
--- a/js/src/vm/Stack.cpp
+++ b/js/src/vm/Stack.cpp
@@ -851,6 +851,21 @@ FrameIter::copyDataAsAbstractFramePtr() const
     return frame;
 }
 
+void*
+FrameIter::rawFramePtr() const
+{
+    switch (data_.state_) {
+      case DONE:
+      case ASMJS:
+        return nullptr;
+      case JIT:
+        return data_.jitFrames_.fp();
+      case INTERP:
+        return interpFrame();
+    }
+    MOZ_CRASH("Unexpected state");
+}
+
 JSCompartment*
 FrameIter::compartment() const
 {
diff --git a/js/src/vm/Stack.h b/js/src/vm/Stack.h
index b89f8a4ce7..8dd05a12e4 100644
--- a/js/src/vm/Stack.h
+++ b/js/src/vm/Stack.h
@@ -2041,6 +2041,9 @@ class FrameIter
     // This can only be called when isPhysicalIonFrame():
     inline jit::CommonFrameLayout* physicalIonFrame() const;
 
+    // This is used to provide a raw interface for debugging.
+    void* rawFramePtr() const;
+
   private:
     Data data_;
     jit::InlineFrameIterator ionInlineFrames_;
diff --git a/js/src/vm/StructuredClone.cpp b/js/src/vm/StructuredClone.cpp
index 2e2d3d2c32..462b06a67f 100644
--- a/js/src/vm/StructuredClone.cpp
+++ b/js/src/vm/StructuredClone.cpp
@@ -43,6 +43,7 @@
 #include "builtin/MapObject.h"
 #include "js/Date.h"
 #include "js/TraceableHashTable.h"
+#include "vm/SavedFrame.h"
 #include "vm/SharedArrayObject.h"
 #include "vm/TypedArrayObject.h"
 #include "vm/WrapperObject.h"
@@ -93,6 +94,12 @@ enum StructuredDataType : uint32_t {
     SCTAG_END_OF_KEYS,
     SCTAG_SHARED_TYPED_ARRAY_OBJECT,
     SCTAG_DATA_VIEW_OBJECT,
+    SCTAG_SAVED_FRAME_OBJECT,
+
+    SCTAG_JSPRINCIPALS,
+    SCTAG_NULL_JSPRINCIPALS,
+    SCTAG_RECONSTRUCTED_SAVED_FRAME_PRINCIPALS_IS_SYSTEM,
+    SCTAG_RECONSTRUCTED_SAVED_FRAME_PRINCIPALS_IS_NOT_SYSTEM,
 
     SCTAG_TYPED_ARRAY_V1_MIN = 0xFFFF0100,
     SCTAG_TYPED_ARRAY_V1_INT8 = SCTAG_TYPED_ARRAY_V1_MIN + Scalar::Int8,
@@ -244,6 +251,7 @@ struct JSStructuredCloneReader {
     bool readSharedTypedArray(uint32_t arrayType, uint32_t nelems, MutableHandleValue vp);
     bool readArrayBuffer(uint32_t nbytes, MutableHandleValue vp);
     bool readV1ArrayBuffer(uint32_t arrayType, uint32_t nelems, MutableHandleValue vp);
+    JSObject* readSavedFrame(uint32_t principalsTag);
     bool startRead(MutableHandleValue vp);
 
     SCInput& in;
@@ -306,6 +314,7 @@ struct JSStructuredCloneWriter {
     bool traverseObject(HandleObject obj);
     bool traverseMap(HandleObject obj);
     bool traverseSet(HandleObject obj);
+    bool traverseSavedFrame(HandleObject obj);
 
     bool parseTransferable();
     bool reportErrorTransferable(uint32_t errorId);
@@ -325,9 +334,10 @@ struct JSStructuredCloneWriter {
     // counts.length() == objs.length() and sum(counts) == entries.length().
     Vector<size_t> counts;
 
-    // For JSObject: Propery IDs as value
-    // For Map: Key followed by value.
+    // For JSObject: Property IDs as value
+    // For Map: Key followed by value
     // For Set: Key
+    // For SavedFrame: parent SavedFrame
     AutoValueVector entries;
 
     // The "memory" list described in the HTML5 internal structured cloning algorithm.
@@ -1045,6 +1055,103 @@ JSStructuredCloneWriter::traverseSet(HandleObject obj)
     return out.writePair(SCTAG_SET_OBJECT, 0);
 }
 
+// Objects are written as a "preorder" traversal of the object graph: object
+// "headers" (the class tag and any data needed for initial construction) are
+// visited first, then the children are recursed through (where children are
+// properties, Set or Map entries, etc.). So for example
+//
+//     m = new Map();
+//     m.set(key1 = {}, value1 = {})
+//
+// would be stored as
+//
+//     <Map tag>
+//     <key1 class tag>
+//     <value1 class tag>
+//     <end-of-children marker for key1>
+//     <end-of-children marker for value1>
+//     <end-of-children marker for Map>
+//
+// Notice how the end-of-children marker for key1 is sandwiched between the
+// value1 beginning and end.
+bool
+JSStructuredCloneWriter::traverseSavedFrame(HandleObject obj)
+{
+    RootedObject unwrapped(context(), js::CheckedUnwrap(obj));
+    MOZ_ASSERT(unwrapped && unwrapped->is<SavedFrame>());
+
+    RootedSavedFrame savedFrame(context(), &unwrapped->as<SavedFrame>());
+
+    RootedObject parent(context(), savedFrame->getParent());
+    if (!context()->compartment()->wrap(context(), &parent))
+        return false;
+
+    if (!objs.append(ObjectValue(*obj)) ||
+        !entries.append(parent ? ObjectValue(*parent) : NullValue()) ||
+        !counts.append(1))
+    {
+        return false;
+    }
+
+    checkStack();
+
+    // Write the SavedFrame tag and the SavedFrame's principals.
+
+    if (savedFrame->getPrincipals() == &ReconstructedSavedFramePrincipals::IsSystem) {
+        if (!out.writePair(SCTAG_SAVED_FRAME_OBJECT,
+                           SCTAG_RECONSTRUCTED_SAVED_FRAME_PRINCIPALS_IS_SYSTEM))
+        {
+            return false;
+        };
+    } else if (savedFrame->getPrincipals() == &ReconstructedSavedFramePrincipals::IsNotSystem) {
+        if (!out.writePair(SCTAG_SAVED_FRAME_OBJECT,
+                           SCTAG_RECONSTRUCTED_SAVED_FRAME_PRINCIPALS_IS_NOT_SYSTEM))
+        {
+            return false;
+        }
+    } else {
+        if (auto principals = savedFrame->getPrincipals()) {
+            if (!out.writePair(SCTAG_SAVED_FRAME_OBJECT, SCTAG_JSPRINCIPALS) ||
+                !principals->write(context(), this))
+            {
+                return false;
+            }
+        } else {
+            if (!out.writePair(SCTAG_SAVED_FRAME_OBJECT, SCTAG_NULL_JSPRINCIPALS))
+                return false;
+        }
+    }
+
+    // Write the SavedFrame's reserved slots, except for the parent, which is
+    // queued on objs for further traversal.
+
+    RootedValue val(context());
+
+    val = StringValue(savedFrame->getSource());
+    if (!startWrite(val))
+        return false;
+
+    val = NumberValue(savedFrame->getLine());
+    if (!startWrite(val))
+        return false;
+
+    val = NumberValue(savedFrame->getColumn());
+    if (!startWrite(val))
+        return false;
+
+    auto name = savedFrame->getFunctionDisplayName();
+    val = name ? StringValue(name) : NullValue();
+    if (!startWrite(val))
+        return false;
+
+    auto cause = savedFrame->getAsyncCause();
+    val = cause ? StringValue(cause) : NullValue();
+    if (!startWrite(val))
+        return false;
+
+    return true;
+}
+
 bool
 JSStructuredCloneWriter::startWrite(HandleValue v)
 {
@@ -1119,6 +1226,8 @@ JSStructuredCloneWriter::startWrite(HandleValue v)
             return traverseMap(obj);
         } else if (cls == ESClass_Set) {
             return traverseSet(obj);
+        } else if (SavedFrame::isSavedFrameOrWrapperAndNotProto(*obj)) {
+            return traverseSavedFrame(obj);
         }
 
         if (callbacks && callbacks->write)
@@ -1284,7 +1393,7 @@ JSStructuredCloneWriter::write(HandleValue v)
 
                 if (!startWrite(key) || !startWrite(val))
                     return false;
-            } else if (cls == ESClass_Set) {
+            } else if (cls == ESClass_Set || SavedFrame::isSavedFrameOrWrapperAndNotProto(*obj)) {
                 if (!startWrite(key))
                     return false;
             } else {
@@ -1816,6 +1925,14 @@ JSStructuredCloneReader::startRead(MutableHandleValue vp)
         break;
       }
 
+      case SCTAG_SAVED_FRAME_OBJECT: {
+        auto obj = readSavedFrame(data);
+        if (!obj || !objs.append(ObjectValue(*obj)))
+            return false;
+        vp.setObject(*obj);
+        break;
+      }
+
       default: {
         if (tag <= SCTAG_FLOAT_MAX) {
             double d = ReinterpretPairAsDouble(tag, data);
@@ -1933,16 +2050,99 @@ JSStructuredCloneReader::readTransferMap()
     return true;
 }
 
+JSObject*
+JSStructuredCloneReader::readSavedFrame(uint32_t principalsTag)
+{
+    RootedSavedFrame savedFrame(context(), SavedFrame::create(context()));
+    if (!savedFrame)
+        return nullptr;
+
+    JSPrincipals* principals;
+    if (principalsTag == SCTAG_JSPRINCIPALS) {
+        if (!context()->runtime()->readPrincipals) {
+            JS_ReportErrorNumber(context(), GetErrorMessage, nullptr,
+                                 JSMSG_SC_UNSUPPORTED_TYPE);
+            return nullptr;
+        }
+
+        if (!context()->runtime()->readPrincipals(context(), this, &principals))
+            return nullptr;
+    } else if (principalsTag == SCTAG_RECONSTRUCTED_SAVED_FRAME_PRINCIPALS_IS_SYSTEM) {
+        principals = &ReconstructedSavedFramePrincipals::IsSystem;
+        principals->refcount++;
+    } else if (principalsTag == SCTAG_RECONSTRUCTED_SAVED_FRAME_PRINCIPALS_IS_NOT_SYSTEM) {
+        principals = &ReconstructedSavedFramePrincipals::IsNotSystem;
+        principals->refcount++;
+    } else if (principalsTag == SCTAG_NULL_JSPRINCIPALS) {
+        principals = nullptr;
+    } else {
+        JS_ReportErrorNumber(context(), GetErrorMessage, nullptr,
+                             JSMSG_SC_BAD_SERIALIZED_DATA, "bad SavedFrame principals");
+        return nullptr;
+    }
+    savedFrame->initPrincipalsAlreadyHeld(principals);
+
+    RootedValue source(context());
+    if (!startRead(&source) || !source.isString())
+        return nullptr;
+    auto atomSource = AtomizeString(context(), source.toString());
+    if (!atomSource)
+        return nullptr;
+    savedFrame->initSource(atomSource);
+
+    RootedValue lineVal(context());
+    uint32_t line;
+    if (!startRead(&lineVal) || !lineVal.isNumber() || !ToUint32(context(), lineVal, &line))
+        return nullptr;
+    savedFrame->initLine(line);
+
+    RootedValue columnVal(context());
+    uint32_t column;
+    if (!startRead(&columnVal) || !columnVal.isNumber() || !ToUint32(context(), columnVal, &column))
+        return nullptr;
+    savedFrame->initColumn(column);
+
+    RootedValue name(context());
+    if (!startRead(&name) || !(name.isString() || name.isNull()))
+        return nullptr;
+    JSAtom* atomName = nullptr;
+    if (name.isString()) {
+        atomName = AtomizeString(context(), name.toString());
+        if (!atomName)
+            return nullptr;
+    }
+    savedFrame->initFunctionDisplayName(atomName);
+
+    RootedValue cause(context());
+    if (!startRead(&cause) || !(cause.isString() || cause.isNull()))
+        return nullptr;
+    JSAtom* atomCause = nullptr;
+    if (cause.isString()) {
+        atomCause = AtomizeString(context(), cause.toString());
+        if (!atomCause)
+            return nullptr;
+    }
+    savedFrame->initAsyncCause(atomCause);
+
+    return savedFrame;
+}
+
+// Perform the whole recursive reading procedure.
 bool
 JSStructuredCloneReader::read(MutableHandleValue vp)
 {
     if (!readTransferMap())
         return false;
 
+    // Start out by reading in the main object and pushing it onto the 'objs'
+    // stack. The data related to this object and its descendants extends from
+    // here to the SCTAG_END_OF_KEYS at the end of the stream.
     if (!startRead(vp))
         return false;
 
+    // Stop when the stack shows that all objects have been read.
     while (objs.length() != 0) {
+        // What happens depends on the top obj on the objs stack.
         RootedObject obj(context(), &objs.back().toObject());
 
         uint32_t tag, data;
@@ -1950,36 +2150,76 @@ JSStructuredCloneReader::read(MutableHandleValue vp)
             return false;
 
         if (tag == SCTAG_END_OF_KEYS) {
+            // Pop the current obj off the stack, since we are done with it and
+            // its children.
             MOZ_ALWAYS_TRUE(in.readPair(&tag, &data));
             objs.popBack();
             continue;
         }
 
+        // The input stream contains a sequence of "child" values, whose
+        // interpretation depends on the type of obj. These values can be
+        // anything, and startRead() will push onto 'objs' for any non-leaf
+        // value (i.e., anything that may contain children).
+        //
+        // startRead() will allocate the (empty) object, but note that when
+        // startRead() returns, 'key' is not yet initialized with any of its
+        // properties. Those will be filled in by returning to the head of this
+        // loop, processing the first child obj, and continuing until all
+        // children have been fully created.
+        //
+        // Note that this means the ordering in the stream is a little funky
+        // for things like Map. See the comment above startWrite() for an
+        // example.
         RootedValue key(context());
         if (!startRead(&key))
             return false;
 
-        if (key.isNull() && !(obj->is<MapObject>() || obj->is<SetObject>())) {
-            // Backwards compatibility: Null used to indicate
-            // the end of object properties.
+        if (key.isNull() &&
+            !(obj->is<MapObject>() || obj->is<SetObject>() || obj->is<SavedFrame>()))
+        {
+            // Backwards compatibility: Null formerly indicated the end of
+            // object properties.
             objs.popBack();
             continue;
         }
 
+        // Set object: the values between obj header (from startRead()) and
+        // SCTAG_END_OF_KEYS are all interpreted as values to add to the set.
         if (obj->is<SetObject>()) {
             if (!SetObject::add(context(), obj, key))
                 return false;
             continue;
         }
 
+        // SavedFrame object: there is one following value, the parent
+        // SavedFrame, which is either null or another SavedFrame object.
+        if (obj->is<SavedFrame>()) {
+            SavedFrame* parentFrame;
+            if (key.isNull())
+                parentFrame = nullptr;
+            else if (key.isObject() && key.toObject().is<SavedFrame>())
+                parentFrame = &key.toObject().as<SavedFrame>();
+            else
+                return false;
+
+            obj->as<SavedFrame>().initParent(parentFrame);
+            continue;
+        }
+
+        // Everything else uses a series of key,value,key,value,... Value
+        // objects.
         RootedValue val(context());
         if (!startRead(&val))
             return false;
 
         if (obj->is<MapObject>()) {
+            // For a Map, store those <key,value> pairs in the contained map
+            // data structure.
             if (!MapObject::set(context(), obj, key, val))
                 return false;
         } else {
+            // For any other Object, interpret them as plain properties.
             RootedId id(context());
             if (!ValueToId<CanGC>(context(), key, &id))
                 return false;
diff --git a/layout/base/FrameLayerBuilder.cpp b/layout/base/FrameLayerBuilder.cpp
index 44e0103180..ede3ad091c 100644
--- a/layout/base/FrameLayerBuilder.cpp
+++ b/layout/base/FrameLayerBuilder.cpp
@@ -22,6 +22,7 @@
 #include "UnitTransforms.h"
 #include "Units.h"
 #include "gfx2DGlue.h"
+#include "gfxEnv.h"
 #include "gfxUtils.h"
 #include "nsDisplayList.h"
 #include "nsDocShell.h"
@@ -3653,7 +3654,7 @@ PaintInactiveLayer(nsDisplayListBuilder* aBuilder,
     aItem->GetVisibleRect().ToOutsidePixels(appUnitsPerDevPixel);
 
   RefPtr<DrawTarget> tempDT;
-  if (gfxUtils::sDumpPainting) {
+  if (gfxEnv::DumpPaint()) {
     tempDT = gfxPlatform::GetPlatform()->CreateOffscreenContentDrawTarget(
                                       itemVisibleRect.Size(),
                                       SurfaceFormat::B8G8R8A8);
@@ -3683,7 +3684,7 @@ PaintInactiveLayer(nsDisplayListBuilder* aBuilder,
   basic->SetTarget(nullptr);
 
 #ifdef MOZ_DUMP_PAINTING
-  if (gfxUtils::sDumpPainting && tempDT) {
+  if (gfxEnv::DumpPaint() && tempDT) {
     RefPtr<SourceSurface> surface = tempDT->Snapshot();
     DumpPaintedImage(aItem, surface);
 
@@ -4503,10 +4504,10 @@ FrameLayerBuilder::AddPaintedDisplayItem(PaintedLayerData* aLayerData,
       tempManager->AbortTransaction();
 
 #ifdef MOZ_DUMP_PAINTING
-      if (gfxUtils::DumpDisplayList() || gfxUtils::sDumpPainting) {
+      if (gfxUtils::DumpDisplayList() || gfxEnv::DumpPaint()) {
         fprintf_stderr(gfxUtils::sDumpPaintFile, "Basic layer tree for painting contents of display item %s(%p):\n", aItem->Name(), aItem->Frame());
         std::stringstream stream;
-        tempManager->Dump(stream, "", gfxUtils::sDumpPaintingToFile);
+        tempManager->Dump(stream, "", gfxEnv::DumpPaintToFile());
         fprint_stderr(gfxUtils::sDumpPaintFile, stream);  // not a typo, fprint_stderr declared in LayersLogging.h
       }
 #endif
@@ -5717,7 +5718,7 @@ FrameLayerBuilder::PaintItems(nsTArray<ClippedDisplayItem>& aItems,
       nsIFrame* frame = cdi->mItem->Frame();
       frame->AddStateBits(NS_FRAME_PAINTED_THEBES);
 #ifdef MOZ_DUMP_PAINTING
-      if (gfxUtils::sDumpPaintItems) {
+      if (gfxEnv::DumpPaintItems()) {
         DebugPaintItem(aDrawTarget, aPresContext, cdi->mItem, aBuilder);
       } else {
 #else
diff --git a/layout/base/Units.h b/layout/base/Units.h
index 13e9970927..5945a8609c 100644
--- a/layout/base/Units.h
+++ b/layout/base/Units.h
@@ -10,11 +10,11 @@
 #include "mozilla/gfx/Coord.h"
 #include "mozilla/gfx/Point.h"
 #include "mozilla/gfx/Rect.h"
-#include "mozilla/gfx/RegionTyped.h"
 #include "mozilla/gfx/ScaleFactor.h"
 #include "mozilla/gfx/ScaleFactors2D.h"
-#include "nsRect.h"
 #include "nsMargin.h"
+#include "nsRect.h"
+#include "nsRegion.h"
 #include "mozilla/AppUnits.h"
 #include "mozilla/TypeTraits.h"
 
@@ -289,6 +289,11 @@ struct LayoutDevicePixel {
       NSAppUnitsToIntPixels(aSize.height, aAppUnitsPerDevPixel));
   }
 
+  static nsPoint ToAppUnits(const LayoutDeviceIntPoint& aPoint, nscoord aAppUnitsPerDevPixel) {
+    return nsPoint(aPoint.x * aAppUnitsPerDevPixel,
+                   aPoint.y * aAppUnitsPerDevPixel);
+  }
+
   static nsSize ToAppUnits(const LayoutDeviceIntSize& aSize, nscoord aAppUnitsPerDevPixel) {
     return nsSize(aSize.width * aAppUnitsPerDevPixel,
                   aSize.height * aAppUnitsPerDevPixel);
diff --git a/layout/base/gtest/TestAccessibleCaretEventHub.cpp b/layout/base/gtest/TestAccessibleCaretEventHub.cpp
index d2dcee143c..e725c51771 100644
--- a/layout/base/gtest/TestAccessibleCaretEventHub.cpp
+++ b/layout/base/gtest/TestAccessibleCaretEventHub.cpp
@@ -150,7 +150,7 @@ public:
     auto event = MakeUnique<WidgetTouchEvent>(true, aMessage, nullptr);
     int32_t identifier = 0;
     LayoutDeviceIntPoint point(aX, aY);
-    nsIntPoint radius(19, 19);
+    LayoutDeviceIntPoint radius(19, 19);
     float rotationAngle = 0;
     float force = 1;
 
diff --git a/layout/base/nsIPresShell.h b/layout/base/nsIPresShell.h
index f260cd8afa..7513521c86 100644
--- a/layout/base/nsIPresShell.h
+++ b/layout/base/nsIPresShell.h
@@ -36,6 +36,7 @@
 #include "nsCompatibility.h"
 #include "nsFrameManagerBase.h"
 #include "nsRect.h"
+#include "nsRegionFwd.h"
 #include "mozFlushType.h"
 #include "nsWeakReference.h"
 #include <stdio.h> // for FILE definition
@@ -69,7 +70,6 @@ class nsFrameManager;
 class nsILayoutHistoryState;
 class nsIReflowCallback;
 class nsIDOMNode;
-class nsIntRegion;
 class nsIStyleSheet;
 class nsCSSFrameConstructor;
 class nsISelection;
diff --git a/layout/base/nsLayoutDebugger.cpp b/layout/base/nsLayoutDebugger.cpp
index c7aa8bac6b..99e2ba8262 100644
--- a/layout/base/nsLayoutDebugger.cpp
+++ b/layout/base/nsLayoutDebugger.cpp
@@ -234,6 +234,14 @@ PrintDisplayItemTo(nsDisplayListBuilder* aBuilder, nsDisplayItem* aItem,
   }
 #endif
   aStream << "\n";
+#ifdef MOZ_DUMP_PAINTING
+  if (aDumpHtml && aItem->Painted()) {
+    nsCString string(aItem->Name());
+    string.Append('-');
+    string.AppendInt((uint64_t)aItem);
+    aStream << nsPrintfCString("<br><img id=\"%s\">\n", string.BeginReading());
+  }
+#endif
 
   if (aDumpSublist && list) {
     PrintDisplayListTo(aBuilder, *list, aStream, aIndent+1, aDumpHtml);
diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp
index 7c6e3dda59..0eb8058874 100644
--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@@ -71,6 +71,7 @@
 #include "mozilla/dom/Element.h"
 #include "nsCanvasFrame.h"
 #include "gfxDrawable.h"
+#include "gfxEnv.h"
 #include "gfxUtils.h"
 #include "nsDataHashtable.h"
 #include "nsTextFrame.h"
@@ -132,6 +133,7 @@ using namespace mozilla::gfx;
 #define STICKY_ENABLED_PREF_NAME "layout.css.sticky.enabled"
 #define DISPLAY_CONTENTS_ENABLED_PREF_NAME "layout.css.display-contents.enabled"
 #define TEXT_ALIGN_UNSAFE_ENABLED_PREF_NAME "layout.css.text-align-unsafe-value.enabled"
+#define FLOAT_LOGICAL_VALUES_ENABLED_PREF_NAME "layout.css.float-logical-values.enabled"
 
 #ifdef DEBUG
 // TODO: remove, see bug 598468.
@@ -381,6 +383,61 @@ TextAlignUnsafeEnabledPrefChangeCallback(const char* aPrefName, void* aClosure)
     isTextAlignUnsafeEnabled ? eCSSKeyword_unsafe : eCSSKeyword_UNKNOWN;
 }
 
+// When the pref "layout.css.float-logical-values.enabled" changes, this
+// function is called to let us update kFloatKTable & kClearKTable,
+// to selectively disable or restore the entries for logical values
+// (inline-start and inline-end) in those tables.
+static void
+FloatLogicalValuesEnabledPrefChangeCallback(const char* aPrefName,
+                                            void* aClosure)
+{
+  NS_ASSERTION(strcmp(aPrefName, FLOAT_LOGICAL_VALUES_ENABLED_PREF_NAME) == 0,
+               "Did you misspell " FLOAT_LOGICAL_VALUES_ENABLED_PREF_NAME " ?");
+
+  static bool sIsInitialized;
+  static int32_t sIndexOfInlineStartInFloatTable;
+  static int32_t sIndexOfInlineEndInFloatTable;
+  static int32_t sIndexOfInlineStartInClearTable;
+  static int32_t sIndexOfInlineEndInClearTable;
+  bool isFloatLogicalValuesEnabled =
+    Preferences::GetBool(FLOAT_LOGICAL_VALUES_ENABLED_PREF_NAME, false);
+
+  if (!sIsInitialized) {
+    // First run: find the position of "inline-start" in kFloatKTable.
+    sIndexOfInlineStartInFloatTable =
+      nsCSSProps::FindIndexOfKeyword(eCSSKeyword_inline_start,
+                                     nsCSSProps::kFloatKTable);
+    // First run: find the position of "inline-end" in kFloatKTable.
+    sIndexOfInlineEndInFloatTable =
+      nsCSSProps::FindIndexOfKeyword(eCSSKeyword_inline_end,
+                                     nsCSSProps::kFloatKTable);
+    // First run: find the position of "inline-start" in kClearKTable.
+    sIndexOfInlineStartInClearTable =
+      nsCSSProps::FindIndexOfKeyword(eCSSKeyword_inline_start,
+                                     nsCSSProps::kClearKTable);
+    // First run: find the position of "inline-end" in kClearKTable.
+    sIndexOfInlineEndInClearTable =
+      nsCSSProps::FindIndexOfKeyword(eCSSKeyword_inline_end,
+                                     nsCSSProps::kClearKTable);
+    sIsInitialized = true;
+  }
+
+  // OK -- now, stomp on or restore the logical entries in the keyword tables,
+  // depending on whether the pref is enabled vs. disabled.
+  MOZ_ASSERT(sIndexOfInlineStartInFloatTable >= 0);
+  nsCSSProps::kFloatKTable[sIndexOfInlineStartInFloatTable] =
+    isFloatLogicalValuesEnabled ? eCSSKeyword_inline_start : eCSSKeyword_UNKNOWN;
+  MOZ_ASSERT(sIndexOfInlineEndInFloatTable >= 0);
+  nsCSSProps::kFloatKTable[sIndexOfInlineEndInFloatTable] =
+    isFloatLogicalValuesEnabled ? eCSSKeyword_inline_end : eCSSKeyword_UNKNOWN;
+  MOZ_ASSERT(sIndexOfInlineStartInClearTable >= 0);
+  nsCSSProps::kClearKTable[sIndexOfInlineStartInClearTable] =
+    isFloatLogicalValuesEnabled ? eCSSKeyword_inline_start : eCSSKeyword_UNKNOWN;
+  MOZ_ASSERT(sIndexOfInlineEndInClearTable >= 0);
+  nsCSSProps::kClearKTable[sIndexOfInlineEndInClearTable] =
+    isFloatLogicalValuesEnabled ? eCSSKeyword_inline_end : eCSSKeyword_UNKNOWN;
+}
+
 bool
 nsLayoutUtils::HasAnimationsForCompositor(const nsIFrame* aFrame,
                                           nsCSSProperty aProperty)
@@ -930,80 +987,74 @@ GetDisplayPortFromMarginsData(nsIContent* aContent,
   nsRect expandedScrollableRect =
     nsLayoutUtils::CalculateExpandedScrollableRect(frame);
 
-  if (gfxPrefs::LayersTilesEnabled()) {
-    // Note on the correctness of applying the alignment in Screen space:
-    //   The correct space to apply the alignment in would be Layer space, but
-    //   we don't necessarily know the scale to convert to Layer space at this
-    //   point because Layout may not yet have chosen the resolution at which to
-    //   render (it chooses that in FrameLayerBuilder, but this can be called
-    //   during display list building). Therefore, we perform the alignment in
-    //   Screen space, which basically assumes that Layout chose to render at
-    //   screen resolution; since this is what Layout does most of the time,
-    //   this is a good approximation. A proper solution would involve moving
-    //   the choosing of the resolution to display-list building time.
-    int alignmentX = gfxPlatform::GetPlatform()->GetTileWidth();
-    int alignmentY = gfxPlatform::GetPlatform()->GetTileHeight();
 
+  // Note on the correctness of applying the alignment in Screen space:
+  //   The correct space to apply the alignment in would be Layer space, but
+  //   we don't necessarily know the scale to convert to Layer space at this
+  //   point because Layout may not yet have chosen the resolution at which to
+  //   render (it chooses that in FrameLayerBuilder, but this can be called
+  //   during display list building). Therefore, we perform the alignment in
+  //   Screen space, which basically assumes that Layout chose to render at
+  //   screen resolution; since this is what Layout does most of the time,
+  //   this is a good approximation. A proper solution would involve moving
+  //   the choosing of the resolution to display-list building time.
+  ScreenSize alignment;
+
+  if (gfxPrefs::LayersTilesEnabled()) {
+    alignment = ScreenSize(gfxPlatform::GetPlatform()->GetTileWidth(),
+                           gfxPlatform::GetPlatform()->GetTileHeight());
+  } else {
+    // If we're not drawing with tiles then we need to be careful about not
+    // hitting the max texture size and we only need 1 draw call per layer
+    // so we can align to a smaller multiple.
+    alignment = ScreenSize(128, 128);
+  }
+
+  // Avoid division by zero.
+  if (alignment.width == 0) {
+    alignment.width = 128;
+  }
+  if (alignment.height == 0) {
+    alignment.height = 128;
+  }
+
+  if (gfxPrefs::LayersTilesEnabled()) {
     // Expand the rect by the margins
     screenRect.Inflate(aMarginsData->mMargins);
-
-    // Inflate the rectangle by 1 so that we always push to the next tile
-    // boundary. This is desirable to stop from having a rectangle with a
-    // moving origin occasionally being smaller when it coincidentally lines
-    // up to tile boundaries.
-    screenRect.Inflate(1);
-
-    // Avoid division by zero.
-    if (alignmentX == 0) {
-      alignmentX = 1;
-    }
-    if (alignmentY == 0) {
-      alignmentY = 1;
-    }
-
-    ScreenPoint scrollPosScreen = LayoutDevicePoint::FromAppUnits(scrollPos, auPerDevPixel)
-                                * res;
-
-    screenRect += scrollPosScreen;
-    // Round-out the display port to the nearest alignment (tiles)
-    float x = alignmentX * floor(screenRect.x / alignmentX);
-    float y = alignmentY * floor(screenRect.y / alignmentY);
-    float w = alignmentX * ceil(screenRect.width / alignmentX + 1);
-    float h = alignmentY * ceil(screenRect.height / alignmentY + 1);
-    screenRect = ScreenRect(x, y, w, h);
-    screenRect -= scrollPosScreen;
-
-    ScreenRect screenExpScrollableRect =
-      LayoutDeviceRect::FromAppUnits(expandedScrollableRect,
-                                     auPerDevPixel) * res;
-
-    // Make sure the displayport remains within the scrollable rect.
-    screenRect = screenRect.ForceInside(screenExpScrollableRect - scrollPosScreen);
   } else {
-    nscoord maxSizeInAppUnits = GetMaxDisplayPortSize(aContent);
-    if (maxSizeInAppUnits == nscoord_MAX) {
+    // Calculate the displayport to make sure we fit within the max texture size
+    // when not tiling.
+    nscoord maxSizeAppUnits = GetMaxDisplayPortSize(aContent);
+    if (maxSizeAppUnits == nscoord_MAX) {
       // Pick a safe maximum displayport size for sanity purposes. This is the
       // lowest maximum texture size on tileless-platforms (Windows, D3D10).
-      maxSizeInAppUnits = presContext->DevPixelsToAppUnits(8192);
+      maxSizeAppUnits = presContext->DevPixelsToAppUnits(8192);
     }
 
+    // The alignment code can round up to 3 tiles, we want to make sure
+    // that the displayport can grow by up to 3 tiles without going
+    // over the max texture size.
+    const int MAX_ALIGN_ROUNDING = 3;
+
     // Find the maximum size in screen pixels.
-    int32_t maxSizeInDevPixels = presContext->AppUnitsToDevPixels(maxSizeInAppUnits);
-    int32_t maxWidthInScreenPixels = floor(double(maxSizeInDevPixels) * res.xScale);
-    int32_t maxHeightInScreenPixels = floor(double(maxSizeInDevPixels) * res.yScale);
+    int32_t maxSizeDevPx = presContext->AppUnitsToDevPixels(maxSizeAppUnits);
+    int32_t maxWidthScreenPx = floor(double(maxSizeDevPx) * res.xScale) -
+      MAX_ALIGN_ROUNDING * alignment.width;
+    int32_t maxHeightScreenPx = floor(double(maxSizeDevPx) * res.yScale) -
+      MAX_ALIGN_ROUNDING * alignment.height;
 
     // For each axis, inflate the margins up to the maximum size.
     const ScreenMargin& margins = aMarginsData->mMargins;
-    if (screenRect.height < maxHeightInScreenPixels) {
-      int32_t budget = maxHeightInScreenPixels - screenRect.height;
+    if (screenRect.height < maxHeightScreenPx) {
+      int32_t budget = maxHeightScreenPx - screenRect.height;
 
       float top = std::min(margins.top, float(budget));
       float bottom = std::min(margins.bottom, budget - top);
       screenRect.y -= top;
       screenRect.height += top + bottom;
     }
-    if (screenRect.width < maxWidthInScreenPixels) {
-      int32_t budget = maxWidthInScreenPixels - screenRect.width;
+    if (screenRect.width < maxWidthScreenPx) {
+      int32_t budget = maxWidthScreenPx - screenRect.width;
 
       float left = std::min(margins.left, float(budget));
       float right = std::min(margins.right, budget - left);
@@ -1012,6 +1063,31 @@ GetDisplayPortFromMarginsData(nsIContent* aContent,
     }
   }
 
+  // Inflate the rectangle by 1 so that we always push to the next tile
+  // boundary. This is desirable to stop from having a rectangle with a
+  // moving origin occasionally being smaller when it coincidentally lines
+  // up to tile boundaries.
+  screenRect.Inflate(1);
+
+  ScreenPoint scrollPosScreen = LayoutDevicePoint::FromAppUnits(scrollPos, auPerDevPixel)
+                              * res;
+
+  // Round-out the display port to the nearest alignment (tiles)
+  screenRect += scrollPosScreen;
+  float x = alignment.width * floor(screenRect.x / alignment.width);
+  float y = alignment.height * floor(screenRect.y / alignment.height);
+  float w = alignment.width * ceil(screenRect.width / alignment.width + 1);
+  float h = alignment.height * ceil(screenRect.height / alignment.height + 1);
+  screenRect = ScreenRect(x, y, w, h);
+  screenRect -= scrollPosScreen;
+
+  ScreenRect screenExpScrollableRect =
+    LayoutDeviceRect::FromAppUnits(expandedScrollableRect,
+                                   auPerDevPixel) * res;
+
+  // Make sure the displayport remains within the scrollable rect.
+  screenRect = screenRect.ForceInside(screenExpScrollableRect - scrollPosScreen);
+
   // Convert the aligned rect back into app units.
   nsRect result = LayoutDeviceRect::ToAppUnits(screenRect / res, auPerDevPixel);
 
@@ -3282,7 +3358,7 @@ nsLayoutUtils::PaintFrame(nsRenderingContext* aRenderingContext, nsIFrame* aFram
                                  startBuildDisplayList);
 
   bool profilerNeedsDisplayList = profiler_feature_active("displaylistdump");
-  bool consoleNeedsDisplayList = gfxUtils::DumpDisplayList() || gfxUtils::sDumpPainting;
+  bool consoleNeedsDisplayList = gfxUtils::DumpDisplayList() || gfxEnv::DumpPaint();
 #ifdef MOZ_DUMP_PAINTING
   FILE* savedDumpFile = gfxUtils::sDumpPaintFile;
 #endif
@@ -3291,7 +3367,7 @@ nsLayoutUtils::PaintFrame(nsRenderingContext* aRenderingContext, nsIFrame* aFram
   if (consoleNeedsDisplayList || profilerNeedsDisplayList) {
     ss = MakeUnique<std::stringstream>();
 #ifdef MOZ_DUMP_PAINTING
-    if (gfxUtils::sDumpPaintingToFile) {
+    if (gfxEnv::DumpPaintToFile()) {
       nsCString string("dump-");
       // Include the process ID in the dump file name, to make sure that in an
       // e10s setup different processes don't clobber each other's dump files.
@@ -3305,15 +3381,24 @@ nsLayoutUtils::PaintFrame(nsRenderingContext* aRenderingContext, nsIFrame* aFram
     } else {
       gfxUtils::sDumpPaintFile = stderr;
     }
-    if (gfxUtils::sDumpPaintingToFile) {
-      *ss << "<html><head><script>var array = {}; function ViewImage(index) { window.location = array[index]; }</script></head><body>";
+    if (gfxEnv::DumpPaintToFile()) {
+      *ss << "<html><head><script>\n"
+             "var array = {};\n"
+             "function ViewImage(index) { \n"
+             "  var image = document.getElementById(index);\n"
+             "  if (image.src) {\n"
+             "    image.removeAttribute('src');\n"
+             "  } else {\n"
+             "    image.src = array[index];\n"
+             "  }\n"
+             "}</script></head><body>";
     }
 #endif
     *ss << nsPrintfCString("Painting --- before optimization (dirty %d,%d,%d,%d):\n",
             dirtyRect.x, dirtyRect.y, dirtyRect.width, dirtyRect.height).get();
-    nsFrame::PrintDisplayList(&builder, list, *ss, gfxUtils::sDumpPaintingToFile);
+    nsFrame::PrintDisplayList(&builder, list, *ss, gfxEnv::DumpPaintToFile());
 
-    if (gfxUtils::sDumpPainting || gfxUtils::sDumpPaintItems) {
+    if (gfxEnv::DumpPaint() || gfxEnv::DumpPaintItems()) {
       // Flush stream now to avoid reordering dump output relative to
       // messages dumped by PaintRoot below.
       if (profilerNeedsDisplayList && !consoleNeedsDisplayList) {
@@ -3356,12 +3441,12 @@ nsLayoutUtils::PaintFrame(nsRenderingContext* aRenderingContext, nsIFrame* aFram
 
   if (consoleNeedsDisplayList || profilerNeedsDisplayList) {
     *ss << "Painting --- after optimization:\n";
-    nsFrame::PrintDisplayList(&builder, list, *ss, gfxUtils::sDumpPaintingToFile);
+    nsFrame::PrintDisplayList(&builder, list, *ss, gfxEnv::DumpPaintToFile());
 
     *ss << "Painting --- layer tree:\n";
     if (layerManager) {
       FrameLayerBuilder::DumpRetainedLayerTree(layerManager, *ss,
-                                               gfxUtils::sDumpPaintingToFile);
+                                               gfxEnv::DumpPaintToFile());
     }
 
     if (profilerNeedsDisplayList && !consoleNeedsDisplayList) {
@@ -3372,10 +3457,10 @@ nsLayoutUtils::PaintFrame(nsRenderingContext* aRenderingContext, nsIFrame* aFram
     }
 
 #ifdef MOZ_DUMP_PAINTING
-    if (gfxUtils::sDumpPaintingToFile) {
+    if (gfxEnv::DumpPaintToFile()) {
       *ss << "</body></html>";
     }
-    if (gfxUtils::sDumpPaintingToFile) {
+    if (gfxEnv::DumpPaintToFile()) {
       fclose(gfxUtils::sDumpPaintFile);
     }
     gfxUtils::sDumpPaintFile = savedDumpFile;
@@ -7328,6 +7413,10 @@ nsLayoutUtils::Initialize()
                                            nullptr);
   TextAlignUnsafeEnabledPrefChangeCallback(TEXT_ALIGN_UNSAFE_ENABLED_PREF_NAME,
                                            nullptr);
+  Preferences::RegisterCallback(FloatLogicalValuesEnabledPrefChangeCallback,
+                                FLOAT_LOGICAL_VALUES_ENABLED_PREF_NAME);
+  FloatLogicalValuesEnabledPrefChangeCallback(FLOAT_LOGICAL_VALUES_ENABLED_PREF_NAME,
+                                              nullptr);
 
   nsComputedDOMStyle::RegisterPrefChangeCallbacks();
 }
diff --git a/layout/base/nsRefreshDriver.cpp b/layout/base/nsRefreshDriver.cpp
index a00ad9e1c1..40d245b9c7 100644
--- a/layout/base/nsRefreshDriver.cpp
+++ b/layout/base/nsRefreshDriver.cpp
@@ -312,6 +312,9 @@ private:
     explicit RefreshDriverVsyncObserver(VsyncRefreshDriverTimer* aVsyncRefreshDriverTimer)
       : mVsyncRefreshDriverTimer(aVsyncRefreshDriverTimer)
       , mRefreshTickLock("RefreshTickLock")
+      , mRecentVsync(TimeStamp::Now())
+      , mLastChildTick(TimeStamp::Now())
+      , mVsyncRate(TimeDuration::Forever())
       , mProcessedVsync(true)
     {
       MOZ_ASSERT(NS_IsMainThread());
@@ -355,18 +358,49 @@ private:
       mVsyncRefreshDriverTimer = nullptr;
     }
 
+    void OnTimerStart()
+    {
+      if (!XRE_IsParentProcess()) {
+        mLastChildTick = TimeStamp::Now();
+      }
+    }
+
   private:
     virtual ~RefreshDriverVsyncObserver() {}
 
+    void RecordTelemetryProbes(TimeStamp aVsyncTimestamp)
+    {
+      MOZ_ASSERT(NS_IsMainThread());
+    #ifndef ANDROID  /* bug 1142079 */
+      if (XRE_IsParentProcess()) {
+        TimeDuration vsyncLatency = TimeStamp::Now() - aVsyncTimestamp;
+        Telemetry::Accumulate(Telemetry::FX_REFRESH_DRIVER_CHROME_FRAME_DELAY_MS,
+                              vsyncLatency.ToMilliseconds());
+      } else if (mVsyncRate != TimeDuration::Forever()) {
+        TimeDuration contentDelay = (TimeStamp::Now() - mLastChildTick) - mVsyncRate;
+        Telemetry::Accumulate(Telemetry::FX_REFRESH_DRIVER_CONTENT_FRAME_DELAY_MS,
+                              contentDelay.ToMilliseconds());
+      } else {
+        // Request the vsync rate from the parent process. Might be a few vsyncs
+        // until the parent responds.
+        mVsyncRate = mVsyncRefreshDriverTimer->mVsyncChild->GetVsyncRate();
+      }
+    #endif
+    }
+
     void TickRefreshDriver(TimeStamp aVsyncTimestamp)
     {
       MOZ_ASSERT(NS_IsMainThread());
 
+      RecordTelemetryProbes(aVsyncTimestamp);
       if (XRE_IsParentProcess()) {
         MonitorAutoLock lock(mRefreshTickLock);
         aVsyncTimestamp = mRecentVsync;
         mProcessedVsync = true;
+      } else {
+        mLastChildTick = TimeStamp::Now();
       }
+      MOZ_ASSERT(aVsyncTimestamp <= TimeStamp::Now());
 
       // We might have a problem that we call ~VsyncRefreshDriverTimer() before
       // the scheduled TickRefreshDriver() runs. Check mVsyncRefreshDriverTimer
@@ -382,6 +416,8 @@ private:
     VsyncRefreshDriverTimer* mVsyncRefreshDriverTimer;
     Monitor mRefreshTickLock;
     TimeStamp mRecentVsync;
+    TimeStamp mLastChildTick;
+    TimeDuration mVsyncRate;
     bool mProcessedVsync;
   }; // RefreshDriverVsyncObserver
 
@@ -415,6 +451,7 @@ private:
       mVsyncDispatcher->SetParentRefreshTimer(mVsyncObserver);
     } else {
       Unused << mVsyncChild->SendObserve();
+      mVsyncObserver->OnTimerStart();
     }
   }
 
@@ -450,20 +487,19 @@ private:
   RefPtr<VsyncChild> mVsyncChild;
 }; // VsyncRefreshDriverTimer
 
-/*
- * PreciseRefreshDriverTimer schedules ticks based on the current time
- * and when the next tick -should- be sent if we were hitting our
- * rate.  It always schedules ticks on multiples of aRate -- meaning that
- * if some execution takes longer than an alloted slot, the next tick
- * will be delayed instead of triggering instantly.  This might not be
- * desired -- there's an #if 0'd block below that we could put behind
- * a pref to control this behaviour.
+/**
+ * Since the content process takes some time to setup
+ * the vsync IPC connection, this timer is used
+ * during the intial startup process.
+ * During initial startup, the refresh drivers
+ * are ticked off this timer, and are swapped out once content
+ * vsync IPC connection is established.
  */
-class PreciseRefreshDriverTimer :
+class StartupRefreshDriverTimer :
     public SimpleTimerBasedRefreshDriverTimer
 {
 public:
-  explicit PreciseRefreshDriverTimer(double aRate)
+  explicit StartupRefreshDriverTimer(double aRate)
     : SimpleTimerBasedRefreshDriverTimer(aRate)
   {
   }
@@ -471,176 +507,15 @@ public:
 protected:
   virtual void ScheduleNextTick(TimeStamp aNowTime)
   {
-    // The number of (whole) elapsed intervals between the last target
-    // time and the actual time.  We want to truncate the double down
-    // to an int number of intervals.
-    int numElapsedIntervals = static_cast<int>((aNowTime - mTargetTime) / mRateDuration);
-
-    if (numElapsedIntervals < 0) {
-      // It's possible that numElapsedIntervals is negative (e.g. timer compensation
-      // may result in (aNowTime - mTargetTime) < -1.0/mRateDuration, which will result in
-      // negative numElapsedIntervals), so make sure we don't target the same timestamp.
-      numElapsedIntervals = 0;
-    }
-
-    // the last "tick" that may or may not have been actually sent was
-    // at this time.  For example, if the rate is 15ms, the target
-    // time is 200ms, and it's now 225ms, the last effective tick
-    // would have been at 215ms.  The next one should then be
-    // scheduled for 5 ms from now.
-    //
-    // We then add another mRateDuration to find the next tick target.
-    TimeStamp newTarget = mTargetTime + mRateDuration * (numElapsedIntervals + 1);
-
-    // the amount of (integer) ms until the next time we should tick
+    // Since this is only used for startup, it isn't super critical
+    // that we tick at consistent intervals.
+    TimeStamp newTarget = aNowTime + mRateDuration;
     uint32_t delay = static_cast<uint32_t>((newTarget - aNowTime).ToMilliseconds());
-
-    // Without this block, we'll always schedule on interval ticks;
-    // with it, we'll schedule immediately if we missed our tick target
-    // last time.
-#if 0
-    if (numElapsedIntervals > 0) {
-      // we're late, so reset
-      newTarget = aNowTime;
-      delay = 0;
-    }
-#endif
-
-    // log info & lateness
-    LOG("[%p] precise timer last tick late by %f ms, next tick in %d ms",
-        this,
-        (aNowTime - mTargetTime).ToMilliseconds(),
-        delay);
-#ifndef ANDROID  /* bug 1142079 */
-    Telemetry::Accumulate(Telemetry::FX_REFRESH_DRIVER_FRAME_DELAY_MS, (aNowTime - mTargetTime).ToMilliseconds());
-#endif
-
-    // then schedule the timer
-    LOG("[%p] scheduling callback for %d ms (2)", this, delay);
     mTimer->InitWithFuncCallback(TimerTick, this, delay, nsITimer::TYPE_ONE_SHOT);
-
     mTargetTime = newTarget;
   }
 };
 
-#ifdef XP_WIN
-/*
- * Uses vsync timing on windows with DWM. Falls back dynamically to fixed rate if required.
- */
-class PreciseRefreshDriverTimerWindowsDwmVsync :
-  public PreciseRefreshDriverTimer
-{
-public:
-  // Checks if the vsync API is accessible.
-  static bool IsSupported()
-  {
-    return WinUtils::dwmGetCompositionTimingInfoPtr != nullptr;
-  }
-
-  PreciseRefreshDriverTimerWindowsDwmVsync(double aRate, bool aPreferHwTiming = false)
-    : PreciseRefreshDriverTimer(aRate)
-    , mPreferHwTiming(aPreferHwTiming)
-  {
-  }
-
-protected:
-  // Indicates we should try to adjust to the HW's timing (get rate from the OS or use vsync)
-  // This is typically true if the default refresh-rate value was not modified by the user.
-  bool mPreferHwTiming;
-
-  nsresult GetVBlankInfo(mozilla::TimeStamp &aLastVBlank, mozilla::TimeDuration &aInterval)
-  {
-    MOZ_ASSERT(WinUtils::dwmGetCompositionTimingInfoPtr,
-               "DwmGetCompositionTimingInfoPtr is unavailable (windows vsync)");
-
-    DWM_TIMING_INFO timingInfo;
-    timingInfo.cbSize = sizeof(DWM_TIMING_INFO);
-    HRESULT hr = WinUtils::dwmGetCompositionTimingInfoPtr(0, &timingInfo); // For the desktop window instead of a specific one.
-
-    if (FAILED(hr)) {
-      // This happens first time this is called.
-      return NS_ERROR_NOT_INITIALIZED;
-    }
-
-    LARGE_INTEGER time, freq;
-    ::QueryPerformanceCounter(&time);
-    ::QueryPerformanceFrequency(&freq);
-    aLastVBlank = TimeStamp::Now();
-    double secondsPassed = double(time.QuadPart - timingInfo.qpcVBlank) / double(freq.QuadPart);
-
-    aLastVBlank -= TimeDuration::FromSeconds(secondsPassed);
-    aInterval = TimeDuration::FromSeconds(double(timingInfo.qpcRefreshPeriod) / double(freq.QuadPart));
-
-    return NS_OK;
-  }
-
-  virtual void ScheduleNextTick(TimeStamp aNowTime)
-  {
-    static const TimeDuration kMinSaneInterval = TimeDuration::FromMilliseconds(3); // 330Hz
-    static const TimeDuration kMaxSaneInterval = TimeDuration::FromMilliseconds(44); // 23Hz
-    static const TimeDuration kNegativeMaxSaneInterval = TimeDuration::FromMilliseconds(-44); // Saves conversions for abs interval
-    TimeStamp lastVblank;
-    TimeDuration vblankInterval;
-
-    if (!mPreferHwTiming ||
-        NS_OK != GetVBlankInfo(lastVblank, vblankInterval) ||
-        vblankInterval > kMaxSaneInterval ||
-        vblankInterval < kMinSaneInterval ||
-        (aNowTime - lastVblank) > kMaxSaneInterval ||
-        (aNowTime - lastVblank) < kNegativeMaxSaneInterval) {
-      // Use the default timing without vsync
-      PreciseRefreshDriverTimer::ScheduleNextTick(aNowTime);
-      return;
-    }
-
-    TimeStamp newTarget = lastVblank + vblankInterval; // Base target
-
-    // However, timer callback might return early (or late, but that wouldn't bother us), and vblankInterval
-    // appears to be slightly (~1%) different on each call (probably the OS measuring recent actual interval[s])
-    // and since we don't want to re-target the same vsync, we keep advancing in vblank intervals until we find the
-    // next safe target (next vsync, but not within 10% interval of previous target).
-    // This is typically 0 or 1 iteration:
-    // If we're too early, next vsync would be the one we've already targeted (1 iteration).
-    // If the timer returned late, no iteration will be required.
-
-    const double kSameVsyncThreshold = 0.1;
-    while (newTarget <= mTargetTime + vblankInterval.MultDouble(kSameVsyncThreshold)) {
-      newTarget += vblankInterval;
-    }
-
-    // To make sure we always hit the same "side" of the signal:
-    // round the delay up (by adding 1, since we later floor) and add a little (10% by default).
-    // Note that newTarget doesn't change (and is the next vblank) as a reference when we're back.
-    static const double kDefaultPhaseShiftPercent = 10;
-    static const double phaseShiftFactor = 0.01 *
-      (Preferences::GetInt("layout.frame_rate.vsync.phasePercentage", kDefaultPhaseShiftPercent) % 100);
-
-    double phaseDelay = 1.0 + vblankInterval.ToMilliseconds() * phaseShiftFactor;
-
-    // ms until the next time we should tick
-    double delayMs = (newTarget - aNowTime).ToMilliseconds() + phaseDelay;
-
-    // Make sure the delay is never negative.
-    uint32_t delay = static_cast<uint32_t>(delayMs < 0 ? 0 : delayMs);
-
-    // log info & lateness
-    LOG("[%p] precise dwm-vsync timer last tick late by %f ms, next tick in %d ms",
-        this,
-        (aNowTime - mTargetTime).ToMilliseconds(),
-        delay);
-#ifndef ANDROID  /* bug 1142079 */
-    Telemetry::Accumulate(Telemetry::FX_REFRESH_DRIVER_FRAME_DELAY_MS, (aNowTime - mTargetTime).ToMilliseconds());
-#endif
-
-    // then schedule the timer
-    LOG("[%p] scheduling callback for %d ms (2)", this, delay);
-    mTimer->InitWithFuncCallback(TimerTick, this, delay, nsITimer::TYPE_ONE_SHOT);
-
-    mTargetTime = newTarget;
-  }
-};
-#endif
-
 /*
  * A RefreshDriverTimer for inactive documents.  When a new refresh driver is
  * added, the rate is reset to the base (normally 1s/1fps).  Every time
@@ -854,13 +729,10 @@ CreateVsyncRefreshTimer()
   // ready.
   gfxPrefs::GetSingleton();
 
-  if (!gfxPrefs::VsyncAlignedRefreshDriver()
-        || gfxPlatform::IsInLayoutAsapMode()) {
+  if (gfxPlatform::IsInLayoutAsapMode()) {
     return;
   }
 
-  NS_WARNING("Enabling vsync refresh driver");
-
   if (XRE_IsParentProcess()) {
     // Make sure all vsync systems are ready.
     gfxPlatform::GetPlatform();
@@ -1008,13 +880,8 @@ nsRefreshDriver::ChooseTimer() const
     // Try to use vsync-base refresh timer first for sRegularRateTimer.
     CreateVsyncRefreshTimer();
 
-#ifdef XP_WIN
-    if (!sRegularRateTimer && PreciseRefreshDriverTimerWindowsDwmVsync::IsSupported()) {
-      sRegularRateTimer = new PreciseRefreshDriverTimerWindowsDwmVsync(rate, isDefault);
-    }
-#endif
     if (!sRegularRateTimer) {
-      sRegularRateTimer = new PreciseRefreshDriverTimer(rate);
+      sRegularRateTimer = new StartupRefreshDriverTimer(rate);
     }
   }
   return sRegularRateTimer;
@@ -1350,22 +1217,13 @@ nsRefreshDriver::ObserverCount() const
   return sum;
 }
 
-/* static */ PLDHashOperator
-nsRefreshDriver::StartTableRequestCounter(const uint32_t& aKey,
-                                          ImageStartData* aEntry,
-                                          void* aUserArg)
-{
-  uint32_t *count = static_cast<uint32_t*>(aUserArg);
-  *count += aEntry->mEntries.Count();
-
-  return PL_DHASH_NEXT;
-}
-
 uint32_t
 nsRefreshDriver::ImageRequestCount() const
 {
   uint32_t count = 0;
-  mStartTable.EnumerateRead(nsRefreshDriver::StartTableRequestCounter, &count);
+  for (auto iter = mStartTable.ConstIter(); !iter.Done(); iter.Next()) {
+    count += iter.UserData()->mEntries.Count();
+  }
   return count + mRequests.Count();
 }
 
@@ -1734,9 +1592,10 @@ nsRefreshDriver::Tick(int64_t aNowEpoch, TimeStamp aNowTime)
             presContext->NotifyFontFaceSetOnRefresh();
           }
           NS_RELEASE(shell);
+
+          mNeedToRecomputeVisibility = true;
         }
 
-        mNeedToRecomputeVisibility = true;
 
         if (tracingStyleFlush) {
           profiler_tracing("Paint", "Styles", TRACING_INTERVAL_END);
@@ -1780,9 +1639,9 @@ nsRefreshDriver::Tick(int64_t aNowEpoch, TimeStamp aNowTime)
           presContext->NotifyFontFaceSetOnRefresh();
         }
         NS_RELEASE(shell);
-      }
 
-      mNeedToRecomputeVisibility = true;
+        mNeedToRecomputeVisibility = true;
+      }
 
       if (tracingLayoutFlush) {
         profiler_tracing("Paint", "Reflow", TRACING_INTERVAL_END);
@@ -1812,9 +1671,34 @@ nsRefreshDriver::Tick(int64_t aNowEpoch, TimeStamp aNowTime)
    * for refresh events.
    */
 
-  ImageRequestParameters parms = {aNowTime, previousRefresh, &mRequests};
+  for (auto iter = mStartTable.Iter(); !iter.Done(); iter.Next()) {
+    const uint32_t& delay = iter.Key();
+    ImageStartData* data = iter.UserData();
 
-  mStartTable.EnumerateRead(nsRefreshDriver::StartTableRefresh, &parms);
+    if (data->mStartTime) {
+      TimeStamp& start = *data->mStartTime;
+      TimeDuration prev = previousRefresh - start;
+      TimeDuration curr = aNowTime - start;
+      uint32_t prevMultiple = uint32_t(prev.ToMilliseconds()) / delay;
+
+      // We want to trigger images' refresh if we've just crossed over a
+      // multiple of the first image's start time. If so, set the animation
+      // start time to the nearest multiple of the delay and move all the
+      // images in this table to the main requests table.
+      if (prevMultiple != uint32_t(curr.ToMilliseconds()) / delay) {
+        mozilla::TimeStamp desired =
+          start + TimeDuration::FromMilliseconds(prevMultiple * delay);
+        BeginRefreshingImages(data->mEntries, desired);
+      }
+    } else {
+      // This is the very first time we've drawn images with this time delay.
+      // Set the animation start time to "now" and move all the images in this
+      // table to the main requests table.
+      mozilla::TimeStamp desired = aNowTime;
+      BeginRefreshingImages(data->mEntries, desired);
+      data->mStartTime.emplace(aNowTime);
+    }
+  }
 
   if (mRequests.Count()) {
     // RequestRefresh may run scripts, so it's not safe to directly call it
@@ -1902,56 +1786,22 @@ nsRefreshDriver::Tick(int64_t aNowEpoch, TimeStamp aNowTime)
 
 void
 nsRefreshDriver::BeginRefreshingImages(RequestTable& aEntries,
-                                       ImageRequestParameters* aParms)
+                                       mozilla::TimeStamp aDesired)
 {
   for (auto iter = aEntries.Iter(); !iter.Done(); iter.Next()) {
     auto req = static_cast<imgIRequest*>(iter.Get()->GetKey());
     MOZ_ASSERT(req, "Unable to retrieve the image request");
 
-    aParms->mRequests->PutEntry(req);
+    mRequests.PutEntry(req);
 
     nsCOMPtr<imgIContainer> image;
     if (NS_SUCCEEDED(req->GetImage(getter_AddRefs(image)))) {
-      image->SetAnimationStartTime(aParms->mDesired);
+      image->SetAnimationStartTime(aDesired);
     }
   }
   aEntries.Clear();
 }
 
-/* static */ PLDHashOperator
-nsRefreshDriver::StartTableRefresh(const uint32_t& aDelay,
-                                   ImageStartData* aData,
-                                   void* aUserArg)
-{
-  ImageRequestParameters* parms =
-    static_cast<ImageRequestParameters*> (aUserArg);
-
-  if (aData->mStartTime) {
-    TimeStamp& start = *aData->mStartTime;
-    TimeDuration prev = parms->mPrevious - start;
-    TimeDuration curr = parms->mCurrent - start;
-    uint32_t prevMultiple = static_cast<uint32_t>(prev.ToMilliseconds()) / aDelay;
-
-    // We want to trigger images' refresh if we've just crossed over a multiple
-    // of the first image's start time. If so, set the animation start time to
-    // the nearest multiple of the delay and move all the images in this table
-    // to the main requests table.
-    if (prevMultiple != static_cast<uint32_t>(curr.ToMilliseconds()) / aDelay) {
-      parms->mDesired = start + TimeDuration::FromMilliseconds(prevMultiple * aDelay);
-      BeginRefreshingImages(aData->mEntries, parms);
-    }
-  } else {
-    // This is the very first time we've drawn images with this time delay.
-    // Set the animation start time to "now" and move all the images in this
-    // table to the main requests table.
-    parms->mDesired = parms->mCurrent;
-    BeginRefreshingImages(aData->mEntries, parms);
-    aData->mStartTime.emplace(parms->mCurrent);
-  }
-
-  return PL_DHASH_NEXT;
-}
-
 void
 nsRefreshDriver::Freeze()
 {
diff --git a/layout/base/nsRefreshDriver.h b/layout/base/nsRefreshDriver.h
index 521df8d7a1..1d687d44cd 100644
--- a/layout/base/nsRefreshDriver.h
+++ b/layout/base/nsRefreshDriver.h
@@ -323,12 +323,6 @@ private:
 
   uint32_t ObserverCount() const;
   uint32_t ImageRequestCount() const;
-  static PLDHashOperator StartTableRequestCounter(const uint32_t& aKey,
-                                                  ImageStartData* aEntry,
-                                                  void* aUserArg);
-  static PLDHashOperator StartTableRefresh(const uint32_t& aKey,
-                                           ImageStartData* aEntry,
-                                           void* aUserArg);
   ObserverArray& ArrayFor(mozFlushType aFlushType);
   // Trigger a refresh immediately, if haven't been disconnected or frozen.
   void DoRefresh();
@@ -408,16 +402,8 @@ private:
   nsTArray<nsIDocument*> mThrottledFrameRequestCallbackDocs;
   nsTObserverArray<nsAPostRefreshObserver*> mPostRefreshObservers;
 
-  // Helper struct for processing image requests
-  struct ImageRequestParameters {
-    mozilla::TimeStamp mCurrent;
-    mozilla::TimeStamp mPrevious;
-    RequestTable* mRequests;
-    mozilla::TimeStamp mDesired;
-  };
-
-  static void BeginRefreshingImages(RequestTable& aEntries,
-                                    ImageRequestParameters* aParms);
+  void BeginRefreshingImages(RequestTable& aEntries,
+                             mozilla::TimeStamp aDesired);
 
   friend class mozilla::RefreshDriverTimer;
 
diff --git a/layout/build/nsLayoutCID.h b/layout/build/nsLayoutCID.h
index e48fc281d2..5e7d639b86 100644
--- a/layout/build/nsLayoutCID.h
+++ b/layout/build/nsLayoutCID.h
@@ -82,8 +82,4 @@
 #define SERVICEWORKERMANAGER_CID \
 { 0xc74bde32, 0xbcc7, 0x4840, { 0x84, 0x30, 0xc7, 0x33, 0x35, 0x1b, 0x21, 0x2a } }
 
-// {91f43ef6-8159-457a-ba68-249c3ff7a06a}
-#define SERVICEWORKERPERIODICUPDATER_CID \
-{ 0x91f43ef6, 0x8159, 0x457a, { 0xba, 0x68, 0x24, 0x9c, 0x3f, 0xf7, 0xa0, 0x6a } }
-
 #endif /* nsLayoutCID_h__ */
diff --git a/layout/build/nsLayoutModule.cpp b/layout/build/nsLayoutModule.cpp
index fdf804e8d0..038e05d640 100644
--- a/layout/build/nsLayoutModule.cpp
+++ b/layout/build/nsLayoutModule.cpp
@@ -89,7 +89,6 @@
 #include "mozilla/dom/network/UDPSocketChild.h"
 #include "mozilla/dom/quota/QuotaManager.h"
 #include "mozilla/dom/workers/ServiceWorkerManager.h"
-#include "mozilla/dom/workers/ServiceWorkerPeriodicUpdater.h"
 #include "mozilla/dom/workers/WorkerDebuggerManager.h"
 #include "mozilla/OSFileConstants.h"
 #include "mozilla/Services.h"
@@ -272,7 +271,6 @@ using mozilla::dom::alarm::AlarmHalService;
 using mozilla::dom::power::PowerManagerService;
 using mozilla::dom::quota::QuotaManager;
 using mozilla::dom::workers::ServiceWorkerManager;
-using mozilla::dom::workers::ServiceWorkerPeriodicUpdater;
 using mozilla::dom::workers::WorkerDebuggerManager;
 using mozilla::dom::UDPSocketChild;
 using mozilla::dom::time::TimeService;
@@ -320,8 +318,6 @@ NS_GENERIC_FACTORY_SINGLETON_CONSTRUCTOR(QuotaManager,
                                          QuotaManager::FactoryCreate)
 NS_GENERIC_FACTORY_SINGLETON_CONSTRUCTOR(ServiceWorkerManager,
                                          ServiceWorkerManager::GetInstance)
-NS_GENERIC_FACTORY_SINGLETON_CONSTRUCTOR(ServiceWorkerPeriodicUpdater,
-                                         ServiceWorkerPeriodicUpdater::GetSingleton)
 NS_GENERIC_FACTORY_CONSTRUCTOR(WorkerDebuggerManager)
 
 #ifdef MOZ_WIDGET_GONK
@@ -771,7 +767,6 @@ NS_DEFINE_NAMED_CID(NS_TEXTEDITOR_CID);
 NS_DEFINE_NAMED_CID(DOMREQUEST_SERVICE_CID);
 NS_DEFINE_NAMED_CID(QUOTA_MANAGER_CID);
 NS_DEFINE_NAMED_CID(SERVICEWORKERMANAGER_CID);
-NS_DEFINE_NAMED_CID(SERVICEWORKERPERIODICUPDATER_CID);
 NS_DEFINE_NAMED_CID(WORKERDEBUGGERMANAGER_CID);
 #ifdef MOZ_WIDGET_GONK
 NS_DEFINE_NAMED_CID(SYSTEMWORKERMANAGER_CID);
@@ -1081,7 +1076,6 @@ static const mozilla::Module::CIDEntry kLayoutCIDs[] = {
   { &kDOMREQUEST_SERVICE_CID, false, nullptr, DOMRequestServiceConstructor },
   { &kQUOTA_MANAGER_CID, false, nullptr, QuotaManagerConstructor },
   { &kSERVICEWORKERMANAGER_CID, false, nullptr, ServiceWorkerManagerConstructor },
-  { &kSERVICEWORKERPERIODICUPDATER_CID, false, nullptr, ServiceWorkerPeriodicUpdaterConstructor },
   { &kWORKERDEBUGGERMANAGER_CID, true, nullptr, WorkerDebuggerManagerConstructor },
 #ifdef MOZ_WIDGET_GONK
   { &kSYSTEMWORKERMANAGER_CID, true, nullptr, SystemWorkerManagerConstructor },
@@ -1251,7 +1245,6 @@ static const mozilla::Module::ContractIDEntry kLayoutContracts[] = {
   { DOMREQUEST_SERVICE_CONTRACTID, &kDOMREQUEST_SERVICE_CID },
   { QUOTA_MANAGER_CONTRACTID, &kQUOTA_MANAGER_CID },
   { SERVICEWORKERMANAGER_CONTRACTID, &kSERVICEWORKERMANAGER_CID },
-  { SERVICEWORKERPERIODICUPDATER_CONTRACTID, &kSERVICEWORKERPERIODICUPDATER_CID, Module::MAIN_PROCESS_ONLY },
   { WORKERDEBUGGERMANAGER_CONTRACTID, &kWORKERDEBUGGERMANAGER_CID },
 #ifdef MOZ_WIDGET_GONK
   { SYSTEMWORKERMANAGER_CONTRACTID, &kSYSTEMWORKERMANAGER_CID },
@@ -1367,7 +1360,6 @@ static const mozilla::Module::CategoryEntry kLayoutCategories[] = {
 #endif
   { "profile-after-change", "PresentationDeviceManager", PRESENTATION_DEVICE_MANAGER_CONTRACTID },
   { "profile-after-change", "PresentationService", PRESENTATION_SERVICE_CONTRACTID },
-  { "idle-daily", "ServiceWorker Periodic Updater", SERVICEWORKERPERIODICUPDATER_CONTRACTID },
   { nullptr }
 };
 
diff --git a/layout/generic/nsFrameSetFrame.cpp b/layout/generic/nsFrameSetFrame.cpp
index 33393992ee..b7db1a454f 100644
--- a/layout/generic/nsFrameSetFrame.cpp
+++ b/layout/generic/nsFrameSetFrame.cpp
@@ -178,9 +178,7 @@ nsHTMLFramesetFrame::nsHTMLFramesetFrame(nsStyleContext* aContext)
   : nsContainerFrame(aContext)
 {
   mNumRows             = 0;
-  mRowSizes            = nullptr;
   mNumCols             = 0;
-  mColSizes            = nullptr;
   mEdgeVisibility      = 0;
   mParentFrameborder   = eFrameborder_Yes; // default
   mParentBorderWidth   = -1; // default not set
@@ -193,20 +191,10 @@ nsHTMLFramesetFrame::nsHTMLFramesetFrame(nsStyleContext* aContext)
   mChildCount          = 0;
   mTopLevelFrameset    = nullptr;
   mEdgeColors.Set(NO_COLOR);
-  mVerBorders          = nullptr;
-  mHorBorders          = nullptr;
-  mChildFrameborder    = nullptr;
-  mChildBorderColors   = nullptr;
 }
 
 nsHTMLFramesetFrame::~nsHTMLFramesetFrame()
 {
-  delete[] mRowSizes;
-  delete[] mColSizes;
-  delete[] mVerBorders;
-  delete[] mHorBorders;
-  delete[] mChildFrameborder;
-  delete[] mChildBorderColors;
 }
 
 NS_QUERYFRAME_HEAD(nsHTMLFramesetFrame)
@@ -251,20 +239,20 @@ nsHTMLFramesetFrame::Init(nsIContent*       aContent,
 
   // Maximum value of mNumRows and mNumCols is NS_MAX_FRAMESET_SPEC_COUNT
   PR_STATIC_ASSERT(NS_MAX_FRAMESET_SPEC_COUNT < UINT_MAX / sizeof(nscoord));
-  mRowSizes  = new nscoord[mNumRows];
-  mColSizes  = new nscoord[mNumCols];
+  mRowSizes  = MakeUnique<nscoord[]>(mNumRows);
+  mColSizes  = MakeUnique<nscoord[]>(mNumCols);
 
   // Ensure we can't overflow numCells
   PR_STATIC_ASSERT(NS_MAX_FRAMESET_SPEC_COUNT < INT32_MAX / NS_MAX_FRAMESET_SPEC_COUNT);
   int32_t numCells = mNumRows*mNumCols;
 
   PR_STATIC_ASSERT(NS_MAX_FRAMESET_SPEC_COUNT < UINT_MAX / sizeof(nsHTMLFramesetBorderFrame*));
-  mVerBorders    = new nsHTMLFramesetBorderFrame*[mNumCols];  // 1 more than number of ver borders
+  mVerBorders    = MakeUnique<nsHTMLFramesetBorderFrame*[]>(mNumCols);  // 1 more than number of ver borders
 
   for (int verX  = 0; verX < mNumCols; verX++)
     mVerBorders[verX]    = nullptr;
 
-  mHorBorders    = new nsHTMLFramesetBorderFrame*[mNumRows];  // 1 more than number of hor borders
+  mHorBorders    = MakeUnique<nsHTMLFramesetBorderFrame*[]>(mNumRows);  // 1 more than number of hor borders
 
   for (int horX = 0; horX < mNumRows; horX++)
     mHorBorders[horX]    = nullptr;
@@ -275,8 +263,8 @@ nsHTMLFramesetFrame::Init(nsIContent*       aContent,
                    < UINT_MAX / sizeof(nsFrameborder) / NS_MAX_FRAMESET_SPEC_COUNT);
   PR_STATIC_ASSERT(NS_MAX_FRAMESET_SPEC_COUNT
                    < UINT_MAX / sizeof(nsBorderColor) / NS_MAX_FRAMESET_SPEC_COUNT);
-  mChildFrameborder  = new nsFrameborder[numCells];
-  mChildBorderColors  = new nsBorderColor[numCells];
+  mChildFrameborder  = MakeUnique<nsFrameborder[]>(numCells);
+  mChildBorderColors  = MakeUnique<nsBorderColor[]>(numCells);
 
   // create the children frames; skip content which isn't <frameset> or <frame>
   mChildCount = 0; // number of <frame> or <frameset> children
@@ -443,12 +431,12 @@ void nsHTMLFramesetFrame::CalculateRowCol(nsPresContext*        aPresContext,
 
   int32_t  fixedTotal = 0;
   int32_t  numFixed = 0;
-  nsAutoArrayPtr<int32_t> fixed(new int32_t[aNumSpecs]);
+  auto fixed = MakeUnique<int32_t[]>(aNumSpecs);
   int32_t  numPercent = 0;
-  nsAutoArrayPtr<int32_t> percent(new int32_t[aNumSpecs]);
+  auto percent = MakeUnique<int32_t[]>(aNumSpecs);
   int32_t  relativeSums = 0;
   int32_t  numRelative = 0;
-  nsAutoArrayPtr<int32_t> relative(new int32_t[aNumSpecs]);
+  auto relative = MakeUnique<int32_t[]>(aNumSpecs);
 
   if (MOZ_UNLIKELY(!fixed || !percent || !relative)) {
     return; // NS_ERROR_OUT_OF_MEMORY
@@ -480,7 +468,7 @@ void nsHTMLFramesetFrame::CalculateRowCol(nsPresContext*        aPresContext,
 
   // scale the fixed sizes if they total too much (or too little and there aren't any percent or relative)
   if ((fixedTotal > aSize) || ((fixedTotal < aSize) && (0 == numPercent) && (0 == numRelative))) {
-    Scale(aSize, numFixed, fixed, aNumSpecs, aValues);
+    Scale(aSize, numFixed, fixed.get(), aNumSpecs, aValues);
     return;
   }
 
@@ -495,7 +483,7 @@ void nsHTMLFramesetFrame::CalculateRowCol(nsPresContext*        aPresContext,
 
   // scale the percent sizes if they total too much (or too little and there aren't any relative)
   if ((percentTotal > percentMax) || ((percentTotal < percentMax) && (0 == numRelative))) {
-    Scale(percentMax, numPercent, percent, aNumSpecs, aValues);
+    Scale(percentMax, numPercent, percent.get(), aNumSpecs, aValues);
     return;
   }
 
@@ -510,7 +498,7 @@ void nsHTMLFramesetFrame::CalculateRowCol(nsPresContext*        aPresContext,
 
   // scale the relative sizes if they take up too much or too little
   if (relativeTotal != relativeMax) {
-    Scale(relativeMax, numRelative, relative, aNumSpecs, aValues);
+    Scale(relativeMax, numRelative, relative.get(), aNumSpecs, aValues);
   }
 }
 
@@ -868,13 +856,13 @@ nsHTMLFramesetFrame::Reflow(nsPresContext*           aPresContext,
     return;
   }
 
-  CalculateRowCol(aPresContext, width, mNumCols, colSpecs, mColSizes);
-  CalculateRowCol(aPresContext, height, mNumRows, rowSpecs, mRowSizes);
+  CalculateRowCol(aPresContext, width, mNumCols, colSpecs, mColSizes.get());
+  CalculateRowCol(aPresContext, height, mNumRows, rowSpecs, mRowSizes.get());
 
-  nsAutoArrayPtr<bool>  verBordersVis; // vertical borders visibility
-  nsAutoArrayPtr<nscolor> verBorderColors;
-  nsAutoArrayPtr<bool>  horBordersVis; // horizontal borders visibility
-  nsAutoArrayPtr<nscolor> horBorderColors;
+  UniquePtr<bool[]>  verBordersVis; // vertical borders visibility
+  UniquePtr<nscolor[]> verBorderColors;
+  UniquePtr<bool[]>  horBordersVis; // horizontal borders visibility
+  UniquePtr<nscolor[]> horBorderColors;
   nscolor                 borderColor = GetBorderColor();
   nsFrameborder           frameborder = GetFrameBorder();
 
@@ -884,15 +872,15 @@ nsHTMLFramesetFrame::Reflow(nsPresContext*           aPresContext,
     PR_STATIC_ASSERT(NS_MAX_FRAMESET_SPEC_COUNT < UINT_MAX / sizeof(bool));
     PR_STATIC_ASSERT(NS_MAX_FRAMESET_SPEC_COUNT < UINT_MAX / sizeof(nscolor));
 
-    verBordersVis = new bool[mNumCols];
-    verBorderColors = new nscolor[mNumCols];
+    verBordersVis = MakeUnique<bool[]>(mNumCols);
+    verBorderColors = MakeUnique<nscolor[]>(mNumCols);
     for (int verX  = 0; verX < mNumCols; verX++) {
       verBordersVis[verX] = false;
       verBorderColors[verX] = NO_COLOR;
     }
 
-    horBordersVis = new bool[mNumRows];
-    horBorderColors = new nscolor[mNumRows];
+    horBordersVis = MakeUnique<bool[]>(mNumRows);
+    horBorderColors = MakeUnique<nscolor[]>(mNumRows);
     for (int horX = 0; horX < mNumRows; horX++) {
       horBordersVis[horX] = false;
       horBorderColors[horX] = NO_COLOR;
@@ -1089,11 +1077,8 @@ nsHTMLFramesetFrame::Reflow(nsPresContext*           aPresContext,
       }
     }
 
-    delete[] mChildFrameborder;
-    delete[] mChildBorderColors;
-
-    mChildFrameborder = nullptr;
-    mChildBorderColors = nullptr;
+    mChildFrameborder.reset();
+    mChildBorderColors.reset();
   }
 
   aStatus = NS_FRAME_COMPLETE;
@@ -1285,7 +1270,7 @@ nsHTMLFramesetFrame::MouseDrag(nsPresContext* aPresContext,
       const nsFramesetSpec* colSpecs = nullptr;
       ourContent->GetColSpec(&mNumCols, &colSpecs);
       nsAutoString newColAttr;
-      GenerateRowCol(aPresContext, width, mNumCols, colSpecs, mColSizes,
+      GenerateRowCol(aPresContext, width, mNumCols, colSpecs, mColSizes.get(),
                      newColAttr);
       // Setting the attr will trigger a reflow
       mContent->SetAttr(kNameSpaceID_None, nsGkAtoms::cols, newColAttr, true);
@@ -1308,7 +1293,7 @@ nsHTMLFramesetFrame::MouseDrag(nsPresContext* aPresContext,
       const nsFramesetSpec* rowSpecs = nullptr;
       ourContent->GetRowSpec(&mNumRows, &rowSpecs);
       nsAutoString newRowAttr;
-      GenerateRowCol(aPresContext, height, mNumRows, rowSpecs, mRowSizes,
+      GenerateRowCol(aPresContext, height, mNumRows, rowSpecs, mRowSizes.get(),
                      newRowAttr);
       // Setting the attr will trigger a reflow
       mContent->SetAttr(kNameSpaceID_None, nsGkAtoms::rows, newRowAttr, true);
diff --git a/layout/generic/nsFrameSetFrame.h b/layout/generic/nsFrameSetFrame.h
index 673e1836ce..c7742aaa5b 100644
--- a/layout/generic/nsFrameSetFrame.h
+++ b/layout/generic/nsFrameSetFrame.h
@@ -9,6 +9,7 @@
 #define nsHTMLFrameset_h___
 
 #include "mozilla/Attributes.h"
+#include "mozilla/UniquePtr.h"
 #include "nsContainerFrame.h"
 #include "nsColor.h"
 
@@ -187,16 +188,19 @@ protected:
   
   void SetBorderResize(nsHTMLFramesetBorderFrame* aBorderFrame);
 
+  template<typename T, class D = mozilla::DefaultDelete<T>>
+  using UniquePtr = mozilla::UniquePtr<T, D>;
+
   nsFramesetDrag   mDrag;
   nsBorderColor    mEdgeColors;
   nsHTMLFramesetBorderFrame* mDragger;
   nsHTMLFramesetFrame* mTopLevelFrameset;
-  nsHTMLFramesetBorderFrame** mVerBorders;  // vertical borders
-  nsHTMLFramesetBorderFrame** mHorBorders;  // horizontal borders
-  nsFrameborder*   mChildFrameborder; // the frameborder attr of children
-  nsBorderColor*   mChildBorderColors;
-  nscoord*         mRowSizes;  // currently computed row sizes
-  nscoord*         mColSizes;  // currently computed col sizes
+  UniquePtr<nsHTMLFramesetBorderFrame*[]> mVerBorders;  // vertical borders
+  UniquePtr<nsHTMLFramesetBorderFrame*[]> mHorBorders;  // horizontal borders
+  UniquePtr<nsFrameborder[]> mChildFrameborder; // the frameborder attr of children
+  UniquePtr<nsBorderColor[]> mChildBorderColors;
+  UniquePtr<nscoord[]> mRowSizes;  // currently computed row sizes
+  UniquePtr<nscoord[]> mColSizes;  // currently computed col sizes
   mozilla::LayoutDeviceIntPoint mFirstDragPoint;
   int32_t          mNumRows;
   int32_t          mNumCols;
diff --git a/layout/generic/nsImageMap.cpp b/layout/generic/nsImageMap.cpp
index 88612ca8d7..9f3098208e 100644
--- a/layout/generic/nsImageMap.cpp
+++ b/layout/generic/nsImageMap.cpp
@@ -10,6 +10,7 @@
 #include "mozilla/dom/Element.h"
 #include "mozilla/dom/Event.h" // for nsIDOMEvent::InternalDOMEvent()
 #include "mozilla/gfx/PathHelpers.h"
+#include "mozilla/UniquePtr.h"
 #include "nsString.h"
 #include "nsReadableUtils.h"
 #include "nsPresContext.h"
@@ -46,7 +47,7 @@ public:
   void HasFocus(bool aHasFocus);
 
   nsCOMPtr<nsIContent> mArea;
-  nscoord* mCoords;
+  UniquePtr<nscoord[]> mCoords;
   int32_t mNumCoords;
   bool mHasFocus;
 };
@@ -56,7 +57,6 @@ Area::Area(nsIContent* aArea)
 {
   MOZ_COUNT_CTOR(Area);
   NS_PRECONDITION(mArea, "How did that happen?");
-  mCoords = nullptr;
   mNumCoords = 0;
   mHasFocus = false;
 }
@@ -64,7 +64,6 @@ Area::Area(nsIContent* aArea)
 Area::~Area()
 {
   MOZ_COUNT_DTOR(Area);
-  delete [] mCoords;
 }
 
 #include <stdlib.h>
@@ -105,7 +104,6 @@ void Area::ParseCoords(const nsAString& aSpec)
     char *tptr;
     char *n_str;
     int32_t i, cnt;
-    int32_t *value_list;
 
     /*
      * Nothing in an empty list
@@ -210,7 +208,7 @@ void Area::ParseCoords(const nsAString& aSpec)
     /*
      * Allocate space for the coordinate array.
      */
-    value_list = new nscoord[cnt];
+    UniquePtr<nscoord[]> value_list = MakeUnique<nscoord[]>(cnt);
     if (!value_list)
     {
       free(cp);
@@ -254,7 +252,7 @@ void Area::ParseCoords(const nsAString& aSpec)
     }
 
     mNumCoords = cnt;
-    mCoords = value_list;
+    mCoords = Move(value_list);
 
     free(cp);
   }
diff --git a/layout/inspector/nsFontFaceList.cpp b/layout/inspector/nsFontFaceList.cpp
index 1ee2db0dde..57f7413d6c 100644
--- a/layout/inspector/nsFontFaceList.cpp
+++ b/layout/inspector/nsFontFaceList.cpp
@@ -1,3 +1,5 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
@@ -25,35 +27,22 @@ NS_IMPL_ISUPPORTS(nsFontFaceList, nsIDOMFontFaceList)
 ////////////////////////////////////////////////////////////////////////
 // nsIDOMFontFaceList
 
-struct FindByIndexData {
-  uint32_t mTarget;
-  uint32_t mCurrent;
-  nsIDOMFontFace* mResult;
-};
-
-static PLDHashOperator
-FindByIndex(gfxFontEntry* aKey, nsIDOMFontFace* aData, void* aUserData)
-{
-  FindByIndexData* data = static_cast<FindByIndexData*>(aUserData);
-  if (data->mCurrent == data->mTarget) {
-    data->mResult = aData;
-    return PL_DHASH_STOP;
-  }
-  data->mCurrent++;
-  return PL_DHASH_NEXT;
-}
-
 NS_IMETHODIMP
 nsFontFaceList::Item(uint32_t index, nsIDOMFontFace **_retval)
 {
   NS_ENSURE_TRUE(index < mFontFaces.Count(), NS_ERROR_INVALID_ARG);
-  FindByIndexData userData;
-  userData.mTarget = index;
-  userData.mCurrent = 0;
-  userData.mResult = nullptr;
-  mFontFaces.EnumerateRead(FindByIndex, &userData);
-  NS_ASSERTION(userData.mResult != nullptr, "null entry in nsFontFaceList?");
-  NS_IF_ADDREF(*_retval = userData.mResult);
+
+  uint32_t current = 0;
+  nsIDOMFontFace* result = nullptr;
+  for (auto iter = mFontFaces.Iter(); !iter.Done(); iter.Next()) {
+    if (current == index) {
+      result = iter.UserData();
+      break;
+    }
+    current++;
+  }
+  NS_ASSERTION(result != nullptr, "null entry in nsFontFaceList?");
+  NS_IF_ADDREF(*_retval = result);
   return NS_OK;
 }
 
diff --git a/layout/ipc/PVsync.ipdl b/layout/ipc/PVsync.ipdl
index 0ad8ac0a3a..5d31e34d4c 100644
--- a/layout/ipc/PVsync.ipdl
+++ b/layout/ipc/PVsync.ipdl
@@ -23,10 +23,14 @@ child:
   // Send vsync event from chrome to content process.
   async Notify(TimeStamp aVsyncTimestamp) compress;
 
+  // Send the vsync rate to the content process.
+  async VsyncRate(float aVsyncRate);
+
 parent:
   // Content process use these messages to acquire the vsync event.
   async Observe();
   async Unobserve();
+  async RequestVsyncRate();
 
   // This message is never sent. Each PVsync actor will stay alive as long as
   // its PBackground manager.
diff --git a/layout/ipc/VsyncChild.cpp b/layout/ipc/VsyncChild.cpp
index d42278db8d..45372b89ab 100644
--- a/layout/ipc/VsyncChild.cpp
+++ b/layout/ipc/VsyncChild.cpp
@@ -14,6 +14,7 @@ namespace layout {
 VsyncChild::VsyncChild()
   : mObservingVsync(false)
   , mIsShutdown(false)
+  , mVsyncRate(TimeDuration::Forever())
 {
   MOZ_ASSERT(NS_IsMainThread());
 }
@@ -72,5 +73,22 @@ VsyncChild::SetVsyncObserver(VsyncObserver* aVsyncObserver)
   mObserver = aVsyncObserver;
 }
 
+TimeDuration
+VsyncChild::GetVsyncRate()
+{
+  if (mVsyncRate == TimeDuration::Forever()) {
+    PVsyncChild::SendRequestVsyncRate();
+  }
+
+  return mVsyncRate;
+}
+
+bool
+VsyncChild::RecvVsyncRate(const float& aVsyncRate)
+{
+  mVsyncRate = TimeDuration::FromMilliseconds(aVsyncRate);
+  return true;
+}
+
 } // namespace layout
 } // namespace mozilla
diff --git a/layout/ipc/VsyncChild.h b/layout/ipc/VsyncChild.h
index 118f3620cd..88896d643b 100644
--- a/layout/ipc/VsyncChild.h
+++ b/layout/ipc/VsyncChild.h
@@ -38,12 +38,14 @@ public:
 
   // Bind a VsyncObserver into VsyncChild after ipc channel connected.
   void SetVsyncObserver(VsyncObserver* aVsyncObserver);
+  TimeDuration GetVsyncRate();
 
 private:
   VsyncChild();
   virtual ~VsyncChild();
 
   virtual bool RecvNotify(const TimeStamp& aVsyncTimestamp) override;
+  virtual bool RecvVsyncRate(const float& aVsyncRate) override;
   virtual void ActorDestroy(ActorDestroyReason aActorDestroyReason) override;
 
   bool mObservingVsync;
@@ -51,6 +53,7 @@ private:
 
   // The content side vsync observer.
   RefPtr<VsyncObserver> mObserver;
+  TimeDuration mVsyncRate;
 };
 
 } // namespace layout
diff --git a/layout/ipc/VsyncParent.cpp b/layout/ipc/VsyncParent.cpp
index 6f25eb4a52..7a30b4f823 100644
--- a/layout/ipc/VsyncParent.cpp
+++ b/layout/ipc/VsyncParent.cpp
@@ -72,6 +72,15 @@ VsyncParent::DispatchVsyncEvent(TimeStamp aTimeStamp)
   }
 }
 
+bool
+VsyncParent::RecvRequestVsyncRate()
+{
+  AssertIsOnBackgroundThread();
+  TimeDuration vsyncRate = gfxPlatform::GetPlatform()->GetHardwareVsync()->GetGlobalDisplay().GetVsyncRate();
+  Unused << SendVsyncRate(vsyncRate.ToMilliseconds());
+  return true;
+}
+
 bool
 VsyncParent::RecvObserve()
 {
diff --git a/layout/ipc/VsyncParent.h b/layout/ipc/VsyncParent.h
index 2456378f63..33e96c4c60 100644
--- a/layout/ipc/VsyncParent.h
+++ b/layout/ipc/VsyncParent.h
@@ -36,6 +36,7 @@ private:
   virtual ~VsyncParent();
 
   virtual bool NotifyVsync(TimeStamp aTimeStamp) override;
+  virtual bool RecvRequestVsyncRate() override;
 
   virtual bool RecvObserve() override;
   virtual bool RecvUnobserve() override;
diff --git a/layout/reftests/backgrounds/reftest.list b/layout/reftests/backgrounds/reftest.list
index ba547b4d17..da9c07b788 100644
--- a/layout/reftests/backgrounds/reftest.list
+++ b/layout/reftests/backgrounds/reftest.list
@@ -116,7 +116,7 @@ random-if(OSX==1010) == background-size-monster-rem.html background-size-monster
 # the image aren't the issue, because they're being obscured to avoid sampling
 # algorithm dependencies (at least assuming the sampling algorithm in use
 # doesn't sample too far astray from the boundaries).
-fails-if(supportsRepeatResampling) == background-size-zoom-repeat.html background-size-zoom-repeat-ref.html
+fails == background-size-zoom-repeat.html background-size-zoom-repeat-ref.html
 
 # -moz-default-background-color and -moz-default-color (bug 591341)
 == background-moz-default-background-color.html background-moz-default-background-color-ref.html
diff --git a/layout/reftests/border-image/reftest.list b/layout/reftests/border-image/reftest.list
index cb07f6dbff..67a3aedd4e 100644
--- a/layout/reftests/border-image/reftest.list
+++ b/layout/reftests/border-image/reftest.list
@@ -17,8 +17,8 @@ fuzzy-if(winWidget,1,1) == multicolor-image-2.html multicolor-image-2-ref.html
 != different-h-v-2.html different-h-v-ref.html
 != different-h-v-1.html different-h-v-2.html
 == center-scaling-1.html center-scaling-1-ref.html
-fails-if(Android||B2G) == center-scaling-2.html center-scaling-2-ref.html # Android/B2G: very different scaling (blurriness) on some sides
-fails-if(Android||B2G) == center-scaling-3.html center-scaling-3-ref.html # Android/B2G: very different scaling (blurriness) on some sides
+fails-if(Android||B2G) fails-if(usesRepeatResampling) == center-scaling-2.html center-scaling-2-ref.html # Android/B2G: very different scaling (blurriness) on some sides
+fails-if(Android||B2G) fails-if(usesRepeatResampling) == center-scaling-3.html center-scaling-3-ref.html # Android/B2G: very different scaling (blurriness) on some sides
 == center-scaling-4t.html center-scaling-4t-ref.html
 == center-scaling-4r.html center-scaling-4r-ref.html
 == center-scaling-4b.html center-scaling-4b-ref.html
diff --git a/layout/reftests/bugs/1207326-1.html b/layout/reftests/bugs/1207326-1.html
new file mode 100644
index 0000000000..91dfc0eb1d
--- /dev/null
+++ b/layout/reftests/bugs/1207326-1.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Testcase for bug 1207326</title>
+  <style>
+    .wrap1 {
+      position: absolute;
+      width: 600px;
+      height: 600px;
+      transform: perspective(500px) rotateY(6deg) scale(0.7, 0.7);
+      overflow: hidden;
+    }
+    .wrap2 {
+      position: relative;
+      margin-top: -300px;
+      margin-left: -300px;
+    }
+    .inner {
+      position: relative;
+      height: 100%;
+      background-color: purple;
+      will-change: transform;
+    }
+    .main {
+      overflow: hidden;
+      height: 100px;
+      width: 100px;
+    }
+  </style>
+</head>
+<body>
+  <div class="main">
+    <div class="wrap2">
+      <div class="wrap1">
+        <div class="inner">
+        </div>
+      </div>
+    </div>
+  </div>
+</body>
+</html>
diff --git a/layout/reftests/bugs/reftest.list b/layout/reftests/bugs/reftest.list
index 8f6dc4ccb5..a521624d6b 100644
--- a/layout/reftests/bugs/reftest.list
+++ b/layout/reftests/bugs/reftest.list
@@ -1015,7 +1015,7 @@ skip-if(B2G||Mulet) == 421234-1.html 421234-1-ref.html # Initial mulet triage: p
 == 421436-1b.html 421436-1-ref.html
 == 421632-1.html 421632-1-ref.html
 != 421710-1.html about:blank
-skip-if(B2G||Mulet) fails-if(Android) fails-if(!supportsRepeatResampling) == 421885-1.xml 421885-1-ref.xml # Initial mulet triage: parity with B2G/B2G Desktop
+skip-if(B2G||Mulet) fails-if(Android) fails-if(usesRepeatResampling) == 421885-1.xml 421885-1-ref.xml # Initial mulet triage: parity with B2G/B2G Desktop
 == 421955-1.html 421955-1-ref.html
 skip-if(B2G||Mulet) == 422249-1.html 422249-1-ref.html # Initial mulet triage: parity with B2G/B2G Desktop
 == 422394-1.html 422394-1-ref.html
@@ -1165,13 +1165,13 @@ random == 445004-1.html 445004-1-ref.html # bug 472268
 == 445142-1c.html 445142-1-ref.html
 == 445142-2a.html 445142-2-ref.html
 == 445142-2b.html 445142-2-ref.html
-fails-if(!supportsRepeatResampling) == 446100-1a.html about:blank
-skip-if(B2G||Mulet) fails-if(Android) fails-if(!supportsRepeatResampling) == 446100-1b.html about:blank # Initial mulet triage: parity with B2G/B2G Desktop
-skip-if(B2G||Mulet) fails-if(Android) fails-if(!supportsRepeatResampling) == 446100-1c.html about:blank # Initial mulet triage: parity with B2G/B2G Desktop
-fails-if(!supportsRepeatResampling) == 446100-1d.html about:blank
-== 446100-1e.html about:blank
+fails-if(usesRepeatResampling) == 446100-1a.html about:blank
+skip-if(B2G||Mulet) fails-if(Android) fails-if(usesRepeatResampling) == 446100-1b.html about:blank # Initial mulet triage: parity with B2G/B2G Desktop
+skip-if(B2G||Mulet) fails-if(Android) fails-if(usesRepeatResampling) == 446100-1c.html about:blank # Initial mulet triage: parity with B2G/B2G Desktop
+fails-if(usesRepeatResampling) == 446100-1d.html about:blank
+fails-if(usesRepeatResampling) == 446100-1e.html about:blank
 == 446100-1f.html about:blank
-skip-if(B2G||Mulet) fails-if(Android) fails-if(!supportsRepeatResampling) == 446100-1g.html about:blank # Initial mulet triage: parity with B2G/B2G Desktop
+fails-if(usesRepeatResampling) skip-if(B2G||Mulet) fails-if(Android) == 446100-1g.html about:blank # Initial mulet triage: parity with B2G/B2G Desktop
 == 446100-1h.html about:blank
 skip-if(B2G||Mulet) == 447749-1.html 447749-1-ref.html # Initial mulet triage: parity with B2G/B2G Desktop
 fuzzy(127,2) == 448193.html 448193-ref.html
@@ -1933,4 +1933,5 @@ fuzzy(1,74) fuzzy-if(gtkWidget,6,79) == 1174332-1.html 1174332-1-ref.html
 == 1179078-1.html 1179078-1-ref.html
 == 1179288-1.html 1179288-1-ref.html
 == 1190635-1.html 1190635-1-ref.html
+!= 1207326-1.html about:blank
 == 1209603-1.html 1209603-1-ref.html
diff --git a/layout/reftests/css-blending/mix-blend-mode-dest-alpha-1135271-ref.html b/layout/reftests/css-blending/mix-blend-mode-dest-alpha-1135271-ref.html
new file mode 100644
index 0000000000..e8ff8a6109
--- /dev/null
+++ b/layout/reftests/css-blending/mix-blend-mode-dest-alpha-1135271-ref.html
@@ -0,0 +1,21 @@
+<!DOCTYPE HTML>
+<head>
+  <style>
+    .parent {
+       width: 200px;
+       height: 200px;
+       isolation: isolate;
+    }
+    .child {
+      width: 200px;
+      height: 200px;
+      background: green;
+    }
+  </style>
+</head>
+<body>
+ <div class="parent">
+  <div class="child">
+  </div>
+ </div>
+</body>
diff --git a/layout/reftests/css-blending/mix-blend-mode-dest-alpha-1135271.html b/layout/reftests/css-blending/mix-blend-mode-dest-alpha-1135271.html
new file mode 100644
index 0000000000..f36dfe53fb
--- /dev/null
+++ b/layout/reftests/css-blending/mix-blend-mode-dest-alpha-1135271.html
@@ -0,0 +1,22 @@
+<!DOCTYPE HTML>
+<head>
+  <style>
+    .parent {
+       width: 200px;
+       height: 200px;
+       isolation: isolate;
+    }
+    .child {
+      width: 200px;
+      height: 200px;
+      mix-blend-mode: multiply;
+      background: green;
+    }
+  </style>
+</head>
+<body>
+ <div class="parent">
+  <div class="child">
+  </div>
+ </div>
+</body>
diff --git a/layout/reftests/css-blending/reftest.list b/layout/reftests/css-blending/reftest.list
index b8b536bf00..2764c10570 100644
--- a/layout/reftests/css-blending/reftest.list
+++ b/layout/reftests/css-blending/reftest.list
@@ -47,6 +47,7 @@ pref(layout.css.mix-blend-mode.enabled,true) == mix-blend-mode-child-of-blended-
 
 pref(layout.css.mix-blend-mode.enabled,true) == mix-blend-mode-nested-976533.html mix-blend-mode-nested-976533-ref.html
 pref(layout.css.mix-blend-mode.enabled,true) == mix-blend-mode-culling-1207041.html mix-blend-mode-culling-1207041-ref.html
+pref(layout.css.mix-blend-mode.enabled,true) == mix-blend-mode-dest-alpha-1135271.html mix-blend-mode-dest-alpha-1135271-ref.html
 
 # Test plan 5.3.1 Blending between the background layers and the background color for an element with background-blend-mode
 # Test 9
diff --git a/layout/reftests/floats/reftest.list b/layout/reftests/floats/reftest.list
index 89a6f10526..55fd20ac5f 100644
--- a/layout/reftests/floats/reftest.list
+++ b/layout/reftests/floats/reftest.list
@@ -90,6 +90,11 @@ fuzzy-if(OSX==1010,26,7) == orthogonal-floats-1b.html orthogonal-floats-1-ref.ht
 fuzzy-if(OSX==1010,103,802) fuzzy-if(winWidget,116,700) HTTP(..) == orthogonal-floats-1c.html orthogonal-floats-1-ref.html
 fuzzy-if(OSX==1010,103,802) fuzzy-if(winWidget,116,700) HTTP(..) == orthogonal-floats-1d.html orthogonal-floats-1-ref.html
 
+pref(layout.css.float-logical-values.enabled,true) == logical-float-side-1.html logical-float-side-1-ref.html
+pref(layout.css.float-logical-values.enabled,true) == logical-float-side-2.html logical-float-side-2-ref.html
+pref(layout.css.float-logical-values.enabled,true) == logical-float-side-3.html logical-float-side-3-ref.html
+pref(layout.css.float-logical-values.enabled,true) == logical-float-side-4.html logical-float-side-4-ref.html
+
 == float-in-rtl-slr-1a.html float-in-rtl-slr-1-ref.html
 == float-in-rtl-slr-1b.html float-in-rtl-slr-1-ref.html
 == float-in-rtl-slr-1c.html float-in-rtl-slr-1-ref.html
diff --git a/layout/reftests/font-loading-api/multiple-sets-1-ref.html b/layout/reftests/font-loading-api/multiple-sets-1-ref.html
new file mode 100644
index 0000000000..5a59ff728b
--- /dev/null
+++ b/layout/reftests/font-loading-api/multiple-sets-1-ref.html
@@ -0,0 +1,3 @@
+<!DOCTYPE html>
+<iframe id=a src=multiple-sets-frame-ref.html></iframe>
+<iframe id=b src=multiple-sets-frame-ref.html></iframe>
diff --git a/layout/reftests/font-loading-api/multiple-sets-1.html b/layout/reftests/font-loading-api/multiple-sets-1.html
new file mode 100644
index 0000000000..f52a9d8fb2
--- /dev/null
+++ b/layout/reftests/font-loading-api/multiple-sets-1.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html class=reftest-wait>
+<body onload=step()>
+<iframe id=a src=multiple-sets-frame.html></iframe>
+<iframe id=b src=multiple-sets-frame.html></iframe>
+<script>
+var events = 2;  // wait for load event and MozReftestInvalidate
+
+function step() {
+  if (--events == 0) {
+    var a = document.getElementById("a");
+    var b = document.getElementById("b");
+    var a_win = a.contentWindow;
+    var b_win = b.contentWindow;
+    var a_doc = a.contentDocument;
+    var b_doc = b.contentDocument;
+    var face = new a_win.FontFace("Ahem", "url(../fonts/Ahem.ttf)");
+    a_doc.fonts.add(face);
+    b_doc.fonts.add(face);
+    face.load().then(function() {
+      document.documentElement.className = "";
+    });
+  }
+}
+
+window.addEventListener("MozReftestInvalidate", step, false);
+</script>
diff --git a/layout/reftests/font-loading-api/multiple-sets-frame-ref.html b/layout/reftests/font-loading-api/multiple-sets-frame-ref.html
new file mode 100644
index 0000000000..d8dec9920c
--- /dev/null
+++ b/layout/reftests/font-loading-api/multiple-sets-frame-ref.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<style>
+@font-face {
+  font-family: Ahem;
+  src: url(../fonts/Ahem.ttf);
+}
+</style>
+<p style="font: 16px Ahem">Hello</p>
diff --git a/layout/reftests/font-loading-api/multiple-sets-frame.html b/layout/reftests/font-loading-api/multiple-sets-frame.html
new file mode 100644
index 0000000000..c185959632
--- /dev/null
+++ b/layout/reftests/font-loading-api/multiple-sets-frame.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<p style="font: 16px Ahem">Hello</p>
diff --git a/layout/reftests/font-loading-api/reftest.list b/layout/reftests/font-loading-api/reftest.list
index 18b3980da1..38527c9a22 100644
--- a/layout/reftests/font-loading-api/reftest.list
+++ b/layout/reftests/font-loading-api/reftest.list
@@ -3,6 +3,7 @@ default-preferences pref(layout.css.font-loading-api.enabled,true)
 HTTP(..) == dynamic-insert-1.html dynamic-insert-1-ref.html
 HTTP(..) == dynamic-remove-1.html dynamic-remove-1-ref.html
 HTTP(..) == ex-unit-1.html ../font-face/ex-unit-1-ref.html
+HTTP(..) == multiple-sets-1.html multiple-sets-1-ref.html
 HTTP(..) == name-collision.html ../font-face/name-collision-ref.html
 HTTP(..) == order-1.html ../font-face/order-1-ref.html
 HTTP(..) == src-list-1.html ../font-face/src-list-1-ref.html
diff --git a/layout/reftests/font-matching/italic-oblique-1.html b/layout/reftests/font-matching/italic-oblique-1.html
new file mode 100644
index 0000000000..7df94b51dc
--- /dev/null
+++ b/layout/reftests/font-matching/italic-oblique-1.html
@@ -0,0 +1,31 @@
+<!DOCTYPE HTML>
+<head>
+<title>style matching - italic/oblique</title>
+<link rel="author" title="John Daggett" href="mailto:jdaggett@mozilla.com">
+<link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-style-prop">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-style-matching">
+<link rel="match" href="italic-oblique-ref.html">
+<meta name="flags" content="font matching must distinguish between italic and oblique">
+<style>
+@font-face {
+  font-family: test;
+  src: url(../fonts/markA.woff);
+}
+
+@font-face {
+  font-family: test;
+  src: url(../fonts/markB.woff);
+  font-style: italic;
+}
+
+body { margin: 30px }
+p { margin: 0; font: italic 300% test, serif; }
+</style>
+</head>
+<body>
+<p>BBB</p>
+</body>
+</html>
+
+
diff --git a/layout/reftests/font-matching/italic-oblique-2.html b/layout/reftests/font-matching/italic-oblique-2.html
new file mode 100644
index 0000000000..b3264120d5
--- /dev/null
+++ b/layout/reftests/font-matching/italic-oblique-2.html
@@ -0,0 +1,31 @@
+<!DOCTYPE HTML>
+<head>
+<title>style matching - italic/oblique</title>
+<link rel="author" title="John Daggett" href="mailto:jdaggett@mozilla.com">
+<link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-style-prop">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-style-matching">
+<link rel="match" href="italic-oblique-ref.html">
+<meta name="flags" content="font matching must distinguish between italic and oblique">
+<style>
+@font-face {
+  font-family: test;
+  src: url(../fonts/markA.woff);
+}
+
+@font-face {
+  font-family: test;
+  src: url(../fonts/markC.woff);
+  font-style: oblique;
+}
+
+body { margin: 30px }
+p { margin: 0; font: italic 300% test, serif; }
+</style>
+</head>
+<body>
+<p>CCC</p>
+</body>
+</html>
+
+
diff --git a/layout/reftests/font-matching/italic-oblique-3.html b/layout/reftests/font-matching/italic-oblique-3.html
new file mode 100644
index 0000000000..cf897ae44d
--- /dev/null
+++ b/layout/reftests/font-matching/italic-oblique-3.html
@@ -0,0 +1,37 @@
+<!DOCTYPE HTML>
+<head>
+<title>style matching - italic/oblique</title>
+<link rel="author" title="John Daggett" href="mailto:jdaggett@mozilla.com">
+<link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-style-prop">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-style-matching">
+<link rel="match" href="italic-oblique-ref.html">
+<meta name="flags" content="font matching must distinguish between italic and oblique">
+<style>
+@font-face {
+  font-family: test;
+  src: url(../fonts/markA.woff);
+}
+
+@font-face {
+  font-family: test;
+  src: url(../fonts/markB.woff);
+  font-style: italic;
+}
+
+@font-face {
+  font-family: test;
+  src: url(../fonts/mark2B.woff);
+  font-style: oblique;
+}
+
+body { margin: 30px }
+p { margin: 0; font: italic 300% test, serif; }
+</style>
+</head>
+<body>
+<p>BBB</p>
+</body>
+</html>
+
+
diff --git a/layout/reftests/font-matching/italic-oblique-4.html b/layout/reftests/font-matching/italic-oblique-4.html
new file mode 100644
index 0000000000..2313462c34
--- /dev/null
+++ b/layout/reftests/font-matching/italic-oblique-4.html
@@ -0,0 +1,37 @@
+<!DOCTYPE HTML>
+<head>
+<title>style matching - italic/oblique</title>
+<link rel="author" title="John Daggett" href="mailto:jdaggett@mozilla.com">
+<link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-style-prop">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-style-matching">
+<link rel="match" href="italic-oblique-ref.html">
+<meta name="flags" content="font matching must distinguish between italic and oblique">
+<style>
+@font-face {
+  font-family: test;
+  src: url(../fonts/markA.woff);
+}
+
+@font-face {
+  font-family: test;
+  src: url(../fonts/mark2B.woff);
+  font-style: oblique;
+}
+
+@font-face {
+  font-family: test;
+  src: url(../fonts/markB.woff);
+  font-style: italic;
+}
+
+body { margin: 30px }
+p { margin: 0; font: italic 300% test, serif; }
+</style>
+</head>
+<body>
+<p>BBB</p>
+</body>
+</html>
+
+
diff --git a/layout/reftests/font-matching/italic-oblique-5.html b/layout/reftests/font-matching/italic-oblique-5.html
new file mode 100644
index 0000000000..de1281b0a2
--- /dev/null
+++ b/layout/reftests/font-matching/italic-oblique-5.html
@@ -0,0 +1,37 @@
+<!DOCTYPE HTML>
+<head>
+<title>style matching - italic/oblique</title>
+<link rel="author" title="John Daggett" href="mailto:jdaggett@mozilla.com">
+<link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-style-prop">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-style-matching">
+<link rel="match" href="italic-oblique-ref.html">
+<meta name="flags" content="font matching must distinguish between italic and oblique">
+<style>
+@font-face {
+  font-family: test;
+  src: url(../fonts/markA.woff);
+}
+
+@font-face {
+  font-family: test;
+  src: url(../fonts/mark2B.woff);
+  font-style: italic;
+}
+
+@font-face {
+  font-family: test;
+  src: url(../fonts/markB.woff);
+  font-style: oblique;
+}
+
+body { margin: 30px }
+p { margin: 0; font: oblique 300% test, serif; }
+</style>
+</head>
+<body>
+<p>BBB</p>
+</body>
+</html>
+
+
diff --git a/layout/reftests/font-matching/italic-oblique-6.html b/layout/reftests/font-matching/italic-oblique-6.html
new file mode 100644
index 0000000000..de23a2de9e
--- /dev/null
+++ b/layout/reftests/font-matching/italic-oblique-6.html
@@ -0,0 +1,37 @@
+<!DOCTYPE HTML>
+<head>
+<title>style matching - italic/oblique</title>
+<link rel="author" title="John Daggett" href="mailto:jdaggett@mozilla.com">
+<link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-style-prop">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-style-matching">
+<link rel="match" href="italic-oblique-ref.html">
+<meta name="flags" content="font matching must distinguish between italic and oblique">
+<style>
+@font-face {
+  font-family: test;
+  src: url(../fonts/markA.woff);
+}
+
+@font-face {
+  font-family: test;
+  src: url(../fonts/markB.woff);
+  font-style: italic;
+}
+
+@font-face {
+  font-family: test;
+  src: url(../fonts/markC.woff);
+  font-style: oblique;
+}
+
+body { margin: 30px }
+p { margin: 0; font: oblique 300% test, serif; }
+</style>
+</head>
+<body>
+<p>CCC</p>
+</body>
+</html>
+
+
diff --git a/layout/reftests/font-matching/italic-oblique-7.html b/layout/reftests/font-matching/italic-oblique-7.html
new file mode 100644
index 0000000000..05cc3c45f4
--- /dev/null
+++ b/layout/reftests/font-matching/italic-oblique-7.html
@@ -0,0 +1,37 @@
+<!DOCTYPE HTML>
+<head>
+<title>style matching - italic/oblique</title>
+<link rel="author" title="John Daggett" href="mailto:jdaggett@mozilla.com">
+<link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-style-prop">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-style-matching">
+<link rel="match" href="italic-oblique-ref.html">
+<meta name="flags" content="font matching must distinguish between italic and oblique">
+<style>
+@font-face {
+  font-family: test;
+  src: url(../fonts/markA.woff);
+  font-style: oblique;
+}
+
+@font-face {
+  font-family: test;
+  src: url(../fonts/markB.woff);
+}
+
+@font-face {
+  font-family: test;
+  src: url(../fonts/mark2B.woff);
+  font-style: italic;
+}
+
+body { margin: 30px }
+p { margin: 0; font: oblique 300% test, serif; }
+</style>
+</head>
+<body>
+<p>AAA</p>
+</body>
+</html>
+
+
diff --git a/layout/reftests/font-matching/italic-oblique-8.html b/layout/reftests/font-matching/italic-oblique-8.html
new file mode 100644
index 0000000000..ee4ec956ff
--- /dev/null
+++ b/layout/reftests/font-matching/italic-oblique-8.html
@@ -0,0 +1,43 @@
+<!DOCTYPE HTML>
+<head>
+<title>style matching - italic/oblique</title>
+<link rel="author" title="John Daggett" href="mailto:jdaggett@mozilla.com">
+<link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-style-prop">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-style-matching">
+<link rel="match" href="italic-oblique-ref.html">
+<meta name="flags" content="font matching must distinguish between italic and oblique">
+<style>
+@font-face {
+  font-family: test1;
+  src: url(../fonts/markA.woff);
+}
+
+@font-face {
+  font-family: test2;
+  src: url(../fonts/markB.woff);
+  font-style: italic;
+}
+
+@font-face {
+  font-family: test3;
+  src: url(../fonts/markC.woff);
+  font-style: oblique;
+}
+
+@font-face {
+  font-family: test3;
+  src: url(../fonts/mark2C.woff);
+  font-style: italic;
+}
+
+body { margin: 30px }
+p { margin: 0; font: oblique 300% test1, test2, test3, serif; }
+</style>
+</head>
+<body>
+<p>CCC</p>
+</body>
+</html>
+
+
diff --git a/layout/reftests/font-matching/italic-oblique-9.html b/layout/reftests/font-matching/italic-oblique-9.html
new file mode 100644
index 0000000000..dfc4012fa9
--- /dev/null
+++ b/layout/reftests/font-matching/italic-oblique-9.html
@@ -0,0 +1,43 @@
+<!DOCTYPE HTML>
+<head>
+<title>style matching - italic/oblique</title>
+<link rel="author" title="John Daggett" href="mailto:jdaggett@mozilla.com">
+<link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-style-prop">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-style-matching">
+<link rel="match" href="italic-oblique-ref.html">
+<meta name="flags" content="font matching must distinguish between italic and oblique">
+<style>
+@font-face {
+  font-family: test1;
+  src: url(../fonts/markA.woff);
+}
+
+@font-face {
+  font-family: test2;
+  src: url(../fonts/markC.woff);
+  font-style: italic;
+}
+
+@font-face {
+  font-family: test3;
+  src: url(../fonts/mark2C.woff);
+  font-style: oblique;
+}
+
+@font-face {
+  font-family: test3;
+  src: url(../fonts/mark2A.woff);
+  font-style: italic;
+}
+
+body { margin: 30px }
+p { margin: 0; font: oblique 300% test1, test2, test3, serif; }
+</style>
+</head>
+<body>
+<p>CCC</p>
+</body>
+</html>
+
+
diff --git a/layout/reftests/font-matching/italic-oblique-kinnari-ref.html b/layout/reftests/font-matching/italic-oblique-kinnari-ref.html
new file mode 100644
index 0000000000..4499ebc0b4
--- /dev/null
+++ b/layout/reftests/font-matching/italic-oblique-kinnari-ref.html
@@ -0,0 +1,37 @@
+<!DOCTYPE HTML>
+<head>
+<title>style matching - italic/oblique</title>
+<link rel="author" title="John Daggett" href="mailto:jdaggett@mozilla.com">
+<link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-style-prop">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-style-matching">
+<link rel="match" href="italic-oblique-ref.html">
+<meta name="flags" content="font matching must distinguish between italic and oblique">
+<style>
+@font-face {
+  font-family: test;
+  src: url(../fonts/mark2A.woff);
+  font-style: oblique;
+}
+
+@font-face {
+  font-family: test;
+  src: url(../fonts/markB.woff);
+}
+
+@font-face {
+  font-family: test;
+  src: url(../fonts/markA.woff);
+  font-style: italic;
+}
+
+body { margin: 30px }
+p { margin: 0; font: italic 300% kinnari, test, serif; }
+</style>
+</head>
+<body>
+<p>AAA</p>
+</body>
+</html>
+
+
diff --git a/layout/reftests/font-matching/italic-oblique-kinnari.html b/layout/reftests/font-matching/italic-oblique-kinnari.html
new file mode 100644
index 0000000000..f465d247e4
--- /dev/null
+++ b/layout/reftests/font-matching/italic-oblique-kinnari.html
@@ -0,0 +1,37 @@
+<!DOCTYPE HTML>
+<head>
+<title>style matching - italic/oblique</title>
+<link rel="author" title="John Daggett" href="mailto:jdaggett@mozilla.com">
+<link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-style-prop">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-style-matching">
+<link rel="match" href="italic-oblique-ref.html">
+<meta name="flags" content="font matching must distinguish between italic and oblique">
+<style>
+@font-face {
+  font-family: test;
+  src: url(../fonts/mark2A.woff);
+  font-style: oblique;
+}
+
+@font-face {
+  font-family: test;
+  src: url(../fonts/markB.woff);
+}
+
+@font-face {
+  font-family: test;
+  src: url(../fonts/markA.woff);
+  font-style: italic;
+}
+
+body { margin: 30px }
+p { margin: 0; font: oblique 300% kinnari, test, serif; }
+</style>
+</head>
+<body>
+<p>AAA</p>
+</body>
+</html>
+
+
diff --git a/layout/reftests/font-matching/italic-oblique-ref.html b/layout/reftests/font-matching/italic-oblique-ref.html
new file mode 100644
index 0000000000..8ae9bbc19b
--- /dev/null
+++ b/layout/reftests/font-matching/italic-oblique-ref.html
@@ -0,0 +1,24 @@
+<!DOCTYPE HTML>
+<head>
+<title>style matching - italic/oblique</title>
+<link rel="author" title="John Daggett" href="mailto:jdaggett@mozilla.com">
+<link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-style-prop">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-style-matching">
+<link rel="match" href="italic-oblique-1-ref.html">
+<meta name="flags" content="font matching must distinguish between italic and oblique">
+<style>
+@font-face {
+  font-family: test;
+  src: url(../fonts/markA.woff);
+}
+body { margin: 30px }
+p { margin: 0; font: 300% test, serif; }
+</style>
+</head>
+<body>
+<p>AAA</p>
+</body>
+</html>
+
+
diff --git a/layout/reftests/font-matching/reftest.list b/layout/reftests/font-matching/reftest.list
index d1c1d502c3..f754fc1c52 100644
--- a/layout/reftests/font-matching/reftest.list
+++ b/layout/reftests/font-matching/reftest.list
@@ -97,3 +97,16 @@ skip-if(Mulet) HTTP(..) == font-synthesis-2.html font-synthesis-2-ref.html # MUL
 # Bug 1060791 - support for format 10 cmap in Apple Symbols;
 # relevant fonts not present on other platforms.
 skip-if(!cocoaWidget) HTTP(..) != apple-symbols-1.html apple-symbols-1-notref.html
+
+# distinguish between italic and oblique
+== simple-oblique.html simple-oblique-ref.html
+== italic-oblique-1.html italic-oblique-ref.html
+fuzzy-if(Mulet,103,144) == italic-oblique-2.html italic-oblique-ref.html
+== italic-oblique-3.html italic-oblique-ref.html
+== italic-oblique-4.html italic-oblique-ref.html
+== italic-oblique-5.html italic-oblique-ref.html
+fuzzy-if(Mulet,103,144) == italic-oblique-6.html italic-oblique-ref.html
+== italic-oblique-7.html italic-oblique-ref.html
+fuzzy-if(Mulet,103,144) == italic-oblique-8.html italic-oblique-ref.html
+fuzzy-if(Mulet,103,144) == italic-oblique-9.html italic-oblique-ref.html
+!= italic-oblique-kinnari.html italic-oblique-kinnari-ref.html
diff --git a/layout/reftests/font-matching/simple-oblique-ref.html b/layout/reftests/font-matching/simple-oblique-ref.html
new file mode 100644
index 0000000000..d021f51d02
--- /dev/null
+++ b/layout/reftests/font-matching/simple-oblique-ref.html
@@ -0,0 +1,33 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<title>oblique italic equivalence</title>
+<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+  
+<style type="text/css">
+
+body {
+  margin: 50px;
+  font-size: 300%;
+}
+
+#sans { font-family: sans-serif; }
+#serif { font-family: serif; }
+#mono { font-family: monospace; }
+
+p {
+  margin: 0;
+  font-style: italic;
+  line-height: 1.3em;
+}
+</style>
+
+</head>
+<body>
+
+<p id=sans>UNICORN asteroid</p>
+<p id=serif>UNICORN asteroid</p>
+<p id=mono>UNICORN asteroid</p>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/layout/reftests/font-matching/simple-oblique.html b/layout/reftests/font-matching/simple-oblique.html
new file mode 100644
index 0000000000..cb4671f4d8
--- /dev/null
+++ b/layout/reftests/font-matching/simple-oblique.html
@@ -0,0 +1,33 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<title>oblique italic equivalence</title>
+<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+  
+<style type="text/css">
+
+body {
+  margin: 50px;
+  font-size: 300%;
+}
+
+#sans { font-family: sans-serif; }
+#serif { font-family: serif; }
+#mono { font-family: monospace; }
+
+p {
+  margin: 0;
+  font-style: oblique;
+  line-height: 1.3em;
+}
+</style>
+
+</head>
+<body>
+
+<p id=sans>UNICORN asteroid</p>
+<p id=serif>UNICORN asteroid</p>
+<p id=mono>UNICORN asteroid</p>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/layout/reftests/fonts/mark2A.woff b/layout/reftests/fonts/mark2A.woff
new file mode 100644
index 0000000000..58869bec71
Binary files /dev/null and b/layout/reftests/fonts/mark2A.woff differ
diff --git a/layout/reftests/fonts/mark2B.woff b/layout/reftests/fonts/mark2B.woff
new file mode 100644
index 0000000000..d1319a74c8
Binary files /dev/null and b/layout/reftests/fonts/mark2B.woff differ
diff --git a/layout/reftests/fonts/mark2C.woff b/layout/reftests/fonts/mark2C.woff
new file mode 100644
index 0000000000..d21fd0722c
Binary files /dev/null and b/layout/reftests/fonts/mark2C.woff differ
diff --git a/layout/reftests/fonts/mark2D.woff b/layout/reftests/fonts/mark2D.woff
new file mode 100644
index 0000000000..3d42d6f40c
Binary files /dev/null and b/layout/reftests/fonts/mark2D.woff differ
diff --git a/layout/reftests/image-element/reftest.list b/layout/reftests/image-element/reftest.list
index a55162b4a4..e2a72aafd1 100644
--- a/layout/reftests/image-element/reftest.list
+++ b/layout/reftests/image-element/reftest.list
@@ -18,7 +18,7 @@ fuzzy-if(d2d&&/^Windows\x20NT\x206\.1/.test(http.oscpu),16,90) == element-paint-
 == element-paint-transform-repeated.html element-paint-transform-repeated-ref.html
 fuzzy-if(d2d,255,24) == element-paint-transform-03.html element-paint-transform-03-ref.html
 == element-paint-native-widget.html element-paint-native-widget-ref.html
-fails-if(!supportsRepeatResampling) == element-paint-subimage-sampling-restriction.html about:blank
+fails-if(usesRepeatResampling) == element-paint-subimage-sampling-restriction.html about:blank
 == element-paint-clippath.html element-paint-clippath-ref.html
 == element-paint-sharpness-01a.html element-paint-sharpness-01b.html
 == element-paint-sharpness-01b.html element-paint-sharpness-01c.html
diff --git a/layout/reftests/image/reftest.list b/layout/reftests/image/reftest.list
index 25bc3161fc..c2a2301993 100644
--- a/layout/reftests/image/reftest.list
+++ b/layout/reftests/image/reftest.list
@@ -1,5 +1,5 @@
 fuzzy-if(Android,8,30) == background-image-zoom-1.html background-image-zoom-1-ref.html
-== background-image-zoom-2.html about:blank
+fails-if(usesRepeatResampling) == background-image-zoom-2.html about:blank
 == image-seam-1a.html image-seam-1-ref.html
 == image-seam-1b.html image-seam-1-ref.html
 fuzzy-if(Android,255,154) == image-seam-2.html  image-seam-2-ref.html  # Bug 1128229
diff --git a/layout/reftests/layers/opacity-blending-ref.html b/layout/reftests/layers/opacity-blending-ref.html
new file mode 100644
index 0000000000..533ecef701
--- /dev/null
+++ b/layout/reftests/layers/opacity-blending-ref.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html lang="en">
+<meta charset="utf-8">
+<title>Compositor opacity blending should work correctly (and the same as canvas)</title>
+<html class="reftest-wait">
+<head>
+<script>
+    function load() {
+        var one = document.getElementById("one").getContext("2d");
+
+        one.fillStyle = "rgba(255,0,0,0.5)";
+        one.fillRect(0, 0, 200, 200);
+        one.fillStyle = "rgba(0,255,0,0.5)";
+        one.fillRect(0, 0, 200, 200);
+
+        document.documentElement.removeAttribute("class");
+    }
+</script>
+</head>
+<body onload="load()">
+
+<div style="opacity:0.8">
+    <canvas id="one" style="position:absolute; left:0px;"></canvas>
+</div>
+</body>
+</html>
diff --git a/layout/reftests/layers/opacity-blending.html b/layout/reftests/layers/opacity-blending.html
new file mode 100644
index 0000000000..2b9731f0c0
--- /dev/null
+++ b/layout/reftests/layers/opacity-blending.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html lang="en">
+<meta charset="utf-8">
+<title>Compositor opacity blending should work correctly (and the same as canvas)</title>
+<html class="reftest-wait">
+<head>
+<script>
+    function load() {
+        var one = document.getElementById("one").getContext("2d");
+        var two = document.getElementById("two").getContext("2d");
+
+        one.fillStyle = "rgba(255,0,0,0.5)";
+        one.fillRect(0, 0, 200, 200);
+        two.fillStyle = "rgba(0,255,0,0.5)";
+        two.fillRect(0, 0, 200, 200);
+
+        document.documentElement.removeAttribute("class");
+      }
+</script>
+</head>
+<body onload="load()">
+
+<div style="opacity:0.8">
+    <canvas id="one" style="position:absolute; left:0px;"></canvas>
+    <canvas id="two" style="position:absolute; left:0px;"></canvas>
+</div>
+</body>
+</html>
diff --git a/layout/reftests/layers/reftest.list b/layout/reftests/layers/reftest.list
index a136ad40c8..3c3224e02a 100644
--- a/layout/reftests/layers/reftest.list
+++ b/layout/reftests/layers/reftest.list
@@ -17,3 +17,4 @@ skip-if(!asyncPan) != pull-background-displayport-3.html about:blank # fails wit
 skip-if(!asyncPan) != pull-background-displayport-4.html about:blank # fails with non-overlay scrollbars and event regions due to bug 1148515
 fails skip-if(!asyncPan) != pull-background-displayport-5.html about:blank # bug 1147673
 skip-if(!asyncPan) != pull-background-displayport-6.html about:blank # fails with non-overlay scrollbars and event regions due to bug 1148515
+fuzzy(2,30150) == opacity-blending.html opacity-blending-ref.html
diff --git a/layout/reftests/svg/filters/feDiffuseLighting-1-ref.svg b/layout/reftests/svg/filters/feDiffuseLighting-1-ref.svg
index 9a03386007..efdf453903 100644
--- a/layout/reftests/svg/filters/feDiffuseLighting-1-ref.svg
+++ b/layout/reftests/svg/filters/feDiffuseLighting-1-ref.svg
@@ -3,5 +3,14 @@
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <svg xmlns='http://www.w3.org/2000/svg' xmlns:xlink='http://www.w3.org/1999/xlink'>
-  <image width='100' height='100' xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAGQAAABkCAYAAABw4pVUAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAG6SURBVHhe7d3BbcJAGAXhJYXQg32mCV8p2vRAEb4mREoJe/g2GiTf55/hiRu+jTG+P08fxMAXwhHGn4GCYF+FghQEM4DhtJCCYAYwnBZSEMwAhtNCCoIZwHBaSEEwAxhOCykIZgDDaSEFwQxgOC2kIJgBDGfqQh6Px9j3HTtxLZypQZ7P5ziOYy0DGO3UIPf7fWzbhp24Fs7UIGudbtIWBOtSkIJgBjCcFlIQzACG00IKghnAcFpIQTADGE4LKQhmAMNpIQXBDGA4LaQgmAEMp4UUBDOA4bSQgmAGMJwWUhDMAIbTQgqCGcBwWkhBMAMYTgspCGYAw2khBcEMYDgtpCCYAQynhRQEM4DhtJCCYAYwnBZSEMwAhtNCCoIZwHBaSEEwAxhOCykIZgDDaSEFwQxgOC2kIJgBDKeFFAQzgOG0kIJgBjCcFlIQzACG00IKghnAcFrIfw7yfr/H6/XCTlwL5/bBnfY+9d8/47+ua5znuZYFiHZqEOiuZVH6DcHSFaQgmAEMp4UUBDOA4bSQgmAGMJwWUhDMAIbTQgqCGcBwWkhBMAMYTgspCGYAw2khBcEMYDgtBAvyA+wPEw79WuphAAAAAElFTkSuQmCC"/>
+  <image width='100' height='100'
+         xlink:href="data:image/png;base64,
+iVBORw0KGgoAAAANSUhEUgAAAGQAAABkCAYAAABw4pVUAAAABmJLR0QA/wD/AP+gvaeTAAAACXBI
+WXMAAA7EAAAOxAGVKw4bAAAAB3RJTUUH3wkbDDIilL5aRAAAAB1pVFh0Q29tbWVudAAAAAAAQ3Jl
+YXRlZCB3aXRoIEdJTVBkLmUHAAAA9UlEQVR42u3csRHDIBBFwbPHddADiqmEduhFlSiWelBOSirX
+YFsB49lXAMHf4DIeEXGFpqi1Fk8zzFPOGchsAQEiIEAEBIiAABEQIAIiIEAEBIiAAPmgUkosy2LV
+H3rd+VitNXrvse+7ZWcASSlFSsmqbggQAQEiIAICRECACAgQAQEiIEAERECACAgQAQEiIEAERECA
+CAgQAQEiIEAERECACAgQAQEiIEAERECACAgQAQEiIEAERECACAgQAfnHbv3Z+jzP6L1bdRaQdV1j
+jGHVWUC2bbOoGwJEQIAIiIAAERAgAgJEQIAIiIAAERAg+qrjOOINBcEbJFN4kugAAAAASUVORK5C
+YII="/>
 </svg>
diff --git a/layout/reftests/svg/filters/filter-lighting-region-ref.svg b/layout/reftests/svg/filters/filter-lighting-region-ref.svg
new file mode 100644
index 0000000000..d7337102b7
--- /dev/null
+++ b/layout/reftests/svg/filters/filter-lighting-region-ref.svg
@@ -0,0 +1,11 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg xmlns="http://www.w3.org/2000/svg" width="600px" height="300px">
+
+  <rect x="50" y="50" width="200" height="200" fill="black" />
+
+  <rect x="340" y="40" width="220" height="220" fill="grey" />
+  <rect x="350" y="50" width="200" height="200" fill="white" />
+</svg>
diff --git a/layout/reftests/svg/filters/filter-lighting-region.svg b/layout/reftests/svg/filters/filter-lighting-region.svg
new file mode 100644
index 0000000000..883b6d805d
--- /dev/null
+++ b/layout/reftests/svg/filters/filter-lighting-region.svg
@@ -0,0 +1,30 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg xmlns="http://www.w3.org/2000/svg" width="600px" height="300px">
+  <!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=1203376 -->
+  <defs>
+    <!-- the filter lights are intentionally chosen to fill the entire area with
+         a solid color since we're only testing the extents of the filter region
+    -->
+    <filter id="diffuse" x="-50%" y="-50%" width="200%" height="200%">
+      <!-- gives a black filter region -->
+      <feDiffuseLighting lighting-color="black">
+        <feDistantLight />
+      </feDiffuseLighting>
+    </filter>
+
+    <filter id="specular" x="-50%" y="-50%" width="200%" height="200%">
+      <!-- gives a white filter region -->
+      <feSpecularLighting lighting-color="white" specularConstant="100">
+        <feDistantLight elevation="90"/>
+      </feSpecularLighting>
+    </filter>
+  </defs>
+
+  <rect x="100" y="100" width="100" height="100" filter="url(#diffuse)" />
+
+  <rect x="340" y="40" width="220" height="220" fill="grey" />
+  <rect x="400" y="100" width="100" height="100" filter="url(#specular)" />
+</svg>
diff --git a/layout/reftests/svg/filters/reftest.list b/layout/reftests/svg/filters/reftest.list
index 3a623f22c7..053ae15e2a 100644
--- a/layout/reftests/svg/filters/reftest.list
+++ b/layout/reftests/svg/filters/reftest.list
@@ -109,10 +109,12 @@ fuzzy(2,500) == feDisplacementMap-colour-01.svg feDisplacementMap-colour-01-ref.
 == feTile-large-02.svg feTile-large-02-ref.svg
 == feTile-outside-01.svg feTile-outside-01-ref.svg
 
-fuzzy(1,119) == feDiffuseLighting-1.svg feDiffuseLighting-1-ref.svg
+fuzzy(1,217) == feDiffuseLighting-1.svg feDiffuseLighting-1-ref.svg
 
 fuzzy(2,2659) skip-if(d2d) == feSpecularLighting-1.svg feSpecularLighting-1-ref.svg
 
+== filter-lighting-region.svg filter-lighting-region-ref.svg
+
 == fePointLight-zoomed-page.svg fePointLight-zoomed-page-ref.svg
 
 == feTurbulence-offset.svg feTurbulence-offset-ref.svg
diff --git a/layout/style/CSSVariableResolver.cpp b/layout/style/CSSVariableResolver.cpp
index a79e2b29a6..0d25b747bc 100644
--- a/layout/style/CSSVariableResolver.cpp
+++ b/layout/style/CSSVariableResolver.cpp
@@ -12,6 +12,7 @@
 #include "CSSVariableDeclarations.h"
 #include "CSSVariableValues.h"
 #include "mozilla/PodOperations.h"
+#include "mozilla/UniquePtr.h"
 #include <algorithm>
 
 namespace mozilla {
@@ -25,7 +26,7 @@ class EnumerateVariableReferencesData
 public:
   explicit EnumerateVariableReferencesData(CSSVariableResolver& aResolver)
     : mResolver(aResolver)
-    , mReferences(new bool[aResolver.mVariables.Length()])
+    , mReferences(MakeUnique<bool[]>(aResolver.mVariables.Length()))
   {
   }
 
@@ -66,7 +67,7 @@ private:
   // true, it indicates that the variable we have called
   // EnumerateVariableReferences for has a reference to the variable with
   // that ID.
-  nsAutoArrayPtr<bool> mReferences;
+  const UniquePtr<bool[]> mReferences;
 
   // Whether the variable we have called EnumerateVariableReferences for
   // references a variable that does not exist in the resolver.
diff --git a/layout/style/CounterStyleManager.cpp b/layout/style/CounterStyleManager.cpp
index eb833da2ef..c847afbc67 100644
--- a/layout/style/CounterStyleManager.cpp
+++ b/layout/style/CounterStyleManager.cpp
@@ -1987,25 +1987,17 @@ CounterStyleManager::InitializeBuiltinCounterStyles()
   }
 }
 
-#ifdef DEBUG
-static PLDHashOperator
-CheckRefCount(const nsSubstring& aKey,
-              CounterStyle* aStyle,
-              void* aArg)
-{
-  aStyle->AddRef();
-  auto refcnt = aStyle->Release();
-  NS_ASSERTION(!aStyle->IsDependentStyle() || refcnt == 1,
-               "Counter style is still referenced by other objects.");
-  return PL_DHASH_NEXT;
-}
-#endif
-
 void
 CounterStyleManager::Disconnect()
 {
 #ifdef DEBUG
-  mCacheTable.EnumerateRead(CheckRefCount, nullptr);
+  for (auto iter = mCacheTable.Iter(); !iter.Done(); iter.Next()) {
+    CounterStyle* style = iter.UserData();
+    style->AddRef();
+    auto refcnt = style->Release();
+    NS_ASSERTION(!style->IsDependentStyle() || refcnt == 1,
+                 "Counter style is still referenced by other objects.");
+  }
 #endif
   mCacheTable.Clear();
   mPresContext = nullptr;
@@ -2099,9 +2091,9 @@ InvalidateOldStyle(const nsSubstring& aKey,
     if (aStyle->IsDependentStyle()) {
       if (aStyle->IsCustomStyle()) {
         // Since |aStyle| is being removed from mCacheTable, it won't be visited
-        // by our post-removal InvalidateDependentData() traversal. So, we have
-        // to give it a manual ResetDependentData() call. (This only really
-        // matters if something else is holding a reference & keeping it alive.)
+        // by our post-removal iteration. So, we have to give it a manual
+        // ResetDependentData() call. (This only really matters if something
+        // else is holding a reference and keeping it alive.)
         static_cast<CustomCounterStyle*>(aStyle.get())->ResetDependentData();
       }
       // The object has to be held here so that it will not be released
@@ -2115,27 +2107,21 @@ InvalidateOldStyle(const nsSubstring& aKey,
   return PL_DHASH_NEXT;
 }
 
-static PLDHashOperator
-InvalidateDependentData(const nsSubstring& aKey,
-                        CounterStyle* aStyle,
-                        void* aArg)
-{
-  if (aStyle->IsCustomStyle()) {
-    CustomCounterStyle* custom = static_cast<CustomCounterStyle*>(aStyle);
-    custom->ResetDependentData();
-  }
-  // There is no dependent data cached in DependentBuiltinCounterStyle
-  // instances, so we don't need to reset their data.
-  return PL_DHASH_NEXT;
-}
-
 bool
 CounterStyleManager::NotifyRuleChanged()
 {
   InvalidateOldStyleData data(mPresContext);
   mCacheTable.Enumerate(InvalidateOldStyle, &data);
   if (data.mChanged) {
-    mCacheTable.EnumerateRead(InvalidateDependentData, nullptr);
+    for (auto iter = mCacheTable.Iter(); !iter.Done(); iter.Next()) {
+      CounterStyle* style = iter.UserData();
+      if (style->IsCustomStyle()) {
+        CustomCounterStyle* custom = static_cast<CustomCounterStyle*>(style);
+        custom->ResetDependentData();
+      }
+      // There is no dependent data cached in DependentBuiltinCounterStyle
+      // instances, so we don't need to reset their data.
+    }
   }
   return data.mChanged;
 }
diff --git a/layout/style/FontFace.cpp b/layout/style/FontFace.cpp
index 89a81a8cec..47b5b19265 100644
--- a/layout/style/FontFace.cpp
+++ b/layout/style/FontFace.cpp
@@ -5,6 +5,7 @@
 
 #include "mozilla/dom/FontFace.h"
 
+#include <algorithm>
 #include "mozilla/dom/FontFaceBinding.h"
 #include "mozilla/dom/FontFaceSet.h"
 #include "mozilla/dom/Promise.h"
@@ -73,6 +74,7 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(FontFace)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mLoaded)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mRule)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mFontFaceSet)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mOtherFontFaceSets)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_SCRIPT_OBJECTS
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
@@ -81,6 +83,7 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(FontFace)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mLoaded)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mRule)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mFontFaceSet)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mOtherFontFaceSets)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_PRESERVED_WRAPPER
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
@@ -448,6 +451,10 @@ FontFace::SetStatus(FontFaceLoadStatus aStatus)
     mFontFaceSet->OnFontFaceStatusChanged(this);
   }
 
+  for (FontFaceSet* otherSet : mOtherFontFaceSets) {
+    otherSet->OnFontFaceStatusChanged(this);
+  }
+
   if (!mLoaded) {
     return;
   }
@@ -691,6 +698,39 @@ FontFace::CreateBufferSource()
   return bufferSource.forget();
 }
 
+bool
+FontFace::IsInFontFaceSet(FontFaceSet* aFontFaceSet) const
+{
+  if (mFontFaceSet == aFontFaceSet) {
+    return mInFontFaceSet;
+  }
+  return mOtherFontFaceSets.Contains(aFontFaceSet);
+}
+
+void
+FontFace::AddFontFaceSet(FontFaceSet* aFontFaceSet)
+{
+  MOZ_ASSERT(!IsInFontFaceSet(aFontFaceSet));
+
+  if (mFontFaceSet == aFontFaceSet) {
+    mInFontFaceSet = true;
+  } else {
+    mOtherFontFaceSets.AppendElement(aFontFaceSet);
+  }
+}
+
+void
+FontFace::RemoveFontFaceSet(FontFaceSet* aFontFaceSet)
+{
+  MOZ_ASSERT(IsInFontFaceSet(aFontFaceSet));
+
+  if (mFontFaceSet == aFontFaceSet) {
+    mInFontFaceSet = false;
+  } else {
+    mOtherFontFaceSets.RemoveElement(aFontFaceSet);
+  }
+}
+
 // -- FontFace::Entry --------------------------------------------------------
 
 /* virtual */ void
@@ -703,5 +743,25 @@ FontFace::Entry::SetLoadState(UserFontLoadState aLoadState)
   }
 }
 
+/* virtual */ void
+FontFace::Entry::GetUserFontSets(nsTArray<gfxUserFontSet*>& aResult)
+{
+  aResult.Clear();
+
+  for (FontFace* f : mFontFaces) {
+    if (f->mInFontFaceSet) {
+      aResult.AppendElement(f->mFontFaceSet->GetUserFontSet());
+    }
+    for (FontFaceSet* s : f->mOtherFontFaceSets) {
+      aResult.AppendElement(s->GetUserFontSet());
+    }
+  }
+
+  // Remove duplicates.
+  aResult.Sort();
+  auto it = std::unique(aResult.begin(), aResult.end());
+  aResult.TruncateLength(it - aResult.begin());
+}
+
 } // namespace dom
 } // namespace mozilla
diff --git a/layout/style/FontFace.h b/layout/style/FontFace.h
index 09e5bc270a..e7605535b1 100644
--- a/layout/style/FontFace.h
+++ b/layout/style/FontFace.h
@@ -44,15 +44,16 @@ public:
           const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
           uint32_t aWeight,
           int32_t aStretch,
-          uint32_t aItalicStyle,
+          uint8_t aStyle,
           const nsTArray<gfxFontFeature>& aFeatureSettings,
           uint32_t aLanguageOverride,
           gfxSparseBitSet* aUnicodeRanges)
       : gfxUserFontEntry(aFontSet, aFontFaceSrcList, aWeight, aStretch,
-                         aItalicStyle, aFeatureSettings, aLanguageOverride,
+                         aStyle, aFeatureSettings, aLanguageOverride,
                          aUnicodeRanges) {}
 
     virtual void SetLoadState(UserFontLoadState aLoadState) override;
+    virtual void GetUserFontSets(nsTArray<gfxUserFontSet*>& aResult) override;
     const nsAutoTArray<FontFace*,1>& GetFontFaces() { return mFontFaces; }
 
   protected:
@@ -82,23 +83,14 @@ public:
   void SetUserFontEntry(gfxUserFontEntry* aEntry);
 
   /**
-   * Returns whether this object is in a FontFaceSet.
+   * Returns whether this object is in the specified FontFaceSet.
    */
-  bool IsInFontFaceSet() { return mInFontFaceSet; }
+  bool IsInFontFaceSet(FontFaceSet* aFontFaceSet) const;
 
   FontFaceSet* GetPrimaryFontFaceSet() const { return mFontFaceSet; }
 
-  /**
-   * Sets whether this object is in a FontFaceSet.  This is called by the
-   * FontFaceSet when Add, Remove, etc. are called.
-   */
-  void SetIsInFontFaceSet(bool aInFontFaceSet) {
-    MOZ_ASSERT(!(!aInFontFaceSet && HasRule()),
-               "use DisconnectFromRule instead");
-    mInFontFaceSet = aInFontFaceSet;
-  }
-
-  FontFaceSet* GetFontFaceSet() const { return mFontFaceSet; }
+  void AddFontFaceSet(FontFaceSet* aFontFaceSet);
+  void RemoveFontFaceSet(FontFaceSet* aFontFaceSet);
 
   /**
    * Gets the family name of the FontFace as a raw string (such as 'Times', as
@@ -245,11 +237,15 @@ private:
   // the descriptors stored in mRule.
   nsAutoPtr<mozilla::CSSFontFaceDescriptors> mDescriptors;
 
-  // The FontFaceSet this FontFace is associated with, regardless of whether
-  // it is currently "in" the set.
+  // The primary FontFaceSet this FontFace is associated with,
+  // regardless of whether it is currently "in" the set.
   RefPtr<FontFaceSet> mFontFaceSet;
 
-  // Whether this FontFace appears in the FontFaceSet.
+  // Other FontFaceSets (apart from mFontFaceSet) that this FontFace
+  // appears in.
+  nsTArray<RefPtr<FontFaceSet>> mOtherFontFaceSets;
+
+  // Whether this FontFace appears in mFontFaceSet.
   bool mInFontFaceSet;
 };
 
diff --git a/layout/style/FontFaceSet.cpp b/layout/style/FontFaceSet.cpp
index 5b4adacd19..e4bdba25b6 100644
--- a/layout/style/FontFaceSet.cpp
+++ b/layout/style/FontFaceSet.cpp
@@ -9,10 +9,10 @@
 #include "gfxFontConstants.h"
 #include "mozilla/css/Declaration.h"
 #include "mozilla/css/Loader.h"
-#include "mozilla/dom/CSSFontFaceLoadEvent.h"
-#include "mozilla/dom/CSSFontFaceLoadEventBinding.h"
 #include "mozilla/dom/FontFaceSetBinding.h"
 #include "mozilla/dom/FontFaceSetIterator.h"
+#include "mozilla/dom/FontFaceSetLoadEvent.h"
+#include "mozilla/dom/FontFaceSetLoadEventBinding.h"
 #include "mozilla/dom/Promise.h"
 #include "mozilla/AsyncEventDispatcher.h"
 #include "mozilla/Logging.h"
@@ -169,7 +169,7 @@ FontFaceSet::ParseFontShorthandForMatching(
                             RefPtr<FontFamilyListRefCnt>& aFamilyList,
                             uint32_t& aWeight,
                             int32_t& aStretch,
-                            uint32_t& aItalicStyle,
+                            uint8_t& aStyle,
                             ErrorResult& aRv)
 {
   // Parse aFont as a 'font' property value.
@@ -224,7 +224,7 @@ FontFaceSet::ParseFontShorthandForMatching(
   aWeight = weight;
 
   aStretch = data->ValueFor(eCSSProperty_font_stretch)->GetIntValue();
-  aItalicStyle = data->ValueFor(eCSSProperty_font_style)->GetIntValue();
+  aStyle = data->ValueFor(eCSSProperty_font_style)->GetIntValue();
 }
 
 static bool
@@ -252,7 +252,7 @@ FontFaceSet::FindMatchingFontFaces(const nsAString& aFont,
   RefPtr<FontFamilyListRefCnt> familyList;
   uint32_t weight;
   int32_t stretch;
-  uint32_t italicStyle;
+  uint8_t italicStyle;
   ParseFontShorthandForMatching(aFont, familyList, weight, stretch, italicStyle,
                                 aRv);
   if (aRv.Failed()) {
@@ -399,23 +399,16 @@ FontFaceSet::Add(FontFace& aFontFace, ErrorResult& aRv)
 {
   FlushUserFontSet();
 
-  // We currently only support FontFace objects being in a single FontFaceSet,
-  // and we also restrict the FontFaceSet to contain only FontFaces created
-  // in the same window.
-
-  if (aFontFace.GetFontFaceSet() != this) {
-    aRv.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
-    return nullptr;
-  }
-
-  if (aFontFace.IsInFontFaceSet()) {
+  if (aFontFace.IsInFontFaceSet(this)) {
     return this;
   }
 
-  MOZ_ASSERT(!aFontFace.HasRule(),
-             "rule-backed FontFaces should always be in the FontFaceSet");
+  if (aFontFace.HasRule()) {
+    aRv.Throw(NS_ERROR_DOM_INVALID_MODIFICATION_ERR);
+    return nullptr;
+  }
 
-  aFontFace.SetIsInFontFaceSet(true);
+  aFontFace.AddFontFaceSet(this);
 
 #ifdef DEBUG
   for (const FontFaceRecord& rec : mNonRuleFaces) {
@@ -449,7 +442,7 @@ FontFaceSet::Clear()
 
   for (size_t i = 0; i < mNonRuleFaces.Length(); i++) {
     FontFace* f = mNonRuleFaces[i].mFontFace;
-    f->SetIsInFontFaceSet(false);
+    f->RemoveFontFaceSet(this);
   }
 
   mNonRuleFaces.Clear();
@@ -480,7 +473,7 @@ FontFaceSet::Delete(FontFace& aFontFace)
     return false;
   }
 
-  aFontFace.SetIsInFontFaceSet(false);
+  aFontFace.RemoveFontFaceSet(this);
 
   mNonRuleFacesDirty = true;
   RebuildUserFontSet();
@@ -492,8 +485,7 @@ FontFaceSet::Delete(FontFace& aFontFace)
 bool
 FontFaceSet::HasAvailableFontFace(FontFace* aFontFace)
 {
-  return aFontFace->GetFontFaceSet() == this &&
-         aFontFace->IsInFontFaceSet();
+  return aFontFace->IsInFontFaceSet(this);
 }
 
 bool
@@ -532,16 +524,18 @@ FontFaceSet::Size()
   return std::min<size_t>(total, INT32_MAX);
 }
 
-FontFaceSetIterator*
+already_AddRefed<FontFaceSetIterator>
 FontFaceSet::Entries()
 {
-  return new FontFaceSetIterator(this, true);
+  RefPtr<FontFaceSetIterator> it = new FontFaceSetIterator(this, true);
+  return it.forget();
 }
 
-FontFaceSetIterator*
+already_AddRefed<FontFaceSetIterator>
 FontFaceSet::Values()
 {
-  return new FontFaceSetIterator(this, false);
+  RefPtr<FontFaceSetIterator> it = new FontFaceSetIterator(this, false);
+  return it.forget();
 }
 
 void
@@ -972,7 +966,7 @@ FontFaceSet::FindOrCreateUserFontEntryFromFontFace(const nsAString& aFamilyName,
 
   uint32_t weight = NS_STYLE_FONT_WEIGHT_NORMAL;
   int32_t stretch = NS_STYLE_FONT_STRETCH_NORMAL;
-  uint32_t italicStyle = NS_STYLE_FONT_STYLE_NORMAL;
+  uint8_t italicStyle = NS_STYLE_FONT_STYLE_NORMAL;
   uint32_t languageOverride = NO_FONT_LANGUAGE_OVERRIDE;
 
   // set up weight
@@ -1338,6 +1332,12 @@ FontFaceSet::CheckFontLoad(const gfxFontFaceSrc* aFontFaceSrc,
         *aBypassCache = true;
       }
     }
+    uint32_t flags;
+    if (NS_SUCCEEDED(docShell->GetDefaultLoadFlags(&flags))) {
+      if (flags & nsIRequest::LOAD_BYPASS_CACHE) {
+        *aBypassCache = true;
+      }
+    }
   }
 
   return rv;
@@ -1624,7 +1624,7 @@ FontFaceSet::DispatchLoadingFinishedEvent(
                                  const nsAString& aType,
                                  const nsTArray<FontFace*>& aFontFaces)
 {
-  CSSFontFaceLoadEventInit init;
+  FontFaceSetLoadEventInit init;
   init.mBubbles = false;
   init.mCancelable = false;
   OwningNonNull<FontFace>* elements =
@@ -1633,8 +1633,8 @@ FontFaceSet::DispatchLoadingFinishedEvent(
   for (size_t i = 0; i < aFontFaces.Length(); i++) {
     elements[i] = aFontFaces[i];
   }
-  RefPtr<CSSFontFaceLoadEvent> event =
-    CSSFontFaceLoadEvent::Constructor(this, aType, init);
+  RefPtr<FontFaceSetLoadEvent> event =
+    FontFaceSetLoadEvent::Constructor(this, aType, init);
   (new AsyncEventDispatcher(this, event))->PostDOMEvent();
 }
 
@@ -1774,13 +1774,13 @@ FontFaceSet::UserFontSet::CreateUserFontEntry(
                                const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
                                uint32_t aWeight,
                                int32_t aStretch,
-                               uint32_t aItalicStyle,
+                               uint8_t aStyle,
                                const nsTArray<gfxFontFeature>& aFeatureSettings,
                                uint32_t aLanguageOverride,
                                gfxSparseBitSet* aUnicodeRanges)
 {
   RefPtr<gfxUserFontEntry> entry =
-    new FontFace::Entry(this, aFontFaceSrcList, aWeight, aStretch, aItalicStyle,
+    new FontFace::Entry(this, aFontFaceSrcList, aWeight, aStretch, aStyle,
                         aFeatureSettings, aLanguageOverride, aUnicodeRanges);
   return entry.forget();
 }
diff --git a/layout/style/FontFaceSet.h b/layout/style/FontFaceSet.h
index 541bb6c7e8..91ff5c6b2b 100644
--- a/layout/style/FontFaceSet.h
+++ b/layout/style/FontFaceSet.h
@@ -23,12 +23,12 @@ class nsPIDOMWindow;
 namespace mozilla {
 namespace css {
 class FontFamilyListRefCnt;
-}
+} // namespace css
 namespace dom {
 class FontFace;
 class Promise;
-}
-}
+} // namespace dom
+} // namespace mozilla
 
 namespace mozilla {
 namespace dom {
@@ -83,7 +83,7 @@ public:
                                    const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
                                    uint32_t aWeight,
                                    int32_t aStretch,
-                                   uint32_t aItalicStyle,
+                                   uint8_t aStyle,
                                    const nsTArray<gfxFontFeature>& aFeatureSettings,
                                    uint32_t aLanguageOverride,
                                    gfxSparseBitSet* aUnicodeRanges) override;
@@ -149,6 +149,12 @@ public:
 
   void FlushUserFontSet();
 
+  static nsPresContext* GetPresContextFor(gfxUserFontSet* aUserFontSet)
+  {
+    FontFaceSet* set = static_cast<UserFontSet*>(aUserFontSet)->mFontFaceSet;
+    return set ? set->GetPresContext() : nullptr;
+  }
+
   // -- Web IDL --------------------------------------------------------------
 
   IMPL_EVENT_HANDLER(loading)
@@ -169,8 +175,8 @@ public:
   bool Delete(FontFace& aFontFace);
   bool Has(FontFace& aFontFace);
   uint32_t Size();
-  mozilla::dom::FontFaceSetIterator* Entries();
-  mozilla::dom::FontFaceSetIterator* Values();
+  already_AddRefed<mozilla::dom::FontFaceSetIterator> Entries();
+  already_AddRefed<mozilla::dom::FontFaceSetIterator> Values();
   void ForEach(JSContext* aCx, FontFaceSetForEachCallback& aCallback,
                JS::Handle<JS::Value> aThisArg,
                mozilla::ErrorResult& aRv);
@@ -215,7 +221,7 @@ private:
   void CheckLoadingFinishedAfterDelay();
 
   /**
-   * Dispatches a CSSFontFaceLoadEvent to this object.
+   * Dispatches a FontFaceSetLoadEvent to this object.
    */
   void DispatchLoadingFinishedEvent(
                                 const nsAString& aType,
@@ -280,7 +286,7 @@ private:
               RefPtr<mozilla::css::FontFamilyListRefCnt>& aFamilyList,
               uint32_t& aWeight,
               int32_t& aStretch,
-              uint32_t& aItalicStyle,
+              uint8_t& aStyle,
               ErrorResult& aRv);
   void FindMatchingFontFaces(const nsAString& aFont,
                              const nsAString& aText,
diff --git a/layout/style/FontFaceSetIterator.cpp b/layout/style/FontFaceSetIterator.cpp
index ce6d8bc0f9..74997eb1aa 100644
--- a/layout/style/FontFaceSetIterator.cpp
+++ b/layout/style/FontFaceSetIterator.cpp
@@ -8,6 +8,11 @@
 namespace mozilla {
 namespace dom {
 
+NS_IMPL_CYCLE_COLLECTION(FontFaceSetIterator, mFontFaceSet)
+
+NS_IMPL_CYCLE_COLLECTION_ROOT_NATIVE(FontFaceSetIterator, AddRef)
+NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(FontFaceSetIterator, Release)
+
 FontFaceSetIterator::FontFaceSetIterator(FontFaceSet* aFontFaceSet,
                                          bool aIsKeyAndValue)
   : mFontFaceSet(aFontFaceSet)
diff --git a/layout/style/FontFaceSetIterator.h b/layout/style/FontFaceSetIterator.h
index 31a31f4e0e..2c925885d5 100644
--- a/layout/style/FontFaceSetIterator.h
+++ b/layout/style/FontFaceSetIterator.h
@@ -12,12 +12,14 @@
 namespace mozilla {
 namespace dom {
 
-class FontFaceSetIterator final : public NonRefcountedDOMObject
+class FontFaceSetIterator final
 {
 public:
   FontFaceSetIterator(mozilla::dom::FontFaceSet* aFontFaceSet,
                       bool aIsKeyAndValue);
-  ~FontFaceSetIterator();
+
+  NS_DECL_CYCLE_COLLECTION_NATIVE_CLASS(FontFaceSetIterator)
+  NS_INLINE_DECL_CYCLE_COLLECTING_NATIVE_REFCOUNTING(FontFaceSetIterator)
 
   bool WrapObject(JSContext* aCx,
                   JS::Handle<JSObject*> aGivenProto,
@@ -28,6 +30,8 @@ public:
             mozilla::ErrorResult& aRv);
 
 private:
+  ~FontFaceSetIterator();
+
   RefPtr<FontFaceSet> mFontFaceSet;
   uint32_t mNextIndex;
   bool mIsKeyAndValue;
diff --git a/layout/style/nsCSSProps.cpp b/layout/style/nsCSSProps.cpp
index ea00036d7d..1afc5299ef 100644
--- a/layout/style/nsCSSProps.cpp
+++ b/layout/style/nsCSSProps.cpp
@@ -1009,7 +1009,7 @@ const KTableValue nsCSSProps::kCaptionSideKTable[] = {
   eCSSKeyword_UNKNOWN,              -1
 };
 
-const KTableValue nsCSSProps::kClearKTable[] = {
+KTableValue nsCSSProps::kClearKTable[] = {
   eCSSKeyword_none,         NS_STYLE_CLEAR_NONE,
   eCSSKeyword_left,         NS_STYLE_CLEAR_LEFT,
   eCSSKeyword_right,        NS_STYLE_CLEAR_RIGHT,
@@ -1374,7 +1374,7 @@ const KTableValue nsCSSProps::kJustifyContentKTable[] = {
   eCSSKeyword_UNKNOWN,-1
 };
 
-const KTableValue nsCSSProps::kFloatKTable[] = {
+KTableValue nsCSSProps::kFloatKTable[] = {
   eCSSKeyword_none,         NS_STYLE_FLOAT_NONE,
   eCSSKeyword_left,         NS_STYLE_FLOAT_LEFT,
   eCSSKeyword_right,        NS_STYLE_FLOAT_RIGHT,
diff --git a/layout/style/nsCSSProps.h b/layout/style/nsCSSProps.h
index 592d8c3733..966331627f 100644
--- a/layout/style/nsCSSProps.h
+++ b/layout/style/nsCSSProps.h
@@ -677,7 +677,9 @@ public:
   static const KTableValue kBoxShadowTypeKTable[];
   static const KTableValue kBoxSizingKTable[];
   static const KTableValue kCaptionSideKTable[];
-  static const KTableValue kClearKTable[];
+  // Not const because we modify its entries when the pref
+  // "layout.css.float-logical-values.enabled" changes:
+  static KTableValue kClearKTable[];
   static const KTableValue kColorKTable[];
   static const KTableValue kContentKTable[];
   static const KTableValue kControlCharacterVisibilityKTable[];
@@ -702,7 +704,9 @@ public:
   // ------------------------------------------------------------------
   static const KTableValue kFlexDirectionKTable[];
   static const KTableValue kFlexWrapKTable[];
-  static const KTableValue kFloatKTable[];
+  // Not const because we modify its entries when the pref
+  // "layout.css.float-logical-values.enabled" changes:
+  static KTableValue kFloatKTable[];
   static const KTableValue kFloatEdgeKTable[];
   static const KTableValue kFontKTable[];
   static const KTableValue kFontKerningKTable[];
diff --git a/layout/style/nsCSSRuleProcessor.cpp b/layout/style/nsCSSRuleProcessor.cpp
index 0bc497eac2..b30fba20eb 100644
--- a/layout/style/nsCSSRuleProcessor.cpp
+++ b/layout/style/nsCSSRuleProcessor.cpp
@@ -3835,13 +3835,13 @@ nsCSSRuleProcessor::RefreshRuleCascade(nsPresContext* aPresContext)
 
       // Sort the hash table of per-weight linked lists by weight.
       uint32_t weightCount = data.mRulesByWeight.EntryCount();
-      nsAutoArrayPtr<PerWeightData> weightArray(new PerWeightData[weightCount]);
+      auto weightArray = MakeUnique<PerWeightData[]>(weightCount);
       int32_t j = 0;
       for (auto iter = data.mRulesByWeight.Iter(); !iter.Done(); iter.Next()) {
         auto entry = static_cast<const RuleByWeightEntry*>(iter.Get());
         weightArray[j++] = entry->data;
       }
-      NS_QuickSort(weightArray, weightCount, sizeof(PerWeightData),
+      NS_QuickSort(weightArray.get(), weightCount, sizeof(PerWeightData),
                    CompareWeightData, nullptr);
 
       // Put things into the rule hash.
diff --git a/layout/style/nsFontFaceLoader.cpp b/layout/style/nsFontFaceLoader.cpp
index 4e11026559..8ccbd23357 100644
--- a/layout/style/nsFontFaceLoader.cpp
+++ b/layout/style/nsFontFaceLoader.cpp
@@ -24,6 +24,7 @@
 #include "mozilla/gfx/2D.h"
 
 using namespace mozilla;
+using namespace mozilla::dom;
 
 #define LOG(args) MOZ_LOG(gfxUserFontSet::GetUserFontsLog(), mozilla::LogLevel::Debug, args)
 #define LOG_ENABLED() MOZ_LOG_TEST(gfxUserFontSet::GetUserFontsLog(), \
@@ -31,7 +32,7 @@ using namespace mozilla;
 
 nsFontFaceLoader::nsFontFaceLoader(gfxUserFontEntry* aUserFontEntry,
                                    nsIURI* aFontURI,
-                                   mozilla::dom::FontFaceSet* aFontFaceSet,
+                                   FontFaceSet* aFontFaceSet,
                                    nsIChannel* aChannel)
   : mUserFontEntry(aUserFontEntry),
     mFontURI(aFontURI),
@@ -73,7 +74,7 @@ nsFontFaceLoader::StartedLoading(nsIStreamLoader* aStreamLoader)
   mStreamLoader = aStreamLoader;
 }
 
-void
+/* static */ void
 nsFontFaceLoader::LoadTimerCallback(nsITimer* aTimer, void* aClosure)
 {
   nsFontFaceLoader* loader = static_cast<nsFontFaceLoader*>(aClosure);
@@ -117,11 +118,16 @@ nsFontFaceLoader::LoadTimerCallback(nsITimer* aTimer, void* aClosure)
   // font will be used in the meantime, and tell the context to refresh.
   if (updateUserFontSet) {
     ufe->mFontDataLoadingState = gfxUserFontEntry::LOADING_SLOWLY;
-    nsPresContext* ctx = loader->mFontFaceSet->GetPresContext();
-    if (ctx) {
-      loader->mFontFaceSet->IncrementGeneration();
-      ctx->UserFontSetUpdated(loader->GetUserFontEntry());
-      LOG(("userfonts (%p) timeout reflow\n", loader));
+    nsTArray<gfxUserFontSet*> fontSets;
+    ufe->GetUserFontSets(fontSets);
+    for (gfxUserFontSet* fontSet : fontSets) {
+      nsPresContext* ctx = FontFaceSet::GetPresContextFor(fontSet);
+      if (ctx) {
+        fontSet->IncrementGeneration();
+        ctx->UserFontSetUpdated(ufe);
+        LOG(("userfonts (%p) timeout reflow for pres context %p\n",
+             loader, ctx));
+      }
     }
   }
 }
@@ -179,16 +185,22 @@ nsFontFaceLoader::OnStreamComplete(nsIStreamLoader* aLoader,
   // This is called even in the case of a failed download (HTTP 404, etc),
   // as there may still be data to be freed (e.g. an error page),
   // and we need to load the next source.
-  nsPresContext* ctx = mFontFaceSet->GetPresContext();
   bool fontUpdate =
     mUserFontEntry->FontDataDownloadComplete(aString, aStringLen, aStatus);
 
   // when new font loaded, need to reflow
-  if (fontUpdate && ctx) {
-    // Update layout for the presence of the new font.  Since this is
-    // asynchronous, reflows will coalesce.
-    ctx->UserFontSetUpdated(mUserFontEntry);
-    LOG(("userfonts (%p) reflow\n", this));
+  if (fontUpdate) {
+    nsTArray<gfxUserFontSet*> fontSets;
+    mUserFontEntry->GetUserFontSets(fontSets);
+    for (gfxUserFontSet* fontSet : fontSets) {
+      nsPresContext* ctx = FontFaceSet::GetPresContextFor(fontSet);
+      if (ctx) {
+        // Update layout for the presence of the new font.  Since this is
+        // asynchronous, reflows will coalesce.
+        ctx->UserFontSetUpdated(mUserFontEntry);
+        LOG(("userfonts (%p) reflow for pres context %p\n", this, ctx));
+      }
+    }
   }
 
   // done with font set
@@ -214,7 +226,7 @@ nsFontFaceLoader::Cancel()
   mChannel->Cancel(NS_BINDING_ABORTED);
 }
 
-nsresult
+/* static */ nsresult
 nsFontFaceLoader::CheckLoadAllowed(nsIPrincipal* aSourcePrincipal,
                                    nsIURI* aTargetURI,
                                    nsISupports* aContext)
diff --git a/layout/style/test/file_font_loading_api_vframe.html b/layout/style/test/file_font_loading_api_vframe.html
new file mode 100644
index 0000000000..51dbbbee91
--- /dev/null
+++ b/layout/style/test/file_font_loading_api_vframe.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<style></style>
diff --git a/layout/style/test/mochitest.ini b/layout/style/test/mochitest.ini
index cd97c27e04..c52a52050a 100644
--- a/layout/style/test/mochitest.ini
+++ b/layout/style/test/mochitest.ini
@@ -171,7 +171,9 @@ support-files = flexbox_layout_testcases.js
 [test_font_family_parsing.html]
 [test_font_feature_values_parsing.html]
 [test_font_loading_api.html]
-support-files = BitPattern.woff
+support-files =
+  BitPattern.woff
+  file_font_loading_api_vframe.html
 [test_garbage_at_end_of_declarations.html]
 [test_grid_container_shorthands.html]
 [test_grid_item_shorthands.html]
diff --git a/layout/style/test/property_database.js b/layout/style/test/property_database.js
index cbbc3a52ac..4a3d1af8e2 100644
--- a/layout/style/test/property_database.js
+++ b/layout/style/test/property_database.js
@@ -2473,7 +2473,7 @@ var gCSSProperties = {
     inherited: false,
     type: CSS_TYPE_LONGHAND,
     initial_values: [ "none" ],
-    other_values: [ "left", "right", "both", "inline-start", "inline-end" ],
+    other_values: [ "left", "right", "both" ],
     invalid_values: []
   },
   "clip": {
@@ -2577,7 +2577,7 @@ var gCSSProperties = {
     inherited: false,
     type: CSS_TYPE_LONGHAND,
     initial_values: [ "none" ],
-    other_values: [ "left", "right", "inline-start", "inline-end" ],
+    other_values: [ "left", "right" ],
     invalid_values: []
   },
   "font": {
@@ -6744,6 +6744,18 @@ if (SpecialPowers.getBoolPref("layout.css.unset-value.enabled")) {
   }
 }
 
+if (IsCSSPropertyPrefEnabled("layout.css.float-logical-values.enabled")) {
+  gCSSProperties["float"].other_values.push("inline-start");
+  gCSSProperties["float"].other_values.push("inline-end");
+  gCSSProperties["clear"].other_values.push("inline-start");
+  gCSSProperties["clear"].other_values.push("inline-end");
+} else {
+  gCSSProperties["float"].invalid_values.push("inline-start");
+  gCSSProperties["float"].invalid_values.push("inline-end");
+  gCSSProperties["clear"].invalid_values.push("inline-start");
+  gCSSProperties["clear"].invalid_values.push("inline-end");
+}
+
 if (false) {
   // TODO These properties are chrome-only, and are not exposed via CSSOM.
   // We may still want to find a way to test them. See bug 1206999.
diff --git a/layout/style/test/test_font_loading_api.html b/layout/style/test/test_font_loading_api.html
index 0ae3956e6b..122d4e46d9 100644
--- a/layout/style/test/test_font_loading_api.html
+++ b/layout/style/test/test_font_loading_api.html
@@ -7,7 +7,8 @@
 <script src=descriptor_database.js></script>
 
 <body onload="start()">
-<iframe style="display: none"></iframe>
+<iframe id=v src="file_font_loading_api_vframe.html"></iframe>
+<iframe id=n style="display: none"></iframe>
 
 <script>
 // Map of FontFace descriptor attribute names to @font-face rule descriptor
@@ -161,13 +162,40 @@ function runTest() {
   SimpleTest.waitForExplicitFinish();
 
   // Document and window from inside the display:none iframe.
-  var iframe = document.querySelector("iframe");
-  var fdocument = iframe.contentDocument;
-  var fwindow = iframe.contentWindow;
+  var nframe = document.getElementById("n");
+  var ndocument = nframe.contentDocument;
+  var nwindow = nframe.contentWindow;
 
-  // For easier test assertion descriptions.
-  document.toString  = window.toString  = function() { return "visible document"; };
-  fdocument.toString = fwindow.toString = function() { return "display:none document"; };
+  // Document and window from inside the visible iframe.
+  var vframe = document.getElementById("v");
+  var vdocument = vframe.contentDocument;
+  var vwindow = vframe.contentWindow;
+
+  // For iterating over different combinations of documents and windows
+  // to test with.
+  var sources = [
+    { win: window,  doc: document,  what: "window/document"   },
+    { win: vwindow, doc: vdocument, what: "vwindow/vdocument" },
+    { win: nwindow, doc: ndocument, what: "nwindow/ndocument" },
+    { win: window,  doc: vdocument, what: "window/vdocument"  },
+    { win: window,  doc: ndocument, what: "window/ndocument"  },
+    { win: vwindow, doc: document,  what: "vwindow/document"  },
+    { win: vwindow, doc: ndocument, what: "vwindow/ndocument" },
+    { win: nwindow, doc: document,  what: "nwindow/document"  },
+    { win: nwindow, doc: vdocument, what: "nwindow/vdocument" },
+  ];
+
+  var sourceDocuments = [
+    { doc: document,  what: "document"  },
+    { doc: vdocument, what: "vdocument" },
+    { doc: ndocument, what: "ndocument" },
+  ];
+
+  var sourceWindows = [
+    { win: window,  what: "window"  },
+    { win: vwindow, what: "vwindow" },
+    { win: nwindow, what: "nwindow" },
+  ];
 
   queue = queue.then(function() {
 
@@ -184,18 +212,18 @@ function runTest() {
     ok(window.FontFace, "FontFace interface object should be present (TEST 1)");
     is(Object.getPrototypeOf(FontFace.prototype), Object.prototype, "FontFace should inherit from Object (TEST 1)");
 
-    // (TEST 2) Some miscellaneous tests for CSSFontFaceLoadEvent.
-    ok(window.CSSFontFaceLoadEvent, "CSSFontFaceLoadEvent interface object should be present (TEST 2)");
-    is(Object.getPrototypeOf(CSSFontFaceLoadEvent.prototype), Event.prototype, "CSSFontFaceLoadEvent should inherit from Event (TEST 2)");
+    // (TEST 2) Some miscellaneous tests for FontFaceSetLoadEvent.
+    ok(window.FontFaceSetLoadEvent, "FontFaceSetLoadEvent interface object should be present (TEST 2)");
+    is(Object.getPrototypeOf(FontFaceSetLoadEvent.prototype), Event.prototype, "FontFaceSetLoadEvent should inherit from Event (TEST 2)");
 
   }).then(function() {
 
     // (TEST 3) Test that document.fonts.ready starts out resolved with the
     // FontFaceSet.
     var p = Promise.resolve();
-    [document, fdocument].forEach(function(doc) {
+    sourceDocuments.forEach(function({ doc, what }) {
       p = p.then(function() {
-        return is_resolved_with(doc.fonts.ready, doc.fonts, "initial value of document.fonts", "(TEST 3) (" + doc + ")");
+        return is_resolved_with(doc.fonts.ready, doc.fonts, "initial value of document.fonts", "(TEST 3) (" + what + ")");
       });
     });
     return p;
@@ -204,19 +232,19 @@ function runTest() {
 
     // (TEST 4) Test that document.fonts in this test document starts out with no
     // FontFace objects in it.
-    [document, fdocument].forEach(function(doc) {
-      is(Array.from(doc.fonts).length, 0, "initial number of FontFace objects in document.fonts (TEST 4) (" + doc + ")");
+    sourceDocuments.forEach(function({ doc, what }) {
+      is(Array.from(doc.fonts).length, 0, "initial number of FontFace objects in document.fonts (TEST 4) (" + what + ")");
     });
 
     // (TEST 5) Test that document.fonts.status starts off as loaded.
-    [document, fdocument].forEach(function(doc) {
-      is(doc.fonts.status, "loaded", "initial value of document.fonts.status (TEST 5) (" + doc + ")");
+    sourceDocuments.forEach(function({ doc, what }) {
+      is(doc.fonts.status, "loaded", "initial value of document.fonts.status (TEST 5) (" + what + ")");
     });
 
     // (TEST 6) Test initial value of FontFace.status when a url() source is
     // used.
-    [window, fwindow].forEach(function(win) {
-      is(new win.FontFace("test", "url(x)").status, "unloaded", "initial value of FontFace.status from " + win + " when a url() source is used (TEST 6) (" + win + ")");
+    sourceWindows.forEach(function({ win, what }) {
+      is(new win.FontFace("test", "url(x)").status, "unloaded", "initial value of FontFace.status when a url() source is used (TEST 6) (" + what + ")");
     });
 
     // (TEST 7) Test initial value of FontFace.status when an invalid
@@ -224,18 +252,18 @@ function runTest() {
     // load() call, it should either be "loading" if the browser is
     // asynchronously parsing the font data, or "error" if it parsed
     // it immediately.
-    [window, fwindow].forEach(function(win) {
+    sourceWindows.forEach(function({ win, what }) {
       var status = new win.FontFace("test", new ArrayBuffer(0)).status;
-      ok(status == "loading" || status == "error", "initial value of FontFace.status from " + win + " when an invalid ArrayBuffer source is used (TEST 7) (" + win + ")");
+      ok(status == "loading" || status == "error", "initial value of FontFace.status when an invalid ArrayBuffer source is used (TEST 7) (" + what + ")");
     });
 
     // (TEST 8) Test initial value of FontFace.status when a valid ArrayBuffer
     // source is used.  Because it has an implicit initial load() call, it
     // should either be "loading" if the browser is asynchronously parsing the
     // font data, or "loaded" if it parsed it immediately.
-    [window, fwindow].forEach(function(win) {
+    sourceWindows.forEach(function({ win, what }) {
       status = new win.FontFace("test", fontData).status;
-      ok(status == "loading" || status == "loaded", "initial value of FontFace.status from " + win + " when a valid ArrayBuffer source is used (TEST 8) (" + win + ")");
+      ok(status == "loading" || status == "loaded", "initial value of FontFace.status when a valid ArrayBuffer source is used (TEST 8) (" + what + ")");
     });
 
     // (TEST 9) (old test became redundant with TEST 19)
@@ -245,9 +273,9 @@ function runTest() {
     // (TEST 10) Test initial value of FontFace.loaded when a valid url()
     // source is used.
     var p = Promise.resolve();
-    [window, fwindow].forEach(function(win) {
+    sourceWindows.forEach(function({ win, what }) {
       p = p.then(function() {
-        return is_pending(new win.FontFace("test", "url(x)").loaded, "initial value of FontFace.loaded from " + win + " when a valid url() source is used", "(TEST 10) (" + win + ")");
+        return is_pending(new win.FontFace("test", "url(x)").loaded, "initial value of FontFace.loaded when a valid url() source is used", "(TEST 10) (" + what + ")");
       });
     });
     return p;
@@ -264,26 +292,26 @@ function runTest() {
 
     // (TEST 13) Test initial values of the descriptor attributes on FontFace
     // objects.
-    [window, fwindow].forEach(function(win) {
+    sourceWindows.forEach(function({ win, what }) {
       var face = new win.FontFace("test", fontData);
       // XXX Spec issue: what values do the descriptor attributes have before the
       // constructor's dictionary argument is parsed?
       for (var desc in defaultValues) {
-        is(face[desc], defaultValues[desc], "initial value of FontFace." + desc + " (TEST 13) (" + win + ")");
+        is(face[desc], defaultValues[desc], "initial value of FontFace." + desc + " (TEST 13) (" + what + ")");
       }
     });
 
     // (TEST 14) Test default values of the FontFaceDescriptors dictionary.
     var p = Promise.resolve();
-    [window, fwindow].forEach(function(win) {
+    sourceWindows.forEach(function({ win, what }) {
       p = p.then(function() {
         var face = new win.FontFace("test", fontData);
         return face.loaded.then(function() {
           for (var desc in defaultValues) {
-            is(face[desc], defaultValues[desc], "default value of FontFace." + desc + " (TEST 14) (" + win + ")");
+            is(face[desc], defaultValues[desc], "default value of FontFace." + desc + " (TEST 14) (" + what + ")");
           }
         }, function(aError) {
-          ok(false, "FontFace should have loaded succesfully (TEST 14) (" + win + ")");
+          ok(false, "FontFace should have loaded succesfully (TEST 14) (" + what + ")");
         });
       });
     });
@@ -294,7 +322,7 @@ function runTest() {
     // (TEST 15) Test passing non-default descriptor values to the FontFace
     // constructor.
     var p = Promise.resolve();
-    [window, fwindow].forEach(function(win) {
+    sourceWindows.forEach(function({ win, what }) {
       p = p.then(function() {
         var descriptorTests = Promise.resolve();
         Object.keys(nonDefaultValues).forEach(function(aDesc) {
@@ -303,11 +331,11 @@ function runTest() {
             init[aDesc] = nonDefaultValues[aDesc][0];
             var face = new win.FontFace("test", fontData, init);
             var ok_todo = aDesc == "variant" ? todo : ok;
-            ok_todo(face[aDesc] == nonDefaultValues[aDesc][1], "specified valid non-default value of FontFace." + aDesc + " immediately after construction (TEST 15) (" + win + ")");
+            ok_todo(face[aDesc] == nonDefaultValues[aDesc][1], "specified valid non-default value of FontFace." + aDesc + " immediately after construction (TEST 15) (" + what + ")");
             return face.loaded.then(function() {
-              ok_todo(face[aDesc] == nonDefaultValues[aDesc][1], "specified valid non-default value of FontFace." + aDesc + " (TEST 15) (" + win + ")");
+              ok_todo(face[aDesc] == nonDefaultValues[aDesc][1], "specified valid non-default value of FontFace." + aDesc + " (TEST 15) (" + what + ")");
             }, function(aError) {
-              ok(false, "FontFace should have loaded succesfully (TEST 15) (" + win + ")");
+              ok(false, "FontFace should have loaded succesfully (TEST 15) (" + what + ")");
             });
           });
         });
@@ -321,7 +349,7 @@ function runTest() {
     // (TEST 16) Test passing invalid descriptor values to the FontFace
     // constructor.
     var p = Promise.resolve();
-    [window, fwindow].forEach(function(win) {
+    sourceWindows.forEach(function({ win, what }) {
       p = p.then(function() {
         var descriptorTests = Promise.resolve();
         Object.keys(invalidValues).forEach(function(aDesc) {
@@ -330,12 +358,12 @@ function runTest() {
             init[aDesc] = invalidValues[aDesc];
             var face = new win.FontFace("test", fontData, init);
             var ok_todo = aDesc == "variant" ? todo : ok;
-            ok_todo(face.status == "error", "FontFace should be error immediately after construction with invalid value of FontFace." + aDesc + " (TEST 16) (" + win + ")");
+            ok_todo(face.status == "error", "FontFace should be error immediately after construction with invalid value of FontFace." + aDesc + " (TEST 16) (" + what + ")");
             return face.loaded.then(function() {
-              ok_todo(false, "FontFace should not load after invalid value of FontFace." + aDesc + " specified (TEST 16) (" + win + ")");
+              ok_todo(false, "FontFace should not load after invalid value of FontFace." + aDesc + " specified (TEST 16) (" + what + ")");
             }, function(aError) {
-              ok(true, "FontFace should not load after invalid value of FontFace." + aDesc + " specified (TEST 16) (" + win + ")");
-              is(aError.name, "SyntaxError", "FontFace.loaded with invalid value of FontFace." + aDesc + " should be rejected with a SyntaxError (TEST 16) (" + win + ")");
+              ok(true, "FontFace should not load after invalid value of FontFace." + aDesc + " specified (TEST 16) (" + what + ")");
+              is(aError.name, "SyntaxError", "FontFace.loaded with invalid value of FontFace." + aDesc + " should be rejected with a SyntaxError (TEST 16) (" + what + ")");
             });
           });
         });
@@ -349,19 +377,19 @@ function runTest() {
     // (TEST 17) Test passing an invalid font family name to the FontFace
     // constructor.
     var p = Promise.resolve();
-    [window, fwindow].forEach(function(win) {
+    sourceWindows.forEach(function({ win, what }) {
       p = p.then(function() {
         var familyTests = Promise.resolve();
         invalidFontFamilyNames.forEach(function(aFamilyName) {
           familyTests = familyTests.then(function() {
             var face = new win.FontFace(aFamilyName, fontData);
-            is(face.status, "error", "FontFace should be error immediately after construction with invalid family name " + aFamilyName + " (TEST 17) (" + win + ")");
-            is(face.family, "", "FontFace.family should be the empty string after construction with invalid family name " + aFamilyName + " (TEST 17) (" + win + ")");
+            is(face.status, "error", "FontFace should be error immediately after construction with invalid family name " + aFamilyName + " (TEST 17) (" + what + ")");
+            is(face.family, "", "FontFace.family should be the empty string after construction with invalid family name " + aFamilyName + " (TEST 17) (" + what + ")");
             return face.loaded.then(function() {
-              ok(false, "FontFace should not load after invalid family name " + aFamilyName + " specified (TEST 17) (" + win + ")");
+              ok(false, "FontFace should not load after invalid family name " + aFamilyName + " specified (TEST 17) (" + what + ")");
             }, function(aError) {
-              ok(true, "FontFace should not load after invalid family name " + aFamilyName + " specified (TEST 17) (" + win + ")");
-              is(aError.name, "SyntaxError", "FontFace.loaded with invalid family name " + aFamilyName + " should be rejected with a SyntaxError (TEST 17) (" + win + ")");
+              ok(true, "FontFace should not load after invalid family name " + aFamilyName + " specified (TEST 17) (" + what + ")");
+              is(aError.name, "SyntaxError", "FontFace.loaded with invalid family name " + aFamilyName + " should be rejected with a SyntaxError (TEST 17) (" + what + ")");
             });
           });
         });
@@ -378,16 +406,16 @@ function runTest() {
     // (TEST 18) Test passing valid url() source strings to the FontFace
     // constructor.
     var p = Promise.resolve();
-    [window, fwindow].forEach(function(win) {
+    sourceWindows.forEach(function({ win, what }) {
       p = p.then(function() {
         var srcTests = Promise.resolve();
         gCSSFontFaceDescriptors.src.values.forEach(function(aSrc) {
           srcTests = srcTests.then(function() {
             var face = new win.FontFace("test", aSrc);
             return face.load().then(function() {
-              ok(true, "FontFace should load with valid url() src " + aSrc + " (TEST 18) (" + win + ")");
+              ok(true, "FontFace should load with valid url() src " + aSrc + " (TEST 18) (" + what + ")");
             }, function(aError) {
-              is(aError.name, "NetworkError", "FontFace had NetworkError when loading with valid url() src " + aSrc + " (TEST 18) (" + win + ")");
+              is(aError.name, "NetworkError", "FontFace had NetworkError when loading with valid url() src " + aSrc + " (TEST 18) (" + what + ")");
             });
           });
         });
@@ -401,17 +429,17 @@ function runTest() {
     // (TEST 19) Test passing invalid url() source strings to the FontFace
     // constructor.
     var p = Promise.resolve();
-    [window, fwindow].forEach(function(win) {
+    sourceWindows.forEach(function({ win, what }) {
       p = p.then(function() {
         var srcTests = Promise.resolve();
         gCSSFontFaceDescriptors.src.invalid_values.forEach(function(aSrc) {
           srcTests = srcTests.then(function() {
             var face = new win.FontFace("test", aSrc);
-            is(face.status, "error", "FontFace.status should be \"error\" when constructed with an invalid url() src " + aSrc + " (TEST 19) (" + win + ")");
+            is(face.status, "error", "FontFace.status should be \"error\" when constructed with an invalid url() src " + aSrc + " (TEST 19) (" + what + ")");
             return face.loaded.then(function() {
-              ok(false, "FontFace should not load with invalid url() src " + aSrc + " (TEST 19) (" + win + ")");
+              ok(false, "FontFace should not load with invalid url() src " + aSrc + " (TEST 19) (" + what + ")");
             }, function(aError) {
-              is(aError.name, "SyntaxError", "FontFace.ready should have been rejected with a SyntaxError when constructed with an invalid url() src " + aSrc + " (TEST 19) (" + win + ")");
+              is(aError.name, "SyntaxError", "FontFace.ready should have been rejected with a SyntaxError when constructed with an invalid url() src " + aSrc + " (TEST 19) (" + what + ")");
             });
           });
         });
@@ -425,14 +453,14 @@ function runTest() {
     // (TEST 20) Test that the status of a FontFace constructed with a valid
     // ArrayBuffer source eventually becomes "loaded".
     var p = Promise.resolve();
-    [window, fwindow].forEach(function(win) {
+    sourceWindows.forEach(function({ win, what }) {
       p = p.then(function() {
         var face = new win.FontFace("test", fontData);
         return face.loaded.then(function(aFace) {
-          is(face.status, "loaded", "status of FontFace constructed with a valid ArrayBuffer source should eventually be \"loaded\" (TEST 20) (" + win + ")");
-          is(face, aFace, "FontFace.loaded was resolved with the FontFace object once loaded (TEST 20) (" + win + ")");
+          is(face.status, "loaded", "status of FontFace constructed with a valid ArrayBuffer source should eventually be \"loaded\" (TEST 20) (" + what + ")");
+          is(face, aFace, "FontFace.loaded was resolved with the FontFace object once loaded (TEST 20) (" + what + ")");
         }, function(aError) {
-          ok(false, "FontFace constructed with a valid ArrayBuffer should eventually load (TEST 20) (" + win + ")");
+          ok(false, "FontFace constructed with a valid ArrayBuffer should eventually load (TEST 20) (" + what + ")");
         });
       });
     });
@@ -443,14 +471,14 @@ function runTest() {
     // (TEST 21) Test that the status of a FontFace constructed with an invalid
     // ArrayBuffer source eventually becomes "error".
     var p = Promise.resolve();
-    [window, fwindow].forEach(function(win) {
+    sourceWindows.forEach(function({ win, what }) {
       p = p.then(function() {
         var face = new win.FontFace("test", new ArrayBuffer(0));
         return face.loaded.then(function() {
-          ok(false, "FontFace constructed with an invalid ArrayBuffer should not load (TEST 21) (" + win + ")");
+          ok(false, "FontFace constructed with an invalid ArrayBuffer should not load (TEST 21) (" + what + ")");
         }, function(aError) {
-          is(aError.name, "SyntaxError", "loaded of FontFace constructed with an invalid ArrayBuffer source should be rejected with TypeError (TEST 21) (" + win + ")");
-          is(face.status, "error", "status of FontFace constructed with an invalid ArrayBuffer source should eventually be \"error\" (TEST 21) (" + win + ")");
+          is(aError.name, "SyntaxError", "loaded of FontFace constructed with an invalid ArrayBuffer source should be rejected with TypeError (TEST 21) (" + what + ")");
+          is(face.status, "error", "status of FontFace constructed with an invalid ArrayBuffer source should eventually be \"error\" (TEST 21) (" + what + ")");
         });
       });
     });
@@ -460,7 +488,7 @@ function runTest() {
 
     // (TEST 22) Test assigning non-default descriptor values on the FontFace.
     var p = Promise.resolve();
-    [window, fwindow].forEach(function(win) {
+    sourceWindows.forEach(function({ win, what }) {
       p = p.then(function() {
         var descriptorTests = Promise.resolve();
         Object.keys(nonDefaultValues).forEach(function(aDesc) {
@@ -469,9 +497,9 @@ function runTest() {
             return face.loaded.then(function() {
               var ok_todo = aDesc == "variant" ? todo : ok;
               face[aDesc] = nonDefaultValues[aDesc][0];
-              ok_todo(face[aDesc] == nonDefaultValues[aDesc][1], "assigned valid non-default value to FontFace." + aDesc + " (TEST 22) (" + win + ")");
+              ok_todo(face[aDesc] == nonDefaultValues[aDesc][1], "assigned valid non-default value to FontFace." + aDesc + " (TEST 22) (" + what + ")");
             }, function(aError) {
-              ok(false, "FontFace should have loaded succesfully (TEST 22) (" + win + ")");
+              ok(false, "FontFace should have loaded succesfully (TEST 22) (" + what + ")");
             });
           });
         });
@@ -484,7 +512,7 @@ function runTest() {
 
     // (TEST 23) Test assigning invalid descriptor values on the FontFace.
     var p = Promise.resolve();
-    [window, fwindow].forEach(function(win) {
+    sourceWindows.forEach(function({ win, what }) {
       p = p.then(function() {
         var descriptorTests = Promise.resolve();
         Object.keys(invalidValues).forEach(function(aDesc) {
@@ -498,9 +526,9 @@ function runTest() {
               } catch (ex) {
                 exceptionName = ex.name;
               }
-              ok_todo(exceptionName == "SyntaxError", "assigning invalid value to FontFace." + aDesc + " should throw a SyntaxError (TEST 23) (" + win + ")");
+              ok_todo(exceptionName == "SyntaxError", "assigning invalid value to FontFace." + aDesc + " should throw a SyntaxError (TEST 23) (" + what + ")");
             }, function(aError) {
-              ok(false, "FontFace should have loaded succesfully (TEST 23) (" + win + ")");
+              ok(false, "FontFace should have loaded succesfully (TEST 23) (" + what + ")");
             });
           });
         });
@@ -516,18 +544,18 @@ function runTest() {
     // Promise is returned, and that the Promise is eventually rejected with a
     // NetworkError and its status is set to "error".
     var p = Promise.resolve();
-    [window, fwindow].forEach(function(win) {
+    sourceWindows.forEach(function({ win, what }) {
       p = p.then(function() {
         var face = new win.FontFace("test", "url(x)");
         var result = face.load();
-        is(face.status, "loading", "FontFace.status should be \"loading\" right after load() is called (TEST 24) (" + win + ")");
-        is(result, face.loaded, "FontFace.load() should return the .loaded Promise (TEST 24) (" + win + ")");
+        is(face.status, "loading", "FontFace.status should be \"loading\" right after load() is called (TEST 24) (" + what + ")");
+        is(result, face.loaded, "FontFace.load() should return the .loaded Promise (TEST 24) (" + what + ")");
 
         return result.then(function() {
-          ok(false, "FontFace with a non-existing url() source should not load (TEST 24) (" + win + ")");
+          ok(false, "FontFace with a non-existing url() source should not load (TEST 24) (" + what + ")");
         }, function(aError) {
-          is(aError.name, "NetworkError", "FontFace with a non-existing url() source should result in its .loaded Promise being rejected with a NetworkError (TEST 24) (" + win + ")");
-          is(face.status, "error", "FontFace with a non-existing url() source should result in its .status being set to \"error\" (TEST 24) (" + win + ")");
+          is(aError.name, "NetworkError", "FontFace with a non-existing url() source should result in its .loaded Promise being rejected with a NetworkError (TEST 24) (" + what + ")");
+          is(face.status, "error", "FontFace with a non-existing url() source should result in its .status being set to \"error\" (TEST 24) (" + what + ")");
         });
       });
     });
@@ -537,34 +565,33 @@ function runTest() {
 
     // (TEST 25) Test simple manipulation of the FontFaceSet.
     var p = Promise.resolve();
-    [window, fwindow].forEach(function(win) {
-      var doc = win.document;
+    sources.forEach(function({ win, doc, what }) {
       p = p.then(function() {
         var face, face2, all;
         face = new win.FontFace("test", "url(x)");
         face2 = new win.FontFace("test2", "url(x)");
-        ok(!doc.fonts.has(face), "newly created FontFace should not be in document.fonts (TEST 25) (" + win + ")");
+        ok(!doc.fonts.has(face), "newly created FontFace should not be in document.fonts (TEST 25) (" + what + ")");
         doc.fonts.add(face);
-        ok(doc.fonts.has(face), "should be able to add a FontFace to document.fonts (TEST 25) (" + win + ")");
+        ok(doc.fonts.has(face), "should be able to add a FontFace to document.fonts (TEST 25) (" + what + ")");
         doc.fonts.add(face);
-        ok(doc.fonts.has(face), "should be able to repeatedly add a FontFace to document.fonts (TEST 25) (" + win + ")");
-        ok(doc.fonts.delete(face), "FontFaceSet.delete should return true when it succeeds (TEST 25) (" + win + ")");
-        ok(!doc.fonts.has(face), "FontFace should be gone from document.fonts after delete is called (TEST 25) (" + win + ")");
-        ok(!doc.fonts.delete(face), "FontFaceSet.delete should return false when it fails (TEST 25) (" + win + ")");
+        ok(doc.fonts.has(face), "should be able to repeatedly add a FontFace to document.fonts (TEST 25) (" + what + ")");
+        ok(doc.fonts.delete(face), "FontFaceSet.delete should return true when it succeeds (TEST 25) (" + what + ")");
+        ok(!doc.fonts.has(face), "FontFace should be gone from document.fonts after delete is called (TEST 25) (" + what + ")");
+        ok(!doc.fonts.delete(face), "FontFaceSet.delete should return false when it fails (TEST 25) (" + what + ")");
         doc.fonts.add(face);
         doc.fonts.add(face2);
-        ok(doc.fonts.has(face2), "should be able to add a second FontFace to document.fonts (TEST 25) (" + win + ")");
+        ok(doc.fonts.has(face2), "should be able to add a second FontFace to document.fonts (TEST 25) (" + what + ")");
         doc.fonts.clear();
-        ok(!doc.fonts.has(face) && !doc.fonts.has(face2), "FontFaces should be gone from document.fonts after clear is called (TEST 25) (" + win + ")");
+        ok(!doc.fonts.has(face) && !doc.fonts.has(face2), "FontFaces should be gone from document.fonts after clear is called (TEST 25) (" + what + ")");
         doc.fonts.add(face);
         doc.fonts.add(face2);
         all = Array.from(doc.fonts);
-        is(all[0], face, "FontFaces should be returned in the same order as insertion (TEST 25) (" + win + ")");
-        is(all[1], face2, "FontFaces should be returned in the same order as insertion (TEST 25) (" + win + ")");
+        is(all[0], face, "FontFaces should be returned in the same order as insertion (TEST 25) (" + what + ")");
+        is(all[1], face2, "FontFaces should be returned in the same order as insertion (TEST 25) (" + what + ")");
         doc.fonts.add(face);
         all = Array.from(doc.fonts);
-        is(all[0], face, "FontFaces should be not be reordered when a duplicate entry is added (TEST 25) (" + win + ")");
-        is(all[1], face2, "FontFaces should be not be reordered when a duplicate entry is added (TEST 25) (" + win + ")");
+        is(all[0], face, "FontFaces should be not be reordered when a duplicate entry is added (TEST 25) (" + what + ")");
+        is(all[1], face2, "FontFaces should be not be reordered when a duplicate entry is added (TEST 25) (" + what + ")");
         doc.fonts.clear();
         return doc.fonts.ready;
       });
@@ -577,8 +604,7 @@ function runTest() {
     // "loading", and a loading event is dispatched when a loading FontFace is
     // added to it.
     var p = Promise.resolve();
-    [window, fwindow].forEach(function(win) {
-      var doc = win.document;
+    sources.forEach(function({ win, doc, what }) {
       p = p.then(function() {
         var awaitEvents = new Promise(function(aResolve, aReject) {
 
@@ -593,19 +619,19 @@ function runTest() {
           }
 
           var listener = function(aEvent) {
-            is(Object.getPrototypeOf(aEvent), win.Event.prototype, "loading event should be a plain Event object (TEST 26) (" + win + ")");
+            is(Object.getPrototypeOf(aEvent), doc.defaultView.Event.prototype, "loading event should be a plain Event object (TEST 26) (" + what + ")");
             loadingDispatched = true;
             check();
           };
           doc.fonts.addEventListener("loading", listener);
           doc.fonts.onloading = function(aEvent) {
-            is(Object.getPrototypeOf(aEvent), win.Event.prototype, "loading event should be a plain Event object (TEST 26) (" + win + ")");
+            is(Object.getPrototypeOf(aEvent), doc.defaultView.Event.prototype, "loading event should be a plain Event object (TEST 26) (" + what + ")");
             onloadingTriggered = true;
             check();
           };
         });
 
-        is(doc.fonts.status, "loaded", "FontFaceSet.status initially (TEST 26) (" + win + ")");
+        is(doc.fonts.status, "loaded", "FontFaceSet.status initially (TEST 26) (" + what + ")");
 
         var oldReady = doc.fonts.ready;
         var face = new win.FontFace("test", "url(neverending_font_load.sjs)");
@@ -613,12 +639,12 @@ function runTest() {
         doc.fonts.add(face);
 
         var newReady = doc.fonts.ready;
-        isnot(newReady, oldReady, "FontFaceSet.ready should be replaced when a loading FontFace is added to it (TEST 26) (" + win + ")");
-        is(doc.fonts.status, "loading", "FontFaceSet.status should be set to \"loading\" when a loading FontFace is added to it (TEST 26) (" + win + ")");
+        isnot(newReady, oldReady, "FontFaceSet.ready should be replaced when a loading FontFace is added to it (TEST 26) (" + what + ")");
+        is(doc.fonts.status, "loading", "FontFaceSet.status should be set to \"loading\" when a loading FontFace is added to it (TEST 26) (" + what + ")");
 
         return awaitEvents
             .then(function() {
-              return is_pending(newReady, "FontFaceSet.ready should be replaced with a fresh pending Promise when a loading FontFace is added to it", "(TEST 26) (" + win + ")");
+              return is_pending(newReady, "FontFaceSet.ready should be replaced with a fresh pending Promise when a loading FontFace is added to it", "(TEST 26) (" + what + ")");
             })
             .then(function() {
               doc.fonts.clear();
@@ -634,8 +660,7 @@ function runTest() {
     // "loaded", and a loadingdone event (but no loadingerror event) is
     // dispatched when the only loading FontFace in it is removed.
     var p = Promise.resolve();
-    [window, fwindow].forEach(function(win) {
-      var doc = win.document;
+    sources.forEach(function({ win, doc, what }) {
       p = p.then(function() {
         var awaitEvents = new Promise(function(aResolve, aReject) {
 
@@ -651,15 +676,15 @@ function runTest() {
           }
 
           var doneListener = function(aEvent) {
-            is(Object.getPrototypeOf(aEvent), win.CSSFontFaceLoadEvent.prototype, "loadingdone event should be a CSSFontFaceLoadEvent object (TEST 27) (" + win + ")");
-            is(aEvent.fontfaces.length, 0, "the CSSFontFaceLoadEvent should have an empty fontfaces array (TEST 27) (" + win + ")");
+            is(Object.getPrototypeOf(aEvent), doc.defaultView.FontFaceSetLoadEvent.prototype, "loadingdone event should be a FontFaceSetLoadEvent object (TEST 27) (" + what + ")");
+            is(aEvent.fontfaces.length, 0, "the FontFaceSetLoadEvent should have an empty fontfaces array (TEST 27) (" + what + ")");
             loadingdoneDispatched = true;
             check();
           };
           doc.fonts.addEventListener("loadingdone", doneListener);
           doc.fonts.onloadingdone = function(aEvent) {
-            is(Object.getPrototypeOf(aEvent), win.CSSFontFaceLoadEvent.prototype, "loadingdone event should be a CSSFontFaceLoadEvent object (TEST 27) (" + win + ")");
-            is(aEvent.fontfaces.length, 0, "the CSSFontFaceLoadEvent should have an empty fontfaces array (TEST 27) (" + win + ")");
+            is(Object.getPrototypeOf(aEvent), doc.defaultView.FontFaceSetLoadEvent.prototype, "loadingdone event should be a FontFaceSetLoadEvent object (TEST 27) (" + what + ")");
+            is(aEvent.fontfaces.length, 0, "the FontFaceSetLoadEvent should have an empty fontfaces array (TEST 27) (" + what + ")");
             onloadingdoneTriggered = true;
             check();
           };
@@ -674,22 +699,22 @@ function runTest() {
           };
         });
 
-        is(doc.fonts.status, "loaded", "FontFaceSet.status should be \"loaded\" initially (TEST 27) (" + win + ")");
+        is(doc.fonts.status, "loaded", "FontFaceSet.status should be \"loaded\" initially (TEST 27) (" + what + ")");
 
         var f = new win.FontFace("test", "url(neverending_font_load.sjs)");
         f.load();
         doc.fonts.add(f);
 
-        is(doc.fonts.status, "loading", "FontFaceSet.status should be \"loading\" when a loading FontFace is in it (TEST 27) (" + win + ")");
+        is(doc.fonts.status, "loading", "FontFaceSet.status should be \"loading\" when a loading FontFace is in it (TEST 27) (" + what + ")");
 
         doc.fonts.clear();
 
         return awaitEvents
             .then(function() {
-              return is_resolved_with(doc.fonts.ready, doc.fonts, "FontFaceSet.ready when the FontFaceSet is cleared", "(TEST 27) (" + win + ")");
+              return is_resolved_with(doc.fonts.ready, doc.fonts, "FontFaceSet.ready when the FontFaceSet is cleared", "(TEST 27) (" + what + ")");
             })
             .then(function() {
-              is(doc.fonts.status, "loaded", "FontFaceSet.status should be set to \"loaded\" when it is cleared (TEST 27) (" + win + ")");
+              is(doc.fonts.status, "loaded", "FontFaceSet.status should be set to \"loaded\" when it is cleared (TEST 27) (" + what + ")");
               return doc.fonts.ready;
             });
       });
@@ -702,8 +727,7 @@ function runTest() {
     // "loading", and a loading event is dispatched when a FontFace in it
     // starts loading.
     var p = Promise.resolve();
-    [window, fwindow].forEach(function(win) {
-      var doc = win.document;
+    sources.forEach(function({ win, doc, what }) {
       p = p.then(function() {
         var awaitEvents = new Promise(function(aResolve, aReject) {
 
@@ -718,13 +742,13 @@ function runTest() {
           }
 
           var listener = function(aEvent) {
-            is(Object.getPrototypeOf(aEvent), win.Event.prototype, "loading event should be a plain Event object (TEST 28) (" + win + ")");
+            is(Object.getPrototypeOf(aEvent), doc.defaultView.Event.prototype, "loading event should be a plain Event object (TEST 28) (" + what + ")");
             loadingDispatched = true;
             check();
           };
           doc.fonts.addEventListener("loading", listener);
           doc.fonts.onloading = function(aEvent) {
-            is(Object.getPrototypeOf(aEvent), win.Event.prototype, "loading event should be a plain Event object (TEST 28) (" + win + ")");
+            is(Object.getPrototypeOf(aEvent), doc.defaultView.Event.prototype, "loading event should be a plain Event object (TEST 28) (" + what + ")");
             onloadingTriggered = true;
             check();
           };
@@ -736,12 +760,12 @@ function runTest() {
         face.load();
 
         var newReady = doc.fonts.ready;
-        isnot(newReady, oldReady, "FontFaceSet.ready should be replaced when its only FontFace starts loading (TEST 28) (" + win + ")");
-        is(doc.fonts.status, "loading", "FontFaceSet.status should be set to \"loading\" when its only FontFace starts loading (TEST 28) (" + win + ")");
+        isnot(newReady, oldReady, "FontFaceSet.ready should be replaced when its only FontFace starts loading (TEST 28) (" + what + ")");
+        is(doc.fonts.status, "loading", "FontFaceSet.status should be set to \"loading\" when its only FontFace starts loading (TEST 28) (" + what + ")");
 
         return awaitEvents
             .then(function() {
-              return is_pending(newReady, "FontFaceSet.ready when the FontFaceSet's only FontFace starts loading", "(TEST 28) (" + win + ")");
+              return is_pending(newReady, "FontFaceSet.ready when the FontFaceSet's only FontFace starts loading", "(TEST 28) (" + what + ")");
             })
             .then(function() {
               doc.fonts.clear();
@@ -757,8 +781,7 @@ function runTest() {
     // when a FontFace that eventually becomes status "error" is added to the
     // FontFaceSet.
     var p = Promise.resolve();
-    [window, fwindow].forEach(function(win) {
-      var doc = win.document;
+    sources.forEach(function({ win, doc, what }) {
       p = p.then(function() {
         var face;
         var awaitEvents = new Promise(function(aResolve, aReject) {
@@ -783,14 +806,14 @@ function runTest() {
           };
           doc.fonts.addEventListener("loadingdone", doneListener);
           doc.fonts.onloadingdone = function(aEvent) {
-            is(Object.getPrototypeOf(aEvent), win.CSSFontFaceLoadEvent.prototype, "loadingdone event should be a CSSFontFaceLoadEvent object (TEST 29) (" + win + ")");
-            is(aEvent.fontfaces.length, 0, "the CSSFontFaceLoadEvent should have an empty fontfaces array (TEST 29) (" + win + ")");
+            is(Object.getPrototypeOf(aEvent), doc.defaultView.FontFaceSetLoadEvent.prototype, "loadingdone event should be a FontFaceSetLoadEvent object (TEST 29) (" + what + ")");
+            is(aEvent.fontfaces.length, 0, "the FontFaceSetLoadEvent should have an empty fontfaces array (TEST 29) (" + what + ")");
             onloadingdoneTriggered = true;
             check();
           };
           var errorListener = function(aEvent) {
-            is(Object.getPrototypeOf(aEvent), win.CSSFontFaceLoadEvent.prototype, "loadingerror event should be a CSSFontFaceLoadEvent object (TEST 29) (" + win + ")");
-            is(aEvent.fontfaces[0], face, "the CSSFontFaceLoadEvent should have a fontfaces array with the FontFace in it (TEST 29) (" + win + ")");
+            is(Object.getPrototypeOf(aEvent), doc.defaultView.FontFaceSetLoadEvent.prototype, "loadingerror event should be a FontFaceSetLoadEvent object (TEST 29) (" + what + ")");
+            is(aEvent.fontfaces[0], face, "the FontFaceSetLoadEvent should have a fontfaces array with the FontFace in it (TEST 29) (" + what + ")");
             loadingerrorDispatched = true;
             check();
           }
@@ -803,14 +826,14 @@ function runTest() {
 
         face = new win.FontFace("test", "url(x)");
         face.load();
-        is(face.status, "loading", "FontFace should have status \"loading\" (TEST 29) (" + win + ")");
+        is(face.status, "loading", "FontFace should have status \"loading\" (TEST 29) (" + what + ")");
         doc.fonts.add(face);
 
         return face.loaded
           .then(function() {
-            ok(false, "the FontFace should not load (TEST 29) (" + win + ")");
+            ok(false, "the FontFace should not load (TEST 29) (" + what + ")");
           }, function(aError) {
-            is(face.status, "error", "FontFace should have status \"error\" (TEST 29) (" + win + ")");
+            is(face.status, "error", "FontFace should have status \"error\" (TEST 29) (" + what + ")");
             return awaitEvents;
           })
           .then(function() {
@@ -826,8 +849,7 @@ function runTest() {
     // (TEST 30) Test that a loadingdone event is dispatched when a FontFace
     // that eventually becomes status "loaded" is added to the FontFaceSet.
     var p = Promise.resolve();
-    [window, fwindow].forEach(function(win, i) {
-      var doc = win.document;
+    sources.forEach(function({ win, doc, what }, i) {
       p = p.then(function() {
         var face;
         var awaitEvents = new Promise(function(aResolve, aReject) {
@@ -848,7 +870,7 @@ function runTest() {
           };
           doc.fonts.addEventListener("loadingdone", doneListener);
           doc.fonts.onloadingdone = function(aEvent) {
-            is(aEvent.fontfaces[0], face, "the CSSFontFaceLoadEvent should have a fontfaces array with the FontFace in it (TEST 30) (" + win + ")");
+            is(aEvent.fontfaces[0], face, "the FontFaceSetLoadEvent should have a fontfaces array with the FontFace in it (TEST 30) (" + what + ")");
             onloadingdoneTriggered = true;
             check();
           };
@@ -856,12 +878,12 @@ function runTest() {
 
         face = new win.FontFace("test", "url(BitPattern.woff?test30." + i + ")");
         face.load();
-        is(face.status, "loading", "FontFace should have status \"loading\" (TEST 30) (" + win + ")");
+        is(face.status, "loading", "FontFace should have status \"loading\" (TEST 30) (" + what + ")");
         doc.fonts.add(face);
 
         return face.loaded
           .then(function() {
-            is(face.status, "loaded", "FontFace should have status \"loaded\" (TEST 30) (" + win + ")");
+            is(face.status, "loaded", "FontFace should have status \"loaded\" (TEST 30) (" + what + ")");
             return awaitEvents;
           })
           .then(function() {
@@ -877,8 +899,7 @@ function runTest() {
     // with status "unloaded" is added to the FontFaceSet and load() is called
     // on it.
     var p = Promise.resolve();
-    [window, fwindow].forEach(function(win, i) {
-      var doc = win.document;
+    sources.forEach(function({ win, doc, what }, i) {
       p = p.then(function() {
         var face;
         var awaitEvents = new Promise(function(aResolve, aReject) {
@@ -899,14 +920,14 @@ function runTest() {
           };
           doc.fonts.addEventListener("loadingdone", doneListener);
           doc.fonts.onloadingdone = function(aEvent) {
-            is(aEvent.fontfaces[0], face, "the CSSFontFaceLoadEvent should have a fontfaces array with the FontFace in it (TEST 31) (" + win + ")");
+            is(aEvent.fontfaces[0], face, "the FontFaceSetLoadEvent should have a fontfaces array with the FontFace in it (TEST 31) (" + what + ")");
             onloadingdoneTriggered = true;
             check();
           };
         });
 
         face = new win.FontFace("test", "url(BitPattern.woff?test31." + i + ")");
-        is(face.status, "unloaded", "FontFace should have status \"unloaded\" (TEST 31) (" + win + ")");
+        is(face.status, "unloaded", "FontFace should have status \"unloaded\" (TEST 31) (" + what + ")");
         doc.fonts.add(face);
 
         return face.load()
@@ -914,7 +935,7 @@ function runTest() {
               return awaitEvents;
             })
             .then(function() {
-              is(face.status, "loaded", "FontFace should have status \"loaded\" (TEST 31) (" + win + ")");
+              is(face.status, "loaded", "FontFace should have status \"loaded\" (TEST 31) (" + what + ")");
               doc.fonts.clear();
               return doc.fonts.ready;
             });
@@ -1023,81 +1044,30 @@ function runTest() {
 
     style.textContent = "";
 
-  }).then(function() {
-
-    // (TEST 34) Test that descriptor getters for unspecified descriptors on
-    // CSS-connected FontFace objects return their default values.
-    var style = document.querySelector("style");
-    var ruleText = "@font-face { font-family: something; src: url(x); }";
-
-    style.textContent = ruleText;
-
-    var all = Array.from(document.fonts);
-    var face = all[0];
-
-    Object.keys(defaultValues).forEach(function(aDesc) {
-      is(face[aDesc], defaultValues[aDesc], "FontFace should return default value for " + aDesc + " (TEST 34)");
-    });
-
-    style.textContent = "";
-
-  }).then(function() {
-
-    // (TEST LAST) Test that a pending style sheet load prevents
-    // document.fonts.status from being set to "loaded".
-
-    // First, add a FontFace to document.fonts that will load soon.
-    var face = new FontFace("test", "url(BitPattern.woff?testlast)");
-    face.load();
-    document.fonts.add(face);
-
-    // Next, add a style sheet reference.
-    var link = document.createElement("link");
-    link.rel = "stylesheet";
-    link.href = "neverending_stylesheet_load.sjs";
-    link.type = "text/css";
-    document.head.appendChild(link);
-
-    return setTimeoutZero()  // wait for the style sheet to start loading
-        .then(function() {
-          document.fonts.clear();
-          is(document.fonts.status, "loading", "FontFaceSet.status when the FontFaceSet has been cleared of loading FontFaces but there is a pending style sheet load (TEST LAST)");
-          document.head.removeChild(link);
-          // XXX Removing the <link> element won't cancel the load of the
-          // style sheet, so we can't do that to test that
-          // document.fonts.ready is resolved once there are no more
-          // loading style sheets.
-        });
-
-    // NOTE: It is important that this style sheet test comes last in the file,
-    // as the neverending style sheet load will interfere with subsequent
-    // sub-tests.
-
   }).then(function() {
 
     // (TEST 35) Test that no loadingdone event is dispatched when a FontFace
     // with "loaded" status is added to a "loaded" FontFaceSet.
     var p = Promise.resolve();
-    [window, fwindow].forEach(function(win) {
-      var doc = win.document;
+    sources.forEach(function({ win, doc, what }) {
       p = p.then(function() {
         var gotLoadingDone = false;
         doc.fonts.onloadingdone = function(aEvent) {
           gotLoadingDone = true;
         };
 
-        is(doc.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" (TEST 35) (" + win + ")");
+        is(doc.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" (TEST 35) (" + what + ")");
         var face = new win.FontFace("test", fontData);
 
         return face.loaded
           .then(function() {
-            is(face.status, "loaded", "FontFace should have status \"loaded\" (TEST 35) (" + win + ")");
+            is(face.status, "loaded", "FontFace should have status \"loaded\" (TEST 35) (" + what + ")");
             doc.fonts.add(face);
-            is(doc.fonts.status, "loaded", "document.fonts.status should still have status \"loaded\" (TEST 35) (" + win + ")");
+            is(doc.fonts.status, "loaded", "document.fonts.status should still have status \"loaded\" (TEST 35) (" + what + ")");
             return doc.fonts.ready;
           })
           .then(function() {
-            ok(!gotLoadingDone, "loadingdone event should not be dispatched (TEST 35) (" + win + ")");
+            ok(!gotLoadingDone, "loadingdone event should not be dispatched (TEST 35) (" + what + ")");
             doc.fonts.onloadingdone = null;
             doc.fonts.clear();
           });
@@ -1110,7 +1080,7 @@ function runTest() {
     // (TEST 36) Test that no loadingdone or loadingerror event is dispatched
     // when a FontFace with "error" status is added to a "loaded" FontFaceSet.
     var p = Promise.resolve();
-    [window, fwindow].forEach(function(win) {
+    sources.forEach(function({ win, doc, what }) {
       var doc = win.document;
       p = p.then(function() {
         var gotLoadingDone = false, gotLoadingError = false;
@@ -1121,21 +1091,21 @@ function runTest() {
           gotLoadingError = true;
         };
 
-        is(doc.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" (TEST 36) (" + win + ")");
+        is(doc.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" (TEST 36) (" + what + ")");
         var face = new win.FontFace("test", new ArrayBuffer(0));
 
         return face.loaded
           .then(function() {
-            ok(false, "FontFace should not have loaded (TEST 36) (" + win + ")");
+            ok(false, "FontFace should not have loaded (TEST 36) (" + what + ")");
           }, function() {
-            is(face.status, "error", "FontFace should have status \"error\" (TEST 36) (" + win + ")");
+            is(face.status, "error", "FontFace should have status \"error\" (TEST 36) (" + what + ")");
             doc.fonts.add(face);
-            is(doc.fonts.status, "loaded", "document.fonts.status should still have status \"loaded\" (TEST 36) (" + win + ")");
+            is(doc.fonts.status, "loaded", "document.fonts.status should still have status \"loaded\" (TEST 36) (" + what + ")");
             return doc.fonts.ready;
           })
           .then(function() {
-            ok(!gotLoadingDone, "loadingdone event should not be dispatched (TEST 36) (" + win + ")");
-            ok(!gotLoadingError, "loadingerror event should not be dispatched (TEST 36) (" + win + ")");
+            ok(!gotLoadingDone, "loadingdone event should not be dispatched (TEST 36) (" + what + ")");
+            ok(!gotLoadingError, "loadingerror event should not be dispatched (TEST 36) (" + what + ")");
             doc.fonts.onloadingdone = null;
             doc.fonts.onloadingerror = null;
             doc.fonts.clear();
@@ -1150,8 +1120,7 @@ function runTest() {
     // at the FontFaceSet containing it.
 
     var p = Promise.resolve();
-    [window, fwindow].forEach(function(win, i) {
-      var doc = win.document;
+    sources.forEach(function({ win, doc, what}, i) {
       p = p.then(function() {
         var events = [], face, face2;
 
@@ -1162,37 +1131,37 @@ function runTest() {
           events.push(e);
         };
 
-        is(doc.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" (TEST 37) (" + win + ")");
+        is(doc.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" (TEST 37) (" + what + ")");
 
         face = new win.FontFace("test", "url(BitPattern.woff?test37." + i + "a)");
         face.load();
         doc.fonts.add(face);
-        is(doc.fonts.status, "loading", "document.fonts.status should have status \"loading\" after first font added (TEST 37) (" + win + ")");
+        is(doc.fonts.status, "loading", "document.fonts.status should have status \"loading\" after first font added (TEST 37) (" + what + ")");
 
         return doc.fonts.ready
           .then(function() {
-            is(doc.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" after first font loaded (TEST 37) (" + win + ")");
-            is(face.status, "loaded", "first FontFace should have status \"loaded\" (TEST 37) (" + win + ")");
+            is(doc.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" after first font loaded (TEST 37) (" + what + ")");
+            is(face.status, "loaded", "first FontFace should have status \"loaded\" (TEST 37) (" + what + ")");
 
             face2 = new win.FontFace("test2", "url(BitPattern.woff?test37." + i + "b)");
             face2.load();
             doc.fonts.add(face2);
-            is(doc.fonts.status, "loading", "document.fonts.status should have status \"loading\" after second font added (TEST 37) (" + win + ")");
+            is(doc.fonts.status, "loading", "document.fonts.status should have status \"loading\" after second font added (TEST 37) (" + what + ")");
 
             return doc.fonts.ready;
           }).then(function() {
-            is(doc.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" after second font loaded (TEST 37) (" + win + ")");
-            is(face2.status, "loaded", "second FontFace should have status \"loaded\" (TEST 37) (" + win + ")");
+            is(doc.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" after second font loaded (TEST 37) (" + what + ")");
+            is(face2.status, "loaded", "second FontFace should have status \"loaded\" (TEST 37) (" + what + ")");
 
-            is(events.length, 2, "should receive two events (TEST 37) (" + win + ")");
+            is(events.length, 2, "should receive two events (TEST 37) (" + what + ")");
 
-            is(events[0].type, "loadingdone", "first event should be \"loadingdone\" (TEST 37) (" + win + ")");
-            is(events[0].fontfaces.length, 1, "first event should have 1 FontFace (TEST 37) (" + win + ")");
+            is(events[0].type, "loadingdone", "first event should be \"loadingdone\" (TEST 37) (" + what + ")");
+            is(events[0].fontfaces.length, 1, "first event should have 1 FontFace (TEST 37) (" + what + ")");
             is(events[0].fontfaces[0], face, "first event should have the first FontFace");
 
-            is(events[1].type, "loadingdone", "second event should be \"loadingdone\" (TEST 37) (" + win + ")");
-            is(events[1].fontfaces.length, 1, "second event should only have 1 FontFace (TEST 37) (" + win + ")");
-            is(events[1].fontfaces[0], face2, "second event should have the second FontFace (TEST 37) (" + win + ")");
+            is(events[1].type, "loadingdone", "second event should be \"loadingdone\" (TEST 37) (" + what + ")");
+            is(events[1].fontfaces.length, 1, "second event should only have 1 FontFace (TEST 37) (" + what + ")");
+            is(events[1].fontfaces[0], face2, "second event should have the second FontFace (TEST 37) (" + what + ")");
 
             doc.fonts.onloadingdone = null;
             doc.fonts.onloadingerror = null;
@@ -1209,8 +1178,7 @@ function runTest() {
     // at the FontFaceSet containing it.
 
     var p = Promise.resolve();
-    [window, fwindow].forEach(function(win) {
-      var doc = win.document;
+    sources.forEach(function({ win, doc, what }) {
       p = p.then(function() {
         var events = [], face, face2;
 
@@ -1221,42 +1189,42 @@ function runTest() {
           events.push(e);
         };
 
-        is(doc.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" (TEST 38) (" + win + ")");
+        is(doc.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" (TEST 38) (" + what + ")");
 
         face = new win.FontFace("test", "url(x)");
         face.load();
         doc.fonts.add(face);
-        is(doc.fonts.status, "loading", "document.fonts.status should have status \"loading\" after first font added (TEST 38) (" + win + ")");
+        is(doc.fonts.status, "loading", "document.fonts.status should have status \"loading\" after first font added (TEST 38) (" + what + ")");
 
         return doc.fonts.ready
           .then(function() {
-            is(doc.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" after first font failed to load (TEST 38) (" + win + ")");
-            is(face.status, "error", "first FontFace should have status \"error\" (TEST 38) (" + win + ")");
+            is(doc.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" after first font failed to load (TEST 38) (" + what + ")");
+            is(face.status, "error", "first FontFace should have status \"error\" (TEST 38) (" + what + ")");
 
             face2 = new win.FontFace("test2", "url(x)");
             face2.load();
             doc.fonts.add(face2);
-            is(doc.fonts.status, "loading", "document.fonts.status should have status \"loading\" after second font added (TEST 38) (" + win + ")");
+            is(doc.fonts.status, "loading", "document.fonts.status should have status \"loading\" after second font added (TEST 38) (" + what + ")");
 
             return doc.fonts.ready;
           }).then(function() {
-            is(doc.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" after second font failed to load (TEST 38) (" + win + ")");
-            is(face2.status, "error", "second FontFace should have status \"error\" (TEST 38) (" + win + ")");
+            is(doc.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" after second font failed to load (TEST 38) (" + what + ")");
+            is(face2.status, "error", "second FontFace should have status \"error\" (TEST 38) (" + what + ")");
 
-            is(events.length, 4, "should receive four events (TEST 38) (" + win + ")");
+            is(events.length, 4, "should receive four events (TEST 38) (" + what + ")");
 
-            is(events[0].type, "loadingdone", "first event should be \"loadingdone\" (TEST 38) (" + win + ")");
-            is(events[0].fontfaces.length, 0, "first event should have no FontFaces (TEST 38) (" + win + ")");
+            is(events[0].type, "loadingdone", "first event should be \"loadingdone\" (TEST 38) (" + what + ")");
+            is(events[0].fontfaces.length, 0, "first event should have no FontFaces (TEST 38) (" + what + ")");
 
-            is(events[1].type, "loadingerror", "second event should be \"loadingerror\" (TEST 38) (" + win + ")");
-            is(events[1].fontfaces.length, 1, "second event should have 1 FontFace (TEST 38) (" + win + ")");
+            is(events[1].type, "loadingerror", "second event should be \"loadingerror\" (TEST 38) (" + what + ")");
+            is(events[1].fontfaces.length, 1, "second event should have 1 FontFace (TEST 38) (" + what + ")");
             is(events[1].fontfaces[0], face, "second event should have the first FontFace");
 
-            is(events[2].type, "loadingdone", "third event should be \"loadingdone\" (TEST 38) (" + win + ")");
-            is(events[2].fontfaces.length, 0, "third event should have no FontFaces (TEST 38) (" + win + ")");
+            is(events[2].type, "loadingdone", "third event should be \"loadingdone\" (TEST 38) (" + what + ")");
+            is(events[2].fontfaces.length, 0, "third event should have no FontFaces (TEST 38) (" + what + ")");
 
-            is(events[3].type, "loadingerror", "third event should be \"loadingerror\" (TEST 38) (" + win + ")");
-            is(events[3].fontfaces.length, 1, "third event should only have 1 FontFace (TEST 38) (" + win + ")");
+            is(events[3].type, "loadingerror", "third event should be \"loadingerror\" (TEST 38) (" + what + ")");
+            is(events[3].fontfaces.length, 1, "third event should only have 1 FontFace (TEST 38) (" + what + ")");
             is(events[3].fontfaces[0], face2, "third event should have the second FontFace");
 
             doc.fonts.onloadingdone = null;
@@ -1376,9 +1344,7 @@ function runTest() {
     // time to a FontFaceSet (where none of the FontFace objects are reflecting
     // an @font-face rule) will be ignored.
 
-    [window, fwindow].forEach(function(win) {
-      var doc = win.document;
-
+    sources.forEach(function({ win, doc, what }) {
       // Add a couple of non-connected FontFace objects.
       var f1 = new win.FontFace("test1", "url(x)");
       var f2 = new win.FontFace("test2", "url(x)");
@@ -1388,65 +1354,96 @@ function runTest() {
 
       var all = Array.from(doc.fonts);
 
-      is(all.length, 2, "number of FontFace objects in the FontFaceSet before duplicate add (TEST 41) (" + win + ")");
-      is(all[0], f1, "first non-connected FontFace object in the FontFaceSet before duplicate add (TEST 41) (" + win + ")");
-      is(all[1], f2, "second non-connected FontFace object in the FontFaceSet before duplicate add (TEST 41) (" + win + ")");
+      is(all.length, 2, "number of FontFace objects in the FontFaceSet before duplicate add (TEST 41) (" + what + ")");
+      is(all[0], f1, "first non-connected FontFace object in the FontFaceSet before duplicate add (TEST 41) (" + what + ")");
+      is(all[1], f2, "second non-connected FontFace object in the FontFaceSet before duplicate add (TEST 41) (" + what + ")");
 
       doc.fonts.add(f1);
 
       all = Array.from(doc.fonts);
-      is(all.length, 2, "number of FontFace objects in the FontFaceSet after duplicate add (TEST 41) (" + win + ")");
-      is(all[0], f1, "first non-connected FontFace object in the FontFaceSet after duplicate add (TEST 41) (" + win + ")");
-      is(all[1], f2, "second non-connected FontFace object in the FontFaceSet after duplicate add (TEST 41) (" + win + ")");
+      is(all.length, 2, "number of FontFace objects in the FontFaceSet after duplicate add (TEST 41) (" + what + ")");
+      is(all[0], f1, "first non-connected FontFace object in the FontFaceSet after duplicate add (TEST 41) (" + what + ")");
+      is(all[1], f2, "second non-connected FontFace object in the FontFaceSet after duplicate add (TEST 41) (" + what + ")");
 
       doc.fonts.clear();
     });
 
+  }).then(function() {
+
+    // (TEST 42) Test that adding a FontFace to multiple FontFaceSets and then
+    // loading it updates the status of all FontFaceSets.
+
+    var face = new FontFace("test", "url(x)");
+
+    sourceDocuments.forEach(function({ doc, what }) {
+      doc.fonts.add(face);
+    });
+
+    sourceDocuments.forEach(function({ doc, what }) {
+      is(doc.fonts.status, "loaded", what + ".fonts.status before loading (TEST 42)");
+    });
+
+    face.load();
+
+    sourceDocuments.forEach(function({ doc, what }) {
+      is(doc.fonts.status, "loading", what + ".fonts.status after loading started (TEST 42)");
+    });
+
+    return Promise.all(sourceDocuments.map(function({ doc }) { return doc.fonts.ready; }))
+      .then(function() {
+        is(face.status, "error", "FontFace.status after loading finished (TEST 42)");
+        sourceDocuments.forEach(function({ doc, what }) {
+          is(doc.fonts.status, "loaded", what + ".fonts.status after loading finished (TEST 42)");
+        });
+
+        sourceDocuments.forEach(function({ doc, what }) {
+          doc.fonts.clear();
+        });
+      });
+
   }).then(function() {
 
     // (TEST 43) Test the check method with platform fonts and some
     // degenerate cases.
 
-    [window, fwindow].forEach(function(win) {
-      var doc = win.document;
-
+    sourceDocuments.forEach(function({ doc, what }) {
       // Invalid font shorthands should throw a SyntaxError.
       try {
         doc.fonts.check("Helvetica");
-        ok(false, "check should throw when a syntactically invalid font shorthand is given (TEST 43) (" + win + ")");
+        ok(false, "check should throw when a syntactically invalid font shorthand is given (TEST 43) (" + what + ")");
       } catch (ex) {
-        is(ex.name, "SyntaxError", "exception name when check is called with a syntactically invalid font shorthand (TEST 43) (" + win + ")");
+        is(ex.name, "SyntaxError", "exception name when check is called with a syntactically invalid font shorthand (TEST 43) (" + what + ")");
       }
 
       // System fonts should throw a SyntaxError.
       try {
         doc.fonts.check("caption");
-        ok(false, "check should throw when a system font value is given (TEST 43) (" + win + ")");
+        ok(false, "check should throw when a system font value is given (TEST 43) (" + what + ")");
       } catch (ex) {
-        is(ex.name, "SyntaxError", "exception name when check is called with a system font value (TEST 43) (" + win + ")");
+        is(ex.name, "SyntaxError", "exception name when check is called with a system font value (TEST 43) (" + what + ")");
       }
 
       // CSS-wide keywords should throw a SyntaxError.
       try {
         doc.fonts.check("inherit");
-        ok(false, "check should throw when a CSS-wide keyword is given (TEST 43) (" + win + ")");
+        ok(false, "check should throw when a CSS-wide keyword is given (TEST 43) (" + what + ")");
       } catch (ex) {
-        is(ex.name, "SyntaxError", "exception name when check is called with a CSS-wide keyword (TEST 43) (" + win + ")");
+        is(ex.name, "SyntaxError", "exception name when check is called with a CSS-wide keyword (TEST 43) (" + what + ")");
       }
 
       // CSS variables should throw a SyntaxError.
       try {
         doc.fonts.check("16px var(--family)");
-        ok(false, "check should throw when CSS variables are used (TEST 43) (" + win + ")");
+        ok(false, "check should throw when CSS variables are used (TEST 43) (" + what + ")");
       } catch (ex) {
-        is(ex.name, "SyntaxError", "exception name when check is called with CSS variables (TEST 43) (" + win + ")");
+        is(ex.name, "SyntaxError", "exception name when check is called with CSS variables (TEST 43) (" + what + ")");
       }
 
       // No matching font family names => return true.
-      is(doc.fonts.check("16px NonExistentFont1, NonExistentFont2"), true, "check return value when no matching font family names are used (TEST 43) (" + win + ")");
+      is(doc.fonts.check("16px NonExistentFont1, NonExistentFont2"), true, "check return value when no matching font family names are used (TEST 43) (" + what + ")");
 
       // Matching platform font family name => return true.
-      is(doc.fonts.check("16px NonExistentFont, " + likelyPlatformFonts), true, "check return value when a matching platform font family name is used (TEST 43) (" + win + ")");
+      is(doc.fonts.check("16px NonExistentFont, " + likelyPlatformFonts), true, "check return value when a matching platform font family name is used (TEST 43) (" + what + ")");
 
       // Matching platform font family name, but using a different test
       // strings.  (Platform fonts always return true from check, regardless
@@ -1457,14 +1454,14 @@ function runTest() {
         { test: "A",   desc: "a matching glyph" },
         { test: "AB",  desc: "multiple matching glyphs" }
       ].forEach(function({ test, desc }) {
-        is(doc.fonts.check("16px " + likelyPlatformFonts, test), true, "check return value when a matching platform font family name is used but with " + desc + " (TEST 43) (" + win + ")");
+        is(doc.fonts.check("16px " + likelyPlatformFonts, test), true, "check return value when a matching platform font family name is used but with " + desc + " (TEST 43) (" + what + ")");
       });
 
       // No matching font family name, but an empty test string.
-      is(doc.fonts.check("16px NonExistentFont", ""), true, "check return value with a non-matching font family name and an empty test string (TEST 43) (" + win + ")");
+      is(doc.fonts.check("16px NonExistentFont", ""), true, "check return value with a non-matching font family name and an empty test string (TEST 43) (" + what + ")");
 
       // Matching platform font family name, but empty test string.
-      is(doc.fonts.check("16px " + likelyPlatformFonts, ""), true, "check return value with an empty test string (TEST 43) (" + win + ")");
+      is(doc.fonts.check("16px " + likelyPlatformFonts, ""), true, "check return value with an empty test string (TEST 43) (" + what + ")");
     });
 
   }).then(function() {
@@ -1510,9 +1507,7 @@ function runTest() {
       { result: true,  font: "16px Test", faces: [{ family: "Test", status: "loaded", unicodeRange: "U+61" }, { family: "Test", status: "loaded", unicodeRange: "U+62" }] },
     ];
 
-    [window, fwindow].forEach(function(win, i) {
-      var doc = win.document;
-
+    sources.forEach(function({ win, doc, what }, i) {
       tests.forEach(function({ result, font, faces }, j) {
         faces.forEach(function(f, k) {
           var fontFace;
@@ -1526,10 +1521,10 @@ function runTest() {
               fontFace.load();
             }
           }
-          is(fontFace.status, f.status, "status of newly created FontFace " + [j, k] + " (TEST 44) (" + win + ")");
+          is(fontFace.status, f.status, "status of newly created FontFace " + [j, k] + " (TEST 44) (" + what + ")");
           doc.fonts.add(fontFace);
         });
-        is(doc.fonts.check(font, "ab"), result, "check return value for subtest " + j + " (TEST 44) (" + win + ")");
+        is(doc.fonts.check(font, "ab"), result, "check return value for subtest " + j + " (TEST 44) (" + what + ")");
         doc.fonts.clear();
       });
     });
@@ -1540,56 +1535,54 @@ function runTest() {
     // degenerate cases.
 
     var p = Promise.resolve();
-    [window, fwindow].forEach(function(win, i) {
-      var doc = win.document;
-
+    sources.forEach(function({ win, doc, what }) {
       p = p.then(function() {
         // Invalid font shorthands should reject the promise with a SyntaxError.
         return doc.fonts.load("Helvetica").then(function() {
-          ok(false, "load should reject when a syntactically invalid font shorthand is given (TEST 45) (" + win + ")");
+          ok(false, "load should reject when a syntactically invalid font shorthand is given (TEST 45) (" + what + ")");
         }, function(ex) {
-          is(ex.name, "SyntaxError", "exception name when load is called with a syntactically invalid font shorthand (TEST 45) (" + win + ")");
+          is(ex.name, "SyntaxError", "exception name when load is called with a syntactically invalid font shorthand (TEST 45) (" + what + ")");
         });
       });
 
       p = p.then(function() {
         // System fonts should reject with a SyntaxError.
         return doc.fonts.load("caption").then(function() {
-          ok(false, "load should throw when a system font value is given (TEST 45) (" + win + ")");
+          ok(false, "load should throw when a system font value is given (TEST 45) (" + what + ")");
         }, function(ex) {
-          is(ex.name, "SyntaxError", "exception name when load is called with a system font value (TEST 45) (" + win + ")");
+          is(ex.name, "SyntaxError", "exception name when load is called with a system font value (TEST 45) (" + what + ")");
         });
       });
 
       p = p.then(function() {
         // CSS-wide keywords should reject with a SyntaxError.
         return doc.fonts.load("inherit").then(function() {
-          ok(false, "load should throw when a CSS-wide keyword is given (TEST 45) (" + win + ")");
+          ok(false, "load should throw when a CSS-wide keyword is given (TEST 45) (" + what + ")");
         }, function(ex) {
-          is(ex.name, "SyntaxError", "exception name when load is called with a CSS-wide keyword (TEST 45) (" + win + ")");
+          is(ex.name, "SyntaxError", "exception name when load is called with a CSS-wide keyword (TEST 45) (" + what + ")");
         });
       });
 
       p = p.then(function() {
         // CSS variables should throw a SyntaxError.
         return doc.fonts.load("16px var(--family)").then(function() {
-          ok(false, "load should throw when CSS variables are used (TEST 45) (" + win + ")");
+          ok(false, "load should throw when CSS variables are used (TEST 45) (" + what + ")");
         }, function(ex) {
-          is(ex.name, "SyntaxError", "exception name when load is called with CSS variables (TEST 45) (" + win + ")");
+          is(ex.name, "SyntaxError", "exception name when load is called with CSS variables (TEST 45) (" + what + ")");
         });
       });
 
       p = p.then(function() {
         // No matching font family names => return true.
         return doc.fonts.load("16px NonExistentFont1, NonExistentFont2").then(function(result) {
-          is(result.length, 0, "load resolves with an emtpy array when no matching font family names are used (TEST 45) (" + win + ")");
+          is(result.length, 0, "load resolves with an emtpy array when no matching font family names are used (TEST 45) (" + what + ")");
         });
       });
 
       p = p.then(function() {
         // Matching platform font family name => return true.
         return doc.fonts.load("16px NonExistentFont1, " + likelyPlatformFonts).then(function(result) {
-          is(result.length, 0, "load resolves with an emtpy array when no matching font family names are used (TEST 45) (" + win + ")");
+          is(result.length, 0, "load resolves with an emtpy array when no matching font family names are used (TEST 45) (" + what + ")");
         });
       });
 
@@ -1604,7 +1597,7 @@ function runTest() {
       ].forEach(function({ sample, desc }) {
         p = p.then(function() {
           return doc.fonts.load("16px " + likelyPlatformFonts, sample).then(function(result) {
-            is(result.length, 0, "load resolves with an empty array when a matching platform font family name is used but with " + desc + " (TEST 45) (" + win + ")");
+            is(result.length, 0, "load resolves with an empty array when a matching platform font family name is used but with " + desc + " (TEST 45) (" + what + ")");
           });
         });
       });
@@ -1612,14 +1605,14 @@ function runTest() {
       p = p.then(function() {
         // No matching font family name, but an empty test string.
         return doc.fonts.load("16px NonExistentFont", "").then(function(result) {
-          is(result.length, 0, "load resolves with an empty array when a non-matching platform font family name and an empty test string is used (TEST 45) (" + win + ")");
+          is(result.length, 0, "load resolves with an empty array when a non-matching platform font family name and an empty test string is used (TEST 45) (" + what + ")");
         });
       });
 
       p = p.then(function() {
         // Matching font family name, but an empty test string.
         return doc.fonts.load("16px " + likelyPlatformFonts, "").then(function(result) {
-          is(result.length, 0, "load resolves with an empty array when a matching platform font family name and an empty test string is used (TEST 45) (" + win + ")");
+          is(result.length, 0, "load resolves with an empty array when a matching platform font family name and an empty test string is used (TEST 45) (" + what + ")");
         });
       });
     });
@@ -1673,9 +1666,7 @@ function runTest() {
     ];
 
     var p = Promise.resolve();
-    [window, fwindow].forEach(function(win, i) {
-      var doc = win.document;
-
+    sources.forEach(function({ win, doc, what }, i) {
       tests.forEach(function({ result, font, faces }, j) {
         p = p.then(function() {
           var fontFaces = [];
@@ -1691,25 +1682,25 @@ function runTest() {
                 fontFace.load();
               }
             }
-            is(fontFace.status, f.status, "status of newly created FontFace " + [j, k] + " (TEST 46) (" + win + ")");
+            is(fontFace.status, f.status, "status of newly created FontFace " + [j, k] + " (TEST 46) (" + what + ")");
             doc.fonts.add(fontFace);
             fontFaces.push(fontFace);
           });
           return doc.fonts.load(font, "ab").then(function(array) {
-            ok(result, "load should resolve for subtest " + j + " (TEST 46) (" + win + ")");
+            ok(result, "load should resolve for subtest " + j + " (TEST 46) (" + what + ")");
             var expected = [];
             for (var k = 0; k < faces.length; k++) {
               if (faces[k].included) {
                 expected.push(fontFaces[k]);
               }
             }
-            is(array.length, expected.length, "length of array load resolves with for subtest " + j + " (TEST 46) (" + win + ")");
+            is(array.length, expected.length, "length of array load resolves with for subtest " + j + " (TEST 46) (" + what + ")");
             for (var k = 0; k < array.length; k++) {
-              is(array[k], expected[k], "value in array[" + k + "] load resolves with for subtest " + j + " (TEST 46) (" + win + ")");
+              is(array[k], expected[k], "value in array[" + k + "] load resolves with for subtest " + j + " (TEST 46) (" + what + ")");
             }
           }, function(ex) {
-            ok(!result, "load should not resolve for subtest " + j + " (TEST 46) (" + win + ")");
-            is(ex.name, "SyntaxError", "exception load's return value is rejected with for subtest " + j + " (TEST 46) (" + win + ")");
+            ok(!result, "load should not resolve for subtest " + j + " (TEST 46) (" + what + ")");
+            is(ex.name, "SyntaxError", "exception load's return value is rejected with for subtest " + j + " (TEST 46) (" + what + ")");
           }).then(function() {
             doc.fonts.clear();
           });
@@ -1718,6 +1709,140 @@ function runTest() {
     });
     return p;
 
+  }).then(function() {
+
+    // (TEST 47) Test that CSS-connected FontFaces can't be added to other
+    // FontFaceSets.
+
+    var style = document.querySelector("style");
+    style.textContent = "@font-face { font-family: something; src: url(x); }";
+
+    var rule = style.sheet.cssRules[0];
+
+    var all = Array.from(document.fonts);
+    is(all.length, 1, "document.fonts should contain one FontFace (TEST 47)");
+
+    var face = all[0];
+
+    sourceDocuments.forEach(function({ doc, what }) {
+      if (doc == document) {
+        return;
+      }
+
+      var exceptionName;
+      try {
+        doc.fonts.add(face);
+        ok(false, "add should throw when attempting to add a CSS-connected FontFace to another FontFaceSet (TEST 47) (" + what + ")");
+      } catch (ex) {
+        is(ex.name, "InvalidModificationError", "exception name when add is called with a CSS-connected FontFace from another FontFaceSet (TEST 47) (" + what + ")");
+      }
+    });
+
+    style.textContent = "";
+    document.body.offsetTop;
+
+    sourceDocuments.forEach(function({ doc, what }) {
+      if (doc == document) {
+        return;
+      }
+
+      ok(!doc.fonts.has(face), "FontFaceSet initially doesn't have the FontFace (TEST 47) (" + what + ")");
+      doc.fonts.add(face);
+      ok(doc.fonts.has(face), "add should allow a previously CSS-connected FontFace to be added to another FontFaceSet (TEST 47) (" + what + ")");
+      doc.fonts.clear();
+    });
+
+    document.fonts.clear();
+
+  }).then(function() {
+
+    // (TEST 48) Test that FontFaceSets that hold a combination of FontFaces
+    // from different documents expose the right set of FontFaces.
+
+    // Expected FontFaceSet contents.
+    var expected = {
+      document: [],
+      vdocument: [],
+      ndocument: [],
+    };
+
+    // Create a CSS-connected FontFace in the top-level document.
+    var style = document.querySelector("style");
+    style.textContent = "@font-face { font-family: something; src: url(x); }";
+
+    var all = Array.from(document.fonts);
+    is(all.length, 1, "document.fonts should contain one FontFace (TEST 48)");
+
+    all[0]._description = "CSS-connected in document";
+    expected.document.push(all[0]);
+
+    // Create a CSS-connected FontFace in the visible iframe.
+    var vstyle = vdocument.querySelector("style");
+    vstyle.textContent = "@font-face { font-family: somethingelse; src: url(x); }";
+
+    all = Array.from(vdocument.fonts);
+    all[0]._description = "CSS-connected in vdocument";
+    is(all.length, 1, "vdocument.fonts should contain one FontFace (TEST 48)");
+
+    expected.vdocument.push(all[0]);
+
+    // Create a FontFace in each window and add it to each document's FontFaceSet.
+    var i = 0;
+    var faces = [];
+    sourceWindows.forEach(function({ win, what: whatWin }) {
+      var f = new win.FontFace("test" + ++i, "url(x)");
+      sourceDocuments.forEach(function({ doc, what: whatDoc }) {
+        doc.fonts.add(f);
+        expected[whatDoc].push(f);
+        f._description = whatWin + "/" + whatDoc;
+      });
+    });
+
+    sourceDocuments.forEach(function({ doc, what }) {
+      var all = Array.from(doc.fonts);
+      is(expected[what].length, all.length, "expected FontFaceSet size (TEST 48) (" + what + ")");
+      for (var i = 0; i < expected[what].length; i++) {
+        is(expected[what][i], all[i], "expected FontFace (" + expected[what][i]._description + ") at index " + i + " (TEST 48) (" + what + ")");
+      }
+    });
+
+    vstyle.textContent = "";
+    style.textContent = "";
+
+    sourceDocuments.forEach(function({ doc }) { doc.fonts.clear(); });
+
+  }).then(function() {
+
+    // (TEST LAST) Test that a pending style sheet load prevents
+    // document.fonts.status from being set to "loaded".
+
+    // First, add a FontFace to document.fonts that will load soon.
+    var face = new FontFace("test", "url(BitPattern.woff?testlast)");
+    face.load();
+    document.fonts.add(face);
+
+    // Next, add a style sheet reference.
+    var link = document.createElement("link");
+    link.rel = "stylesheet";
+    link.href = "neverending_stylesheet_load.sjs";
+    link.type = "text/css";
+    document.head.appendChild(link);
+
+    return setTimeoutZero()  // wait for the style sheet to start loading
+        .then(function() {
+          document.fonts.clear();
+          is(document.fonts.status, "loading", "FontFaceSet.status when the FontFaceSet has been cleared of loading FontFaces but there is a pending style sheet load (TEST LAST)");
+          document.head.removeChild(link);
+          // XXX Removing the <link> element won't cancel the load of the
+          // style sheet, so we can't do that to test that
+          // document.fonts.ready is resolved once there are no more
+          // loading style sheets.
+        });
+
+    // NOTE: It is important that this style sheet test comes last in the file,
+    // as the neverending style sheet load will interfere with subsequent
+    // sub-tests.
+
   }).then(function() {
 
     // End of the tests.
diff --git a/layout/svg/nsSVGIntegrationUtils.h b/layout/svg/nsSVGIntegrationUtils.h
index f8781aa83e..00514e042d 100644
--- a/layout/svg/nsSVGIntegrationUtils.h
+++ b/layout/svg/nsSVGIntegrationUtils.h
@@ -9,13 +9,13 @@
 #include "gfxMatrix.h"
 #include "gfxRect.h"
 #include "nsAutoPtr.h"
+#include "nsRegionFwd.h"
 
 class gfxContext;
 class gfxDrawable;
 class nsDisplayList;
 class nsDisplayListBuilder;
 class nsIFrame;
-class nsIntRegion;
 
 struct nsRect;
 
diff --git a/layout/tools/reftest/b2g_desktop.py b/layout/tools/reftest/b2g_desktop.py
index c47f5fdd21..e0d5e8f44a 100644
--- a/layout/tools/reftest/b2g_desktop.py
+++ b/layout/tools/reftest/b2g_desktop.py
@@ -140,8 +140,6 @@ class B2GDesktopReftest(RefTest):
         # Set a future policy version to avoid the telemetry prompt.
         prefs["toolkit.telemetry.prompted"] = 999
         prefs["toolkit.telemetry.notifiedOptOut"] = 999
-        # Disable periodic updates of service workers
-        prefs["dom.serviceWorkers.periodic-updates.enabled"] = False
 
         # Set the extra prefs.
         profile.set_preferences(prefs)
diff --git a/layout/tools/reftest/reftest-preferences.js b/layout/tools/reftest/reftest-preferences.js
index 13058a07a5..07db1f4969 100644
--- a/layout/tools/reftest/reftest-preferences.js
+++ b/layout/tools/reftest/reftest-preferences.js
@@ -61,6 +61,3 @@
 
     // Make sure SelfSupport doesn't hit the network.
     branch.setCharPref("browser.selfsupport.url", "https://%(server)s/selfsupport-dummy/");
-
-    // Disable periodic updates of service workers.
-    branch.setBoolPref("dom.serviceWorkers.periodic-updates.enabled", false);
diff --git a/layout/tools/reftest/reftest.js b/layout/tools/reftest/reftest.js
index e787637814..2f6e0d792a 100644
--- a/layout/tools/reftest/reftest.js
+++ b/layout/tools/reftest/reftest.js
@@ -765,7 +765,7 @@ function BuildConditionSandbox(aURL) {
     }
 
     // Graphics features
-    sandbox.supportsRepeatResampling = !sandbox.cocoaWidget;
+    sandbox.usesRepeatResampling = sandbox.d2d;
     return sandbox;
 }
 
diff --git a/layout/tools/reftest/runreftestb2g.py b/layout/tools/reftest/runreftestb2g.py
index 085a246ac0..a40565de18 100644
--- a/layout/tools/reftest/runreftestb2g.py
+++ b/layout/tools/reftest/runreftestb2g.py
@@ -450,8 +450,6 @@ class B2GRemoteReftest(RefTest):
         # Disable tiles also
         prefs["browser.newtabpage.directory.source"] = ""
         prefs["browser.newtabpage.directory.ping"] = ""
-        # Disable periodic updates of service workers
-        prefs["dom.serviceWorkers.periodic-updates.enabled"] = False
 
         if options.oop:
             prefs['browser.tabs.remote.autostart'] = True
diff --git a/layout/xul/BoxObject.cpp b/layout/xul/BoxObject.cpp
index 2caa0c4536..516397cc69 100644
--- a/layout/xul/BoxObject.cpp
+++ b/layout/xul/BoxObject.cpp
@@ -1,4 +1,5 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
@@ -46,17 +47,6 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(BoxObject)
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
-static PLDHashOperator
-PropertyTraverser(const nsAString& aKey, nsISupports* aProperty, void* userArg)
-{
-  nsCycleCollectionTraversalCallback *cb =
-    static_cast<nsCycleCollectionTraversalCallback*>(userArg);
-
-  cb->NoteXPCOMChild(aProperty);
-
-  return PL_DHASH_NEXT;
-}
-
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(BoxObject)
   // XXX jmorton: why aren't we unlinking mPropertyTable?
   NS_IMPL_CYCLE_COLLECTION_UNLINK_PRESERVED_WRAPPER
@@ -65,7 +55,9 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(BoxObject)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_SCRIPT_OBJECTS
   if (tmp->mPropertyTable) {
-    tmp->mPropertyTable->EnumerateRead(PropertyTraverser, &cb);
+    for (auto iter = tmp->mPropertyTable->Iter(); !iter.Done(); iter.Next()) {
+      cb.NoteXPCOMChild(iter.UserData());
+    }
   }
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
diff --git a/layout/xul/grid/nsGrid.cpp b/layout/xul/grid/nsGrid.cpp
index 847d9ec798..92e29153fd 100644
--- a/layout/xul/grid/nsGrid.cpp
+++ b/layout/xul/grid/nsGrid.cpp
@@ -92,9 +92,9 @@ In this case 5 extra columns will be added to the column list to handle the situ
 These are called extraColumns/Rows.
 */
 
+using namespace mozilla;
+
 nsGrid::nsGrid():mBox(nullptr),
-                 mRows(nullptr),
-                 mColumns(nullptr), 
                  mRowsBox(nullptr),
                  mColumnsBox(nullptr),
                  mNeedsRebuild(true),
@@ -102,7 +102,6 @@ nsGrid::nsGrid():mBox(nullptr),
                  mColumnCount(0),
                  mExtraRowCount(0),
                  mExtraColumnCount(0),
-                 mCellMap(nullptr),
                  mMarkingDirty(false)
 {
     MOZ_COUNT_CTOR(nsGrid);
@@ -205,8 +204,8 @@ nsGrid::RebuildIfNeeded()
   }
 
   // build and poplulate row and columns arrays
-  BuildRows(mRowsBox, rowCount, &mRows, true);
-  BuildRows(mColumnsBox, columnCount, &mColumns, false);
+  mRows = BuildRows(mRowsBox, rowCount, true);
+  mColumns = BuildRows(mColumnsBox, columnCount, false);
 
   // build and populate the cell map
   mCellMap = BuildCellMap(rowCount, columnCount);
@@ -215,22 +214,13 @@ nsGrid::RebuildIfNeeded()
   mColumnCount = columnCount;
 
   // populate the cell map from column and row children
-  PopulateCellMap(mRows, mColumns, mRowCount, mColumnCount, true);
-  PopulateCellMap(mColumns, mRows, mColumnCount, mRowCount, false);
+  PopulateCellMap(mRows.get(), mColumns.get(), mRowCount, mColumnCount, true);
+  PopulateCellMap(mColumns.get(), mRows.get(), mColumnCount, mRowCount, false);
 }
 
 void
 nsGrid::FreeMap()
 {
-  if (mRows) 
-    delete[] mRows;
-
-  if (mColumns)
-    delete[] mColumns;
-
-  if (mCellMap)
-    delete[] mCellMap;
-
   mRows = nullptr;
   mColumns = nullptr;
   mCellMap = nullptr;
@@ -313,44 +303,36 @@ nsGrid::CountRowsColumns(nsIFrame* aRowBox, int32_t& aRowCount, int32_t& aComput
 /**
  * Given the number of rows create nsGridRow objects for them and full them out.
  */
-void
-nsGrid::BuildRows(nsIFrame* aBox, int32_t aRowCount, nsGridRow** aRows, bool aIsHorizontal)
+UniquePtr<nsGridRow[]>
+nsGrid::BuildRows(nsIFrame* aBox, int32_t aRowCount, bool aIsHorizontal)
 {
   // if no rows then return null
   if (aRowCount == 0) {
-
-    // make sure we free up the memory.
-    if (*aRows)
-      delete[] (*aRows);
-
-    *aRows = nullptr;
-    return;
+    return nullptr;
   }
 
   // create the array
-  nsGridRow* row;
+  UniquePtr<nsGridRow[]> row;
   
   // only create new rows if we have to. Reuse old rows.
   if (aIsHorizontal)
   { 
     if (aRowCount > mRowCount) {
-       delete[] mRows;
-       row = new nsGridRow[aRowCount];
+       row = MakeUnique<nsGridRow[]>(aRowCount);
     } else {
       for (int32_t i=0; i < mRowCount; i++)
         mRows[i].Init(nullptr, false);
 
-      row = mRows;
+      row = Move(mRows);
     }
   } else {
     if (aRowCount > mColumnCount) {
-       delete[] mColumns;
-       row = new nsGridRow[aRowCount];
+       row = MakeUnique<nsGridRow[]>(aRowCount);
     } else {
        for (int32_t i=0; i < mColumnCount; i++)
          mColumns[i].Init(nullptr, false);
 
-       row = mColumns;
+       row = Move(mColumns);
     }
   }
 
@@ -359,40 +341,36 @@ nsGrid::BuildRows(nsIFrame* aBox, int32_t aRowCount, nsGridRow** aRows, bool aIs
   {
     nsCOMPtr<nsIGridPart> monument = GetPartFromBox(aBox);
     if (monument) {
-       monument->BuildRows(aBox, row);
+       monument->BuildRows(aBox, row.get());
     }
   }
 
-  *aRows = row;
+  return row;
 }
 
 
 /**
  * Given the number of rows and columns. Build a cellmap
  */
-nsGridCell*
+UniquePtr<nsGridCell[]>
 nsGrid::BuildCellMap(int32_t aRows, int32_t aColumns)
 {
   int32_t size = aRows*aColumns;
   int32_t oldsize = mRowCount*mColumnCount;
   if (size == 0) {
-    delete[] mCellMap;
+    return nullptr;
   }
-  else {
-    if (size > oldsize) {
-      delete[] mCellMap;
-      return new nsGridCell[size];
-    } else {
-      // clear out cellmap
-      for (int32_t i=0; i < oldsize; i++)
-      {
-        mCellMap[i].SetBoxInRow(nullptr);
-        mCellMap[i].SetBoxInColumn(nullptr);
-      }
-      return mCellMap;
-    }
+
+  if (size > oldsize) {
+    return MakeUnique<nsGridCell[]>(size);
   }
-  return nullptr;
+
+  // clear out cellmap
+  for (int32_t i=0; i < oldsize; i++) {
+    mCellMap[i].SetBoxInRow(nullptr);
+    mCellMap[i].SetBoxInColumn(nullptr);
+  }
+  return Move(mCellMap);
 }
 
 /** 
diff --git a/layout/xul/grid/nsGrid.h b/layout/xul/grid/nsGrid.h
index b21700ed28..9c27c00d4d 100644
--- a/layout/xul/grid/nsGrid.h
+++ b/layout/xul/grid/nsGrid.h
@@ -10,6 +10,7 @@
 #include "nsStackLayout.h"
 #include "nsIGridPart.h"
 #include "nsCOMPtr.h"
+#include "mozilla/UniquePtr.h"
 
 class nsBoxLayoutState;
 class nsGridCell;
@@ -84,8 +85,9 @@ private:
 
   void FreeMap();
   void FindRowsAndColumns(nsIFrame** aRows, nsIFrame** aColumns);
-  void BuildRows(nsIFrame* aBox, int32_t aSize, nsGridRow** aColumnsRows, bool aIsHorizontal = true);
-  nsGridCell* BuildCellMap(int32_t aRows, int32_t aColumns);
+  mozilla::UniquePtr<nsGridRow[]> BuildRows(nsIFrame* aBox, int32_t aSize,
+                                            bool aIsHorizontal = true);
+  mozilla::UniquePtr<nsGridCell[]> BuildCellMap(int32_t aRows, int32_t aColumns);
   void PopulateCellMap(nsGridRow* aRows, nsGridRow* aColumns, int32_t aRowCount, int32_t aColumnCount, bool aIsHorizontal = true);
   void CountRowsColumns(nsIFrame* aBox, int32_t& aRowCount, int32_t& aComputedColumnCount);
   void SetLargestSize(nsSize& aSize, nscoord aHeight, bool aIsHorizontal = true);
@@ -96,10 +98,10 @@ private:
   nsIFrame* mBox;
 
   // an array of row object
-  nsGridRow* mRows;
+  mozilla::UniquePtr<nsGridRow[]> mRows;
 
   // an array of columns objects.
-  nsGridRow* mColumns;
+  mozilla::UniquePtr<nsGridRow[]> mColumns;
 
   // the first in the <grid> that implements the <rows> tag.
   nsIFrame* mRowsBox;
@@ -120,7 +122,7 @@ private:
   int32_t mExtraColumnCount;
 
   // x,y array of cells in the rows and columns
-  nsGridCell* mCellMap;
+  mozilla::UniquePtr<nsGridCell[]> mCellMap;
 
   // a flag that when true suppresses all other MarkDirties. This
   // prevents lots of extra work being done.
diff --git a/layout/xul/nsSplitterFrame.cpp b/layout/xul/nsSplitterFrame.cpp
index f8ddcdf00b..a4dcb55187 100644
--- a/layout/xul/nsSplitterFrame.cpp
+++ b/layout/xul/nsSplitterFrame.cpp
@@ -36,6 +36,7 @@
 #include "nsContentUtils.h"
 #include "mozilla/dom/Element.h"
 #include "mozilla/MouseEvents.h"
+#include "mozilla/UniquePtr.h"
 
 using namespace mozilla;
 
@@ -104,7 +105,7 @@ public:
   ResizeType GetResizeAfter();
   State GetState();
 
-  void Reverse(nsSplitterInfo*& aIndexes, int32_t aCount);
+  void Reverse(UniquePtr<nsSplitterInfo[]>& aIndexes, int32_t aCount);
   bool SupportsCollapseDirection(CollapseDirection aDirection);
 
   void EnsureOrient();
@@ -116,8 +117,8 @@ public:
   nscoord mCurrentPos;
   nsIFrame* mParentBox;
   bool mPressed;
-  nsSplitterInfo* mChildInfosBefore;
-  nsSplitterInfo* mChildInfosAfter;
+  UniquePtr<nsSplitterInfo[]> mChildInfosBefore;
+  UniquePtr<nsSplitterInfo[]> mChildInfosAfter;
   int32_t mChildInfosBeforeCount;
   int32_t mChildInfosAfterCount;
   State mState;
@@ -144,8 +145,6 @@ nsSplitterFrameInner::GetResizeBefore()
 
 nsSplitterFrameInner::~nsSplitterFrameInner() 
 {
-  delete[] mChildInfosBefore;
-  delete[] mChildInfosAfter;
 }
 
 nsSplitterFrameInner::ResizeType
@@ -272,8 +271,6 @@ nsSplitterFrame::Init(nsIContent*       aContent,
   mInner = new nsSplitterFrameInner(this);
 
   mInner->AddRef();
-  mInner->mChildInfosAfter = nullptr;
-  mInner->mChildInfosBefore = nullptr;
   mInner->mState = nsSplitterFrameInner::Open;
   mInner->mDragging = false;
 
@@ -432,8 +429,6 @@ nsSplitterFrameInner::MouseUp(nsPresContext* aPresContext,
     //printf("MouseUp\n");
   }
 
-  delete[] mChildInfosBefore;
-  delete[] mChildInfosAfter;
   mChildInfosBefore = nullptr;
   mChildInfosAfter = nullptr;
   mChildInfosBeforeCount = 0;
@@ -480,7 +475,9 @@ nsSplitterFrameInner::MouseDrag(nsPresContext* aPresContext,
 
     nscoord oldPos = pos;
 
-    ResizeChildTo(aPresContext, pos, mChildInfosBefore, mChildInfosAfter, mChildInfosBeforeCount, mChildInfosAfterCount, bounded);
+    ResizeChildTo(aPresContext, pos,
+                  mChildInfosBefore.get(), mChildInfosAfter.get(),
+                  mChildInfosBeforeCount, mChildInfosAfterCount, bounded);
 
     State currentState = GetState();
     bool supportsBefore = SupportsCollapseDirection(Before);
@@ -651,10 +648,8 @@ nsSplitterFrameInner::MouseDown(nsIDOMEvent* aMouseEvent)
   ResizeType resizeBefore = GetResizeBefore();
   ResizeType resizeAfter  = GetResizeAfter();
 
-  delete[] mChildInfosBefore;
-  delete[] mChildInfosAfter;
-  mChildInfosBefore = new nsSplitterInfo[childCount];
-  mChildInfosAfter  = new nsSplitterInfo[childCount];
+  mChildInfosBefore = MakeUnique<nsSplitterInfo[]>(childCount);
+  mChildInfosAfter  = MakeUnique<nsSplitterInfo[]>(childCount);
 
   // create info 2 lists. One of the children before us and one after.
   int32_t count = 0;
@@ -727,12 +722,8 @@ nsSplitterFrameInner::MouseDown(nsIDOMEvent* aMouseEvent)
     Reverse(mChildInfosAfter, mChildInfosAfterCount);
 
     // Now swap the two arrays.
-    nscoord newAfterCount = mChildInfosBeforeCount;
-    mChildInfosBeforeCount = mChildInfosAfterCount;
-    mChildInfosAfterCount = newAfterCount;
-    nsSplitterInfo* temp = mChildInfosAfter;
-    mChildInfosAfter = mChildInfosBefore;
-    mChildInfosBefore = temp;
+    Swap(mChildInfosBeforeCount, mChildInfosAfterCount);
+    Swap(mChildInfosBefore, mChildInfosAfter);
   }
 
   // if resizebefore is not Farthest, reverse the list because the first child
@@ -791,15 +782,14 @@ nsSplitterFrameInner::MouseMove(nsIDOMEvent* aMouseEvent)
 }
 
 void
-nsSplitterFrameInner::Reverse(nsSplitterInfo*& aChildInfos, int32_t aCount)
+nsSplitterFrameInner::Reverse(UniquePtr<nsSplitterInfo[]>& aChildInfos, int32_t aCount)
 {
-    nsSplitterInfo* infos = new nsSplitterInfo[aCount];
+    UniquePtr<nsSplitterInfo[]> infos(new nsSplitterInfo[aCount]);
 
     for (int i=0; i < aCount; i++)
        infos[i] = aChildInfos[aCount - 1 - i];
 
-    delete[] aChildInfos;
-    aChildInfos = infos;
+    aChildInfos = Move(infos);
 }
 
 bool
@@ -898,8 +888,10 @@ nsSplitterFrameInner::AdjustChildren(nsPresContext* aPresContext)
   EnsureOrient();
   bool isHorizontal = !mOuter->IsHorizontal();
 
-  AdjustChildren(aPresContext, mChildInfosBefore, mChildInfosBeforeCount, isHorizontal);
-  AdjustChildren(aPresContext, mChildInfosAfter, mChildInfosAfterCount, isHorizontal);
+  AdjustChildren(aPresContext, mChildInfosBefore.get(),
+                 mChildInfosBeforeCount, isHorizontal);
+  AdjustChildren(aPresContext, mChildInfosAfter.get(),
+                 mChildInfosAfterCount, isHorizontal);
 }
 
 static nsIFrame* GetChildBoxForContent(nsIFrame* aParentBox, nsIContent* aContent)
diff --git a/media/libstagefright/binding/AnnexB.cpp b/media/libstagefright/binding/AnnexB.cpp
index 82ca2ff9c7..9ccff857c6 100644
--- a/media/libstagefright/binding/AnnexB.cpp
+++ b/media/libstagefright/binding/AnnexB.cpp
@@ -220,8 +220,8 @@ AnnexB::ConvertSampleToAVCC(mozilla::MediaRawData* aSample)
     return ConvertSampleTo4BytesAVCC(aSample);
   }
   if (!IsAnnexB(aSample)) {
-    // Not AnnexB, can't convert.
-    return false;
+    // Not AnnexB, nothing to convert.
+    return true;
   }
 
   mozilla::Vector<uint8_t> nalu;
@@ -237,15 +237,17 @@ already_AddRefed<mozilla::MediaByteBuffer>
 AnnexB::ExtractExtraData(const mozilla::MediaRawData* aSample)
 {
   RefPtr<mozilla::MediaByteBuffer> extradata = new mozilla::MediaByteBuffer;
-  if (IsAVCC(aSample) && HasSPS(aSample->mExtraData)) {
+  if (HasSPS(aSample->mExtraData)) {
     // We already have an explicit extradata, re-use it.
     extradata = aSample->mExtraData;
     return extradata.forget();
   }
 
   if (IsAnnexB(aSample)) {
+    // We can't extract data from AnnexB.
     return extradata.forget();
   }
+
   // SPS content
   mozilla::Vector<uint8_t> sps;
   ByteWriter spsw(sps);
diff --git a/media/webrtc/signaling/src/media-conduit/WebrtcOMXH264VideoCodec.cpp b/media/webrtc/signaling/src/media-conduit/WebrtcOMXH264VideoCodec.cpp
index 5383e152f1..083b78b064 100644
--- a/media/webrtc/signaling/src/media-conduit/WebrtcOMXH264VideoCodec.cpp
+++ b/media/webrtc/signaling/src/media-conduit/WebrtcOMXH264VideoCodec.cpp
@@ -1003,7 +1003,7 @@ WebrtcOMXH264VideoEncoder::Encode(const webrtc::I420VideoFrame& aInputImage,
                                    (yuvData.mYSize.height + 1) / 2);
   yuvData.mPicSize = yuvData.mYSize;
   yuvData.mStereoMode = StereoMode::MONO;
-  layers::PlanarYCbCrImage img(nullptr);
+  layers::RecyclingPlanarYCbCrImage img(nullptr);
   // SetDataNoCopy() doesn't need AllocateAndGetNewBuffer(); OMXVideoEncoder is ok with this
   img.SetDataNoCopy(yuvData);
 
diff --git a/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp b/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp
index adb52fb803..05d0ed0038 100644
--- a/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp
+++ b/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp
@@ -45,6 +45,7 @@
 #include "mozilla/gfx/Point.h"
 #include "mozilla/gfx/Types.h"
 #include "mozilla/UniquePtr.h"
+#include "mozilla/UniquePtrExtensions.h"
 
 #include "logging.h"
 
@@ -1179,7 +1180,7 @@ void MediaPipelineTransmit::PipelineListener::ProcessVideoChunk(
   int half_height = (size.height + 1) >> 1;
   int c_size = half_width * half_height;
   int buffer_size = YSIZE(size.width, size.height) + 2 * c_size;
-  UniquePtr<uint8[]> yuv_scoped(new (fallible) uint8[buffer_size]);
+  auto yuv_scoped = MakeUniqueFallible<uint8[]>(buffer_size);
   if (!yuv_scoped)
     return;
   uint8* yuv = yuv_scoped.get();
@@ -1205,7 +1206,7 @@ void MediaPipelineTransmit::PipelineListener::ProcessVideoChunk(
                               yuv + cr_offset, half_width,
                               size.width, size.height);
       break;
-    case SurfaceFormat::R5G6B5:
+    case SurfaceFormat::R5G6B5_UINT16:
       rv = libyuv::RGB565ToI420(static_cast<uint8*>(map.GetData()),
                                 map.GetStride(),
                                 yuv, size.width,
@@ -1501,7 +1502,10 @@ void MediaPipelineReceiveVideo::PipelineListener::RenderVideoFrame(
     yuvData.mPicSize = IntSize(width_, height_);
     yuvData.mStereoMode = StereoMode::MONO;
 
-    yuvImage->SetData(yuvData);
+    if (!yuvImage->SetData(yuvData)) {
+      MOZ_ASSERT(false);
+      return;
+    }
 
     image_ = image.forget();
   }
diff --git a/media/webrtc/signaling/test/common.build b/media/webrtc/signaling/test/common.build
index babf9b6c94..b3bb19f04b 100644
--- a/media/webrtc/signaling/test/common.build
+++ b/media/webrtc/signaling/test/common.build
@@ -11,10 +11,8 @@ for var in ('MOZILLA_EXTERNAL_LINKAGE', 'USE_FAKE_MEDIA_STREAMS', 'USE_FAKE_PCOB
             'NR_SOCKET_IS_VOID_PTR', 'HAVE_STRDUP'):
     DEFINES[var] = True
 
-GENERATED_INCLUDES += [
-  '/dom/bindings',
-]
 LOCAL_INCLUDES += [
+    '!/dom/bindings',
     '/dom/media/',
     '/ipc/chromium/src',
     '/media/mtransport',
diff --git a/memory/build/moz.build b/memory/build/moz.build
index efeb9c8e42..3595bc663c 100644
--- a/memory/build/moz.build
+++ b/memory/build/moz.build
@@ -27,7 +27,7 @@ if CONFIG['MOZ_JEMALLOC4']:
     SOURCES += [
         'mozjemalloc_compat.c',
     ]
-    GENERATED_INCLUDES += ['../jemalloc/src/include']
+    LOCAL_INCLUDES += ['!../jemalloc/src/include']
     if CONFIG['_MSC_VER']:
         LOCAL_INCLUDES += ['/memory/jemalloc/src/include/msvc_compat']
         if not CONFIG['HAVE_INTTYPES_H']:
diff --git a/memory/jemalloc/moz.build b/memory/jemalloc/moz.build
index 3c00883af0..75aee79360 100644
--- a/memory/jemalloc/moz.build
+++ b/memory/jemalloc/moz.build
@@ -68,7 +68,10 @@ if CONFIG['GNU_CC']:
 
 DEFINES['abort'] = 'moz_abort'
 
-GENERATED_INCLUDES += ['src/include']
-LOCAL_INCLUDES += ['src/include']
+LOCAL_INCLUDES += [
+    '!src/include',
+    'src/include',
+]
 
+# We allow warnings for third-party code that can be updated from upstream.
 ALLOW_COMPILER_WARNINGS = True
diff --git a/memory/mozalloc/moz.build b/memory/mozalloc/moz.build
index dfee3ced89..68ddc84839 100644
--- a/memory/mozalloc/moz.build
+++ b/memory/mozalloc/moz.build
@@ -40,8 +40,14 @@ else:
 # The strndup declaration in string.h is in an ifdef __USE_GNU section
 DEFINES['_GNU_SOURCE'] = True
 
-GENERATED_INCLUDES += ['/xpcom']
-
 DISABLE_STL_WRAPPING = True
 
+LOCAL_INCLUDES += [
+    '!/xpcom',
+    '/memory/build',
+]
+
 DIST_INSTALL = True
+
+if CONFIG['GNU_CXX']:
+    CXXFLAGS += ['-Wshadow']
diff --git a/memory/replace/jemalloc/moz.build b/memory/replace/jemalloc/moz.build
index 1918de4763..7518f24510 100644
--- a/memory/replace/jemalloc/moz.build
+++ b/memory/replace/jemalloc/moz.build
@@ -26,7 +26,7 @@ USE_LIBS += [
 DEFINES['MOZ_JEMALLOC4'] = True
 DEFINES['MOZ_REPLACE_JEMALLOC'] = True
 
-GENERATED_INCLUDES += ['../../jemalloc/src/include']
+LOCAL_INCLUDES += ['!../../jemalloc/src/include']
 if CONFIG['_MSC_VER']:
     LOCAL_INCLUDES += ['/memory/jemalloc/src/include/msvc_compat']
     if not CONFIG['HAVE_INTTYPES_H']:
diff --git a/mfbt/UniquePtrExtensions.h b/mfbt/UniquePtrExtensions.h
new file mode 100644
index 0000000000..65b07ed2ee
--- /dev/null
+++ b/mfbt/UniquePtrExtensions.h
@@ -0,0 +1,42 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* Useful extensions to UniquePtr. */
+
+#ifndef mozilla_UniquePtrExtensions_h
+#define mozilla_UniquePtrExtensions_h
+
+#include "mozilla/fallible.h"
+#include "mozilla/UniquePtr.h"
+
+namespace mozilla {
+
+/**
+ * MakeUniqueFallible works exactly like MakeUnique, except that the memory
+ * allocation performed is done fallibly, i.e. it can return nullptr.
+ */
+template<typename T, typename... Args>
+typename detail::UniqueSelector<T>::SingleObject
+MakeUniqueFallible(Args&&... aArgs)
+{
+  return UniquePtr<T>(new (fallible) T(Forward<Args>(aArgs)...));
+}
+
+template<typename T>
+typename detail::UniqueSelector<T>::UnknownBound
+MakeUniqueFallible(decltype(sizeof(int)) aN)
+{
+  typedef typename RemoveExtent<T>::Type ArrayType;
+  return UniquePtr<T>(new (fallible) ArrayType[aN]());
+}
+
+template<typename T, typename... Args>
+typename detail::UniqueSelector<T>::KnownBound
+MakeUniqueFallible(Args&&... aArgs) = delete;
+
+} // namespace mozilla
+
+#endif // mozilla_UniquePtrExtensions_h
diff --git a/mfbt/moz.build b/mfbt/moz.build
index 6d062c2351..46e5ee248b 100644
--- a/mfbt/moz.build
+++ b/mfbt/moz.build
@@ -91,6 +91,7 @@ EXPORTS.mozilla = [
     'Types.h',
     'TypeTraits.h',
     'UniquePtr.h',
+    'UniquePtrExtensions.h',
     'Variant.h',
     'Vector.h',
     'WeakPtr.h',
diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index 8e18640806..05e8740967 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -157,7 +157,6 @@ pref("dom.workers.maxPerDomain", 20);
 // Whether or not Shared Web Workers are enabled.
 pref("dom.workers.sharedWorkers.enabled", true);
 
-// Service workers
 pref("dom.serviceWorkers.enabled", false);
 
 // Allow service workers to intercept network requests using the fetch event
@@ -1405,7 +1404,7 @@ pref("privacy.trackingprotection.enabled",  false);
 
 pref("dom.event.contextmenu.enabled",       true);
 pref("dom.event.clipboardevents.enabled",   true);
-#if defined(XP_WIN) && !defined(RELEASE_BUILD)
+#if defined(XP_WIN) && !defined(RELEASE_BUILD) || defined(MOZ_WIDGET_GTK) && !defined(RELEASE_BUILD)
 pref("dom.event.highrestimestamp.enabled",  true);
 #else
 pref("dom.event.highrestimestamp.enabled",  false);
@@ -2608,6 +2607,14 @@ pref("layout.css.unicode-range.enabled", false);
 // Is support for CSS "text-align: unsafe X" enabled?
 pref("layout.css.text-align-unsafe-value.enabled", false);
 
+// Is support for CSS "float: inline-{start,end}" and
+// "clear: inline-{start,end}" enabled?
+#if defined(MOZ_B2G) || defined(NIGHTLY_BUILD)
+pref("layout.css.float-logical-values.enabled", true);
+#else
+pref("layout.css.float-logical-values.enabled", false);
+#endif
+
 // Is support for the CSS4 image-orientation property enabled?
 pref("layout.css.image-orientation.enabled", true);
 
@@ -4419,10 +4426,6 @@ pref("image.multithreaded_decoding.limit", -1);
 // cache.
 pref("canvas.image.cache.limit", 0);
 
-// Allow track-fobics to deliberately poison canvas data for
-// toDataURL() and getImageData()
-pref("canvas.poisondata", false);
-
 // WebGL prefs
 #ifdef ANDROID
 // Disable MSAA on mobile.
@@ -4731,9 +4734,14 @@ pref("dom.mozContacts.enabled", false);
 pref("dom.mozAlarms.enabled", false);
 
 // Push
+
 pref("dom.push.enabled", false);
 
-pref("dom.push.debug", false);
+#if !defined(RELEASE_BUILD)
+pref("dom.push.debug", true);
+#endif
+
+
 pref("dom.push.serverURL", "wss://push.services.mozilla.com/");
 pref("dom.push.userAgentID", "");
 
@@ -4786,11 +4794,15 @@ pref("dom.mozSettings.enabled", false);
 pref("dom.mozPermissionSettings.enabled", false);
 
 // W3C touch events
-// 0 - disabled, 1 - enabled, 2 - autodetect (win)
+// 0 - disabled, 1 - enabled, 2 - autodetect (win/gtk3)
 #ifdef XP_WIN
 pref("dom.w3c_touch_events.enabled", 2);
 #endif
 
+#if MOZ_WIDGET_GTK == 3
+pref("dom.w3c_touch_events.enabled", 2);
+#endif
+
 // W3C draft pointer events
 pref("dom.w3c_pointer_events.enabled", false);
 
@@ -5319,13 +5331,6 @@ pref("media.gmp.insecure.allow", false);
 
 pref("dom.audiochannel.mutedByDefault", false);
 
-// Use vsync aligned rendering. b2g prefs are in b2g.js.
-// Hardware vsync supported on windows, os x, and b2g.
-// Linux and fennec will use software vsync.
-#if defined(XP_MACOSX) || defined(XP_WIN) || defined(XP_LINUX)
-pref("gfx.vsync.refreshdriver", true);
-#endif
-
 // Secure Element API
 #ifdef MOZ_SECUREELEMENT
 pref("dom.secureelement.enabled", false);
diff --git a/netwerk/build/moz.build b/netwerk/build/moz.build
index 19a5d102c6..f741a3ea75 100644
--- a/netwerk/build/moz.build
+++ b/netwerk/build/moz.build
@@ -73,7 +73,7 @@ if CONFIG['MOZ_RTSP']:
         '/netwerk/protocol/rtsp',
     ]
 
-GENERATED_INCLUDES += [
-    '/modules/brotli/dec',
-    '/netwerk/dns',
+LOCAL_INCLUDES += [
+    '!/modules/brotli/dec',
+    '!/netwerk/dns',
 ]
diff --git a/python/mozbuild/mozbuild/backend/recursivemake.py b/python/mozbuild/mozbuild/backend/recursivemake.py
index 6047045816..77caa4e525 100644
--- a/python/mozbuild/mozbuild/backend/recursivemake.py
+++ b/python/mozbuild/mozbuild/backend/recursivemake.py
@@ -47,7 +47,6 @@ from ..frontend.data import (
     ExternalLibrary,
     FinalTargetFiles,
     GeneratedFile,
-    GeneratedInclude,
     GeneratedSources,
     HostDefines,
     HostLibrary,
@@ -560,9 +559,6 @@ class RecursiveMakeBackend(CommonBackend):
         elif isinstance(obj, LocalInclude):
             self._process_local_include(obj.path, backend_file)
 
-        elif isinstance(obj, GeneratedInclude):
-            self._process_generated_include(obj.path, backend_file)
-
         elif isinstance(obj, PerSourceFlag):
             self._process_per_source_flag(obj, backend_file)
 
@@ -1244,13 +1240,6 @@ INSTALL_TARGETS += %(prefix)s
         else:
             backend_file.write('LOCAL_INCLUDES += -I%s\n' % path)
 
-    def _process_generated_include(self, generated_include, backend_file):
-        if generated_include.startswith('/'):
-            path = self.environment.topobjdir.replace('\\', '/')
-        else:
-            path = ''
-        backend_file.write('LOCAL_INCLUDES += -I%s%s\n' % (path, generated_include))
-
     def _process_per_source_flag(self, per_source_flag, backend_file):
         for flag in per_source_flag.flags:
             backend_file.write('%s_FLAGS += %s\n' % (mozpath.basename(per_source_flag.file_name), flag))
diff --git a/python/mozbuild/mozbuild/frontend/context.py b/python/mozbuild/mozbuild/frontend/context.py
index 33aa147da4..dc159a7a84 100644
--- a/python/mozbuild/mozbuild/frontend/context.py
+++ b/python/mozbuild/mozbuild/frontend/context.py
@@ -1077,11 +1077,6 @@ VARIABLES = {
         This variable only has an effect when building with MSVC.
         """, None),
 
-    'GENERATED_INCLUDES' : (StrictOrderingOnAppendList, list,
-        """Directories generated by the build system to be searched for include
-        files by the compiler.
-        """, None),
-
     'HOST_SOURCES': (ContextDerivedTypedList(SourcePath, StrictOrderingOnAppendList), list,
         """Source code files to compile with the host compiler.
 
@@ -1169,7 +1164,7 @@ VARIABLES = {
         """List of system libraries for host programs and libraries.
         """, None),
 
-    'LOCAL_INCLUDES': (ContextDerivedTypedList(SourcePath, StrictOrderingOnAppendList), list,
+    'LOCAL_INCLUDES': (ContextDerivedTypedList(Path, StrictOrderingOnAppendList), list,
         """Additional directories to be searched for include files by the compiler.
         """, None),
 
@@ -2102,6 +2097,16 @@ DEPRECATION_HINTS = {
 
             GENERATED_SOURCES += [ 'foo.cpp']
     ''',
+
+    'GENERATED_INCLUDES': '''
+        Please use
+
+            LOCAL_INCLUDES += [ '!foo' ]
+
+        instead of
+
+            GENERATED_INCLUDES += [ 'foo' ]
+    ''',
 }
 
 # Make sure that all template variables have a deprecation hint.
diff --git a/python/mozbuild/mozbuild/frontend/data.py b/python/mozbuild/mozbuild/frontend/data.py
index 4352c96db7..358b94c749 100644
--- a/python/mozbuild/mozbuild/frontend/data.py
+++ b/python/mozbuild/mozbuild/frontend/data.py
@@ -648,18 +648,6 @@ class LocalInclude(ContextDerived):
 
         self.path = path
 
-class GeneratedInclude(ContextDerived):
-    """Describes an individual generated include path."""
-
-    __slots__ = (
-        'path',
-    )
-
-    def __init__(self, context, path):
-        ContextDerived.__init__(self, context)
-
-        self.path = path
-
 
 class PerSourceFlag(ContextDerived):
     """Describes compiler flags specified for individual source files."""
diff --git a/python/mozbuild/mozbuild/frontend/emitter.py b/python/mozbuild/mozbuild/frontend/emitter.py
index 1256c4d8db..ecadabd436 100644
--- a/python/mozbuild/mozbuild/frontend/emitter.py
+++ b/python/mozbuild/mozbuild/frontend/emitter.py
@@ -38,7 +38,6 @@ from .data import (
     FinalTargetFiles,
     GeneratedEventWebIDLFile,
     GeneratedFile,
-    GeneratedInclude,
     GeneratedSources,
     GeneratedWebIDLFile,
     ExampleWebIDLInterface,
@@ -659,7 +658,6 @@ class TreeMetadataEmitter(LoggingMixin):
             ('GENERATED_EVENTS_WEBIDL_FILES', GeneratedEventWebIDLFile),
             ('GENERATED_WEBIDL_FILES', GeneratedWebIDLFile),
             ('IPDL_SOURCES', IPDLFile),
-            ('GENERATED_INCLUDES', GeneratedInclude),
             ('PREPROCESSED_TEST_WEBIDL_FILES', PreprocessedTestWebIDLFile),
             ('PREPROCESSED_WEBIDL_FILES', PreprocessedWebIDLFile),
             ('TEST_WEBIDL_FILES', TestWebIDLFile),
@@ -671,7 +669,8 @@ class TreeMetadataEmitter(LoggingMixin):
                 yield klass(context, name)
 
         for local_include in context.get('LOCAL_INCLUDES', []):
-            if not os.path.exists(local_include.full_path):
+            if (not isinstance(local_include, ObjDirPath) and
+                    not os.path.exists(local_include.full_path)):
                 raise SandboxValidationError('Path specified in LOCAL_INCLUDES '
                     'does not exist: %s (resolved to %s)' % (local_include,
                     local_include.full_path), context)
diff --git a/python/mozbuild/mozbuild/frontend/gyp_reader.py b/python/mozbuild/mozbuild/frontend/gyp_reader.py
index 4b29ba6a62..84724d3b72 100644
--- a/python/mozbuild/mozbuild/frontend/gyp_reader.py
+++ b/python/mozbuild/mozbuild/frontend/gyp_reader.py
@@ -221,10 +221,10 @@ def read_from_gyp(config, path, output, vars, non_unified_sources = set()):
         # Add some features to all contexts. Put here in case LOCAL_INCLUDES
         # order matters.
         context['LOCAL_INCLUDES'] += [
+            '!/ipc/ipdl/_ipdlheaders',
             '/ipc/chromium/src',
             '/ipc/glue',
         ]
-        context['GENERATED_INCLUDES'] += ['/ipc/ipdl/_ipdlheaders']
         # These get set via VC project file settings for normal GYP builds.
         if config.substs['OS_TARGET'] == 'WINNT':
             context['DEFINES']['UNICODE'] = True
diff --git a/python/mozbuild/mozbuild/test/backend/data/generated_includes/moz.build b/python/mozbuild/mozbuild/test/backend/data/generated_includes/moz.build
index b4c71617b9..876a842eeb 100644
--- a/python/mozbuild/mozbuild/test/backend/data/generated_includes/moz.build
+++ b/python/mozbuild/mozbuild/test/backend/data/generated_includes/moz.build
@@ -2,4 +2,4 @@
 # Any copyright is dedicated to the Public Domain.
 # http://creativecommons.org/publicdomain/zero/1.0/
 
-GENERATED_INCLUDES += ['/bar/baz', 'foo']
+LOCAL_INCLUDES += ['!/bar/baz', '!foo']
diff --git a/python/mozbuild/mozbuild/test/backend/test_recursivemake.py b/python/mozbuild/mozbuild/test/backend/test_recursivemake.py
index 6a47de225c..ff6767e49f 100644
--- a/python/mozbuild/mozbuild/test/backend/test_recursivemake.py
+++ b/python/mozbuild/mozbuild/test/backend/test_recursivemake.py
@@ -627,7 +627,7 @@ class TestRecursiveMakeBackend(BackendTester):
         topobjdir = env.topobjdir.replace('\\', '/')
 
         expected = [
-            'LOCAL_INCLUDES += -I%s/bar/baz' % topobjdir,
+            'LOCAL_INCLUDES += -Ibar/baz',
             'LOCAL_INCLUDES += -Ifoo',
         ]
 
diff --git a/python/mozbuild/mozbuild/test/frontend/data/generated_includes/moz.build b/python/mozbuild/mozbuild/test/frontend/data/generated_includes/moz.build
index b4c71617b9..876a842eeb 100644
--- a/python/mozbuild/mozbuild/test/frontend/data/generated_includes/moz.build
+++ b/python/mozbuild/mozbuild/test/frontend/data/generated_includes/moz.build
@@ -2,4 +2,4 @@
 # Any copyright is dedicated to the Public Domain.
 # http://creativecommons.org/publicdomain/zero/1.0/
 
-GENERATED_INCLUDES += ['/bar/baz', 'foo']
+LOCAL_INCLUDES += ['!/bar/baz', '!foo']
diff --git a/python/mozbuild/mozbuild/test/frontend/test_emitter.py b/python/mozbuild/mozbuild/test/frontend/test_emitter.py
index b29571ddb8..4cd0fd1494 100644
--- a/python/mozbuild/mozbuild/test/frontend/test_emitter.py
+++ b/python/mozbuild/mozbuild/test/frontend/test_emitter.py
@@ -18,7 +18,6 @@ from mozbuild.frontend.data import (
     DirectoryTraversal,
     Exports,
     GeneratedFile,
-    GeneratedInclude,
     GeneratedSources,
     HostDefines,
     HostSources,
@@ -661,10 +660,19 @@ class TestEmitterBasic(unittest.TestCase):
         reader = self.reader('generated_includes')
         objs = self.read_topsrcdir(reader)
 
-        generated_includes = [o.path for o in objs if isinstance(o, GeneratedInclude)]
+        generated_includes = [o.path for o in objs if isinstance(o, LocalInclude)]
         expected = [
-            '/bar/baz',
-            'foo',
+            '!/bar/baz',
+            '!foo',
+        ]
+
+        self.assertEqual(generated_includes, expected)
+
+        generated_includes = [o.path.full_path
+                              for o in objs if isinstance(o, LocalInclude)]
+        expected = [
+            mozpath.join(reader.config.topobjdir, 'bar/baz'),
+            mozpath.join(reader.config.topobjdir, 'foo'),
         ]
 
         self.assertEqual(generated_includes, expected)
diff --git a/security/manager/pki/moz.build b/security/manager/pki/moz.build
index 0ae5748cc6..826c7b4dbb 100644
--- a/security/manager/pki/moz.build
+++ b/security/manager/pki/moz.build
@@ -8,7 +8,6 @@ DIRS += ['resources']
 
 XPIDL_SOURCES += [
     'nsIASN1Tree.idl',
-    'nsIPKIParamBlock.idl',
 ]
 
 XPIDL_MODULE = 'pippki'
@@ -18,11 +17,10 @@ UNIFIED_SOURCES += [
     'nsNSSDialogHelper.cpp',
     'nsNSSDialogs.cpp',
     'nsPKIModule.cpp',
-    'nsPKIParamBlock.cpp',
 ]
 
-GENERATED_INCLUDES += [
-    '/dist/public/nss',
+LOCAL_INCLUDES += [
+    '!/dist/public/nss',
 ]
 
 FINAL_LIBRARY = 'xul'
diff --git a/security/manager/pki/nsIPKIParamBlock.idl b/security/manager/pki/nsIPKIParamBlock.idl
deleted file mode 100644
index df7180eeb1..0000000000
--- a/security/manager/pki/nsIPKIParamBlock.idl
+++ /dev/null
@@ -1,14 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsISupports.idl"
-
-[scriptable, uuid(b6fe3d78-1dd1-11b2-9058-ced9016984c8)]
-interface nsIPKIParamBlock : nsISupports {
-
-  void setISupportAtIndex(in long index, in nsISupports object);
-  nsISupports getISupportAtIndex(in long index);
-};
diff --git a/security/manager/pki/nsNSSDialogHelper.cpp b/security/manager/pki/nsNSSDialogHelper.cpp
index 2a53d7e735..6535cdf3db 100644
--- a/security/manager/pki/nsNSSDialogHelper.cpp
+++ b/security/manager/pki/nsNSSDialogHelper.cpp
@@ -5,24 +5,26 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsNSSDialogHelper.h"
-#include "nsIWindowWatcher.h"
-#include "nsCOMPtr.h"
-#include "nsIComponentManager.h"
-#include "nsIServiceManager.h"
-#include "nsIInterfaceRequestor.h"
-#include "nsIInterfaceRequestorUtils.h"
+
 #include "mozilla/dom/ScriptSettings.h"
+#include "nsCOMPtr.h"
+#include "nsIDOMWindow.h"
+#include "nsIServiceManager.h"
+#include "nsIWindowWatcher.h"
 
 static const char kOpenDialogParam[] = "centerscreen,chrome,modal,titlebar";
 static const char kOpenWindowParam[] = "centerscreen,chrome,titlebar";
 
 nsresult
-nsNSSDialogHelper::openDialog(
-    nsIDOMWindow *window,
-    const char *url,
-    nsISupports *params,
-    bool modal)
+nsNSSDialogHelper::openDialog(nsIDOMWindow* window, const char* url,
+                              nsISupports* params, bool modal)
 {
+#ifdef MOZ_WIDGET_GONK
+  // On b2g devices, we need to proxy the dialog creation & management
+  // to Gaia.
+  return NS_ERROR_NOT_IMPLEMENTED;
+#endif
+
   nsresult rv;
   nsCOMPtr<nsIWindowWatcher> windowWatcher = 
            do_GetService(NS_WINDOWWATCHER_CONTRACTID, &rv);
@@ -52,4 +54,3 @@ nsNSSDialogHelper::openDialog(
                                  getter_AddRefs(newWindow));
   return rv;
 }
-
diff --git a/security/manager/pki/nsNSSDialogHelper.h b/security/manager/pki/nsNSSDialogHelper.h
index 488e532eb5..30868d825f 100644
--- a/security/manager/pki/nsNSSDialogHelper.h
+++ b/security/manager/pki/nsNSSDialogHelper.h
@@ -7,7 +7,8 @@
 #ifndef nsNSSDialogHelper_h
 #define nsNSSDialogHelper_h
 
-#include "nsIDOMWindow.h"
+class nsIDOMWindow;
+class nsISupports;
 
 /**
  * Common class that uses the window watcher service to open a
@@ -18,13 +19,9 @@
 class nsNSSDialogHelper
 {
 public:
-  //The params is going to be either a nsIPKIParamBlock or
-  //nsIDialogParamBlock
-  static nsresult openDialog(
-                  nsIDOMWindow *window,
-                  const char *url,
-                  nsISupports *params,
-                  bool modal = true);
+  // params is a nsIDialogParamBlock or a nsIKeygenThread
+  static nsresult openDialog(nsIDOMWindow* window, const char* url,
+                             nsISupports* params, bool modal = true);
 };
 
 #endif
diff --git a/security/manager/pki/nsNSSDialogs.cpp b/security/manager/pki/nsNSSDialogs.cpp
index 447aff2290..cddbc50f2e 100644
--- a/security/manager/pki/nsNSSDialogs.cpp
+++ b/security/manager/pki/nsNSSDialogs.cpp
@@ -25,7 +25,6 @@
 #include "nsPromiseFlatString.h"
 
 #include "nsNSSDialogs.h"
-#include "nsPKIParamBlock.h"
 #include "nsIKeygenThread.h"
 #include "nsIProtectedAuthThread.h"
 #include "nsNSSDialogHelper.h"
@@ -144,30 +143,36 @@ nsNSSDialogs::ConfirmDownloadCACert(nsIInterfaceRequestor *ctx,
 {
   nsresult rv;
 
-  *_retval = true;
+  nsCOMPtr<nsIMutableArray> dlgArray(do_CreateInstance(NS_ARRAY_CONTRACTID));
+  if (!dlgArray) {
+    return NS_ERROR_FAILURE;
+  }
+  rv = dlgArray->AppendElement(cert, false);
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+  nsCOMPtr<nsIDialogParamBlock> dlgParamBlock(
+    do_CreateInstance(NS_DIALOGPARAMBLOCK_CONTRACTID));
+  if (!dlgParamBlock) {
+    return NS_ERROR_FAILURE;
+  }
+  rv = dlgParamBlock->SetObjects(dlgArray);
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
 
   // Get the parent window for the dialog
   nsCOMPtr<nsIDOMWindow> parent = do_GetInterface(ctx);
-
-  nsCOMPtr<nsIPKIParamBlock> block =
-           do_CreateInstance(NS_PKIPARAMBLOCK_CONTRACTID);
-  if (!block)
-    return NS_ERROR_FAILURE;
-
-  rv = block->SetISupportAtIndex(1, cert);
-  if (NS_FAILED(rv))
-    return rv;
-
   rv = nsNSSDialogHelper::openDialog(parent, 
                                      "chrome://pippki/content/downloadcert.xul",
-                                     block);
-  if (NS_FAILED(rv)) return rv;
+                                     dlgParamBlock);
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
 
   int32_t status;
   int32_t ssl, email, objsign;
 
-  nsCOMPtr<nsIDialogParamBlock> dlgParamBlock = do_QueryInterface(block);
-  
   rv = dlgParamBlock->GetInt(1, &status);
   if (NS_FAILED(rv)) return rv;
   rv = dlgParamBlock->GetInt(2, &ssl);
@@ -182,12 +187,11 @@ nsNSSDialogs::ConfirmDownloadCACert(nsIInterfaceRequestor *ctx,
   *_trust |= (email) ? nsIX509CertDB::TRUSTED_EMAIL : 0;
   *_trust |= (objsign) ? nsIX509CertDB::TRUSTED_OBJSIGN : 0;
 
-  *_retval = (status == 0)?false:true;
+  *_retval = (status != 0);
 
   return rv;
 }
 
-
 NS_IMETHODIMP 
 nsNSSDialogs::NotifyCACertExists(nsIInterfaceRequestor *ctx)
 {
@@ -411,28 +415,32 @@ nsNSSDialogs::GetPKCS12FilePassword(nsIInterfaceRequestor* ctx,
 }
 
 NS_IMETHODIMP 
-nsNSSDialogs::ViewCert(nsIInterfaceRequestor *ctx, 
-                       nsIX509Cert *cert)
+nsNSSDialogs::ViewCert(nsIInterfaceRequestor* ctx, nsIX509Cert* cert)
 {
-  nsresult rv;
-
-  nsCOMPtr<nsIPKIParamBlock> block =
-           do_CreateInstance(NS_PKIPARAMBLOCK_CONTRACTID);
-  if (!block)
+  nsCOMPtr<nsIMutableArray> dlgArray(do_CreateInstance(NS_ARRAY_CONTRACTID));
+  if (!dlgArray) {
     return NS_ERROR_FAILURE;
-
-  rv = block->SetISupportAtIndex(1, cert);
-  if (NS_FAILED(rv))
+  }
+  nsresult rv = dlgArray->AppendElement(cert, false);
+  if (NS_FAILED(rv)) {
     return rv;
+  }
+  nsCOMPtr<nsIDialogParamBlock> dlgParamBlock(
+    do_CreateInstance(NS_DIALOGPARAMBLOCK_CONTRACTID));
+  if (!dlgParamBlock) {
+    return NS_ERROR_FAILURE;
+  }
+  rv = dlgParamBlock->SetObjects(dlgArray);
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
 
   // Get the parent window for the dialog
   nsCOMPtr<nsIDOMWindow> parent = do_GetInterface(ctx);
-
-  rv = nsNSSDialogHelper::openDialog(parent,
-                                     "chrome://pippki/content/certViewer.xul",
-                                     block,
-                                     false);
-  return rv;
+  return nsNSSDialogHelper::openDialog(parent,
+                                       "chrome://pippki/content/certViewer.xul",
+                                       dlgParamBlock,
+                                       false);
 }
 
 NS_IMETHODIMP
diff --git a/security/manager/pki/nsPKIModule.cpp b/security/manager/pki/nsPKIModule.cpp
index fb3af221d1..25b1ba8637 100644
--- a/security/manager/pki/nsPKIModule.cpp
+++ b/security/manager/pki/nsPKIModule.cpp
@@ -7,22 +7,18 @@
 #include "mozilla/ModuleUtils.h"
 
 #include "nsNSSDialogs.h"
-#include "nsPKIParamBlock.h"
 #include "nsASN1Tree.h"
 
 NS_GENERIC_FACTORY_CONSTRUCTOR_INIT(nsNSSDialogs, Init)
-NS_GENERIC_FACTORY_CONSTRUCTOR_INIT(nsPKIParamBlock, Init)
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsNSSASN1Tree)
 
 NS_DEFINE_NAMED_CID(NS_NSSDIALOGS_CID);
 NS_DEFINE_NAMED_CID(NS_NSSASN1OUTINER_CID);
-NS_DEFINE_NAMED_CID(NS_PKIPARAMBLOCK_CID);
 
 
 static const mozilla::Module::CIDEntry kPKICIDs[] = {
   { &kNS_NSSDIALOGS_CID, false, nullptr, nsNSSDialogsConstructor },
   { &kNS_NSSASN1OUTINER_CID, false, nullptr, nsNSSASN1TreeConstructor },
-  { &kNS_PKIPARAMBLOCK_CID, false, nullptr, nsPKIParamBlockConstructor },
   { nullptr }
 };
 
@@ -34,7 +30,6 @@ static const mozilla::Module::ContractIDEntry kPKIContracts[] = {
   { NS_TOKENDIALOGS_CONTRACTID, &kNS_NSSDIALOGS_CID },
   { NS_GENERATINGKEYPAIRINFODIALOGS_CONTRACTID, &kNS_NSSDIALOGS_CID },
   { NS_ASN1TREE_CONTRACTID, &kNS_NSSASN1OUTINER_CID },
-  { NS_PKIPARAMBLOCK_CONTRACTID, &kNS_PKIPARAMBLOCK_CID },
   { nullptr }
 };
 
diff --git a/security/manager/pki/nsPKIParamBlock.cpp b/security/manager/pki/nsPKIParamBlock.cpp
deleted file mode 100644
index 1a3885fab8..0000000000
--- a/security/manager/pki/nsPKIParamBlock.cpp
+++ /dev/null
@@ -1,97 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsPKIParamBlock.h"
-#include "nsIServiceManager.h"
-#include "nsIDialogParamBlock.h"
-#include "nsIMutableArray.h"
-
-NS_IMPL_ISUPPORTS(nsPKIParamBlock, nsIPKIParamBlock, nsIDialogParamBlock)
-
-nsPKIParamBlock::nsPKIParamBlock()
-{
-}
-
-nsresult
-nsPKIParamBlock::Init()
-{
-  mDialogParamBlock = do_CreateInstance(NS_DIALOGPARAMBLOCK_CONTRACTID);
-  return !mDialogParamBlock ? NS_ERROR_OUT_OF_MEMORY : NS_OK;
-}
-
-nsPKIParamBlock::~nsPKIParamBlock()
-{
-}
-
-
-NS_IMETHODIMP 
-nsPKIParamBlock::SetNumberStrings( int32_t inNumStrings )
-{
-  return mDialogParamBlock->SetNumberStrings(inNumStrings);
-}
-
-NS_IMETHODIMP 
-nsPKIParamBlock::SetInt(int32_t inIndex, int32_t inInt)
-{
-  return mDialogParamBlock->SetInt(inIndex, inInt);
-}
-
-NS_IMETHODIMP 
-nsPKIParamBlock::GetInt(int32_t inIndex, int32_t *outInt)
-{
-  return mDialogParamBlock->GetInt(inIndex, outInt);
-}
-
-
-NS_IMETHODIMP 
-nsPKIParamBlock::GetString(int32_t inIndex, char16_t **_retval)
-{
-  return mDialogParamBlock->GetString(inIndex, _retval);
-}
-
-NS_IMETHODIMP 
-nsPKIParamBlock::SetString(int32_t inIndex, const char16_t *inString)
-{
-  return mDialogParamBlock->SetString(inIndex, inString);
-}
-
-NS_IMETHODIMP
-nsPKIParamBlock::GetObjects(nsIMutableArray * *aObjects)
-{
-  return mDialogParamBlock->GetObjects(aObjects);
-}
-
-NS_IMETHODIMP
-nsPKIParamBlock::SetObjects(nsIMutableArray * aObjects)
-{
-  return mDialogParamBlock->SetObjects(aObjects);
-}
-
-
-
-NS_IMETHODIMP 
-nsPKIParamBlock::SetISupportAtIndex(int32_t index, nsISupports *object)
-{
-  if (!mSupports) {
-    mSupports = do_CreateInstance(NS_SUPPORTSARRAY_CONTRACTID);
-    if (!mSupports) {
-      return NS_ERROR_OUT_OF_MEMORY;
-    }
-  }
-  // Ignore any InsertElementAt error, because this function always did that
-  mSupports->InsertElementAt(object, index-1);
-  return NS_OK;
-}
-
-NS_IMETHODIMP 
-nsPKIParamBlock::GetISupportAtIndex(int32_t index, nsISupports **_retval)
-{
-  NS_ENSURE_ARG(_retval);
-
-  return mSupports->GetElementAt(index - 1, _retval);
-}
-
-
diff --git a/security/manager/pki/nsPKIParamBlock.h b/security/manager/pki/nsPKIParamBlock.h
deleted file mode 100644
index 5b43445546..0000000000
--- a/security/manager/pki/nsPKIParamBlock.h
+++ /dev/null
@@ -1,36 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-#ifndef _NSPKIPARAMBLOCK_
-#define _NSPKIPARAMBLOCK_
-#include "nsCOMPtr.h"
-#include "nsIPKIParamBlock.h"
-#include "nsIDialogParamBlock.h"
-#include "nsISupportsArray.h"
-
-#define NS_PKIPARAMBLOCK_CID \
-  { 0x0bec75a8, 0x1dd2, 0x11b2, \
-    { 0x86, 0x3a, 0xf6, 0x9f, 0x77, 0xc3, 0x13, 0x71 }}
-
-#define NS_PKIPARAMBLOCK_CONTRACTID "@mozilla.org/security/pkiparamblock;1"
-
-class nsPKIParamBlock : public nsIPKIParamBlock,
-                        public nsIDialogParamBlock
-{
-public:
- 
-  nsPKIParamBlock();
-  nsresult Init();
-
-  NS_DECL_NSIPKIPARAMBLOCK
-  NS_DECL_NSIDIALOGPARAMBLOCK
-  NS_DECL_THREADSAFE_ISUPPORTS
-private:
-  virtual ~nsPKIParamBlock();
-  nsCOMPtr<nsIDialogParamBlock> mDialogParamBlock;
-  nsCOMPtr<nsISupportsArray>    mSupports;
-};
-
-#endif //_NSPKIPARAMBLOCK_
diff --git a/security/manager/pki/resources/content/certManager.js b/security/manager/pki/resources/content/certManager.js
index 4ed0fa5ef4..a375beb76c 100644
--- a/security/manager/pki/resources/content/certManager.js
+++ b/security/manager/pki/resources/content/certManager.js
@@ -11,8 +11,6 @@ const nsICertTree = Components.interfaces.nsICertTree;
 const nsCertTree = "@mozilla.org/security/nsCertTree;1";
 const nsIDialogParamBlock = Components.interfaces.nsIDialogParamBlock;
 const nsDialogParamBlock = "@mozilla.org/embedcomp/dialogparam;1";
-const nsIPKIParamBlock    = Components.interfaces.nsIPKIParamBlock;
-const nsPKIParamBlock    = "@mozilla.org/security/pkiparamblock;1";
 
 const gCertFileTypes = "*.p7b; *.crt; *.cert; *.cer; *.pem; *.der";
 
diff --git a/security/manager/pki/resources/content/deletecert.js b/security/manager/pki/resources/content/deletecert.js
index fb2c286762..4a94ef52ec 100644
--- a/security/manager/pki/resources/content/deletecert.js
+++ b/security/manager/pki/resources/content/deletecert.js
@@ -5,7 +5,6 @@
 const nsIX509Cert = Components.interfaces.nsIX509Cert;
 const nsX509CertDB = "@mozilla.org/security/x509certdb;1";
 const nsIX509CertDB = Components.interfaces.nsIX509CertDB;
-const nsIPKIParamBlock = Components.interfaces.nsIPKIParamBlock;
 const nsIDialogParamBlock = Components.interfaces.nsIDialogParamBlock;
 
 var certdb;
diff --git a/security/manager/pki/resources/content/downloadcert.js b/security/manager/pki/resources/content/downloadcert.js
index de844f94e0..8f48619653 100644
--- a/security/manager/pki/resources/content/downloadcert.js
+++ b/security/manager/pki/resources/content/downloadcert.js
@@ -3,20 +3,16 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 const nsIDialogParamBlock = Components.interfaces.nsIDialogParamBlock;
-const nsIPKIParamBlock = Components.interfaces.nsIPKIParamBlock;
 const nsIX509Cert = Components.interfaces.nsIX509Cert;
 
-var pkiParams;
 var params;
 var caName;
 var cert;
 
 function onLoad()
 {
-  pkiParams = window.arguments[0].QueryInterface(nsIPKIParamBlock);
-  params = pkiParams.QueryInterface(nsIDialogParamBlock);
-  var isupport = pkiParams.getISupportAtIndex(1);
-  cert = isupport.QueryInterface(nsIX509Cert);
+  params = window.arguments[0].QueryInterface(nsIDialogParamBlock);
+  cert = params.objects.queryElementAt(0, nsIX509Cert);
 
   caName = cert.commonName; 
 
diff --git a/security/manager/pki/resources/content/editcerts.js b/security/manager/pki/resources/content/editcerts.js
index 0e96f3f1da..ae69e2d931 100644
--- a/security/manager/pki/resources/content/editcerts.js
+++ b/security/manager/pki/resources/content/editcerts.js
@@ -5,7 +5,6 @@
 const nsIX509Cert = Components.interfaces.nsIX509Cert;
 const nsX509CertDB = "@mozilla.org/security/x509certdb;1";
 const nsIX509CertDB = Components.interfaces.nsIX509CertDB;
-const nsIPKIParamBlock = Components.interfaces.nsIPKIParamBlock;
 
 var certdb;
 var cert;
diff --git a/security/manager/pki/resources/content/viewCertDetails.js b/security/manager/pki/resources/content/viewCertDetails.js
index eaca327b5a..d36467df04 100644
--- a/security/manager/pki/resources/content/viewCertDetails.js
+++ b/security/manager/pki/resources/content/viewCertDetails.js
@@ -7,12 +7,12 @@ const nsX509CertDB = "@mozilla.org/security/x509certdb;1";
 const nsIX509CertDB = Components.interfaces.nsIX509CertDB;
 const nsPK11TokenDB = "@mozilla.org/security/pk11tokendb;1";
 const nsIPK11TokenDB = Components.interfaces.nsIPK11TokenDB;
-const nsIPKIParamBlock = Components.interfaces.nsIPKIParamBlock;
 const nsIASN1Object = Components.interfaces.nsIASN1Object;
 const nsIASN1Sequence = Components.interfaces.nsIASN1Sequence;
 const nsIASN1PrintableItem = Components.interfaces.nsIASN1PrintableItem;
 const nsIASN1Tree = Components.interfaces.nsIASN1Tree;
 const nsASN1Tree = "@mozilla.org/security/nsASN1Tree;1"
+const nsIDialogParamBlock = Components.interfaces.nsIDialogParamBlock;
 
 var bundle;
 
@@ -78,9 +78,8 @@ function setWindowName()
     //var cert = certdb.findCertByNickname(token, myName);
     cert = certdb.findCertByNickname(null, myName);
   } else {
-    var pkiParams = window.arguments[0].QueryInterface(nsIPKIParamBlock);
-    var isupport = pkiParams.getISupportAtIndex(1);
-    cert = isupport.QueryInterface(nsIX509Cert);
+    var params = window.arguments[0].QueryInterface(nsIDialogParamBlock);
+    var cert = params.objects.queryElementAt(0, nsIX509Cert);
     document.title = certDetails + '"' + cert.windowTitle + '"'; // XXX l10n?
   }
 
diff --git a/security/manager/ssl/moz.build b/security/manager/ssl/moz.build
index a749ef8098..2c5eeb1068 100644
--- a/security/manager/ssl/moz.build
+++ b/security/manager/ssl/moz.build
@@ -159,8 +159,8 @@ LOCAL_INCLUDES += [
     '/security/pkix/include',
 ]
 
-GENERATED_INCLUDES += [
-    '/dist/public/nss',
+LOCAL_INCLUDES += [
+    '!/dist/public/nss',
 ]
 
 if CONFIG['_MSC_VER']:
diff --git a/security/manager/ssl/tests/mochitest/stricttransportsecurity/mochitest.ini b/security/manager/ssl/tests/mochitest/stricttransportsecurity/mochitest.ini
index 1d3a494d90..1df2585ca7 100644
--- a/security/manager/ssl/tests/mochitest/stricttransportsecurity/mochitest.ini
+++ b/security/manager/ssl/tests/mochitest/stricttransportsecurity/mochitest.ini
@@ -1,5 +1,6 @@
 [DEFAULT]
-skip-if = buildapp == 'b2g' || e10s
+tags = psm
+skip-if = buildapp == 'b2g'
 support-files =
   nosts_bootstrap.html
   nosts_bootstrap.html^headers^
diff --git a/security/manager/ssl/tests/mochitest/stricttransportsecurity/test_stricttransportsecurity.html b/security/manager/ssl/tests/mochitest/stricttransportsecurity/test_stricttransportsecurity.html
index 6a3e2df3f3..5905865685 100644
--- a/security/manager/ssl/tests/mochitest/stricttransportsecurity/test_stricttransportsecurity.html
+++ b/security/manager/ssl/tests/mochitest/stricttransportsecurity/test_stricttransportsecurity.html
@@ -47,13 +47,7 @@
       document.body.removeChild(document.getElementById('ifr_' + test));
 
     // clean up the STS state
-    const Cc = SpecialPowers.Cc;
-    const Ci = SpecialPowers.Ci;
-    var ios = Cc["@mozilla.org/network/io-service;1"].getService(Ci.nsIIOService);
-    var thehost = ios.newURI("http://example.com", null, null);
-
-    var sss = Cc["@mozilla.org/ssservice;1"].getService(Ci.nsISiteSecurityService);
-    sss.removeState(Ci.nsISiteSecurityService.HEADER_HSTS, thehost, 0);
+    SpecialPowers.cleanUpSTSData("http://example.com");
   }
 
   function loadVerifyFrames(round) {
diff --git a/security/manager/ssl/tests/mochitest/stricttransportsecurity/test_sts_privatebrowsing_perwindowpb.html b/security/manager/ssl/tests/mochitest/stricttransportsecurity/test_sts_privatebrowsing_perwindowpb.html
index be3fd00819..796517c98a 100644
--- a/security/manager/ssl/tests/mochitest/stricttransportsecurity/test_sts_privatebrowsing_perwindowpb.html
+++ b/security/manager/ssl/tests/mochitest/stricttransportsecurity/test_sts_privatebrowsing_perwindowpb.html
@@ -192,14 +192,8 @@
   function clean_up_sts_state(isPrivate) {
     // erase all signs that this test ran.
     SimpleTest.info("Cleaning up STS data");
-    var ios =
-      Cc["@mozilla.org/network/io-service;1"].getService(Ci.nsIIOService);
-    var thehost = ios.newURI("http://example.com", null, null);
-    var sss =
-      Cc["@mozilla.org/ssservice;1"].
-        getService(Ci.nsISiteSecurityService);
     var flags = isPrivate ? Ci.nsISocketProvider.NO_PERMANENT_STORAGE : 0
-    sss.removeState(Ci.nsISiteSecurityService.HEADER_HSTS, thehost, flags);
+    SpecialPowers.cleanUpSTSData("http://example.com", flags);
     dump_STSState(isPrivate);
   }
 
diff --git a/testing/mochitest/browser-harness.xul b/testing/mochitest/browser-harness.xul
index cbf8d18b6e..dfe2dd44d3 100644
--- a/testing/mochitest/browser-harness.xul
+++ b/testing/mochitest/browser-harness.xul
@@ -123,13 +123,13 @@
     }
     browserTest.prototype = {
       get passCount() {
-        return this.results.filter(function (t) !t.info && !t.todo && t.pass).length;
+        return this.results.filter(t => !t.info && !t.todo && t.pass).length;
       },
       get todoCount() {
-        return this.results.filter(function (t) !t.info && t.todo && t.pass).length;
+        return this.results.filter(t => !t.info && t.todo && t.pass).length;
       },
       get failCount() {
-        return this.results.filter(function (t) !t.info && !t.pass).length;
+        return this.results.filter(t => !t.info && !t.pass).length;
       },
 
       addResult: function addResult(result) {
@@ -288,9 +288,9 @@
 
       var log = "";
 
-      var passCount = aTests.map(function (f) f.passCount).reduce(sum);
-      var failCount = aTests.map(function (f) f.failCount).reduce(sum);
-      var todoCount = aTests.map(function (f) f.todoCount).reduce(sum);
+      var passCount = aTests.map(f => f.passCount).reduce(sum);
+      var failCount = aTests.map(f => f.failCount).reduce(sum);
+      var todoCount = aTests.map(f => f.todoCount).reduce(sum);
       log += "<div id=\"summary\" class=\"";
       log += failCount != 0 ? "failure" :
                passCount == 0 ? "todo" : "success";
diff --git a/testing/mochitest/browser-test.js b/testing/mochitest/browser-test.js
index 48180a33c9..bd3fc1617a 100644
--- a/testing/mochitest/browser-test.js
+++ b/testing/mochitest/browser-test.js
@@ -312,9 +312,9 @@ Tester.prototype = {
 
     this.Promise.Debugging.flushUncaughtErrors();
 
-    var passCount = this.tests.reduce(function(a, f) a + f.passCount, 0);
-    var failCount = this.tests.reduce(function(a, f) a + f.failCount, 0);
-    var todoCount = this.tests.reduce(function(a, f) a + f.todoCount, 0);
+    var passCount = this.tests.reduce((a, f) => a + f.passCount, 0);
+    var failCount = this.tests.reduce((a, f) => a + f.failCount, 0);
+    var todoCount = this.tests.reduce((a, f) => a + f.todoCount, 0);
 
     if (this.repeat > 0) {
       --this.repeat;
diff --git a/testing/mochitest/tests/Harness_sanity/mochitest.ini b/testing/mochitest/tests/Harness_sanity/mochitest.ini
index 0eefc3feea..4182d225ed 100644
--- a/testing/mochitest/tests/Harness_sanity/mochitest.ini
+++ b/testing/mochitest/tests/Harness_sanity/mochitest.ini
@@ -12,6 +12,8 @@ skip-if = (toolkit == 'android' && processor == 'x86') #x86 only
 [test_SpecialPowersExtension2.html]
 support-files = file_SpecialPowersFrame1.html
 [test_SpecialPowersPushPermissions.html]
+support-files =
+    specialPowers_framescript.js
 [test_SpecialPowersPushPrefEnv.html]
 [test_SimpletestGetTestFileURL.html]
 [test_SpecialPowersLoadChromeScript.html]
diff --git a/testing/mochitest/tests/Harness_sanity/specialPowers_framescript.js b/testing/mochitest/tests/Harness_sanity/specialPowers_framescript.js
new file mode 100644
index 0000000000..da1b87782a
--- /dev/null
+++ b/testing/mochitest/tests/Harness_sanity/specialPowers_framescript.js
@@ -0,0 +1,13 @@
+Components.utils.import("resource://gre/modules/Services.jsm");
+
+var permChangedObs = {
+  observe: function(subject, topic, data) {
+    if (topic == 'perm-changed') {
+      var permission = subject.QueryInterface(Components.interfaces.nsIPermission);
+      var msg = { op: data, type: permission.type };
+      sendAsyncMessage('perm-changed', msg);
+    }
+  }
+};
+
+Services.obs.addObserver(permChangedObs, 'perm-changed', false);
diff --git a/testing/mochitest/tests/Harness_sanity/test_SpecialPowersPushPermissions.html b/testing/mochitest/tests/Harness_sanity/test_SpecialPowersPushPermissions.html
index 9f48359abe..194ee4b305 100644
--- a/testing/mochitest/tests/Harness_sanity/test_SpecialPowersPushPermissions.html
+++ b/testing/mochitest/tests/Harness_sanity/test_SpecialPowersPushPermissions.html
@@ -17,6 +17,17 @@ const ACCESS_SESSION = SpecialPowers.Ci.nsICookiePermission.ACCESS_SESSION;
 const ACCESS_ALLOW_FIRST_PARTY_ONLY = SpecialPowers.Ci.nsICookiePermission.ACCESS_ALLOW_FIRST_PARTY_ONLY;
 const ACCESS_LIMIT_THIRD_PARTY = SpecialPowers.Ci.nsICookiePermission.ACCESS_LIMIT_THIRD_PARTY;
 
+const EXPIRE_TIME = SpecialPowers.Ci.nsIPermissionManager.EXPIRE_TIME;
+var start;
+const DELAY = 500;
+// PR_Now() that called in nsPermissionManager to get the system time and
+// Date.now() are out of sync on win32 platform(XP/win7). The PR_Now() is
+// 15~20ms less than Date.now(). Unfortunately, this time skew can't be
+// avoided, so it needs to add a time buffer to compensate.
+const TIME_SKEW = 100;
+var gScript = SpecialPowers.loadChromeScript(SimpleTest.getTestFileURL('specialPowers_framescript.js'));
+SimpleTest.requestFlakyTimeout("untriaged");
+
 function starttest(){
   SpecialPowers.addPermission("pPROMPT", PROMPT_ACTION, document);
   SpecialPowers.addPermission("pALLOW", ALLOW_ACTION, document);
@@ -136,9 +147,70 @@ function test6() {
     dump('/**** pTHIRDPARTY still set ****/\n');
     setTimeout(test6, 0);
   } else {
-    SimpleTest.finish();
+    test7();
   }
 }
+
+function test7() {
+  afterPermissionChanged('pEXPIRE', 'deleted', test8);
+  afterPermissionChanged('pEXPIRE', 'added', permissionPollingCheck);
+  start = Number(Date.now());
+  SpecialPowers.addPermission('pEXPIRE', true, document, EXPIRE_TIME, start + DELAY);
+}
+
+function test8() {
+  afterPermissionChanged('pEXPIRE', 'deleted', SimpleTest.finish);
+  afterPermissionChanged('pEXPIRE', 'added', permissionPollingCheck);
+  start = Number(Date.now());
+  SpecialPowers.pushPermissions([
+    { 'type': 'pEXPIRE',
+      'allow': true,
+      'expireType': EXPIRE_TIME,
+      'expireTime': start + DELAY,
+      'context': document
+    }], function() {
+      info("Wait permission changed signal!");
+    }
+  );
+}
+
+function afterPermissionChanged(type, op, callback) {
+  // handle the message from specialPowers_framescript.js
+  gScript.addMessageListener('perm-changed', function onChange(msg) {
+    if (msg.type == type && msg.op == op) {
+      gScript.removeMessageListener('perm-changed', onChange);
+      callback();
+    }
+  });
+}
+
+function permissionPollingCheck() {
+  var now = Number(Date.now());
+  if (now < start + DELAY) {
+    ok(SpecialPowers.testPermission('pEXPIRE', ALLOW_ACTION, document),
+       'unexpired permission is still there!');
+    setTimeout(permissionPollingCheck, DELAY);
+    return;
+  }
+
+  if (SpecialPowers.testPermission('pEXPIRE', ALLOW_ACTION, document) &&
+      (now < start + DELAY + TIME_SKEW) &&
+      isWin32()) {
+    setTimeout(permissionPollingCheck, DELAY);
+    return;
+  }
+
+  // The permission is already expired!
+  ok(!SpecialPowers.testPermission('pEXPIRE', ALLOW_ACTION, document),
+     'expired permission should be removed!');
+}
+
+function isWin32() {
+  var version = SpecialPowers.Services.sysinfo.getProperty('version');
+  version = parseFloat(version);
+  // version 5.1 is win XP, 6.1 is win7
+  return (navigator.platform.indexOf('Win') == 0) && (version <= 6.1);
+}
 </script>
 </pre>
 </body>
diff --git a/testing/mochitest/tests/Harness_sanity/test_bug816847.html b/testing/mochitest/tests/Harness_sanity/test_bug816847.html
index a7ff5e308c..f6a5edfed4 100644
--- a/testing/mochitest/tests/Harness_sanity/test_bug816847.html
+++ b/testing/mochitest/tests/Harness_sanity/test_bug816847.html
@@ -57,8 +57,7 @@ function starttest(){
   SpecialPowers.addPermission(perms[0], true, origin);
   SpecialPowers.addPermission(perms[1], true, {manifestURL: manifest});
   SpecialPowers.addPermission(perms[2], true, document);
-  SpecialPowers.addPermission(perms[3], true, {url: origin,
-                                               appId: Ci.nsIScriptSecurityManager.NO_APP_ID});
+  SpecialPowers.addPermission(perms[3], true, {url: origin});
 
   is(Services.perms.testPermissionFromPrincipal(noappPrincipal, perms[0]),
      allow, "Set permission by string");
@@ -74,8 +73,7 @@ function starttest(){
   SpecialPowers.removePermission(perms[0], origin);
   SpecialPowers.removePermission(perms[1], {manifestURL: manifest});
   SpecialPowers.removePermission(perms[2], document);
-  SpecialPowers.removePermission(perms[3], {url: origin,
-                                            appId: Ci.nsIScriptSecurityManager.NO_APP_ID});
+  SpecialPowers.removePermission(perms[3], {url: origin});
 
   is(Services.perms.testPermissionFromPrincipal(noappPrincipal, perms[0]),
      unknown, "Removed permission by string");
diff --git a/testing/mochitest/tests/SimpleTest/SimpleTest.js b/testing/mochitest/tests/SimpleTest/SimpleTest.js
index 6b341ec9c1..5178b148d9 100644
--- a/testing/mochitest/tests/SimpleTest/SimpleTest.js
+++ b/testing/mochitest/tests/SimpleTest/SimpleTest.js
@@ -1107,7 +1107,7 @@ SimpleTest.monitorConsole = function (continuation, msgs, forbidUnexpectedMsgs)
   }
 
   function msgMatches(msg, pat) {
-    for (k in pat) {
+    for (var k in pat) {
       if (!(k in msg)) {
         return false;
       }
diff --git a/testing/modules/AppInfo.jsm b/testing/modules/AppInfo.jsm
index af9f0d08b5..8f08fdc4da 100644
--- a/testing/modules/AppInfo.jsm
+++ b/testing/modules/AppInfo.jsm
@@ -30,7 +30,9 @@ var APP_INFO = {
   invalidateCachesOnRestart() {},
 
   // nsIWinAppHelper
-  get userCanElevate() false,
+  get userCanElevate() {
+    return false;
+  },
 
   QueryInterface(iid) {
     let interfaces = [ Ci.nsIXULAppInfo, Ci.nsIXULRuntime ];
diff --git a/testing/mozbase/mozprofile/mozprofile/profile.py b/testing/mozbase/mozprofile/mozprofile/profile.py
index 4c0484ee19..9165aa4f86 100644
--- a/testing/mozbase/mozprofile/mozprofile/profile.py
+++ b/testing/mozbase/mozprofile/mozprofile/profile.py
@@ -359,8 +359,6 @@ class FirefoxProfile(Profile):
                    'toolkit.startup.max_resumed_crashes' : -1,
                    # Don't report telemetry information
                    'toolkit.telemetry.enabled' : False,
-                   # Disable periodic updates of service workers
-                   'dom.serviceWorkers.periodic-updates.enabled': False,
                    }
 
 class MetroFirefoxProfile(Profile):
@@ -404,8 +402,6 @@ class MetroFirefoxProfile(Profile):
                    'toolkit.startup.max_resumed_crashes' : -1,
                    # Don't report telemetry information
                    'toolkit.telemetry.enabled' : False,
-                   # Disable periodic updates of service workers
-                   'dom.serviceWorkers.periodic-updates.enabled': False,
                    }
 
 class ThunderbirdProfile(Profile):
diff --git a/testing/profiles/prefs_general.js b/testing/profiles/prefs_general.js
index ccd4e66ae2..6bdb12cd38 100644
--- a/testing/profiles/prefs_general.js
+++ b/testing/profiles/prefs_general.js
@@ -309,10 +309,6 @@ user_pref("network.proxy.pac_generator", false);
 // Make tests run consistently on DevEdition (which has a lightweight theme
 // selected by default).
 user_pref("lightweightThemes.selectedThemeID", "");
-user_pref("browser.devedition.theme.enabled", false);
-
-// Disable periodic updates of service workers.
-user_pref("dom.serviceWorkers.periodic-updates.enabled", false);
 
 // Enable speech synth test service, and disable built in platform services.
 user_pref("media.webspeech.synth.test", true);
diff --git a/testing/specialpowers/components/SpecialPowersObserver.js b/testing/specialpowers/components/SpecialPowersObserver.js
index 038476f6eb..1b48c2c300 100644
--- a/testing/specialpowers/components/SpecialPowersObserver.js
+++ b/testing/specialpowers/components/SpecialPowersObserver.js
@@ -88,7 +88,7 @@ SpecialPowersObserver.prototype = new SpecialPowersObserverAPI();
       this._messageManager.addMessageListener("SPChromeScriptMessage", this);
       this._messageManager.addMessageListener("SPQuotaManager", this);
       this._messageManager.addMessageListener("SPSetTestPluginEnabledState", this);
-      this._messageManager.addMessageListener("SPPeriodicServiceWorkerUpdates", this);
+      this._messageManager.addMessageListener("SPCleanUpSTSData", this);
 
       this._messageManager.loadFrameScript(CHILD_LOGGER_SCRIPT, true);
       this._messageManager.loadFrameScript(CHILD_SCRIPT_API, true);
@@ -147,7 +147,7 @@ SpecialPowersObserver.prototype = new SpecialPowersObserverAPI();
       this._messageManager.removeMessageListener("SPChromeScriptMessage", this);
       this._messageManager.removeMessageListener("SPQuotaManager", this);
       this._messageManager.removeMessageListener("SPSetTestPluginEnabledState", this);
-      this._messageManager.removeMessageListener("SPPeriodicServiceWorkerUpdates", this);
+      this._messageManager.removeMessageListener("SPCleanUpSTSData", this);
 
       this._messageManager.removeDelayedFrameScript(CHILD_LOGGER_SCRIPT);
       this._messageManager.removeDelayedFrameScript(CHILD_SCRIPT_API);
diff --git a/testing/specialpowers/content/SpecialPowersObserverAPI.js b/testing/specialpowers/content/SpecialPowersObserverAPI.js
index aababf3539..575e19ba74 100644
--- a/testing/specialpowers/content/SpecialPowersObserverAPI.js
+++ b/testing/specialpowers/content/SpecialPowersObserverAPI.js
@@ -312,32 +312,21 @@ SpecialPowersObserverAPI.prototype = {
 
       case "SPPermissionManager": {
         let msg = aMessage.json;
-
-        let secMan = Services.scriptSecurityManager;
-        // TODO: Bug 1196665 - Add originAttributes into SpecialPowers
-        let attrs = {appId: msg.appId, inBrowser: msg.isInBrowserElement};
-        let principal = secMan.createCodebasePrincipal(this._getURI(msg.url), attrs);
+        let principal = msg.principal;
 
         switch (msg.op) {
           case "add":
-            Services.perms.addFromPrincipal(principal, msg.type, msg.permission);
+            Services.perms.addFromPrincipal(principal, msg.type, msg.permission, msg.expireType, msg.expireTime);
             break;
           case "remove":
             Services.perms.removeFromPrincipal(principal, msg.type);
             break;
           case "has":
             let hasPerm = Services.perms.testPermissionFromPrincipal(principal, msg.type);
-            if (hasPerm == Ci.nsIPermissionManager.ALLOW_ACTION) 
-              return true;
-            return false;
-            break;
+            return hasPerm == Ci.nsIPermissionManager.ALLOW_ACTION;
           case "test":
             let testPerm = Services.perms.testPermissionFromPrincipal(principal, msg.type, msg.value);
-            if (testPerm == msg.value)  {
-              return true;
-            }
-            return false;
-            break;
+            return testPerm == msg.value;
           default:
             throw new SpecialPowersError(
               "Invalid operation for SPPermissionManager");
@@ -378,32 +367,32 @@ SpecialPowersObserverAPI.prototype = {
               return;
             }
           case "inject-app":
-	    {
+            {
               let aAppId = aMessage.json.appId;
-	      let aApp   = aMessage.json.app;
+              let aApp   = aMessage.json.app;
 
               let keys = Object.keys(Webapps.DOMApplicationRegistry.webapps);
-	      let exists = keys.indexOf(aAppId) !== -1;
-	      if (exists) {
+              let exists = keys.indexOf(aAppId) !== -1;
+              if (exists) {
                 return false;
-	      }
+              }
 
               Webapps.DOMApplicationRegistry.webapps[aAppId] = aApp;
-	      return true;
-	    }
-	  case "reject-app":
-	    {
+              return true;
+            }
+          case "reject-app":
+            {
               let aAppId = aMessage.json.appId;
 
               let keys = Object.keys(Webapps.DOMApplicationRegistry.webapps);
-	      let exists = keys.indexOf(aAppId) !== -1;
-	      if (!exists) {
+              let exists = keys.indexOf(aAppId) !== -1;
+              if (!exists) {
                 return false;
-	      }
+              }
 
               delete Webapps.DOMApplicationRegistry.webapps[aAppId];
-	      return true;
-	    }
+              return true;
+            }
           default:
             throw new SpecialPowersError("Invalid operation for SPWebAppsService");
         }
@@ -497,6 +486,7 @@ SpecialPowersObserverAPI.prototype = {
                          .frameLoader
                          .messageManager;
         let msg = aMessage.data;
+        let principal = msg.principal;
         let op = msg.op;
 
         if (op != 'clear' && op != 'getUsage' && op != 'reset') {
@@ -540,15 +530,13 @@ SpecialPowersObserverAPI.prototype = {
         return undefined;	// See comment at the beginning of this function.
       }
 
-      case "SPPeriodicServiceWorkerUpdates": {
-        // We could just dispatch a generic idle-daily notification here, but
-        // this is better since it avoids invoking other idle daily observers
-        // at the cost of hard-coding the usage of PeriodicServiceWorkerUpdater.
-        Cc["@mozilla.org/service-worker-periodic-updater;1"].
-          getService(Ci.nsIObserver).
-          observe(null, "idle-daily", "Caller:SpecialPowers");
-
-        return undefined;	// See comment at the beginning of this function.
+      case "SPCleanUpSTSData": {
+        let origin = aMessage.data.origin;
+        let flags = aMessage.data.flags;
+        let uri = Services.io.newURI(origin, null, null);
+        let sss = Cc["@mozilla.org/ssservice;1"].
+                  getService(Ci.nsISiteSecurityService);
+        sss.removeState(Ci.nsISiteSecurityService.HEADER_HSTS, uri, flags);
       }
 
       default:
diff --git a/testing/specialpowers/content/specialpowers.js b/testing/specialpowers/content/specialpowers.js
index 5c7776ab60..6c02405976 100644
--- a/testing/specialpowers/content/specialpowers.js
+++ b/testing/specialpowers/content/specialpowers.js
@@ -32,7 +32,7 @@ function SpecialPowers(window) {
                            "SPProcessCrashService",
                            "SPSetTestPluginEnabledState",
                            "SPWebAppService",
-                           "SPPeriodicServiceWorkerUpdates"];
+                           "SPCleanUpSTSData"];
 
   this.SP_ASYNC_MESSAGES = ["SpecialPowers.Focus",
                             "SpecialPowers.Quit",
diff --git a/testing/specialpowers/content/specialpowersAPI.js b/testing/specialpowers/content/specialpowersAPI.js
index c95fb24bec..73b90e8045 100644
--- a/testing/specialpowers/content/specialpowersAPI.js
+++ b/testing/specialpowers/content/specialpowersAPI.js
@@ -25,7 +25,7 @@ Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 // but this whole file is in strict mode.  So instead fall back on
 // returning "this" from indirect eval, which returns the global.
 if (!(function() { var e = eval; return e("this"); })().File) {
-  Cu.importGlobalProperties(["File"]);
+    Cu.importGlobalProperties(["File"]);
 }
 
 // Allow stuff from this scope to be accessed from non-privileged scopes. This
@@ -606,7 +606,7 @@ SpecialPowersAPI.prototype = {
       // in order to properly log these assertions and notify
       // all usefull log observers
       let window = this.window.get();
-      let parentRunner, repr = function (o) o;
+      let parentRunner, repr = o => o;
       if (window) {
         window = window.wrappedJSObject;
         parentRunner = window.TestRunner;
@@ -785,8 +785,8 @@ SpecialPowersAPI.prototype = {
           originalValue = Ci.nsICookiePermission.ACCESS_LIMIT_THIRD_PARTY;
         }
 
-        let [url, appId, isInBrowserElement, isSystem] = this._getInfoFromPermissionArg(context);
-        if (isSystem) {
+        let principal = this._getPrincipalFromArg(context);
+        if (principal.isSystemPrincipal) {
           continue;
         }
 
@@ -805,14 +805,24 @@ SpecialPowersAPI.prototype = {
           continue;
         }
 
-        var todo = {'op': 'add', 'type': permission.type, 'permission': perm, 'value': perm, 'url': url, 'appId': appId, 'isInBrowserElement': isInBrowserElement};
+        var todo = {'op': 'add',
+                    'type': permission.type,
+                    'permission': perm,
+                    'value': perm,
+                    'principal': principal,
+                    'expireType': (typeof permission.expireType === "number") ?
+                      permission.expireType : 0, // default: EXPIRE_NEVER
+                    'expireTime': (typeof permission.expireTime === "number") ?
+                      permission.expireTime : 0};
+
+        var cleanupTodo = Object.assign({}, todo);
+
         if (permission.remove == true)
           todo.op = 'remove';
 
         pendingPermissions.push(todo);
 
         /* Push original permissions value or clear into cleanup array */
-        var cleanupTodo = {'op': 'add', 'type': permission.type, 'permission': perm, 'value': perm, 'url': url, 'appId': appId, 'isInBrowserElement': isInBrowserElement};
         if (originalValue == Ci.nsIPermissionManager.UNKNOWN_ACTION) {
           cleanupTodo.op = 'remove';
         } else {
@@ -1729,57 +1739,40 @@ SpecialPowersAPI.prototype = {
     Services.perms.removeFromPrincipal(document.nodePrincipal, "fullscreen");
   },
 
-  _getInfoFromPermissionArg: function(arg) {
-    let url = "";
-    let appId = Ci.nsIScriptSecurityManager.NO_APP_ID;
-    let isInBrowserElement = false;
-    let isSystem = false;
+  _getPrincipalFromArg: function(arg) {
+    let principal;
+    let secMan = Services.scriptSecurityManager;
 
     if (typeof(arg) == "string") {
       // It's an URL.
-      url = Cc["@mozilla.org/network/io-service;1"]
-              .getService(Ci.nsIIOService)
-              .newURI(arg, null, null)
-              .spec;
+      let uri = Services.io.newURI(arg, null, null);
+      principal = secMan.createCodebasePrincipal(uri, {});
     } else if (arg.manifestURL) {
       // It's a thing representing an app.
       let appsSvc = Cc["@mozilla.org/AppsService;1"]
                       .getService(Ci.nsIAppsService)
       let app = appsSvc.getAppByManifestURL(arg.manifestURL);
-
       if (!app) {
         throw "No app for this manifest!";
       }
 
-      appId = appsSvc.getAppLocalIdByManifestURL(arg.manifestURL);
-      url = app.origin;
-      isInBrowserElement = arg.isInBrowserElement || false;
+      principal = app.principal;
     } else if (arg.nodePrincipal) {
       // It's a document.
-      isSystem = (arg.nodePrincipal instanceof Ci.nsIPrincipal) &&
-                 Cc["@mozilla.org/scriptsecuritymanager;1"].
-                 getService(Ci.nsIScriptSecurityManager).
-                 isSystemPrincipal(arg.nodePrincipal);
-      if (!isSystem) {
-        // System principals don't have a URL associated with them, and they
-        // don't really need any permissions to be registered with the
-        // permission manager anyway.
-        url = arg.nodePrincipal.URI.spec;
-        appId = arg.nodePrincipal.appId;
-        isInBrowserElement = arg.nodePrincipal.isInBrowserElement;
-      }
+      // In some tests the arg is a wrapped DOM element, so we unwrap it first.
+      principal = unwrapIfWrapped(arg).nodePrincipal;
     } else {
-      url = arg.url;
-      appId = arg.appId;
-      isInBrowserElement = arg.isInBrowserElement;
+      let uri = Services.io.newURI(arg.url, null, null);
+      let attrs = arg.originAttributes || {};
+      principal = secMan.createCodebasePrincipal(uri, attrs);
     }
 
-    return [ url, appId, isInBrowserElement, isSystem ];
+    return principal;
   },
 
-  addPermission: function(type, allow, arg) {
-    let [url, appId, isInBrowserElement, isSystem] = this._getInfoFromPermissionArg(arg);
-    if (isSystem) {
+  addPermission: function(type, allow, arg, expireType, expireTime) {
+    let principal = this._getPrincipalFromArg(arg);
+    if (principal.isSystemPrincipal) {
       return; // nothing to do
     }
 
@@ -1795,60 +1788,55 @@ SpecialPowersAPI.prototype = {
       'op': 'add',
       'type': type,
       'permission': permission,
-      'url': url,
-      'appId': appId,
-      'isInBrowserElement': isInBrowserElement
+      'principal': principal,
+      'expireType': (typeof expireType === "number") ? expireType : 0,
+      'expireTime': (typeof expireTime === "number") ? expireTime : 0
     };
 
     this._sendSyncMessage('SPPermissionManager', msg);
   },
 
   removePermission: function(type, arg) {
-    let [url, appId, isInBrowserElement, isSystem] = this._getInfoFromPermissionArg(arg);
-    if (isSystem) {
+    let principal = this._getPrincipalFromArg(arg);
+    if (principal.isSystemPrincipal) {
       return; // nothing to do
     }
 
     var msg = {
       'op': 'remove',
       'type': type,
-      'url': url,
-      'appId': appId,
-      'isInBrowserElement': isInBrowserElement
+      'principal': principal
     };
 
     this._sendSyncMessage('SPPermissionManager', msg);
   },
 
   hasPermission: function (type, arg) {
-    let [url, appId, isInBrowserElement, isSystem] = this._getInfoFromPermissionArg(arg);
-    if (isSystem) {
+    let principal = this._getPrincipalFromArg(arg);
+    if (principal.isSystemPrincipal) {
       return true; // system principals have all permissions
     }
 
     var msg = {
       'op': 'has',
       'type': type,
-      'url': url,
-      'appId': appId,
-      'isInBrowserElement': isInBrowserElement
+      'principal': principal
     };
 
     return this._sendSyncMessage('SPPermissionManager', msg)[0];
   },
+
   testPermission: function (type, value, arg) {
-    let [url, appId, isInBrowserElement, isSystem] = this._getInfoFromPermissionArg(arg);
-    if (isSystem) {
+    let principal = this._getPrincipalFromArg(arg);
+    if (principal.isSystemPrincipal) {
       return true; // system principals have all permissions
     }
 
     var msg = {
       'op': 'test',
       'type': type,
-      'value': value, 
-      'url': url,
-      'appId': appId,
-      'isInBrowserElement': isInBrowserElement
+      'value': value,
+      'principal': principal
     };
     return this._sendSyncMessage('SPPermissionManager', msg)[0];
   },
@@ -1873,28 +1861,20 @@ SpecialPowersAPI.prototype = {
     this._sendSyncMessage('SPObserverService', msg);
   },
 
-  clearStorageForURI: function(uri, callback, appId, inBrowser) {
-    this._quotaManagerRequest('clear', uri, appId, inBrowser, callback);
+  clearStorageForDoc: function(wrappedDocument, callback) {
+    this._quotaManagerRequest('clear', wrappedDocument, callback);
   },
 
-  getStorageUsageForURI: function(uri, callback, appId, inBrowser) {
-    this._quotaManagerRequest('getUsage', uri, appId, inBrowser, callback);
+  getStorageUsageForDoc: function(wrappedDocument, callback) {
+    this._quotaManagerRequest('getUsage', wrappedDocument, callback);
   },
 
-  // Technically this restarts the QuotaManager for all URIs, but we need
-  // a specific one to perform the synchronized callback when the reset is
-  // complete.
-  resetStorageForURI: function(uri, callback, appId, inBrowser) {
-    this._quotaManagerRequest('reset', uri, appId, inBrowser, callback);
+  resetStorageForDoc: function(wrappedDocument, callback) {
+    this._quotaManagerRequest('reset', wrappedDocument, callback);
   },
 
-  _quotaManagerRequest: function(op, uri, appId, inBrowser, callback) {
+  _quotaManagerRequest: function(op, wrappedDocument, callback) {
     const messageTopic = "SPQuotaManager";
-
-    if (uri instanceof Ci.nsIURI) {
-      uri = uri.spec;
-    }
-
     const id = Cc["@mozilla.org/uuid-generator;1"]
                  .getService(Ci.nsIUUIDGenerator)
                  .generateUUID()
@@ -1931,7 +1911,8 @@ SpecialPowersAPI.prototype = {
       this._quotaManagerCallbackInfos = [ callbackInfo ];
     }
 
-    let msg = { op: op, uri: uri, appId: appId, inBrowser: inBrowser, id: id };
+    let principal = unwrapIfWrapped(wrappedDocument).nodePrincipal;
+    let msg = { op: op, principal: principal, id: id };
     this._sendAsyncMessage(messageTopic, msg);
   },
 
@@ -1939,10 +1920,6 @@ SpecialPowersAPI.prototype = {
     return new File(path, options);
   },
 
-  startPeriodicServiceWorkerUpdates: function() {
-    return this._sendSyncMessage('SPPeriodicServiceWorkerUpdates', {});
-  },
-
   removeAllServiceWorkerData: function() {
     this.notifyObserversInParentProcess(null, "browser:purge-session-history", "");
   },
@@ -1950,6 +1927,14 @@ SpecialPowersAPI.prototype = {
   removeServiceWorkerDataForExampleDomain: function() {
     this.notifyObserversInParentProcess(null, "browser:purge-domain-data", "example.com");
   },
+
+  cleanUpSTSData: function(origin, flags) {
+    return this._sendSyncMessage('SPCleanUpSTSData', {origin: origin, flags: flags || 0});
+  },
+
+  invalidateExtensionStorageCache: function() {
+    this.notifyObserversInParentProcess(null, "extension-invalidate-storage-cache", "");
+  },
 };
 
 this.SpecialPowersAPI = SpecialPowersAPI;
diff --git a/testing/tps/tps/testrunner.py b/testing/tps/tps/testrunner.py
index 6c9e248de0..c41c73e432 100644
--- a/testing/tps/tps/testrunner.py
+++ b/testing/tps/tps/testrunner.py
@@ -72,8 +72,6 @@ class TPSTestRunner(object):
         'services.sync.firstSync': 'notReady',
         'services.sync.lastversion': '1.0',
         'toolkit.startup.max_resumed_crashes': -1,
-        # Disable periodic updates of service workers
-        'dom.serviceWorkers.periodic-updates.enabled': False,
     }
 
     debug_preferences = {
diff --git a/testing/xpcshell/head.js b/testing/xpcshell/head.js
index e21cc2af89..2a83dcc6aa 100644
--- a/testing/xpcshell/head.js
+++ b/testing/xpcshell/head.js
@@ -216,7 +216,9 @@ var _fakeIdleService = {
       Components.manager.QueryInterface(Components.interfaces.nsIComponentRegistrar);
   },
   contractID: "@mozilla.org/widget/idleservice;1",
-  get CID() this.registrar.contractIDToCID(this.contractID),
+  get CID() {
+    return this.registrar.contractIDToCID(this.contractID);
+  },
 
   activate: function FIS_activate()
   {
@@ -268,7 +270,9 @@ var _fakeIdleService = {
   },
 
   // nsIIdleService
-  get idleTime() 0,
+  get idleTime() {
+    return 0;
+  },
   addIdleObserver: function () {},
   removeIdleObserver: function () {},
 
diff --git a/toolkit/components/addoncompat/tests/addon/bootstrap.js b/toolkit/components/addoncompat/tests/addon/bootstrap.js
index e7f23d376c..a775bf02aa 100644
--- a/toolkit/components/addoncompat/tests/addon/bootstrap.js
+++ b/toolkit/components/addoncompat/tests/addon/bootstrap.js
@@ -273,8 +273,9 @@ function testAboutModuleRegistration()
 
   let modulesToUnregister = new Map();
 
-  function TestChannel(uri, aboutName) {
+  function TestChannel(uri, aLoadInfo, aboutName) {
     this.aboutName = aboutName;
+    this.loadInfo = aLoadInfo;
     this.URI = this.originalURI = uri;
   }
 
@@ -376,8 +377,8 @@ function testAboutModuleRegistration()
       contractID: `@mozilla.org/network/protocol/about;1?what=${aboutName}`,
       QueryInterface: XPCOMUtils.generateQI([Ci.nsIAboutModule]),
 
-      newChannel: (aURI) => {
-        return new TestChannel(aURI, aboutName);
+      newChannel: (aURI, aLoadInfo) => {
+        return new TestChannel(aURI, aLoadInfo, aboutName);
       },
 
       getURIFlags: (aURI) => {
diff --git a/toolkit/components/parentalcontrols/nsParentalControlsServiceWin.cpp b/toolkit/components/parentalcontrols/nsParentalControlsServiceWin.cpp
index b85d0a5624..afd579fa4d 100644
--- a/toolkit/components/parentalcontrols/nsParentalControlsServiceWin.cpp
+++ b/toolkit/components/parentalcontrols/nsParentalControlsServiceWin.cpp
@@ -13,6 +13,7 @@
 #include "nsILocalFileWin.h"
 #include "nsArrayUtils.h"
 #include "nsIXULAppInfo.h"
+#include "mozilla/UniquePtr.h"
 #include "mozilla/WindowsVersion.h"
 
 using namespace mozilla;
@@ -248,9 +249,7 @@ nsParentalControlsService::RequestURIOverrides(nsIArray *aTargets, nsIInterfaceR
 
   // Allocate an array of sub uri
   int32_t count = arrayLength - 1;
-  nsAutoArrayPtr<LPCWSTR> arrUrls(new LPCWSTR[count]);
-  if (!arrUrls)
-    return NS_ERROR_OUT_OF_MEMORY;
+  auto arrUrls = MakeUnique<LPCWSTR[]>(count);
 
   uint32_t uriIdx = 0, idx;
   for (idx = 1; idx < arrayLength; idx++)
diff --git a/toolkit/components/satchel/jar.mn b/toolkit/components/satchel/jar.mn
index 6ce41a1138..4b37d5dc5d 100644
--- a/toolkit/components/satchel/jar.mn
+++ b/toolkit/components/satchel/jar.mn
@@ -4,4 +4,4 @@
 
 toolkit.jar:
 %   content satchel %content/satchel/
-    content/satchel/formSubmitListener.js            (formSubmitListener.js)
+    content/satchel/formSubmitListener.js
diff --git a/toolkit/components/telemetry/Histograms.json b/toolkit/components/telemetry/Histograms.json
index aea3a1365e..40f8598e73 100644
--- a/toolkit/components/telemetry/Histograms.json
+++ b/toolkit/components/telemetry/Histograms.json
@@ -4044,12 +4044,19 @@
     "n_buckets": 30,
     "description": "Average paint duration during any tab open/close animation (excluding tabstrip scroll)"
   },
-  "FX_REFRESH_DRIVER_FRAME_DELAY_MS": {
+  "FX_REFRESH_DRIVER_CHROME_FRAME_DELAY_MS": {
     "expires_in_version": "default",
     "kind": "exponential",
     "high": "10000",
     "n_buckets": 50,
-    "description": "Delay in ms between the target and the actual handling time of the frame at refresh driver"
+    "description": "Delay in ms between the target and the actual handling time of the frame at refresh driver in the chrome process."
+  },
+  "FX_REFRESH_DRIVER_CONTENT_FRAME_DELAY_MS": {
+    "expires_in_version": "default",
+    "kind": "exponential",
+    "high": "10000",
+    "n_buckets": 50,
+    "description": "Delay in ms between the target and the actual handling time of the frame at refresh driver in the content process."
   },
   "FX_TAB_SWITCH_UPDATE_MS": {
     "alert_emails": ["perf-telemetry-alerts@mozilla.com"],
@@ -9192,5 +9199,12 @@
     "expires_in_version": "55",
     "kind": "count",
     "description": "Attempt to notify ServiceWorker of push notification resubscription."
+  },
+  "GFX_CRASH": {
+    "expires_in_version": "never",
+    "kind": "enumerated",
+    "n_values": 100,
+    "releaseChannelCollection": "opt-out",
+    "description": "Graphics Crash Reason (...)"
   }
 }
diff --git a/toolkit/components/thumbnails/PageThumbs.jsm b/toolkit/components/thumbnails/PageThumbs.jsm
index ec23e64ee4..b585b97e2e 100644
--- a/toolkit/components/thumbnails/PageThumbs.jsm
+++ b/toolkit/components/thumbnails/PageThumbs.jsm
@@ -152,7 +152,7 @@ this.PageThumbs = {
    */
   getThumbnailURL: function PageThumbs_getThumbnailURL(aUrl) {
     return this.scheme + "://" + this.staticHost +
-           "?url=" + encodeURIComponent(aUrl);
+           "/?url=" + encodeURIComponent(aUrl);
   },
 
    /**
diff --git a/toolkit/components/thumbnails/PageThumbsProtocol.js b/toolkit/components/thumbnails/PageThumbsProtocol.js
index 994feee167..baa6996626 100644
--- a/toolkit/components/thumbnails/PageThumbsProtocol.js
+++ b/toolkit/components/thumbnails/PageThumbsProtocol.js
@@ -10,7 +10,7 @@
  *
  * URL structure:
  *
- * moz-page-thumb://thumbnail?url=http%3A%2F%2Fwww.mozilla.org%2F
+ * moz-page-thumb://thumbnail/?url=http%3A%2F%2Fwww.mozilla.org%2F
  *
  * This URL requests an image for 'http://www.mozilla.org/'.
  */
@@ -24,14 +24,17 @@ const Ci = Components.interfaces;
 
 Cu.import("resource://gre/modules/PageThumbs.jsm");
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://gre/modules/osfile.jsm", this);
 
 XPCOMUtils.defineLazyModuleGetter(this, "Services",
   "resource://gre/modules/Services.jsm");
 XPCOMUtils.defineLazyModuleGetter(this, "FileUtils",
   "resource://gre/modules/FileUtils.jsm");
 
+const SUBSTITUTING_URL_CID = "{dea9657c-18cf-4984-bde9-ccef5d8ab473}";
+
 /**
- * Implements the thumbnail protocol handler responsible for moz-page-thumb: URIs.
+ * Implements the thumbnail protocol handler responsible for moz-page-thumb: URLs.
  */
 function Protocol() {
 }
@@ -64,7 +67,7 @@ Protocol.prototype = {
    * @return The newly created URI.
    */
   newURI: function Proto_newURI(aSpec, aOriginCharset) {
-    let uri = Cc["@mozilla.org/network/simple-uri;1"].createInstance(Ci.nsIURI);
+    let uri = Components.classesByID[SUBSTITUTING_URL_CID].createInstance(Ci.nsIURL);
     uri.spec = aSpec;
     return uri;
   },
@@ -72,18 +75,19 @@ Protocol.prototype = {
   /**
    * Constructs a new channel from the given URI for this protocol handler.
    * @param aURI The URI for which to construct a channel.
+   * @param aLoadInfo The Loadinfo which to use on the channel.
    * @return The newly created channel.
    */
+  newChannel2: function Proto_newChannel2(aURI, aLoadInfo) {
+    let {file} = aURI.QueryInterface(Ci.nsIFileURL);
+    let fileuri = Services.io.newFileURI(file);
+    let channel = Services.io.newChannelFromURIWithLoadInfo(fileuri, aLoadInfo);
+    channel.originalURI = aURI;
+    return channel;
+  },
+
   newChannel: function Proto_newChannel(aURI) {
-    let {url} = parseURI(aURI);
-    let file = PageThumbsStorage.getFilePathForURL(url);
-    let fileuri = Services.io.newFileURI(new FileUtils.File(file));
-    return Services.io.newChannelFromURI2(fileuri,
-                                          null,      // aLoadingNode
-                                          Services.scriptSecurityManager.getSystemPrincipal(),
-                                          null,      // aTriggeringPrincipal
-                                          Ci.nsILoadInfo.SEC_NORMAL,
-                                          Ci.nsIContentPolicy.TYPE_IMAGE);
+    return newChannel2(aURI, null);
   },
 
   /**
@@ -92,8 +96,34 @@ Protocol.prototype = {
    */
   allowPort: function () false,
 
+  // nsISubstitutingProtocolHandler methods
+
+  /*
+   * Substituting the scheme and host isn't enough, we also transform the path.
+   * So declare no-op implementations for (get|set|has)Substitution methods and
+   * do all the work in resolveURI.
+   */
+
+  setSubstitution(root, baseURI) {},
+
+  getSubstitution(root) {
+    throw Cr.NS_ERROR_NOT_AVAILABLE;
+  },
+
+  hasSubstitution(root) {
+    return false;
+  },
+
+  resolveURI(resURI) {
+    let {url} = parseURI(resURI);
+    let path = PageThumbsStorage.getFilePathForURL(url);
+    return OS.Path.toFileURI(path);
+  },
+
+  // xpcom machinery
   classID: Components.ID("{5a4ae9b5-f475-48ae-9dce-0b4c1d347884}"),
-  QueryInterface: XPCOMUtils.generateQI([Ci.nsIProtocolHandler])
+  QueryInterface: XPCOMUtils.generateQI([Ci.nsIProtocolHandler,
+                                         Ci.nsISubstitutingProtocolHandler])
 };
 
 this.NSGetFactory = XPCOMUtils.generateNSGetFactory([Protocol]);
@@ -104,9 +134,10 @@ this.NSGetFactory = XPCOMUtils.generateNSGetFactory([Protocol]);
  * @return The parsed parameters.
  */
 function parseURI(aURI) {
-  let {scheme, staticHost} = PageThumbs;
-  let re = new RegExp("^" + scheme + "://" + staticHost + ".*?\\?");
-  let query = aURI.spec.replace(re, "");
+  if (aURI.host != PageThumbs.staticHost)
+    throw Cr.NS_ERROR_NOT_AVAILABLE;
+
+  let {query} = aURI.QueryInterface(Ci.nsIURL);
   let params = {};
 
   query.split("&").forEach(function (aParam) {
diff --git a/toolkit/components/thumbnails/moz.build b/toolkit/components/thumbnails/moz.build
index 6c54fc3f20..3625a2167c 100644
--- a/toolkit/components/thumbnails/moz.build
+++ b/toolkit/components/thumbnails/moz.build
@@ -5,6 +5,7 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 BROWSER_CHROME_MANIFESTS += ['test/browser.ini']
+XPCSHELL_TESTS_MANIFESTS += ['test/xpcshell.ini']
 
 EXTRA_COMPONENTS += [
     'BrowserPageThumbs.manifest',
diff --git a/toolkit/components/thumbnails/test/browser_thumbnails_update.js b/toolkit/components/thumbnails/test/browser_thumbnails_update.js
index 523dece88e..3a251fed81 100644
--- a/toolkit/components/thumbnails/test/browser_thumbnails_update.js
+++ b/toolkit/components/thumbnails/test/browser_thumbnails_update.js
@@ -88,6 +88,11 @@ function capIfStaleErrorResponseUpdateTest() {
   yield addTab(URL);
 
   yield captureAndCheckColor(0, 255, 0, "we have a green thumbnail");
+
+  // image cache entry timestamps have second resolution
+  // so make sure the second part of this test takes part in a different second.
+  yield wait(2000);
+
   // update the thumbnail to be stale, then re-request it.  The server will
   // return a 400 response and a red thumbnail.
   // The service should not save the thumbnail - so we (a) check the thumbnail
@@ -119,6 +124,11 @@ function capIfStaleGoodResponseUpdateTest() {
   let browser = gBrowser.selectedBrowser;
 
   yield captureAndCheckColor(0, 255, 0, "we have a green thumbnail");
+
+  // image cache entry timestamps have second resolution
+  // so make sure the second part of this test takes part in a different second.
+  yield wait(2000);
+
   // update the thumbnail to be stale, then re-request it.  The server will
   // return a 200 response and a red thumbnail - so that new thumbnail should
   // end up captured.
@@ -148,6 +158,11 @@ function regularCapErrorResponseUpdateTest() {
   yield addTab(URL);
   yield captureAndCheckColor(0, 255, 0, "we have a green thumbnail");
   gBrowser.removeTab(gBrowser.selectedTab);
+
+  // image cache entry timestamps have second resolution
+  // so make sure the second part of this test takes part in a different second.
+  yield wait(2000);
+
   // do it again - the server will return a 400, so the foreground service
   // should not update it.
   yield addTab(URL);
@@ -162,6 +177,11 @@ function regularCapGoodResponseUpdateTest() {
   yield addTab(URL);
   yield captureAndCheckColor(0, 255, 0, "we have a green thumbnail");
   gBrowser.removeTab(gBrowser.selectedTab);
+
+  // image cache entry timestamps have second resolution
+  // so make sure the second part of this test takes part in a different second.
+  yield wait(2000);
+
   // do it again - the server will return a 200, so the foreground service
   // should  update it.
   yield addTab(URL);
diff --git a/toolkit/components/thumbnails/test/test_thumbnails_interfaces.js b/toolkit/components/thumbnails/test/test_thumbnails_interfaces.js
new file mode 100644
index 0000000000..8272b2e069
--- /dev/null
+++ b/toolkit/components/thumbnails/test/test_thumbnails_interfaces.js
@@ -0,0 +1,31 @@
+// tests to check that moz-page-thumb URLs correctly resolve as file:// URLS
+"use strict";
+
+const Cu = Components.utils;
+const Cc = Components.classes;
+const Cr = Components.results;
+const Ci = Components.interfaces;
+
+Cu.import("resource://gre/modules/Services.jsm");
+
+// need profile so that PageThumbsStorage can resolve the path to the underlying file
+do_get_profile();
+
+function run_test() {
+  // first check the protocol handler implements the correct interface
+  let handler = Services.io.getProtocolHandler("moz-page-thumb");
+  ok(handler instanceof Ci.nsISubstitutingProtocolHandler,
+     "moz-page-thumb handler provides substituting interface");
+
+  // then check that the file URL resolution works
+  let uri = Services.io.newURI("moz-page-thumb://thumbnail/?url=http%3A%2F%2Fwww.mozilla.org%2F",
+                               null, null);
+  ok(uri instanceof Ci.nsIFileURL, "moz-page-thumb:// is a FileURL");
+  ok(uri.file, "This moz-page-thumb:// object is backed by a file");
+
+  // and check that the error case works as specified
+  let bad = Services.io.newURI("moz-page-thumb://wronghost/?url=http%3A%2F%2Fwww.mozilla.org%2F",
+                               null, null);
+  Assert.throws(() => handler.resolveURI(bad), /NS_ERROR_NOT_AVAILABLE/i,
+                "moz-page-thumb object with wrong host must not resolve to a file path");
+}
diff --git a/toolkit/components/thumbnails/test/xpcshell.ini b/toolkit/components/thumbnails/test/xpcshell.ini
new file mode 100644
index 0000000000..13f4ab2475
--- /dev/null
+++ b/toolkit/components/thumbnails/test/xpcshell.ini
@@ -0,0 +1,6 @@
+[DEFAULT]
+head =
+tail =
+
+[test_thumbnails_interfaces.js]
+skip-if = os == 'b2g' || os == 'android' # xpcom interface not packaged
diff --git a/toolkit/content/jar.mn b/toolkit/content/jar.mn
index dc100364ad..2c06f58c05 100644
--- a/toolkit/content/jar.mn
+++ b/toolkit/content/jar.mn
@@ -5,19 +5,22 @@ toolkit.jar:
 # provide the nsTransferable in nsDragAndDrop.js to extensions that have to
 # work with Geckos from before 1.9, when there was a separate file
 %  override chrome://global/content/nsTransferable.js chrome://global/content/nsDragAndDrop.js
-*  content/global/license.html                (license.html)
-   content/global/XPCNativeWrapper.js         (XPCNativeWrapper.js)
-   content/global/minimal-xul.css             (minimal-xul.css)
-*  content/global/xul.css                     (xul.css)
-   content/global/textbox.css                 (textbox.css)
-   content/global/menulist.css                (menulist.css)
-   content/global/autocomplete.css            (autocomplete.css)
-   content/global/about.js                    (about.js)
-   content/global/about.xhtml                 (about.xhtml)
-   content/global/aboutAbout.js               (aboutAbout.js)
-   content/global/aboutAbout.xhtml            (aboutAbout.xhtml)
-   content/global/aboutRights.xhtml           (aboutRights.xhtml)
-   content/global/aboutRights-unbranded.xhtml (aboutRights-unbranded.xhtml)
+*  content/global/license.html
+   content/global/XPCNativeWrapper.js
+   content/global/minimal-xul.css
+*  content/global/xul.css
+   content/global/textbox.css
+   content/global/menulist.css
+   content/global/autocomplete.css
+   content/global/about.js
+   content/global/about.xhtml
+   content/global/aboutAbout.js
+   content/global/aboutAbout.xhtml
+#ifdef MOZILLA_OFFICIAL
+   content/global/aboutRights.xhtml
+#else
+   content/global/aboutRights.xhtml           (aboutRights-unbranded.xhtml)
+#endif
    content/global/aboutNetworking.js
    content/global/aboutNetworking.xhtml
    content/global/aboutServiceWorkers.js
@@ -29,37 +32,37 @@ toolkit.jar:
 *  content/global/aboutSupport.xhtml
 *  content/global/aboutTelemetry.js
    content/global/aboutTelemetry.xhtml
-   content/global/aboutTelemetry.css          (aboutTelemetry.css)
+   content/global/aboutTelemetry.css
    content/global/directionDetector.html
    content/global/plugins.html
    content/global/plugins.css
-   content/global/browser-child.js            (browser-child.js)
-   content/global/browser-content.js          (browser-content.js)
-*+  content/global/buildconfig.html            (buildconfig.html)
-*  content/global/contentAreaUtils.js         (contentAreaUtils.js)
-   content/global/customizeToolbar.css        (customizeToolbar.css)
-*  content/global/customizeToolbar.js         (customizeToolbar.js)
-   content/global/customizeToolbar.xul        (customizeToolbar.xul)
-   content/global/devicestorage.properties    (devicestorage.properties)
-   content/global/editMenuOverlay.js          (editMenuOverlay.js)
-*+ content/global/editMenuOverlay.xul         (editMenuOverlay.xul)
-   content/global/finddialog.js               (finddialog.js)
-*+ content/global/finddialog.xul              (finddialog.xul)
-   content/global/findUtils.js                (findUtils.js)
-   content/global/filepicker.properties       (filepicker.properties)
-*+ content/global/globalOverlay.js            (globalOverlay.js)
-   content/global/logopage.xhtml              (logopage.xhtml)
-+  content/global/mozilla.xhtml               (mozilla.xhtml)
-+  content/global/palemoon.xhtml              (palemoon.xhtml)
-   content/global/nsDragAndDrop.js            (nsDragAndDrop.js)
-   content/global/process-content.js          (process-content.js)
-   content/global/resetProfile.css            (resetProfile.css)
-   content/global/resetProfile.js             (resetProfile.js)
-   content/global/resetProfile.xul            (resetProfile.xul)
-   content/global/resetProfileProgress.xul    (resetProfileProgress.xul)
-   content/global/select-child.js             (select-child.js)
-   content/global/treeUtils.js                (treeUtils.js)
-   content/global/viewZoomOverlay.js          (viewZoomOverlay.js)
+   content/global/browser-child.js
+   content/global/browser-content.js
+*+  content/global/buildconfig.html
+*  content/global/contentAreaUtils.js
+   content/global/customizeToolbar.css
+*  content/global/customizeToolbar.js
+   content/global/customizeToolbar.xul
+   content/global/devicestorage.properties
+   content/global/editMenuOverlay.js
+*+ content/global/editMenuOverlay.xul
+   content/global/finddialog.js
+*+ content/global/finddialog.xul
+   content/global/findUtils.js
+   content/global/filepicker.properties
+*+ content/global/globalOverlay.js
+   content/global/logopage.xhtml
++  content/global/mozilla.xhtml
++  content/global/palemoon.xhtml
+   content/global/nsDragAndDrop.js
+   content/global/process-content.js
+   content/global/resetProfile.css
+   content/global/resetProfile.js
+   content/global/resetProfile.xul
+   content/global/resetProfileProgress.xul
+   content/global/select-child.js
+   content/global/treeUtils.js
+   content/global/viewZoomOverlay.js
 *+ content/global/bindings/autocomplete.xml    (widgets/autocomplete.xml)
    content/global/bindings/browser.xml         (widgets/browser.xml)
    content/global/bindings/button.xml          (widgets/button.xml)
@@ -101,6 +104,6 @@ toolkit.jar:
    content/global/bindings/videocontrols.css   (widgets/videocontrols.css)
 *+ content/global/bindings/wizard.xml          (widgets/wizard.xml)
 #ifdef XP_MACOSX
-   content/global/macWindowMenu.js             (macWindowMenu.js)
+   content/global/macWindowMenu.js
 #endif
    content/global/svg/svgBindings.xml          (/layout/svg/resources/content/svgBindings.xml)
diff --git a/toolkit/content/widgets/preferences.xml b/toolkit/content/widgets/preferences.xml
index 5e3b1955bc..bc81fe80f0 100644
--- a/toolkit/content/widgets/preferences.xml
+++ b/toolkit/content/widgets/preferences.xml
@@ -1176,6 +1176,10 @@
         <body>
         <![CDATA[
           // Write all values to preferences.
+          if (this._deferredValueUpdateElements.size) {
+            this._finalizeDeferredElements();
+          }
+
           var preferences = this.preferences;
           for (var i = 0; i < preferences.length; ++i) {
             var preference = preferences[i];
@@ -1252,15 +1256,57 @@
         </body>
       </method>
       
+      <field name="DeferredTask" readonly="true">
+        let targetObj = {};
+        Components.utils.import("resource://gre/modules/DeferredTask.jsm", targetObj);
+        targetObj.DeferredTask;
+      </field>
+      <method name="_deferredValueUpdate">
+        <parameter name="aElement"/>
+        <body>
+        <![CDATA[
+          delete aElement._deferredValueUpdateTask;
+          let preference = document.getElementById(aElement.getAttribute("preference"));
+          let prefVal = preference.getElementValue(aElement);
+          preference.value = prefVal;
+          this._deferredValueUpdateElements.delete(aElement);
+        ]]>
+        </body>
+      </method>
+      <field name="_deferredValueUpdateElements">
+        new Set();
+      </field>
+      <method name="_finalizeDeferredElements">
+        <body>
+        <![CDATA[
+          for (let el of this._deferredValueUpdateElements) {
+            if (el._deferredValueUpdateTask) {
+              el._deferredValueUpdateTask.finalize();
+            }
+          }
+        ]]>
+        </body>
+      </method>
       <method name="userChangedValue">
         <parameter name="aElement"/>
         <body>
         <![CDATA[
-          var element = this.getPreferenceElement(aElement);
+          let element = this.getPreferenceElement(aElement);
           if (element.hasAttribute("preference")) {
-            var preference = document.getElementById(element.getAttribute("preference"));
-            var prefVal = preference.getElementValue(element);
-            preference.value = prefVal;
+            if (element.getAttribute("delayprefsave") != "true") {
+              var preference = document.getElementById(element.getAttribute("preference"));
+              var prefVal = preference.getElementValue(element);
+              preference.value = prefVal;
+            } else {
+              if (!element._deferredValueUpdateTask) {
+                element._deferredValueUpdateTask = new this.DeferredTask(this._deferredValueUpdate.bind(this, element), 1000);
+                this._deferredValueUpdateElements.add(element);
+              } else {
+                // Each time the preference is changed, restart the delay.
+                element._deferredValueUpdateTask.disarm();
+                element._deferredValueUpdateTask.arm();
+              }
+            }
           }
         ]]>
         </body>
diff --git a/toolkit/devtools/server/actors/actor-registry.js b/toolkit/devtools/server/actors/actor-registry.js
index 609d108ed1..72958f2497 100644
--- a/toolkit/devtools/server/actors/actor-registry.js
+++ b/toolkit/devtools/server/actors/actor-registry.js
@@ -93,7 +93,10 @@ function request(uri) {
         "Can only register actors whose URI scheme is 'resource'."));
     }
 
-    NetUtil.asyncFetch(uri, (stream, status, req) => {
+    NetUtil.asyncFetch({
+      uri,
+      loadUsingSystemPrincipal: true,
+     }, (stream, status, req) => {
       if (!components.isSuccessCode(status)) {
         reject(new Error("Request failed with status code = "
                          + status
diff --git a/toolkit/library/moz.build b/toolkit/library/moz.build
index 3f734988f8..a5dafdc33f 100644
--- a/toolkit/library/moz.build
+++ b/toolkit/library/moz.build
@@ -32,6 +32,12 @@ def Libxul(name):
     if CONFIG['MOZ_WEBRTC']:
         DELAYLOAD_DLLS += ['msdmo.dll']
 
+    if CONFIG['OS_ARCH'] == 'WINNT':
+        DELAYLOAD_DLLS += [
+            'api-ms-win-core-winrt-l1-1-0.dll',
+            'api-ms-win-core-winrt-string-l1-1-0.dll',
+        ]
+
     if CONFIG['OS_ARCH'] == 'WINNT' and not CONFIG['GNU_CC']:
         LOCAL_INCLUDES += [
             '/widget/windows',
diff --git a/toolkit/mozapps/extensions/test/browser/browser_openDialog.js b/toolkit/mozapps/extensions/test/browser/browser_openDialog.js
index 049871de29..bafb309eae 100644
--- a/toolkit/mozapps/extensions/test/browser/browser_openDialog.js
+++ b/toolkit/mozapps/extensions/test/browser/browser_openDialog.js
@@ -20,20 +20,17 @@ let CustomChromeProtocol = {
     return uri;
   },
 
-  newChannel: function CCP_newChannel(aURI) {
-    let url = "chrome:" + aURI.path;
-    let ch = NetUtil.newChannel2(url,
-                                 null,
-                                 null,
-                                 null,      // aLoadingNode
-                                 Services.scriptSecurityManager.getSystemPrincipal(),
-                                 null,      // aTriggeringPrincipal
-                                 Ci.nsILoadInfo.SEC_NORMAL,
-                                 Ci.nsIContentPolicy.TYPE_OTHER);
+  newChannel2: function CCP_newChannel2(aURI, aLoadInfo) {
+    let url = Services.io.newURI("chrome:" + aURI.path, null, null);
+    let ch = Services.io.newChannelFromURIWithLoadInfo(url, aLoadInfo);
     ch.originalURI = aURI;
     return ch;
   },
 
+  newChannel: function CCP_newChannel(aURI) {
+    return newChannel2(aURI, null);
+  },
+
   allowPort: function CCP_allowPort(aPort, aScheme) {
     return false;
   },
diff --git a/toolkit/mozapps/preferences/fontbuilder.js b/toolkit/mozapps/preferences/fontbuilder.js
index c3ce3855c7..75b508fa1c 100644
--- a/toolkit/mozapps/preferences/fontbuilder.js
+++ b/toolkit/mozapps/preferences/fontbuilder.js
@@ -85,5 +85,37 @@ var FontBuilder = {
       }
     }
     aMenuList.appendChild(popup);    
+  },
+
+  readFontSelection(aElement)
+  {
+    // Determine the appropriate value to select, for the following cases:
+    // - there is no setting
+    // - the font selected by the user is no longer present (e.g. deleted from
+    //   fonts folder)
+    let preference = document.getElementById(aElement.getAttribute("preference"));
+    if (preference.value) {
+      let fontItems = aElement.getElementsByAttribute("value", preference.value);
+
+      // There is a setting that actually is in the list. Respect it.
+      if (fontItems.length)
+        return undefined;
+    }
+
+    let defaultValue = aElement.firstChild.firstChild.getAttribute("value");
+    let fontNameList = preference.name.replace(".name.", ".name-list.");
+    let prefFontNameList = document.getElementById(fontNameList);
+    if (!prefFontNameList || !prefFontNameList.value)
+      return defaultValue;
+
+    let fontNames = prefFontNameList.value.split(",");
+
+    for (let i = 0; i < fontNames.length; ++i) {
+      let fontName = this.enumerator.getStandardFamilyName(fontNames[i].trim());
+      let fontItems = aElement.getElementsByAttribute("value", fontName);
+      if (fontItems.length)
+        return fontItems[0].getAttribute("value");
+    }
+    return defaultValue;
   }
 };
diff --git a/toolkit/mozapps/preferences/jar.mn b/toolkit/mozapps/preferences/jar.mn
index 6df057207f..3ebdff5dae 100644
--- a/toolkit/mozapps/preferences/jar.mn
+++ b/toolkit/mozapps/preferences/jar.mn
@@ -4,8 +4,8 @@
 
 toolkit.jar:
 % content mozapps %content/mozapps/
-  content/mozapps/preferences/fontbuilder.js                    (fontbuilder.js)
-  content/mozapps/preferences/changemp.js                       (changemp.js)
-  content/mozapps/preferences/changemp.xul                      (changemp.xul)
-  content/mozapps/preferences/removemp.js                       (removemp.js)
-  content/mozapps/preferences/removemp.xul                      (removemp.xul)
+  content/mozapps/preferences/fontbuilder.js
+  content/mozapps/preferences/changemp.js
+  content/mozapps/preferences/changemp.xul
+  content/mozapps/preferences/removemp.js
+  content/mozapps/preferences/removemp.xul
diff --git a/toolkit/profile/nsToolkitProfileService.cpp b/toolkit/profile/nsToolkitProfileService.cpp
index d3645f3730..4bfc0dc204 100644
--- a/toolkit/profile/nsToolkitProfileService.cpp
+++ b/toolkit/profile/nsToolkitProfileService.cpp
@@ -4,6 +4,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "mozilla/ArrayUtils.h"
+#include "mozilla/UniquePtr.h"
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -971,12 +972,10 @@ nsToolkitProfileService::Flush()
 
     uint32_t length;
     const int bufsize = 100+MAXPATHLEN*pCount;
-    nsAutoArrayPtr<char> buffer (new char[bufsize]);
+    auto buffer = MakeUnique<char[]>(bufsize);
 
-    NS_ENSURE_TRUE(buffer, NS_ERROR_OUT_OF_MEMORY);
-
-    char *pos = buffer;
-    char *end = buffer + bufsize;
+    char *pos = buffer.get();
+    char *end = pos + bufsize;
 
     pos += snprintf(pos, end - pos,
                     "[General]\n"
@@ -1024,13 +1023,11 @@ nsToolkitProfileService::Flush()
     rv = mListFile->OpenANSIFileDesc("w", &writeFile);
     NS_ENSURE_SUCCESS(rv, rv);
 
-    if (buffer) {
-        length = pos - buffer;
+    length = pos - buffer.get();
 
-        if (fwrite(buffer, sizeof(char), length, writeFile) != length) {
-            fclose(writeFile);
-            return NS_ERROR_UNEXPECTED;
-        }
+    if (fwrite(buffer.get(), sizeof(char), length, writeFile) != length) {
+        fclose(writeFile);
+        return NS_ERROR_UNEXPECTED;
     }
 
     fclose(writeFile);
diff --git a/toolkit/system/gnome/nsPackageKitService.cpp b/toolkit/system/gnome/nsPackageKitService.cpp
index bfd8285740..237ace4a59 100644
--- a/toolkit/system/gnome/nsPackageKitService.cpp
+++ b/toolkit/system/gnome/nsPackageKitService.cpp
@@ -4,7 +4,6 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsArrayUtils.h"
-#include "nsAutoPtr.h"
 #include "nsIObserver.h"
 #include "nsIObserverService.h"
 #include "nsISupportsPrimitives.h"
@@ -12,6 +11,7 @@
 #include "nsStringAPI.h"
 #include "prlink.h"
 #include "mozilla/unused.h"
+#include "mozilla/UniquePtr.h"
 
 #include <glib.h>
 #include <glib-object.h>
@@ -215,7 +215,7 @@ nsPackageKitService::InstallPackages(uint32_t aInstallMethod,
 
   // Create the GVariant* parameter from the list of packages.
   GVariant* parameters = nullptr;
-  nsAutoArrayPtr<gchar*> packages(new gchar*[arrayLength + 1]);
+  auto packages = MakeUnique<gchar*[]>(arrayLength + 1);
 
   nsresult rv = NS_OK;
   for (uint32_t i = 0; i < arrayLength; i++) {
diff --git a/toolkit/xre/MacLaunchHelper.mm b/toolkit/xre/MacLaunchHelper.mm
index 8d922c728b..8191e870af 100644
--- a/toolkit/xre/MacLaunchHelper.mm
+++ b/toolkit/xre/MacLaunchHelper.mm
@@ -6,8 +6,8 @@
 #include "MacLaunchHelper.h"
 
 #include "nsMemory.h"
-#include "nsAutoPtr.h"
 #include "nsIAppStartup.h"
+#include "mozilla/UniquePtr.h"
 
 #include <stdio.h>
 #include <spawn.h>
@@ -40,7 +40,7 @@ void LaunchChildMac(int aArgc, char** aArgv,
 {
   // "posix_spawnp" uses null termination for arguments rather than a count.
   // Note that we are not duplicating the argument strings themselves.
-  nsAutoArrayPtr<char*> argv_copy(new char*[aArgc + 1]);
+  auto argv_copy = MakeUnique<char*[]>(aArgc + 1);
   for (int i = 0; i < aArgc; i++) {
     argv_copy[i] = aArgv[i];
   }
@@ -80,7 +80,7 @@ void LaunchChildMac(int aArgc, char** aArgv,
     envp = *cocoaEnvironment;
   }
 
-  int result = posix_spawnp(pid, argv_copy[0], NULL, &spawnattr, argv_copy, envp);
+  int result = posix_spawnp(pid, argv_copy[0], NULL, &spawnattr, argv_copy.get(), envp);
 
   posix_spawnattr_destroy(&spawnattr);
 
diff --git a/widget/InputData.cpp b/widget/InputData.cpp
index e003f0d7c5..45352335ca 100644
--- a/widget/InputData.cpp
+++ b/widget/InputData.cpp
@@ -21,10 +21,10 @@ already_AddRefed<Touch> SingleTouchData::ToNewDOMTouch() const
   MOZ_ASSERT(NS_IsMainThread(),
              "Can only create dom::Touch instances on main thread");
   RefPtr<Touch> touch = new Touch(mIdentifier,
-                                    LayoutDeviceIntPoint(mScreenPoint.x, mScreenPoint.y),
-                                    nsIntPoint(mRadius.width, mRadius.height),
-                                    mRotationAngle,
-                                    mForce);
+                                  LayoutDeviceIntPoint(mScreenPoint.x, mScreenPoint.y),
+                                  LayoutDeviceIntPoint(mRadius.width, mRadius.height),
+                                  mRotationAngle,
+                                  mForce);
   return touch.forget();
 }
 
diff --git a/widget/SystemTimeConverter.h b/widget/SystemTimeConverter.h
new file mode 100644
index 0000000000..ca36530ad9
--- /dev/null
+++ b/widget/SystemTimeConverter.h
@@ -0,0 +1,235 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef SystemTimeConverter_h
+#define SystemTimeConverter_h
+
+#include <limits>
+#include "mozilla/TimeStamp.h"
+#include "mozilla/TypeTraits.h"
+
+namespace mozilla {
+
+// Utility class that converts time values represented as an unsigned integral
+// number of milliseconds from one time source (e.g. a native event time) to
+// corresponding mozilla::TimeStamp objects.
+//
+// This class handles wrapping of integer values and skew between the time
+// source and mozilla::TimeStamp values.
+//
+// It does this by using an historical reference time recorded in both time
+// scales (i.e. both as a numerical time value and as a TimeStamp).
+//
+// For performance reasons, this class is careful to minimize calls to the
+// native "current time" function (e.g. gdk_x11_server_get_time) since this can
+// be slow. Furthermore, it uses TimeStamp::NowLowRes instead of TimeStamp::Now
+// except when establishing the reference time.
+template <typename Time>
+class SystemTimeConverter {
+public:
+  SystemTimeConverter()
+    : mReferenceTime(Time(0))
+    , mReferenceTimeStamp() // Initializes to the null timestamp
+    , mLastBackwardsSkewCheck(Time(0))
+    , kTimeRange(std::numeric_limits<Time>::max())
+    , kTimeHalfRange(kTimeRange / 2)
+    , kBackwardsSkewCheckInterval(Time(2000))
+  {
+    static_assert(!IsSigned<Time>::value, "Expected Time to be unsigned");
+  }
+
+  template <typename CurrentTimeGetter>
+  mozilla::TimeStamp
+  GetTimeStampFromSystemTime(Time aTime,
+                             CurrentTimeGetter& aCurrentTimeGetter) {
+    // If the reference time is not set, use the current time value to fill
+    // it in.
+    if (mReferenceTimeStamp.IsNull()) {
+      UpdateReferenceTime(aTime, aCurrentTimeGetter);
+    }
+    TimeStamp roughlyNow = TimeStamp::NowLoRes();
+
+    // Check for skew between the source of Time values and TimeStamp values.
+    // We do this by comparing two durations (both in ms):
+    //
+    // i.  The duration from the reference time to the passed-in time.
+    //     (timeDelta in the diagram below)
+    // ii. The duration from the reference timestamp to the current time
+    //     based on TimeStamp::NowLoRes.
+    //     (timeStampDelta in the diagram below)
+    //
+    // Normally, we'd expect (ii) to be slightly larger than (i) to account
+    // for the time taken between generating the event and processing it.
+    //
+    // If (ii) - (i) is negative then the source of Time values is getting
+    // "ahead" of TimeStamp. We call this "forwards" skew below.
+    //
+    // For the reverse case, if (ii) - (i) is positive (and greater than some
+    // tolerance factor), then we may have "backwards" skew. This is often
+    // the case when we have a backlog of events and by the time we process
+    // them, the time given by the system is comparatively "old".
+    //
+    // We call the absolute difference between (i) and (ii), "deltaFromNow".
+    //
+    // Graphically:
+    //
+    //                    mReferenceTime              aTime
+    // Time scale:      ........+.......................*........
+    //                          |--------timeDelta------|
+    //
+    //                  mReferenceTimeStamp             roughlyNow
+    // TimeStamp scale: ........+...........................*....
+    //                          |------timeStampDelta-------|
+    //
+    //                                                  |---|
+    //                                               deltaFromNow
+    //
+    Time deltaFromNow;
+    bool newer = IsTimeNewerThanTimestamp(aTime, roughlyNow, &deltaFromNow);
+
+    // TimeStamp::NowLoRes should be accurate to within 15.6ms so we need to
+    // be at least that generous when detecting clock skew.
+    static const Time kTolerance = 30;
+
+    // Check for forwards skew
+    if (newer) {
+      // Make aTime correspond to roughlyNow
+      UpdateReferenceTime(aTime, roughlyNow);
+
+      // We didn't have backwards skew so don't bother checking for
+      // backwards skew again for a little while.
+      mLastBackwardsSkewCheck = aTime;
+
+      return roughlyNow;
+    }
+
+    if (deltaFromNow <= kTolerance) {
+      // If the time between event times and TimeStamp values is within
+      // the tolerance then assume we don't have clock skew so we can
+      // avoid checking for backwards skew for a while.
+      mLastBackwardsSkewCheck = aTime;
+    } else if (aTime - mLastBackwardsSkewCheck > kBackwardsSkewCheckInterval) {
+      aCurrentTimeGetter.GetTimeAsyncForPossibleBackwardsSkew(roughlyNow);
+      mLastBackwardsSkewCheck = aTime;
+    }
+
+    // Finally, calculate the timestamp
+    return roughlyNow - TimeDuration::FromMilliseconds(deltaFromNow);
+  }
+
+  void
+  CompensateForBackwardsSkew(Time aReferenceTime,
+                             const TimeStamp &aLowerBound) {
+    // Check if we actually have backwards skew. Backwards skew looks like
+    // the following:
+    //
+    //        mReferenceTime
+    // Time:      ..+...a...b...c..........................
+    //
+    //     mReferenceTimeStamp
+    // TimeStamp: ..+.....a.....b.....c....................
+    //
+    // Converted
+    // time:      ......a'..b'..c'.........................
+    //
+    // What we need to do is bring mReferenceTime "forwards".
+    //
+    // Suppose when we get (c), we detect possible backwards skew and trigger
+    // an async request for the current time (which is passed in here as
+    // aReferenceTime).
+    //
+    // We end up with something like the following:
+    //
+    //        mReferenceTime     aReferenceTime
+    // Time:      ..+...a...b...c...v......................
+    //
+    //     mReferenceTimeStamp
+    // TimeStamp: ..+.....a.....b.....c..........x.........
+    //                                ^          ^
+    //                          aLowerBound  TimeStamp::Now()
+    //
+    // If the duration (aLowerBound - mReferenceTimeStamp) is greater than
+    // (aReferenceTime - mReferenceTime) then we know we have backwards skew.
+    //
+    // If that's not the case, then we probably just got caught behind
+    // temporarily.
+    Time delta;
+    if (IsTimeNewerThanTimestamp(aReferenceTime, aLowerBound, &delta)) {
+      return;
+    }
+
+    // We have backwards skew; the equivalent TimeStamp for aReferenceTime lies
+    // somewhere between aLowerBound (which was the TimeStamp when we triggered
+    // the async request for the current time) and TimeStamp::Now().
+    //
+    // If aReferenceTime was waiting in the event queue for a long time, the
+    // equivalent TimeStamp might be much closer to aLowerBound than
+    // TimeStamp::Now() so for now we just set it to aLowerBound. That's
+    // guaranteed to be at least somewhat of an improvement.
+    UpdateReferenceTime(aReferenceTime, aLowerBound);
+  }
+
+private:
+  template <typename CurrentTimeGetter>
+  void
+  UpdateReferenceTime(Time aReferenceTime,
+                      const CurrentTimeGetter& aCurrentTimeGetter) {
+    Time currentTime = aCurrentTimeGetter.GetCurrentTime();
+    TimeStamp currentTimeStamp = TimeStamp::Now();
+    Time timeSinceReference = currentTime - aReferenceTime;
+    TimeStamp referenceTimeStamp =
+      currentTimeStamp - TimeDuration::FromMilliseconds(timeSinceReference);
+    UpdateReferenceTime(aReferenceTime, referenceTimeStamp);
+  }
+
+  void
+  UpdateReferenceTime(Time aReferenceTime,
+                      const TimeStamp& aReferenceTimeStamp) {
+    mReferenceTime = aReferenceTime;
+    mReferenceTimeStamp = aReferenceTimeStamp;
+  }
+
+  bool
+  IsTimeNewerThanTimestamp(Time aTime, TimeStamp aTimeStamp, Time* aDelta)
+  {
+    Time timeDelta = aTime - mReferenceTime;
+
+    // Cast the result to signed 64-bit integer first since that should be
+    // enough to hold the range of values returned by ToMilliseconds() and
+    // the result of converting from double to an integer-type when the value
+    // is outside the integer range is undefined.
+    // Then we do an implicit cast to Time (typically an unsigned 32-bit
+    // integer) which wraps times outside that range.
+    MOZ_ASSERT(mReferenceTimeStamp <= aTimeStamp,
+               "Got a negative timestamp delta");
+    Time timeStampDelta =
+      static_cast<int64_t>((aTimeStamp - mReferenceTimeStamp).ToMilliseconds());
+
+    Time timeToTimeStamp = timeStampDelta - timeDelta;
+    bool isNewer = false;
+    if (timeToTimeStamp == 0) {
+      *aDelta = 0;
+    } else if (timeToTimeStamp < kTimeHalfRange) {
+      *aDelta = timeToTimeStamp;
+    } else {
+      isNewer = true;
+      *aDelta = timeDelta - timeStampDelta;
+    }
+
+    return isNewer;
+  }
+
+  Time mReferenceTime;
+  TimeStamp mReferenceTimeStamp;
+  Time mLastBackwardsSkewCheck;
+
+  const Time kTimeRange;
+  const Time kTimeHalfRange;
+  const Time kBackwardsSkewCheckInterval;
+};
+
+} // namespace mozilla
+
+#endif /* SystemTimeConverter_h */
diff --git a/widget/WidgetUtils.cpp b/widget/WidgetUtils.cpp
index b10b6bd9e5..fe15181d02 100644
--- a/widget/WidgetUtils.cpp
+++ b/widget/WidgetUtils.cpp
@@ -9,6 +9,9 @@
 #ifdef XP_WIN
 #include "WinUtils.h"
 #endif
+#if MOZ_WIDGET_GTK == 3
+#include "mozilla/WidgetUtilsGtk.h"
+#endif
 
 namespace mozilla {
 
@@ -100,6 +103,8 @@ WidgetUtils::IsTouchDeviceSupportPresent()
 {
 #ifdef XP_WIN
   return WinUtils::IsTouchDeviceSupportPresent();
+#elif MOZ_WIDGET_GTK == 3
+  return WidgetUtilsGTK::IsTouchDeviceSupportPresent();
 #else
   return 0;
 #endif
diff --git a/widget/cocoa/VibrancyManager.h b/widget/cocoa/VibrancyManager.h
index bc3b6b3bb5..3a6a8e93f9 100644
--- a/widget/cocoa/VibrancyManager.h
+++ b/widget/cocoa/VibrancyManager.h
@@ -17,7 +17,6 @@
 @class NSColor;
 @class NSView;
 class nsChildView;
-class nsIntRegion;
 
 namespace mozilla {
 
diff --git a/widget/cocoa/VibrancyManager.mm b/widget/cocoa/VibrancyManager.mm
index 0e7ab19520..66d386a50b 100644
--- a/widget/cocoa/VibrancyManager.mm
+++ b/widget/cocoa/VibrancyManager.mm
@@ -198,6 +198,12 @@ enum {
 };
 #endif
 
+#if !defined(MAC_OS_X_VERSION_10_11) || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_11
+enum {
+  NSVisualEffectMaterialMenu = 5
+};
+#endif
+
 static NSUInteger
 VisualEffectStateForVibrancyType(VibrancyType aType)
 {
@@ -250,13 +256,14 @@ VibrancyManager::CreateEffectView(VibrancyType aType, NSRect aRect)
   [effectView setState:VisualEffectStateForVibrancyType(aType)];
 
   if (aType == VibrancyType::MENU) {
-    // NSVisualEffectMaterialTitlebar doesn't match the native menu look
-    // perfectly but comes pretty close. Ideally we'd use a material with
-    // materialTypeName "MacLight", since that's what menus use, but there's
-    // no entry with that material in the internalMaterialType-to-
-    // CGSWindowBackdropViewSpec table which NSVisualEffectView consults when
-    // setting up the effect.
-    [effectView setMaterial:NSVisualEffectMaterialTitlebar];
+    if (nsCocoaFeatures::OnElCapitanOrLater()) {
+      [effectView setMaterial:NSVisualEffectMaterialMenu];
+    } else {
+      // Before 10.11 there is no material that perfectly matches the menu
+      // look. Of all available material types, NSVisualEffectMaterialTitlebar
+      // is the one that comes closest.
+      [effectView setMaterial:NSVisualEffectMaterialTitlebar];
+    }
   } else if (aType == VibrancyType::HIGHLIGHTED_MENUITEM) {
     [effectView setMaterial:NSVisualEffectMaterialMenuItem];
     if ([effectView respondsToSelector:@selector(setEmphasized:)]) {
diff --git a/widget/cocoa/nsCocoaFeatures.h b/widget/cocoa/nsCocoaFeatures.h
index bb0ebcb4f3..14eb3bef52 100644
--- a/widget/cocoa/nsCocoaFeatures.h
+++ b/widget/cocoa/nsCocoaFeatures.h
@@ -22,6 +22,7 @@ public:
   static bool OnMountainLionOrLater();
   static bool OnMavericksOrLater();
   static bool OnYosemiteOrLater();
+  static bool OnElCapitanOrLater();
   static bool AccelerateByDefault();
 
   static bool IsAtLeastVersion(int32_t aMajor, int32_t aMinor, int32_t aBugFix=0);
diff --git a/widget/cocoa/nsCocoaFeatures.mm b/widget/cocoa/nsCocoaFeatures.mm
index ca84e9bf30..fee8d329f3 100644
--- a/widget/cocoa/nsCocoaFeatures.mm
+++ b/widget/cocoa/nsCocoaFeatures.mm
@@ -18,6 +18,7 @@
 #define MAC_OS_X_VERSION_10_8_HEX  0x00001080
 #define MAC_OS_X_VERSION_10_9_HEX  0x00001090
 #define MAC_OS_X_VERSION_10_10_HEX 0x000010A0
+#define MAC_OS_X_VERSION_10_11_HEX 0x000010B0
 
 #include "nsCocoaFeatures.h"
 #include "nsCocoaUtils.h"
@@ -172,6 +173,12 @@ nsCocoaFeatures::OnYosemiteOrLater()
     return (OSXVersion() >= MAC_OS_X_VERSION_10_10_HEX);
 }
 
+/* static */ bool
+nsCocoaFeatures::OnElCapitanOrLater()
+{
+    return (OSXVersion() >= MAC_OS_X_VERSION_10_11_HEX);
+}
+
 /* static */ bool
 nsCocoaFeatures::AccelerateByDefault()
 {
diff --git a/widget/cocoa/nsDragService.h b/widget/cocoa/nsDragService.h
index afc4d98b37..2ad0e4fbef 100644
--- a/widget/cocoa/nsDragService.h
+++ b/widget/cocoa/nsDragService.h
@@ -30,9 +30,11 @@ class nsDragService : public nsBaseDragService
 public:
   nsDragService();
 
+  // nsBaseDragService
+  virtual nsresult InvokeDragSessionImpl(nsISupportsArray* anArrayTransferables,
+                                         nsIScriptableRegion* aRegion,
+                                         uint32_t aActionType);
   // nsIDragService
-  NS_IMETHOD InvokeDragSession(nsIDOMNode *aDOMNode, nsISupportsArray * anArrayTransferables,
-                               nsIScriptableRegion * aRegion, uint32_t aActionType);
   NS_IMETHOD EndDragSession(bool aDoneDrag);
 
   // nsIDragSession
diff --git a/widget/cocoa/nsDragService.mm b/widget/cocoa/nsDragService.mm
index 6b42f34ed7..fb52074f1f 100644
--- a/widget/cocoa/nsDragService.mm
+++ b/widget/cocoa/nsDragService.mm
@@ -273,17 +273,13 @@ nsDragService::ConstructDragImage(nsIDOMNode* aDOMNode,
 // We can only invoke NSView's 'dragImage:at:offset:event:pasteboard:source:slideBack:' from
 // within NSView's 'mouseDown:' or 'mouseDragged:'. Luckily 'mouseDragged' is always on the
 // stack when InvokeDragSession gets called.
-NS_IMETHODIMP
-nsDragService::InvokeDragSession(nsIDOMNode* aDOMNode, nsISupportsArray* aTransferableArray,
-                                 nsIScriptableRegion* aDragRgn, uint32_t aActionType)
+nsresult
+nsDragService::InvokeDragSessionImpl(nsISupportsArray* aTransferableArray,
+                                     nsIScriptableRegion* aDragRgn,
+                                     uint32_t aActionType)
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSRESULT;
 
-  nsresult rv = nsBaseDragService::InvokeDragSession(aDOMNode,
-                                                     aTransferableArray,
-                                                     aDragRgn, aActionType);
-  NS_ENSURE_SUCCESS(rv, rv);
-
   mDataItems = aTransferableArray;
 
   // put data on the clipboard
@@ -291,7 +287,7 @@ nsDragService::InvokeDragSession(nsIDOMNode* aDOMNode, nsISupportsArray* aTransf
     return NS_ERROR_FAILURE;
 
   nsIntRect dragRect(0, 0, 20, 20);
-  NSImage* image = ConstructDragImage(aDOMNode, &dragRect, aDragRgn);
+  NSImage* image = ConstructDragImage(mSourceNode, &dragRect, aDragRgn);
   if (!image) {
     // if no image was returned, just draw a rectangle
     NSSize size;
diff --git a/widget/cocoa/nsLookAndFeel.mm b/widget/cocoa/nsLookAndFeel.mm
index 424f875416..ea905b233a 100644
--- a/widget/cocoa/nsLookAndFeel.mm
+++ b/widget/cocoa/nsLookAndFeel.mm
@@ -11,6 +11,7 @@
 #include "nsCocoaFeatures.h"
 #include "gfxFont.h"
 #include "gfxFontConstants.h"
+#include "gfxPlatformMac.h"
 #include "mozilla/gfx/2D.h"
 #include "mozilla/widget/WidgetMessageUtils.h"
 
@@ -521,14 +522,6 @@ bool nsLookAndFeel::AllowOverlayScrollbarsOverlap()
   return (UseOverlayScrollbars() && nsCocoaFeatures::OnMountainLionOrLater());
 }
 
-// copied from gfxQuartzFontCache.mm, maybe should go in a Cocoa utils
-// file somewhere
-static void GetStringForNSString(const NSString *aSrc, nsAString& aDest)
-{
-    aDest.SetLength([aSrc length]);
-    [aSrc getCharacters:reinterpret_cast<unichar*>(aDest.BeginWriting())];
-}
-
 bool
 nsLookAndFeel::GetFontImpl(FontID aID, nsString &aFontName,
                            gfxFontStyle &aFontStyle,
@@ -548,101 +541,9 @@ nsLookAndFeel::GetFontImpl(FontID aID, nsString &aFontName,
         return true;
     }
 
-/* possibilities, see NSFont Class Reference:
-    [NSFont boldSystemFontOfSize:     0.0]
-    [NSFont controlContentFontOfSize: 0.0]
-    [NSFont labelFontOfSize:          0.0]
-    [NSFont menuBarFontOfSize:        0.0]
-    [NSFont menuFontOfSize:           0.0]
-    [NSFont messageFontOfSize:        0.0]
-    [NSFont paletteFontOfSize:        0.0]
-    [NSFont systemFontOfSize:         0.0]
-    [NSFont titleBarFontOfSize:       0.0]
-    [NSFont toolTipsFontOfSize:       0.0]
-    [NSFont userFixedPitchFontOfSize: 0.0]
-    [NSFont userFontOfSize:           0.0]
-    [NSFont systemFontOfSize:         [NSFont smallSystemFontSize]]
-    [NSFont boldSystemFontOfSize:     [NSFont smallSystemFontSize]]
-*/
+    gfxPlatformMac::LookupSystemFont(aID, aFontName, aFontStyle,
+                                     aDevPixPerCSSPixel);
 
-    NSFont *font = nullptr;
-    switch (aID) {
-        // css2
-        case eFont_Caption:
-            font = [NSFont systemFontOfSize:0.0];
-            break;
-        case eFont_Icon: // used in urlbar; tried labelFont, but too small
-            font = [NSFont controlContentFontOfSize:0.0];
-            break;
-        case eFont_Menu:
-            font = [NSFont systemFontOfSize:0.0];
-            break;
-        case eFont_MessageBox:
-            font = [NSFont systemFontOfSize:[NSFont smallSystemFontSize]];
-            break;
-        case eFont_SmallCaption:
-            font = [NSFont boldSystemFontOfSize:[NSFont smallSystemFontSize]];
-            break;
-        case eFont_StatusBar:
-            font = [NSFont systemFontOfSize:[NSFont smallSystemFontSize]];
-            break;
-        // css3
-        //case eFont_Window:     = 'sans-serif'
-        //case eFont_Document:   = 'sans-serif'
-        case eFont_Workspace:
-            font = [NSFont controlContentFontOfSize:0.0];
-            break;
-        case eFont_Desktop:
-            font = [NSFont controlContentFontOfSize:0.0];
-            break;
-        case eFont_Info:
-            font = [NSFont controlContentFontOfSize:0.0];
-            break;
-        case eFont_Dialog:
-            font = [NSFont systemFontOfSize:0.0];
-            break;
-        case eFont_Button:
-            font = [NSFont systemFontOfSize:[NSFont smallSystemFontSize]];
-            break;
-        case eFont_PullDownMenu:
-            font = [NSFont menuBarFontOfSize:0.0];
-            break;
-        case eFont_List:
-            font = [NSFont systemFontOfSize:[NSFont smallSystemFontSize]];
-            break;
-        case eFont_Field:
-            font = [NSFont systemFontOfSize:[NSFont smallSystemFontSize]];
-            break;
-        // moz
-        case eFont_Tooltips:
-            font = [NSFont toolTipsFontOfSize:0.0];
-            break;
-        case eFont_Widget:
-            font = [NSFont systemFontOfSize:[NSFont smallSystemFontSize]];
-            break;
-        default:
-            break;
-    }
-
-    if (!font) {
-        NS_WARNING("failed to find a system font!");
-        return false;
-    }
-
-    NSFontSymbolicTraits traits = [[font fontDescriptor] symbolicTraits];
-    aFontStyle.style =
-        (traits & NSFontItalicTrait) ?  NS_FONT_STYLE_ITALIC : NS_FONT_STYLE_NORMAL;
-    aFontStyle.weight =
-        (traits & NSFontBoldTrait) ? NS_FONT_WEIGHT_BOLD : NS_FONT_WEIGHT_NORMAL;
-    aFontStyle.stretch =
-        (traits & NSFontExpandedTrait) ?
-            NS_FONT_STRETCH_EXPANDED : (traits & NSFontCondensedTrait) ?
-                NS_FONT_STRETCH_CONDENSED : NS_FONT_STRETCH_NORMAL;
-    // convert size from css pixels to device pixels
-    aFontStyle.size = [font pointSize] * aDevPixPerCSSPixel;
-    aFontStyle.systemFont = true;
-
-    GetStringForNSString([font familyName], aFontName);
     return true;
 
     NS_OBJC_END_TRY_ABORT_BLOCK_RETURN(false);
diff --git a/widget/gonk/libdisplay/BootAnimation.cpp b/widget/gonk/libdisplay/BootAnimation.cpp
index 413198076b..b3ccdbc96b 100644
--- a/widget/gonk/libdisplay/BootAnimation.cpp
+++ b/widget/gonk/libdisplay/BootAnimation.cpp
@@ -692,18 +692,26 @@ AnimationThread(void *)
     return nullptr;
 }
 
+namespace mozilla {
+
+__attribute__ ((visibility ("default")))
 void
 StartBootAnimation()
 {
+    GetGonkDisplay(); // Ensure GonkDisplay exist
     sRunAnimation = true;
     pthread_create(&sAnimationThread, nullptr, AnimationThread, nullptr);
 }
 
+__attribute__ ((visibility ("default")))
 void
 StopBootAnimation()
 {
     if (sRunAnimation) {
         sRunAnimation = false;
         pthread_join(sAnimationThread, nullptr);
+        GetGonkDisplay()->NotifyBootAnimationStopped();
     }
 }
+
+} // namespace mozilla
diff --git a/widget/gonk/libdisplay/BootAnimation.h b/widget/gonk/libdisplay/BootAnimation.h
index d06586c993..9fdc20eca9 100644
--- a/widget/gonk/libdisplay/BootAnimation.h
+++ b/widget/gonk/libdisplay/BootAnimation.h
@@ -16,9 +16,15 @@
 #ifndef BOOTANIMATION_H
 #define BOOTANIMATION_H
 
+namespace mozilla {
+
+MOZ_EXPORT __attribute__ ((weak))
 void StartBootAnimation();
 
 /* Stop the boot animation if it's still running. */
+MOZ_EXPORT __attribute__ ((weak))
 void StopBootAnimation();
 
+} // namespace mozilla
+
 #endif /* BOOTANIMATION_H */
diff --git a/widget/gonk/libdisplay/GonkDisplay.h b/widget/gonk/libdisplay/GonkDisplay.h
index 0f703e7450..070ac7eac1 100644
--- a/widget/gonk/libdisplay/GonkDisplay.h
+++ b/widget/gonk/libdisplay/GonkDisplay.h
@@ -78,6 +78,8 @@ public:
         GonkDisplay::DisplayType aDisplayType,
         android::IGraphicBufferProducer* aProducer = nullptr) = 0;
 
+    virtual void NotifyBootAnimationStopped() = 0;
+
     float xdpi;
     int32_t surfaceformat;
 };
diff --git a/widget/gonk/libdisplay/GonkDisplayICS.cpp b/widget/gonk/libdisplay/GonkDisplayICS.cpp
index b7e3122949..99634d0c64 100644
--- a/widget/gonk/libdisplay/GonkDisplayICS.cpp
+++ b/widget/gonk/libdisplay/GonkDisplayICS.cpp
@@ -27,8 +27,6 @@
 #include "mozilla/FileUtils.h"
 #include "mozilla/FileUtils.h"
 
-#include "BootAnimation.h"
-
 using namespace android;
 
 
@@ -105,7 +103,7 @@ GonkDisplayICS::GonkDisplayICS()
             len = read(fd.get(), &buf, 1);
         } while (len < 0 && errno == EINTR);
         if (len < 0) {
-            LOGE("BootAnimation: wait_for_fb_sleep failed errno: %d", errno);
+            LOGE("wait_for_fb_sleep failed errno: %d", errno);
         }
     }
 
@@ -130,8 +128,6 @@ GonkDisplayICS::GonkDisplayICS()
 
     const framebuffer_device_t *fbdev = mFBSurface->getDevice();
     surfaceformat = fbdev->format;
-
-    StartBootAnimation();
 }
 
 GonkDisplayICS::~GonkDisplayICS()
@@ -215,7 +211,6 @@ GonkDisplayICS::GetNativeData(GonkDisplay::DisplayType aDisplayType,
     MOZ_ASSERT(aDisplayType == DISPLAY_PRIMARY, "ICS gonk supports primary display only.");
 
     NativeData data;
-    StopBootAnimation();
     data.mNativeWindow = static_cast<ANativeWindow *>(mFBSurface.get());
     data.mXdpi = xdpi;
 
diff --git a/widget/gonk/libdisplay/GonkDisplayICS.h b/widget/gonk/libdisplay/GonkDisplayICS.h
index e47ad2741c..8f3f14138c 100644
--- a/widget/gonk/libdisplay/GonkDisplayICS.h
+++ b/widget/gonk/libdisplay/GonkDisplayICS.h
@@ -59,6 +59,8 @@ public:
         GonkDisplay::DisplayType aDisplayType,
         android::IGraphicBufferProducer* aProducer = nullptr);
 
+    virtual void NotifyBootAnimationStopped() {}
+
 private:
     hw_module_t const*        mModule;
     hwc_composer_device_t*    mHwc;
diff --git a/widget/gonk/libdisplay/GonkDisplayJB.cpp b/widget/gonk/libdisplay/GonkDisplayJB.cpp
index fcb7f740f1..66100ea291 100644
--- a/widget/gonk/libdisplay/GonkDisplayJB.cpp
+++ b/widget/gonk/libdisplay/GonkDisplayJB.cpp
@@ -26,7 +26,6 @@
 #include <hardware/power.h>
 #include <suspend/autosuspend.h>
 
-#include "BootAnimation.h"
 #include "FramebufferSurface.h"
 #if ANDROID_VERSION == 17
 #include "GraphicBufferAlloc.h"
@@ -126,9 +125,6 @@ GonkDisplayJB::GonkDisplayJB()
         // only create this buffer for devices w/ hwc version > 1.0.
         CreateSurface(mBootAnimSTClient, mBootAnimDispSurface, mWidth, mHeight);
     }
-
-    ALOGI("Starting bootanimation with (%d) format framebuffer", surfaceformat);
-    StartBootAnimation();
 }
 
 GonkDisplayJB::~GonkDisplayJB()
@@ -225,8 +221,6 @@ GonkDisplayJB::GetHWCDevice()
 bool
 GonkDisplayJB::SwapBuffers(EGLDisplay dpy, EGLSurface sur)
 {
-    StopBootAnim();
-
     // Should be called when composition rendering is complete for a frame.
     // Only HWC v1.0 needs this call.
     // HWC > v1.0 case, do not call compositionComplete().
@@ -323,32 +317,46 @@ GonkDisplayJB::DequeueBuffer()
 bool
 GonkDisplayJB::QueueBuffer(ANativeWindowBuffer* buf)
 {
-    int error = 0;
     bool success = false;
+    int error = DoQueueBuffer(buf);
+    // Check for bootAnim or normal display flow.
+    if (!mBootAnimSTClient.get()) {
+        success = Post(mDispSurface->lastHandle, mDispSurface->GetPrevDispAcquireFd());
+    } else {
+        success = Post(mBootAnimDispSurface->lastHandle, mBootAnimDispSurface->GetPrevDispAcquireFd());
+    }
+    return error == 0 && success;
+}
+
+int
+GonkDisplayJB::DoQueueBuffer(ANativeWindowBuffer* buf)
+{
+    int error = 0;
     // Check for bootAnim or normal display flow.
     if (!mBootAnimSTClient.get()) {
         error = mSTClient->queueBuffer(mSTClient.get(), buf, -1);
-        success = Post(mDispSurface->lastHandle, mDispSurface->GetPrevDispAcquireFd());
     } else {
         error = mBootAnimSTClient->queueBuffer(mBootAnimSTClient.get(), buf, -1);
-        success = Post(mBootAnimDispSurface->lastHandle, mBootAnimDispSurface->GetPrevDispAcquireFd());
     }
-
-    return error == 0 && success;
+    return error;
 }
 
 void
 GonkDisplayJB::UpdateDispSurface(EGLDisplay dpy, EGLSurface sur)
 {
-    StopBootAnim();
-
-    eglSwapBuffers(dpy, sur);
+    if (sur != EGL_NO_SURFACE) {
+      eglSwapBuffers(dpy, sur);
+    } else {
+      // When BasicCompositor is used as Compositor,
+      // EGLSurface does not exit.
+      ANativeWindowBuffer* buf = DequeueBuffer();
+      DoQueueBuffer(buf);
+    }
 }
 
 void
-GonkDisplayJB::StopBootAnim()
+GonkDisplayJB::NotifyBootAnimationStopped()
 {
-    StopBootAnimation();
     if (mBootAnimSTClient.get()) {
         mBootAnimSTClient = nullptr;
         mBootAnimDispSurface = nullptr;
@@ -377,7 +385,6 @@ GonkDisplayJB::GetNativeData(GonkDisplay::DisplayType aDisplayType,
     NativeData data;
 
     if (aDisplayType == DISPLAY_PRIMARY) {
-        StopBootAnim();
         data.mNativeWindow = mSTClient;
         data.mDisplaySurface = mDispSurface;
         data.mXdpi = xdpi;
diff --git a/widget/gonk/libdisplay/GonkDisplayJB.h b/widget/gonk/libdisplay/GonkDisplayJB.h
index d8ed9b4d37..7f182dce05 100644
--- a/widget/gonk/libdisplay/GonkDisplayJB.h
+++ b/widget/gonk/libdisplay/GonkDisplayJB.h
@@ -50,6 +50,8 @@ public:
         GonkDisplay::DisplayType aDisplayType,
         android::IGraphicBufferProducer* aProducer = nullptr);
 
+    virtual void NotifyBootAnimationStopped();
+
 private:
     void StopBootAnim();
     void CreateSurface(android::sp<ANativeWindow>& aNativeWindow,
@@ -57,6 +59,8 @@ private:
                        uint32_t aWidth, uint32_t aHeight);
     void PowerOnDisplay(int aDpy);
 
+    int DoQueueBuffer(ANativeWindowBuffer* buf);
+
     hw_module_t const*        mModule;
     hw_module_t const*        mFBModule;
     hwc_composer_device_1_t*  mHwc;
diff --git a/widget/gonk/nsScreenManagerGonk.cpp b/widget/gonk/nsScreenManagerGonk.cpp
index 8ab09e9c6f..c478752c61 100644
--- a/widget/gonk/nsScreenManagerGonk.cpp
+++ b/widget/gonk/nsScreenManagerGonk.cpp
@@ -18,6 +18,7 @@
 #include "mozilla/MouseEvents.h"
 #include "mozilla/TouchEvents.h"
 #include "mozilla/Hal.h"
+#include "libdisplay/BootAnimation.h"
 #include "libdisplay/GonkDisplay.h"
 #include "nsScreenManagerGonk.h"
 #include "nsThreadUtils.h"
@@ -243,6 +244,9 @@ nsScreenGonk::GetSurfaceFormat()
 ANativeWindow*
 nsScreenGonk::GetNativeWindow()
 {
+    if (IsPrimaryScreen()) {
+        StopBootAnimation();
+    }
     return mNativeWindow.get();
 }
 
@@ -357,6 +361,39 @@ nsScreenGonk::BringToTop(nsWindow* aWindow)
     mTopWindows.InsertElementAt(0, aWindow);
 }
 
+ANativeWindowBuffer*
+nsScreenGonk::DequeueBuffer()
+{
+    ANativeWindowBuffer* buf = nullptr;
+#if ANDROID_VERSION >= 17
+    int fenceFd = -1;
+    mNativeWindow->dequeueBuffer(mNativeWindow.get(), &buf, &fenceFd);
+    android::sp<android::Fence> fence(new android::Fence(fenceFd));
+#if ANDROID_VERSION == 17
+    fence->waitForever(1000, "nsScreenGonk_DequeueBuffer");
+    // 1000 is what Android uses. It is a warning timeout in ms.
+    // This timeout was removed in ANDROID_VERSION 18.
+#else
+    fence->waitForever("nsScreenGonk_DequeueBuffer");
+#endif
+#else
+    mNativeWindow->dequeueBuffer(mNativeWindow.get(), &buf);
+#endif
+    return buf;
+}
+
+bool
+nsScreenGonk::QueueBuffer(ANativeWindowBuffer* buf)
+{
+#if ANDROID_VERSION >= 17
+  int ret = mNativeWindow->queueBuffer(mNativeWindow.get(), buf, -1);
+  return ret == 0;
+#else
+  int ret = mNativeWindow->queueBuffer(mNativeWindow.get(), buf);
+  return ret == 0;
+#endif
+}
+
 #if ANDROID_VERSION >= 17
 android::DisplaySurface*
 nsScreenGonk::GetDisplaySurface()
diff --git a/widget/gonk/nsScreenManagerGonk.h b/widget/gonk/nsScreenManagerGonk.h
index c7f0c93057..949719c663 100644
--- a/widget/gonk/nsScreenManagerGonk.h
+++ b/widget/gonk/nsScreenManagerGonk.h
@@ -74,6 +74,9 @@ public:
     ScreenConfiguration GetConfiguration();
     bool IsPrimaryScreen();
 
+    ANativeWindowBuffer* DequeueBuffer();
+    bool QueueBuffer(ANativeWindowBuffer* buf);
+
 #if ANDROID_VERSION >= 17
     android::DisplaySurface* GetDisplaySurface();
     int GetPrevDispAcquireFd();
diff --git a/widget/gonk/nsWindow.cpp b/widget/gonk/nsWindow.cpp
index ff32519d8c..9088800983 100644
--- a/widget/gonk/nsWindow.cpp
+++ b/widget/gonk/nsWindow.cpp
@@ -66,9 +66,9 @@ static nsWindow *gFocusedWindow = nullptr;
 NS_IMPL_ISUPPORTS_INHERITED0(nsWindow, nsBaseWidget)
 
 nsWindow::nsWindow()
+    : mFramebuffer(nullptr)
+    , mMappedBuffer(nullptr)
 {
-    mFramebuffer = nullptr;
-
     RefPtr<nsScreenManagerGonk> screenManager = nsScreenManagerGonk::GetInstance();
     screenManager->Initialize();
 
@@ -628,48 +628,65 @@ gralloc_module()
 }
 
 static SurfaceFormat
-HalFormatToSurfaceFormat(int aHalFormat, int* bytepp)
+HalFormatToSurfaceFormat(int aHalFormat)
 {
     switch (aHalFormat) {
     case HAL_PIXEL_FORMAT_RGBA_8888:
-        *bytepp = 4;
-        return SurfaceFormat::R8G8B8A8;
+        // Needs RB swap
+        return SurfaceFormat::B8G8R8A8;
     case HAL_PIXEL_FORMAT_RGBX_8888:
-        *bytepp = 4;
-        return SurfaceFormat::R8G8B8X8;
+        // Needs RB swap
+        return SurfaceFormat::B8G8R8X8;
     case HAL_PIXEL_FORMAT_BGRA_8888:
-        *bytepp = 4;
         return SurfaceFormat::B8G8R8A8;
     case HAL_PIXEL_FORMAT_RGB_565:
-        *bytepp = 2;
-        return SurfaceFormat::R5G6B5;
+        return SurfaceFormat::R5G6B5_UINT16;
     default:
         MOZ_CRASH("Unhandled HAL pixel format");
         return SurfaceFormat::UNKNOWN; // not reached
     }
 }
 
+static bool
+NeedsRBSwap(int aHalFormat)
+{
+    switch (aHalFormat) {
+    case HAL_PIXEL_FORMAT_RGBA_8888:
+        return true;
+    case HAL_PIXEL_FORMAT_RGBX_8888:
+        return true;
+    case HAL_PIXEL_FORMAT_BGRA_8888:
+        return false;
+    case HAL_PIXEL_FORMAT_RGB_565:
+        return false;
+    default:
+        MOZ_CRASH("Unhandled HAL pixel format");
+        return false; // not reached
+    }
+}
+
+
 already_AddRefed<DrawTarget>
 nsWindow::StartRemoteDrawing()
 {
-    GonkDisplay* display = GetGonkDisplay();
-    mFramebuffer = display->DequeueBuffer();
+    mFramebuffer = mScreen->DequeueBuffer();
     int width = mFramebuffer->width, height = mFramebuffer->height;
-    void *vaddr;
     if (gralloc_module()->lock(gralloc_module(), mFramebuffer->handle,
                                GRALLOC_USAGE_SW_READ_NEVER |
                                GRALLOC_USAGE_SW_WRITE_OFTEN |
                                GRALLOC_USAGE_HW_FB,
-                               0, 0, width, height, &vaddr)) {
+                               0, 0, width, height,
+                               reinterpret_cast<void**>(&mMappedBuffer))) {
         EndRemoteDrawing();
         return nullptr;
     }
-    int bytepp;
-    SurfaceFormat format = HalFormatToSurfaceFormat(display->surfaceformat,
-                                                    &bytepp);
+    SurfaceFormat format = HalFormatToSurfaceFormat(mScreen->GetSurfaceFormat());
     mFramebufferTarget = Factory::CreateDrawTargetForData(
-         BackendType::CAIRO, (uint8_t*)vaddr,
-         IntSize(width, height), mFramebuffer->stride * bytepp, format);
+        BackendType::CAIRO,
+        mMappedBuffer,
+        IntSize(width, height),
+        mFramebuffer->stride * gfx::BytesPerPixel(format),
+        format);
     if (!mFramebufferTarget) {
         MOZ_CRASH("nsWindow::StartRemoteDrawing failed in CreateDrawTargetForData");
     }
@@ -686,15 +703,27 @@ nsWindow::StartRemoteDrawing()
 void
 nsWindow::EndRemoteDrawing()
 {
-    if (mFramebufferTarget) {
+    if (mFramebufferTarget && mFramebuffer) {
         IntSize size = mFramebufferTarget->GetSize();
         Rect rect(0, 0, size.width, size.height);
         RefPtr<SourceSurface> source = mBackBuffer->Snapshot();
         mFramebufferTarget->DrawSurface(source, rect, rect);
-        gralloc_module()->unlock(gralloc_module(), mFramebuffer->handle);
+
+        // Convert from BGR to RGB
+        // XXX this is a temporary solution. It consumes extra cpu cycles,
+        // it should not be used on product device.
+        if (NeedsRBSwap(mScreen->GetSurfaceFormat())) {
+            LOGE("Very slow composition path, it should not be used on product!!!");
+            SurfaceFormat format = HalFormatToSurfaceFormat(mScreen->GetSurfaceFormat());
+            gfxUtils::ConvertBGRAtoRGBA(
+                mMappedBuffer,
+                mFramebuffer->stride * mFramebuffer->height * gfx::BytesPerPixel(format));
+            mMappedBuffer = nullptr;
+            gralloc_module()->unlock(gralloc_module(), mFramebuffer->handle);
+        }
     }
     if (mFramebuffer) {
-        GetGonkDisplay()->QueueBuffer(mFramebuffer);
+        mScreen->QueueBuffer(mFramebuffer);
     }
     mFramebuffer = nullptr;
     mFramebufferTarget = nullptr;
diff --git a/widget/gonk/nsWindow.h b/widget/gonk/nsWindow.h
index a76335a21c..32399291b6 100644
--- a/widget/gonk/nsWindow.h
+++ b/widget/gonk/nsWindow.h
@@ -137,6 +137,11 @@ protected:
     // framebuffer.
     RefPtr<mozilla::gfx::DrawTarget> mFramebufferTarget;
     ANativeWindowBuffer* mFramebuffer;
+    /**
+     * Points to a mapped gralloc buffer between calls to lock and unlock.
+     * Should be null outside of the lock-unlock pair.
+     */
+    uint8_t* mMappedBuffer;
     // If we're using a BasicCompositor, this is our window back
     // buffer.  The gralloc framebuffer driver expects us to draw the
     // entire framebuffer on every frame, but gecko expects the
diff --git a/widget/gtk/WidgetUtilsGtk.cpp b/widget/gtk/WidgetUtilsGtk.cpp
new file mode 100644
index 0000000000..393f66908d
--- /dev/null
+++ b/widget/gtk/WidgetUtilsGtk.cpp
@@ -0,0 +1,51 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "WidgetUtilsGtk.h"
+
+namespace mozilla {
+
+namespace widget {
+
+int32_t WidgetUtilsGTK::IsTouchDeviceSupportPresent()
+{
+#if GTK_CHECK_VERSION(3,4,0)
+    int32_t result = 0;
+    GdkDisplay* display = gdk_display_get_default();
+    if (!display) {
+        return 0;
+    }
+
+    GdkDeviceManager* manager = gdk_display_get_device_manager(display);
+    if (!manager) {
+        return 0;
+    }
+
+    GList* devices =
+        gdk_device_manager_list_devices(manager, GDK_DEVICE_TYPE_SLAVE);
+    GList* list = devices;
+
+    while (devices) {
+        GdkDevice* device = static_cast<GdkDevice*>(devices->data);
+        if (gdk_device_get_source(device) == GDK_SOURCE_TOUCHSCREEN) {
+            result = 1;
+            break;
+        }
+        devices = devices->next;
+   }
+
+   if (list) {
+       g_list_free(list);
+   }
+
+   return result;
+#else
+   return 0;
+#endif
+}
+
+}  // namespace widget
+
+} // namespace mozilla
diff --git a/widget/gtk/WidgetUtilsGtk.h b/widget/gtk/WidgetUtilsGtk.h
new file mode 100644
index 0000000000..8c132c11ba
--- /dev/null
+++ b/widget/gtk/WidgetUtilsGtk.h
@@ -0,0 +1,25 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef WidgetUtilsGtk_h__
+#define WidgetUtilsGtk_h__
+
+#include <stdint.h>
+
+namespace mozilla {
+namespace widget {
+
+class WidgetUtilsGTK
+{
+public:
+  /* See WidgetUtils::IsTouchDeviceSupportPresent(). */
+  static int32_t IsTouchDeviceSupportPresent();
+};
+
+}  // namespace widget
+
+}  // namespace mozilla
+
+#endif // WidgetUtilsGtk_h__
diff --git a/widget/gtk/gtk3drawing.c b/widget/gtk/gtk3drawing.c
index 777ef76395..c0889aed5c 100644
--- a/widget/gtk/gtk3drawing.c
+++ b/widget/gtk/gtk3drawing.c
@@ -2719,13 +2719,11 @@ moz_gtk_get_widget_border(GtkThemeWidgetType widget, gint* left, gint* top,
         }
     case MOZ_GTK_TREE_HEADER_CELL:
         {
-            /* A Tree Header in GTK is just a different styled button 
+            /* A Tree Header in GTK is just a different styled button
              * It must be placed in a TreeView for getting the correct style
              * assigned.
-             * That is why the following code is the same as for MOZ_GTK_BUTTON.  
+             * That is why the following code is the same as for MOZ_GTK_BUTTON.
              * */
-            GtkStyleContext *style;
-
             ensure_tree_header_cell_widget();
             *left = *top = *right = *bottom = gtk_container_get_border_width(GTK_CONTAINER(gTreeHeaderCellWidget));
 
diff --git a/widget/gtk/moz.build b/widget/gtk/moz.build
index 7f4829e980..9b77796f64 100644
--- a/widget/gtk/moz.build
+++ b/widget/gtk/moz.build
@@ -13,6 +13,10 @@ EXPORTS += [
     'nsIImageToPixbuf.h',
 ]
 
+EXPORTS.mozilla += [
+    'WidgetUtilsGtk.h'
+]
+
 UNIFIED_SOURCES += [
     'IMContextWrapper.cpp',
     'mozcontainer.c',
@@ -32,6 +36,7 @@ UNIFIED_SOURCES += [
     'nsWidgetFactory.cpp',
     'WakeLockListener.cpp',
     'WidgetTraceEvent.cpp',
+    'WidgetUtilsGtk.cpp',
 ]
 
 SOURCES += [
@@ -60,6 +65,9 @@ if CONFIG['MOZ_X11']:
         'nsDragService.cpp',
     ]
 
+if CONFIG['GNU_CC']:
+    CFLAGS += ['-Wshadow']
+
 if CONFIG['ACCESSIBILITY']:
     UNIFIED_SOURCES += [
         'maiRedundantObjectFactory.c',
diff --git a/widget/gtk/mozgtk/mozgtk.c b/widget/gtk/mozgtk/mozgtk.c
index 7366d743a3..15c345cac9 100644
--- a/widget/gtk/mozgtk/mozgtk.c
+++ b/widget/gtk/mozgtk/mozgtk.c
@@ -119,7 +119,9 @@ STUB(gdk_x11_display_get_user_time)
 STUB(gdk_x11_display_get_xdisplay)
 STUB(gdk_x11_get_default_root_xwindow)
 STUB(gdk_x11_get_default_xdisplay)
+STUB(gdk_x11_get_server_time)
 STUB(gdk_x11_get_xatom_by_name)
+STUB(gdk_x11_get_xatom_by_name_for_display)
 STUB(gdk_x11_lookup_xdisplay)
 STUB(gdk_x11_screen_get_xscreen)
 STUB(gdk_x11_visual_get_xvisual)
@@ -462,6 +464,8 @@ STUB(gtk_window_fullscreen)
 STUB(gtk_window_get_group)
 STUB(gtk_window_get_transient_for)
 STUB(gtk_window_get_type)
+STUB(gtk_window_get_type_hint)
+STUB(gtk_window_get_window_type)
 STUB(gtk_window_group_add_window)
 STUB(gtk_window_group_get_current_grab)
 STUB(gtk_window_group_new)
@@ -491,6 +495,8 @@ STUB(gtk_window_unmaximize)
 #ifdef GTK3_SYMBOLS
 STUB(gdk_device_get_source)
 STUB(gdk_device_manager_get_client_pointer)
+STUB(gdk_disable_multidevice)
+STUB(gdk_device_manager_list_devices)
 STUB(gdk_display_get_device_manager)
 STUB(gdk_error_trap_pop_ignored)
 STUB(gdk_event_get_source_device)
@@ -500,10 +506,12 @@ STUB(gdk_x11_display_get_type)
 STUB(gtk_cairo_should_draw_window)
 STUB(gtk_cairo_transform_to_window)
 STUB(gtk_combo_box_text_append)
+STUB(gtk_drag_set_icon_surface)
 STUB(gtk_get_major_version)
 STUB(gtk_get_micro_version)
 STUB(gtk_get_minor_version)
 STUB(gtk_menu_button_new)
+STUB(gtk_offscreen_window_new)
 STUB(gtk_paned_new)
 STUB(gtk_render_activity)
 STUB(gtk_render_arrow)
@@ -528,6 +536,7 @@ STUB(gtk_style_context_get_border_color)
 STUB(gtk_style_context_get_color)
 STUB(gtk_style_context_get_margin)
 STUB(gtk_style_context_get_padding)
+STUB(gtk_style_context_has_class)
 STUB(gtk_style_context_new)
 STUB(gtk_style_context_remove_region)
 STUB(gtk_style_context_restore)
diff --git a/widget/gtk/nsClipboard.cpp b/widget/gtk/nsClipboard.cpp
index d31fe25e8a..4d13e61550 100644
--- a/widget/gtk/nsClipboard.cpp
+++ b/widget/gtk/nsClipboard.cpp
@@ -137,14 +137,6 @@ nsClipboard::SetData(nsITransferable *aTransferable,
         return NS_OK;
     }
 
-    nsresult rv;
-    if (!mPrivacyHandler) {
-        rv = NS_NewClipboardPrivacyHandler(getter_AddRefs(mPrivacyHandler));
-        NS_ENSURE_SUCCESS(rv, rv);
-    }
-    rv = mPrivacyHandler->PrepareDataForClipboard(aTransferable);
-    NS_ENSURE_SUCCESS(rv, rv);
-
     // Clear out the clipboard in order to set the new data
     EmptyClipboard(aWhichClipboard);
 
@@ -154,7 +146,8 @@ nsClipboard::SetData(nsITransferable *aTransferable,
     // Get the types of supported flavors
     nsCOMPtr<nsISupportsArray> flavors;
 
-    rv = aTransferable->FlavorsTransferableCanExport(getter_AddRefs(flavors));
+    nsresult rv =
+        aTransferable->FlavorsTransferableCanExport(getter_AddRefs(flavors));
     if (!flavors || NS_FAILED(rv))
         return NS_ERROR_FAILURE;
 
@@ -523,9 +516,8 @@ nsClipboard::SelectionGetEvent(GtkClipboard     *aClipboard,
     nsCOMPtr<nsISupports> item;
     uint32_t len;
 
-  
     GdkAtom selectionTarget = gtk_selection_data_get_target(aSelectionData);
-  
+
     // Check to see if the selection data includes any of the string
     // types that we support.
     if (selectionTarget == gdk_atom_intern ("STRING", FALSE) ||
@@ -563,12 +555,11 @@ nsClipboard::SelectionGetEvent(GtkClipboard     *aClipboard,
         // Look through our transfer data for the image
         static const char* const imageMimeTypes[] = {
             kNativeImageMime, kPNGImageMime, kJPEGImageMime, kJPGImageMime, kGIFImageMime };
-        nsCOMPtr<nsISupports> item;
-        uint32_t len;
+        nsCOMPtr<nsISupports> imageItem;
         nsCOMPtr<nsISupportsInterfacePointer> ptrPrimitive;
         for (uint32_t i = 0; !ptrPrimitive && i < ArrayLength(imageMimeTypes); i++) {
-            rv = trans->GetTransferData(imageMimeTypes[i], getter_AddRefs(item), &len);
-            ptrPrimitive = do_QueryInterface(item);
+            rv = trans->GetTransferData(imageMimeTypes[i], getter_AddRefs(imageItem), &len);
+            ptrPrimitive = do_QueryInterface(imageItem);
         }
         if (!ptrPrimitive)
             return;
diff --git a/widget/gtk/nsClipboard.h b/widget/gtk/nsClipboard.h
index 000ba732df..70c866a013 100644
--- a/widget/gtk/nsClipboard.h
+++ b/widget/gtk/nsClipboard.h
@@ -9,8 +9,7 @@
 #define __nsClipboard_h_
 
 #include "nsIClipboard.h"
-#include "nsClipboardPrivacyHandler.h"
-#include "nsAutoPtr.h"
+#include "nsIObserver.h"
 #include <gtk/gtk.h>
 
 class nsClipboard : public nsIClipboard,
@@ -53,7 +52,6 @@ private:
     nsCOMPtr<nsIClipboardOwner>  mGlobalOwner;
     nsCOMPtr<nsITransferable>    mSelectionTransferable;
     nsCOMPtr<nsITransferable>    mGlobalTransferable;
-    RefPtr<nsClipboardPrivacyHandler> mPrivacyHandler;
 
 };
 
diff --git a/widget/gtk/nsDragService.cpp b/widget/gtk/nsDragService.cpp
index 05be822eeb..8275637044 100644
--- a/widget/gtk/nsDragService.cpp
+++ b/widget/gtk/nsDragService.cpp
@@ -19,6 +19,7 @@
 #include "nsPrimitiveHelpers.h"
 #include "prtime.h"
 #include "prthread.h"
+#include <dlfcn.h>
 #include <gtk/gtk.h>
 #include <gdk/gdkx.h>
 #include "nsCRT.h"
@@ -38,6 +39,7 @@
 #include "nsGtkUtils.h"
 #include "mozilla/gfx/2D.h"
 #include "gfxPlatform.h"
+#include "nsScreenGtk.h"
 
 using namespace mozilla;
 using namespace mozilla::gfx;
@@ -102,7 +104,12 @@ nsDragService::nsDragService()
     obsServ->AddObserver(this, "quit-application", false);
 
     // our hidden source widget
+#if (MOZ_WIDGET_GTK == 2)
     mHiddenWidget = gtk_window_new(GTK_WINDOW_POPUP);
+#else
+    // Using an offscreen window works around bug 983843.
+    mHiddenWidget = gtk_offscreen_window_new();
+#endif
     // make sure that the widget is realized so that
     // we can use it as a drag source.
     gtk_widget_realize(mHiddenWidget);
@@ -305,11 +312,16 @@ nsDragService::InvokeDragSession(nsIDOMNode *aDOMNode,
     if (mSourceNode)
         return NS_ERROR_NOT_AVAILABLE;
 
-    nsresult rv = nsBaseDragService::InvokeDragSession(aDOMNode,
-                                                       aArrayTransferables,
-                                                       aRegion, aActionType);
-    NS_ENSURE_SUCCESS(rv, rv);
+    return nsBaseDragService::InvokeDragSession(aDOMNode, aArrayTransferables,
+                                                aRegion, aActionType);
+}
 
+// nsBaseDragService
+nsresult
+nsDragService::InvokeDragSessionImpl(nsISupportsArray* aArrayTransferables,
+                                     nsIScriptableRegion* aRegion,
+                                     uint32_t aActionType)
+{
     // make sure that we have an array of transferables to use
     if (!aArrayTransferables)
         return NS_ERROR_INVALID_ARG;
@@ -370,6 +382,7 @@ nsDragService::InvokeDragSession(nsIDOMNode *aDOMNode,
 
     mSourceRegion = nullptr;
 
+    nsresult rv;
     if (context) {
         StartDragSession();
 
@@ -384,6 +397,7 @@ nsDragService::InvokeDragSession(nsIDOMNode *aDOMNode,
         }
         // We don't have a drag end point yet.
         mEndDragPoint = nsIntPoint(-1, -1);
+        rv = NS_OK;
     }
     else {
         rv = NS_ERROR_FAILURE;
@@ -401,7 +415,6 @@ nsDragService::SetAlphaPixmap(SourceSurface *aSurface,
                               int32_t aYOffset,
                               const nsIntRect& dragRect)
 {
-#if (MOZ_WIDGET_GTK == 2)
     GdkScreen* screen = gtk_widget_get_screen(mHiddenWidget);
 
     // Transparent drag icons need, like a lot of transparency-related things,
@@ -409,6 +422,7 @@ nsDragService::SetAlphaPixmap(SourceSurface *aSurface,
     if (!gdk_screen_is_composited(screen))
       return false;
 
+#if (MOZ_WIDGET_GTK == 2)
     GdkColormap* alphaColormap = gdk_screen_get_rgba_colormap(screen);
     if (!alphaColormap)
       return false;
@@ -449,8 +463,46 @@ nsDragService::SetAlphaPixmap(SourceSurface *aSurface,
     g_object_unref(pixmap);
     return true;
 #else
-    // TODO GTK3
-    return false;
+#ifdef cairo_image_surface_create
+#error "Looks like we're including Mozilla's cairo instead of system cairo"
+#endif
+    // TODO: grab X11 pixmap or image data instead of expensive readback.
+    cairo_surface_t *surf = cairo_image_surface_create(CAIRO_FORMAT_ARGB32,
+                                                       dragRect.width,
+                                                       dragRect.height);
+    if (!surf)
+        return false;
+
+    RefPtr<DrawTarget> dt = gfxPlatform::GetPlatform()->
+        CreateDrawTargetForData(cairo_image_surface_get_data(surf),
+                                dragRect.Size(),
+                                cairo_image_surface_get_stride(surf),
+                                SurfaceFormat::B8G8R8A8);
+    if (!dt)
+        return false;
+
+    dt->ClearRect(Rect(0, 0, dragRect.width, dragRect.height));
+    dt->DrawSurface(aSurface,
+                    Rect(0, 0, dragRect.width, dragRect.height),
+                    Rect(0, 0, dragRect.width, dragRect.height),
+                    DrawSurfaceOptions(),
+                    DrawOptions(DRAG_IMAGE_ALPHA_LEVEL, CompositionOp::OP_SOURCE));
+
+    cairo_surface_mark_dirty(surf);
+    cairo_surface_set_device_offset(surf, -aXOffset, -aYOffset);
+
+    // Ensure that the surface is drawn at the correct scale on HiDPI displays.
+    static auto sCairoSurfaceSetDeviceScalePtr =
+        (void (*)(cairo_surface_t*,double,double))
+        dlsym(RTLD_DEFAULT, "cairo_surface_set_device_scale");
+    if (sCairoSurfaceSetDeviceScalePtr) {
+        gint scale = nsScreenGtk::GetGtkMonitorScaleFactor();
+        sCairoSurfaceSetDeviceScalePtr(surf, scale, scale);
+    }
+
+    gtk_drag_set_icon_surface(aContext, surf);
+    cairo_surface_destroy(surf);
+    return true;
 #endif
 }
 
@@ -510,6 +562,26 @@ nsDragService::GetCanDrop(bool *aCanDrop)
     return NS_OK;
 }
 
+static void
+UTF16ToNewUTF8(const char16_t* aUTF16,
+               uint32_t aUTF16Len,
+               char** aUTF8,
+               uint32_t* aUTF8Len)
+{
+  nsDependentSubstring utf16(aUTF16, aUTF16Len);
+  *aUTF8 = ToNewUTF8String(utf16, aUTF8Len);
+}
+
+static void
+UTF8ToNewUTF16(const char* aUTF8,
+               uint32_t aUTF8Len,
+               char16_t** aUTF16,
+               uint32_t* aUTF16Len)
+{
+  nsDependentCSubstring utf8(aUTF8, aUTF8Len);
+  *aUTF16 = UTF8ToNewUnicode(utf8, aUTF16Len);
+}
+
 // count the number of URIs in some text/uri-list format data.
 static uint32_t
 CountTextUriListItems(const char *data,
@@ -541,7 +613,7 @@ GetTextUriListItem(const char *data,
                    uint32_t datalen,
                    uint32_t aItemIndex,
                    char16_t **convertedText,
-                   int32_t *convertedTextLen)
+                   uint32_t *convertedTextLen)
 {
     const char *p = data;
     const char *endPtr = p + datalen;
@@ -560,8 +632,7 @@ GetTextUriListItem(const char *data,
             const char *q = p;
             while (q < endPtr && *q != '\0' && *q != '\n' && *q != '\r')
               q++;
-            nsPrimitiveHelpers::ConvertPlatformPlainTextToUnicode(
-                                p, q - p, convertedText, convertedTextLen);
+            UTF8ToNewUTF16(p, q - p, convertedText, convertedTextLen);
             break;
         }
         // skip to the end of the line
@@ -572,8 +643,7 @@ GetTextUriListItem(const char *data,
 
     // didn't find the desired item, so just pass the whole lot
     if (!*convertedText) {
-        nsPrimitiveHelpers::ConvertPlatformPlainTextToUnicode(
-                            data, datalen, convertedText, convertedTextLen);
+        UTF8ToNewUTF16(data, datalen, convertedText, convertedTextLen);
     }
 }
 
@@ -731,7 +801,7 @@ nsDragService::GetData(nsITransferable * aTransferable,
                     if (mTargetDragData) {
                         const char* text = static_cast<char*>(mTargetDragData);
                         char16_t* convertedText = nullptr;
-                        int32_t convertedTextLen = 0;
+                        uint32_t convertedTextLen = 0;
 
                         GetTextUriListItem(text, mTargetDragDataLen, aItemIndex,
                                            &convertedText, &convertedTextLen);
@@ -739,8 +809,8 @@ nsDragService::GetData(nsITransferable * aTransferable,
                         if (convertedText) {
                             nsCOMPtr<nsIIOService> ioService = do_GetIOService(&rv);
                             nsCOMPtr<nsIURI> fileURI;
-                            nsresult rv = ioService->NewURI(NS_ConvertUTF16toUTF8(convertedText),
-                                                            nullptr, nullptr, getter_AddRefs(fileURI));
+                            rv = ioService->NewURI(NS_ConvertUTF16toUTF8(convertedText),
+                                                   nullptr, nullptr, getter_AddRefs(fileURI));
                             if (NS_SUCCEEDED(rv)) {
                                 nsCOMPtr<nsIFileURL> fileURL = do_QueryInterface(fileURI, &rv);
                                 if (NS_SUCCEEDED(rv)) {
@@ -803,10 +873,9 @@ nsDragService::GetData(nsITransferable * aTransferable,
                             const char* castedText =
                                         reinterpret_cast<char*>(mTargetDragData);
                             char16_t* convertedText = nullptr;
-                            int32_t convertedTextLen = 0;
-                            nsPrimitiveHelpers::ConvertPlatformPlainTextToUnicode(
-                                                castedText, mTargetDragDataLen,
-                                                &convertedText, &convertedTextLen);
+                            uint32_t convertedTextLen = 0;
+                            UTF8ToNewUTF16(castedText, mTargetDragDataLen,
+                                           &convertedText, &convertedTextLen);
                             if ( convertedText ) {
                                 MOZ_LOG(sDragLm, LogLevel::Debug,
                                        ("successfully converted plain text \
@@ -836,7 +905,7 @@ nsDragService::GetData(nsITransferable * aTransferable,
                         const char *data =
                                    reinterpret_cast<char*>(mTargetDragData);
                         char16_t* convertedText = nullptr;
-                        int32_t convertedTextLen = 0;
+                        uint32_t convertedTextLen = 0;
 
                         GetTextUriListItem(data, mTargetDragDataLen, aItemIndex,
                                            &convertedText, &convertedTextLen);
@@ -868,8 +937,8 @@ nsDragService::GetData(nsITransferable * aTransferable,
                             const char* castedText =
                                   reinterpret_cast<char*>(mTargetDragData);
                             char16_t* convertedText = nullptr;
-                            int32_t convertedTextLen = 0;
-                            nsPrimitiveHelpers::ConvertPlatformPlainTextToUnicode(castedText, mTargetDragDataLen, &convertedText, &convertedTextLen);
+                            uint32_t convertedTextLen = 0;
+                            UTF8ToNewUTF16(castedText, mTargetDragDataLen, &convertedText, &convertedTextLen);
                             if ( convertedText ) {
                                 MOZ_LOG(sDragLm,
                                        LogLevel::Debug,
@@ -1426,14 +1495,13 @@ CreateUriList(nsISupportsArray *items, gchar **text, gint *length)
                 char* plainTextData = nullptr;
                 char16_t* castedUnicode = reinterpret_cast<char16_t*>
                                                            (tmpData);
-                int32_t plainTextLen = 0;
-                nsPrimitiveHelpers::ConvertUnicodeToPlatformPlainText(
-                                    castedUnicode,
-                                    tmpDataLen / 2,
-                                    &plainTextData,
-                                    &plainTextLen);
+                uint32_t plainTextLen = 0;
+                UTF16ToNewUTF8(castedUnicode,
+                               tmpDataLen / 2,
+                               &plainTextData,
+                               &plainTextLen);
                 if (plainTextData) {
-                    int32_t j;
+                    uint32_t j;
 
                     // text/x-moz-url is of form url + "\n" + title.
                     // We just want the url.
@@ -1532,19 +1600,11 @@ nsDragService::SourceDataGet(GtkWidget        *aWidget,
                 char* plainTextData = nullptr;
                 char16_t* castedUnicode = reinterpret_cast<char16_t*>
                                                            (tmpData);
-                int32_t plainTextLen = 0;
-                if (strcmp(mimeFlavor, gTextPlainUTF8Type) == 0) {
-                    plainTextData =
-                        ToNewUTF8String(
-                            nsDependentString(castedUnicode, tmpDataLen / 2),
-                            (uint32_t*)&plainTextLen);
-                } else {
-                    nsPrimitiveHelpers::ConvertUnicodeToPlatformPlainText(
-                                        castedUnicode,
-                                        tmpDataLen / 2,
-                                        &plainTextData,
-                                        &plainTextLen);
-                }
+                uint32_t plainTextLen = 0;
+                UTF16ToNewUTF8(castedUnicode,
+                               tmpDataLen / 2,
+                               &plainTextData,
+                               &plainTextLen);
                 if (tmpData) {
                     // this was not allocated using glib
                     free(tmpData);
diff --git a/widget/gtk/nsDragService.h b/widget/gtk/nsDragService.h
index d724721073..162986f098 100644
--- a/widget/gtk/nsDragService.h
+++ b/widget/gtk/nsDragService.h
@@ -58,6 +58,10 @@ public:
 
     NS_DECL_NSIOBSERVER
 
+    // nsBaseDragService
+    virtual nsresult InvokeDragSessionImpl(nsISupportsArray* anArrayTransferables,
+                                           nsIScriptableRegion* aRegion,
+                                           uint32_t aActionType) override;
     // nsIDragService
     NS_IMETHOD InvokeDragSession (nsIDOMNode *aDOMNode,
                                   nsISupportsArray * anArrayTransferables,
diff --git a/widget/gtk/nsLookAndFeel.cpp b/widget/gtk/nsLookAndFeel.cpp
index 8534ddf8c8..2f77a3dc0f 100644
--- a/widget/gtk/nsLookAndFeel.cpp
+++ b/widget/gtk/nsLookAndFeel.cpp
@@ -23,6 +23,7 @@
 #include "gtkdrawing.h"
 #include "nsStyleConsts.h"
 #include "gfxFontConstants.h"
+#include "WidgetUtils.h"
 
 #include <dlfcn.h>
 
@@ -633,8 +634,13 @@ nsLookAndFeel::GetIntImpl(IntID aID, int32_t &aResult)
         res = NS_ERROR_NOT_IMPLEMENTED;
         break;
     case eIntID_TouchEnabled:
+#if MOZ_WIDGET_GTK == 3
+        aResult = mozilla::widget::WidgetUtils::IsTouchDeviceSupportPresent();
+        break;
+#else
         aResult = 0;
         res = NS_ERROR_NOT_IMPLEMENTED;
+#endif
         break;
     case eIntID_MacGraphiteTheme:
     case eIntID_MacLionTheme:
diff --git a/widget/gtk/nsWindow.cpp b/widget/gtk/nsWindow.cpp
index 8b5a8dcf52..5986a70dfb 100644
--- a/widget/gtk/nsWindow.cpp
+++ b/widget/gtk/nsWindow.cpp
@@ -6,9 +6,12 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "mozilla/ArrayUtils.h"
+#include "mozilla/EventForwards.h"
 #include "mozilla/MiscEvents.h"
 #include "mozilla/MouseEvents.h"
 #include "mozilla/TextEvents.h"
+#include "mozilla/TouchEvents.h"
+#include "mozilla/UniquePtrExtensions.h"
 #include <algorithm>
 
 #include "GeckoProfiler.h"
@@ -22,6 +25,7 @@
 #include "nsDragService.h"
 #include "nsIWidgetListener.h"
 #include "nsIScreenManager.h"
+#include "SystemTimeConverter.h"
 
 #include "nsGtkKeyUtils.h"
 #include "nsGtkCursors.h"
@@ -143,9 +147,11 @@ const gint kEvents = GDK_EXPOSURE_MASK | GDK_STRUCTURE_MASK |
                      GDK_BUTTON_PRESS_MASK | GDK_BUTTON_RELEASE_MASK |
 #if GTK_CHECK_VERSION(3,4,0)
                      GDK_SMOOTH_SCROLL_MASK |
+                     GDK_TOUCH_MASK |
 #endif
                      GDK_SCROLL_MASK |
-                     GDK_POINTER_MOTION_MASK;
+                     GDK_POINTER_MOTION_MASK |
+                     GDK_PROPERTY_CHANGE_MASK;
 
 /* utility functions */
 static bool       is_mouse_in_window(GdkWindow* aWindow,
@@ -199,6 +205,8 @@ static gboolean key_press_event_cb        (GtkWidget *widget,
                                            GdkEventKey *event);
 static gboolean key_release_event_cb      (GtkWidget *widget,
                                            GdkEventKey *event);
+static gboolean property_notify_event_cb  (GtkWidget *widget,
+                                           GdkEventProperty *event);
 static gboolean scroll_event_cb           (GtkWidget *widget,
                                            GdkEventScroll *event);
 static gboolean visibility_notify_event_cb(GtkWidget *widget,
@@ -210,6 +218,10 @@ static gboolean window_state_event_cb     (GtkWidget *widget,
 static void     theme_changed_cb          (GtkSettings *settings,
                                            GParamSpec *pspec,
                                            nsWindow *data);
+#if GTK_CHECK_VERSION(3,4,0)
+static gboolean touch_event_cb            (GtkWidget* aWidget,
+                                           GdkEventTouch* aEvent);
+#endif
 static nsWindow* GetFirstNSWindowForGDKWindow (GdkWindow *aGdkWindow);
 
 #ifdef __cplusplus
@@ -261,6 +273,75 @@ static nsresult    initialize_prefs        (void);
 static guint32 sLastUserInputTime = GDK_CURRENT_TIME;
 static guint32 sRetryGrabTime;
 
+static SystemTimeConverter<guint32>&
+TimeConverter() {
+    static SystemTimeConverter<guint32> sTimeConverterSingleton;
+    return sTimeConverterSingleton;
+}
+
+namespace mozilla {
+
+class CurrentX11TimeGetter
+{
+public:
+    explicit CurrentX11TimeGetter(GdkWindow* aWindow)
+        : mWindow(aWindow)
+        , mAsyncUpdateStart()
+    {
+    }
+
+    guint32 GetCurrentTime() const
+    {
+        return gdk_x11_get_server_time(mWindow);
+    }
+
+    void GetTimeAsyncForPossibleBackwardsSkew(const TimeStamp& aNow)
+    {
+        // Check for in-flight request
+        if (!mAsyncUpdateStart.IsNull()) {
+            return;
+        }
+        mAsyncUpdateStart = aNow;
+
+        Display* xDisplay = GDK_WINDOW_XDISPLAY(mWindow);
+        Window xWindow = GDK_WINDOW_XID(mWindow);
+        unsigned char c = 'a';
+        Atom timeStampPropAtom = TimeStampPropAtom();
+        XChangeProperty(xDisplay, xWindow, timeStampPropAtom,
+                        timeStampPropAtom, 8, PropModeReplace, &c, 1);
+        XFlush(xDisplay);
+    }
+
+    gboolean PropertyNotifyHandler(GtkWidget* aWidget,
+                                   GdkEventProperty* aEvent)
+    {
+        if (aEvent->atom !=
+            gdk_x11_xatom_to_atom(TimeStampPropAtom())) {
+            return FALSE;
+        }
+
+        guint32 eventTime = aEvent->time;
+        TimeStamp lowerBound = mAsyncUpdateStart;
+
+        TimeConverter().CompensateForBackwardsSkew(eventTime, lowerBound);
+        mAsyncUpdateStart = TimeStamp();
+        return TRUE;
+    }
+
+private:
+    static Atom TimeStampPropAtom() {
+        return gdk_x11_get_xatom_by_name_for_display(
+            gdk_display_get_default(), "GDK_TIMESTAMP_PROP");
+    }
+
+    // This is safe because this class is stored as a member of mWindow and
+    // won't outlive it.
+    GdkWindow* mWindow;
+    TimeStamp  mAsyncUpdateStart;
+};
+
+} // namespace mozilla
+
 static NS_DEFINE_IID(kCDragServiceCID,  NS_DRAGSERVICE_CID);
 
 // The window from which the focus manager asks us to dispatch key events.
@@ -270,6 +351,9 @@ static bool              gGlobalsInitialized   = false;
 static bool              gRaiseWindows         = true;
 static nsWindow         *gPluginFocusWindow    = nullptr;
 
+#if GTK_CHECK_VERSION(3,4,0)
+static uint32_t          gLastTouchID = 0;
+#endif
 
 #define NS_WINDOW_TITLE_MAX_LENGTH 4095
 
@@ -328,13 +412,16 @@ NS_IMPL_ISUPPORTS_INHERITED0(nsWindow, nsBaseWidget)
 
 nsWindow::nsWindow()
 {
-    mIsTopLevel       = false;
-    mIsDestroyed      = false;
-    mListenForResizes = false;
-    mIsShown          = false;
-    mNeedsShow        = false;
-    mEnabled          = true;
-    mCreated          = false;
+    mIsTopLevel          = false;
+    mIsDestroyed         = false;
+    mListenForResizes    = false;
+    mIsShown             = false;
+    mNeedsShow           = false;
+    mEnabled             = true;
+    mCreated             = false;
+#if GTK_CHECK_VERSION(3,4,0)
+    mHandleTouchEvent    = false;
+#endif
 
     mContainer           = nullptr;
     mGdkWindow           = nullptr;
@@ -458,10 +545,6 @@ nsWindow::DispatchEvent(WidgetGUIEvent* aEvent, nsEventStatus& aStatus)
     debug_DumpEvent(stdout, aEvent->widget, aEvent,
                     nsAutoCString("something"), 0);
 #endif
-    // Translate the mouse event into device pixels.
-    aEvent->refPoint.x = GdkCoordToDevicePixels(aEvent->refPoint.x);
-    aEvent->refPoint.y = GdkCoordToDevicePixels(aEvent->refPoint.y);
-
     aStatus = nsEventStatus_eIgnore;
     nsIWidgetListener* listener =
         mAttachedWidgetListener ? mAttachedWidgetListener : mWidgetListener;
@@ -855,6 +938,15 @@ nsWindow::IsVisible() const
     return mIsShown;
 }
 
+void
+nsWindow::RegisterTouchWindow()
+{
+#if GTK_CHECK_VERSION(3,4,0)
+    mHandleTouchEvent = true;
+    mTouches.Clear();
+#endif
+}
+
 NS_IMETHODIMP
 nsWindow::ConstrainPosition(bool aAllowSlop, int32_t *aX, int32_t *aY)
 {
@@ -1421,13 +1513,15 @@ nsWindow::GetClientBounds(nsIntRect &aRect)
     return NS_OK;
 }
 
-nsIntPoint
-nsWindow::GetClientOffset()
+void
+nsWindow::UpdateClientOffset()
 {
-    PROFILER_LABEL("nsWindow", "GetClientOffset", js::ProfileEntry::Category::GRAPHICS);
+    PROFILER_LABEL("nsWindow", "UpdateClientOffset", js::ProfileEntry::Category::GRAPHICS);
 
-    if (!mIsTopLevel) {
-        return nsIntPoint(0, 0);
+    if (!mIsTopLevel || !mShell || !mGdkWindow ||
+        gtk_window_get_window_type(GTK_WINDOW(mShell)) == GTK_WINDOW_POPUP) {
+        mClientOffset = nsIntPoint(0, 0);
+        return;
     }
 
     GdkAtom cardinal_atom = gdk_x11_xatom_to_atom(XA_CARDINAL);
@@ -1436,10 +1530,8 @@ nsWindow::GetClientOffset()
     int format_returned;
     int length_returned;
     long *frame_extents;
-    GdkWindow* window;
 
-    if (!mShell || !(window = gtk_widget_get_window(mShell)) ||
-        !gdk_property_get(window,
+    if (!gdk_property_get(mGdkWindow,
                           gdk_atom_intern ("_NET_FRAME_EXTENTS", FALSE),
                           cardinal_atom,
                           0, // offset
@@ -1450,8 +1542,8 @@ nsWindow::GetClientOffset()
                           &length_returned,
                           (guchar **) &frame_extents) ||
         length_returned/sizeof(glong) != 4) {
-
-        return nsIntPoint(0, 0);
+        mClientOffset = nsIntPoint(0, 0);
+        return;
     }
 
     // data returned is in the order left, right, top, bottom
@@ -1460,7 +1552,29 @@ nsWindow::GetClientOffset()
 
     g_free(frame_extents);
 
-    return nsIntPoint(left, top);
+    mClientOffset = nsIntPoint(left, top);
+}
+
+nsIntPoint
+nsWindow::GetClientOffset()
+{
+    return mClientOffset;
+}
+
+gboolean
+nsWindow::OnPropertyNotifyEvent(GtkWidget* aWidget, GdkEventProperty* aEvent)
+
+{
+  if (aEvent->atom == gdk_atom_intern("_NET_FRAME_EXTENTS", FALSE)) {
+    UpdateClientOffset();
+    return FALSE;
+  }
+
+  if (GetCurrentTimeGetter()->PropertyNotifyHandler(aWidget, aEvent)) {
+    return TRUE;
+  }
+
+  return FALSE;
 }
 
 NS_IMETHODIMP
@@ -1746,16 +1860,16 @@ nsWindow::CaptureMouse(bool aCapture)
     if (!mGdkWindow)
         return NS_OK;
 
-    if (!mShell)
+    if (!mContainer)
         return NS_ERROR_FAILURE;
 
     if (aCapture) {
-        gtk_grab_add(mShell);
+        gtk_grab_add(GTK_WIDGET(mContainer));
         GrabPointer(GetLastUserInputTime());
     }
     else {
         ReleaseGrabs();
-        gtk_grab_remove(mShell);
+        gtk_grab_remove(GTK_WIDGET(mContainer));
     }
 
     return NS_OK;
@@ -1768,7 +1882,7 @@ nsWindow::CaptureRollupEvents(nsIRollupListener *aListener,
     if (!mGdkWindow)
         return NS_OK;
 
-    if (!mShell)
+    if (!mContainer)
         return NS_ERROR_FAILURE;
 
     LOG(("CaptureRollupEvents %p %i\n", this, int(aDoCapture)));
@@ -1777,13 +1891,14 @@ nsWindow::CaptureRollupEvents(nsIRollupListener *aListener,
         gRollupListener = aListener;
         // real grab is only done when there is no dragging
         if (!nsWindow::DragInProgress()) {
-            // This widget grab ensures that a Gecko GtkWidget receives mouse
-            // events even when embedded in non-Gecko-owned GtkWidgets.
-            // The grab is placed on the toplevel GtkWindow instead of the
-            // MozContainer to avoid double dispatch of keyboard events
-            // (bug 707623).
-            gtk_grab_add(mShell);
-            GrabPointer(GetLastUserInputTime());
+            // Maybe the dnd flag is not yet set at this point, but dnd has already started
+            // so let's be extra careful and skip this operation for dnd popup panels always
+            // (panels with type="drag").
+            GdkWindowTypeHint gdkTypeHint = gtk_window_get_type_hint(GTK_WINDOW(mShell));
+            if (gdkTypeHint != GDK_WINDOW_TYPE_HINT_DND) {
+              gtk_grab_add(GTK_WIDGET(mContainer));
+              GrabPointer(GetLastUserInputTime());
+            }
         }
     }
     else {
@@ -1793,7 +1908,7 @@ nsWindow::CaptureRollupEvents(nsIRollupListener *aListener,
         // There may not have been a drag in process when aDoCapture was set,
         // so make sure to remove any added grab.  This is a no-op if the grab
         // was not added to this widget.
-        gtk_grab_remove(mShell);
+        gtk_grab_remove(GTK_WIDGET(mContainer));
         gRollupListener = nullptr;
     }
 
@@ -2212,9 +2327,9 @@ nsWindow::UpdateAlpha(gfxPattern* aPattern, nsIntRect aBoundsRect)
     int32_t stride = GetAlignedStride<4>(BytesPerPixel(SurfaceFormat::A8) *
                                          aBoundsRect.width);
     int32_t bufferSize = stride * aBoundsRect.height;
-    nsAutoArrayPtr<uint8_t> imageBuffer(new (std::nothrow) uint8_t[bufferSize]);
+    auto imageBuffer = MakeUniqueFallible<uint8_t[]>(bufferSize);
     RefPtr<DrawTarget> drawTarget = gfxPlatform::GetPlatform()->
-        CreateDrawTargetForData(imageBuffer, aBoundsRect.Size(),
+        CreateDrawTargetForData(imageBuffer.get(), aBoundsRect.Size(),
                                 stride, SurfaceFormat::A8);
 
     if (drawTarget) {
@@ -2225,7 +2340,7 @@ nsWindow::UpdateAlpha(gfxPattern* aPattern, nsIntRect aBoundsRect)
                              *aPattern->GetPattern(drawTarget),
                              DrawOptions(1.0, CompositionOp::OP_SOURCE));
     }
-    UpdateTranslucentWindowAlphaInternal(aBoundsRect, imageBuffer, stride);
+    UpdateTranslucentWindowAlphaInternal(aBoundsRect, imageBuffer.get(), stride);
 }
 
 gboolean
@@ -2324,8 +2439,6 @@ nsWindow::OnSizeAllocate(GtkAllocation *aAllocation)
     if (mBounds.Size() == size)
         return;
 
-    nsIntRect rect;
-
     // Invalidate the new part of the window now for the pending paint to
     // minimize background flashes (GDK does not do this for external resizes
     // of toplevels.)
@@ -2376,10 +2489,9 @@ nsWindow::OnEnterNotifyEvent(GdkEventCrossing *aEvent)
     WidgetMouseEvent event(true, eMouseEnterIntoWidget, this,
                            WidgetMouseEvent::eReal);
 
-    event.refPoint.x = nscoord(aEvent->x);
-    event.refPoint.y = nscoord(aEvent->y);
-
+    event.refPoint = GdkEventCoordsToDevicePixels(aEvent->x, aEvent->y);
     event.time = aEvent->time;
+    event.timeStamp = GetEventTimeStamp(aEvent->time);
 
     LOG(("OnEnterNotify: %p\n", (void *)this));
 
@@ -2418,10 +2530,9 @@ nsWindow::OnLeaveNotifyEvent(GdkEventCrossing *aEvent)
     WidgetMouseEvent event(true, eMouseExitFromWidget, this,
                            WidgetMouseEvent::eReal);
 
-    event.refPoint.x = nscoord(aEvent->x);
-    event.refPoint.y = nscoord(aEvent->y);
-
+    event.refPoint = GdkEventCoordsToDevicePixels(aEvent->x, aEvent->y);
     event.time = aEvent->time;
+    event.timeStamp = GetEventTimeStamp(aEvent->time);
 
     event.exit = is_top_level_mouse_exit(mGdkWindow, aEvent)
         ? WidgetMouseEvent::eTopLevel : WidgetMouseEvent::eChild;
@@ -2431,6 +2542,20 @@ nsWindow::OnLeaveNotifyEvent(GdkEventCrossing *aEvent)
     DispatchInputEvent(&event);
 }
 
+template <typename Event> static LayoutDeviceIntPoint
+GetRefPoint(nsWindow* aWindow, Event* aEvent)
+{
+    if (aEvent->window == aWindow->GetGdkWindow()) {
+        // we are the window that the event happened on so no need for expensive WidgetToScreenOffset
+        return aWindow->GdkEventCoordsToDevicePixels(aEvent->x, aEvent->y);
+    }
+    // XXX we're never quite sure which GdkWindow the event came from due to our custom bubbling
+    // in scroll_event_cb(), so use ScreenToWidget to translate the screen root coordinates into
+    // coordinates relative to this widget.
+    return aWindow->GdkEventCoordsToDevicePixels(
+        aEvent->x_root, aEvent->y_root) - aWindow->WidgetToScreenOffset();
+}
+
 void
 nsWindow::OnMotionNotifyEvent(GdkEventMotion *aEvent)
 {
@@ -2482,29 +2607,22 @@ nsWindow::OnMotionNotifyEvent(GdkEventMotion *aEvent)
         modifierState = xevent.xmotion.state;
 
         event.time = xevent.xmotion.time;
+        event.timeStamp = GetEventTimeStamp(xevent.xmotion.time);
 #else
-        event.refPoint.x = nscoord(aEvent->x);
-        event.refPoint.y = nscoord(aEvent->y);
+        event.refPoint = GdkEventCoordsToDevicePixels(aEvent->x, aEvent->y);
 
         modifierState = aEvent->state;
 
         event.time = aEvent->time;
+        event.timeStamp = GetEventTimeStamp(aEvent->time);
 #endif /* MOZ_X11 */
-    }
-    else {
-        // XXX see OnScrollEvent()
-        if (aEvent->window == mGdkWindow) {
-            event.refPoint.x = nscoord(aEvent->x);
-            event.refPoint.y = nscoord(aEvent->y);
-        } else {
-            LayoutDeviceIntPoint point(NSToIntFloor(aEvent->x_root),
-                                       NSToIntFloor(aEvent->y_root));
-            event.refPoint = point - WidgetToScreenOffset();
-        }
+    } else {
+        event.refPoint = GetRefPoint(this, aEvent);
 
         modifierState = aEvent->state;
 
         event.time = aEvent->time;
+        event.timeStamp = GetEventTimeStamp(aEvent->time);
     }
 
     KeymapWrapper::InitInputEvent(event, modifierState);
@@ -2568,15 +2686,7 @@ void
 nsWindow::InitButtonEvent(WidgetMouseEvent& aEvent,
                           GdkEventButton* aGdkEvent)
 {
-    // XXX see OnScrollEvent()
-    if (aGdkEvent->window == mGdkWindow) {
-        aEvent.refPoint.x = nscoord(aGdkEvent->x);
-        aEvent.refPoint.y = nscoord(aGdkEvent->y);
-    } else {
-        LayoutDeviceIntPoint point(NSToIntFloor(aGdkEvent->x_root),
-                                   NSToIntFloor(aGdkEvent->y_root));
-        aEvent.refPoint = point - WidgetToScreenOffset();
-    }
+    aEvent.refPoint = GetRefPoint(this, aGdkEvent);
 
     guint modifierState = aGdkEvent->state;
     // aEvent's state doesn't include this event's information.  Therefore,
@@ -2601,6 +2711,7 @@ nsWindow::InitButtonEvent(WidgetMouseEvent& aEvent,
     KeymapWrapper::InitInputEvent(aEvent, modifierState);
 
     aEvent.time = aGdkEvent->time;
+    aEvent.timeStamp = GetEventTimeStamp(aGdkEvent->time);
 
     switch (aGdkEvent->type) {
     case GDK_2BUTTON_PRESS:
@@ -2859,6 +2970,35 @@ nsWindow::DispatchKeyDownEvent(GdkEventKey *aEvent, bool *aCancelled)
     return true;
 }
 
+TimeStamp
+nsWindow::GetEventTimeStamp(guint32 aEventTime)
+{
+    if (MOZ_UNLIKELY(!mGdkWindow)) {
+        // nsWindow has been Destroy()ed.
+        return TimeStamp::Now();
+    }
+    if (aEventTime == 0) {
+        // Some X11 and GDK events may be received with a time of 0 to indicate
+        // that they are synthetic events. Some input method editors do this.
+        // In this case too, just return the current timestamp.
+        return TimeStamp::Now();
+    }
+    CurrentX11TimeGetter* getCurrentTime = GetCurrentTimeGetter();
+    MOZ_ASSERT(getCurrentTime,
+               "Null current time getter despite having a window");
+    return TimeConverter().GetTimeStampFromSystemTime(aEventTime,
+                                                      *getCurrentTime);
+}
+
+mozilla::CurrentX11TimeGetter*
+nsWindow::GetCurrentTimeGetter() {
+    MOZ_ASSERT(mGdkWindow, "Expected mGdkWindow to be set");
+    if (MOZ_UNLIKELY(!mCurrentTimeGetter)) {
+        mCurrentTimeGetter = new CurrentX11TimeGetter(mGdkWindow);
+    }
+    return mCurrentTimeGetter;
+}
+
 gboolean
 nsWindow::OnKeyPressEvent(GdkEventKey *aEvent)
 {
@@ -2962,6 +3102,7 @@ nsWindow::OnKeyPressEvent(GdkEventKey *aEvent)
 
         contextMenuEvent.refPoint = LayoutDeviceIntPoint(0, 0);
         contextMenuEvent.time = aEvent->time;
+        contextMenuEvent.timeStamp = GetEventTimeStamp(aEvent->time);
         contextMenuEvent.clickCount = 1;
         KeymapWrapper::InitInputEvent(contextMenuEvent, aEvent->state);
         status = DispatchInputEvent(&contextMenuEvent);
@@ -2982,16 +3123,12 @@ nsWindow::OnKeyPressEvent(GdkEventKey *aEvent)
             textString[2] = 0;
             compositionChangeEvent.mData = textString;
             compositionChangeEvent.time = event.time;
+            compositionChangeEvent.timeStamp = GetEventTimeStamp(aEvent->time);
             DispatchEvent(&compositionChangeEvent, status);
         }
     }
 
-    // If the event was consumed, return.
-    if (status == nsEventStatus_eConsumeNoDefault) {
-        return TRUE;
-    }
-
-    return FALSE;
+    return TRUE;
 }
 
 gboolean
@@ -3007,14 +3144,9 @@ nsWindow::OnKeyReleaseEvent(GdkEventKey *aEvent)
     WidgetKeyboardEvent event(true, eKeyUp, this);
     KeymapWrapper::InitKeyEvent(event, aEvent);
 
-    nsEventStatus status = DispatchInputEvent(&event);
+    (void)DispatchInputEvent(&event);
 
-    // If the event was consumed, return.
-    if (status == nsEventStatus_eConsumeNoDefault) {
-        return TRUE;
-    }
-
-    return FALSE;
+    return TRUE;
 }
 
 void
@@ -3069,25 +3201,12 @@ nsWindow::OnScrollEvent(GdkEventScroll *aEvent)
         break;
     }
 
-    NS_ASSERTION(wheelEvent.deltaX || wheelEvent.deltaY,
-                 "deltaX or deltaY must be non-zero");
-
-    if (aEvent->window == mGdkWindow) {
-        // we are the window that the event happened on so no need for expensive WidgetToScreenOffset
-        wheelEvent.refPoint.x = nscoord(aEvent->x);
-        wheelEvent.refPoint.y = nscoord(aEvent->y);
-    } else {
-        // XXX we're never quite sure which GdkWindow the event came from due to our custom bubbling
-        // in scroll_event_cb(), so use ScreenToWidget to translate the screen root coordinates into
-        // coordinates relative to this widget.
-        LayoutDeviceIntPoint point(NSToIntFloor(aEvent->x_root),
-                                   NSToIntFloor(aEvent->y_root));
-        wheelEvent.refPoint = point - WidgetToScreenOffset();
-    }
+    wheelEvent.refPoint = GetRefPoint(this, aEvent);
 
     KeymapWrapper::InitInputEvent(wheelEvent, aEvent->state);
 
     wheelEvent.time = aEvent->time;
+    wheelEvent.timeStamp = GetEventTimeStamp(aEvent->time);
 
     DispatchAPZAwareEvent(&wheelEvent);
 }
@@ -3232,6 +3351,7 @@ nsWindow::DispatchDragEvent(EventMessage aMsg, const nsIntPoint& aRefPoint,
 
     event.refPoint = LayoutDeviceIntPoint::FromUntyped(aRefPoint);
     event.time = aTime;
+    event.timeStamp = GetEventTimeStamp(aTime);
 
     DispatchInputEvent(&event);
 }
@@ -3253,6 +3373,73 @@ nsWindow::OnDragDataReceivedEvent(GtkWidget *aWidget,
                            aSelectionData, aInfo, aTime);
 }
 
+#if GTK_CHECK_VERSION(3,4,0)
+static PLDHashOperator AppendTouchToEvent(GdkEventSequence* aKey,
+                                          dom::Touch* aData,
+                                          void* aArg)
+{
+  WidgetTouchEvent* event = reinterpret_cast<WidgetTouchEvent*>(aArg);
+  event->touches.AppendElement(new dom::Touch(*aData));
+
+  return PL_DHASH_NEXT;
+}
+
+gboolean
+nsWindow::OnTouchEvent(GdkEventTouch* aEvent)
+{
+    if (!mHandleTouchEvent) {
+        return FALSE;
+    }
+
+    EventMessage msg;
+    switch (aEvent->type) {
+    case GDK_TOUCH_BEGIN:
+        msg = eTouchStart;
+        break;
+    case GDK_TOUCH_UPDATE:
+        msg = eTouchMove;
+        break;
+    case GDK_TOUCH_END:
+        msg = eTouchEnd;
+        break;
+    case GDK_TOUCH_CANCEL:
+        msg = eTouchCancel;
+        break;
+    default:
+        return FALSE;
+    }
+
+    LayoutDeviceIntPoint touchPoint = GetRefPoint(this, aEvent);
+
+    int32_t id;
+    RefPtr<dom::Touch> touch;
+    if (mTouches.Remove(aEvent->sequence, getter_AddRefs(touch))) {
+        id = touch->mIdentifier;
+    } else {
+        id = ++gLastTouchID & 0x7FFFFFFF;
+    }
+
+    touch = new dom::Touch(id, touchPoint, LayoutDeviceIntPoint(1, 1),
+                           0.0f, 0.0f);
+
+    WidgetTouchEvent event(true, msg, this);
+    KeymapWrapper::InitInputEvent(event, aEvent->state);
+    event.time = aEvent->time;
+
+    if (aEvent->type == GDK_TOUCH_BEGIN || aEvent->type == GDK_TOUCH_UPDATE) {
+        mTouches.Put(aEvent->sequence, touch.forget());
+        // add all touch points to event object
+        mTouches.EnumerateRead(AppendTouchToEvent, &event);
+    } else if (aEvent->type == GDK_TOUCH_END ||
+               aEvent->type == GDK_TOUCH_CANCEL) {
+        *event.touches.AppendElement() = touch.forget();
+    }
+
+    DispatchAPZAwareEvent(&event);
+    return TRUE;
+}
+#endif
+
 static void
 GetBrandName(nsXPIDLString& brandName)
 {
@@ -3350,6 +3537,7 @@ nsWindow::Create(nsIWidget        *aParent,
     GtkWindow      *topLevelParent = nullptr;
     nsWindow       *parentnsWindow = nullptr;
     GtkWidget      *eventWidget = nullptr;
+    bool            shellHasCSD = false;
 
     if (aParent) {
         parentnsWindow = static_cast<nsWindow*>(aParent);
@@ -3498,16 +3686,30 @@ nsWindow::Create(nsIWidget        *aParent,
             g_object_unref(group);
         }
 
-        // Prevent GtkWindow from painting a background to flicker.
-        gtk_widget_set_app_paintable(mShell, TRUE);
-
         // Create a container to hold child windows and child GtkWidgets.
         GtkWidget *container = moz_container_new();
         mContainer = MOZ_CONTAINER(container);
-        // Use mShell's window for drawing and events.
-        gtk_widget_set_has_window(container, FALSE);
-        eventWidget = mShell;
+
+#if (MOZ_WIDGET_GTK == 3)
+        // "csd" style is set when widget is realized so we need to call
+        // it explicitly now.
+        gtk_widget_realize(mShell);
+
+        // We can't draw directly to top-level window when client side
+        // decorations are enabled. We use container with GdkWindow instead.
+        GtkStyleContext* style = gtk_widget_get_style_context(mShell);
+        shellHasCSD = gtk_style_context_has_class(style, "csd");
+#endif
+        if (!shellHasCSD) {
+            // Use mShell's window for drawing and events.
+            gtk_widget_set_has_window(container, FALSE);
+            // Prevent GtkWindow from painting a background to flicker.
+            gtk_widget_set_app_paintable(mShell, TRUE);
+        }
+        // Set up event widget
+        eventWidget = shellHasCSD ? container : mShell;
         gtk_widget_add_events(eventWidget, kEvents);
+
         gtk_container_add(GTK_CONTAINER(mShell), container);
         gtk_widget_realize(container);
 
@@ -3516,7 +3718,7 @@ nsWindow::Create(nsIWidget        *aParent,
         gtk_widget_grab_focus(container);
 
         // the drawing window
-        mGdkWindow = gtk_widget_get_window(mShell);
+        mGdkWindow = gtk_widget_get_window(eventWidget);
 
         if (mWindowType == eWindowType_popup) {
             // gdk does not automatically set the cursor for "temporary"
@@ -3531,7 +3733,7 @@ nsWindow::Create(nsIWidget        *aParent,
             if (aInitData->mNoAutoHide) {
                 gint wmd = ConvertBorderStyles(mBorderStyle);
                 if (wmd != -1)
-                  gdk_window_set_decorations(gtk_widget_get_window(mShell), (GdkWMDecoration) wmd);
+                  gdk_window_set_decorations(mGdkWindow, (GdkWMDecoration) wmd);
             }
 
             // If the popup ignores mouse events, set an empty input shape.
@@ -3654,7 +3856,8 @@ nsWindow::Create(nsIWidget        *aParent,
         g_signal_connect(mContainer, "drag_data_received",
                          G_CALLBACK(drag_data_received_event_cb), nullptr);
 
-        GtkWidget *widgets[] = { GTK_WIDGET(mContainer), mShell };
+        GtkWidget *widgets[] = { GTK_WIDGET(mContainer),
+                                 !shellHasCSD ? mShell : nullptr };
         for (size_t i = 0; i < ArrayLength(widgets) && widgets[i]; ++i) {
             // Visibility events are sent to the owning widget of the relevant
             // window but do not propagate to parent widgets so connect on
@@ -3699,8 +3902,14 @@ nsWindow::Create(nsIWidget        *aParent,
                          G_CALLBACK(button_press_event_cb), nullptr);
         g_signal_connect(eventWidget, "button-release-event",
                          G_CALLBACK(button_release_event_cb), nullptr);
+        g_signal_connect(eventWidget, "property-notify-event",
+                         G_CALLBACK(property_notify_event_cb), nullptr);
         g_signal_connect(eventWidget, "scroll-event",
                          G_CALLBACK(scroll_event_cb), nullptr);
+#if GTK_CHECK_VERSION(3,4,0)
+        g_signal_connect(eventWidget, "touch-event",
+                         G_CALLBACK(touch_event_cb), nullptr);
+#endif
     }
 
     LOG(("nsWindow [%p]\n", (void *)this));
@@ -3765,8 +3974,7 @@ nsWindow::SetWindowClass(const nsAString &xulWinType)
   res_name[0] = toupper(res_name[0]);
   if (!role) role = res_name;
 
-  GdkWindow *shellWindow = gtk_widget_get_window(GTK_WIDGET(mShell));
-  gdk_window_set_role(shellWindow, role);
+  gdk_window_set_role(mGdkWindow, role);
 
 #ifdef MOZ_X11
   GdkDisplay *display = gdk_display_get_default();
@@ -3782,7 +3990,7 @@ nsWindow::SetWindowClass(const nsAString &xulWinType)
       // Can't use gtk_window_set_wmclass() for this; it prints
       // a warning & refuses to make the change.
       XSetClassHint(GDK_DISPLAY_XDISPLAY(display),
-                    gdk_x11_window_get_xid(shellWindow),
+                    gdk_x11_window_get_xid(mGdkWindow),
                     class_hint);
       XFree(class_hint);
   }
@@ -4243,9 +4451,8 @@ nsWindow::ApplyTransparencyBitmap()
     // We use X11 calls where possible, because GDK handles expose events
     // for shaped windows in a way that's incompatible with us (Bug 635903).
     // It doesn't occur when the shapes are set through X.
-    GdkWindow *shellWindow = gtk_widget_get_window(mShell);
-    Display* xDisplay = GDK_WINDOW_XDISPLAY(shellWindow);
-    Window xDrawable = GDK_WINDOW_XID(shellWindow);
+    Display* xDisplay = GDK_WINDOW_XDISPLAY(mGdkWindow);
+    Window xDrawable = GDK_WINDOW_XID(mGdkWindow);
     Pixmap maskPixmap = XCreateBitmapFromData(xDisplay,
                                               xDrawable,
                                               mTransparencyBitmap,
@@ -4258,7 +4465,7 @@ nsWindow::ApplyTransparencyBitmap()
 #else
 #if (MOZ_WIDGET_GTK == 2)
     gtk_widget_reset_shapes(mShell);
-    GdkBitmap* maskBitmap = gdk_bitmap_create_from_data(gtk_widget_get_window(mShell),
+    GdkBitmap* maskBitmap = gdk_bitmap_create_from_data(mGdkWindow,
             mTransparencyBitmap,
             mTransparencyBitmapWidth, mTransparencyBitmapHeight);
     if (!maskBitmap)
@@ -4299,12 +4506,11 @@ nsWindow::ClearTransparencyBitmap()
         return;
 
 #ifdef MOZ_X11
-    GdkWindow *window = gtk_widget_get_window(mShell);
-    if (!window)
+    if (!mGdkWindow)
         return;
 
-    Display* xDisplay = GDK_WINDOW_XDISPLAY(window);
-    Window xWindow = gdk_x11_window_get_xid(window);
+    Display* xDisplay = GDK_WINDOW_XDISPLAY(mGdkWindow);
+    Window xWindow = gdk_x11_window_get_xid(mGdkWindow);
 
     XShapeCombineMask(xDisplay, xWindow, ShapeBounding, 0, 0, None, ShapeSet);
 #endif
@@ -4678,9 +4884,8 @@ nsWindow::HideWindowChrome(bool aShouldHide)
     // confused if we change the window decorations while the window
     // is visible.
     bool wasVisible = false;
-    GdkWindow *shellWindow = gtk_widget_get_window(mShell);
-    if (gdk_window_is_visible(shellWindow)) {
-        gdk_window_hide(shellWindow);
+    if (gdk_window_is_visible(mGdkWindow)) {
+        gdk_window_hide(mGdkWindow);
         wasVisible = true;
     }
 
@@ -4691,10 +4896,10 @@ nsWindow::HideWindowChrome(bool aShouldHide)
         wmd = ConvertBorderStyles(mBorderStyle);
 
     if (wmd != -1)
-      gdk_window_set_decorations(shellWindow, (GdkWMDecoration) wmd);
+      gdk_window_set_decorations(mGdkWindow, (GdkWMDecoration) wmd);
 
     if (wasVisible)
-        gdk_window_show(shellWindow);
+        gdk_window_show(mGdkWindow);
 
     // For some window managers, adding or removing window decorations
     // requires unmapping and remapping our toplevel window.  Go ahead
@@ -5515,6 +5720,16 @@ key_release_event_cb(GtkWidget *widget, GdkEventKey *event)
     return focusWindow->OnKeyReleaseEvent(event);
 }
 
+static gboolean
+property_notify_event_cb(GtkWidget* aWidget, GdkEventProperty* aEvent)
+{
+    RefPtr<nsWindow> window = get_window_for_gdk_window(aEvent->window);
+    if (!window)
+        return FALSE;
+
+    return window->OnPropertyNotifyEvent(aWidget, aEvent);
+}
+
 static gboolean
 scroll_event_cb(GtkWidget *widget, GdkEventScroll *event)
 {
@@ -5598,6 +5813,21 @@ theme_changed_cb (GtkSettings *settings, GParamSpec *pspec, nsWindow *data)
     window->ThemeChanged();
 }
 
+#if GTK_CHECK_VERSION(3,4,0)
+static gboolean
+touch_event_cb(GtkWidget* aWidget, GdkEventTouch* aEvent)
+{
+    UpdateLastInputEventTime(aEvent);
+
+    nsWindow* window = GetFirstNSWindowForGDKWindow(aEvent->window);
+    if (!window) {
+        return FALSE;
+    }
+
+    return window->OnTouchEvent(aEvent);
+}
+#endif
+
 //////////////////////////////////////////////////////////////////////
 // These are all of our drag and drop operations
 
@@ -6345,6 +6575,13 @@ nsWindow::GdkCoordToDevicePixels(gint coord) {
     return coord * GdkScaleFactor();
 }
 
+LayoutDeviceIntPoint
+nsWindow::GdkEventCoordsToDevicePixels(gdouble x, gdouble y)
+{
+    gint scale = GdkScaleFactor();
+    return LayoutDeviceIntPoint(floor(x * scale + 0.5), floor(y * scale + 0.5));
+}
+
 LayoutDeviceIntPoint
 nsWindow::GdkPointToDevicePixels(GdkPoint point) {
     gint scale = GdkScaleFactor();
diff --git a/widget/gtk/nsWindow.h b/widget/gtk/nsWindow.h
index 2244fb49a6..5647d699c5 100644
--- a/widget/gtk/nsWindow.h
+++ b/widget/gtk/nsWindow.h
@@ -17,6 +17,7 @@
 #include "nsIDragService.h"
 #include "nsITimer.h"
 #include "nsGkAtoms.h"
+#include "nsRefPtrHashtable.h"
 
 #include "nsBaseWidget.h"
 #include <gdk/gdk.h>
@@ -30,6 +31,7 @@
 #include "mozilla/a11y/Accessible.h"
 #endif
 #include "mozilla/EventForwards.h"
+#include "mozilla/TouchEvents.h"
 
 #include "IMContextWrapper.h"
 
@@ -67,6 +69,11 @@ class nsPluginNativeWindowGtk;
 class nsShmImage;
 #endif
 
+namespace mozilla {
+class TimeStamp;
+class CurrentX11TimeGetter;
+}
+
 class nsWindow : public nsBaseWidget
 {
 public:
@@ -195,6 +202,11 @@ public:
                                                guint            aInfo,
                                                guint            aTime,
                                                gpointer         aData);
+    gboolean           OnPropertyNotifyEvent(GtkWidget *aWidget,
+                                             GdkEventProperty *aEvent);
+#if GTK_CHECK_VERSION(3,4,0)
+    gboolean           OnTouchEvent(GdkEventTouch* aEvent);
+#endif
 
     virtual already_AddRefed<mozilla::gfx::DrawTarget>
                        StartRemoteDrawingInRegion(nsIntRegion& aInvalidRegion) override;
@@ -216,6 +228,8 @@ private:
     void               GrabPointer  (guint32 aTime);
     void               ReleaseGrabs (void);
 
+    void               UpdateClientOffset();
+
 public:
     enum PluginType {
         PluginType_NONE = 0,   /* do not have any plugin */
@@ -258,6 +272,8 @@ public:
     // otherwise, FALSE.
     bool               DispatchKeyDownEvent(GdkEventKey *aEvent,
                                             bool *aIsCancelled);
+    mozilla::TimeStamp GetEventTimeStamp(guint32 aEventTime);
+    mozilla::CurrentX11TimeGetter* GetCurrentTimeGetter();
 
     NS_IMETHOD_(void) SetInputContext(const InputContext& aContext,
                                       const InputContextAction& aAction) override;
@@ -314,6 +330,21 @@ public:
                                                       uint32_t aAdditionalFlags,
                                                       nsIObserver* aObserver) override;
 
+    // HiDPI scale conversion
+    gint GdkScaleFactor();
+
+    // To GDK
+    gint DevicePixelsToGdkCoordRoundUp(int pixels);
+    gint DevicePixelsToGdkCoordRoundDown(int pixels);
+    GdkPoint DevicePixelsToGdkPointRoundDown(nsIntPoint point);
+    GdkRectangle DevicePixelsToGdkSizeRoundUp(nsIntSize pixelSize);
+
+    // From GDK
+    int GdkCoordToDevicePixels(gint coord);
+    mozilla::LayoutDeviceIntPoint GdkPointToDevicePixels(GdkPoint point);
+    mozilla::LayoutDeviceIntPoint GdkEventCoordsToDevicePixels(gdouble x, gdouble y);
+    nsIntRect GdkRectToDevicePixels(GdkRectangle rect);
+
 protected:
     virtual ~nsWindow();
 
@@ -331,6 +362,8 @@ protected:
     virtual nsresult NotifyIMEInternal(
                          const IMENotification& aIMENotification) override;
 
+    virtual void RegisterTouchWindow() override;
+
     nsCOMPtr<nsIWidget> mParent;
     // Is this a toplevel window?
     bool                mIsTopLevel;
@@ -346,6 +379,10 @@ protected:
     bool                mEnabled;
     // has the native window for this been created yet?
     bool                mCreated;
+#if GTK_CHECK_VERSION(3,4,0)
+    // whether we handle touch event
+    bool                mHandleTouchEvent;
+#endif
 
 private:
     void               DestroyChildWindows();
@@ -378,9 +415,14 @@ private:
     int32_t             mTransparencyBitmapWidth;
     int32_t             mTransparencyBitmapHeight;
 
+    nsIntPoint          mClientOffset;
+
 #if GTK_CHECK_VERSION(3,4,0)
     // This field omits duplicate scroll events caused by GNOME bug 726878.
     guint32             mLastScrollEventTime;
+
+    // for touch event handling
+    nsRefPtrHashtable<nsPtrHashKey<GdkEventSequence>, mozilla::dom::Touch> mTouches;
 #endif
 
 #ifdef MOZ_X11
@@ -495,19 +537,7 @@ private:
      */
     RefPtr<mozilla::widget::IMContextWrapper> mIMContext;
 
-    // HiDPI scale conversion
-    gint GdkScaleFactor();
-
-    // To GDK
-    gint DevicePixelsToGdkCoordRoundUp(int pixels);
-    gint DevicePixelsToGdkCoordRoundDown(int pixels);
-    GdkPoint DevicePixelsToGdkPointRoundDown(nsIntPoint point);
-    GdkRectangle DevicePixelsToGdkSizeRoundUp(nsIntSize pixelSize);
-
-    // From GDK
-    int GdkCoordToDevicePixels(gint coord);
-    mozilla::LayoutDeviceIntPoint GdkPointToDevicePixels(GdkPoint point);
-    nsIntRect GdkRectToDevicePixels(GdkRectangle rect);
+    nsAutoPtr<mozilla::CurrentX11TimeGetter> mCurrentTimeGetter;
 };
 
 class nsChildWindow : public nsWindow {
diff --git a/widget/moz.build b/widget/moz.build
index 9fe24d9c25..0b5347f5df 100644
--- a/widget/moz.build
+++ b/widget/moz.build
@@ -25,6 +25,7 @@ if toolkit == 'windows':
         'nsITaskbarProgress.idl',
         'nsITaskbarTabPreview.idl',
         'nsITaskbarWindowPreview.idl',
+        'nsIWindowsUIUtils.idl',
         'nsIWinTaskbar.idl',
     ]
 elif toolkit == 'cocoa':
@@ -144,7 +145,6 @@ UNIFIED_SOURCES += [
     'nsBaseDragService.cpp',
     'nsBaseScreen.cpp',
     'nsClipboardHelper.cpp',
-    'nsClipboardPrivacyHandler.cpp',
     'nsClipboardProxy.cpp',
     'nsColorPickerProxy.cpp',
     'nsContentProcessWidgetFactory.cpp',
diff --git a/widget/nsBaseClipboard.cpp b/widget/nsBaseClipboard.cpp
index 2721029dfd..fd22dab658 100644
--- a/widget/nsBaseClipboard.cpp
+++ b/widget/nsBaseClipboard.cpp
@@ -59,12 +59,6 @@ NS_IMETHODIMP nsBaseClipboard::SetData(nsITransferable * aTransferable, nsIClipb
 
   if ( mTransferable ) {
     NS_ADDREF(mTransferable);
-    if (!mPrivacyHandler) {
-      rv = NS_NewClipboardPrivacyHandler(getter_AddRefs(mPrivacyHandler));
-      NS_ENSURE_SUCCESS(rv, rv);
-    }
-    rv = mPrivacyHandler->PrepareDataForClipboard(mTransferable);
-    NS_ENSURE_SUCCESS(rv, rv);
     rv = SetNativeClipboardData(aWhichClipboard);
   }
   
diff --git a/widget/nsBaseClipboard.h b/widget/nsBaseClipboard.h
index 6d650d97bc..538389ce96 100644
--- a/widget/nsBaseClipboard.h
+++ b/widget/nsBaseClipboard.h
@@ -8,8 +8,6 @@
 
 #include "nsIClipboard.h"
 #include "nsITransferable.h"
-#include "nsClipboardPrivacyHandler.h"
-#include "nsAutoPtr.h"
 
 class nsITransferable;
 class nsIClipboardOwner;
@@ -41,7 +39,6 @@ protected:
   bool                mIgnoreEmptyNotification;
   nsIClipboardOwner * mClipboardOwner;
   nsITransferable   * mTransferable;
-  RefPtr<nsClipboardPrivacyHandler> mPrivacyHandler;
 
 };
 
diff --git a/widget/nsBaseDragService.cpp b/widget/nsBaseDragService.cpp
index 9f88e01ec2..f336f027b5 100644
--- a/widget/nsBaseDragService.cpp
+++ b/widget/nsBaseDragService.cpp
@@ -226,7 +226,15 @@ nsBaseDragService::InvokeDragSession(nsIDOMNode *aDOMNode,
   // are in the wrong coord system, so turn off mouse capture.
   nsIPresShell::ClearMouseCapture(nullptr);
 
-  return NS_OK;
+  nsresult rv = InvokeDragSessionImpl(aTransferableArray,
+                                      aDragRgn, aActionType);
+
+  if (NS_FAILED(rv)) {
+    mSourceNode = nullptr;
+    mSourceDocument = nullptr;
+  }
+
+  return rv;
 }
 
 NS_IMETHODIMP
diff --git a/widget/nsBaseDragService.h b/widget/nsBaseDragService.h
index 8e29d9e664..3ba13da1e5 100644
--- a/widget/nsBaseDragService.h
+++ b/widget/nsBaseDragService.h
@@ -63,6 +63,15 @@ public:
 protected:
   virtual ~nsBaseDragService();
 
+  /**
+   * Called from nsBaseDragService to initiate a platform drag from a source
+   * in this process.  This is expected to ensure that StartDragSession() and
+   * EndDragSession() get called if the platform drag is successfully invoked.
+   */
+  virtual nsresult InvokeDragSessionImpl(nsISupportsArray* aTransferableArray,
+                                         nsIScriptableRegion* aDragRgn,
+                                         uint32_t aActionType) = 0;
+
   /**
    * Draw the drag image, if any, to a surface and return it. The drag image
    * is constructed from mImage if specified, or aDOMNode if mImage is null.
diff --git a/widget/nsBaseWidget.cpp b/widget/nsBaseWidget.cpp
index 75456bc985..b58a0192fe 100644
--- a/widget/nsBaseWidget.cpp
+++ b/widget/nsBaseWidget.cpp
@@ -691,16 +691,16 @@ nsBaseWidget::IsWindowClipRegionEqual(const nsTArray<nsIntRect>& aRects)
 {
   return mClipRects &&
          mClipRectCount == aRects.Length() &&
-         memcmp(mClipRects, aRects.Elements(), sizeof(nsIntRect)*mClipRectCount) == 0;
+         memcmp(mClipRects.get(), aRects.Elements(), sizeof(nsIntRect)*mClipRectCount) == 0;
 }
 
 void
 nsBaseWidget::StoreWindowClipRegion(const nsTArray<nsIntRect>& aRects)
 {
   mClipRectCount = aRects.Length();
-  mClipRects = new nsIntRect[mClipRectCount];
+  mClipRects = MakeUnique<nsIntRect[]>(mClipRectCount);
   if (mClipRects) {
-    memcpy(mClipRects, aRects.Elements(), sizeof(nsIntRect)*mClipRectCount);
+    memcpy(mClipRects.get(), aRects.Elements(), sizeof(nsIntRect)*mClipRectCount);
   }
 }
 
@@ -917,6 +917,14 @@ void nsBaseWidget::ConfigureAPZCTreeManager()
     uint64_t rootLayerTreeId = mCompositorParent->RootLayerTreeId();
     CompositorParent::SetControllerForLayerTree(rootLayerTreeId, controller);
   }
+
+  // When APZ is enabled, we can actually enable raw touch events because we
+  // have code that can deal with them properly. If APZ is not enabled, this
+  // function doesn't get called.
+  if (Preferences::GetInt("dom.w3c_touch_events.enabled", 0) ||
+      Preferences::GetBool("dom.w3c_pointer_events.enabled", false)) {
+    RegisterTouchWindow();
+  }
 }
 
 void nsBaseWidget::ConfigureAPZControllerThread()
diff --git a/widget/nsBaseWidget.h b/widget/nsBaseWidget.h
index 2fc18cae6d..fe2600612e 100644
--- a/widget/nsBaseWidget.h
+++ b/widget/nsBaseWidget.h
@@ -461,6 +461,7 @@ protected:
    * Notify the widget that this window is being used with OMTC.
    */
   virtual void WindowUsesOMTC() {}
+  virtual void RegisterTouchWindow() {}
 
   nsIDocument* GetDocument() const;
 
@@ -496,7 +497,7 @@ protected:
   nsIntRect         mBounds;
   nsIntRect*        mOriginalBounds;
   // When this pointer is null, the widget is not clipped
-  nsAutoArrayPtr<nsIntRect> mClipRects;
+  mozilla::UniquePtr<nsIntRect[]> mClipRects;
   uint32_t          mClipRectCount;
   nsSizeMode        mSizeMode;
   nsPopupLevel      mPopupLevel;
diff --git a/widget/nsClipboardPrivacyHandler.cpp b/widget/nsClipboardPrivacyHandler.cpp
deleted file mode 100644
index 625b587568..0000000000
--- a/widget/nsClipboardPrivacyHandler.cpp
+++ /dev/null
@@ -1,124 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "mozilla/ArrayUtils.h"
-
-#include "nsClipboardPrivacyHandler.h"
-#include "nsITransferable.h"
-#include "nsISupportsPrimitives.h"
-#include "nsIObserverService.h"
-#include "nsIClipboard.h"
-#include "nsComponentManagerUtils.h"
-#include "nsServiceManagerUtils.h"
-#include "nsLiteralString.h"
-#include "nsNetCID.h"
-#include "nsXPCOM.h"
-#include "mozilla/Services.h"
-
-#if defined(XP_WIN)
-#include <ole2.h>
-#endif
-
-using namespace mozilla;
-
-#define NS_MOZ_DATA_FROM_PRIVATEBROWSING "application/x-moz-private-browsing"
-
-NS_IMPL_ISUPPORTS(nsClipboardPrivacyHandler, nsIObserver, nsISupportsWeakReference)
-
-nsresult
-nsClipboardPrivacyHandler::Init()
-{
-  nsCOMPtr<nsIObserverService> observerService =
-    mozilla::services::GetObserverService();
-  if (!observerService)
-    return NS_ERROR_FAILURE;
-  return observerService->AddObserver(this, "last-pb-context-exited", true);
-}
-
-/**
-  * Prepare the transferable object to be inserted into the clipboard
-  *
-  */
-nsresult
-nsClipboardPrivacyHandler::PrepareDataForClipboard(nsITransferable * aTransferable)
-{
-  NS_ASSERTION(aTransferable, "clipboard given a null transferable");
-
-  bool isPrivateData = false;
-  aTransferable->GetIsPrivateData(&isPrivateData);
-
-  nsresult rv = NS_OK;
-  if (isPrivateData) {
-    nsCOMPtr<nsISupportsPRBool> data = do_CreateInstance(NS_SUPPORTS_PRBOOL_CONTRACTID);
-    if (data) {
-      rv = data->SetData(true);
-      NS_ENSURE_SUCCESS(rv, rv);
-
-      // Ignore the error code of AddDataFlavor, since we might have added
-      // this flavor before.  If this call really fails, so will the next
-      // one (SetTransferData).
-      aTransferable->AddDataFlavor(NS_MOZ_DATA_FROM_PRIVATEBROWSING);
-
-      rv = aTransferable->SetTransferData(NS_MOZ_DATA_FROM_PRIVATEBROWSING, data, sizeof(bool));
-      NS_ENSURE_SUCCESS(rv, rv);
-    }
-  }
-
-  return rv;
-}
-
-NS_IMETHODIMP
-nsClipboardPrivacyHandler::Observe(nsISupports *aSubject, char const *aTopic, char16_t const *aData)
-{
-  nsresult rv;
-  nsCOMPtr<nsIClipboard> clipboard =
-    do_GetService("@mozilla.org/widget/clipboard;1", &rv);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  const char * flavors[] = { NS_MOZ_DATA_FROM_PRIVATEBROWSING };
-  bool haveFlavors;
-  rv = clipboard->HasDataMatchingFlavors(flavors,
-                                         ArrayLength(flavors),
-                                         nsIClipboard::kGlobalClipboard,
-                                         &haveFlavors);
-  if (NS_SUCCEEDED(rv) && haveFlavors) {
-#if defined(XP_WIN)
-    // Workaround for bug 518412.  On Windows 7 x64, there is a bug
-    // in handling clipboard data without any formats between
-    // 32-bit/64-bit boundaries, which could lead Explorer to crash.
-    // We work around the problem by clearing the clipboard using
-    // the usual Win32 API.
-    NS_ENSURE_TRUE(SUCCEEDED(::OleSetClipboard(nullptr)), NS_ERROR_FAILURE);
-#else
-    // Empty the native clipboard by copying an empty transferable
-    nsCOMPtr<nsITransferable> nullData =
-      do_CreateInstance("@mozilla.org/widget/transferable;1", &rv);
-    NS_ENSURE_SUCCESS(rv, rv);
-    nullData->Init(nullptr);
-    rv = clipboard->SetData(nullData, nullptr,
-                            nsIClipboard::kGlobalClipboard);
-    NS_ENSURE_SUCCESS(rv, rv);
-#endif
-  }
-
-  return NS_OK;
-}
-
-nsresult
-NS_NewClipboardPrivacyHandler(nsClipboardPrivacyHandler ** aHandler)
-{
-  NS_PRECONDITION(aHandler != nullptr, "null ptr");
-  if (!aHandler)
-    return NS_ERROR_NULL_POINTER;
-
-  *aHandler = new nsClipboardPrivacyHandler();
-
-  NS_ADDREF(*aHandler);
-  nsresult rv = (*aHandler)->Init();
-  if (NS_FAILED(rv))
-    NS_RELEASE(*aHandler);
-
-  return rv;
-}
diff --git a/widget/nsClipboardPrivacyHandler.h b/widget/nsClipboardPrivacyHandler.h
deleted file mode 100644
index 2e356e6f83..0000000000
--- a/widget/nsClipboardPrivacyHandler.h
+++ /dev/null
@@ -1,42 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef nsClipboardPrivacyHandler_h__
-#define nsClipboardPrivacyHandler_h__
-
-#include "nsIObserver.h"
-#include "nsWeakReference.h"
-#include "nsCOMPtr.h"
-#include "mozilla/Attributes.h"
-
-class nsITransferable;
-
-// nsClipboardPrivacyHandler makes sure that clipboard data copied during
-// the private browsing mode does not leak after exiting this mode.
-// In order to ensure this, callers should store an object of this class
-// for their lifetime, and call PrepareDataForClipboard in their
-// nsIClipboard::SetData implementation before starting to use the
-// nsITransferable object in any way.
-
-class nsClipboardPrivacyHandler final : public nsIObserver,
-                                        public nsSupportsWeakReference
-{
-  ~nsClipboardPrivacyHandler() {}
-
-public:
-
-  // nsISupports
-  NS_DECL_ISUPPORTS
-
-  // nsIObserver  
-  NS_DECL_NSIOBSERVER
-
-  nsresult Init();
-  nsresult PrepareDataForClipboard(nsITransferable * aTransferable);
-};
-
-nsresult NS_NewClipboardPrivacyHandler(nsClipboardPrivacyHandler ** aHandler);
-
-#endif // nsClipboardPrivacyHandler_h__
diff --git a/widget/nsDragServiceProxy.cpp b/widget/nsDragServiceProxy.cpp
index 7f0bb0e0a0..294a3913d5 100644
--- a/widget/nsDragServiceProxy.cpp
+++ b/widget/nsDragServiceProxy.cpp
@@ -23,21 +23,12 @@ nsDragServiceProxy::~nsDragServiceProxy()
 {
 }
 
-NS_IMETHODIMP
-nsDragServiceProxy::InvokeDragSession(nsIDOMNode* aDOMNode,
-                                      nsISupportsArray* aArrayTransferables,
-                                      nsIScriptableRegion* aRegion,
-                                      uint32_t aActionType)
+nsresult
+nsDragServiceProxy::InvokeDragSessionImpl(nsISupportsArray* aArrayTransferables,
+                                          nsIScriptableRegion* aRegion,
+                                          uint32_t aActionType)
 {
-  nsresult rv = nsBaseDragService::InvokeDragSession(aDOMNode,
-                                                     aArrayTransferables,
-                                                     aRegion,
-                                                     aActionType);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  nsCOMPtr<nsIDOMDocument> sourceDocument;
-  aDOMNode->GetOwnerDocument(getter_AddRefs(sourceDocument));
-  nsCOMPtr<nsIDocument> doc = do_QueryInterface(sourceDocument);
+  nsCOMPtr<nsIDocument> doc = do_QueryInterface(mSourceDocument);
   NS_ENSURE_STATE(doc->GetDocShell());
   mozilla::dom::TabChild* child =
     mozilla::dom::TabChild::GetFrom(doc->GetDocShell());
diff --git a/widget/nsDragServiceProxy.h b/widget/nsDragServiceProxy.h
index 8fe35aa0fc..bbfaade14d 100644
--- a/widget/nsDragServiceProxy.h
+++ b/widget/nsDragServiceProxy.h
@@ -15,11 +15,10 @@ public:
 
   NS_DECL_ISUPPORTS_INHERITED
 
-  // nsIDragService
-  NS_IMETHOD InvokeDragSession(nsIDOMNode* aDOMNode,
-                               nsISupportsArray* anArrayTransferables,
-                               nsIScriptableRegion* aRegion,
-                               uint32_t aActionType) override;
+  // nsBaseDragService
+  virtual nsresult InvokeDragSessionImpl(nsISupportsArray* anArrayTransferables,
+                                         nsIScriptableRegion* aRegion,
+                                         uint32_t aActionType) override;
 private:
   virtual ~nsDragServiceProxy();
 };
diff --git a/widget/nsGUIEventIPC.h b/widget/nsGUIEventIPC.h
index 2a694dbb94..bc8767bb90 100644
--- a/widget/nsGUIEventIPC.h
+++ b/widget/nsGUIEventIPC.h
@@ -323,7 +323,7 @@ struct ParamTraits<mozilla::WidgetTouchEvent>
     for (uint32_t i = 0; i < numTouches; ++i) {
         int32_t identifier;
         mozilla::LayoutDeviceIntPoint refPoint;
-        nsIntPoint radius;
+        mozilla::LayoutDeviceIntPoint radius;
         float rotationAngle;
         float force;
         if (!ReadParam(aMsg, aIter, &identifier) ||
diff --git a/widget/nsIWidget.h b/widget/nsIWidget.h
index a2c4df756e..a66d9165bb 100644
--- a/widget/nsIWidget.h
+++ b/widget/nsIWidget.h
@@ -17,6 +17,7 @@
 #include "nsTArray.h"
 #include "nsITheme.h"
 #include "nsITimer.h"
+#include "nsRegionFwd.h"
 #include "nsXULAppAPI.h"
 #include "mozilla/Maybe.h"
 #include "mozilla/EventForwards.h"
@@ -36,7 +37,6 @@ class   nsIRollupListener;
 class   imgIContainer;
 class   nsIContent;
 class   ViewWrapper;
-class   nsIntRegion;
 class   nsIScreen;
 
 namespace mozilla {
diff --git a/widget/nsIWidgetListener.h b/widget/nsIWidgetListener.h
index 2be2714593..76b87073f0 100644
--- a/widget/nsIWidgetListener.h
+++ b/widget/nsIWidgetListener.h
@@ -10,8 +10,9 @@
 #include "mozilla/EventForwards.h"
 #include "mozilla/TimeStamp.h"
 
+#include "nsRegionFwd.h"
+
 class nsView;
-class nsIntRegion;
 class nsIPresShell;
 class nsIWidget;
 class nsIXULWindow;
diff --git a/widget/nsIWindowsUIUtils.idl b/widget/nsIWindowsUIUtils.idl
new file mode 100644
index 0000000000..331562a672
--- /dev/null
+++ b/widget/nsIWindowsUIUtils.idl
@@ -0,0 +1,24 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+
+[scriptable, uuid(aa8a0ecf-96a1-418c-b80e-f24ae18bbedc)]
+interface nsIWindowsUIUtils : nsISupports
+{
+  /**
+   * Whether the OS is currently in tablet mode. Always false on
+   * non-Windows and on versions of Windows before win10
+   */
+  readonly attribute boolean inTabletMode;
+
+  /**
+   * Update the tablet mode state
+   */
+  void updateTabletModeState();
+};
+
diff --git a/widget/nsPrimitiveHelpers.cpp b/widget/nsPrimitiveHelpers.cpp
index 8325d66160..71c88ca37e 100644
--- a/widget/nsPrimitiveHelpers.cpp
+++ b/widget/nsPrimitiveHelpers.cpp
@@ -29,17 +29,6 @@
 #include "nsLinebreakConverter.h"
 #include "nsReadableUtils.h"
 
-#include "nsIServiceManager.h"
-// unicode conversion
-#include "nsIPlatformCharset.h"
-#include "nsIUnicodeDecoder.h"
-#include "nsISaveAsCharset.h"
-#include "nsAutoPtr.h"
-#include "mozilla/Likely.h"
-#include "mozilla/dom/EncodingUtils.h"
-
-using mozilla::dom::EncodingUtils;
-
 
 //
 // CreatePrimitiveForData
@@ -70,11 +59,11 @@ nsPrimitiveHelpers :: CreatePrimitiveForData ( const char* aFlavor, const void*
         do_CreateInstance(NS_SUPPORTS_STRING_CONTRACTID);
     if (primitive ) {
       if (aDataLen % 2) {
-        nsAutoArrayPtr<char> buffer(new char[aDataLen + 1]);
+        auto buffer = MakeUnique<char[]>(aDataLen + 1);
         if (!MOZ_LIKELY(buffer))
           return;
 
-        memcpy(buffer, aDataBuff, aDataLen);
+        memcpy(buffer.get(), aDataBuff, aDataLen);
         buffer[aDataLen] = 0;
         const char16_t* start = reinterpret_cast<const char16_t*>(buffer.get());
         // recall that length takes length as characters, not bytes
@@ -127,106 +116,6 @@ nsPrimitiveHelpers :: CreateDataFromPrimitive ( const char* aFlavor, nsISupports
 }
 
 
-//
-// ConvertUnicodeToPlatformPlainText
-//
-// Given a unicode buffer (flavor text/unicode), this converts it to plain text using
-// the appropriate platform charset encoding. |inUnicodeLen| is the length of the input
-// string, not the # of bytes in the buffer. The |outPlainTextData| is null terminated,
-// but its length parameter, |outPlainTextLen|, does not reflect that.
-//
-nsresult
-nsPrimitiveHelpers :: ConvertUnicodeToPlatformPlainText ( char16_t* inUnicode, int32_t inUnicodeLen,
-                                                            char** outPlainTextData, int32_t* outPlainTextLen )
-{
-  if ( !outPlainTextData || !outPlainTextLen )
-    return NS_ERROR_INVALID_ARG;
-
-  // get the charset
-  nsresult rv;
-  nsCOMPtr <nsIPlatformCharset> platformCharsetService = do_GetService(NS_PLATFORMCHARSET_CONTRACTID, &rv);
-
-  nsAutoCString platformCharset;
-  if (NS_SUCCEEDED(rv))
-    rv = platformCharsetService->GetCharset(kPlatformCharsetSel_PlainTextInClipboard, platformCharset);
-  if (NS_FAILED(rv))
-    platformCharset.AssignLiteral("ISO-8859-1");
-
-  // use transliterate to convert things like smart quotes to normal quotes for plain text
-
-  nsCOMPtr<nsISaveAsCharset> converter = do_CreateInstance("@mozilla.org/intl/saveascharset;1", &rv);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  rv = converter->Init(platformCharset.get(),
-                  nsISaveAsCharset::attr_EntityAfterCharsetConv +
-                  nsISaveAsCharset::attr_FallbackQuestionMark,
-                  0);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  rv = converter->Convert(inUnicode, outPlainTextData);
-  *outPlainTextLen = *outPlainTextData ? strlen(*outPlainTextData) : 0;
-
-  NS_ASSERTION ( NS_SUCCEEDED(rv), "Error converting unicode to plain text" );
-
-  return rv;
-} // ConvertUnicodeToPlatformPlainText
-
-
-//
-// ConvertPlatformPlainTextToUnicode
-//
-// Given a char buffer (flavor text/plaikn), this converts it to unicode using
-// the appropriate platform charset encoding. |outUnicode| is null terminated,
-// but its length parameter, |outUnicodeLen|, does not reflect that. |outUnicodeLen| is
-// the length of the string in characters, not bytes.
-//
-nsresult
-nsPrimitiveHelpers :: ConvertPlatformPlainTextToUnicode ( const char* inText, int32_t inTextLen,
-                                                            char16_t** outUnicode, int32_t* outUnicodeLen )
-{
-  if ( !outUnicode || !outUnicodeLen )
-    return NS_ERROR_INVALID_ARG;
-
-  // Get the appropriate unicode decoder. We're guaranteed that this won't change
-  // through the life of the app so we can cache it.
-  nsresult rv = NS_OK;
-  static nsCOMPtr<nsIUnicodeDecoder> decoder;
-  static bool hasConverter = false;
-  if ( !hasConverter ) {
-    // get the charset
-    nsAutoCString platformCharset;
-    nsCOMPtr <nsIPlatformCharset> platformCharsetService = do_GetService(NS_PLATFORMCHARSET_CONTRACTID, &rv);
-    if (NS_SUCCEEDED(rv))
-      rv = platformCharsetService->GetCharset(kPlatformCharsetSel_PlainTextInClipboard, platformCharset);
-    if (NS_FAILED(rv))
-      platformCharset.AssignLiteral("windows-1252");
-
-    decoder = EncodingUtils::DecoderForEncoding(platformCharset);
-
-    hasConverter = true;
-  }
-
-  // Estimate out length and allocate the buffer based on a worst-case estimate, then do
-  // the conversion.
-  rv = decoder->GetMaxLength(inText, inTextLen, outUnicodeLen);   // |outUnicodeLen| is number of chars
-  if (NS_WARN_IF(NS_FAILED(rv))) {
-    return rv;
-  }
-
-  if ( *outUnicodeLen ) {
-    *outUnicode = reinterpret_cast<char16_t*>(moz_xmalloc((*outUnicodeLen + 1) * sizeof(char16_t)));
-    if ( *outUnicode ) {
-      rv = decoder->Convert(inText, &inTextLen, *outUnicode, outUnicodeLen);
-      (*outUnicode)[*outUnicodeLen] = '\0';                   // null terminate. Convert() doesn't do it for us
-    }
-  } // if valid length
-
-  NS_ASSERTION ( NS_SUCCEEDED(rv), "Error converting plain text to unicode" );
-
-  return rv;
-} // ConvertPlatformPlainTextToUnicode
-
-
 //
 // ConvertPlatformToDOMLinebreaks
 //
diff --git a/widget/nsPrimitiveHelpers.h b/widget/nsPrimitiveHelpers.h
index 0d492cb7c1..d6a9dae531 100644
--- a/widget/nsPrimitiveHelpers.h
+++ b/widget/nsPrimitiveHelpers.h
@@ -29,20 +29,6 @@ public:
   static void CreateDataFromPrimitive ( const char* aFlavor, nsISupports* aPrimitive, 
                                          void** aDataBuff, uint32_t aDataLen ) ;
 
-    // Given a unicode buffer (flavor text/unicode), this converts it to plain text using
-    // the appropriate platform charset encoding. |inUnicodeLen| is the length of the input
-    // string, not the # of bytes in the buffer. |outPlainTextData| is null terminated, 
-    // but its length parameter, |outPlainTextLen|, does not reflect that.
-  static nsresult ConvertUnicodeToPlatformPlainText ( char16_t* inUnicode, int32_t inUnicodeLen, 
-                                                    char** outPlainTextData, int32_t* outPlainTextLen ) ;
-
-    // Given a char buffer (flavor text/plaikn), this converts it to unicode using
-    // the appropriate platform charset encoding. |outUnicode| is null terminated, 
-    // but its length parameter, |outUnicodeLen|, does not reflect that. |outUnicodeLen| is
-    // the length of the string in characters, not bytes.
-  static nsresult ConvertPlatformPlainTextToUnicode ( const char* inText, int32_t inTextLen, 
-                                                    char16_t** outUnicode, int32_t* outUnicodeLen ) ;
-
 }; // class nsPrimitiveHelpers
 
 
diff --git a/widget/nsShmImage.cpp b/widget/nsShmImage.cpp
index 9bf4f941a5..88571fda82 100644
--- a/widget/nsShmImage.cpp
+++ b/widget/nsShmImage.cpp
@@ -112,7 +112,7 @@ nsShmImage::Create(const IntSize& aSize,
         }
         goto unsupported;
     case 16:
-        shm->mFormat = SurfaceFormat::R5G6B5;
+        shm->mFormat = SurfaceFormat::R5G6B5_UINT16;
         break;
     unsupported:
     default:
diff --git a/widget/nsTransferable.cpp b/widget/nsTransferable.cpp
index 9cd116f24e..ede993b855 100644
--- a/widget/nsTransferable.cpp
+++ b/widget/nsTransferable.cpp
@@ -183,7 +183,7 @@ DataStruct::ReadCache(nsISupports** aData, uint32_t* aDataLen)
 
     uint32_t size = uint32_t(fileSize);
     // create new memory for the large clipboard data
-    nsAutoArrayPtr<char> data(new char[size]);
+    auto data = MakeUnique<char[]>(size);
     if ( !data )
       return NS_ERROR_OUT_OF_MEMORY;
       
@@ -194,11 +194,12 @@ DataStruct::ReadCache(nsISupports** aData, uint32_t* aDataLen)
     
     if (!cacheFile) return NS_ERROR_FAILURE;
 
-    nsresult rv = inStr->Read(data, fileSize, aDataLen);
+    nsresult rv = inStr->Read(data.get(), fileSize, aDataLen);
 
     // make sure we got all the data ok
     if (NS_SUCCEEDED(rv) && *aDataLen == size) {
-      nsPrimitiveHelpers::CreatePrimitiveForData ( mFlavor.get(), data, fileSize, aData );
+      nsPrimitiveHelpers::CreatePrimitiveForData(mFlavor.get(), data.get(),
+                                                 fileSize, aData);
       return *aData ? NS_OK : NS_ERROR_FAILURE;
     }
 
diff --git a/widget/nsWidgetsCID.h b/widget/nsWidgetsCID.h
index afafe93f24..a428cdee28 100644
--- a/widget/nsWidgetsCID.h
+++ b/widget/nsWidgetsCID.h
@@ -185,3 +185,7 @@
 #define NS_IMEPICKER_CID \
 { 0x8e5c35ef, 0xb65b, 0x47aa, \
 { 0xbb, 0x90, 0x5b, 0x89, 0x6d, 0x88, 0x24, 0x18 } }
+
+#define NS_WINDOWS_UIUTILS_CID \
+{ 0xe04a55e8, 0xfee3, 0x4ea2, \
+  { 0xa9, 0x8b, 0x41, 0xd2, 0x62, 0x1a, 0xdc, 0x3c } }
diff --git a/widget/nsXPLookAndFeel.cpp b/widget/nsXPLookAndFeel.cpp
index d4069aee52..4d42be3bca 100644
--- a/widget/nsXPLookAndFeel.cpp
+++ b/widget/nsXPLookAndFeel.cpp
@@ -11,6 +11,7 @@
 #include "nsLookAndFeel.h"
 #include "nsCRT.h"
 #include "nsFont.h"
+#include "mozilla/dom/ContentChild.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/gfx/2D.h"
 #include "mozilla/widget/WidgetMessageUtils.h"
diff --git a/widget/qt/nsClipboard.cpp b/widget/qt/nsClipboard.cpp
index b45b98ac57..797524fef5 100644
--- a/widget/qt/nsClipboard.cpp
+++ b/widget/qt/nsClipboard.cpp
@@ -62,7 +62,7 @@ _moz2dformat_to_qformat(SurfaceFormat aFormat)
         return QImage::Format_ARGB32_Premultiplied;
     case SurfaceFormat::B8G8R8X8:
         return QImage::Format_ARGB32;
-    case SurfaceFormat::R5G6B5:
+    case SurfaceFormat::R5G6B5_UINT16:
         return QImage::Format_RGB16;
     default:
         return QImage::Format_Invalid;
@@ -468,14 +468,6 @@ nsClipboard::SetData(nsITransferable *aTransferable,
         return NS_OK;
     }
 
-    nsresult rv;
-    if (!mPrivacyHandler) {
-      rv = NS_NewClipboardPrivacyHandler(getter_AddRefs(mPrivacyHandler));
-      NS_ENSURE_SUCCESS(rv, rv);
-    }
-    rv = mPrivacyHandler->PrepareDataForClipboard(aTransferable);
-    NS_ENSURE_SUCCESS(rv, rv);
-
     EmptyClipboard(aWhichClipboard);
 
     QClipboard::Mode mode;
diff --git a/widget/qt/nsClipboard.h b/widget/qt/nsClipboard.h
index dee611591c..d348c4b551 100644
--- a/widget/qt/nsClipboard.h
+++ b/widget/qt/nsClipboard.h
@@ -8,8 +8,6 @@
 #include "nsIClipboard.h"
 #include "nsITransferable.h"
 #include "nsIClipboardOwner.h"
-#include "nsClipboardPrivacyHandler.h"
-#include "nsAutoPtr.h"
 #include "nsCOMPtr.h"
 
 #include <qclipboard.h>
diff --git a/widget/tests/chrome.ini b/widget/tests/chrome.ini
index afd5187f12..fe8cb722ae 100644
--- a/widget/tests/chrome.ini
+++ b/widget/tests/chrome.ini
@@ -11,7 +11,6 @@ support-files = window_bug429954.xul
 [test_bug478536.xul]
 skip-if = true # Bug 561929
 support-files = window_bug478536.xul
-[test_bug462106_perwindow.xul]
 [test_bug517396.xul]
 [test_bug538242.xul]
 support-files = window_bug538242.xul
diff --git a/widget/tests/test_bug462106_perwindow.xul b/widget/tests/test_bug462106_perwindow.xul
deleted file mode 100644
index 07d1c581f4..0000000000
--- a/widget/tests/test_bug462106_perwindow.xul
+++ /dev/null
@@ -1,136 +0,0 @@
-<?xml version="1.0"?>
-<?xml-stylesheet type="text/css" href="chrome://global/skin"?>
-<?xml-stylesheet type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"?>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=462106
--->
-<window title="Mozilla Bug 462106"
-        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
-        onload="initAndRunTests()">
-  <script type="application/javascript"
-          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
-
-  <!-- test results are displayed in the html:body -->
-  <body xmlns="http://www.w3.org/1999/xhtml">
-    <p id="display"></p>
-    <div id="content" style="display: none"></div>
-    <pre id="test"></pre>
-  </body>
-
-  <!-- test code goes here -->
-  <script class="testbody" type="application/javascript">
-  <![CDATA[
-
-  /** Test for Bug 462106 **/
-
-const Cc = Components.classes;
-const Ci = Components.interfaces;
-const Cu = Components.utils;
-Cu.import("resource://gre/modules/Services.jsm");
-
-function copy(str, doc) {
-  if (!doc) {
-    doc = document;
-  }
-  Cc["@mozilla.org/widget/clipboardhelper;1"].
-  getService(Ci.nsIClipboardHelper).
-  copyString(str, doc);
-}
-
-function getLoadContext() {
-  return window.QueryInterface(Ci.nsIInterfaceRequestor)
-               .getInterface(Ci.nsIWebNavigation)
-               .QueryInterface(Ci.nsILoadContext);
-}
-
-function paste() {
-  let trans = Cc["@mozilla.org/widget/transferable;1"].
-              createInstance(Ci.nsITransferable);
-  trans.init(getLoadContext());
-  trans.addDataFlavor("text/unicode");
-  let clip = Cc["@mozilla.org/widget/clipboard;1"].
-             getService(Ci.nsIClipboard);
-  clip.getData(trans, Ci.nsIClipboard.kGlobalClipboard);
-  let str = {}, length = {};
-  try {
-    trans.getTransferData("text/unicode", str, length);
-  } catch (e) {
-    str = null;
-  }
-  if (str) {
-    str = str.value.QueryInterface(Ci.nsISupportsString);
-    if (str)
-      str = str.data.substring(0, length.value / 2);
-  }
-  return str;
-}
-
-function whenDelayedStartupFinished(aWindow, aCallback) {
-  Services.obs.addObserver(function observer(aSubject, aTopic) {
-    if (aWindow == aSubject) {
-      Services.obs.removeObserver(observer, aTopic);
-      setTimeout(aCallback, 0);
-    }
-  }, "browser-delayed-startup-finished", false);
-}
-
-function testOnWindow(options, callback) {
-  var mainWindow = window.QueryInterface(Ci.nsIInterfaceRequestor)
-                         .getInterface(Ci.nsIWebNavigation)
-                         .QueryInterface(Ci.nsIDocShellTreeItem)
-                         .rootTreeItem
-                         .QueryInterface(Ci.nsIInterfaceRequestor)
-                         .getInterface(Ci.nsIDOMWindow);
-
-  let win = mainWindow.OpenBrowserWindow(options);
-  whenDelayedStartupFinished(win, function() {
-    callback(win);
-  });
-};
-
-function initAndRunTests() {
-  SimpleTest.waitForExplicitFinish();
-
-  const data = "random number: " + Math.random();
-  copy(data);
-  is(data, paste(), "Data successfully copied before entering the private browsing mode");
-  testOnWindow({private: true}, function (aPrivateWindow) {
-    aPrivateWindow.close();
-
-    // the data should still be on the clipboard because it was copied before
-    // entering the private browsing mode
-    is(data, paste(), "Copied data persisted after leaving the private browsing mode");
-
-    const data2 = "another random number: " + Math.random();
-
-    testOnWindow({private: true}, function (aPrivateWindow) {
-      copy(data2, aPrivateWindow.document); // copy the data inside the private browsing mode
-
-      function insidePBPaste() {
-        if (data2 != paste()) {
-          setTimeout(insidePBPaste, 100);
-          return;
-        }
-        // the data should be on the clipboard inside the private browsing mode
-        is(data2, paste(), "Data successfully copied inside the private browsing mode");
-        aPrivateWindow.close();
-
-        function afterClose() {
-          if (data2 == paste()) {
-            setTimeout(afterClose, 100);
-            return;
-          }
-          // the data should no longer be on the clipboard at this stage
-          isnot(data2, paste(), "Data no longer available after leaving the private browsing mode");
-          SimpleTest.finish();
-        }
-        afterClose();
-      }
-      insidePBPaste();
-    });
-  });
-}
-
-  ]]>
-  </script>
-</window>
diff --git a/widget/uikit/nsWindow.mm b/widget/uikit/nsWindow.mm
index 1b64a4f30a..3bb0407b70 100644
--- a/widget/uikit/nsWindow.mm
+++ b/widget/uikit/nsWindow.mm
@@ -173,6 +173,7 @@ private:
     event.touches.SetCapacity(aTouches.count);
     for (UITouch* touch in aTouches) {
         LayoutDeviceIntPoint loc = UIKitPointsToDevPixels([touch locationInView:self], [self contentScaleFactor]);
+        LayoutDeviceIntPoint radius = UIKitPointsToDevPixels([touch majorRadius], [touch majorRadius]);
         void* value;
         if (!CFDictionaryGetValueIfPresent(mTouches, touch, (const void**)&value)) {
             // This shouldn't happen.
@@ -180,11 +181,7 @@ private:
             continue;
         }
         int id = reinterpret_cast<int>(value);
-        RefPtr<Touch> t = new Touch(id,
-                                      loc,
-                                      nsIntPoint([touch majorRadius], [touch majorRadius]),
-                                      0.0f,
-                                      1.0f);
+        RefPtr<Touch> t = new Touch(id, loc, radius, 0.0f, 1.0f);
         event.refPoint = loc;
         event.touches.AppendElement(t);
     }
diff --git a/widget/windows/LSPAnnotator.cpp b/widget/windows/LSPAnnotator.cpp
new file mode 100644
index 0000000000..f440e798f3
--- /dev/null
+++ b/widget/windows/LSPAnnotator.cpp
@@ -0,0 +1,161 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/**
+ * LSPs are evil little bits of code that are allowed to inject into our
+ * networking stack by Windows.  Once they have wormed into our process
+ * they gnaw at our innards until we crash.  Here we force the buggers
+ * into the light by recording them in our crash information.
+ * We do the enumeration on a thread because I'm concerned about startup perf
+ * on machines with several LSPs.
+ */
+
+#if _WIN32_WINNT < 0x0600
+// Redefining _WIN32_WINNT for some Vista APIs that we call
+#undef _WIN32_WINNT
+#define _WIN32_WINNT 0x0600
+#endif
+#include "nsICrashReporter.h"
+#include "nsISupportsImpl.h"
+#include "nsServiceManagerUtils.h"
+#include "nsThreadUtils.h"
+#include "nsQueryObject.h"
+#include "nsWindowsHelpers.h"
+#include <windows.h>
+#include <rpc.h>
+#include <ws2spi.h>
+
+namespace mozilla {
+namespace crashreporter {
+
+class LSPAnnotationGatherer : public nsRunnable
+{
+  ~LSPAnnotationGatherer() {}
+
+public:
+  NS_DECL_THREADSAFE_ISUPPORTS
+  NS_DECL_NSIRUNNABLE
+
+  void Annotate();
+  nsCString mString;
+  nsCOMPtr<nsIThread> mThread;
+};
+
+NS_IMPL_ISUPPORTS(LSPAnnotationGatherer, nsIRunnable)
+
+void
+LSPAnnotationGatherer::Annotate()
+{
+  nsCOMPtr<nsICrashReporter> cr =
+    do_GetService("@mozilla.org/toolkit/crash-reporter;1");
+  bool enabled;
+  if (cr && NS_SUCCEEDED(cr->GetEnabled(&enabled)) && enabled) {
+    cr->AnnotateCrashReport(NS_LITERAL_CSTRING("Winsock_LSP"), mString);
+  }
+  mThread->AsyncShutdown();
+}
+
+NS_IMETHODIMP
+LSPAnnotationGatherer::Run()
+{
+  PR_SetCurrentThreadName("LSP Annotator");
+
+  mThread = NS_GetCurrentThread();
+
+  DWORD size = 0;
+  int err;
+  // Get the size of the buffer we need
+  if (SOCKET_ERROR != WSCEnumProtocols(nullptr, nullptr, &size, &err) ||
+      err != WSAENOBUFS) {
+    // Er, what?
+    NS_NOTREACHED("WSCEnumProtocols suceeded when it should have failed ...");
+    return NS_ERROR_FAILURE;
+  }
+
+  auto byteArray = MakeUnique<char[]>(size);
+  WSAPROTOCOL_INFOW* providers =
+    reinterpret_cast<WSAPROTOCOL_INFOW*>(byteArray.get());
+
+  int n = WSCEnumProtocols(nullptr, providers, &size, &err);
+  if (n == SOCKET_ERROR) {
+    // Lame. We provided the right size buffer; we'll just give up now.
+    NS_WARNING("Could not get LSP list");
+    return NS_ERROR_FAILURE;
+  }
+
+  nsCString str;
+  for (int i = 0; i < n; i++) {
+    AppendUTF16toUTF8(nsDependentString(providers[i].szProtocol), str);
+    str.AppendLiteral(" : ");
+    str.AppendInt(providers[i].iVersion);
+    str.AppendLiteral(" : ");
+    str.AppendInt(providers[i].iAddressFamily);
+    str.AppendLiteral(" : ");
+    str.AppendInt(providers[i].iSocketType);
+    str.AppendLiteral(" : ");
+    str.AppendInt(providers[i].iProtocol);
+    str.AppendLiteral(" : ");
+    str.AppendPrintf("0x%x", providers[i].dwServiceFlags1);
+    str.AppendLiteral(" : ");
+    str.AppendPrintf("0x%x", providers[i].dwProviderFlags);
+    str.AppendLiteral(" : ");
+
+    wchar_t path[MAX_PATH];
+    int pathLen = MAX_PATH;
+    if (!WSCGetProviderPath(&providers[i].ProviderId, path, &pathLen, &err)) {
+      AppendUTF16toUTF8(nsDependentString(path), str);
+    }
+
+    str.AppendLiteral(" : ");
+    // If WSCGetProviderInfo is available, we should call it to obtain the
+    // category flags for this provider. When present, these flags inform
+    // Windows as to which order to chain the providers.
+    nsModuleHandle ws2_32(LoadLibraryW(L"ws2_32.dll"));
+    if (ws2_32) {
+      decltype(WSCGetProviderInfo)* pWSCGetProviderInfo =
+        reinterpret_cast<decltype(WSCGetProviderInfo)*>(
+            GetProcAddress(ws2_32, "WSCGetProviderInfo"));
+      if (pWSCGetProviderInfo) {
+        DWORD categoryInfo;
+        size_t categoryInfoSize = sizeof(categoryInfo);
+        if (!pWSCGetProviderInfo(&providers[i].ProviderId,
+                                 ProviderInfoLspCategories,
+                                 (PBYTE)&categoryInfo, &categoryInfoSize, 0,
+                                 &err)) {
+          str.AppendPrintf("0x%x", categoryInfo);
+        }
+      }
+    }
+
+    str.AppendLiteral(" : ");
+    if (providers[i].ProtocolChain.ChainLen <= BASE_PROTOCOL) {
+      // If we're dealing with a catalog entry that identifies an individual
+      // base or layer provider, log its provider GUID.
+      RPC_CSTR provIdStr = nullptr;
+      if (UuidToStringA(&providers[i].ProviderId, &provIdStr) == RPC_S_OK) {
+        str.Append(reinterpret_cast<char*>(provIdStr));
+        RpcStringFreeA(&provIdStr);
+      }
+    }
+
+    if (i + 1 != n) {
+      str.AppendLiteral(" \n ");
+    }
+  }
+
+  mString = str;
+  NS_DispatchToMainThread(NS_NewRunnableMethod(this, &LSPAnnotationGatherer::Annotate));
+  return NS_OK;
+}
+
+void LSPAnnotate()
+{
+  nsCOMPtr<nsIThread> thread;
+  nsCOMPtr<nsIRunnable> runnable =
+    do_QueryObject(new LSPAnnotationGatherer());
+  NS_NewThread(getter_AddRefs(thread), runnable);
+}
+
+} // namespace crashreporter
+} // namespace mozilla
diff --git a/widget/windows/WinUtils.cpp b/widget/windows/WinUtils.cpp
index 7a83fb0941..3f764de546 100644
--- a/widget/windows/WinUtils.cpp
+++ b/widget/windows/WinUtils.cpp
@@ -1213,7 +1213,7 @@ AsyncFaviconDataReady::OnComplete(nsIURI *aFaviconURI,
 
   // Allocate a new buffer that we own and can use out of line in
   // another thread.
-  uint8_t *data = SurfaceToPackedBGRA(dataSurface);
+  UniquePtr<uint8_t[]> data = SurfaceToPackedBGRA(dataSurface);
   if (!data) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
@@ -1221,7 +1221,7 @@ AsyncFaviconDataReady::OnComplete(nsIURI *aFaviconURI,
   int32_t dataLength = stride * size.height;
 
   // AsyncEncodeAndWriteIcon takes ownership of the heap allocated buffer
-  nsCOMPtr<nsIRunnable> event = new AsyncEncodeAndWriteIcon(path, data,
+  nsCOMPtr<nsIRunnable> event = new AsyncEncodeAndWriteIcon(path, Move(data),
                                                             dataLength,
                                                             stride,
                                                             size.width,
@@ -1235,7 +1235,7 @@ AsyncFaviconDataReady::OnComplete(nsIURI *aFaviconURI,
 
 // Warning: AsyncEncodeAndWriteIcon assumes ownership of the aData buffer passed in
 AsyncEncodeAndWriteIcon::AsyncEncodeAndWriteIcon(const nsAString &aIconPath,
-                                                 uint8_t *aBuffer,
+                                                 UniquePtr<uint8_t[]> aBuffer,
                                                  uint32_t aBufferLength,
                                                  uint32_t aStride,
                                                  uint32_t aWidth,
@@ -1243,7 +1243,7 @@ AsyncEncodeAndWriteIcon::AsyncEncodeAndWriteIcon(const nsAString &aIconPath,
                                                  const bool aURLShortcut) :
   mURLShortcut(aURLShortcut),
   mIconPath(aIconPath),
-  mBuffer(aBuffer),
+  mBuffer(Move(aBuffer)),
   mBufferLength(aBufferLength),
   mStride(aStride),
   mWidth(aWidth),
@@ -1258,7 +1258,7 @@ NS_IMETHODIMP AsyncEncodeAndWriteIcon::Run()
   // Note that since we're off the main thread we can't use
   // gfxPlatform::GetPlatform()->ScreenReferenceDrawTarget()
   RefPtr<DataSourceSurface> surface =
-    Factory::CreateWrappingDataSourceSurface(mBuffer, mStride,
+    Factory::CreateWrappingDataSourceSurface(mBuffer.get(), mStride,
                                              IntSize(mWidth, mHeight),
                                              SurfaceFormat::B8G8R8A8);
 
diff --git a/widget/windows/WinUtils.h b/widget/windows/WinUtils.h
index 8cce2e7176..20ee87f36b 100644
--- a/widget/windows/WinUtils.h
+++ b/widget/windows/WinUtils.h
@@ -36,6 +36,7 @@
 
 #include "mozilla/Attributes.h"
 #include "mozilla/EventForwards.h"
+#include "mozilla/UniquePtr.h"
 
 /**
  * NS_INLINE_DECL_IUNKNOWN_REFCOUNTING should be used for defining and
@@ -459,15 +460,15 @@ public:
 
   // Warning: AsyncEncodeAndWriteIcon assumes ownership of the aData buffer passed in
   AsyncEncodeAndWriteIcon(const nsAString &aIconPath,
-                          uint8_t *aData, uint32_t aDataLen, uint32_t aStride,
-                          uint32_t aWidth, uint32_t aHeight,
+                          UniquePtr<uint8_t[]> aData, uint32_t aDataLen,
+                          uint32_t aStride, uint32_t aWidth, uint32_t aHeight,
                           const bool aURLShortcut);
 
 private:
   virtual ~AsyncEncodeAndWriteIcon();
 
   nsAutoString mIconPath;
-  nsAutoArrayPtr<uint8_t> mBuffer;
+  UniquePtr<uint8_t[]> mBuffer;
   HMODULE sDwmDLL;
   uint32_t mBufferLength;
   uint32_t mStride;
diff --git a/widget/windows/WindowsUIUtils.cpp b/widget/windows/WindowsUIUtils.cpp
new file mode 100644
index 0000000000..de6b9b355f
--- /dev/null
+++ b/widget/windows/WindowsUIUtils.cpp
@@ -0,0 +1,174 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include <windows.h>
+#include "mozwrlbase.h"
+#include "nsServiceManagerUtils.h"
+
+#include "WindowsUIUtils.h"
+
+#include "nsIObserverService.h"
+#include "nsIBaseWindow.h"
+#include "nsIDocshell.h"
+#include "nsIAppShellService.h"
+#include "nsAppShellCID.h"
+#include "nsIXULWindow.h"
+#include "mozilla/Services.h"
+#include "mozilla/WindowsVersion.h"
+#include "nsString.h"
+#include "nsIWidget.h"
+
+#include <windows.ui.viewmanagement.h>
+
+#pragma comment(lib, "runtimeobject.lib")
+
+using namespace mozilla;
+using namespace ABI::Windows::UI;
+using namespace ABI::Windows::UI::ViewManagement;
+using namespace Microsoft::WRL;
+using namespace Microsoft::WRL::Wrappers;
+using namespace ABI::Windows::Foundation;
+
+/* All of this is win10 stuff and we're compiling against win81 headers
+ * for now, so we may need to do some legwork: */
+#ifndef UserInteractionMode
+namespace ABI {
+  namespace Windows {
+    namespace UI {
+      namespace ViewManagement {
+        enum UserInteractionMode {
+          UserInteractionMode_Mouse = 0,
+          UserInteractionMode_Touch = 1
+        };
+      }
+    }
+  }
+}
+
+#endif
+
+#ifndef RuntimeClass_Windows_UI_ViewManagement_UIViewSettings
+#define RuntimeClass_Windows_UI_ViewManagement_UIViewSettings L"Windows.UI.ViewManagement.UIViewSettings"
+#endif
+
+#ifndef IUIViewSettings
+namespace ABI {
+  namespace Windows {
+    namespace UI {
+      namespace ViewManagement {
+        interface IUIViewSettings;
+        MIDL_INTERFACE("C63657F6-8850-470D-88F8-455E16EA2C26")
+          IUIViewSettings : public IInspectable
+          {
+            public:
+              virtual HRESULT STDMETHODCALLTYPE get_UserInteractionMode(UserInteractionMode *value) = 0;
+          };
+
+        extern const __declspec(selectany) IID & IID_IUIViewSettings = __uuidof(IUIViewSettings);
+      }
+    }
+  }
+}
+#endif
+
+#ifndef IUIViewSettingsInterop
+
+typedef interface IUIViewSettingsInterop IUIViewSettingsInterop;
+
+MIDL_INTERFACE("3694dbf9-8f68-44be-8ff5-195c98ede8a6")
+IUIViewSettingsInterop : public IInspectable
+{
+public:
+  virtual HRESULT STDMETHODCALLTYPE GetForWindow(HWND hwnd, REFIID riid, void **ppv) = 0;
+};
+#endif
+
+WindowsUIUtils::WindowsUIUtils() :
+  mInTabletMode(eTabletModeUnknown)
+{
+}
+
+WindowsUIUtils::~WindowsUIUtils()
+{
+}
+
+/*
+ * Implement the nsISupports methods...
+ */
+NS_IMPL_ISUPPORTS(WindowsUIUtils,
+                  nsIWindowsUIUtils)
+
+NS_IMETHODIMP
+WindowsUIUtils::GetInTabletMode(bool* aResult)
+{
+  if (mInTabletMode == eTabletModeUnknown) {
+    UpdateTabletModeState();
+  }
+  *aResult = mInTabletMode == eTabletModeOn;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+WindowsUIUtils::UpdateTabletModeState()
+{
+  if (!IsWin10OrLater()) {
+    return NS_OK;
+  }
+
+  nsCOMPtr<nsIAppShellService> appShell(do_GetService(NS_APPSHELLSERVICE_CONTRACTID));
+  nsCOMPtr<nsIXULWindow> hiddenWindow;
+
+  nsresult rv = appShell->GetHiddenWindow(getter_AddRefs(hiddenWindow));
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+
+  nsCOMPtr<nsIDocShell> docShell;
+  rv = hiddenWindow->GetDocShell(getter_AddRefs(docShell));
+  if (NS_FAILED(rv) || !docShell) {
+    return rv;
+  }
+
+  nsCOMPtr<nsIBaseWindow> baseWindow(do_QueryInterface(docShell));
+
+  if (!baseWindow)
+    return NS_ERROR_FAILURE;
+
+  nsCOMPtr<nsIWidget> widget;
+  baseWindow->GetMainWidget(getter_AddRefs(widget));
+
+  if (!widget)
+    return NS_ERROR_FAILURE;
+
+  HWND winPtr = (HWND)widget->GetNativeData(NS_NATIVE_WINDOW);
+  ComPtr<IUIViewSettingsInterop> uiViewSettingsInterop;
+
+  HRESULT hr = GetActivationFactory(
+      HStringReference(RuntimeClass_Windows_UI_ViewManagement_UIViewSettings).Get(),
+      &uiViewSettingsInterop);
+  if (SUCCEEDED(hr)) {
+    ComPtr<IUIViewSettings> uiViewSettings;
+    hr = uiViewSettingsInterop->GetForWindow(winPtr, IID_PPV_ARGS(&uiViewSettings));
+    if (SUCCEEDED(hr)) {
+      UserInteractionMode mode;
+      hr = uiViewSettings->get_UserInteractionMode(&mode);
+      if (SUCCEEDED(hr)) {
+        TabletModeState oldTabletModeState = mInTabletMode;
+        mInTabletMode = (mode == UserInteractionMode_Touch) ? eTabletModeOn : eTabletModeOff;
+        if (mInTabletMode != oldTabletModeState) {
+          nsCOMPtr<nsIObserverService> observerService =
+            mozilla::services::GetObserverService();
+          NS_NAMED_LITERAL_STRING(tabletMode, "tablet-mode");
+          NS_NAMED_LITERAL_STRING(normalMode, "normal-mode");
+          observerService->NotifyObservers(nullptr, "tablet-mode-change",
+            ((mInTabletMode == eTabletModeOn) ? tabletMode.get() : normalMode.get()));
+        }
+      }
+    }
+  }
+
+  return NS_OK;
+}
+
diff --git a/widget/windows/WindowsUIUtils.h b/widget/windows/WindowsUIUtils.h
new file mode 100644
index 0000000000..a33c93a94f
--- /dev/null
+++ b/widget/windows/WindowsUIUtils.h
@@ -0,0 +1,29 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_widget_WindowsUIUtils_h__
+#define mozilla_widget_WindowsUIUtils_h__
+
+#include "nsIWindowsUIUtils.h"
+
+enum TabletModeState {
+  eTabletModeUnknown = 0,
+  eTabletModeOff,
+  eTabletModeOn
+};
+
+class WindowsUIUtils final : public nsIWindowsUIUtils {
+public:
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIWINDOWSUIUTILS
+
+  WindowsUIUtils();
+protected:
+  ~WindowsUIUtils();
+
+  TabletModeState mInTabletMode;
+};
+
+#endif // mozilla_widget_WindowsUIUtils_h__
diff --git a/widget/windows/moz.build b/widget/windows/moz.build
index 4371a74f58..95e4f1f87d 100644
--- a/widget/windows/moz.build
+++ b/widget/windows/moz.build
@@ -63,6 +63,7 @@ SOURCES += [
     'nsBidiKeyboard.cpp',
     'nsFilePicker.cpp',
     'nsWidgetFactory.cpp',
+    'WindowsUIUtils.cpp',
     'WinMouseScrollHandler.cpp',
 ]
 
diff --git a/widget/windows/mozwrlbase.h b/widget/windows/mozwrlbase.h
new file mode 100644
index 0000000000..d82be8f043
--- /dev/null
+++ b/widget/windows/mozwrlbase.h
@@ -0,0 +1,77 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#pragma once
+
+/*
+ * Includes <wrl.h> and it's children. Defines imports needed by
+ * corewrappers.h in the case where windows.h has already been
+ * included w/WINVER < 0x600. Also ups WINVER/_WIN32_WINNT prior
+ * to including wrl.h. Mozilla's build currently has WINVER set to
+ * 0x502 for XP support.
+ */
+
+#if _WIN32_WINNT < 0x600
+
+#include <windows.h>
+
+VOID
+WINAPI
+ReleaseSRWLockExclusive(
+    _Inout_ PSRWLOCK SRWLock
+    );
+
+VOID
+WINAPI
+ReleaseSRWLockShared(
+    _Inout_ PSRWLOCK SRWLock
+    );
+
+BOOL
+WINAPI
+InitializeCriticalSectionEx(
+    _Out_ LPCRITICAL_SECTION lpCriticalSection,
+    _In_ DWORD dwSpinCount,
+    _In_ DWORD Flags
+    );
+
+VOID
+WINAPI
+InitializeSRWLock(
+    _Out_ PSRWLOCK SRWLock
+    );
+
+VOID
+WINAPI
+AcquireSRWLockExclusive(
+    _Inout_ PSRWLOCK SRWLock
+    );
+
+BOOLEAN
+WINAPI
+TryAcquireSRWLockExclusive(
+    _Inout_ PSRWLOCK SRWLock
+    );
+
+BOOLEAN
+WINAPI
+TryAcquireSRWLockShared(
+    _Inout_ PSRWLOCK SRWLock
+    );
+
+VOID
+WINAPI
+AcquireSRWLockShared(
+    _Inout_ PSRWLOCK SRWLock
+    );
+
+#undef WINVER
+#undef _WIN32_WINNT
+#define WINVER 0x600
+#define _WIN32_WINNT 0x600
+
+#endif // _WIN32_WINNT < 0x600
+
+#include <wrl.h>
diff --git a/widget/windows/nsClipboard.cpp b/widget/windows/nsClipboard.cpp
index 08aaeed1a5..2097783140 100644
--- a/widget/windows/nsClipboard.cpp
+++ b/widget/windows/nsClipboard.cpp
@@ -88,7 +88,7 @@ nsClipboard::Observe(nsISupports *aSubject, const char *aTopic,
 }
 
 //-------------------------------------------------------------------------
-UINT nsClipboard::GetFormat(const char* aMimeStr)
+UINT nsClipboard::GetFormat(const char* aMimeStr, bool aMapHTMLMime)
 {
   UINT format;
 
@@ -103,7 +103,8 @@ UINT nsClipboard::GetFormat(const char* aMimeStr)
   else if (strcmp(aMimeStr, kFileMime) == 0 ||
            strcmp(aMimeStr, kFilePromiseMime) == 0)
     format = CF_HDROP;
-  else if (strcmp(aMimeStr, kNativeHTMLMime) == 0)
+  else if (strcmp(aMimeStr, kNativeHTMLMime) == 0 ||
+           aMapHTMLMime && strcmp(aMimeStr, kHTMLMime) == 0)
     format = CF_HTML;
   else
     format = ::RegisterClipboardFormatW(NS_ConvertASCIItoUTF16(aMimeStr).get());
@@ -166,7 +167,9 @@ nsresult nsClipboard::SetupNativeDataObject(nsITransferable * aTransferable, IDa
     if ( currentFlavor ) {
       nsXPIDLCString flavorStr;
       currentFlavor->ToString(getter_Copies(flavorStr));
-      UINT format = GetFormat(flavorStr);
+      // When putting data onto the clipboard, we want to maintain kHTMLMime
+      // ("text/html") and not map it to CF_HTML here since this will be done below.
+      UINT format = GetFormat(flavorStr, false);
 
       // Now tell the native IDataObject about both our mime type and 
       // the native data format
@@ -749,27 +752,26 @@ nsClipboard :: FindPlatformHTML ( IDataObject* inDataObject, UINT inIndex, void*
 bool
 nsClipboard :: FindUnicodeFromPlainText ( IDataObject* inDataObject, UINT inIndex, void** outData, uint32_t* outDataLen )
 {
-  bool dataFound = false;
-
   // we are looking for text/unicode and we failed to find it on the clipboard first,
   // try again with text/plain. If that is present, convert it to unicode.
-  nsresult loadResult = GetNativeDataOffClipboard(inDataObject, inIndex, GetFormat(kTextMime), nullptr, outData, outDataLen);
-  if ( NS_SUCCEEDED(loadResult) && *outData ) {
-    const char* castedText = reinterpret_cast<char*>(*outData);          
-    char16_t* convertedText = nullptr;
-    int32_t convertedTextLen = 0;
-    nsPrimitiveHelpers::ConvertPlatformPlainTextToUnicode ( castedText, *outDataLen, 
-                                                              &convertedText, &convertedTextLen );
-    if ( convertedText ) {
-      // out with the old, in with the new 
-      free(*outData);
-      *outData = convertedText;
-      *outDataLen = convertedTextLen * sizeof(char16_t);
-      dataFound = true;
-    }
-  } // if plain text data on clipboard
+  nsresult rv = GetNativeDataOffClipboard(inDataObject, inIndex, GetFormat(kTextMime), nullptr, outData, outDataLen);
+  if (NS_FAILED(rv) || !*outData) {
+    return false;
+  }
 
-  return dataFound;
+  const char* castedText = static_cast<char*>(*outData);
+  nsAutoString tmp;
+  rv = NS_CopyNativeToUnicode(nsDependentCSubstring(castedText, *outDataLen), tmp);
+  if (NS_FAILED(rv)) {
+    return false;
+  }
+
+  // out with the old, in with the new
+  free(*outData);
+  *outData = ToNewUnicode(tmp);
+  *outDataLen = tmp.Length() * sizeof(char16_t);
+
+  return true;
 
 } // FindUnicodeFromPlainText
 
diff --git a/widget/windows/nsClipboard.h b/widget/windows/nsClipboard.h
index 05da23f9fd..620e895435 100644
--- a/widget/windows/nsClipboard.h
+++ b/widget/windows/nsClipboard.h
@@ -7,6 +7,7 @@
 #define nsClipboard_h__
 
 #include "nsBaseClipboard.h"
+#include "nsIObserver.h"
 #include "nsIURI.h"
 #include <windows.h>
 
@@ -50,7 +51,13 @@ public:
   static nsresult GetNativeDataOffClipboard(nsIWidget * aWindow, UINT aIndex, UINT aFormat, void ** aData, uint32_t * aLen);
   static nsresult GetNativeDataOffClipboard(IDataObject * aDataObject, UINT aIndex, UINT aFormat, const char * aMIMEImageFormat, void ** aData, uint32_t * aLen);
   static nsresult GetGlobalData(HGLOBAL aHGBL, void ** aData, uint32_t * aLen);
-  static UINT     GetFormat(const char* aMimeStr);
+
+  // This function returns the internal Windows clipboard format identifier
+  // for a given Mime string. The default is to map kHTMLMime ("text/html")
+  // to the clipboard format CF_HTML ("HTLM Format"), but it can also be
+  // registered as clipboard format "text/html" to support previous versions
+  // of Gecko.
+  static UINT     GetFormat(const char* aMimeStr, bool aMapHTMLMime = true);
 
   static UINT     CF_HTML;
   
diff --git a/widget/windows/nsDragService.cpp b/widget/windows/nsDragService.cpp
index e090b5766c..6d4a30988f 100644
--- a/widget/windows/nsDragService.cpp
+++ b/widget/windows/nsDragService.cpp
@@ -170,18 +170,11 @@ nsDragService::CreateDragImage(nsIDOMNode *aDOMNode,
 }
 
 //-------------------------------------------------------------------------
-NS_IMETHODIMP
-nsDragService::InvokeDragSession(nsIDOMNode *aDOMNode,
-                                 nsISupportsArray *anArrayTransferables,
-                                 nsIScriptableRegion *aRegion,
-                                 uint32_t aActionType)
+nsresult
+nsDragService::InvokeDragSessionImpl(nsISupportsArray* anArrayTransferables,
+                                     nsIScriptableRegion* aRegion,
+                                     uint32_t aActionType)
 {
-  nsresult rv = nsBaseDragService::InvokeDragSession(aDOMNode,
-                                                     anArrayTransferables,
-                                                     aRegion,
-                                                     aActionType);
-  NS_ENSURE_SUCCESS(rv, rv);
-
   // Try and get source URI of the items that are being dragged
   nsIURI *uri = nullptr;
 
@@ -191,7 +184,7 @@ nsDragService::InvokeDragSession(nsIDOMNode *aDOMNode,
   }
 
   uint32_t numItemsToDrag = 0;
-  rv = anArrayTransferables->Count(&numItemsToDrag);
+  nsresult rv = anArrayTransferables->Count(&numItemsToDrag);
   if (!numItemsToDrag)
     return NS_ERROR_FAILURE;
 
@@ -214,7 +207,7 @@ nsDragService::InvokeDragSession(nsIDOMNode *aDOMNode,
       nsCOMPtr<nsITransferable> trans(do_QueryInterface(supports));
       if (trans) {
         // set the requestingNode on the transferable
-        trans->SetRequestingNode(aDOMNode);
+        trans->SetRequestingNode(mSourceNode);
         RefPtr<IDataObject> dataObj;
         rv = nsClipboard::CreateNativeDataObject(trans,
                                                  getter_AddRefs(dataObj), uri);
@@ -233,7 +226,7 @@ nsDragService::InvokeDragSession(nsIDOMNode *aDOMNode,
     nsCOMPtr<nsITransferable> trans(do_QueryInterface(supports));
     if (trans) {
       // set the requestingNode on the transferable
-      trans->SetRequestingNode(aDOMNode);
+      trans->SetRequestingNode(mSourceNode);
       rv = nsClipboard::CreateNativeDataObject(trans,
                                                getter_AddRefs(itemToDrag),
                                                uri);
@@ -247,7 +240,7 @@ nsDragService::InvokeDragSession(nsIDOMNode *aDOMNode,
                                  CLSCTX_INPROC_SERVER,
                                  IID_IDragSourceHelper, (void**)&pdsh))) {
     SHDRAGIMAGE sdi;
-    if (CreateDragImage(aDOMNode, aRegion, &sdi)) {
+    if (CreateDragImage(mSourceNode, aRegion, &sdi)) {
       if (FAILED(pdsh->InitializeFromBitmap(&sdi, itemToDrag)))
         DeleteObject(sdi.hbmpDragImage);
     }
diff --git a/widget/windows/nsDragService.h b/widget/windows/nsDragService.h
index eb165da6e9..9228e72047 100644
--- a/widget/windows/nsDragService.h
+++ b/widget/windows/nsDragService.h
@@ -23,11 +23,10 @@ public:
   nsDragService();
   virtual ~nsDragService();
   
-  // nsIDragService
-  NS_IMETHOD InvokeDragSession(nsIDOMNode *aDOMNode,
-                               nsISupportsArray *anArrayTransferables,
-                               nsIScriptableRegion *aRegion,
-                               uint32_t aActionType);
+  // nsBaseDragService
+  virtual nsresult InvokeDragSessionImpl(nsISupportsArray* anArrayTransferables,
+                                         nsIScriptableRegion* aRegion,
+                                         uint32_t aActionType);
 
   // nsIDragSession
   NS_IMETHOD GetData(nsITransferable * aTransferable, uint32_t anItem);
diff --git a/widget/windows/nsFilePicker.cpp b/widget/windows/nsFilePicker.cpp
index ddccb6e905..b41297d2c5 100644
--- a/widget/windows/nsFilePicker.cpp
+++ b/widget/windows/nsFilePicker.cpp
@@ -10,6 +10,7 @@
 #include <shlwapi.h>
 #include <cderr.h>
 
+#include "mozilla/UniquePtr.h"
 #include "mozilla/WindowsVersion.h"
 #include "nsReadableUtils.h"
 #include "nsNetUtil.h"
@@ -26,6 +27,8 @@
 #include "nsPIDOMWindow.h"
 
 using mozilla::IsVistaOrLater;
+using mozilla::MakeUnique;
+using mozilla::UniquePtr;
 using namespace mozilla::widget;
 
 char16_t *nsFilePicker::mLastUsedUnicodeDirectory;
@@ -70,15 +73,15 @@ class AutoRestoreWorkingPath
 public:
   AutoRestoreWorkingPath() {
     DWORD bufferLength = GetCurrentDirectoryW(0, nullptr);
-    mWorkingPath = new wchar_t[bufferLength];
-    if (GetCurrentDirectoryW(bufferLength, mWorkingPath) == 0) {
+    mWorkingPath = MakeUnique<wchar_t[]>(bufferLength);
+    if (GetCurrentDirectoryW(bufferLength, mWorkingPath.get()) == 0) {
       mWorkingPath = nullptr;
     }
   }
 
   ~AutoRestoreWorkingPath() {
     if (HasWorkingPath()) {
-      ::SetCurrentDirectoryW(mWorkingPath);
+      ::SetCurrentDirectoryW(mWorkingPath.get());
     }
   }
 
@@ -86,7 +89,7 @@ public:
     return mWorkingPath != nullptr;
   }
 private:
-  nsAutoArrayPtr<wchar_t> mWorkingPath;
+  UniquePtr<wchar_t[]> mWorkingPath;
 };
 
 // Manages NS_NATIVE_TMP_WINDOW child windows. NS_NATIVE_TMP_WINDOWs are
@@ -523,8 +526,8 @@ nsFilePicker::ShowXPFolderPicker(const nsString& aInitialDir)
 {
   bool result = false;
 
-  nsAutoArrayPtr<wchar_t> dirBuffer(new wchar_t[FILE_BUFFER_SIZE]);
-  wcsncpy(dirBuffer, aInitialDir.get(), FILE_BUFFER_SIZE);
+  auto dirBuffer = MakeUnique<wchar_t[]>(FILE_BUFFER_SIZE);
+  wcsncpy(dirBuffer.get(), aInitialDir.get(), FILE_BUFFER_SIZE);
   dirBuffer[FILE_BUFFER_SIZE-1] = '\0';
 
   AutoDestroyTmpWindow adtw((HWND)(mParentWidget.get() ?
@@ -532,7 +535,7 @@ nsFilePicker::ShowXPFolderPicker(const nsString& aInitialDir)
 
   BROWSEINFOW browserInfo = {0};
   browserInfo.pidlRoot       = nullptr;
-  browserInfo.pszDisplayName = dirBuffer;
+  browserInfo.pszDisplayName = dirBuffer.get();
   browserInfo.lpszTitle      = mTitle.get();
   browserInfo.ulFlags        = BIF_USENEWUI | BIF_RETURNONLYFSDIRS;
   browserInfo.hwndOwner      = adtw.get(); 
@@ -551,9 +554,9 @@ nsFilePicker::ShowXPFolderPicker(const nsString& aInitialDir)
 
   LPITEMIDLIST list = ::SHBrowseForFolderW(&browserInfo);
   if (list) {
-    result = ::SHGetPathFromIDListW(list, dirBuffer);
+    result = ::SHGetPathFromIDListW(list, dirBuffer.get());
     if (result)
-      mUnicodeFile.Assign(static_cast<const wchar_t*>(dirBuffer));
+      mUnicodeFile.Assign(static_cast<const wchar_t*>(dirBuffer.get()));
     // free PIDL
     CoTaskMemFree(list);
   }
@@ -667,8 +670,8 @@ nsFilePicker::ShowXPFilePicker(const nsString& aInitialDir)
   ofn.lStructSize = sizeof(ofn);
   nsString filterBuffer = mFilterList;
                                 
-  nsAutoArrayPtr<wchar_t> fileBuffer(new wchar_t[FILE_BUFFER_SIZE]);
-  wcsncpy(fileBuffer,  mDefaultFilePath.get(), FILE_BUFFER_SIZE);
+  auto fileBuffer = MakeUnique<wchar_t[]>(FILE_BUFFER_SIZE);
+  wcsncpy(fileBuffer.get(),  mDefaultFilePath.get(), FILE_BUFFER_SIZE);
   fileBuffer[FILE_BUFFER_SIZE-1] = '\0'; // null terminate in case copy truncated
 
   if (!aInitialDir.IsEmpty()) {
@@ -681,7 +684,7 @@ nsFilePicker::ShowXPFilePicker(const nsString& aInitialDir)
   ofn.lpstrTitle   = (LPCWSTR)mTitle.get();
   ofn.lpstrFilter  = (LPCWSTR)filterBuffer.get();
   ofn.nFilterIndex = mSelectedType;
-  ofn.lpstrFile    = fileBuffer;
+  ofn.lpstrFile    = fileBuffer.get();
   ofn.nMaxFile     = FILE_BUFFER_SIZE;
   ofn.hwndOwner    = adtw.get();
   ofn.lCustData    = reinterpret_cast<LPARAM>(this);
@@ -754,9 +757,9 @@ nsFilePicker::ShowXPFilePicker(const nsString& aInitialDir)
       // the new Common File Dialogs for Vista and up.
       if (!IsVistaOrLater()) {
         ofn.lpfnHook = MultiFilePickerHook;
-        fileBuffer.forget();
+        fileBuffer.release();
         result = FilePickerWrapper(&ofn, PICKER_TYPE_OPEN);
-        fileBuffer = ofn.lpstrFile;
+        fileBuffer.reset(ofn.lpstrFile);
       } else {
         result = FilePickerWrapper(&ofn, PICKER_TYPE_OPEN);
       }
@@ -798,7 +801,7 @@ nsFilePicker::ShowXPFilePicker(const nsString& aInitialDir)
 
   // Single file selection, we're done
   if (mMode != modeOpenMultiple) {
-    GetQualifiedPath(fileBuffer, mUnicodeFile);
+    GetQualifiedPath(fileBuffer.get(), mUnicodeFile);
     return true;
   }
 
@@ -808,7 +811,7 @@ nsFilePicker::ShowXPFilePicker(const nsString& aInitialDir)
   // separated, with an extra '\0' character after the last file name. This
   // format enables the Explorer-style dialog boxes to return long file names
   // that include spaces. 
-  wchar_t *current = fileBuffer;
+  wchar_t *current = fileBuffer.get();
   
   nsAutoString dirName(current);
   // Sometimes dirName contains a trailing slash and sometimes it doesn't:
@@ -839,7 +842,7 @@ nsFilePicker::ShowXPFilePicker(const nsString& aInitialDir)
   // Handle the case where the user selected just one file. From msdn: If you
   // specify OFN_ALLOWMULTISELECT and the user selects only one file the
   // lpstrFile string does not have a separator between the path and file name.
-  if (current && *current && (current == fileBuffer)) {
+  if (current && *current && (current == fileBuffer.get())) {
     nsCOMPtr<nsIFile> file = do_CreateInstance("@mozilla.org/file/local;1");
     NS_ENSURE_TRUE(file, false);
     
diff --git a/widget/windows/nsWidgetFactory.cpp b/widget/windows/nsWidgetFactory.cpp
index 96ed545bf9..be8be3c3b6 100644
--- a/widget/windows/nsWidgetFactory.cpp
+++ b/widget/windows/nsWidgetFactory.cpp
@@ -44,6 +44,8 @@
 #include "JumpListBuilder.h"
 #include "JumpListItem.h"
 
+#include "WindowsUIUtils.h"
+
 #ifdef NS_PRINTING
 #include "nsDeviceContextSpecWin.h"
 #include "nsPrintOptionsWin.h"
@@ -116,6 +118,7 @@ NS_GENERIC_FACTORY_CONSTRUCTOR(JumpListItem)
 NS_GENERIC_FACTORY_CONSTRUCTOR(JumpListSeparator)
 NS_GENERIC_FACTORY_CONSTRUCTOR(JumpListLink)
 NS_GENERIC_FACTORY_CONSTRUCTOR(JumpListShortcut)
+NS_GENERIC_FACTORY_CONSTRUCTOR(WindowsUIUtils)
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsTransferable)
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsHTMLFormatConverter)
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsDragService)
@@ -154,6 +157,7 @@ NS_DEFINE_NAMED_CID(NS_WIN_JUMPLISTITEM_CID);
 NS_DEFINE_NAMED_CID(NS_WIN_JUMPLISTSEPARATOR_CID);
 NS_DEFINE_NAMED_CID(NS_WIN_JUMPLISTLINK_CID);
 NS_DEFINE_NAMED_CID(NS_WIN_JUMPLISTSHORTCUT_CID);
+NS_DEFINE_NAMED_CID(NS_WINDOWS_UIUTILS_CID);
 NS_DEFINE_NAMED_CID(NS_DRAGSERVICE_CID);
 NS_DEFINE_NAMED_CID(NS_BIDIKEYBOARD_CID);
 #ifdef NS_PRINTING
@@ -186,6 +190,7 @@ static const mozilla::Module::CIDEntry kWidgetCIDs[] = {
   { &kNS_WIN_JUMPLISTSEPARATOR_CID, false, nullptr, JumpListSeparatorConstructor },
   { &kNS_WIN_JUMPLISTLINK_CID, false, nullptr, JumpListLinkConstructor },
   { &kNS_WIN_JUMPLISTSHORTCUT_CID, false, nullptr, JumpListShortcutConstructor },
+  { &kNS_WINDOWS_UIUTILS_CID, false, nullptr, WindowsUIUtilsConstructor },
   { &kNS_DRAGSERVICE_CID, false, nullptr, nsDragServiceConstructor, Module::MAIN_PROCESS_ONLY },
   { &kNS_BIDIKEYBOARD_CID, false, nullptr, nsBidiKeyboardConstructor },
 #ifdef NS_PRINTING
@@ -218,6 +223,7 @@ static const mozilla::Module::ContractIDEntry kWidgetContracts[] = {
   { "@mozilla.org/windows-jumplistseparator;1", &kNS_WIN_JUMPLISTSEPARATOR_CID },
   { "@mozilla.org/windows-jumplistlink;1", &kNS_WIN_JUMPLISTLINK_CID },
   { "@mozilla.org/windows-jumplistshortcut;1", &kNS_WIN_JUMPLISTSHORTCUT_CID },
+  { "@mozilla.org/windows-ui-utils;1", &kNS_WINDOWS_UIUTILS_CID },
   { "@mozilla.org/widget/dragservice;1", &kNS_DRAGSERVICE_CID, Module::MAIN_PROCESS_ONLY },
   { "@mozilla.org/widget/bidikeyboard;1", &kNS_BIDIKEYBOARD_CID },
 #ifdef NS_PRINTING
diff --git a/widget/windows/nsWindow.cpp b/widget/windows/nsWindow.cpp
index 4f688d0904..aa7d250435 100644
--- a/widget/windows/nsWindow.cpp
+++ b/widget/windows/nsWindow.cpp
@@ -122,6 +122,7 @@
 #include "nsPrintfCString.h"
 #include "mozilla/Preferences.h"
 #include "nsISound.h"
+#include "SystemTimeConverter.h"
 #include "WinTaskbar.h"
 #include "WinUtils.h"
 #include "WidgetUtils.h"
@@ -161,6 +162,8 @@
 #include "nsIWinTaskbar.h"
 #define NS_TASKBAR_CONTRACTID "@mozilla.org/windows-taskbar;1"
 
+#include "nsIWindowsUIUtils.h"
+
 #include "nsWindowDefs.h"
 
 #include "nsCrashOnException.h"
@@ -245,8 +248,28 @@ int             nsWindow::sTrimOnMinimize         = 2;
 
 TriStateBool nsWindow::sHasBogusPopupsDropShadowOnMultiMonitor = TRI_UNKNOWN;
 
-DWORD           nsWindow::sFirstEventTime = 0;
-TimeStamp       nsWindow::sFirstEventTimeStamp = TimeStamp();
+namespace mozilla {
+
+class CurrentWindowsTimeGetter {
+public:
+  DWORD GetCurrentTime() const
+  {
+    return ::GetTickCount();
+  }
+
+  void GetTimeAsyncForPossibleBackwardsSkew(const TimeStamp& aNow)
+  {
+    // FIXME: Get time async
+  }
+};
+
+} // namespace mozilla
+
+static SystemTimeConverter<DWORD>&
+TimeConverter() {
+  static SystemTimeConverter<DWORD> timeConverterSingleton;
+  return timeConverterSingleton;
+}
 
 /**************************************************************
  *
@@ -296,10 +319,6 @@ static bool gIsPointerEventsEnabled = false;
 // coordinate this many milliseconds:
 #define HITTEST_CACHE_LIFETIME_MS 50
 
-// Times attached to messages wrap when they overflow
-static const DWORD kEventTimeRange = std::numeric_limits<DWORD>::max();
-static const DWORD kEventTimeHalfRange = kEventTimeRange / 2;
-
 
 /**************************************************************
  **************************************************************
@@ -1298,26 +1317,10 @@ void nsWindow::SetThemeRegion()
  *
  **************************************************************/
 
-void nsWindow::ConfigureAPZCTreeManager()
-{
-  nsBaseWidget::ConfigureAPZCTreeManager();
-
-  // When APZ is enabled, we can actually enable raw touch events because we
-  // have code that can deal with them properly. If APZ is not enabled, this
-  // function doesn't get called, and |mGesture| will take care of touch-based
-  // scrolling. Note that RegisterTouchWindow may still do nothing depending
-  // on touch/pointer events prefs, and so it is possible to enable APZ without
-  // also enabling touch support.
-  RegisterTouchWindow();
-}
-
 void nsWindow::RegisterTouchWindow() {
-  if (Preferences::GetInt("dom.w3c_touch_events.enabled", 0) ||
-      gIsPointerEventsEnabled) {
-    mTouchWindow = true;
-    mGesture.RegisterTouchWindow(mWnd);
-    ::EnumChildWindows(mWnd, nsWindow::RegisterTouchForDescendants, 0);
-  }
+  mTouchWindow = true;
+  mGesture.RegisterTouchWindow(mWnd);
+  ::EnumChildWindows(mWnd, nsWindow::RegisterTouchForDescendants, 0);
 }
 
 BOOL CALLBACK nsWindow::RegisterTouchForDescendants(HWND aWnd, LPARAM aMsg) {
@@ -2281,7 +2284,7 @@ NS_IMETHODIMP
 nsWindow::SetNonClientMargins(nsIntMargin &margins)
 {
   if (!mIsTopWidgetWindow ||
-      mBorderStyle & eBorderStyle_none)
+      mBorderStyle == eBorderStyle_none)
     return NS_ERROR_INVALID_ARG;
 
   if (mHideChrome) {
@@ -4541,16 +4544,6 @@ nsWindow::ProcessMessage(UINT msg, WPARAM& wParam, LPARAM& lParam,
 
   // (Large blocks of code should be broken out into OnEvent handlers.)
   switch (msg) {
-    // Manually reset the cursor if WM_SETCURSOR is requested while over
-    // application content (as opposed to Windows borders, etc).
-    case WM_SETCURSOR:
-      if (LOWORD(lParam) == HTCLIENT)
-      {
-        SetCursor(GetCursor());
-        result = true;
-      }
-      break;
-
     // WM_QUERYENDSESSION must be handled by all windows.
     // Otherwise Windows thinks the window can just be killed at will.
     case WM_QUERYENDSESSION:
@@ -4656,6 +4649,15 @@ nsWindow::ProcessMessage(UINT msg, WPARAM& wParam, LPARAM& lParam,
 
     case WM_SETTINGCHANGE:
     {
+      if (IsWin10OrLater() && mWindowType == eWindowType_invisible && lParam) {
+        auto lParamString = reinterpret_cast<const wchar_t*>(lParam);
+        if (!wcscmp(lParamString, L"UserInteractionMode")) {
+          nsCOMPtr<nsIWindowsUIUtils> uiUtils(do_GetService("@mozilla.org/windows-ui-utils;1"));
+          if (uiUtils) {
+            uiUtils->UpdateTabletModeState();
+          }
+        }
+      }
       if (lParam) {
         auto lParamString = reinterpret_cast<const wchar_t*>(lParam);
         if (!wcscmp(lParamString, L"ImmersiveColorSet")) {
@@ -5391,10 +5393,6 @@ nsWindow::ProcessMessage(UINT msg, WPARAM& wParam, LPARAM& lParam,
         // A GestureNotify event is dispatched to decide which single-finger panning
         // direction should be active (including none) and if pan feedback should
         // be displayed. Java and plugin windows can make their own calls.
-        if (gIsPointerEventsEnabled) {
-          result = false;
-          break;
-        }
 
         GESTURENOTIFYSTRUCT * gestureinfo = (GESTURENOTIFYSTRUCT*)lParam;
         nsPointWin touchPoint;
@@ -5696,102 +5694,11 @@ nsWindow::ClientMarginHitTestPoint(int32_t mx, int32_t my)
 TimeStamp
 nsWindow::GetMessageTimeStamp(LONG aEventTime)
 {
-  // Conversion from native event time to timestamp is complicated by the fact
-  // that native event time wraps. Also, for consistency's sake we avoid calling
-  // ::GetTickCount() each time and for performance reasons we only use the
-  // TimeStamp::NowLoRes except when recording the first event's time.
-
-  // We currently require the event time to be passed in. This is an interim
-  // measure to avoid calling GetMessageTime twice for each event--once when
-  // storing the time directly and once when converting to a timestamp.
-  //
-  // Once we no longer store both a time and a timestamp on each event we can
-  // perform the call to GetMessageTime here instead.
   DWORD eventTime = static_cast<DWORD>(aEventTime);
 
-  // Record first event time
-  if (sFirstEventTimeStamp.IsNull()) {
-    nsWindow::UpdateFirstEventTime(eventTime);
-  }
-  TimeStamp roughlyNow = TimeStamp::NowLoRes();
-
-  // If the event time is before the first event time there are two
-  // possibilities:
-  //
-  //   a) Event time has wrapped
-  //   b) The initial events were not delivered strictly in time order
-  //
-  // I'm not sure if (b) ever happens but even if it doesn't currently occur,
-  // it could come about if we change the way we fetch events.
-  //
-  // We can tell we have (b) if the event time is a little bit before the first
-  // event (i.e. less than half the range) and the timestamp is only a little
-  // bit past the first event timestamp (again less than half the range).
-  // In that case we should adjust the first event time so it really is the
-  // first event time.
-  if (eventTime < sFirstEventTime &&
-      sFirstEventTime - eventTime < kEventTimeHalfRange &&
-      roughlyNow - sFirstEventTimeStamp <
-        TimeDuration::FromMilliseconds(kEventTimeHalfRange)) {
-    UpdateFirstEventTime(eventTime);
-  }
-
-  double timeSinceFirstEvent =
-    sFirstEventTime <= eventTime
-      ? eventTime - sFirstEventTime
-      : static_cast<double>(kEventTimeRange) + eventTime - sFirstEventTime;
-  TimeStamp eventTimeStamp =
-    sFirstEventTimeStamp + TimeDuration::FromMilliseconds(timeSinceFirstEvent);
-
-  // Event time may have wrapped several times since we recorded the first
-  // event time (it wraps every ~50 days) so we extend eventTimeStamp as
-  // needed.
-  double timesWrapped =
-    (roughlyNow - sFirstEventTimeStamp).ToMilliseconds() / kEventTimeRange;
-  int32_t cyclesToAdd = static_cast<int32_t>(timesWrapped); // floor
-
-  // There is some imprecision in the above calculation since we are using
-  // TimeStamp::NowLoRes and sFirstEventTime and sFirstEventTimeStamp may not
-  // be *exactly* the same moment. It is possible we think that time
-  // has *just* wrapped based on comparing timestamps, but actually the
-  // event time is *just about* to wrap; or vice versa.
-  // In the following, we detect this situation and adjust cyclesToAdd as
-  // necessary.
-  double intervalFraction = fmod(timesWrapped, 1.0);
-
-  // If our rough calculation of how many times we've wrapped based on comparing
-  // timestamps says we've just wrapped (specifically, less 10% past the wrap
-  // point), but the event time is just before the wrap point (again, within
-  // 10%), then we need to reduce the number of wraps by 1.
-  if (intervalFraction < 0.1 && timeSinceFirstEvent > kEventTimeRange * 0.9) {
-    cyclesToAdd--;
-  // Likewise, if our rough calculation says we've just wrapped but actually the
-  // event time is just after the wrap point, we need to add an extra wrap.
-  } else if (intervalFraction > 0.9 &&
-             timeSinceFirstEvent < kEventTimeRange * 0.1) {
-    cyclesToAdd++;
-  }
-
-  if (cyclesToAdd > 0) {
-    eventTimeStamp +=
-      TimeDuration::FromMilliseconds(kEventTimeRange * cyclesToAdd);
-  }
-
-  return eventTimeStamp;
-}
-
-void
-nsWindow::UpdateFirstEventTime(DWORD aEventTime)
-{
-  sFirstEventTime = aEventTime;
-  DWORD currentTime = ::GetTickCount();
-  TimeStamp currentTimeStamp = TimeStamp::Now();
-  double timeSinceFirstEvent =
-    aEventTime <= currentTime
-      ? currentTime - aEventTime
-      : static_cast<double>(kEventTimeRange) + currentTime - aEventTime;
-  sFirstEventTimeStamp =
-    currentTimeStamp - TimeDuration::FromMilliseconds(timeSinceFirstEvent);
+  CurrentWindowsTimeGetter getCurrentTime;
+  return TimeConverter().GetTimeStampFromSystemTime(aEventTime,
+                                                    getCurrentTime);
 }
 
 void nsWindow::PostSleepWakeNotification(const bool aIsSleepMode)
@@ -6335,10 +6242,6 @@ bool nsWindow::OnTouch(WPARAM wParam, LPARAM lParam)
 // Gesture event processing. Handles WM_GESTURE events.
 bool nsWindow::OnGesture(WPARAM wParam, LPARAM lParam)
 {
-  if (gIsPointerEventsEnabled) {
-    return false;
-  }
-
   // Treatment for pan events which translate into scroll events:
   if (mGesture.IsPanEvent(lParam)) {
     if ( !mGesture.ProcessPanMessage(mWnd, wParam, lParam) )
diff --git a/widget/windows/nsWindow.h b/widget/windows/nsWindow.h
index 6636cfd80f..e1e2ef1aa2 100644
--- a/widget/windows/nsWindow.h
+++ b/widget/windows/nsWindow.h
@@ -28,6 +28,7 @@
 #include "mozilla/MouseEvents.h"
 #include "mozilla/TimeStamp.h"
 #include "nsMargin.h"
+#include "nsRegionFwd.h"
 
 #include "nsWinGesture.h"
 
@@ -49,7 +50,6 @@
 
 class nsNativeDragTarget;
 class nsIRollupListener;
-class nsIntRegion;
 class imgIContainer;
 
 namespace mozilla {
@@ -292,8 +292,7 @@ protected:
   virtual ~nsWindow();
 
   virtual void WindowUsesOMTC() override;
-  virtual void ConfigureAPZCTreeManager() override;
-  void RegisterTouchWindow();
+  virtual void RegisterTouchWindow() override;
 
   virtual nsresult NotifyIMEInternal(
                      const IMENotification& aIMENotification) override;
@@ -588,11 +587,6 @@ protected:
   TimeStamp mCachedHitTestTime;
   int32_t mCachedHitTestResult;
 
-  // For converting native event times to timestamps we record the time of the
-  // first received event in each time scale.
-  static DWORD     sFirstEventTime;
-  static TimeStamp sFirstEventTimeStamp;
-
   static bool sNeedsToInitMouseWheelSettings;
   static void InitMouseWheelScrollData();
 
diff --git a/widget/windows/nsWindowGfx.cpp b/widget/windows/nsWindowGfx.cpp
index dca34886bc..9bd18312b5 100644
--- a/widget/windows/nsWindowGfx.cpp
+++ b/widget/windows/nsWindowGfx.cpp
@@ -640,7 +640,7 @@ nsresult nsWindowGfx::CreateIcon(imgIContainer *aContainer,
   MOZ_ASSERT(dataSurface->GetFormat() == SurfaceFormat::B8G8R8A8);
 
   uint8_t* data = nullptr;
-  nsAutoArrayPtr<uint8_t> autoDeleteArray;
+  UniquePtr<uint8_t[]> autoDeleteArray;
   if (map.mStride == BytesPerPixel(dataSurface->GetFormat()) * iconSize.width) {
     // Mapped data is already packed
     data = map.mData;
@@ -653,7 +653,8 @@ nsresult nsWindowGfx::CreateIcon(imgIContainer *aContainer,
     dataSurface->Unmap();
     map.mData = nullptr;
 
-    data = autoDeleteArray = SurfaceToPackedBGRA(dataSurface);
+    autoDeleteArray = SurfaceToPackedBGRA(dataSurface);
+    data = autoDeleteArray.get();
     NS_ENSURE_TRUE(data, NS_ERROR_FAILURE);
   }
 
diff --git a/xpcom/build/moz.build b/xpcom/build/moz.build
index 614fd1a698..c9164d1781 100644
--- a/xpcom/build/moz.build
+++ b/xpcom/build/moz.build
@@ -79,8 +79,8 @@ FINAL_LIBRARY = 'xul'
 DEFINES['_IMPL_NS_STRINGAPI'] = True
 DEFINES['OMNIJAR_NAME'] = CONFIG['OMNIJAR_NAME']
 
-GENERATED_INCLUDES += ['..']
 LOCAL_INCLUDES += [
+    '!..',
     '../base',
     '../components',
     '../ds',
diff --git a/xpcom/components/moz.build b/xpcom/components/moz.build
index 03a057f8da..7b2ebef455 100644
--- a/xpcom/components/moz.build
+++ b/xpcom/components/moz.build
@@ -44,8 +44,8 @@ if CONFIG['GNU_CXX']:
 
 FINAL_LIBRARY = 'xul'
 
-GENERATED_INCLUDES += ['..']
 LOCAL_INCLUDES += [
+    '!..',
     '../base',
     '../build',
     '../ds',
diff --git a/xpcom/glue/nsTArray.h b/xpcom/glue/nsTArray.h
index e5f6314258..c14899dadc 100644
--- a/xpcom/glue/nsTArray.h
+++ b/xpcom/glue/nsTArray.h
@@ -28,6 +28,7 @@
 #include "nsQuickSort.h"
 #include "nsDebug.h"
 #include "nsISupportsImpl.h"
+#include "nsRegionFwd.h"
 #include <new>
 
 namespace JS {
@@ -36,7 +37,6 @@ class Heap;
 } /* namespace JS */
 
 class nsRegion;
-class nsIntRegion;
 namespace mozilla {
 namespace layers {
 struct TileClient;
diff --git a/xpcom/io/moz.build b/xpcom/io/moz.build
index f05e7850c0..45732e4cbf 100644
--- a/xpcom/io/moz.build
+++ b/xpcom/io/moz.build
@@ -134,4 +134,4 @@ FINAL_LIBRARY = 'xul'
 if CONFIG['OS_ARCH'] == 'Linux' and 'lib64' in CONFIG['libdir']:
     DEFINES['HAVE_USR_LIB64_DIR'] = True
 
-GENERATED_INCLUDES += ['..']
+LOCAL_INCLUDES += ['!..']
diff --git a/xpcom/libxpcomrt/moz.build b/xpcom/libxpcomrt/moz.build
index c2e0884ab0..cb58cc5a72 100644
--- a/xpcom/libxpcomrt/moz.build
+++ b/xpcom/libxpcomrt/moz.build
@@ -119,8 +119,8 @@ if CONFIG['INTEL_ARCHITECTURE']:
     sse_string_path = '/xpcom/string/nsUTF8UtilsSSE2.cpp'
     SOURCES[sse_string_path].flags += CONFIG['SSE2_FLAGS']
 
-GENERATED_INCLUDES += ['..']
 LOCAL_INCLUDES = [
+    '!..',
     '../base',
     '../build',
     '../components',
diff --git a/xpcom/typelib/xpt/moz.build b/xpcom/typelib/xpt/moz.build
index e58f5dee45..b5ca955bfe 100644
--- a/xpcom/typelib/xpt/moz.build
+++ b/xpcom/typelib/xpt/moz.build
@@ -22,8 +22,10 @@ EXPORTS += [
 
 FINAL_LIBRARY = 'xul'
 
-GENERATED_INCLUDES += ['/xpcom/base']
-LOCAL_INCLUDES += ['/xpcom/base']
+LOCAL_INCLUDES += [
+    '!/xpcom/base',
+    '/xpcom/base',
+]
 
 if CONFIG['_MSC_VER']:
     CFLAGS += ['-Zl']