diff --git a/b2g/installer/package-manifest.in b/b2g/installer/package-manifest.in
index 017a6fa174..23c8a1887e 100644
--- a/b2g/installer/package-manifest.in
+++ b/b2g/installer/package-manifest.in
@@ -721,6 +721,7 @@
 @RESPATH@/components/nsUrlClassifierHashCompleter.js
 @RESPATH@/components/nsUrlClassifierListManager.js
 @RESPATH@/components/nsUrlClassifierLib.js
+@RESPATH@/components/PrivateBrowsingTrackingProtectionWhitelist.js
 @RESPATH@/components/url-classifier.xpt
 
 ; GNOME hooks
diff --git a/browser/installer/package-manifest.in b/browser/installer/package-manifest.in
index 3bf2d1a10d..656e430055 100644
--- a/browser/installer/package-manifest.in
+++ b/browser/installer/package-manifest.in
@@ -650,6 +650,20 @@
 @RESPATH@/browser/modules/*
 @RESPATH@/modules/*
 
+; Safe Browsing
+#ifdef MOZ_URL_CLASSIFIER
+@RESPATH@/components/nsURLClassifier.manifest
+@RESPATH@/components/nsUrlClassifierHashCompleter.js
+@RESPATH@/components/nsUrlClassifierListManager.js
+@RESPATH@/components/nsUrlClassifierLib.js
+@RESPATH@/components/url-classifier.xpt
+#endif
+
+; Private Browsing
+@RESPATH@/components/privatebrowsing.xpt
+@RESPATH@/components/PrivateBrowsing.manifest
+@RESPATH@/components/PrivateBrowsingTrackingProtectionWhitelist.js
+
 ; ANGLE GLES-on-D3D rendering library
 #ifdef MOZ_ANGLE_RENDERER
 @BINPATH@/libEGL.dll
diff --git a/dom/asmjscache/test/file_slow.js b/dom/asmjscache/test/file_slow.js
index 723e04bfe9..963422143c 100644
--- a/dom/asmjscache/test/file_slow.js
+++ b/dom/asmjscache/test/file_slow.js
@@ -18,7 +18,7 @@ function f2(stdlib, foreign, buffer) {
 }
 if (this.jsFuns)
     ok(jsFuns.isAsmJSModule(f2), "f2 is an asm.js module");
-var i32 = new Int32Array(1024);
+var i32 = new Int32Array(16384); // Smallest allowed buffer size is 64KBy
 for (var i = 0; i < i32.length; i++)
     i32[i] = i;
 var f2Main = f2(this, null, i32.buffer);
diff --git a/dom/audiochannel/AudioChannelAgent.h b/dom/audiochannel/AudioChannelAgent.h
index 4311a7b9d9..74271199ec 100644
--- a/dom/audiochannel/AudioChannelAgent.h
+++ b/dom/audiochannel/AudioChannelAgent.h
@@ -70,4 +70,5 @@ private:
 } // namespace dom
 } // namespace mozilla
 
+
 #endif
diff --git a/dom/base/ChromeUtils.cpp b/dom/base/ChromeUtils.cpp
index d4342fc8c6..4a85fc09df 100644
--- a/dom/base/ChromeUtils.cpp
+++ b/dom/base/ChromeUtils.cpp
@@ -30,6 +30,26 @@ ThreadSafeChromeUtils::NondeterministicGetWeakMapKeys(GlobalObject& aGlobal,
   }
 }
 
+/* static */ void
+ThreadSafeChromeUtils::NondeterministicGetWeakSetKeys(GlobalObject& aGlobal,
+                                                      JS::Handle<JS::Value> aSet,
+                                                      JS::MutableHandle<JS::Value> aRetval,
+                                                      ErrorResult& aRv)
+{
+  if (!aSet.isObject()) {
+    aRetval.setUndefined();
+  } else {
+    JSContext* cx = aGlobal.Context();
+    JS::Rooted<JSObject*> objRet(cx);
+    JS::Rooted<JSObject*> setObj(cx, &aSet.toObject());
+    if (!JS_NondeterministicGetWeakSetKeys(cx, setObj, &objRet)) {
+      aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
+    } else {
+      aRetval.set(objRet ? JS::ObjectValue(*objRet) : JS::UndefinedValue());
+    }
+  }
+}
+
   /* static */ void
 ChromeUtils::OriginAttributesToSuffix(dom::GlobalObject& aGlobal,
                                       const dom::OriginAttributesDictionary& aAttrs,
diff --git a/dom/base/ChromeUtils.h b/dom/base/ChromeUtils.h
index 103d996aed..800038a807 100644
--- a/dom/base/ChromeUtils.h
+++ b/dom/base/ChromeUtils.h
@@ -38,6 +38,11 @@ public:
                                              JS::Handle<JS::Value> aMap,
                                              JS::MutableHandle<JS::Value> aRetval,
                                              ErrorResult& aRv);
+
+  static void NondeterministicGetWeakSetKeys(GlobalObject& aGlobal,
+                                             JS::Handle<JS::Value> aSet,
+                                             JS::MutableHandle<JS::Value> aRetval,
+                                             ErrorResult& aRv);
 };
 
 class ChromeUtils : public ThreadSafeChromeUtils
diff --git a/dom/base/ConsoleReportCollector.cpp b/dom/base/ConsoleReportCollector.cpp
index 462f7242c5..05b8c755f8 100644
--- a/dom/base/ConsoleReportCollector.cpp
+++ b/dom/base/ConsoleReportCollector.cpp
@@ -79,6 +79,27 @@ ConsoleReportCollector::FlushConsoleReports(nsIDocument* aDocument)
   }
 }
 
+void
+ConsoleReportCollector::FlushConsoleReports(nsIConsoleReportCollector* aCollector)
+{
+  MOZ_ASSERT(aCollector);
+
+  nsTArray<PendingReport> reports;
+
+  {
+    MutexAutoLock lock(mMutex);
+    mPendingReports.SwapElements(reports);
+  }
+
+  for (uint32_t i = 0; i < reports.Length(); ++i) {
+    PendingReport& report = reports[i];
+    aCollector->AddConsoleReport(report.mErrorFlags, report.mCategory,
+                                 report.mPropertiesFile, report.mSourceFileURI,
+                                 report.mLineNumber, report.mColumnNumber,
+                                 report.mMessageName, report.mStringParams);
+  }
+}
+
 ConsoleReportCollector::~ConsoleReportCollector()
 {
 }
diff --git a/dom/base/ConsoleReportCollector.h b/dom/base/ConsoleReportCollector.h
index 942563bfb2..ea07fa6834 100644
--- a/dom/base/ConsoleReportCollector.h
+++ b/dom/base/ConsoleReportCollector.h
@@ -29,6 +29,9 @@ public:
   void
   FlushConsoleReports(nsIDocument* aDocument) override;
 
+  void
+  FlushConsoleReports(nsIConsoleReportCollector* aCollector) override;
+
 private:
   ~ConsoleReportCollector();
 
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index bf0e9e292b..9c1a7c18eb 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -10688,13 +10688,6 @@ nsGlobalWindow::GetLocalStorage(ErrorResult& aError)
       return nullptr;
     }
 
-    // If the document has the sandboxed origin flag set
-    // don't allow access to localStorage.
-    if (mDoc && (mDoc->GetSandboxFlags() & SANDBOXED_ORIGIN)) {
-      aError.Throw(NS_ERROR_DOM_SECURITY_ERR);
-      return nullptr;
-    }
-
     nsString documentURI;
     if (mDoc) {
       mDoc->GetDocumentURI(documentURI);
diff --git a/dom/base/nsIConsoleReportCollector.h b/dom/base/nsIConsoleReportCollector.h
index 0b140a5f18..7f22c4ff4c 100644
--- a/dom/base/nsIConsoleReportCollector.h
+++ b/dom/base/nsIConsoleReportCollector.h
@@ -66,7 +66,7 @@ public:
                      aLineNumber, aColumnNumber, aMessageName, params);
   }
 
-  // Flush all pending reports to the console.
+  // Flush all pending reports to the console.  Main thread only.
   //
   // aDocument      An optional document representing where to flush the
   //                reports.  If provided, then the corresponding window's
@@ -74,6 +74,14 @@ public:
   //                go to the browser console.
   virtual void
   FlushConsoleReports(nsIDocument* aDocument) = 0;
+
+  // Flush all pending reports to another collector.  May be called from any
+  // thread.
+  //
+  // aCollector     A required collector object that will effectively take
+  //                ownership of our currently console reports.
+  virtual void
+  FlushConsoleReports(nsIConsoleReportCollector* aCollector) = 0;
 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsIConsoleReportCollector, NS_NSICONSOLEREPORTCOLLECTOR_IID)
diff --git a/dom/base/test/browser_messagemanager_loadprocessscript.js b/dom/base/test/browser_messagemanager_loadprocessscript.js
index 39929ded21..feabfb43c6 100644
--- a/dom/base/test/browser_messagemanager_loadprocessscript.js
+++ b/dom/base/test/browser_messagemanager_loadprocessscript.js
@@ -1,4 +1,4 @@
-let ppmm = Cc["@mozilla.org/parentprocessmessagemanager;1"]
+var ppmm = Cc["@mozilla.org/parentprocessmessagemanager;1"]
            .getService(Ci.nsIMessageBroadcaster);
 ppmm.QueryInterface(Ci.nsIProcessScriptLoader);
 
@@ -18,7 +18,7 @@ function processScript() {
   });
   sendSyncMessage("ProcessTest:Loaded");
 }
-let processScriptURL = "data:,(" + processScript.toString() + ")()";
+var processScriptURL = "data:,(" + processScript.toString() + ")()";
 
 function initTestScript() {
   let init = initialProcessData;
@@ -29,9 +29,9 @@ function initTestScript() {
 
   sendAsyncMessage("ProcessTest:InitGood", init.test456.get("hi"));
 }
-let initTestScriptURL = "data:,(" + initTestScript.toString() + ")()";
+var initTestScriptURL = "data:,(" + initTestScript.toString() + ")()";
 
-let checkProcess = Task.async(function*(mm) {
+var checkProcess = Task.async(function*(mm) {
   let { target } = yield promiseMessage(mm, "ProcessTest:Loaded");
   target.sendAsyncMessage("ProcessTest:Reply");
   yield promiseMessage(target, "ProcessTest:Finished");
diff --git a/dom/base/test/browser_state_notifications.js b/dom/base/test/browser_state_notifications.js
index b66086ae7a..3279acb39a 100644
--- a/dom/base/test/browser_state_notifications.js
+++ b/dom/base/test/browser_state_notifications.js
@@ -4,7 +4,7 @@
 
 "use strict";
 
-const { interfaces: Ci, classes: Cc, utils: Cu } = Components;
+var { interfaces: Ci, classes: Cc, utils: Cu } = Components;
 const { addObserver, removeObserver } = Cc["@mozilla.org/observer-service;1"].
                                           getService(Ci.nsIObserverService);
 const { openWindow } = Cc["@mozilla.org/embedcomp/window-watcher;1"].
diff --git a/dom/base/test/browser_use_counters.js b/dom/base/test/browser_use_counters.js
index 45b821a3e4..80341bb2f4 100644
--- a/dom/base/test/browser_use_counters.js
+++ b/dom/base/test/browser_use_counters.js
@@ -1,13 +1,13 @@
 /* -*- Mode: javascript; tab-width: 2; indent-tabs-mode: nil; js-indent-level: 2 -*- */
 
-let {Promise: promise} = Cu.import("resource://gre/modules/Promise.jsm", {});
+var {Promise: promise} = Cu.import("resource://gre/modules/Promise.jsm", {});
 
 const gHttpTestRoot = "http://example.com/browser/dom/base/test/";
 
 /**
  * Enable local telemetry recording for the duration of the tests.
  */
-let gOldContentCanRecord = false;
+var gOldContentCanRecord = false;
 add_task(function* test_initialize() {
    gOldContentCanRecord = yield ContentTask.spawn(gBrowser.selectedBrowser, {}, function () {
     let telemetry = Cc["@mozilla.org/base/telemetry;1"].getService(Ci.nsITelemetry);
@@ -112,7 +112,7 @@ function grabHistogramsFromContent(browser, use_counter_middlefix) {
   });
 }
 
-let check_use_counter_iframe = Task.async(function* (file, use_counter_middlefix, check_documents=true) {
+var check_use_counter_iframe = Task.async(function* (file, use_counter_middlefix, check_documents=true) {
   info("checking " + file + " with histogram " + use_counter_middlefix);
 
   let newTab = gBrowser.addTab( "about:blank");
diff --git a/dom/base/test/bug403852_fileOpener.js b/dom/base/test/bug403852_fileOpener.js
index 7d835d443f..e8de8b5996 100644
--- a/dom/base/test/bug403852_fileOpener.js
+++ b/dom/base/test/bug403852_fileOpener.js
@@ -1,7 +1,7 @@
-const { classes: Cc, interfaces: Ci, utils: Cu } = Components;
+var { classes: Cc, interfaces: Ci, utils: Cu } = Components;
 Cu.importGlobalProperties(["File"]);
 
-let testFile = Cc["@mozilla.org/file/directory_service;1"]
+var testFile = Cc["@mozilla.org/file/directory_service;1"]
                  .getService(Ci.nsIDirectoryService)
                  .QueryInterface(Ci.nsIProperties)
                  .get("ProfD", Ci.nsIFile);
diff --git a/dom/base/test/file_audioLoop.html b/dom/base/test/file_audioLoop.html
index 0d057e8d2d..d680c9a58f 100644
--- a/dom/base/test/file_audioLoop.html
+++ b/dom/base/test/file_audioLoop.html
@@ -1,4 +1,2 @@
 <!DOCTYPE html>
 <audio src="audio.ogg" autoplay="true" loop>
-<!DOCTYPE html>
-<audio src="audio.ogg" autoplay="true" loop>
diff --git a/dom/base/test/file_messagemanager_unload.html b/dom/base/test/file_messagemanager_unload.html
index 9778c94c10..3df810d502 100644
--- a/dom/base/test/file_messagemanager_unload.html
+++ b/dom/base/test/file_messagemanager_unload.html
@@ -4,9 +4,3 @@
     <iframe id="frame" src="about:robots"></iframe>
   </body>
 </html>
-<!DOCTYPE html>
-<html>
-  <body>
-    <iframe id="frame" src="about:robots"></iframe>
-  </body>
-</html>
diff --git a/dom/base/test/file_simplecontentpolicy.js b/dom/base/test/file_simplecontentpolicy.js
index a8d24a1fb6..1f9606c49d 100644
--- a/dom/base/test/file_simplecontentpolicy.js
+++ b/dom/base/test/file_simplecontentpolicy.js
@@ -1,6 +1,6 @@
-const Ci = Components.interfaces;
-const Cc = Components.classes;
-const Cr = Components.results;
+var Ci = Components.interfaces;
+var Cc = Components.classes;
+var Cr = Components.results;
 
 Components.utils.import("resource://gre/modules/Services.jsm");
 Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
diff --git a/dom/base/test/fileapi_chromeScript.js b/dom/base/test/fileapi_chromeScript.js
index 59932314d3..85f80a60b2 100644
--- a/dom/base/test/fileapi_chromeScript.js
+++ b/dom/base/test/fileapi_chromeScript.js
@@ -1,4 +1,4 @@
-const { classes: Cc, interfaces: Ci, utils: Cu } = Components;
+var { classes: Cc, interfaces: Ci, utils: Cu } = Components;
 Cu.importGlobalProperties(["File"]);
 
 var fileNum = 1;
diff --git a/dom/battery/BatteryManager.cpp b/dom/battery/BatteryManager.cpp
index a6db71ad9a..9c5276e342 100644
--- a/dom/battery/BatteryManager.cpp
+++ b/dom/battery/BatteryManager.cpp
@@ -142,10 +142,7 @@ BatteryManager::UpdateFromBatteryInfo(const hal::BatteryInformation& aBatteryInf
   if (!nsContentUtils::IsChromeDoc(doc) &&
       status != nsIPrincipal::APP_STATUS_CERTIFIED)
   {
-    mLevel = 0.292f;
-    printf_stderr("SNORP: battery level before rounding: %lf\n", mLevel);
     mLevel = lround(mLevel * 10.0) / 10.0;
-    printf_stderr("SNORP: battery level after rounding: %lf\n", mLevel);
   }
 
   mCharging = aBatteryInfo.charging();
diff --git a/dom/battery/moz.build b/dom/battery/moz.build
index 75d0e1075c..7a65c6611e 100644
--- a/dom/battery/moz.build
+++ b/dom/battery/moz.build
@@ -18,3 +18,6 @@ include('/ipc/chromium/chromium-config.mozbuild')
 FINAL_LIBRARY = 'xul'
 
 MOCHITEST_MANIFESTS += ['test/mochitest.ini']
+
+if CONFIG['GNU_CXX']:
+    CXXFLAGS += ['-Wshadow']
diff --git a/dom/battery/test/marionette/test_battery_level.js b/dom/battery/test/marionette/test_battery_level.js
index 74b1ec70a7..c95ebac192 100644
--- a/dom/battery/test/marionette/test_battery_level.js
+++ b/dom/battery/test/marionette/test_battery_level.js
@@ -3,7 +3,7 @@
 
 MARIONETTE_TIMEOUT = 10000;
 
-let battery = null;
+var battery = null;
 
 function verifyInitialState() {
   window.navigator.getBattery().then(function (b) {
diff --git a/dom/battery/test/marionette/test_battery_status_charging.js b/dom/battery/test/marionette/test_battery_status_charging.js
index 714f73d10e..9b6966132d 100644
--- a/dom/battery/test/marionette/test_battery_status_charging.js
+++ b/dom/battery/test/marionette/test_battery_status_charging.js
@@ -3,9 +3,9 @@
 
 MARIONETTE_TIMEOUT = 10000;
 
-let battery = null;
-let fromStatus = "charging";
-let fromCharging = true;
+var battery = null;
+var fromStatus = "charging";
+var fromCharging = true;
 
 function verifyInitialState() {
   window.navigator.getBattery().then(function (b) {
diff --git a/dom/battery/test/marionette/test_battery_status_discharging.js b/dom/battery/test/marionette/test_battery_status_discharging.js
index 972c034927..7a8ca62883 100644
--- a/dom/battery/test/marionette/test_battery_status_discharging.js
+++ b/dom/battery/test/marionette/test_battery_status_discharging.js
@@ -3,9 +3,9 @@
 
 MARIONETTE_TIMEOUT = 10000;
 
-let battery = null;
-let fromStatus = "discharging";
-let fromCharging = false;
+var battery = null;
+var fromStatus = "discharging";
+var fromCharging = false;
 
 function verifyInitialState() {
   window.navigator.getBattery().then(function (b) {
diff --git a/dom/battery/test/marionette/test_battery_status_full.js b/dom/battery/test/marionette/test_battery_status_full.js
index a636a6eaca..381fd311b7 100644
--- a/dom/battery/test/marionette/test_battery_status_full.js
+++ b/dom/battery/test/marionette/test_battery_status_full.js
@@ -3,9 +3,9 @@
 
 MARIONETTE_TIMEOUT = 10000;
 
-let battery = window.navigator.battery;
-let fromStatus = "full";
-let fromCharging = true;
+var battery = window.navigator.battery;
+var fromStatus = "full";
+var fromCharging = true;
 
 function verifyInitialState() {
   window.navigator.getBattery().then(function (b) {
diff --git a/dom/battery/test/marionette/test_battery_status_not_charging.js b/dom/battery/test/marionette/test_battery_status_not_charging.js
index 9b7b38eeb7..68bbe16aef 100644
--- a/dom/battery/test/marionette/test_battery_status_not_charging.js
+++ b/dom/battery/test/marionette/test_battery_status_not_charging.js
@@ -3,9 +3,9 @@
 
 MARIONETTE_TIMEOUT = 10000;
 
-let battery = window.navigator.battery;
-let fromStatus = "not-charging";
-let fromCharging = false;
+var battery = window.navigator.battery;
+var fromStatus = "not-charging";
+var fromCharging = false;
 
 function verifyInitialState() {
   window.navigator.getBattery().then(function (b) {
diff --git a/dom/battery/test/marionette/test_battery_status_unknown.js b/dom/battery/test/marionette/test_battery_status_unknown.js
index a86581e381..78e192fce5 100644
--- a/dom/battery/test/marionette/test_battery_status_unknown.js
+++ b/dom/battery/test/marionette/test_battery_status_unknown.js
@@ -3,9 +3,9 @@
 
 MARIONETTE_TIMEOUT = 10000;
 
-let battery = window.navigator.battery;
-let fromStatus = "unknown";
-let fromCharging = false;
+var battery = window.navigator.battery;
+var fromStatus = "unknown";
+var fromCharging = false;
 
 function verifyInitialState() {
   window.navigator.getBattery().then(function (b) {
diff --git a/dom/battery/test/marionette/test_deprecated_battery_level.js b/dom/battery/test/marionette/test_deprecated_battery_level.js
index b344a26e61..3e92f66322 100644
--- a/dom/battery/test/marionette/test_deprecated_battery_level.js
+++ b/dom/battery/test/marionette/test_deprecated_battery_level.js
@@ -3,7 +3,7 @@
 
 MARIONETTE_TIMEOUT = 10000;
 
-let battery = window.navigator.battery;
+var battery = window.navigator.battery;
 
 function verifyInitialState() {
   ok(battery, "battery");
diff --git a/dom/battery/test/marionette/test_deprecated_battery_status_charging.js b/dom/battery/test/marionette/test_deprecated_battery_status_charging.js
index 2d7469d9f3..847154cd9d 100644
--- a/dom/battery/test/marionette/test_deprecated_battery_status_charging.js
+++ b/dom/battery/test/marionette/test_deprecated_battery_status_charging.js
@@ -3,9 +3,9 @@
 
 MARIONETTE_TIMEOUT = 10000;
 
-let battery = window.navigator.battery;
-let fromStatus = "charging";
-let fromCharging = true;
+var battery = window.navigator.battery;
+var fromStatus = "charging";
+var fromCharging = true;
 
 function verifyInitialState() {
   ok(battery, "battery");
diff --git a/dom/battery/test/marionette/test_deprecated_battery_status_discharging.js b/dom/battery/test/marionette/test_deprecated_battery_status_discharging.js
index b6a45f2b84..e6ae391468 100644
--- a/dom/battery/test/marionette/test_deprecated_battery_status_discharging.js
+++ b/dom/battery/test/marionette/test_deprecated_battery_status_discharging.js
@@ -3,9 +3,9 @@
 
 MARIONETTE_TIMEOUT = 10000;
 
-let battery = window.navigator.battery;
-let fromStatus = "discharging";
-let fromCharging = false;
+var battery = window.navigator.battery;
+var fromStatus = "discharging";
+var fromCharging = false;
 
 function verifyInitialState() {
   ok(battery, "battery");
diff --git a/dom/battery/test/marionette/test_deprecated_battery_status_full.js b/dom/battery/test/marionette/test_deprecated_battery_status_full.js
index 80d0fa1129..0d14ef6e72 100644
--- a/dom/battery/test/marionette/test_deprecated_battery_status_full.js
+++ b/dom/battery/test/marionette/test_deprecated_battery_status_full.js
@@ -3,9 +3,9 @@
 
 MARIONETTE_TIMEOUT = 10000;
 
-let battery = window.navigator.battery;
-let fromStatus = "full";
-let fromCharging = true;
+var battery = window.navigator.battery;
+var fromStatus = "full";
+var fromCharging = true;
 
 function verifyInitialState() {
   ok(battery, "battery");
diff --git a/dom/battery/test/marionette/test_deprecated_battery_status_not_charging.js b/dom/battery/test/marionette/test_deprecated_battery_status_not_charging.js
index 113017f76e..678fd9375e 100644
--- a/dom/battery/test/marionette/test_deprecated_battery_status_not_charging.js
+++ b/dom/battery/test/marionette/test_deprecated_battery_status_not_charging.js
@@ -3,9 +3,9 @@
 
 MARIONETTE_TIMEOUT = 10000;
 
-let battery = window.navigator.battery;
-let fromStatus = "not-charging";
-let fromCharging = false;
+var battery = window.navigator.battery;
+var fromStatus = "not-charging";
+var fromCharging = false;
 
 function verifyInitialState() {
   ok(battery, "battery");
diff --git a/dom/battery/test/marionette/test_deprecated_battery_unknown.js b/dom/battery/test/marionette/test_deprecated_battery_status_unknown.js
similarity index 96%
rename from dom/battery/test/marionette/test_deprecated_battery_unknown.js
rename to dom/battery/test/marionette/test_deprecated_battery_status_unknown.js
index 42a315a04c..15f6fd6717 100644
--- a/dom/battery/test/marionette/test_deprecated_battery_unknown.js
+++ b/dom/battery/test/marionette/test_deprecated_battery_status_unknown.js
@@ -3,9 +3,9 @@
 
 MARIONETTE_TIMEOUT = 10000;
 
-let battery = window.navigator.battery;
-let fromStatus = "unknown";
-let fromCharging = false;
+var battery = window.navigator.battery;
+var fromStatus = "unknown";
+var fromCharging = false;
 
 function verifyInitialState() {
   ok(battery, "battery");
diff --git a/dom/bluetooth/common/webapi/BluetoothAdapter.cpp b/dom/bluetooth/common/webapi/BluetoothAdapter.cpp
index 753e76a28d..71698119d0 100644
--- a/dom/bluetooth/common/webapi/BluetoothAdapter.cpp
+++ b/dom/bluetooth/common/webapi/BluetoothAdapter.cpp
@@ -1662,8 +1662,7 @@ BluetoothAdapter::DispatchEmptyEvent(const nsAString& aType)
 {
   RefPtr<Event> event = NS_NewDOMEvent(this, nullptr, nullptr);
 
-  nsresult rv = event->InitEvent(aType, false, false);
-  NS_ENSURE_SUCCESS_VOID(rv);
+  event->InitEvent(aType, false, false);
 
   DispatchTrustedEvent(event);
 }
diff --git a/dom/speakermanager/SpeakerManager.cpp b/dom/speakermanager/SpeakerManager.cpp
index 404babb14c..771c553906 100644
--- a/dom/speakermanager/SpeakerManager.cpp
+++ b/dom/speakermanager/SpeakerManager.cpp
@@ -90,13 +90,7 @@ SpeakerManager::DispatchSimpleEvent(const nsAString& aStr)
   }
 
   RefPtr<Event> event = NS_NewDOMEvent(this, nullptr, nullptr);
-  rv = event->InitEvent(aStr, false, false);
-
-  if (NS_FAILED(rv)) {
-    NS_WARNING("Failed to init the error event!!!");
-    return;
-  }
-
+  event->InitEvent(aStr, false, false);
   event->SetTrusted(true);
 
   rv = DispatchDOMEvent(nullptr, event, nullptr, nullptr);
diff --git a/dom/storage/DOMStorage.cpp b/dom/storage/DOMStorage.cpp
index 9d416bad83..6bc4f8039e 100644
--- a/dom/storage/DOMStorage.cpp
+++ b/dom/storage/DOMStorage.cpp
@@ -13,14 +13,14 @@
 #include "nsIPermissionManager.h"
 #include "nsIPrincipal.h"
 #include "nsICookiePermission.h"
-#include "nsICookieService.h"
-#include "mozIThirdPartyUtil.h"
+#include "nsPIDOMWindow.h"
 
 #include "mozilla/dom/StorageBinding.h"
 #include "mozilla/dom/StorageEvent.h"
 #include "mozilla/dom/StorageEventBinding.h"
 #include "mozilla/Services.h"
 #include "mozilla/Preferences.h"
+#include "mozilla/EnumSet.h"
 #include "nsThreadUtils.h"
 #include "nsContentUtils.h"
 #include "nsServiceManagerUtils.h"
@@ -71,7 +71,7 @@ DOMStorage::WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto)
 uint32_t
 DOMStorage::GetLength(ErrorResult& aRv)
 {
-  if (!CanUseStorage(mWindow, this)) {
+  if (!CanUseStorage(nullptr, this)) {
     aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
     return 0;
   }
@@ -84,7 +84,7 @@ DOMStorage::GetLength(ErrorResult& aRv)
 void
 DOMStorage::Key(uint32_t aIndex, nsAString& aResult, ErrorResult& aRv)
 {
-  if (!CanUseStorage(mWindow, this)) {
+  if (!CanUseStorage(nullptr, this)) {
     aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
     return;
   }
@@ -95,7 +95,7 @@ DOMStorage::Key(uint32_t aIndex, nsAString& aResult, ErrorResult& aRv)
 void
 DOMStorage::GetItem(const nsAString& aKey, nsAString& aResult, ErrorResult& aRv)
 {
-  if (!CanUseStorage(mWindow, this)) {
+  if (!CanUseStorage(nullptr, this)) {
     aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
     return;
   }
@@ -107,7 +107,7 @@ void
 DOMStorage::SetItem(const nsAString& aKey, const nsAString& aData,
                     ErrorResult& aRv)
 {
-  if (!CanUseStorage(mWindow, this)) {
+  if (!CanUseStorage(nullptr, this)) {
     aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
     return;
   }
@@ -140,7 +140,7 @@ DOMStorage::SetItem(const nsAString& aKey, const nsAString& aData,
 void
 DOMStorage::RemoveItem(const nsAString& aKey, ErrorResult& aRv)
 {
-  if (!CanUseStorage(mWindow, this)) {
+  if (!CanUseStorage(nullptr, this)) {
     aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
     return;
   }
@@ -159,7 +159,7 @@ DOMStorage::RemoveItem(const nsAString& aKey, ErrorResult& aRv)
 void
 DOMStorage::Clear(ErrorResult& aRv)
 {
-  if (!CanUseStorage(mWindow, this)) {
+  if (!CanUseStorage(nullptr, this)) {
     aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
     return;
   }
@@ -232,80 +232,35 @@ DOMStorage::BroadcastChangeNotification(const nsSubstring& aKey,
 
 static const char kPermissionType[] = "cookie";
 static const char kStorageEnabled[] = "dom.storage.enabled";
-static const char kCookiesBehavior[] = "network.cookie.cookieBehavior";
-static const char kCookiesLifetimePolicy[] = "network.cookie.lifetimePolicy";
 
 // static, public
 bool
-DOMStorage::CanUseStorage(nsIDOMWindow* aWindow, DOMStorage* aStorage)
+DOMStorage::CanUseStorage(nsPIDOMWindow* aWindow, DOMStorage* aStorage)
 {
   // This method is responsible for correct setting of mIsSessionOnly.
   // It doesn't work with mIsPrivate flag at all, since it is checked
   // regardless mIsSessionOnly flag in DOMStorageCache code.
-  if (aStorage) {
-    aStorage->mIsSessionOnly = false;
-  }
 
   if (!mozilla::Preferences::GetBool(kStorageEnabled)) {
     return false;
   }
 
-  // chrome can always use aStorage regardless of permission preferences
-  nsCOMPtr<nsIPrincipal> subjectPrincipal =
-    nsContentUtils::SubjectPrincipal();
-  if (nsContentUtils::IsSystemPrincipal(subjectPrincipal)) {
-    return true;
+  nsContentUtils::StorageAccess access = nsContentUtils::StorageAccess::eDeny;
+  if (aWindow) {
+    access = nsContentUtils::StorageAllowedForWindow(aWindow);
+  } else if (aStorage) {
+    access = nsContentUtils::StorageAllowedForPrincipal(aStorage->mPrincipal);
   }
 
-  nsCOMPtr<nsIPermissionManager> permissionManager =
-    services::GetPermissionManager();
-  if (!permissionManager) {
+  if (access == nsContentUtils::StorageAccess::eDeny) {
     return false;
   }
 
-  uint32_t perm;
-  permissionManager->TestPermissionFromPrincipal(subjectPrincipal,
-                                                 kPermissionType, &perm);
-
-  if (perm == nsIPermissionManager::DENY_ACTION) {
-    return false;
-  }
-
-  if (perm == nsICookiePermission::ACCESS_SESSION) {
-    if (aStorage) {
-      aStorage->mIsSessionOnly = true;
-    }
-  } else if (perm != nsIPermissionManager::ALLOW_ACTION) {
-    uint32_t cookieBehavior = Preferences::GetUint(kCookiesBehavior);
-    uint32_t lifetimePolicy = Preferences::GetUint(kCookiesLifetimePolicy);
-
-    // Can't use DOM storage when policy is set to "reject always".
-    if (cookieBehavior == nsICookieService::BEHAVIOR_REJECT) {
-      return false;
-    }
-
-    // Reject storage from 3rd party embedded content.
-    // If we don't have a window, then we can assume that the content is not
-    // originated from a 3rd party, because storage was not obtained through
-    // the window object.
-    if (aWindow && cookieBehavior == nsICookieService::BEHAVIOR_REJECT_FOREIGN) {
-      nsCOMPtr<mozIThirdPartyUtil> thirdPartyUtil =
-        do_GetService(THIRDPARTYUTIL_CONTRACTID);
-      MOZ_ASSERT(thirdPartyUtil);
-
-      bool thirdPartyWindow = false;
-      if (NS_SUCCEEDED(thirdPartyUtil->IsThirdPartyWindow(
-            aWindow, nullptr, &thirdPartyWindow)) && thirdPartyWindow) {
-        return false;
-      }
-    }
-
-    if (lifetimePolicy == nsICookieService::ACCEPT_SESSION && aStorage) {
-      aStorage->mIsSessionOnly = true;
-    }
-  }
-
   if (aStorage) {
+    aStorage->mIsSessionOnly = access <= nsContentUtils::StorageAccess::eSessionScoped;
+
+    nsCOMPtr<nsIPrincipal> subjectPrincipal =
+      nsContentUtils::SubjectPrincipal();
     return aStorage->CanAccess(subjectPrincipal);
   }
 
@@ -343,7 +298,7 @@ DOMStorage::CanAccess(nsIPrincipal* aPrincipal)
 void
 DOMStorage::GetSupportedNames(unsigned, nsTArray<nsString>& aKeys)
 {
-  if (!CanUseStorage(mWindow, this)) {
+  if (!CanUseStorage(nullptr, this)) {
     // return just an empty array
     aKeys.Clear();
     return;
diff --git a/dom/storage/DOMStorage.h b/dom/storage/DOMStorage.h
index 44a37e42db..711c7fb88c 100644
--- a/dom/storage/DOMStorage.h
+++ b/dom/storage/DOMStorage.h
@@ -18,6 +18,7 @@
 
 class nsIPrincipal;
 class nsIDOMWindow;
+class nsPIDOMWindow;
 
 namespace mozilla {
 namespace dom {
@@ -115,13 +116,14 @@ public:
 
   void Clear(ErrorResult& aRv);
 
-  // This method checks whether the caller can use storage.
+  // The method checks whether the caller can use a storage.
   // CanUseStorage is called before any DOM initiated operation
-  // on storage is about to happen and ensures that the storage's
+  // on a storage is about to happen and ensures that the storage's
   // session-only flag is properly set according the current settings.
-  // It is an optimization, since the privileges check and session-only
-  // state determination are complex and share code (goes hand in hand).
-  static bool CanUseStorage(nsIDOMWindow* aWindow, DOMStorage* aStorage = nullptr);
+  // It is an optimization since the privileges check and session only
+  // state determination are complex and share the code (comes hand in
+  // hand together).
+  static bool CanUseStorage(nsPIDOMWindow* aWindow, DOMStorage* aStorage = nullptr);
 
   bool IsPrivate() const { return mIsPrivate; }
   bool IsSessionOnly() const { return mIsSessionOnly; }
diff --git a/dom/storage/DOMStorageCache.cpp b/dom/storage/DOMStorageCache.cpp
index 61b7d86559..376fe17d13 100644
--- a/dom/storage/DOMStorageCache.cpp
+++ b/dom/storage/DOMStorageCache.cpp
@@ -778,8 +778,11 @@ DOMStorageCache::StartDatabase()
 
     sDatabase = db.forget();
   } else {
+    // Use DOMLocalStorageManager::Ensure in case we're called from
+    // DOMSessionStorageManager's initializer and we haven't yet initialized the
+    // local storage manager.
     RefPtr<DOMStorageDBChild> db = new DOMStorageDBChild(
-        DOMLocalStorageManager::Self());
+        DOMLocalStorageManager::Ensure());
 
     nsresult rv = db->Init();
     if (NS_FAILED(rv)) {
diff --git a/dom/storage/DOMStorageManager.cpp b/dom/storage/DOMStorageManager.cpp
index c378ad413f..1fcba55306 100644
--- a/dom/storage/DOMStorageManager.cpp
+++ b/dom/storage/DOMStorageManager.cpp
@@ -598,6 +598,21 @@ DOMLocalStorageManager::~DOMLocalStorageManager()
   sSelf = nullptr;
 }
 
+DOMLocalStorageManager*
+DOMLocalStorageManager::Ensure()
+{
+  if (sSelf) {
+    return sSelf;
+  }
+
+  // Cause sSelf to be populated.
+  nsCOMPtr<nsIDOMStorageManager> initializer =
+    do_GetService("@mozilla.org/dom/localStorage-manager;1");
+  MOZ_ASSERT(sSelf, "Didn't initialize?");
+
+  return sSelf;
+}
+
 // DOMSessionStorageManager
 
 DOMSessionStorageManager::DOMSessionStorageManager()
diff --git a/dom/storage/DOMStorageManager.h b/dom/storage/DOMStorageManager.h
index 790da014ad..07708fae3a 100644
--- a/dom/storage/DOMStorageManager.h
+++ b/dom/storage/DOMStorageManager.h
@@ -125,6 +125,9 @@ public:
   // Global getter of localStorage manager service
   static DOMLocalStorageManager* Self() { return sSelf; }
 
+  // Like Self, but creates an instance if we're not yet initialized.
+  static DOMLocalStorageManager* Ensure();
+
 private:
   static DOMLocalStorageManager* sSelf;
 };
diff --git a/dom/storage/moz.build b/dom/storage/moz.build
index f78fec6a67..a41a7684ac 100644
--- a/dom/storage/moz.build
+++ b/dom/storage/moz.build
@@ -31,3 +31,6 @@ LOCAL_INCLUDES += [
 
 if CONFIG['ENABLE_TESTS']:
     DEFINES['DOM_STORAGE_TESTS'] = True
+
+if CONFIG['GNU_CXX']:
+    CXXFLAGS += ['-Wshadow']
diff --git a/dom/svg/DOMSVGLengthList.cpp b/dom/svg/DOMSVGLengthList.cpp
index 9caac0c9c3..9d93546d98 100644
--- a/dom/svg/DOMSVGLengthList.cpp
+++ b/dom/svg/DOMSVGLengthList.cpp
@@ -260,6 +260,13 @@ DOMSVGLengthList::InsertItemBefore(DOMSVGLength& newItem,
     error.Throw(NS_ERROR_OUT_OF_MEMORY);
     return nullptr;
   }
+  if (AnimListMirrorsBaseList()) {
+    if (!mAList->mAnimVal->mItems.SetCapacity(
+          mAList->mAnimVal->mItems.Length() + 1, fallible)) {
+      error.Throw(NS_ERROR_OUT_OF_MEMORY);
+      return nullptr;
+    }
+  }
 
   AutoChangeLengthListNotifier notifier(this);
   // Now that we know we're inserting, keep animVal list in sync as necessary.
@@ -370,16 +377,15 @@ DOMSVGLengthList::MaybeInsertNullInAnimValListAt(uint32_t aIndex)
 {
   MOZ_ASSERT(!IsAnimValList(), "call from baseVal to animVal");
 
-  DOMSVGLengthList* animVal = mAList->mAnimVal;
-
-  if (!animVal || mAList->IsAnimating()) {
-    // No animVal list wrapper, or animVal not a clone of baseVal
+  if (!AnimListMirrorsBaseList()) {
     return;
   }
 
+  DOMSVGLengthList* animVal = mAList->mAnimVal;
+
+  MOZ_ASSERT(animVal, "AnimListMirrorsBaseList() promised a non-null animVal");
   MOZ_ASSERT(animVal->mItems.Length() == mItems.Length(),
              "animVal list not in sync!");
-
   MOZ_ALWAYS_TRUE(animVal->mItems.InsertElementAt(aIndex, nullptr, fallible));
 
   UpdateListIndicesFromIndex(animVal->mItems, aIndex + 1);
@@ -390,15 +396,15 @@ DOMSVGLengthList::MaybeRemoveItemFromAnimValListAt(uint32_t aIndex)
 {
   MOZ_ASSERT(!IsAnimValList(), "call from baseVal to animVal");
 
+  if (!AnimListMirrorsBaseList()) {
+    return;
+  }
+
   // This needs to be a strong reference; otherwise, the RemovingFromList call
   // below might drop the last reference to animVal before we're done with it.
   RefPtr<DOMSVGLengthList> animVal = mAList->mAnimVal;
 
-  if (!animVal || mAList->IsAnimating()) {
-    // No animVal list wrapper, or animVal not a clone of baseVal
-    return;
-  }
-
+  MOZ_ASSERT(animVal, "AnimListMirrorsBaseList() promised a non-null animVal");
   MOZ_ASSERT(animVal->mItems.Length() == mItems.Length(),
              "animVal list not in sync!");
 
diff --git a/dom/svg/DOMSVGLengthList.h b/dom/svg/DOMSVGLengthList.h
index 36917c763f..4596cf3732 100644
--- a/dom/svg/DOMSVGLengthList.h
+++ b/dom/svg/DOMSVGLengthList.h
@@ -98,6 +98,12 @@ public:
   bool IsAnimating() const {
     return mAList->IsAnimating();
   }
+  /**
+   * Returns true if there is an animated list mirroring the base list.
+   */
+  bool AnimListMirrorsBaseList() const {
+    return mAList->mAnimVal && !mAList->IsAnimating();
+  }
 
   uint32_t NumberOfItems() const
   {
diff --git a/dom/svg/DOMSVGNumberList.cpp b/dom/svg/DOMSVGNumberList.cpp
index 9de6912361..00fb7ba4d0 100644
--- a/dom/svg/DOMSVGNumberList.cpp
+++ b/dom/svg/DOMSVGNumberList.cpp
@@ -244,6 +244,13 @@ DOMSVGNumberList::InsertItemBefore(DOMSVGNumber& aItem,
     error.Throw(NS_ERROR_OUT_OF_MEMORY);
     return nullptr;
   }
+  if (AnimListMirrorsBaseList()) {
+    if (!mAList->mAnimVal->mItems.SetCapacity(
+          mAList->mAnimVal->mItems.Length() + 1, fallible)) {
+      error.Throw(NS_ERROR_OUT_OF_MEMORY);
+      return nullptr;
+    }
+  }
 
   AutoChangeNumberListNotifier notifier(this);
   // Now that we know we're inserting, keep animVal list in sync as necessary.
@@ -349,16 +356,15 @@ DOMSVGNumberList::MaybeInsertNullInAnimValListAt(uint32_t aIndex)
 {
   MOZ_ASSERT(!IsAnimValList(), "call from baseVal to animVal");
 
-  DOMSVGNumberList* animVal = mAList->mAnimVal;
-
-  if (!animVal || mAList->IsAnimating()) {
-    // No animVal list wrapper, or animVal not a clone of baseVal
+  if (!AnimListMirrorsBaseList()) {
     return;
   }
 
+  DOMSVGNumberList* animVal = mAList->mAnimVal;
+
+  MOZ_ASSERT(animVal, "AnimListMirrorsBaseList() promised a non-null animVal");
   MOZ_ASSERT(animVal->mItems.Length() == mItems.Length(),
              "animVal list not in sync!");
-
   MOZ_ALWAYS_TRUE(animVal->mItems.InsertElementAt(aIndex, nullptr, fallible));
 
   UpdateListIndicesFromIndex(animVal->mItems, aIndex + 1);
@@ -369,15 +375,15 @@ DOMSVGNumberList::MaybeRemoveItemFromAnimValListAt(uint32_t aIndex)
 {
   MOZ_ASSERT(!IsAnimValList(), "call from baseVal to animVal");
 
+  if (!AnimListMirrorsBaseList()) {
+    return;
+  }
+
   // This needs to be a strong reference; otherwise, the RemovingFromList call
   // below might drop the last reference to animVal before we're done with it.
   RefPtr<DOMSVGNumberList> animVal = mAList->mAnimVal;
 
-  if (!animVal || mAList->IsAnimating()) {
-    // No animVal list wrapper, or animVal not a clone of baseVal
-    return;
-  }
-
+  MOZ_ASSERT(animVal, "AnimListMirrorsBaseList() promised a non-null animVal");
   MOZ_ASSERT(animVal->mItems.Length() == mItems.Length(),
              "animVal list not in sync!");
 
diff --git a/dom/svg/DOMSVGNumberList.h b/dom/svg/DOMSVGNumberList.h
index a9610357ee..c7acd4a736 100644
--- a/dom/svg/DOMSVGNumberList.h
+++ b/dom/svg/DOMSVGNumberList.h
@@ -98,6 +98,12 @@ public:
   bool IsAnimating() const {
     return mAList->IsAnimating();
   }
+  /**
+   * Returns true if there is an animated list mirroring the base list.
+   */
+  bool AnimListMirrorsBaseList() const {
+    return mAList->mAnimVal && !mAList->IsAnimating();
+  }
 
   uint32_t NumberOfItems() const
   {
diff --git a/dom/svg/DOMSVGPathSegList.cpp b/dom/svg/DOMSVGPathSegList.cpp
index 42ba281cfd..52c5b85d55 100644
--- a/dom/svg/DOMSVGPathSegList.cpp
+++ b/dom/svg/DOMSVGPathSegList.cpp
@@ -242,6 +242,13 @@ DOMSVGPathSegList::AttrIsAnimating() const
   return InternalAList().IsAnimating();
 }
 
+bool
+DOMSVGPathSegList::AnimListMirrorsBaseList() const
+{
+  return GetDOMWrapperIfExists(InternalAList().GetAnimValKey()) &&
+           !AttrIsAnimating();
+}
+ 
 SVGPathData&
 DOMSVGPathSegList::InternalList() const
 {
@@ -375,6 +382,15 @@ DOMSVGPathSegList::InsertItemBefore(DOMSVGPathSeg& aNewItem,
     aError.Throw(NS_ERROR_OUT_OF_MEMORY);
     return nullptr;
   }
+  if (AnimListMirrorsBaseList()) {
+    DOMSVGPathSegList *animVal =
+      GetDOMWrapperIfExists(InternalAList().GetAnimValKey());
+    if (!animVal->mItems.SetCapacity(
+          animVal->mItems.Length() + 1, fallible)) {
+      aError.Throw(NS_ERROR_OUT_OF_MEMORY);
+      return nullptr;
+    }
+  }
 
   AutoChangePathSegListNotifier notifier(this);
   // Now that we know we're inserting, keep animVal list in sync as necessary.
@@ -526,22 +542,17 @@ DOMSVGPathSegList::
 {
   MOZ_ASSERT(!IsAnimValList(), "call from baseVal to animVal");
 
-  if (AttrIsAnimating()) {
-    // animVal not a clone of baseVal
+  if (!AnimListMirrorsBaseList()) {
     return;
   }
 
   // The anim val list is in sync with the base val list
   DOMSVGPathSegList *animVal =
     GetDOMWrapperIfExists(InternalAList().GetAnimValKey());
-  if (!animVal) {
-    // No animVal list wrapper
-    return;
-  }
 
+  MOZ_ASSERT(animVal, "AnimListMirrorsBaseList() promised a non-null animVal");
   MOZ_ASSERT(animVal->mItems.Length() == mItems.Length(),
              "animVal list not in sync!");
-
   MOZ_ALWAYS_TRUE(animVal->mItems.InsertElementAt(aIndex,
                                                   ItemProxy(nullptr,
                                                             aInternalIndex),
@@ -557,8 +568,7 @@ DOMSVGPathSegList::
 {
   MOZ_ASSERT(!IsAnimValList(), "call from baseVal to animVal");
 
-  if (AttrIsAnimating()) {
-    // animVal not a clone of baseVal
+  if (!AnimListMirrorsBaseList()) {
     return;
   }
 
@@ -566,11 +576,8 @@ DOMSVGPathSegList::
   // below might drop the last reference to animVal before we're done with it.
   RefPtr<DOMSVGPathSegList> animVal =
     GetDOMWrapperIfExists(InternalAList().GetAnimValKey());
-  if (!animVal) {
-    // No animVal list wrapper
-    return;
-  }
 
+  MOZ_ASSERT(animVal, "AnimListMirrorsBaseList() promised a non-null animVal");
   MOZ_ASSERT(animVal->mItems.Length() == mItems.Length(),
              "animVal list not in sync!");
 
diff --git a/dom/svg/DOMSVGPathSegList.h b/dom/svg/DOMSVGPathSegList.h
index 262860270e..5d8bf660d6 100644
--- a/dom/svg/DOMSVGPathSegList.h
+++ b/dom/svg/DOMSVGPathSegList.h
@@ -128,6 +128,10 @@ public:
    * not simply a mirror of our baseVal).
    */
   bool AttrIsAnimating() const;
+  /**
+   * Returns true if there is an animated list mirroring the base list.
+   */
+  bool AnimListMirrorsBaseList() const;
 
   uint32_t NumberOfItems() const
   {
diff --git a/dom/svg/DOMSVGPointList.cpp b/dom/svg/DOMSVGPointList.cpp
index a16ea4658b..6efe2c2171 100644
--- a/dom/svg/DOMSVGPointList.cpp
+++ b/dom/svg/DOMSVGPointList.cpp
@@ -185,6 +185,13 @@ DOMSVGPointList::AttrIsAnimating() const
   return InternalAList().IsAnimating();
 }
 
+bool
+DOMSVGPointList::AnimListMirrorsBaseList() const
+{
+  return GetDOMWrapperIfExists(InternalAList().GetAnimValKey()) &&
+           !AttrIsAnimating();
+}
+
 SVGPointList&
 DOMSVGPointList::InternalList() const
 {
@@ -311,6 +318,15 @@ DOMSVGPointList::InsertItemBefore(nsISVGPoint& aNewItem, uint32_t aIndex,
     aError.Throw(NS_ERROR_OUT_OF_MEMORY);
     return nullptr;
   }
+  if (AnimListMirrorsBaseList()) {
+    DOMSVGPointList *animVal =
+      GetDOMWrapperIfExists(InternalAList().GetAnimValKey());
+    if (!animVal->mItems.SetCapacity(
+          animVal->mItems.Length() + 1, fallible)) {
+      aError.Throw(NS_ERROR_OUT_OF_MEMORY);
+      return nullptr;
+    }
+  }
 
   AutoChangePointListNotifier notifier(this);
   // Now that we know we're inserting, keep animVal list in sync as necessary.
@@ -417,22 +433,17 @@ DOMSVGPointList::MaybeInsertNullInAnimValListAt(uint32_t aIndex)
 {
   MOZ_ASSERT(!IsAnimValList(), "call from baseVal to animVal");
 
-  if (AttrIsAnimating()) {
-    // animVal not a clone of baseVal
+  if (!AnimListMirrorsBaseList()) {
     return;
   }
 
   // The anim val list is in sync with the base val list
   DOMSVGPointList *animVal =
     GetDOMWrapperIfExists(InternalAList().GetAnimValKey());
-  if (!animVal) {
-    // No animVal list wrapper
-    return;
-  }
 
+  MOZ_ASSERT(animVal, "AnimListMirrorsBaseList() promised a non-null animVal");
   MOZ_ASSERT(animVal->mItems.Length() == mItems.Length(),
              "animVal list not in sync!");
-
   MOZ_ALWAYS_TRUE(animVal->mItems.InsertElementAt(aIndex, nullptr, fallible));
 
   UpdateListIndicesFromIndex(animVal->mItems, aIndex + 1);
@@ -443,8 +454,7 @@ DOMSVGPointList::MaybeRemoveItemFromAnimValListAt(uint32_t aIndex)
 {
   MOZ_ASSERT(!IsAnimValList(), "call from baseVal to animVal");
 
-  if (AttrIsAnimating()) {
-    // animVal not a clone of baseVal
+  if (!AnimListMirrorsBaseList()) {
     return;
   }
 
@@ -452,11 +462,8 @@ DOMSVGPointList::MaybeRemoveItemFromAnimValListAt(uint32_t aIndex)
   // below might drop the last reference to animVal before we're done with it.
   RefPtr<DOMSVGPointList> animVal =
     GetDOMWrapperIfExists(InternalAList().GetAnimValKey());
-  if (!animVal) {
-    // No animVal list wrapper
-    return;
-  }
 
+  MOZ_ASSERT(animVal, "AnimListMirrorsBaseList() promised a non-null animVal");
   MOZ_ASSERT(animVal->mItems.Length() == mItems.Length(),
              "animVal list not in sync!");
 
diff --git a/dom/svg/DOMSVGPointList.h b/dom/svg/DOMSVGPointList.h
index 26b206ea29..e88204d9f0 100644
--- a/dom/svg/DOMSVGPointList.h
+++ b/dom/svg/DOMSVGPointList.h
@@ -130,6 +130,10 @@ public:
    * not simply a mirror of our baseVal).
    */
   bool AttrIsAnimating() const;
+  /**
+   * Returns true if there is an animated list mirroring the base list.
+   */
+  bool AnimListMirrorsBaseList() const;
 
   uint32_t NumberOfItems() const
   {
diff --git a/dom/svg/DOMSVGTransformList.cpp b/dom/svg/DOMSVGTransformList.cpp
index d0abd69ce9..30760bc6d1 100644
--- a/dom/svg/DOMSVGTransformList.cpp
+++ b/dom/svg/DOMSVGTransformList.cpp
@@ -252,6 +252,13 @@ DOMSVGTransformList::InsertItemBefore(SVGTransform& newItem,
     error.Throw(NS_ERROR_OUT_OF_MEMORY);
     return nullptr;
   }
+  if (AnimListMirrorsBaseList()) {
+    if (!mAList->mAnimVal->mItems.SetCapacity(
+          mAList->mAnimVal->mItems.Length() + 1, fallible)) {
+      error.Throw(NS_ERROR_OUT_OF_MEMORY);
+      return nullptr;
+    }
+  }
 
   AutoChangeTransformListNotifier notifier(this);
   // Now that we know we're inserting, keep animVal list in sync as necessary.
@@ -396,16 +403,15 @@ DOMSVGTransformList::MaybeInsertNullInAnimValListAt(uint32_t aIndex)
 {
   MOZ_ASSERT(!IsAnimValList(), "call from baseVal to animVal");
 
-  DOMSVGTransformList* animVal = mAList->mAnimVal;
-
-  if (!animVal || mAList->IsAnimating()) {
-    // No animVal list wrapper, or animVal not a clone of baseVal
+  if (!AnimListMirrorsBaseList()) {
     return;
   }
 
+  DOMSVGTransformList* animVal = mAList->mAnimVal;
+
+  MOZ_ASSERT(animVal, "AnimListMirrorsBaseList() promised a non-null animVal");
   MOZ_ASSERT(animVal->mItems.Length() == mItems.Length(),
              "animVal list not in sync!");
-
   MOZ_ALWAYS_TRUE(animVal->mItems.InsertElementAt(aIndex, nullptr, fallible));
 
   UpdateListIndicesFromIndex(animVal->mItems, aIndex + 1);
@@ -416,15 +422,15 @@ DOMSVGTransformList::MaybeRemoveItemFromAnimValListAt(uint32_t aIndex)
 {
   MOZ_ASSERT(!IsAnimValList(), "call from baseVal to animVal");
 
+  if (!AnimListMirrorsBaseList()) {
+    return;
+  }
+
   // This needs to be a strong reference; otherwise, the RemovingFromList call
   // below might drop the last reference to animVal before we're done with it.
   RefPtr<DOMSVGTransformList> animVal = mAList->mAnimVal;
 
-  if (!animVal || mAList->IsAnimating()) {
-    // No animVal list wrapper, or animVal not a clone of baseVal
-    return;
-  }
-
+  MOZ_ASSERT(animVal, "AnimListMirrorsBaseList() promised a non-null animVal");
   MOZ_ASSERT(animVal->mItems.Length() == mItems.Length(),
              "animVal list not in sync!");
 
diff --git a/dom/svg/DOMSVGTransformList.h b/dom/svg/DOMSVGTransformList.h
index 46dbc5e153..b9ca71f70a 100644
--- a/dom/svg/DOMSVGTransformList.h
+++ b/dom/svg/DOMSVGTransformList.h
@@ -91,6 +91,12 @@ public:
   bool IsAnimating() const {
     return mAList->IsAnimating();
   }
+  /**
+   * Returns true if there is an animated list mirroring the base list.
+   */
+  bool AnimListMirrorsBaseList() const {
+    return mAList->mAnimVal && !mAList->IsAnimating();
+  }
 
   uint32_t NumberOfItems() const
   {
diff --git a/dom/svg/SVGCircleElement.cpp b/dom/svg/SVGCircleElement.cpp
index 9a39f213ac..2ff6703777 100644
--- a/dom/svg/SVGCircleElement.cpp
+++ b/dom/svg/SVGCircleElement.cpp
@@ -83,26 +83,39 @@ SVGCircleElement::GetLengthInfo()
 // nsSVGPathGeometryElement methods
 
 bool
-SVGCircleElement::GetGeometryBounds(
-  Rect* aBounds, const StrokeOptions& aStrokeOptions, const Matrix& aTransform)
+SVGCircleElement::GetGeometryBounds(Rect* aBounds,
+                                    const StrokeOptions& aStrokeOptions,
+                                    const Matrix& aToBoundsSpace,
+                                    const Matrix* aToNonScalingStrokeSpace)
 {
   float x, y, r;
   GetAnimatedLengthValues(&x, &y, &r, nullptr);
 
   if (r <= 0.f) {
     // Rendering of the element is disabled
-    *aBounds = Rect(aTransform * Point(x, y), Size());
+    *aBounds = Rect(aToBoundsSpace * Point(x, y), Size());
     return true;
   }
 
-  if (aTransform.IsRectilinear()) {
+  if (aToBoundsSpace.IsRectilinear()) {
     // Optimize the case where we can treat the circle as a rectangle and
     // still get tight bounds.
     if (aStrokeOptions.mLineWidth > 0.f) {
+      if (aToNonScalingStrokeSpace) {
+        if (aToNonScalingStrokeSpace->IsRectilinear()) {
+          MOZ_ASSERT(!aToNonScalingStrokeSpace->IsSingular());
+          Rect userBounds(x - r, y - r, 2 * r, 2 * r);
+          SVGContentUtils::RectilinearGetStrokeBounds(
+            userBounds, aToBoundsSpace, *aToNonScalingStrokeSpace,
+            aStrokeOptions.mLineWidth, aBounds);
+          return true;
+        }
+        return false;
+      }
       r += aStrokeOptions.mLineWidth / 2.f;
     }
     Rect rect(x - r, y - r, 2 * r, 2 * r);
-    *aBounds = aTransform.TransformBounds(rect);
+    *aBounds = aToBoundsSpace.TransformBounds(rect);
     return true;
   }
 
diff --git a/dom/svg/SVGCircleElement.h b/dom/svg/SVGCircleElement.h
index d0968a7eca..ff7bfe9024 100644
--- a/dom/svg/SVGCircleElement.h
+++ b/dom/svg/SVGCircleElement.h
@@ -32,7 +32,8 @@ public:
 
   // nsSVGPathGeometryElement methods:
   virtual bool GetGeometryBounds(Rect* aBounds, const StrokeOptions& aStrokeOptions,
-                                 const Matrix& aTransform) override;
+                                 const Matrix& aToBoundsSpace,
+                                 const Matrix* aToNonScalingStrokeSpace = nullptr) override;
   virtual already_AddRefed<Path> BuildPath(PathBuilder* aBuilder) override;
 
   virtual nsresult Clone(mozilla::dom::NodeInfo *aNodeInfo, nsINode **aResult) const override;
diff --git a/dom/svg/SVGContentUtils.cpp b/dom/svg/SVGContentUtils.cpp
index f2dacec7ef..6fab226870 100644
--- a/dom/svg/SVGContentUtils.cpp
+++ b/dom/svg/SVGContentUtils.cpp
@@ -219,16 +219,21 @@ SVGContentUtils::GetStrokeOptions(AutoStrokeOptions* aStrokeOptions,
     break;
   }
 
-  switch (styleSVG->mStrokeLinecap) {
-  case NS_STYLE_STROKE_LINECAP_BUTT:
+  if (ShapeTypeHasNoCorners(aElement)) {
     aStrokeOptions->mLineCap = CapStyle::BUTT;
-    break;
-  case NS_STYLE_STROKE_LINECAP_ROUND:
-    aStrokeOptions->mLineCap = CapStyle::ROUND;
-    break;
-  case NS_STYLE_STROKE_LINECAP_SQUARE:
-    aStrokeOptions->mLineCap = CapStyle::SQUARE;
-    break;
+  }
+  else {
+    switch (styleSVG->mStrokeLinecap) {
+      case NS_STYLE_STROKE_LINECAP_BUTT:
+        aStrokeOptions->mLineCap = CapStyle::BUTT;
+        break;
+      case NS_STYLE_STROKE_LINECAP_ROUND:
+        aStrokeOptions->mLineCap = CapStyle::ROUND;
+        break;
+      case NS_STYLE_STROKE_LINECAP_SQUARE:
+        aStrokeOptions->mLineCap = CapStyle::SQUARE;
+        break;
+    }
   }
 }
 
@@ -458,6 +463,45 @@ SVGContentUtils::GetCTM(nsSVGElement *aElement, bool aScreenCTM)
   return GetCTMInternal(aElement, aScreenCTM, false);
 }
 
+void
+SVGContentUtils::RectilinearGetStrokeBounds(const Rect& aRect,
+                                            const Matrix& aToBoundsSpace,
+                                            const Matrix& aToNonScalingStrokeSpace,
+                                            float aStrokeWidth,
+                                            Rect* aBounds)
+{
+  MOZ_ASSERT(aToBoundsSpace.IsRectilinear(),
+             "aToBoundsSpace must be rectilinear");
+  MOZ_ASSERT(aToNonScalingStrokeSpace.IsRectilinear(),
+             "aToNonScalingStrokeSpace must be rectilinear");
+
+  Matrix nonScalingToSource = aToNonScalingStrokeSpace.Inverse();
+  Matrix nonScalingToBounds = nonScalingToSource * aToBoundsSpace;
+
+  *aBounds = aToBoundsSpace.TransformBounds(aRect);
+
+  // Compute the amounts dx and dy that nonScalingToBounds scales a half-width
+  // stroke in the x and y directions, and then inflate aBounds by those amounts
+  // so that when aBounds is transformed back to non-scaling-stroke space
+  // it will map onto the correct stroked bounds.
+
+  Float dx = 0.0f;
+  Float dy = 0.0f;
+  // nonScalingToBounds is rectilinear, so either _12 and _21 are zero or _11
+  // and _22 are zero, and in each case the non-zero entries (from among _11,
+  // _12, _21, _22) simply scale the stroke width in the x and y directions.
+  if (FuzzyEqual(nonScalingToBounds._12, 0) &&
+      FuzzyEqual(nonScalingToBounds._21, 0)) {
+    dx = (aStrokeWidth / 2.0f) * std::abs(nonScalingToBounds._11);
+    dy = (aStrokeWidth / 2.0f) * std::abs(nonScalingToBounds._22);
+  } else {
+    dx = (aStrokeWidth / 2.0f) * std::abs(nonScalingToBounds._21);
+    dy = (aStrokeWidth / 2.0f) * std::abs(nonScalingToBounds._12);
+  }
+
+  aBounds->Inflate(dx, dy);
+}
+
 double
 SVGContentUtils::ComputeNormalizedHypotenuse(double aWidth, double aHeight)
 {
@@ -807,3 +851,9 @@ SVGContentUtils::GetPath(const nsAString& aPathString)
 
   return pathData.BuildPath(builder, NS_STYLE_STROKE_LINECAP_BUTT, 1);
 }
+
+bool
+SVGContentUtils::ShapeTypeHasNoCorners(const nsIContent* aContent) {
+  return aContent && aContent->IsAnyOfSVGElements(nsGkAtoms::circle,
+                                                  nsGkAtoms::ellipse);
+}
diff --git a/dom/svg/SVGContentUtils.h b/dom/svg/SVGContentUtils.h
index 1fad58b0d0..2136c5e6e7 100644
--- a/dom/svg/SVGContentUtils.h
+++ b/dom/svg/SVGContentUtils.h
@@ -39,6 +39,8 @@ class Matrix;
 } // namespace gfx
 } // namespace mozilla
 
+#define SVG_ZERO_LENGTH_PATH_FIX_FACTOR 512
+
 inline bool
 IsSVGWhitespace(char aChar)
 {
@@ -61,6 +63,8 @@ class SVGContentUtils
 {
 public:
   typedef mozilla::gfx::Float Float;
+  typedef mozilla::gfx::Matrix Matrix;
+  typedef mozilla::gfx::Rect Rect;
   typedef mozilla::gfx::StrokeOptions StrokeOptions;
   typedef mozilla::SVGAnimatedPreserveAspectRatio SVGAnimatedPreserveAspectRatio;
   typedef mozilla::SVGPreserveAspectRatio SVGPreserveAspectRatio;
@@ -178,7 +182,23 @@ public:
                                   const char16_t **aParams,
                                   uint32_t aParamsLength);
 
-  static mozilla::gfx::Matrix GetCTM(nsSVGElement *aElement, bool aScreenCTM);
+  static Matrix GetCTM(nsSVGElement *aElement, bool aScreenCTM);
+
+  /**
+   * Gets the tight bounds-space stroke bounds of the non-scaling-stroked rect
+   * aRect.
+   * @param aToBoundsSpace transforms from source space to the space aBounds
+   *        should be computed in.  Must be rectilinear.
+   * @param aToNonScalingStrokeSpace transforms from source
+   *        space to the space in which non-scaling stroke should be applied.
+   *        Must be rectilinear.
+   */
+  static void
+  RectilinearGetStrokeBounds(const Rect& aRect,
+                             const Matrix& aToBoundsSpace,
+                             const Matrix& aToNonScalingStrokeSpace,
+                             float aStrokeWidth,
+                             Rect* aBounds);
 
   /**
    * Check if this is one of the SVG elements that SVG 1.1 Full says
@@ -203,13 +223,13 @@ public:
 
   /* Generate a viewbox to viewport tranformation matrix */
 
-  static mozilla::gfx::Matrix
+  static Matrix
   GetViewBoxTransform(float aViewportWidth, float aViewportHeight,
                       float aViewboxX, float aViewboxY,
                       float aViewboxWidth, float aViewboxHeight,
                       const SVGAnimatedPreserveAspectRatio &aPreserveAspectRatio);
 
-  static mozilla::gfx::Matrix
+  static Matrix
   GetViewBoxTransform(float aViewportWidth, float aViewportHeight,
                       float aViewboxX, float aViewboxY,
                       float aViewboxWidth, float aViewboxHeight,
@@ -323,6 +343,12 @@ public:
    */
   static already_AddRefed<mozilla::gfx::Path>
   GetPath(const nsAString& aPathString);
+
+  /**
+   *  Returns true if aContent is one of the elements whose stroke is guaranteed
+   *  to have no corners: circle or ellipse
+   */
+  static bool ShapeTypeHasNoCorners(const nsIContent* aContent);
 };
 
 #endif
diff --git a/dom/svg/SVGEllipseElement.cpp b/dom/svg/SVGEllipseElement.cpp
index e0e5c9bb55..47adbf1577 100644
--- a/dom/svg/SVGEllipseElement.cpp
+++ b/dom/svg/SVGEllipseElement.cpp
@@ -94,27 +94,40 @@ SVGEllipseElement::GetLengthInfo()
 // nsSVGPathGeometryElement methods
 
 bool
-SVGEllipseElement::GetGeometryBounds(
-  Rect* aBounds, const StrokeOptions& aStrokeOptions, const Matrix& aTransform)
+SVGEllipseElement::GetGeometryBounds(Rect* aBounds,
+                                     const StrokeOptions& aStrokeOptions,
+                                     const Matrix& aToBoundsSpace,
+                                     const Matrix* aToNonScalingStrokeSpace)
 {
   float x, y, rx, ry;
   GetAnimatedLengthValues(&x, &y, &rx, &ry, nullptr);
 
   if (rx <= 0.f || ry <= 0.f) {
     // Rendering of the element is disabled
-    *aBounds = Rect(aTransform * Point(x, y), Size());
+    *aBounds = Rect(aToBoundsSpace * Point(x, y), Size());
     return true;
   }
 
-  if (aTransform.IsRectilinear()) {
+  if (aToBoundsSpace.IsRectilinear()) {
     // Optimize the case where we can treat the ellipse as a rectangle and
     // still get tight bounds.
     if (aStrokeOptions.mLineWidth > 0.f) {
+      if (aToNonScalingStrokeSpace) {
+        if (aToNonScalingStrokeSpace->IsRectilinear()) {
+          MOZ_ASSERT(!aToNonScalingStrokeSpace->IsSingular());
+          Rect userBounds(x - rx, y - ry, 2 * rx, 2 * ry);
+          SVGContentUtils::RectilinearGetStrokeBounds(
+            userBounds, aToBoundsSpace, *aToNonScalingStrokeSpace,
+            aStrokeOptions.mLineWidth, aBounds);
+          return true;
+        }
+        return false;
+      }
       rx += aStrokeOptions.mLineWidth / 2.f;
       ry += aStrokeOptions.mLineWidth / 2.f;
     }
     Rect rect(x - rx, y - ry, 2 * rx, 2 * ry);
-    *aBounds = aTransform.TransformBounds(rect);
+    *aBounds = aToBoundsSpace.TransformBounds(rect);
     return true;
   }
 
diff --git a/dom/svg/SVGEllipseElement.h b/dom/svg/SVGEllipseElement.h
index b9efe7f9bf..27c132fd96 100644
--- a/dom/svg/SVGEllipseElement.h
+++ b/dom/svg/SVGEllipseElement.h
@@ -32,7 +32,8 @@ public:
 
   // nsSVGPathGeometryElement methods:
   virtual bool GetGeometryBounds(Rect* aBounds, const StrokeOptions& aStrokeOptions,
-                                 const Matrix& aTransform) override;
+                                 const Matrix& aToBoundsSpace,
+                                 const Matrix* aToNonScalingStrokeSpace = nullptr) override;
   virtual already_AddRefed<Path> BuildPath(PathBuilder* aBuilder) override;
 
   virtual nsresult Clone(mozilla::dom::NodeInfo *aNodeInfo, nsINode **aResult) const override;
diff --git a/dom/svg/SVGImageElement.cpp b/dom/svg/SVGImageElement.cpp
index b05a756703..a2224e326d 100644
--- a/dom/svg/SVGImageElement.cpp
+++ b/dom/svg/SVGImageElement.cpp
@@ -226,8 +226,10 @@ SVGImageElement::IsAttributeMapped(const nsIAtom* name) const
 /* For the purposes of the update/invalidation logic pretend to
    be a rectangle. */
 bool
-SVGImageElement::GetGeometryBounds(
-  Rect* aBounds, const StrokeOptions& aStrokeOptions, const Matrix& aTransform)
+SVGImageElement::GetGeometryBounds(Rect* aBounds,
+                                   const StrokeOptions& aStrokeOptions,
+                                   const Matrix& aToBoundsSpace,
+                                   const Matrix* aToNonScalingStrokeSpace)
 {
   Rect rect;
   GetAnimatedLengthValues(&rect.x, &rect.y, &rect.width,
@@ -238,7 +240,7 @@ SVGImageElement::GetGeometryBounds(
     rect.SetEmpty(); // Make sure width/height are zero and not negative
   }
 
-  *aBounds = aTransform.TransformBounds(rect);
+  *aBounds = aToBoundsSpace.TransformBounds(rect);
   return true;
 }
 
diff --git a/dom/svg/SVGImageElement.h b/dom/svg/SVGImageElement.h
index 2df2310679..687320de69 100644
--- a/dom/svg/SVGImageElement.h
+++ b/dom/svg/SVGImageElement.h
@@ -55,7 +55,8 @@ public:
 
   // nsSVGPathGeometryElement methods:
   virtual bool GetGeometryBounds(Rect* aBounds, const StrokeOptions& aStrokeOptions,
-                                 const Matrix& aTransform) override;
+                                 const Matrix& aToBoundsSpace,
+                                 const Matrix* aToNonScalingStrokeSpace = nullptr) override;
   virtual already_AddRefed<Path> BuildPath(PathBuilder* aBuilder) override;
 
   // nsSVGSVGElement methods:
diff --git a/dom/svg/SVGLineElement.cpp b/dom/svg/SVGLineElement.cpp
index 7fc6a879ee..123af3c564 100644
--- a/dom/svg/SVGLineElement.cpp
+++ b/dom/svg/SVGLineElement.cpp
@@ -37,6 +37,23 @@ SVGLineElement::SVGLineElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeIn
 {
 }
 
+void
+SVGLineElement::MaybeAdjustForZeroLength(float aX1, float aY1,
+                                         float& aX2, float aY2)
+{
+  if (aX1 == aX2 && aY1 == aY2) {
+    SVGContentUtils::AutoStrokeOptions strokeOptions;
+    SVGContentUtils::GetStrokeOptions(&strokeOptions, this, nullptr, nullptr,
+                                      SVGContentUtils::eIgnoreStrokeDashing);
+
+    if (strokeOptions.mLineCap != CapStyle::BUTT) {
+      float tinyLength =
+        strokeOptions.mLineWidth / SVG_ZERO_LENGTH_PATH_FIX_FACTOR;
+      aX2 += tinyLength;
+    }
+  }
+}
+
 //----------------------------------------------------------------------
 // nsIDOMNode methods
 
@@ -112,6 +129,8 @@ SVGLineElement::GetAsSimplePath(SimplePath* aSimplePath)
 {
   float x1, y1, x2, y2;
   GetAnimatedLengthValues(&x1, &y1, &x2, &y2, nullptr);
+
+  MaybeAdjustForZeroLength(x1, y1, x2, y2);
   aSimplePath->SetLine(x1, y1, x2, y2);
 }
 
@@ -121,6 +140,7 @@ SVGLineElement::BuildPath(PathBuilder* aBuilder)
   float x1, y1, x2, y2;
   GetAnimatedLengthValues(&x1, &y1, &x2, &y2, nullptr);
 
+  MaybeAdjustForZeroLength(x1, y1, x2, y2);
   aBuilder->MoveTo(Point(x1, y1));
   aBuilder->LineTo(Point(x2, y2));
 
@@ -128,33 +148,68 @@ SVGLineElement::BuildPath(PathBuilder* aBuilder)
 }
 
 bool
-SVGLineElement::GetGeometryBounds(
-  Rect* aBounds, const StrokeOptions& aStrokeOptions, const Matrix& aTransform)
+SVGLineElement::GetGeometryBounds(Rect* aBounds,
+                                  const StrokeOptions& aStrokeOptions,
+                                  const Matrix& aToBoundsSpace,
+                                  const Matrix* aToNonScalingStrokeSpace)
 {
   float x1, y1, x2, y2;
   GetAnimatedLengthValues(&x1, &y1, &x2, &y2, nullptr);
 
   if (aStrokeOptions.mLineWidth <= 0) {
-    *aBounds = Rect(aTransform * Point(x1, y1), Size());
-    aBounds->ExpandToEnclose(aTransform * Point(x2, y2));
+    *aBounds = Rect(aToBoundsSpace * Point(x1, y1), Size());
+    aBounds->ExpandToEnclose(aToBoundsSpace * Point(x2, y2));
     return true;
   }
 
+  // transform from non-scaling-stroke space to the space in which we compute
+  // bounds
+  Matrix nonScalingToBounds;
+  if (aToNonScalingStrokeSpace) {
+    MOZ_ASSERT(!aToNonScalingStrokeSpace->IsSingular());
+    Matrix nonScalingToUser = aToNonScalingStrokeSpace->Inverse();
+    nonScalingToBounds = nonScalingToUser * aToBoundsSpace;
+  }
+
   if (aStrokeOptions.mLineCap == CapStyle::ROUND) {
-    if (!aTransform.IsRectilinear()) {
+    if (!aToBoundsSpace.IsRectilinear() ||
+        (aToNonScalingStrokeSpace &&
+         !aToNonScalingStrokeSpace->IsRectilinear())) {
       // TODO: handle this case.
       return false;
     }
     Rect bounds(Point(x1, y1), Size());
     bounds.ExpandToEnclose(Point(x2, y2));
-    bounds.Inflate(aStrokeOptions.mLineWidth / 2.f);
-    *aBounds = aTransform.TransformBounds(bounds);
+    if (aToNonScalingStrokeSpace) {
+      bounds = aToNonScalingStrokeSpace->TransformBounds(bounds);
+      bounds.Inflate(aStrokeOptions.mLineWidth / 2.f);
+      *aBounds = nonScalingToBounds.TransformBounds(bounds);
+    } else {
+      bounds.Inflate(aStrokeOptions.mLineWidth / 2.f);
+      *aBounds = aToBoundsSpace.TransformBounds(bounds);
+    }
     return true;
   }
 
+  // Handle butt and square linecap, normal and non-scaling stroke cases
+  // together: start with endpoints (x1, y1), (x2, y2) in the stroke space,
+  // compute the four corners of the stroked line, transform the corners to
+  // bounds space, and compute bounds there.
+
+  if (aToNonScalingStrokeSpace) {
+    Point nonScalingSpaceP1, nonScalingSpaceP2;
+    nonScalingSpaceP1 = *aToNonScalingStrokeSpace * Point(x1, y1);
+    nonScalingSpaceP2 = *aToNonScalingStrokeSpace * Point(x2, y2);
+    x1 = nonScalingSpaceP1.x;
+    y1 = nonScalingSpaceP1.y;
+    x2 = nonScalingSpaceP2.x;
+    y2 = nonScalingSpaceP2.y;
+  }
+
   Float length = Float(NS_hypot(x2 - x1, y2 - y1));
   Float xDelta;
   Float yDelta;
+  Point points[4];
 
   if (aStrokeOptions.mLineCap == CapStyle::BUTT) {
     if (length == 0.f) {
@@ -164,27 +219,37 @@ SVGLineElement::GetGeometryBounds(
       xDelta = ratio * (y2 - y1);
       yDelta = ratio * (x2 - x1);
     }
+    points[0] = Point(x1 - xDelta, y1 + yDelta);
+    points[1] = Point(x1 + xDelta, y1 - yDelta);
+    points[2] = Point(x2 + xDelta, y2 - yDelta);
+    points[3] = Point(x2 - xDelta, y2 + yDelta);
   } else {
     MOZ_ASSERT(aStrokeOptions.mLineCap == CapStyle::SQUARE);
     if (length == 0.f) {
       xDelta = yDelta = aStrokeOptions.mLineWidth / 2.f;
+      points[0] = Point(x1 - xDelta, y1 + yDelta);
+      points[1] = Point(x1 - xDelta, y1 - yDelta);
+      points[2] = Point(x1 + xDelta, y1 - yDelta);
+      points[3] = Point(x1 + xDelta, y1 + yDelta);
     } else {
       Float ratio = aStrokeOptions.mLineWidth / 2.f / length;
-      xDelta = yDelta = ratio * (fabs(y2 - y1) + fabs(x2 - x1));
+      yDelta = ratio * (x2 - x1);
+      xDelta = ratio * (y2 - y1);
+      points[0] = Point(x1 - yDelta - xDelta, y1 - xDelta + yDelta);
+      points[1] = Point(x1 - yDelta + xDelta, y1 - xDelta - yDelta);
+      points[2] = Point(x2 + yDelta + xDelta, y2 + xDelta - yDelta);
+      points[3] = Point(x2 + yDelta - xDelta, y2 + xDelta + yDelta);
     }
   }
 
-  Point points[4];
+  const Matrix& toBoundsSpace = aToNonScalingStrokeSpace ?
+    nonScalingToBounds : aToBoundsSpace;
 
-  points[0] = Point(x1 - xDelta, y1 - yDelta);
-  points[1] = Point(x1 + xDelta, y1 + yDelta);
-  points[2] = Point(x2 + xDelta, y2 + yDelta);
-  points[3] = Point(x2 - xDelta, y2 - yDelta);
-
-  *aBounds = Rect(aTransform * points[0], Size());
+  *aBounds = Rect(toBoundsSpace * points[0], Size());
   for (uint32_t i = 1; i < 4; ++i) {
-    aBounds->ExpandToEnclose(aTransform * points[i]);
+    aBounds->ExpandToEnclose(toBoundsSpace * points[i]);
   }
+
   return true;
 }
 
diff --git a/dom/svg/SVGLineElement.h b/dom/svg/SVGLineElement.h
index f80cd5cb57..f2bafa4a36 100644
--- a/dom/svg/SVGLineElement.h
+++ b/dom/svg/SVGLineElement.h
@@ -25,6 +25,10 @@ protected:
   virtual JSObject* WrapNode(JSContext *cx, JS::Handle<JSObject*> aGivenProto) override;
   friend nsresult (::NS_NewSVGLineElement(nsIContent **aResult,
                                           already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo));
+  // If the input line has length zero and linecaps aren't butt, adjust |aX2| by
+  // a tiny amount to a barely-nonzero-length line that all of our draw targets
+  // will render
+  void MaybeAdjustForZeroLength(float aX1, float aY1, float& aX2, float aY2);
 
 public:
   // nsIContent interface
@@ -36,7 +40,8 @@ public:
   virtual void GetAsSimplePath(SimplePath* aSimplePath) override;
   virtual already_AddRefed<Path> BuildPath(PathBuilder* aBuilder) override;
   virtual bool GetGeometryBounds(Rect* aBounds, const StrokeOptions& aStrokeOptions,
-                                 const Matrix& aTransform) override;
+                                 const Matrix& aToBoundsSpace,
+                                 const Matrix* aToNonScalingStrokeSpace = nullptr) override;
 
   virtual nsresult Clone(mozilla::dom::NodeInfo *aNodeInfo, nsINode **aResult) const override;
 
diff --git a/dom/svg/SVGPathData.cpp b/dom/svg/SVGPathData.cpp
index 2294eb4509..2020798b4f 100644
--- a/dom/svg/SVGPathData.cpp
+++ b/dom/svg/SVGPathData.cpp
@@ -255,7 +255,7 @@ ApproximateZeroLengthSubpathSquareCaps(PathBuilder* aPB,
   // line is rather arbitrary, other than being chosen to meet the requirements
   // described in the comment above.
 
-  Float tinyLength = aStrokeWidth / 512;
+  Float tinyLength = aStrokeWidth / SVG_ZERO_LENGTH_PATH_FIX_FACTOR;
 
   aPB->LineTo(aPoint + Point(tinyLength, 0));
   aPB->MoveTo(aPoint);
diff --git a/dom/svg/SVGRectElement.cpp b/dom/svg/SVGRectElement.cpp
index 923ecbfbcf..808c7d8190 100644
--- a/dom/svg/SVGRectElement.cpp
+++ b/dom/svg/SVGRectElement.cpp
@@ -112,8 +112,10 @@ SVGRectElement::GetLengthInfo()
 // nsSVGPathGeometryElement methods
 
 bool
-SVGRectElement::GetGeometryBounds(
-  Rect* aBounds, const StrokeOptions& aStrokeOptions, const Matrix& aTransform)
+SVGRectElement::GetGeometryBounds(Rect* aBounds,
+                                  const StrokeOptions& aStrokeOptions,
+                                  const Matrix& aToBoundsSpace,
+                                  const Matrix* aToNonScalingStrokeSpace)
 {
   Rect rect;
   Float rx, ry;
@@ -124,11 +126,11 @@ SVGRectElement::GetGeometryBounds(
     // Rendering of the element disabled
     rect.SetEmpty(); // Make sure width/height are zero and not negative
     // We still want the x/y position from 'rect'
-    *aBounds = aTransform.TransformBounds(rect);
+    *aBounds = aToBoundsSpace.TransformBounds(rect);
     return true;
   }
 
-  if (!aTransform.IsRectilinear()) {
+  if (!aToBoundsSpace.IsRectilinear()) {
     // We can't ignore the radii in this case if we want tight bounds
     rx = std::max(rx, 0.0f);
     ry = std::max(ry, 0.0f);
@@ -139,10 +141,29 @@ SVGRectElement::GetGeometryBounds(
   }
 
   if (aStrokeOptions.mLineWidth > 0.f) {
+    if (aToNonScalingStrokeSpace) {
+      if (aToNonScalingStrokeSpace->IsRectilinear()) {
+        MOZ_ASSERT(!aToNonScalingStrokeSpace->IsSingular());
+        rect = aToNonScalingStrokeSpace->TransformBounds(rect);
+        // Note that, in principle, an author could cause the corners of the
+        // rect to be beveled by specifying stroke-linejoin or setting
+        // stroke-miterlimit to be less than sqrt(2). In that very unlikely
+        // event the bounds that we calculate here may be too big if
+        // aToBoundsSpace is non-rectilinear. This is likely to be so rare it's
+        // not worth handling though.
+        rect.Inflate(aStrokeOptions.mLineWidth / 2.f);
+        Matrix nonScalingToBounds =
+          aToNonScalingStrokeSpace->Inverse() * aToBoundsSpace;
+        *aBounds = nonScalingToBounds.TransformBounds(rect);
+        return true;
+      }
+      return false;
+    }
+    // The "beveled" comment above applies here too
     rect.Inflate(aStrokeOptions.mLineWidth / 2.f);
   }
 
-  *aBounds = aTransform.TransformBounds(rect);
+  *aBounds = aToBoundsSpace.TransformBounds(rect);
   return true;
 }
 
diff --git a/dom/svg/SVGRectElement.h b/dom/svg/SVGRectElement.h
index 67d5c1384e..fe32414eec 100644
--- a/dom/svg/SVGRectElement.h
+++ b/dom/svg/SVGRectElement.h
@@ -32,7 +32,8 @@ public:
 
   // nsSVGPathGeometryElement methods:
   virtual bool GetGeometryBounds(Rect* aBounds, const StrokeOptions& aStrokeOptions,
-                                 const Matrix& aTransform) override;
+                                 const Matrix& aToBoundsSpace,
+                                 const Matrix* aToNonScalingStrokeSpace = nullptr) override;
   virtual void GetAsSimplePath(SimplePath* aSimplePath) override;
   virtual already_AddRefed<Path> BuildPath(PathBuilder* aBuilder = nullptr) override;
 
diff --git a/dom/svg/nsSVGPathGeometryElement.h b/dom/svg/nsSVGPathGeometryElement.h
index 07ba6938da..1091fa0dcd 100644
--- a/dom/svg/nsSVGPathGeometryElement.h
+++ b/dom/svg/nsSVGPathGeometryElement.h
@@ -76,9 +76,21 @@ public:
    * GetStrokedBounds on it.  It also helps us avoid rounding error for simple
    * shapes and simple transforms where the Moz2D Path backends can fail to
    * produce the clean integer bounds that content authors expect in some cases.
+   *
+   * If |aToNonScalingStrokeSpace| is non-null then |aBounds|, which is computed
+   * in bounds space, has the property that it's the smallest (axis-aligned)
+   * rectangular bound containing the image of this shape as stroked in
+   * non-scaling-stroke space.  (When all transforms involved are rectilinear
+   * the bounds of the image of |aBounds| in non-scaling-stroke space will be
+   * tight, but if there are non-rectilinear transforms involved then that may
+   * be impossible and this method will return false).
+   *
+   * If |aToNonScalingStrokeSpace| is non-null then |*aToNonScalingStrokeSpace|
+   * must be non-singular.
    */
   virtual bool GetGeometryBounds(Rect* aBounds, const StrokeOptions& aStrokeOptions,
-                                 const Matrix& aTransform) {
+                                 const Matrix& aToBoundsSpace,
+                                 const Matrix* aToNonScalingStrokeSpace = nullptr) {
     return false;
   }
 
diff --git a/dom/svg/nsSVGPolyElement.cpp b/dom/svg/nsSVGPolyElement.cpp
index 550d5306cf..3ae05bc5fd 100644
--- a/dom/svg/nsSVGPolyElement.cpp
+++ b/dom/svg/nsSVGPolyElement.cpp
@@ -122,8 +122,10 @@ nsSVGPolyElement::GetMarkPoints(nsTArray<nsSVGMark> *aMarks)
 }
 
 bool
-nsSVGPolyElement::GetGeometryBounds(
-  Rect* aBounds, const StrokeOptions& aStrokeOptions, const Matrix& aTransform)
+nsSVGPolyElement::GetGeometryBounds(Rect* aBounds,
+                                    const StrokeOptions& aStrokeOptions,
+                                    const Matrix& aToBoundsSpace,
+                                    const Matrix* aToNonScalingStrokeSpace)
 {
   const SVGPointList &points = mPoints.GetAnimValue();
 
@@ -133,23 +135,23 @@ nsSVGPolyElement::GetGeometryBounds(
     return true;
   }
 
-  if (aStrokeOptions.mLineWidth > 0) {
-    // We don't handle stroke-miterlimit etc. yet
+  if (aStrokeOptions.mLineWidth > 0 || aToNonScalingStrokeSpace) {
+    // We don't handle non-scaling-stroke or stroke-miterlimit etc. yet
     return false;
   }
 
-  if (aTransform.IsRectilinear()) {
+  if (aToBoundsSpace.IsRectilinear()) {
     // We can avoid transforming each point and just transform the result.
     // Important for large point lists.
     Rect bounds(points[0], Size());
     for (uint32_t i = 1; i < points.Length(); ++i) {
       bounds.ExpandToEnclose(points[i]);
     }
-    *aBounds = aTransform.TransformBounds(bounds);
+    *aBounds = aToBoundsSpace.TransformBounds(bounds);
   } else {
-    *aBounds = Rect(aTransform * points[0], Size());
+    *aBounds = Rect(aToBoundsSpace * points[0], Size());
     for (uint32_t i = 1; i < points.Length(); ++i) {
-      aBounds->ExpandToEnclose(aTransform * points[i]);
+      aBounds->ExpandToEnclose(aToBoundsSpace * points[i]);
     }
   }
   return true;
diff --git a/dom/svg/nsSVGPolyElement.h b/dom/svg/nsSVGPolyElement.h
index ffcb145c73..1dcde00784 100644
--- a/dom/svg/nsSVGPolyElement.h
+++ b/dom/svg/nsSVGPolyElement.h
@@ -47,7 +47,8 @@ public:
   virtual bool IsMarkable() override { return true; }
   virtual void GetMarkPoints(nsTArray<nsSVGMark> *aMarks) override;
   virtual bool GetGeometryBounds(Rect* aBounds, const StrokeOptions& aStrokeOptions,
-                                 const Matrix& aTransform) override;
+                                 const Matrix& aToBoundsSpace,
+                                 const Matrix* aToNonScalingStrokeSpace = nullptr) override;
 
   // WebIDL
   already_AddRefed<mozilla::DOMSVGPointList> Points();
diff --git a/dom/svg/test/bounds-helper.svg b/dom/svg/test/bounds-helper.svg
index 6e08ba8f6f..aaa87ee686 100644
--- a/dom/svg/test/bounds-helper.svg
+++ b/dom/svg/test/bounds-helper.svg
@@ -39,5 +39,37 @@ text { font: 20px monospace; }
     <rect x="100" y="100" width="50" height="50" fill="pink"/>
     <text x="200" y="200"/>
   </g>
+  <circle id="nonScalingStrokedCircle1" cx="0" cy="0" r="10"
+          transform="translate(45 130) scale(3 -2)"
+          fill="none" stroke="gray" stroke-width="10"
+          vector-effect="non-scaling-stroke"/>
+  <ellipse id="nonScalingStrokedEllipse1" cx="20" cy="-10" rx="5" ry="5"
+           transform="matrix(0 3 -2 0 0 0)"
+           fill="none" stroke="steelblue" stroke-width="10"
+           vector-effect="non-scaling-stroke" />
+  <line id="nonScalingStrokedLine1" x1="120" y1="5" x2="120" y2="10"
+        transform="scale(2 3)"
+        stroke-width="10" stroke-linecap="round" stroke="orange"
+        vector-effect="non-scaling-stroke" />
+  <line id="nonScalingStrokedLine2" x1="130" y1="5" x2="140" y2="5"
+        transform="rotate(45 260 15) scale(2 3)"
+        stroke-width="10" stroke-linecap="square" stroke="crimson"
+        vector-effect="non-scaling-stroke" />
+  <line id="nonScalingStrokedLine3" x1="140" y1="5" x2="150" y2="5"
+        transform="rotate(45 280 15) scale(2 3)"
+        stroke-width="10" stroke-linecap="butt" stroke="indigo"
+        vector-effect="non-scaling-stroke" />
+
+  <marker id="marker1" markerWidth="100" markerHeight="100"
+          refX="0" refY="50" markerUnits="userSpaceOnUse">
+    <line x1="0" y1="50" x2="50" y2="100" stroke="aqua" stroke-width="20"
+          transform="rotate(-45 0 50)" />
+  </marker>
+  <line id="shapeWithMarker1" x1="160" y1="130" x2="170" y2="130"
+        stroke="black" stroke-width="3" marker-end="url(#marker1)"/>
+
+  <line id="rotatedLine1" x1="160" y1="150" x2="180" y2="170"
+        stroke="darkmagenta" stroke-width="10"
+        transform="rotate(-45 160 150)" />
 </g>
 </svg>
diff --git a/dom/svg/test/test_bounds.html b/dom/svg/test/test_bounds.html
index e615dfd6de..4b7046bc7e 100644
--- a/dom/svg/test/test_bounds.html
+++ b/dom/svg/test/test_bounds.html
@@ -159,13 +159,10 @@ function runTest()
   is(rect3aBounds.width, 108, "rect3a.getBoundingClientRect().width");
   is(rect3aBounds.height, 108, "rect3a.getBoundingClientRect().height");
 
-  // Our PathExtentsToMaxStrokeExtents implementation considers the stroke
-  // width to be sqrt(2)*stroke-width in case the rect is rotated 45 degrees,
-  // so unfortunately we get slightly large results currently. Bug 1092125.
-  isWithAbsTolerance(rect3bBounds.left, 198, 1, "rect3b.getBoundingClientRect().left");
-  isWithAbsTolerance(rect3bBounds.top, 198, 1, "rect3b.getBoundingClientRect().top");
-  isWithAbsTolerance(rect3bBounds.width, 54, 2, "rect3b.getBoundingClientRect().width");
-  isWithAbsTolerance(rect3bBounds.height, 54, 2, "rect3b.getBoundingClientRect().height");
+  isWithAbsTolerance(rect3bBounds.left, 198, 0.1, "rect3b.getBoundingClientRect().left");
+  isWithAbsTolerance(rect3bBounds.top, 198, 0.1, "rect3b.getBoundingClientRect().top");
+  isWithAbsTolerance(rect3bBounds.width, 54, 0.1, "rect3b.getBoundingClientRect().width");
+  isWithAbsTolerance(rect3bBounds.height, 54, 0.1, "rect3b.getBoundingClientRect().height");
 
   rect = new Rect(350 - 108 * sin45, 150 - 108 * sin45, 108 * sin45 * 2, 108 * sin45 * 2);
   isWithAbsTolerance(rect4aBounds.left, rect.left, 0.1, "rect4a.getBoundingClientRect().left");
@@ -203,6 +200,89 @@ function runTest()
   is(gBounds.width, 50, "g2.getBoundingClientRect().width");
   is(gBounds.height, 50, "g2.getBoundingClientRect().height");
 
+  var nonScalingStrokedCircle1Bounds =
+    doc.getElementById("nonScalingStrokedCircle1").getBoundingClientRect();
+  isWithAbsTolerance(nonScalingStrokedCircle1Bounds.left, 10, 0.15,
+                     "nonScalingStrokedCircle1.getBoundingClientRect().left");
+  isWithAbsTolerance(nonScalingStrokedCircle1Bounds.top, 105, 0.15,
+                     "nonScalingStrokedCircle1.getBoundingClientRect().top");
+  isWithAbsTolerance(nonScalingStrokedCircle1Bounds.width, 70, 0.15,
+                     "nonScalingStrokedCircle1.getBoundingClientRect().width");
+  isWithAbsTolerance(nonScalingStrokedCircle1Bounds.height, 50, 0.15,
+                     "nonScalingStrokedCircle1.getBoundingClientRect().height");
+
+  var nonScalingStrokedEllipse1Bounds =
+    doc.getElementById("nonScalingStrokedEllipse1").getBoundingClientRect();
+  isWithAbsTolerance(nonScalingStrokedEllipse1Bounds.left, 5, 0.15,
+                     "nonScalingStrokedEllipse1.getBoundingClientRect().left");
+  isWithAbsTolerance(nonScalingStrokedEllipse1Bounds.top, 40, 0.15,
+                     "nonScalingStrokedEllipse1.getBoundingClientRect().top");
+  isWithAbsTolerance(nonScalingStrokedEllipse1Bounds.width, 30, 0.15,
+                     "nonScalingStrokedEllipse1.getBoundingClientRect().width");
+  isWithAbsTolerance(nonScalingStrokedEllipse1Bounds.height, 40, 0.15,
+                     "nonScalingStrokedEllipse1.getBoundingClientRect().height");
+
+  var nonScalingStrokedLine1Bounds =
+    doc.getElementById("nonScalingStrokedLine1").getBoundingClientRect();
+  isWithAbsTolerance(nonScalingStrokedLine1Bounds.left, 235, 0.1,
+                     "nonScalingStrokedLine1.getBoundingClientRect().left");
+  isWithAbsTolerance(nonScalingStrokedLine1Bounds.top, 10, 0.1,
+                    "nonScalingStrokedLine1.getBoundingClientRect().top");
+  isWithAbsTolerance(nonScalingStrokedLine1Bounds.width, 10, 0.1,
+                     "nonScalingStrokedLine1.getBoundingClientRect().width");
+  isWithAbsTolerance(nonScalingStrokedLine1Bounds.height, 25, 0.1,
+                     "nonScalingStrokedLine1.getBoundingClientRect().height");
+
+  var nonScalingStrokedLine2Bounds =
+    doc.getElementById("nonScalingStrokedLine2").getBoundingClientRect();
+  var capDelta = 5/Math.SQRT2 + 5/Math.SQRT2;
+  rect = new Rect(260 - capDelta, 15 - capDelta, 20/Math.SQRT2 + 2 * capDelta,
+                  20/Math.SQRT2 + 2 * capDelta);
+  isWithAbsTolerance(nonScalingStrokedLine2Bounds.left, rect.left, 0.1,
+                     "nonScalingStrokedLine2.getBoundingClientRect().left");
+  isWithAbsTolerance(nonScalingStrokedLine2Bounds.top, rect.top, 0.1,
+                    "nonScalingStrokedLine2.getBoundingClientRect().top");
+  isWithAbsTolerance(nonScalingStrokedLine2Bounds.width, rect.width, 0.15,
+                     "nonScalingStrokedLine2.getBoundingClientRect().width");
+  isWithAbsTolerance(nonScalingStrokedLine2Bounds.height, rect.height, 0.15,
+                     "nonScalingStrokedLine2.getBoundingClientRect().height");
+
+  var nonScalingStrokedLine3Bounds =
+    doc.getElementById("nonScalingStrokedLine3").getBoundingClientRect();
+  var capDelta = 5/Math.SQRT2;
+  rect = new Rect(280 - capDelta, 15 - capDelta, 20/Math.SQRT2 + 2 * capDelta,
+                  20/Math.SQRT2 + 2 * capDelta);
+  isWithAbsTolerance(nonScalingStrokedLine3Bounds.left, rect.left, 0.1,
+                     "nonScalingStrokedLine3.getBoundingClientRect().left");
+  isWithAbsTolerance(nonScalingStrokedLine3Bounds.top, rect.top, 0.1,
+                    "nonScalingStrokedLine3.getBoundingClientRect().top");
+  isWithAbsTolerance(nonScalingStrokedLine3Bounds.width, rect.width, 0.1,
+                     "nonScalingStrokedLine3.getBoundingClientRect().width");
+  isWithAbsTolerance(nonScalingStrokedLine3Bounds.height, rect.height, 0.1,
+                     "nonScalingStrokedLine3.getBoundingClientRect().height");
+
+  var shapeWithMarker1Bounds =
+    doc.getElementById("shapeWithMarker1").getBoundingClientRect();
+  isWithAbsTolerance(shapeWithMarker1Bounds.left, 160, 0.1,
+    "shapeWithMarker1Bounds.left");
+  isWithAbsTolerance(shapeWithMarker1Bounds.top, 120, 0.1,
+    "shapeWithMarker1Bounds.top");
+  isWithAbsTolerance(shapeWithMarker1Bounds.width, 10 + Math.SQRT2 * 50, 0.1,
+    "shapeWithMarker1Bounds.width");
+  isWithAbsTolerance(shapeWithMarker1Bounds.height, 20, 0.1,
+    "shapeWithMarker1Bounds.height");
+
+  var rotatedLine1Bounds =
+    doc.getElementById("rotatedLine1").getBoundingClientRect();
+  isWithAbsTolerance(rotatedLine1Bounds.left, 160, 0.1,
+    "rotatedLine1Bounds.left");
+  isWithAbsTolerance(rotatedLine1Bounds.top, 145, 0.1,
+    "rotatedLine1Bounds.top");
+  isWithAbsTolerance(rotatedLine1Bounds.width, Math.SQRT2 * 20, 0.1,
+    "rotatedLine1Bounds.width");
+  isWithAbsTolerance(rotatedLine1Bounds.height, 10, 0.1,
+    "rotatedLine1Bounds.height");
+
   SimpleTest.finish();
 }
 
diff --git a/dom/tests/mochitest/localstorage/interOriginFrame.js b/dom/tests/mochitest/localstorage/interOriginFrame.js
index a71441ba5d..185ef88581 100644
--- a/dom/tests/mochitest/localstorage/interOriginFrame.js
+++ b/dom/tests/mochitest/localstorage/interOriginFrame.js
@@ -51,7 +51,7 @@ function finishTest()
 {
   try {
     localStorage.clear();
-  } catch(e) {}
+  } catch (e) {}
   postMsg("done");
   return false;
 }
diff --git a/dom/tests/mochitest/localstorage/test_localStorageCookieSettings.html b/dom/tests/mochitest/localstorage/test_localStorageCookieSettings.html
index d3a47611e1..99f3b1acef 100644
--- a/dom/tests/mochitest/localstorage/test_localStorageCookieSettings.html
+++ b/dom/tests/mochitest/localstorage/test_localStorageCookieSettings.html
@@ -27,21 +27,6 @@ function test1() {
     is(ex.name, "SecurityError");
   }
 
-  // Set cookies behavior to "ask every time".
-  SpecialPowers.pushPrefEnv({"set": [["network.cookie.lifetimePolicy", 1]],
-                             "clear": [["network.cookie.cookieBehavior"]]},
-                            test2);
-}
-
-function test2() {
-  try {
-    localStorage.setItem("contentkey", "test-value");
-    ok(false, "Setting localStorageItem should throw a security exception");
-  }
-  catch(ex) {
-    is(ex.name, "SecurityError");
-  }
-
   // Set cookies behavior to "reject 3rd party"
   SpecialPowers.pushPrefEnv({"set": [["network.cookie.cookieBehavior", 1]],
                              "clear": [["network.cookie.lifetimePolicy"]]},
diff --git a/dom/webidl/DominatorTree.webidl b/dom/webidl/DominatorTree.webidl
index b088e92205..98558f7c76 100644
--- a/dom/webidl/DominatorTree.webidl
+++ b/dom/webidl/DominatorTree.webidl
@@ -4,6 +4,8 @@
  * You can obtain one at http://mozilla.org/MPL/2.0/.
  */
 
+typedef unsigned long long NodeId;
+
 /**
  * In a directed graph with a root node `R`, a node `A` is said to "dominate" a
  * node `B` iff every path from `R` to `B` contains `A`. A node `A` is said to
@@ -37,5 +39,10 @@
  */
 [ChromeOnly, Exposed=(Window,System,Worker)]
 interface DominatorTree {
-
+  /**
+   * The `NodeId` for the root of the dominator tree. This is a "meta-root" in
+   * that it has an edge to each GC root in the heap snapshot this dominator
+   * tree was created from.
+   */
+  readonly attribute NodeId root;
 };
diff --git a/dom/webidl/ThreadSafeChromeUtils.webidl b/dom/webidl/ThreadSafeChromeUtils.webidl
index 7a4a71d8ad..e34fe2f406 100644
--- a/dom/webidl/ThreadSafeChromeUtils.webidl
+++ b/dom/webidl/ThreadSafeChromeUtils.webidl
@@ -43,6 +43,18 @@ interface ThreadSafeChromeUtils {
    */
   [Throws, NewObject]
   static any nondeterministicGetWeakMapKeys(any map);
+
+  /**
+   * Return the keys in a weak set.  This operation is
+   * non-deterministic because it is affected by the scheduling of the
+   * garbage collector and the cycle collector.
+   *
+   * @param aSet weak set or other JavaScript value
+   * @returns If aSet is a weak set object, return the keys of the weak
+   *          set as an array.  Otherwise, return undefined.
+   */
+  [Throws, NewObject]
+  static any nondeterministicGetWeakSetKeys(any aSet);
 };
 
 /**
diff --git a/dom/workers/ServiceWorkerEvents.cpp b/dom/workers/ServiceWorkerEvents.cpp
index 66da92c749..1757639b78 100644
--- a/dom/workers/ServiceWorkerEvents.cpp
+++ b/dom/workers/ServiceWorkerEvents.cpp
@@ -115,10 +115,7 @@ AsyncLog(nsIInterceptedChannel *aInterceptedChannel,
          const nsACString& aMessageName, const nsTArray<nsString>& aParams)
 {
   MOZ_ASSERT(aInterceptedChannel);
-  // Since the intercepted channel is kept alive and paused while handling
-  // the FetchEvent, we are guaranteed the reporter is stable on the worker
-  // thread.
-  nsIConsoleReportCollector* reporter =
+  nsCOMPtr<nsIConsoleReportCollector> reporter =
     aInterceptedChannel->GetConsoleReportCollector();
   if (reporter) {
     reporter->AddConsoleReport(nsIScriptError::errorFlag,
@@ -398,8 +395,8 @@ ExtractErrorValues(JSContext* aCx, JS::Handle<JS::Value> aValue,
     else if(NS_SUCCEEDED(UNWRAP_OBJECT(DOMException, obj, domException))) {
 
       nsAutoString filename;
-      if (NS_SUCCEEDED(domException->GetFilename(filename)) &&
-          !filename.IsEmpty()) {
+      domException->GetFilename(filename);
+      if (!filename.IsEmpty()) {
         CopyUTF16toUTF8(filename, aSourceSpecOut);
         *aLineOut = domException->LineNumber();
         *aColumnOut = domException->ColumnNumber();
@@ -421,6 +418,8 @@ ExtractErrorValues(JSContext* aCx, JS::Handle<JS::Value> aValue,
     nsAutoJSString jsString;
     if (jsString.init(aCx, aValue)) {
       aMessageOut = jsString;
+    } else {
+      JS_ClearPendingException(aCx);
     }
   }
 }
@@ -618,7 +617,7 @@ RespondWithHandler::ResolvedCallback(JSContext* aCx, JS::Handle<JS::Value> aValu
       return;
     }
 
-    nsCOMPtr<nsIEventTarget> stsThread = do_GetService(NS_SOCKETTRANSPORTSERVICE_CONTRACTID, &rv);
+    nsCOMPtr<nsIEventTarget> stsThread = do_GetService(NS_STREAMTRANSPORTSERVICE_CONTRACTID, &rv);
     if (NS_WARN_IF(!stsThread)) {
       return;
     }
diff --git a/extensions/cookie/nsCookiePermission.cpp b/extensions/cookie/nsCookiePermission.cpp
index 5370ff9ad2..f92281e381 100644
--- a/extensions/cookie/nsCookiePermission.cpp
+++ b/extensions/cookie/nsCookiePermission.cpp
@@ -34,7 +34,7 @@
 
 // values for mCookiesLifetimePolicy
 // 0 == accept normally
-// 1 == ask before accepting -- obsolete, treated as ACCEPT_NORMALLY
+// 1 == ask before accepting, no more supported, treated like ACCEPT_NORMALLY (Bug 606655).
 // 2 == downgrade to session
 // 3 == limit lifetime to N days
 static const uint32_t ACCEPT_NORMALLY = 0;
diff --git a/gfx/layers/Layers.h b/gfx/layers/Layers.h
index efbd5f531f..c1aeac86ab 100644
--- a/gfx/layers/Layers.h
+++ b/gfx/layers/Layers.h
@@ -2533,7 +2533,6 @@ protected:
 
   virtual void DumpPacket(layerscope::LayersPacket* aPacket, const void* aParent) override;
 
-  Layer* mTempReferent;
   // 0 is a special value that means "no ID".
   uint64_t mId;
 };
diff --git a/js/public/UbiNodeDominatorTree.h b/js/public/UbiNodeDominatorTree.h
index 8b15ff70c8..a2d5a1d393 100644
--- a/js/public/UbiNodeDominatorTree.h
+++ b/js/public/UbiNodeDominatorTree.h
@@ -546,6 +546,13 @@ class JS_EXPORT_API(DominatorTree)
                                            mozilla::Move(*maybeDominatedSets)));
     }
 
+    /**
+     * Get the root node for this dominator tree.
+     */
+    const Node& root() const {
+        return postOrder[postOrder.length() - 1];
+    }
+
     /**
      * Return the immediate dominator of the given `node`. If `node` was not
      * reachable from the `root` that this dominator tree was constructed from,
diff --git a/js/src/builtin/ReflectParse.cpp b/js/src/builtin/ReflectParse.cpp
index a78dce59a1..9cf637bb14 100644
--- a/js/src/builtin/ReflectParse.cpp
+++ b/js/src/builtin/ReflectParse.cpp
@@ -8,6 +8,7 @@
 
 #include "mozilla/ArrayUtils.h"
 #include "mozilla/DebugOnly.h"
+#include "mozilla/Move.h"
 
 #include <stdlib.h>
 
@@ -32,6 +33,7 @@ using namespace js::frontend;
 using JS::AutoValueArray;
 using mozilla::ArrayLength;
 using mozilla::DebugOnly;
+using mozilla::Forward;
 
 enum class ParseTarget
 {
@@ -220,6 +222,13 @@ GetPropertyDefault(JSContext* cx, HandleObject obj, HandleId id, HandleValue def
     return GetProperty(cx, obj, obj, id, result);
 }
 
+enum class GeneratorStyle
+{
+    None,
+    Legacy,
+    ES6
+};
+
 /*
  * Builder class that constructs JavaScript AST node objects. See:
  *
@@ -296,123 +305,43 @@ class NodeBuilder
     }
 
   private:
-    bool callback(HandleValue fun, TokenPos* pos, MutableHandleValue dst) {
+    template <size_t N>
+    bool callbackHelper(HandleValue fun, AutoValueArray<N>& args, size_t i,
+                        TokenPos* pos, MutableHandleValue dst)
+    {
+        // The end of the implementation of callback(). All arguments except
+        // loc have already been stored in range [0, i) or args.
+        MOZ_ASSERT(i == N - 1);
         if (saveLoc) {
             RootedValue loc(cx);
             if (!newNodeLoc(pos, &loc))
                 return false;
-            AutoValueArray<1> argv(cx);
-            argv[0].set(loc);
-            return Invoke(cx, userv, fun, argv.length(), argv.begin(), dst);
+            args[i++].set(loc);
         }
-
-        AutoValueArray<1> argv(cx);
-        argv[0].setNull(); /* no zero-length arrays allowed! */
-        return Invoke(cx, userv, fun, 0, argv.begin(), dst);
+        return Invoke(cx, userv, fun, N, args.begin(), dst);
     }
 
-    bool callback(HandleValue fun, HandleValue v1, TokenPos* pos, MutableHandleValue dst) {
-        if (saveLoc) {
-            RootedValue loc(cx);
-            if (!newNodeLoc(pos, &loc))
-                return false;
-            AutoValueArray<2> argv(cx);
-            argv[0].set(v1);
-            argv[1].set(loc);
-            return Invoke(cx, userv, fun, argv.length(), argv.begin(), dst);
-        }
-
-        AutoValueArray<1> argv(cx);
-        argv[0].set(v1);
-        return Invoke(cx, userv, fun, argv.length(), argv.begin(), dst);
+    // Helper function for callback(). Note that all Arguments must be types
+    // that convert to HandleValue, so this is not really as template-y as it
+    // seems, just variadic.
+    template <size_t N, typename... Arguments>
+    bool callbackHelper(HandleValue fun, AutoValueArray<N>& args, size_t i,
+                        HandleValue head, Arguments&&... tail)
+    {
+        // Recursive loop to store the arguments in the array. This eventually
+        // bottoms out in a call to the non-template callbackHelper() above.
+        args[i].set(head);
+        return callbackHelper(fun, args, i + 1, Forward<Arguments>(tail)...);
     }
 
-    bool callback(HandleValue fun, HandleValue v1, HandleValue v2, TokenPos* pos,
-                  MutableHandleValue dst) {
-        if (saveLoc) {
-            RootedValue loc(cx);
-            if (!newNodeLoc(pos, &loc))
-                return false;
-            AutoValueArray<3> argv(cx);
-            argv[0].set(v1);
-            argv[1].set(v2);
-            argv[2].set(loc);
-            return Invoke(cx, userv, fun, argv.length(), argv.begin(), dst);
-        }
-
-        AutoValueArray<2> argv(cx);
-        argv[0].set(v1);
-        argv[1].set(v2);
-        return Invoke(cx, userv, fun, argv.length(), argv.begin(), dst);
-    }
-
-    bool callback(HandleValue fun, HandleValue v1, HandleValue v2, HandleValue v3, TokenPos* pos,
-                  MutableHandleValue dst) {
-        if (saveLoc) {
-            RootedValue loc(cx);
-            if (!newNodeLoc(pos, &loc))
-                return false;
-            AutoValueArray<4> argv(cx);
-            argv[0].set(v1);
-            argv[1].set(v2);
-            argv[2].set(v3);
-            argv[3].set(loc);
-            return Invoke(cx, userv, fun, argv.length(), argv.begin(), dst);
-        }
-
-        AutoValueArray<3> argv(cx);
-        argv[0].set(v1);
-        argv[1].set(v2);
-        argv[2].set(v3);
-        return Invoke(cx, userv, fun, argv.length(), argv.begin(), dst);
-    }
-
-    bool callback(HandleValue fun, HandleValue v1, HandleValue v2, HandleValue v3, HandleValue v4,
-                  TokenPos* pos, MutableHandleValue dst) {
-        if (saveLoc) {
-            RootedValue loc(cx);
-            if (!newNodeLoc(pos, &loc))
-                return false;
-            AutoValueArray<5> argv(cx);
-            argv[0].set(v1);
-            argv[1].set(v2);
-            argv[2].set(v3);
-            argv[3].set(v4);
-            argv[4].set(loc);
-            return Invoke(cx, userv, fun, argv.length(), argv.begin(), dst);
-        }
-
-        AutoValueArray<4> argv(cx);
-        argv[0].set(v1);
-        argv[1].set(v2);
-        argv[2].set(v3);
-        argv[3].set(v4);
-        return Invoke(cx, userv, fun, argv.length(), argv.begin(), dst);
-    }
-
-    bool callback(HandleValue fun, HandleValue v1, HandleValue v2, HandleValue v3, HandleValue v4,
-                  HandleValue v5, TokenPos* pos, MutableHandleValue dst) {
-        if (saveLoc) {
-            RootedValue loc(cx);
-            if (!newNodeLoc(pos, &loc))
-                return false;
-            AutoValueArray<6> argv(cx);
-            argv[0].set(v1);
-            argv[1].set(v2);
-            argv[2].set(v3);
-            argv[3].set(v4);
-            argv[4].set(v5);
-            argv[5].set(loc);
-            return Invoke(cx, userv, fun, argv.length(), argv.begin(), dst);
-        }
-
-        AutoValueArray<5> argv(cx);
-        argv[0].set(v1);
-        argv[1].set(v2);
-        argv[2].set(v3);
-        argv[3].set(v4);
-        argv[4].set(v5);
-        return Invoke(cx, userv, fun, argv.length(), argv.begin(), dst);
+    // Invoke a user-defined callback. The actual signature is:
+    //
+    //     bool callback(HandleValue fun, HandleValue... args, TokenPos* pos,
+    //                   MutableHandleValue dst);
+    template <typename... Arguments>
+    bool callback(HandleValue fun, Arguments&&... args) {
+        AutoValueArray<sizeof...(args) - 1> argv(cx);
+        return callbackHelper(fun, argv, 0, Forward<Arguments>(args)...);
     }
 
     // WARNING: Returning a Handle is non-standard, but it works in this case
@@ -447,117 +376,39 @@ class NodeBuilder
 
     bool newArray(NodeVector& elts, MutableHandleValue dst);
 
-    bool newNode(ASTType type, TokenPos* pos, MutableHandleObject dst);
+    bool createNode(ASTType type, TokenPos* pos, MutableHandleObject dst);
 
-    bool newNode(ASTType type, TokenPos* pos, MutableHandleValue dst) {
-        RootedObject node(cx);
-        return newNode(type, pos, &node) &&
-               setResult(node, dst);
+    bool newNodeHelper(HandleObject obj, MutableHandleValue dst) {
+        // The end of the implementation of newNode().
+        MOZ_ASSERT(obj);
+        dst.setObject(*obj);
+        return true;
     }
 
-    bool newNode(ASTType type, TokenPos* pos,
-                 const char* childName, HandleValue child,
-                 MutableHandleValue dst) {
-        RootedObject node(cx);
-        return newNode(type, pos, &node) &&
-               setProperty(node, childName, child) &&
-               setResult(node, dst);
+    template <typename... Arguments>
+    bool newNodeHelper(HandleObject obj, const char *name, HandleValue value,
+                       Arguments&&... rest)
+    {
+        // Recursive loop to define properties. Note that the newNodeHelper()
+        // call below passes two fewer arguments than we received, as we omit
+        // `name` and `value`. This eventually bottoms out in a call to the
+        // non-template newNodeHelper() above.
+        return defineProperty(obj, name, value)
+               && newNodeHelper(obj, Forward<Arguments>(rest)...);
     }
 
-    bool newNode(ASTType type, TokenPos* pos,
-                 const char* childName1, HandleValue child1,
-                 const char* childName2, HandleValue child2,
-                 MutableHandleValue dst) {
+    // Create a node object with "type" and "loc" properties, as well as zero
+    // or more properties passed in as arguments. The signature is really more
+    // like:
+    //
+    //     bool newNode(ASTType type, TokenPos* pos,
+    //                  {const char *name0, HandleValue value0,}...
+    //                  MutableHandleValue dst);
+    template <typename... Arguments>
+    bool newNode(ASTType type, TokenPos* pos, Arguments&&... args) {
         RootedObject node(cx);
-        return newNode(type, pos, &node) &&
-               setProperty(node, childName1, child1) &&
-               setProperty(node, childName2, child2) &&
-               setResult(node, dst);
-    }
-
-    bool newNode(ASTType type, TokenPos* pos,
-                 const char* childName1, HandleValue child1,
-                 const char* childName2, HandleValue child2,
-                 const char* childName3, HandleValue child3,
-                 MutableHandleValue dst) {
-        RootedObject node(cx);
-        return newNode(type, pos, &node) &&
-               setProperty(node, childName1, child1) &&
-               setProperty(node, childName2, child2) &&
-               setProperty(node, childName3, child3) &&
-               setResult(node, dst);
-    }
-
-    bool newNode(ASTType type, TokenPos* pos,
-                 const char* childName1, HandleValue child1,
-                 const char* childName2, HandleValue child2,
-                 const char* childName3, HandleValue child3,
-                 const char* childName4, HandleValue child4,
-                 MutableHandleValue dst) {
-        RootedObject node(cx);
-        return newNode(type, pos, &node) &&
-               setProperty(node, childName1, child1) &&
-               setProperty(node, childName2, child2) &&
-               setProperty(node, childName3, child3) &&
-               setProperty(node, childName4, child4) &&
-               setResult(node, dst);
-    }
-
-    bool newNode(ASTType type, TokenPos* pos,
-                 const char* childName1, HandleValue child1,
-                 const char* childName2, HandleValue child2,
-                 const char* childName3, HandleValue child3,
-                 const char* childName4, HandleValue child4,
-                 const char* childName5, HandleValue child5,
-                 MutableHandleValue dst) {
-        RootedObject node(cx);
-        return newNode(type, pos, &node) &&
-               setProperty(node, childName1, child1) &&
-               setProperty(node, childName2, child2) &&
-               setProperty(node, childName3, child3) &&
-               setProperty(node, childName4, child4) &&
-               setProperty(node, childName5, child5) &&
-               setResult(node, dst);
-    }
-
-    bool newNode(ASTType type, TokenPos* pos,
-                 const char* childName1, HandleValue child1,
-                 const char* childName2, HandleValue child2,
-                 const char* childName3, HandleValue child3,
-                 const char* childName4, HandleValue child4,
-                 const char* childName5, HandleValue child5,
-                 const char* childName6, HandleValue child6,
-                 MutableHandleValue dst) {
-        RootedObject node(cx);
-        return newNode(type, pos, &node) &&
-               setProperty(node, childName1, child1) &&
-               setProperty(node, childName2, child2) &&
-               setProperty(node, childName3, child3) &&
-               setProperty(node, childName4, child4) &&
-               setProperty(node, childName5, child5) &&
-               setProperty(node, childName6, child6) &&
-               setResult(node, dst);
-    }
-
-    bool newNode(ASTType type, TokenPos* pos,
-                 const char* childName1, HandleValue child1,
-                 const char* childName2, HandleValue child2,
-                 const char* childName3, HandleValue child3,
-                 const char* childName4, HandleValue child4,
-                 const char* childName5, HandleValue child5,
-                 const char* childName6, HandleValue child6,
-                 const char* childName7, HandleValue child7,
-                 MutableHandleValue dst) {
-        RootedObject node(cx);
-        return newNode(type, pos, &node) &&
-               setProperty(node, childName1, child1) &&
-               setProperty(node, childName2, child2) &&
-               setProperty(node, childName3, child3) &&
-               setProperty(node, childName4, child4) &&
-               setProperty(node, childName5, child5) &&
-               setProperty(node, childName6, child6) &&
-               setProperty(node, childName7, child7) &&
-               setResult(node, dst);
+        return createNode(type, pos, &node) &&
+               newNodeHelper(node, Forward<Arguments>(args)...);
     }
 
     bool listNode(ASTType type, const char* propName, NodeVector& elts, TokenPos* pos,
@@ -573,7 +424,7 @@ class NodeBuilder
         return newNode(type, pos, propName, array, dst);
     }
 
-    bool setProperty(HandleObject obj, const char* name, HandleValue val) {
+    bool defineProperty(HandleObject obj, const char* name, HandleValue val) {
         MOZ_ASSERT_IF(val.isMagic(), val.whyMagic() == JS_SERIALIZE_NO_NODE);
 
         /*
@@ -592,12 +443,6 @@ class NodeBuilder
 
     bool setNodeLoc(HandleObject node, TokenPos* pos);
 
-    bool setResult(HandleObject obj, MutableHandleValue dst) {
-        MOZ_ASSERT(obj);
-        dst.setObject(*obj);
-        return true;
-    }
-
   public:
     /*
      * All of the public builder methods take as their last two
@@ -620,8 +465,8 @@ class NodeBuilder
 
     bool function(ASTType type, TokenPos* pos,
                   HandleValue id, NodeVector& args, NodeVector& defaults,
-                  HandleValue body, HandleValue rest, bool isGenerator, bool isExpression,
-                  MutableHandleValue dst);
+                  HandleValue body, HandleValue rest, GeneratorStyle generatorStyle,
+                  bool isExpression, MutableHandleValue dst);
 
     bool variableDeclarator(HandleValue id, HandleValue init, TokenPos* pos,
                             MutableHandleValue dst);
@@ -788,7 +633,7 @@ class NodeBuilder
 } /* anonymous namespace */
 
 bool
-NodeBuilder::newNode(ASTType type, TokenPos* pos, MutableHandleObject dst)
+NodeBuilder::createNode(ASTType type, TokenPos* pos, MutableHandleObject dst)
 {
     MOZ_ASSERT(type > AST_ERROR && type < AST_LIMIT);
 
@@ -797,7 +642,7 @@ NodeBuilder::newNode(ASTType type, TokenPos* pos, MutableHandleObject dst)
     if (!node ||
         !setNodeLoc(node, pos) ||
         !atomValue(nodeTypeNames[type], &tv) ||
-        !setProperty(node, "type", tv)) {
+        !defineProperty(node, "type", tv)) {
         return false;
     }
 
@@ -859,28 +704,28 @@ NodeBuilder::newNodeLoc(TokenPos* pos, MutableHandleValue dst)
     if (!newObject(&to))
         return false;
     val.setObject(*to);
-    if (!setProperty(loc, "start", val))
+    if (!defineProperty(loc, "start", val))
         return false;
     val.setNumber(startLineNum);
-    if (!setProperty(to, "line", val))
+    if (!defineProperty(to, "line", val))
         return false;
     val.setNumber(startColumnIndex);
-    if (!setProperty(to, "column", val))
+    if (!defineProperty(to, "column", val))
         return false;
 
     if (!newObject(&to))
         return false;
     val.setObject(*to);
-    if (!setProperty(loc, "end", val))
+    if (!defineProperty(loc, "end", val))
         return false;
     val.setNumber(endLineNum);
-    if (!setProperty(to, "line", val))
+    if (!defineProperty(to, "line", val))
         return false;
     val.setNumber(endColumnIndex);
-    if (!setProperty(to, "column", val))
+    if (!defineProperty(to, "column", val))
         return false;
 
-    if (!setProperty(loc, "source", srcval))
+    if (!defineProperty(loc, "source", srcval))
         return false;
 
     return true;
@@ -891,13 +736,13 @@ NodeBuilder::setNodeLoc(HandleObject node, TokenPos* pos)
 {
     if (!saveLoc) {
         RootedValue nullVal(cx, NullValue());
-        setProperty(node, "loc", nullVal);
+        defineProperty(node, "loc", nullVal);
         return true;
     }
 
     RootedValue loc(cx);
     return newNodeLoc(pos, &loc) &&
-           setProperty(node, "loc", loc);
+           defineProperty(node, "loc", loc);
 }
 
 bool
@@ -1757,7 +1602,7 @@ bool
 NodeBuilder::function(ASTType type, TokenPos* pos,
                       HandleValue id, NodeVector& args, NodeVector& defaults,
                       HandleValue body, HandleValue rest,
-                      bool isGenerator, bool isExpression,
+                      GeneratorStyle generatorStyle, bool isExpression,
                       MutableHandleValue dst)
 {
     RootedValue array(cx), defarray(cx);
@@ -1766,6 +1611,7 @@ NodeBuilder::function(ASTType type, TokenPos* pos,
     if (!newArray(defaults, &defarray))
         return false;
 
+    bool isGenerator = generatorStyle != GeneratorStyle::None;
     RootedValue isGeneratorVal(cx, BooleanValue(isGenerator));
     RootedValue isExpressionVal(cx, BooleanValue(isExpression));
 
@@ -1774,6 +1620,27 @@ NodeBuilder::function(ASTType type, TokenPos* pos,
         return callback(cb, opt(id), array, body, isGeneratorVal, isExpressionVal, pos, dst);
     }
 
+    if (isGenerator) {
+        // Distinguish ES6 generators from legacy generators.
+        RootedValue styleVal(cx);
+        JSAtom* styleStr = generatorStyle == GeneratorStyle::ES6
+                           ? Atomize(cx, "es6", 3)
+                           : Atomize(cx, "legacy", 6);
+        if (!styleStr)
+            return false;
+        styleVal.setString(styleStr);
+        return newNode(type, pos,
+                       "id", id,
+                       "params", array,
+                       "defaults", defarray,
+                       "body", body,
+                       "rest", rest,
+                       "generator", isGeneratorVal,
+                       "style", styleVal,
+                       "expression", isExpressionVal,
+                       dst);
+    }
+
     return newNode(type, pos,
                    "id", id,
                    "params", array,
@@ -3395,7 +3262,9 @@ ASTSerializer::property(ParseNode* pn, MutableHandleValue dst)
     }
 
     bool isShorthand = pn->isKind(PNK_SHORTHAND);
-    bool isMethod = pn->pn_right->isKind(PNK_FUNCTION) && kind == PROP_INIT;
+    bool isMethod =
+        pn->pn_right->isKind(PNK_FUNCTION) &&
+        pn->pn_right->pn_funbox->function()->kind() == JSFunction::Method;
     RootedValue key(cx), val(cx);
     return propertyName(pn->pn_left, &key) &&
            expression(pn->pn_right, &val) &&
@@ -3567,8 +3436,12 @@ ASTSerializer::function(ParseNode* pn, ASTType type, MutableHandleValue dst)
 {
     RootedFunction func(cx, pn->pn_funbox->function());
 
-    // FIXME: Provide more information (legacy generator vs star generator).
-    bool isGenerator = pn->pn_funbox->isGenerator();
+    GeneratorStyle generatorStyle =
+        pn->pn_funbox->isGenerator()
+        ? (pn->pn_funbox->isLegacyGenerator()
+           ? GeneratorStyle::Legacy
+           : GeneratorStyle::ES6)
+        : GeneratorStyle::None;
 
     bool isExpression =
 #if JS_HAS_EXPR_CLOSURES
@@ -3592,7 +3465,7 @@ ASTSerializer::function(ParseNode* pn, ASTType type, MutableHandleValue dst)
         rest.setNull();
     return functionArgsAndBody(pn->pn_body, args, defaults, &body, &rest) &&
         builder.function(type, &pn->pn_pos, id, args, defaults, body,
-                         rest, isGenerator, isExpression, dst);
+                         rest, generatorStyle, isExpression, dst);
 }
 
 bool
diff --git a/js/src/builtin/WeakSetObject.cpp b/js/src/builtin/WeakSetObject.cpp
index 0642bef03e..35fb216e14 100644
--- a/js/src/builtin/WeakSetObject.cpp
+++ b/js/src/builtin/WeakSetObject.cpp
@@ -156,3 +156,21 @@ js::InitWeakSetClass(JSContext* cx, HandleObject obj)
 {
     return WeakSetObject::initClass(cx, obj);
 }
+
+JS_FRIEND_API(bool)
+JS_NondeterministicGetWeakSetKeys(JSContext* cx, HandleObject objArg, MutableHandleObject ret)
+{
+    RootedObject obj(cx, objArg);
+    obj = UncheckedUnwrap(obj);
+    if (!obj || !obj->is<WeakSetObject>()) {
+        ret.set(nullptr);
+        return true;
+    }
+
+    Rooted<WeakSetObject*> weakset(cx, &obj->as<WeakSetObject>());
+    if (!weakset)
+        return false;
+
+    RootedObject map(cx, &weakset->getReservedSlot(WEAKSET_MAP_SLOT).toObject());
+    return JS_NondeterministicGetWeakMapKeys(cx, map, ret);
+}
diff --git a/js/src/gdb/mozilla/Root.py b/js/src/gdb/mozilla/Root.py
index b60d49abea..c93590731a 100644
--- a/js/src/gdb/mozilla/Root.py
+++ b/js/src/gdb/mozilla/Root.py
@@ -18,6 +18,10 @@ class Common(object):
     # the template member holds the referent directly.
     handle = False
 
+    # If True, we should strip typedefs from our referent type. (Rooted<T>
+    # uses template magic that gives the referent a noisy type.)
+    strip_typedefs = False
+
     # Initialize a pretty-printer for |value|, using |cache|.
     #
     # If given, |content_printer| is a pretty-printer constructor to use for
@@ -42,6 +46,8 @@ class Common(object):
         ptr = self.value[self.member]
         if self.handle:
             ptr = ptr.dereference()
+        if self.strip_typedefs:
+            ptr = ptr.cast(ptr.type.strip_typedefs())
         if self.content_printer:
             return self.content_printer(ptr, self.cache).to_string()
         else:
@@ -53,7 +59,7 @@ class Common(object):
 
 @template_pretty_printer("JS::Rooted")
 class Rooted(Common):
-    pass
+    strip_typedefs = True
 
 @template_pretty_printer("JS::Handle")
 class Handle(Common):
diff --git a/js/src/jit-test/tests/debug/Object-script-AsmJSNative.js b/js/src/jit-test/tests/debug/Object-script-AsmJSNative.js
new file mode 100644
index 0000000000..650b71374a
--- /dev/null
+++ b/js/src/jit-test/tests/debug/Object-script-AsmJSNative.js
@@ -0,0 +1,15 @@
+function test(stdlib, foreign) {
+    "use asm"
+    function f(y) {
+        y = +y;
+    }
+    return f;
+};
+var g = newGlobal();
+g.parent = this;
+g.eval(`
+  var dbg = new Debugger();
+  var parentw = dbg.addDebuggee(parent);
+  var testw = parentw.makeDebuggeeValue(parent.test);
+  var scriptw = testw.script;
+`);
diff --git a/js/src/jscntxt.cpp b/js/src/jscntxt.cpp
index 8c585e59ef..3debc077bf 100644
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@@ -223,9 +223,8 @@ ReportError(JSContext* cx, const char* message, JSErrorReport* reportp,
     }
 
     if (cx->options().autoJSAPIOwnsErrorReporting() || JS_IsRunning(cx)) {
-        if (ErrorToException(cx, message, reportp, callback, userRef)) {
+        if (ErrorToException(cx, message, reportp, callback, userRef))
             return;
-        }
 
         /*
          * The AutoJSAPI error reporter only allows warnings to be reported so
@@ -233,7 +232,6 @@ ReportError(JSContext* cx, const char* message, JSErrorReport* reportp,
          */
         if (cx->options().autoJSAPIOwnsErrorReporting() && !JSREPORT_IS_WARNING(reportp->flags))
             return;
-
     }
 
     /*
@@ -587,7 +585,7 @@ js::ExpandErrorArgumentsVA(ExclusiveContext* cx, JSErrorCallback callback,
         size_t totalArgsLength = 0;
         size_t argLengths[JS::MaxNumErrorArguments]; /* only {0} thru {9} supported */
         argCount = efs->argCount;
-        MOZ_ASSERT(argCount <= JS::MaxNumErrorArguments);
+        MOZ_RELEASE_ASSERT(argCount <= JS::MaxNumErrorArguments);
         if (argCount > 0) {
             /*
              * Gather the arguments into an array, and accumulate
@@ -654,7 +652,7 @@ js::ExpandErrorArgumentsVA(ExclusiveContext* cx, JSErrorCallback callback,
                     if (*fmt == '{') {
                         if (isdigit(fmt[1])) {
                             int d = JS7_UNDEC(fmt[1]);
-                            MOZ_ASSERT(d < argCount);
+                            MOZ_RELEASE_ASSERT(d < argCount);
                             js_strncpy(out, reportp->messageArgs[d],
                                        argLengths[d]);
                             out += argLengths[d];
@@ -824,7 +822,7 @@ js::CallErrorReporter(JSContext* cx, const char* message, JSErrorReport* reportp
 }
 
 bool
-js::ReportIsNotDefined(JSContext *cx, HandleId id)
+js::ReportIsNotDefined(JSContext* cx, HandleId id)
 {
     JSAutoByteString printable;
     if (ValueToPrintable(cx, IdToValue(id), &printable))
@@ -833,7 +831,7 @@ js::ReportIsNotDefined(JSContext *cx, HandleId id)
 }
 
 bool
-js::ReportIsNotDefined(JSContext *cx, HandlePropertyName name)
+js::ReportIsNotDefined(JSContext* cx, HandlePropertyName name)
 {
     RootedId id(cx, NameToId(name));
     return ReportIsNotDefined(cx, id);
@@ -841,7 +839,7 @@ js::ReportIsNotDefined(JSContext *cx, HandlePropertyName name)
 
 bool
 js::ReportIsNullOrUndefined(JSContext* cx, int spindex, HandleValue v,
-                           HandleString fallback)
+                            HandleString fallback)
 {
     bool ok;
 
@@ -896,8 +894,9 @@ js::ReportValueErrorFlags(JSContext* cx, unsigned flags, const unsigned errorNum
                           int spindex, HandleValue v, HandleString fallback,
                           const char* arg1, const char* arg2)
 {
-    bool ok;
     UniquePtr<char[], JS::FreePolicy> bytes;
+    bool ok;
+
     MOZ_ASSERT(js_ErrorFormatString[errorNumber].argCount >= 1);
     MOZ_ASSERT(js_ErrorFormatString[errorNumber].argCount <= 3);
     bytes = DecompileValueGenerator(cx, spindex, v, fallback);
@@ -906,7 +905,6 @@ js::ReportValueErrorFlags(JSContext* cx, unsigned flags, const unsigned errorNum
 
     ok = JS_ReportErrorFlagsAndNumber(cx, flags, GetErrorMessage,
                                       nullptr, errorNumber, bytes.get(), arg1, arg2);
-
     return ok;
 }
 
diff --git a/js/src/jsfriendapi.h b/js/src/jsfriendapi.h
index de4b6cf90d..9a6ec74273 100644
--- a/js/src/jsfriendapi.h
+++ b/js/src/jsfriendapi.h
@@ -81,6 +81,9 @@ JS_GetCustomIteratorCount(JSContext* cx);
 extern JS_FRIEND_API(bool)
 JS_NondeterministicGetWeakMapKeys(JSContext* cx, JS::HandleObject obj, JS::MutableHandleObject ret);
 
+extern JS_FRIEND_API(bool)
+JS_NondeterministicGetWeakSetKeys(JSContext* cx, JS::HandleObject obj, JS::MutableHandleObject ret);
+
 // Raw JSScript* because this needs to be callable from a signal handler.
 extern JS_FRIEND_API(unsigned)
 JS_PCToLineNumber(JSScript* script, jsbytecode* pc, unsigned* columnp = nullptr);
diff --git a/js/src/tests/js1_8_5/reflect-parse/PatternBuilders.js b/js/src/tests/js1_8_5/reflect-parse/PatternBuilders.js
index f497f81801..2834aefee8 100644
--- a/js/src/tests/js1_8_5/reflect-parse/PatternBuilders.js
+++ b/js/src/tests/js1_8_5/reflect-parse/PatternBuilders.js
@@ -38,13 +38,14 @@ function funDecl(id, params, body, defaults=[], rest=null) {
                      rest: rest,
                      generator: false });
 }
-function genFunDecl(id, params, body) {
+function genFunDecl(style, id, params, body) {
     return Pattern({ type: "FunctionDeclaration",
                      id: id,
                      params: params,
                      defaults: [],
                      body: body,
-                     generator: true });
+                     generator: true,
+                     style: style });
 }
 function varDecl(decls) {
     return Pattern({ type: "VariableDeclaration", declarations: decls, kind: "var" });
@@ -157,12 +158,13 @@ function funExpr(id, args, body, gen) {
                      body: body,
                      generator: false });
 }
-function genFunExpr(id, args, body) {
+function genFunExpr(style, id, args, body) {
     return Pattern({ type: "FunctionExpression",
                      id: id,
                      params: args,
                      body: body,
-                     generator: true });
+                     generator: true,
+                     style: style });
 }
 function arrowExpr(args, body) {
     return Pattern({ type: "ArrowFunctionExpression",
diff --git a/js/src/tests/js1_8_5/reflect-parse/basicBuilder.js b/js/src/tests/js1_8_5/reflect-parse/basicBuilder.js
index a2bc120dab..007d983d14 100644
--- a/js/src/tests/js1_8_5/reflect-parse/basicBuilder.js
+++ b/js/src/tests/js1_8_5/reflect-parse/basicBuilder.js
@@ -41,8 +41,7 @@ assertGlobalExpr("({ x: y })", 13, { objectExpression: () => 13 });
 assertGlobalExpr("this", 14, { thisExpression: () => 14 });
 assertGlobalExpr("[x for (x in y)]", 17, { comprehensionExpression: () => 17 });
 assertGlobalExpr("(x for (x in y))", 18, { generatorExpression: () => 18 });
-assertGlobalExpr("(function() { yield 42 })", genFunExpr(null, [], blockStmt([exprStmt(19)])), { yieldExpression: () => 19 });
-assertGlobalExpr("(let (x) x)", 20, { letExpression: () => 20 });
+assertGlobalExpr("(function() { yield 42 })", genFunExpr("legacy", null, [], blockStmt([exprStmt(19)])), { yieldExpression: () => 19 });
 
 assertGlobalStmt("switch (x) { case y: }", switchStmt(ident("x"), [1]), { switchCase: () => 1 });
 assertGlobalStmt("try { } catch (e) { }", 2, { tryStatement: (b, g, u, f) => u, catchClause: () => 2 });
diff --git a/js/src/tests/js1_8_5/reflect-parse/classes.js b/js/src/tests/js1_8_5/reflect-parse/classes.js
index 44fcd4081c..9a230be8db 100644
--- a/js/src/tests/js1_8_5/reflect-parse/classes.js
+++ b/js/src/tests/js1_8_5/reflect-parse/classes.js
@@ -14,10 +14,11 @@ function testClasses() {
     function methodFun(id, kind, generator, args, body = []) {
         assertEq(generator && kind === "method", generator);
         assertEq(typeof id === 'string' || id === null, true);
-        let idN = typeof id === 'string' ? ident(id): null;
-        let methodMaker = generator ? genFunExpr : funExpr;
+        let idN = typeof id === 'string' ? ident(id) : null;
         let methodName = kind !== "method" ? null : idN;
-        return methodMaker(methodName, args.map(ident), blockStmt(body));
+        return generator
+               ? genFunExpr("es6", methodName, args.map(ident), blockStmt(body))
+               : funExpr(methodName, args.map(ident), blockStmt(body));
     }
 
     function simpleMethod(id, kind, generator, args=[], isStatic=false) {
diff --git a/js/src/tests/js1_8_5/reflect-parse/computedPropNames.js b/js/src/tests/js1_8_5/reflect-parse/computedPropNames.js
index 543125fae4..d96e73152b 100644
--- a/js/src/tests/js1_8_5/reflect-parse/computedPropNames.js
+++ b/js/src/tests/js1_8_5/reflect-parse/computedPropNames.js
@@ -31,6 +31,15 @@ assertExpr("b = { set [meth](a) { } }", aExpr("=", ident("b"),
               objExpr([{ key: computedName(ident("meth")), value: funExpr(null, [ident("a")],
                 blockStmt([])), method: false, kind: "set"}])));
 
+// Bug 1220702 - If it's not written as a method, `.method` should be false.
+assertExpr("({[x]: function () {}})",
+           objExpr([{
+               key: computedName(ident("x")),
+               value: funExpr(null, [], blockStmt([])),
+               method: false,
+               kind: "init"
+           }]));
+
 }
 
 runtest(test);
diff --git a/js/src/tests/js1_8_5/reflect-parse/generators.js b/js/src/tests/js1_8_5/reflect-parse/generators.js
index 18da38155d..eafdb1cbc0 100644
--- a/js/src/tests/js1_8_5/reflect-parse/generators.js
+++ b/js/src/tests/js1_8_5/reflect-parse/generators.js
@@ -3,10 +3,14 @@ function test() {
 
 // generators
 
-assertDecl("function gen(x) { yield }", genFunDecl(ident("gen"), [ident("x")], blockStmt([exprStmt(yieldExpr(null))])));
-assertExpr("(function(x) { yield })", genFunExpr(null, [ident("x")], blockStmt([exprStmt(yieldExpr(null))])));
-assertDecl("function gen(x) { yield 42 }", genFunDecl(ident("gen"), [ident("x")], blockStmt([exprStmt(yieldExpr(lit(42)))])));
-assertExpr("(function(x) { yield 42 })", genFunExpr(null, [ident("x")], blockStmt([exprStmt(yieldExpr(lit(42)))])));
+assertDecl("function gen(x) { yield }", genFunDecl("legacy", ident("gen"), [ident("x")], blockStmt([exprStmt(yieldExpr(null))])));
+assertExpr("(function(x) { yield })", genFunExpr("legacy", null, [ident("x")], blockStmt([exprStmt(yieldExpr(null))])));
+assertDecl("function gen(x) { yield 42 }", genFunDecl("legacy", ident("gen"), [ident("x")], blockStmt([exprStmt(yieldExpr(lit(42)))])));
+assertExpr("(function(x) { yield 42 })", genFunExpr("legacy", null, [ident("x")], blockStmt([exprStmt(yieldExpr(lit(42)))])));
+
+assertDecl("function* gen() {}", genFunDecl("es6", ident("gen"), [], blockStmt([])));
+assertExpr("(function*() {})", genFunExpr("es6", null, [], blockStmt([])));
+assertExpr("(function* gen() {})", genFunExpr("es6", ident("gen"), [], blockStmt([])));
 
 }
 
diff --git a/js/src/tests/js1_8_5/reflect-parse/methodDefn.js b/js/src/tests/js1_8_5/reflect-parse/methodDefn.js
index 090a0844fb..fb3986179e 100644
--- a/js/src/tests/js1_8_5/reflect-parse/methodDefn.js
+++ b/js/src/tests/js1_8_5/reflect-parse/methodDefn.js
@@ -7,7 +7,7 @@ assertExpr("b = { a() { } }", aExpr("=", ident("b"),
               true}])));
 
 assertExpr("b = { *a() { } }", aExpr("=", ident("b"),
-              objExpr([{ key: ident("a"), value: genFunExpr(ident("a"), [], blockStmt([])), method:
+              objExpr([{ key: ident("a"), value: genFunExpr("es6", ident("a"), [], blockStmt([])), method:
               true}])));
 
 // Method definitions without braces
@@ -28,9 +28,9 @@ assertExpr("({ set x(v) { return 42 } })",
 
 // Bug 1073809 - Getter/setter syntax with generators
 assertExpr("({*get() { }})", objExpr([{ type: "Property", key: ident("get"), method: true,
-                                        value: genFunExpr(ident("get"), [], blockStmt([]))}]));
+                                        value: genFunExpr("es6", ident("get"), [], blockStmt([]))}]));
 assertExpr("({*set() { }})", objExpr([{ type: "Property", key: ident("set"), method: true,
-                                        value: genFunExpr(ident("set"), [], blockStmt([]))}]));
+                                        value: genFunExpr("es6", ident("set"), [], blockStmt([]))}]));
 assertError("({*get foo() { }})", SyntaxError);
 assertError("({*set foo() { }})", SyntaxError);
 
diff --git a/js/src/tests/js1_8_5/reflect-parse/newTarget.js b/js/src/tests/js1_8_5/reflect-parse/newTarget.js
index 45cf527ec6..3db2c2726d 100644
--- a/js/src/tests/js1_8_5/reflect-parse/newTarget.js
+++ b/js/src/tests/js1_8_5/reflect-parse/newTarget.js
@@ -16,7 +16,7 @@ function testNewTarget() {
     assertError("(() => new.target))", SyntaxError);
 
     // valid in generators, too!
-    assertStmt("function *foo() { new.target; }", genFunDecl(ident("foo"), [],
+    assertStmt("function *foo() { new.target; }", genFunDecl("es6", ident("foo"), [],
                blockStmt([exprStmt(newTarget())])));
 
     // new.target is a member expression. You should be able to call, invoke, or
diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
index b440c4d478..2972ed9772 100644
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -7099,7 +7099,7 @@ DebuggerObject_getScript(JSContext* cx, unsigned argc, Value* vp)
     }
 
     RootedFunction fun(cx, &obj->as<JSFunction>());
-    if (fun->isBuiltin()) {
+    if (!fun->isInterpreted()) {
         args.rval().setUndefined();
         return true;
     }
diff --git a/js/xpconnect/tests/unit/test_weak_keys.js b/js/xpconnect/tests/unit/test_weak_keys.js
new file mode 100644
index 0000000000..e70983e9c3
--- /dev/null
+++ b/js/xpconnect/tests/unit/test_weak_keys.js
@@ -0,0 +1,45 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* See https://bugzilla.mozilla.org/show_bug.cgi?id=1165807 */
+
+function run_test()
+{
+  var bunnies = new String("bunnies");
+  var lizards = new String("lizards");
+
+  var weakset = new WeakSet([bunnies, lizards]);
+  var weakmap = new WeakMap();
+  weakmap.set(bunnies, 23);
+  weakmap.set(lizards, "oh no");
+
+  var keys = ThreadSafeChromeUtils.nondeterministicGetWeakMapKeys(bunnies);
+  equal(keys, undefined, "test nondeterministicGetWeakMapKeys on non-WeakMap");
+
+  keys = ThreadSafeChromeUtils.nondeterministicGetWeakMapKeys(weakmap);
+  equal(keys.length, 2, "length of nondeterministicGetWeakMapKeys");
+  equal(weakmap.get(bunnies), 23, "check bunnies in weakmap");
+  equal(weakmap.get(lizards), "oh no", "check lizards in weakmap");
+
+  keys = ThreadSafeChromeUtils.nondeterministicGetWeakSetKeys(bunnies);
+  equal(keys, undefined, "test nondeterministicGetWeakSetKeys on non-WeakMap");
+
+  keys = ThreadSafeChromeUtils.nondeterministicGetWeakSetKeys(weakset);
+  equal(keys.length, 2, "length of nondeterministicGetWeakSetKeys");
+  ok(weakset.has(bunnies), "check bunnies in weakset");
+  ok(weakset.has(lizards), "check lizards in weakset");
+
+  bunnies = null;
+  keys = null;
+
+  Components.utils.forceGC();
+
+  keys = ThreadSafeChromeUtils.nondeterministicGetWeakMapKeys(weakmap);
+  equal(keys.length, 1, "length of nondeterministicGetWeakMapKeys after GC");
+  equal(weakmap.get(lizards), "oh no", "check lizards still in weakmap");
+
+  keys = ThreadSafeChromeUtils.nondeterministicGetWeakSetKeys(weakset);
+  equal(keys.length, 1, "length of nondeterministicGetWeakSetKeys after GC");
+  ok(weakset.has(lizards), "check lizards still in weakset");
+}
diff --git a/js/xpconnect/tests/unit/xpcshell.ini b/js/xpconnect/tests/unit/xpcshell.ini
index 2aab65a4e2..6d931eb88e 100644
--- a/js/xpconnect/tests/unit/xpcshell.ini
+++ b/js/xpconnect/tests/unit/xpcshell.ini
@@ -126,6 +126,7 @@ head = head_watchdog.js
 head = head_watchdog.js
 [test_watchdog_hibernate.js]
 head = head_watchdog.js
+[test_weak_keys.js]
 [test_writeToGlobalPrototype.js]
 [test_xpcwn_tamperproof.js]
 [test_xrayed_iterator.js]
diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index c6621f50c1..075fc1f240 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -5200,9 +5200,31 @@ nsCSSFrameConstructor::FindSVGData(Element* aElement,
     // Elements with failing conditional processing attributes never get
     // rendered.  Note that this is not where we select which frame in a
     // <switch> to render!  That happens in nsSVGSwitchFrame::PaintSVG.
+    if (aIsWithinSVGText) {
+      // SVGTextFrame doesn't handle conditional processing attributes,
+      // so don't create frames for descendants of <text> with failing
+      // attributes.  We need frames not to be created so that text layout
+      // is correct.
+      return &sSuppressData;
+    }
+    // If we're not inside <text>, create an nsSVGContainerFrame (which is a
+    // frame that doesn't render) so that paint servers can still be referenced,
+    // even if they live inside an element with failing conditional processing
+    // attributes.
     return &sContainerData;
   }
 
+  // Ensure that a stop frame is a child of a gradient and that gradients
+  // can only have stop children.
+  bool parentIsGradient = aParentFrame &&
+    (aParentFrame->GetType() == nsGkAtoms::svgLinearGradientFrame ||
+     aParentFrame->GetType() == nsGkAtoms::svgRadialGradientFrame);
+  bool stop = (aTag == nsGkAtoms::stop);
+  if ((parentIsGradient && !stop) ||
+      (!parentIsGradient && stop)) {
+    return &sSuppressData;
+  }
+
   // Prevent bad frame types being children of filters or parents of filter
   // primitives.  If aParentFrame is null, we know that the frame that will
   // be created will be an nsInlineFrame, so it can never be a filter.
diff --git a/layout/reftests/svg/conditions-09-ref.svg b/layout/reftests/svg/conditions-09-ref.svg
new file mode 100644
index 0000000000..a6995f19c2
--- /dev/null
+++ b/layout/reftests/svg/conditions-09-ref.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="400" height="100">
+  <text x="10" y="20">
+    <tspan fill="green">This text should display.</tspan>
+  </text>
+</svg>
diff --git a/layout/reftests/svg/conditions-09.svg b/layout/reftests/svg/conditions-09.svg
new file mode 100644
index 0000000000..a5959b808b
--- /dev/null
+++ b/layout/reftests/svg/conditions-09.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="400" height="100">
+  <text x="10" y="20">
+    <tspan systemLanguage="xx" fill="red">This text shouldn't display.</tspan>
+    <tspan fill="green">This text should display.</tspan>
+  </text>
+</svg>
diff --git a/layout/reftests/svg/reftest.list b/layout/reftests/svg/reftest.list
index d3e23e15cd..c77c57af4d 100644
--- a/layout/reftests/svg/reftest.list
+++ b/layout/reftests/svg/reftest.list
@@ -51,6 +51,7 @@ fuzzy-if(/^Windows\x20NT\x206\.[12]/.test(http.oscpu),1,5) fuzzy-if(azureQuartz,
 == conditions-06.svg pass.svg
 == conditions-07.svg pass.svg
 == conditions-08.svg conditions-08-ref.svg
+== conditions-09.svg conditions-09-ref.svg
 == currentColor-01.svg pass.svg
 == currentColor-02.svg pass.svg
 == currentColor-03.svg pass.svg
@@ -290,6 +291,7 @@ fuzzy-if(cocoaWidget,4,15982) fuzzy-if(winWidget,4,92) == radialGradient-basic-0
 == rootElement-null-01.svg pass.svg
 == script-empty-01.svg pass.svg
 == selector-01.svg pass.svg
+== stroke-linecap-circle-ellipse-01.svg stroke-linecap-circle-ellipse-01-ref.svg
 == stroke-width-percentage-01.svg pass.svg
 == stroke-width-percentage-02a.svg stroke-width-percentage-02-ref.svg
 == stroke-width-percentage-02b.svg stroke-width-percentage-02-ref.svg
diff --git a/layout/reftests/svg/stroke-linecap-circle-ellipse-01-ref.svg b/layout/reftests/svg/stroke-linecap-circle-ellipse-01-ref.svg
new file mode 100644
index 0000000000..47065f0e87
--- /dev/null
+++ b/layout/reftests/svg/stroke-linecap-circle-ellipse-01-ref.svg
@@ -0,0 +1,14 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg xmlns="http://www.w3.org/2000/svg">
+  <title>Reference to test that stroke-linecap:"square" is ignored on circles and ellipses</title>
+  <!-- https://bugzilla.mozilla.org/show_bug.cgi?id=1178159 -->
+
+  <circle cx="300" cy="300" r="200" stroke="black" fill="none"
+          stroke-width="80"/>
+
+  <ellipse cx="300" cy="750" rx="150" ry="100" fill="none"
+           stroke="blue" stroke-width="80"/>
+</svg>
diff --git a/layout/reftests/svg/stroke-linecap-circle-ellipse-01.svg b/layout/reftests/svg/stroke-linecap-circle-ellipse-01.svg
new file mode 100644
index 0000000000..81fc433271
--- /dev/null
+++ b/layout/reftests/svg/stroke-linecap-circle-ellipse-01.svg
@@ -0,0 +1,14 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg xmlns="http://www.w3.org/2000/svg">
+  <title>Test that stroke-linecap:"square" is ignored on circles and ellipses</title>
+  <!-- https://bugzilla.mozilla.org/show_bug.cgi?id=1178159 -->
+
+  <circle cx="300" cy="300" r="200" stroke="black" fill="none"
+          stroke-width="80" stroke-linecap="square"/>
+
+  <ellipse cx="300" cy="750" rx="150" ry="100" fill="none"
+           stroke="blue" stroke-width="80" stroke-linecap="square"/>
+</svg>
diff --git a/layout/reftests/svg/stroke-linecap-round-w-zero-length-segs-01.svg b/layout/reftests/svg/stroke-linecap-round-w-zero-length-segs-01.svg
index 0f8e174d99..5a6c6ad2c2 100644
--- a/layout/reftests/svg/stroke-linecap-round-w-zero-length-segs-01.svg
+++ b/layout/reftests/svg/stroke-linecap-round-w-zero-length-segs-01.svg
@@ -6,11 +6,12 @@
   
   <title>Test 'stroke-linecap: round' with zero length path segments</title>
 
-  <!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=1075399 -->
+  <!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=1075399 for paths and
+       https://bugzilla.mozilla.org/show_bug.cgi?id=1187770 for lines -->
 
   <style>
 
-path {
+path, line {
   stroke-width: 20px;
   stroke-linecap: round;
 }
@@ -20,7 +21,7 @@ circle {
 }
 
 /* expect lime circles to cover red circles */
-path.circles-expected {
+path.circles-expected, line.circles-expected {
   stroke: lime;
 }
 
@@ -158,4 +159,11 @@ path.coverer {
     <circle cy="80" r="8"/>
     <path class="circles-expected" d="M0,0v81" stroke-dasharray="0" />
   </g>
+
+  <!-- Column 6: test zero-length line -->
+  <g transform="translate(625, 25)">
+    <circle cy="0" r="8" />
+    <line class="circles-expected" x1="0" y1="0" x2="0" y2="0" />
+  </g>
+
 </svg>
diff --git a/layout/reftests/svg/stroke-linecap-round-w-zero-length-segs-02.svg b/layout/reftests/svg/stroke-linecap-round-w-zero-length-segs-02.svg
index ced221b424..223a5e0df3 100644
--- a/layout/reftests/svg/stroke-linecap-round-w-zero-length-segs-02.svg
+++ b/layout/reftests/svg/stroke-linecap-round-w-zero-length-segs-02.svg
@@ -6,13 +6,15 @@
   
   <title>Test invalidation for 'stroke-linecap: round' with zero length path segments</title>
 
-  <!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=1075399 -->
+  <!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=1075399 for path and
+       https://bugzilla.mozilla.org/show_bug.cgi?id=1187770 for line -->
 
   <script>
 
 function run()
 {
   document.getElementById('path').setAttribute('stroke-linecap', 'butt');
+  document.getElementById('line').setAttribute('stroke-linecap', 'butt');
   document.documentElement.removeAttribute('class');
 }
 
@@ -24,5 +26,7 @@ window.addEventListener("MozReftestInvalidate", run, false);
 
   <path id="path" stroke="red" stroke-width="200" stroke-linecap="round"
         d="M100,100 L100,100"/>
+  <line id="line" stroke="red" stroke-width="200" stroke-linecap="round"
+        x1="300" y1="300" x2="300" y2="300"/>
 
 </svg>
diff --git a/layout/reftests/svg/stroke-linecap-square-w-zero-length-segs-01.svg b/layout/reftests/svg/stroke-linecap-square-w-zero-length-segs-01.svg
index b7fdf4f429..df395b0e16 100644
--- a/layout/reftests/svg/stroke-linecap-square-w-zero-length-segs-01.svg
+++ b/layout/reftests/svg/stroke-linecap-square-w-zero-length-segs-01.svg
@@ -6,11 +6,12 @@
   
   <title>Test 'stroke-linecap: square' with zero length path segments</title>
 
-  <!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=589648 -->
+  <!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=589648 for paths and
+       https://bugzilla.mozilla.org/show_bug.cgi?id=1187770 for lines -->
 
   <style>
 
-path {
+path, line {
   stroke-width: 20px;
   stroke-linecap: square;
 }
@@ -20,7 +21,7 @@ rect {
 }
 
 /* expect lime squares to cover red rects */
-path.squares-expected {
+path.squares-expected, line.squares-expected {
   stroke: lime;
 }
 
@@ -144,4 +145,10 @@ path.coverer {
     <path class="coverer" d="M20,20 L30,30 M70,70 L80,80"/>
   </g>
 
+  <!-- Column 5: test zero-length line -->
+  <g transform="translate(525, 25)">
+    <rect x="-9" y="-9" width="18" height="18"/>
+    <line class="squares-expected" x1="0" y1="0" x2="0" y2="0" />
+  </g>
+
 </svg>
diff --git a/layout/reftests/svg/stroke-linecap-square-w-zero-length-segs-02.svg b/layout/reftests/svg/stroke-linecap-square-w-zero-length-segs-02.svg
index 13c980abad..506b2f12fd 100644
--- a/layout/reftests/svg/stroke-linecap-square-w-zero-length-segs-02.svg
+++ b/layout/reftests/svg/stroke-linecap-square-w-zero-length-segs-02.svg
@@ -6,13 +6,15 @@
   
   <title>Test 'stroke-linecap: square' with zero length path segments</title>
 
-  <!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=589648 -->
+  <!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=589648 for path and
+       https://bugzilla.mozilla.org/show_bug.cgi?id=1187770 for line -->
 
   <script>
 
 function run()
 {
   document.getElementById('path').setAttribute('stroke-linecap', 'butt');
+  document.getElementById('line').setAttribute('stroke-linecap', 'butt');
   document.documentElement.removeAttribute('class');
 }
 
@@ -25,4 +27,7 @@ window.addEventListener("MozReftestInvalidate", run, false);
   <path id="path" stroke="red" stroke-width="200" stroke-linecap="square"
         d="M100,100 L100,100"/>
 
+  <line id="line" stroke="red" stroke-width="200" stroke-linecap="square"
+        x1="300" y1="300" x2="300" y2="300"/>
+
 </svg>
diff --git a/layout/svg/crashtests/1140080-1.svg b/layout/svg/crashtests/1140080-1.svg
new file mode 100644
index 0000000000..d424562468
--- /dev/null
+++ b/layout/svg/crashtests/1140080-1.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<script>
+
+window.addEventListener("load", function() {
+    var stop = document.getElementsByTagName("stop")[0];
+    stop.setAttribute("offset", "0");
+}, false);
+
+</script>
+<stop/>
+</svg>
diff --git a/layout/svg/crashtests/1149542-1.svg b/layout/svg/crashtests/1149542-1.svg
new file mode 100644
index 0000000000..7353f12775
--- /dev/null
+++ b/layout/svg/crashtests/1149542-1.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <style>
+    text { white-space: pre }
+    text::first-letter { color: red; }
+    tspan { display: none }
+  </style>
+  <text textLength="64">
+<tspan>a</tspan>b</text>
+</svg>
diff --git a/layout/svg/crashtests/1182496-1.html b/layout/svg/crashtests/1182496-1.html
new file mode 100644
index 0000000000..1d95905a2d
--- /dev/null
+++ b/layout/svg/crashtests/1182496-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <script>
+    function tweak(){
+      document.body.innerHTML="fuzz"
+    }
+  </script>
+</head>
+<body onload="tweak()">
+  <svg xmlns="http://www.w3.org/2000/svg">
+    <text>
+      <foreignObject requiredFeatures="foo">
+        <svg style="position: absolute;"/>
+      </foreignObject>
+    </text>
+  </svg>
+</body>
+</html>
+
+
diff --git a/layout/svg/crashtests/1209525-1.svg b/layout/svg/crashtests/1209525-1.svg
new file mode 100644
index 0000000000..21134df33b
--- /dev/null
+++ b/layout/svg/crashtests/1209525-1.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     width="0" height="0">
+
+  <rect width="10" height="10" stroke="black"
+        vector-effect="non-scaling-stroke" />
+
+</svg>
diff --git a/layout/svg/crashtests/1223281-1.svg b/layout/svg/crashtests/1223281-1.svg
new file mode 100644
index 0000000000..b548a9a600
--- /dev/null
+++ b/layout/svg/crashtests/1223281-1.svg
@@ -0,0 +1,24 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<script>
+<![CDATA[
+
+function forceFrameConstruction()
+{
+    document.documentElement.getBoundingClientRect();
+}
+
+function boom()
+{
+    document.documentElement.style.overflow = "scroll";
+    forceFrameConstruction()
+    document.documentElement.style.visibility = "visible";
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+
+<rect style="perspective: 10em;" />
+</svg>
+
diff --git a/layout/svg/crashtests/325427-1.svg b/layout/svg/crashtests/325427-1.svg
new file mode 100644
index 0000000000..1f1c645251
--- /dev/null
+++ b/layout/svg/crashtests/325427-1.svg
@@ -0,0 +1,20 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+  <defs>
+    <g id="module">
+      <use xlink:href="#module" />
+      <use xlink:href="#module" />
+      <use xlink:href="#module" />
+      <use xlink:href="#module" />
+      <use xlink:href="#baseModule" />
+      <use xlink:href="#baseModule" />
+      <use xlink:href="#extendsModule" />
+      <use xlink:href="#extendsModule" />
+      <use xlink:href="#extendsModule" />
+      <use xlink:href="#extendsModule" />
+      <use xlink:href="#extendsModule" />
+      <use xlink:href="#extendsModule" />
+    </g>
+    <use id="baseModule" xlink:href="#module" />
+    <use id="extendsModule" xlink:href="#module" />
+  </defs>
+</svg>
diff --git a/layout/svg/crashtests/803562-1.svg b/layout/svg/crashtests/803562-1.svg
new file mode 100644
index 0000000000..e6fc91127e
--- /dev/null
+++ b/layout/svg/crashtests/803562-1.svg
@@ -0,0 +1,18 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<foreignObject width="500" height="500" style="-moz-appearance: checkbox;">
+  <option xmlns="http://www.w3.org/1999/xhtml"></option>
+</foreignObject>
+
+<script>
+<![CDATA[
+
+window.addEventListener("load", function() {
+  document.getElementsByTagName("option")[0].appendChild(document.createTextNode("Option 1"));
+}, false);
+
+]]>
+</script>
+
+</svg>
+
diff --git a/layout/svg/crashtests/950324-1.svg b/layout/svg/crashtests/950324-1.svg
new file mode 100644
index 0000000000..a43d84f4d8
--- /dev/null
+++ b/layout/svg/crashtests/950324-1.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+    <text style="font-family: sans-serif;"> &#x0301;</text>
+</svg>
diff --git a/layout/svg/crashtests/crashtests.list b/layout/svg/crashtests/crashtests.list
index 48ff72a36f..115315abbc 100644
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -11,6 +11,7 @@ load 314244-1.xul
 load 322185-1.svg
 load 322215-1.svg
 load 323704-1.svg
+load 325427-1.svg
 load 326495-1.svg
 load 326974-1.svg
 load 327706-1.svg
@@ -150,6 +151,7 @@ load 789390-1.html
 load 790072.svg
 load 791826-1.svg
 load 808318-1.svg
+load 803562-1.svg
 load 813420-1.svg
 load 841163-1.svg
 load 841812-1.svg
@@ -178,6 +180,7 @@ load 898909-1.svg
 load 898951-1.svg
 load 913990.html
 load 919371-1.xhtml
+load 950324-1.svg
 load 952270-1.svg
 load 963086-1.svg
 load 974746-1.svg
@@ -187,4 +190,9 @@ load 979407-2.svg
 load 993443.svg
 load 1016145.svg
 load 1028512.svg
-
+load 1140080-1.svg
+load 1149542-1.svg
+load 1182496-1.html
+load 1209525-1.svg
+load 1223281-1.svg
+load extref-test-1.xhtml
diff --git a/layout/svg/nsSVGPathGeometryFrame.cpp b/layout/svg/nsSVGPathGeometryFrame.cpp
index bd8bd4481f..82cbf7f9f0 100644
--- a/layout/svg/nsSVGPathGeometryFrame.cpp
+++ b/layout/svg/nsSVGPathGeometryFrame.cpp
@@ -153,9 +153,9 @@ nsSVGPathGeometryFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
   nsSVGPathGeometryFrameBase::DidSetStyleContext(aOldStyleContext);
 
   if (aOldStyleContext) {
-    float oldOpacity = aOldStyleContext->PeekStyleDisplay()->mOpacity;
-    float newOpacity = StyleDisplay()->mOpacity;
-    if (newOpacity != oldOpacity &&
+    auto oldStyleDisplay = aOldStyleContext->PeekStyleDisplay();
+    if (oldStyleDisplay &&
+        StyleDisplay()->mOpacity != oldStyleDisplay->mOpacity &&
         nsSVGUtils::CanOptimizeOpacity(this)) {
       // nsIFrame::BuildDisplayListForStackingContext() is not going to create an
       // nsDisplayOpacity display list item, so DLBI won't invalidate for us.
@@ -165,9 +165,9 @@ nsSVGPathGeometryFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
     nsSVGPathGeometryElement* element =
       static_cast<nsSVGPathGeometryElement*>(mContent);
 
-    if (aOldStyleContext->PeekStyleSVG()) {
-      if ((StyleSVG()->mStrokeLinecap !=
-             aOldStyleContext->PeekStyleSVG()->mStrokeLinecap) &&
+    auto oldStyleSVG = aOldStyleContext->PeekStyleSVG();
+    if (oldStyleSVG && !SVGContentUtils::ShapeTypeHasNoCorners(mContent)) {
+      if (StyleSVG()->mStrokeLinecap != oldStyleSVG->mStrokeLinecap &&
           element->IsSVGElement(nsGkAtoms::path)) {
         // If the stroke-linecap changes to or from "butt" then our element
         // needs to update its cached Moz2D Path, since SVGPathData::BuildPath
@@ -175,15 +175,13 @@ nsSVGPathGeometryFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
         // length subpaths base on that property.
         element->ClearAnyCachedPath();
       } else if (GetStateBits() & NS_STATE_SVG_CLIPPATH_CHILD) {
-        if (StyleSVG()->mClipRule !=
-              aOldStyleContext->PeekStyleSVG()->mClipRule) {
+        if (StyleSVG()->mClipRule != oldStyleSVG->mClipRule) {
           // Moz2D Path objects are fill-rule specific.
           // For clipPath we use clip-rule as the path's fill-rule.
           element->ClearAnyCachedPath();
         }
       } else {
-        if (StyleSVG()->mFillRule !=
-              aOldStyleContext->PeekStyleSVG()->mFillRule) {
+        if (StyleSVG()->mFillRule != oldStyleSVG->mFillRule) {
           // Moz2D Path objects are fill-rule specific.
           element->ClearAnyCachedPath();
         }
@@ -350,8 +348,23 @@ nsSVGPathGeometryFrame::GetFrameForPoint(const gfxPoint& aPoint)
 nsRect
 nsSVGPathGeometryFrame::GetCoveredRegion()
 {
+  gfxMatrix canvasTM = GetCanvasTM();
+  if (canvasTM.PreservesAxisAlignedRectangles()) {
+    return nsSVGUtils::TransformFrameRectToOuterSVG(
+             mRect, canvasTM, PresContext());
+  }
+
+  // To get tight bounds we need to compute directly in outer SVG coordinates
+  uint32_t flags = nsSVGUtils::eBBoxIncludeFill |
+                   nsSVGUtils::eBBoxIncludeStroke |
+                   nsSVGUtils::eBBoxIncludeMarkers;
+  gfxRect extent =
+    GetBBoxContribution(ToMatrix(canvasTM), flags).ToThebesRect();
+  nsRect region = nsLayoutUtils::RoundGfxRectToAppRect(
+                    extent, PresContext()->AppUnitsPerCSSPixel());
+
   return nsSVGUtils::TransformFrameRectToOuterSVG(
-           mRect, GetCanvasTM(), PresContext());
+                       region, gfxMatrix(), PresContext());
 }
 
 void
@@ -469,25 +482,39 @@ nsSVGPathGeometryFrame::GetBBoxContribution(const Matrix &aToBBoxUserspace,
                    ((aFlags & nsSVGUtils::eBBoxIncludeStroke) &&
                     nsSVGUtils::HasStroke(this));
 
-  bool gotSimpleBounds = false;
-  if (!StyleSVGReset()->HasNonScalingStroke()) {
-    SVGContentUtils::AutoStrokeOptions strokeOptions;
+  SVGContentUtils::AutoStrokeOptions strokeOptions;
+  if (getStroke) {
+    SVGContentUtils::GetStrokeOptions(&strokeOptions, element,
+                                      StyleContext(), nullptr,
+                                      SVGContentUtils::eIgnoreStrokeDashing);
+  } else {
+    // Override the default line width of 1.f so that when we call
+    // GetGeometryBounds below the result doesn't include stroke bounds.
     strokeOptions.mLineWidth = 0.f;
-    if (getStroke) {
-      SVGContentUtils::GetStrokeOptions(&strokeOptions, element,
-        StyleContext(), nullptr,
-        SVGContentUtils::eIgnoreStrokeDashing);
+  }
+
+  Rect simpleBounds;
+  bool gotSimpleBounds = false;
+  gfxMatrix userToOuterSVG;
+  if (getStroke &&
+      nsSVGUtils::GetNonScalingStrokeTransform(this, &userToOuterSVG)) {
+    Matrix moz2dUserToOuterSVG = ToMatrix(userToOuterSVG);
+    if (moz2dUserToOuterSVG.IsSingular()) {
+      return bbox;
     }
-    Rect simpleBounds;
+    gotSimpleBounds = element->GetGeometryBounds(&simpleBounds,
+                                                 strokeOptions,
+                                                 aToBBoxUserspace,
+                                                 &moz2dUserToOuterSVG);
+  } else {
     gotSimpleBounds = element->GetGeometryBounds(&simpleBounds,
                                                  strokeOptions,
                                                  aToBBoxUserspace);
-    if (gotSimpleBounds) {
-      bbox = simpleBounds;
-    }
   }
 
-  if (!gotSimpleBounds) {
+  if (gotSimpleBounds) {
+    bbox = simpleBounds;
+  } else {
     // Get the bounds using a Moz2D Path object (more expensive):
     RefPtr<DrawTarget> tmpDT;
 #ifdef XP_WIN
diff --git a/layout/svg/nsSVGUtils.cpp b/layout/svg/nsSVGUtils.cpp
index f7d6c07481..c30288f8fb 100644
--- a/layout/svg/nsSVGUtils.cpp
+++ b/layout/svg/nsSVGUtils.cpp
@@ -1200,7 +1200,7 @@ PathExtentsToMaxStrokeExtents(const gfxRect& aPathExtents,
   gfxMatrix outerSVGToUser;
   if (nsSVGUtils::GetNonScalingStrokeTransform(aFrame, &outerSVGToUser)) {
     outerSVGToUser.Invert();
-    matrix *= outerSVGToUser;
+    matrix.PreMultiply(outerSVGToUser);
   }
 
   double dx = style_expansion * (fabs(matrix._11) + fabs(matrix._21));
@@ -1226,8 +1226,7 @@ nsSVGUtils::PathExtentsToMaxStrokeExtents(const gfxRect& aPathExtents,
                                           const gfxMatrix& aMatrix)
 {
   bool strokeMayHaveCorners =
-    !aFrame->GetContent()->IsAnyOfSVGElements(nsGkAtoms::circle,
-                                              nsGkAtoms::ellipse);
+    !SVGContentUtils::ShapeTypeHasNoCorners(aFrame->GetContent());
 
   // For a shape without corners the stroke can only extend half the stroke
   // width from the path in the x/y-axis directions. For shapes with corners
diff --git a/layout/svg/svg.css b/layout/svg/svg.css
index 8d5cad63cf..e367c3cb61 100644
--- a/layout/svg/svg.css
+++ b/layout/svg/svg.css
@@ -32,6 +32,7 @@ svg:not(:root), symbol, image, marker, pattern, foreignObject {
 }
 
 foreignObject {
+  -moz-appearance: none ! important;
   margin: 0 ! important;
   padding: 0 ! important;
   border-width: 0 ! important;
diff --git a/modules/libjar/InterceptedJARChannel.cpp b/modules/libjar/InterceptedJARChannel.cpp
index 8323145343..a47c262479 100644
--- a/modules/libjar/InterceptedJARChannel.cpp
+++ b/modules/libjar/InterceptedJARChannel.cpp
@@ -123,6 +123,12 @@ InterceptedJARChannel::SetChannelInfo(mozilla::dom::ChannelInfo* aChannelInfo)
   return aChannelInfo->ResurrectInfoOnChannel(mChannel);
 }
 
+NS_IMETHODIMP
+InterceptedJARChannel::GetConsoleReportCollector(nsIConsoleReportCollector**)
+{
+  return NS_ERROR_NOT_AVAILABLE;
+}
+
 void
 InterceptedJARChannel::NotifyController()
 {
@@ -146,9 +152,3 @@ InterceptedJARChannel::NotifyController()
   }
   mController = nullptr;
 }
-
-nsIConsoleReportCollector*
-InterceptedJARChannel::GetConsoleReportCollector() const
-{
-  return nullptr;
-}
diff --git a/modules/libjar/InterceptedJARChannel.h b/modules/libjar/InterceptedJARChannel.h
index 07a722b81d..f1dd2e78e7 100644
--- a/modules/libjar/InterceptedJARChannel.h
+++ b/modules/libjar/InterceptedJARChannel.h
@@ -53,9 +53,6 @@ public:
   NS_DECL_NSIINTERCEPTEDCHANNEL
 
   void NotifyController();
-
-  virtual nsIConsoleReportCollector*
-  GetConsoleReportCollector() const override;
 };
 
 } // namespace net
diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index dad4622312..02806b5b64 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -1400,8 +1400,10 @@ pref("privacy.popups.disable_from_plugins", 2);
 
 // send "do not track" HTTP header, disabled by default
 pref("privacy.donottrackheader.enabled",    false);
-// Enforce tracking protection
+// Enforce tracking protection in all modes
 pref("privacy.trackingprotection.enabled",  false);
+// Enforce tracking protection in Private Browsing mode
+pref("privacy.trackingprotection.pbmode.enabled",  true);
 
 pref("dom.event.contextmenu.enabled",       true);
 pref("dom.event.clipboardevents.enabled",   true);
@@ -2134,7 +2136,7 @@ pref("network.cookie.cookieBehavior",       0); // 0-Accept, 1-dontAcceptForeign
 pref("network.cookie.cookieBehavior",       0); // Keep the old default of accepting all cookies
 #endif
 pref("network.cookie.thirdparty.sessionOnly", false);
-pref("network.cookie.lifetimePolicy",       0); // 0-accept normally, 2-acceptForSession,3-acceptForNDays
+pref("network.cookie.lifetimePolicy",       0); // 0-accept, 2-acceptForSession, 3-acceptForNDays
 pref("network.cookie.alwaysAcceptSessionCookies", false);
 pref("network.cookie.prefsMigrated",        false);
 pref("network.cookie.lifetime.days",        90);
diff --git a/netwerk/base/EventTokenBucket.cpp b/netwerk/base/EventTokenBucket.cpp
index 22b7dc0d6a..d6696a9793 100644
--- a/netwerk/base/EventTokenBucket.cpp
+++ b/netwerk/base/EventTokenBucket.cpp
@@ -19,8 +19,6 @@
 #include <mmsystem.h>
 #endif
 
-extern PRThread *gSocketThread;
-
 namespace mozilla {
 namespace net {
 
diff --git a/netwerk/base/LoadInfo.cpp b/netwerk/base/LoadInfo.cpp
index 862c8208d0..73e973f981 100644
--- a/netwerk/base/LoadInfo.cpp
+++ b/netwerk/base/LoadInfo.cpp
@@ -429,6 +429,8 @@ NS_IMETHODIMP
 LoadInfo::AppendRedirectedPrincipal(nsIPrincipal* aPrincipal, bool aIsInternalRedirect)
 {
   NS_ENSURE_ARG(aPrincipal);
+  MOZ_ASSERT(NS_IsMainThread());
+
   mRedirectChainIncludingInternalRedirects.AppendElement(aPrincipal);
   if (!aIsInternalRedirect) {
     mRedirectChain.AppendElement(aPrincipal);
diff --git a/netwerk/base/Predictor.cpp b/netwerk/base/Predictor.cpp
index 253af01e8a..f62213339f 100644
--- a/netwerk/base/Predictor.cpp
+++ b/netwerk/base/Predictor.cpp
@@ -1822,7 +1822,8 @@ Predictor::Resetter::OnCacheStorageInfo(uint32_t entryCount, uint64_t consumptio
 NS_IMETHODIMP
 Predictor::Resetter::OnCacheEntryInfo(nsIURI *uri, const nsACString &idEnhance,
                                       int64_t dataSize, int32_t fetchCount,
-                                      uint32_t lastModifiedTime, uint32_t expirationTime)
+                                      uint32_t lastModifiedTime, uint32_t expirationTime,
+                                      bool aPinned)
 {
   MOZ_ASSERT(NS_IsMainThread());
 
diff --git a/netwerk/base/TLSServerSocket.cpp b/netwerk/base/TLSServerSocket.cpp
index 6bc845fe62..a53d58657f 100644
--- a/netwerk/base/TLSServerSocket.cpp
+++ b/netwerk/base/TLSServerSocket.cpp
@@ -20,8 +20,6 @@
 #include "ScopedNSSTypes.h"
 #include "ssl.h"
 
-extern PRThread *gSocketThread;
-
 namespace mozilla {
 namespace net {
 
@@ -222,6 +220,31 @@ TLSServerSocket::SetRequestClientCertificate(uint32_t aMode)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+TLSServerSocket::SetCipherSuites(uint16_t* aCipherSuites, uint32_t aLength)
+{
+  // If AsyncListen was already called (and set mListener), it's too late to set
+  // this.
+  if (NS_WARN_IF(mListener)) {
+    return NS_ERROR_IN_PROGRESS;
+  }
+
+  for (uint16_t i = 0; i < SSL_NumImplementedCiphers; ++i) {
+    uint16_t cipher_id = SSL_ImplementedCiphers[i];
+    if (SSL_CipherPrefSet(mFD, cipher_id, false) != SECSuccess) {
+      return mozilla::psm::GetXPCOMFromNSSError(PR_GetError());
+    }
+  }
+
+  for (uint32_t i = 0; i < aLength; ++i) {
+    if (SSL_CipherPrefSet(mFD, aCipherSuites[i], true) != SECSuccess) {
+      return mozilla::psm::GetXPCOMFromNSSError(PR_GetError());
+    }
+  }
+
+  return NS_OK;
+}
+
 //-----------------------------------------------------------------------------
 // TLSServerConnectionInfo
 //-----------------------------------------------------------------------------
diff --git a/netwerk/base/nsBaseChannel.cpp b/netwerk/base/nsBaseChannel.cpp
index bc0ccf0f6f..64c4d39404 100644
--- a/netwerk/base/nsBaseChannel.cpp
+++ b/netwerk/base/nsBaseChannel.cpp
@@ -21,7 +21,7 @@
 #include "nsProxyRelease.h"
 #include "nsXULAppAPI.h"
 #include "nsContentSecurityManager.h"
-#include "mozilla/LoadInfo.h"
+#include "LoadInfo.h"
 
 static PLDHashOperator
 CopyProperties(const nsAString &key, nsIVariant *data, void *closure)
@@ -89,15 +89,27 @@ nsBaseChannel::Redirect(nsIChannel *newChannel, uint32_t redirectFlags,
   newChannel->SetLoadGroup(mLoadGroup);
   newChannel->SetNotificationCallbacks(mCallbacks);
   newChannel->SetLoadFlags(mLoadFlags | LOAD_REPLACE);
-  // bug 1278013 and backbugs
+
+  // make a copy of the loadinfo, append to the redirectchain
+  // and set it on the new channel
   if (mLoadInfo) {
-    nsSecurityFlags secFlags = mLoadInfo->GetSecurityFlags() ^
-                               nsILoadInfo::SEC_FORCE_INHERIT_PRINCIPAL;
     nsCOMPtr<nsILoadInfo> newLoadInfo =
-      static_cast<mozilla::LoadInfo*>(mLoadInfo.get())->CloneWithNewSecFlags(secFlags);
+      static_cast<mozilla::LoadInfo*>(mLoadInfo.get())->Clone();
+
+    nsCOMPtr<nsIPrincipal> uriPrincipal;
+    nsIScriptSecurityManager *sm = nsContentUtils::GetSecurityManager();
+    sm->GetChannelURIPrincipal(this, getter_AddRefs(uriPrincipal));
+    bool isInternalRedirect =
+      (redirectFlags & (nsIChannelEventSink::REDIRECT_INTERNAL |
+                        nsIChannelEventSink::REDIRECT_STS_UPGRADE));
+    newLoadInfo->AppendRedirectedPrincipal(uriPrincipal, isInternalRedirect);
     newChannel->SetLoadInfo(newLoadInfo);
-  } else
+  }
+  else {
+    // the newChannel was created with a dummy loadInfo, we should clear
+    // it in case the original channel does not have a loadInfo
     newChannel->SetLoadInfo(nullptr);
+  }
 
   // Try to preserve the privacy bit if it has been overridden
   if (mPrivateBrowsingOverriden) {
@@ -172,14 +184,6 @@ nsBaseChannel::ContinueRedirect()
       rv = mRedirectChannel->AsyncOpen(mListener, mListenerContext);
     }
     NS_ENSURE_SUCCESS(rv, rv);
-    // Append the initial uri of the channel to the redirectChain
-    // after the channel got openend successfully.
-    if (mLoadInfo) {
-      nsCOMPtr<nsIPrincipal> uriPrincipal;
-      nsIScriptSecurityManager *sm = nsContentUtils::GetSecurityManager();
-      sm->GetChannelURIPrincipal(this, getter_AddRefs(uriPrincipal));
-      mLoadInfo->AppendRedirectedPrincipal(uriPrincipal, false);
-    }
   }
 
   mRedirectChannel = nullptr;
diff --git a/netwerk/base/nsChannelClassifier.cpp b/netwerk/base/nsChannelClassifier.cpp
index d5136c7587..3d54e8ffb1 100644
--- a/netwerk/base/nsChannelClassifier.cpp
+++ b/netwerk/base/nsChannelClassifier.cpp
@@ -19,6 +19,7 @@
 #include "nsIIOService.h"
 #include "nsIParentChannel.h"
 #include "nsIPermissionManager.h"
+#include "nsIPrivateBrowsingTrackingProtectionWhitelist.h"
 #include "nsIProtocolHandler.h"
 #include "nsIScriptError.h"
 #include "nsIScriptSecurityManager.h"
@@ -64,7 +65,9 @@ nsChannelClassifier::ShouldEnableTrackingProtection(nsIChannel *aChannel,
     NS_ENSURE_ARG(result);
     *result = false;
 
-    if (!Preferences::GetBool("privacy.trackingprotection.enabled", false)) {
+    if (!Preferences::GetBool("privacy.trackingprotection.enabled", false) &&
+        (!Preferences::GetBool("privacy.trackingprotection.pbmode.enabled",
+                               false) || !NS_UsePrivateBrowsing(aChannel))) {
       return NS_OK;
     }
 
@@ -158,6 +161,25 @@ nsChannelClassifier::ShouldEnableTrackingProtection(nsIChannel *aChannel,
       *result = true;
     }
 
+    // In Private Browsing Mode we also check against an in-memory list.
+    if (NS_UsePrivateBrowsing(aChannel)) {
+      nsCOMPtr<nsIPrivateBrowsingTrackingProtectionWhitelist> pbmtpWhitelist =
+          do_GetService(NS_PBTRACKINGPROTECTIONWHITELIST_CONTRACTID, &rv);
+      NS_ENSURE_SUCCESS(rv, rv);
+
+      bool exists = false;
+      rv = pbmtpWhitelist->ExistsInAllowList(topWinURI, &exists);
+      NS_ENSURE_SUCCESS(rv, rv);
+
+      if (exists) {
+        mIsAllowListed = true;
+        LOG(("nsChannelClassifier[%p]: Allowlisting channel[%p] in PBM for %s",
+             this, aChannel, escaped.get()));
+      }
+
+      *result = !exists;
+    }
+
     // Tracking protection will be enabled so return without updating
     // the security state. If any channels are subsequently cancelled
     // (page elements blocked) the state will be then updated.
diff --git a/netwerk/base/nsICachingChannel.idl b/netwerk/base/nsICachingChannel.idl
index 7c6d2b5dba..c0e1abbbd3 100644
--- a/netwerk/base/nsICachingChannel.idl
+++ b/netwerk/base/nsICachingChannel.idl
@@ -17,7 +17,7 @@ interface nsIFile;
  *   3) Support for uniquely identifying cached data in cases when the URL
  *      is insufficient (e.g., HTTP form submission).
  */
-[scriptable, uuid(436b939d-e391-48e5-ba64-ab0e496e3400)]
+[scriptable, uuid(dd1d6122-5ecf-4fe4-8f0f-995e7ab3121a)]
 interface nsICachingChannel : nsICacheInfoChannel
 {
     /**
@@ -53,6 +53,11 @@ interface nsICachingChannel : nsICacheInfoChannel
      */
     attribute boolean cacheOnlyMetadata;
 
+    /**
+     * Tells the channel to use the pinning storage.
+     */
+    attribute boolean pin;
+
     /**************************************************************************
      * Caching channel specific load flags:
      */
diff --git a/netwerk/base/nsINetworkInterceptController.idl b/netwerk/base/nsINetworkInterceptController.idl
index 83f96ef225..3e9ff02018 100644
--- a/netwerk/base/nsINetworkInterceptController.idl
+++ b/netwerk/base/nsINetworkInterceptController.idl
@@ -7,6 +7,7 @@
 #include "nsIContentPolicyBase.idl"
 
 interface nsIChannel;
+interface nsIConsoleReportCollector;
 interface nsIOutputStream;
 interface nsIURI;
 
@@ -28,7 +29,7 @@ class ChannelInfo;
  * which do not implement nsIChannel.
  */
 
-[scriptable, uuid(ea78e439-cc42-4b2d-a42b-85ab55a149d1)]
+[scriptable, uuid(231bb567-90e1-4973-9728-7dab93ab29a8)]
 interface nsIInterceptedChannel : nsISupports
 {
     /**
@@ -87,16 +88,17 @@ interface nsIInterceptedChannel : nsISupports
     [noscript]
     readonly attribute nsContentPolicyType internalContentPolicyType;
 
+    [noscript]
+    readonly attribute nsIConsoleReportCollector consoleReportCollector;
+
 %{C++
-    // Allow access to the inner channel as a ConsoleReportCollector off
-    // the main thread.  Pure C++ method here to avoid requiring an
-    // AddRef() during QI.  Callers should not save the returned pointer.
-    // May return nullptr.
-    //
-    // Note: Only safe to use OMT prior to resetInterception(),
-    //       finishSynthesizedResponse(), and cancel().
-    virtual nsIConsoleReportCollector*
-    GetConsoleReportCollector() const = 0;
+    already_AddRefed<nsIConsoleReportCollector>
+    GetConsoleReportCollector()
+    {
+      nsCOMPtr<nsIConsoleReportCollector> reporter;
+      GetConsoleReportCollector(getter_AddRefs(reporter));
+      return reporter.forget();
+    }
 %}
 };
 
diff --git a/netwerk/base/nsITLSServerSocket.idl b/netwerk/base/nsITLSServerSocket.idl
index ecf2648a98..5ad67d95ab 100644
--- a/netwerk/base/nsITLSServerSocket.idl
+++ b/netwerk/base/nsITLSServerSocket.idl
@@ -8,7 +8,7 @@ interface nsIX509Cert;
 interface nsITLSServerSecurityObserver;
 interface nsISocketTransport;
 
-[scriptable, uuid(2e025b6c-96ba-4781-85fb-d1cf1a653207)]
+[scriptable, uuid(cc2c30f9-cfaa-4b8a-bd44-c24881981b74)]
 interface nsITLSServerSocket : nsIServerSocket
 {
   /**
@@ -60,6 +60,15 @@ interface nsITLSServerSocket : nsIServerSocket
    * change the default.
    */
   void setRequestClientCertificate(in unsigned long aRequestClientCert);
+
+  /**
+   * setCipherSuites
+   *
+   * The server's cipher suites that is used by the TLS handshake.
+   * This is required to be set before calling |asyncListen|.
+   */
+  void setCipherSuites([array, size_is(aLength)] in unsigned short aCipherSuites,
+                       in unsigned long aLength);
 };
 
 /**
diff --git a/netwerk/base/nsSocketTransportService2.cpp b/netwerk/base/nsSocketTransportService2.cpp
index a6a62b9282..0adf895ee5 100644
--- a/netwerk/base/nsSocketTransportService2.cpp
+++ b/netwerk/base/nsSocketTransportService2.cpp
@@ -18,6 +18,7 @@
 #include "nsIPrefBranch.h"
 #include "nsServiceManagerUtils.h"
 #include "nsIObserverService.h"
+#include "mozilla/Atomics.h"
 #include "mozilla/Services.h"
 #include "mozilla/Likely.h"
 #include "mozilla/PublicSSL.h"
@@ -33,7 +34,7 @@ LazyLogModule gSocketTransportLog("nsSocketTransport");
 LazyLogModule gUDPSocketLog("UDPSocket");
 
 nsSocketTransportService *gSocketTransportService = nullptr;
-PRThread                 *gSocketThread           = nullptr;
+Atomic<PRThread*, Relaxed> gSocketThread;
 
 #define SEND_BUFFER_PREF "network.tcp.sendbuffer"
 #define KEEPALIVE_ENABLED_PREF "network.tcp.keepalive.enabled"
diff --git a/netwerk/base/nsSocketTransportService2.h b/netwerk/base/nsSocketTransportService2.h
index e21c4847a4..b03819f1f2 100644
--- a/netwerk/base/nsSocketTransportService2.h
+++ b/netwerk/base/nsSocketTransportService2.h
@@ -260,6 +260,6 @@ private:
 };
 
 extern nsSocketTransportService *gSocketTransportService;
-extern PRThread                 *gSocketThread;
+extern mozilla::Atomic<PRThread*, mozilla::Relaxed> gSocketThread;
 
 #endif // !nsSocketTransportService_h__
diff --git a/netwerk/base/nsTemporaryFileInputStream.cpp b/netwerk/base/nsTemporaryFileInputStream.cpp
index 4eb7161c18..2d24a77828 100644
--- a/netwerk/base/nsTemporaryFileInputStream.cpp
+++ b/netwerk/base/nsTemporaryFileInputStream.cpp
@@ -7,11 +7,12 @@
 #include "nsStreamUtils.h"
 #include <algorithm>
 
-NS_IMPL_ISUPPORTS(nsTemporaryFileInputStream, nsIInputStream)
+NS_IMPL_ISUPPORTS(nsTemporaryFileInputStream, nsIInputStream, nsISeekableStream)
 
 nsTemporaryFileInputStream::nsTemporaryFileInputStream(FileDescOwner* aFileDescOwner, uint64_t aStartPos, uint64_t aEndPos)
   : mFileDescOwner(aFileDescOwner),
     mStartPos(aStartPos),
+    mCurPos(aStartPos),
     mEndPos(aEndPos),
     mClosed(false)
 { 
@@ -31,9 +32,9 @@ nsTemporaryFileInputStream::Available(uint64_t * bytesAvailable)
   if (mClosed)
     return NS_BASE_STREAM_CLOSED;
 
-  NS_ASSERTION(mStartPos <= mEndPos, "StartPos should less equal than EndPos!");
+  NS_ASSERTION(mCurPos <= mEndPos, "CurPos should less equal than EndPos!");
 
-  *bytesAvailable = mEndPos - mStartPos;
+  *bytesAvailable = mEndPos - mCurPos;
   return NS_OK;
 }
 
@@ -50,7 +51,7 @@ nsTemporaryFileInputStream::ReadSegments(nsWriteSegmentFun writer,
                                          uint32_t *        result)
 {
   NS_ASSERTION(result, "null ptr");
-  NS_ASSERTION(mStartPos <= mEndPos, "bad stream state");
+  NS_ASSERTION(mCurPos <= mEndPos, "bad stream state");
   *result = 0;
 
   if (mClosed) {
@@ -58,10 +59,10 @@ nsTemporaryFileInputStream::ReadSegments(nsWriteSegmentFun writer,
   }
 
   mozilla::MutexAutoLock lock(mFileDescOwner->FileMutex());
-  PR_Seek64(mFileDescOwner->mFD, mStartPos, PR_SEEK_SET);
+  PR_Seek64(mFileDescOwner->mFD, mCurPos, PR_SEEK_SET);
 
   // Limit requested count to the amount remaining in our section of the file.
-  count = std::min(count, uint32_t(mEndPos - mStartPos));
+  count = std::min(count, uint32_t(mEndPos - mCurPos));
 
   char buf[4096];
   while (*result < count) {
@@ -81,7 +82,7 @@ nsTemporaryFileInputStream::ReadSegments(nsWriteSegmentFun writer,
         // from writer are not propagated to ReadSegments' caller.
         //
         // If writer fails, leaving bytes still in buf, that's okay: we
-        // only update mStartPos to reflect successful writes, so the call
+        // only update mCurPos to reflect successful writes, so the call
         // to PR_Seek64 at the top will restart us at the right spot.
         return NS_OK;
       }
@@ -89,7 +90,7 @@ nsTemporaryFileInputStream::ReadSegments(nsWriteSegmentFun writer,
                    "writer should not write more than we asked it to write");
       bytesWritten += writerCount;
       *result += writerCount;
-      mStartPos += writerCount;
+      mCurPos += writerCount;
     }
   }
 
@@ -103,3 +104,60 @@ nsTemporaryFileInputStream::IsNonBlocking(bool * nonBlocking)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsTemporaryFileInputStream::Seek(int32_t aWhence, int64_t aOffset)
+{
+  if (mClosed) {
+    return NS_BASE_STREAM_CLOSED;
+  }
+
+  switch (aWhence) {
+    case nsISeekableStream::NS_SEEK_SET:
+      aOffset += mStartPos;
+      break;
+
+    case nsISeekableStream::NS_SEEK_CUR:
+      aOffset += mCurPos;
+      break;
+
+    case nsISeekableStream::NS_SEEK_END:
+      aOffset += mEndPos;
+      break;
+
+    default:
+      return NS_ERROR_FAILURE;
+  }
+
+  if (aOffset < (int64_t)mStartPos || aOffset > (int64_t)mEndPos) {
+    return NS_ERROR_INVALID_ARG;
+  }
+
+  mCurPos = aOffset;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsTemporaryFileInputStream::Tell(int64_t* aPos)
+{
+  if (!aPos) {
+    return NS_ERROR_FAILURE;
+  }
+
+  if (mClosed) {
+    return NS_BASE_STREAM_CLOSED;
+  }
+
+  MOZ_ASSERT(mStartPos <= mCurPos, "StartPos should less equal than CurPos!");
+  *aPos = mCurPos - mStartPos;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsTemporaryFileInputStream::SetEOF()
+{
+  if (mClosed) {
+    return NS_BASE_STREAM_CLOSED;
+  }
+
+  return Close();
+}
diff --git a/netwerk/base/nsTemporaryFileInputStream.h b/netwerk/base/nsTemporaryFileInputStream.h
index 32bdf468a8..8299daa7d3 100644
--- a/netwerk/base/nsTemporaryFileInputStream.h
+++ b/netwerk/base/nsTemporaryFileInputStream.h
@@ -7,11 +7,13 @@
 #define nsTemporaryFileInputStream_h__
 
 #include "mozilla/Mutex.h"
-#include "nsIInputStream.h"
 #include "nsAutoPtr.h"
+#include "nsIInputStream.h"
+#include "nsISeekableStream.h"
 #include "prio.h"
 
 class nsTemporaryFileInputStream : public nsIInputStream
+                                 , public nsISeekableStream
 {
 public:
   //used to release a PRFileDesc
@@ -43,12 +45,14 @@ public:
 
   NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSIINPUTSTREAM
+  NS_DECL_NSISEEKABLESTREAM
 
 private:
   virtual ~nsTemporaryFileInputStream() { }
 
   RefPtr<FileDescOwner> mFileDescOwner;
   uint64_t mStartPos;
+  uint64_t mCurPos;
   uint64_t mEndPos;
   bool mClosed;
 };
diff --git a/netwerk/base/nsUDPSocket.cpp b/netwerk/base/nsUDPSocket.cpp
index f0afd760e5..61729e988d 100644
--- a/netwerk/base/nsUDPSocket.cpp
+++ b/netwerk/base/nsUDPSocket.cpp
@@ -457,7 +457,9 @@ nsUDPSocket::OnSocketReady(PRFileDesc *fd, int16_t outFlags)
 
   PRNetAddr prClientAddr;
   uint32_t count;
-  char buff[1500];
+  // Bug 1165423 - using 8k here because the packet could be larger
+  // than the MTU with fragmentation
+  char buff[8 * 1024];
   count = PR_RecvFrom(mFD, buff, sizeof(buff), 0, &prClientAddr, PR_INTERVAL_NO_WAIT);
 
   if (count < 1) {
diff --git a/netwerk/cache/nsDiskCacheDeviceSQL.cpp b/netwerk/cache/nsDiskCacheDeviceSQL.cpp
index 8db38da4c9..8e58796d8f 100644
--- a/netwerk/cache/nsDiskCacheDeviceSQL.cpp
+++ b/netwerk/cache/nsDiskCacheDeviceSQL.cpp
@@ -7,6 +7,9 @@
 #include "mozilla/ArrayUtils.h"
 #include "mozilla/Attributes.h"
 
+#include "mozilla/IntegerPrintfMacros.h"
+#include "mozilla/Snprintf.h"
+
 #include "nsCache.h"
 #include "nsDiskCache.h"
 #include "nsDiskCacheDeviceSQL.h"
@@ -409,7 +412,7 @@ nsOfflineCacheBinding::Create(nsIFile *cacheDir,
 
     for (generation = 0; ; ++generation)
     {
-      PR_snprintf(leaf, sizeof(leaf), "%014llX-%X", hash, generation);
+      snprintf_literal(leaf, "%014" PRIX64 "-%X", hash, generation);
 
       rv = file->SetNativeLeafName(nsDependentCString(leaf));
       if (NS_FAILED(rv))
@@ -423,7 +426,7 @@ nsOfflineCacheBinding::Create(nsIFile *cacheDir,
   }
   else
   {
-    PR_snprintf(leaf, sizeof(leaf), "%014llX-%X", hash, generation);
+    snprintf_literal(leaf, "%014" PRIX64 "-%X", hash, generation);
     rv = file->AppendNative(nsDependentCString(leaf));
     if (NS_FAILED(rv))
       return nullptr;
diff --git a/netwerk/cache2/AppCacheStorage.cpp b/netwerk/cache2/AppCacheStorage.cpp
index 1dbc464450..a278245be3 100644
--- a/netwerk/cache2/AppCacheStorage.cpp
+++ b/netwerk/cache2/AppCacheStorage.cpp
@@ -25,7 +25,7 @@ NS_IMPL_ISUPPORTS_INHERITED0(AppCacheStorage, CacheStorage)
 
 AppCacheStorage::AppCacheStorage(nsILoadContextInfo* aInfo,
                                  nsIApplicationCache* aAppCache)
-: CacheStorage(aInfo, true /* disk */, false /* lookup app cache */, false /* skip size check */)
+: CacheStorage(aInfo, true /* disk */, false /* lookup app cache */, false /* skip size check */, false /* pin */)
 , mAppCache(aAppCache)
 {
   MOZ_COUNT_CTOR(AppCacheStorage);
diff --git a/netwerk/cache2/CacheEntry.cpp b/netwerk/cache2/CacheEntry.cpp
index c4298f8bde..58c4f919b8 100644
--- a/netwerk/cache2/CacheEntry.cpp
+++ b/netwerk/cache2/CacheEntry.cpp
@@ -86,6 +86,8 @@ CacheEntry::Callback::Callback(CacheEntry* aEntry,
 , mRecheckAfterWrite(false)
 , mNotWanted(false)
 , mSecret(aSecret)
+, mDoomWhenFoundPinned(false)
+, mDoomWhenFoundNonPinned(false)
 {
   MOZ_COUNT_CTOR(CacheEntry::Callback);
 
@@ -95,6 +97,22 @@ CacheEntry::Callback::Callback(CacheEntry* aEntry,
   mEntry->AddHandleRef();
 }
 
+CacheEntry::Callback::Callback(CacheEntry* aEntry, bool aDoomWhenFoundInPinStatus)
+: mEntry(aEntry)
+, mReadOnly(false)
+, mRevalidating(false)
+, mCheckOnAnyThread(true)
+, mRecheckAfterWrite(false)
+, mNotWanted(false)
+, mSecret(false)
+, mDoomWhenFoundPinned(aDoomWhenFoundInPinStatus == true)
+, mDoomWhenFoundNonPinned(aDoomWhenFoundInPinStatus == false)
+{
+  MOZ_COUNT_CTOR(CacheEntry::Callback);
+  MOZ_ASSERT(mEntry->HandlesCount());
+  mEntry->AddHandleRef();
+}
+
 CacheEntry::Callback::Callback(CacheEntry::Callback const &aThat)
 : mEntry(aThat.mEntry)
 , mCallback(aThat.mCallback)
@@ -105,6 +123,8 @@ CacheEntry::Callback::Callback(CacheEntry::Callback const &aThat)
 , mRecheckAfterWrite(aThat.mRecheckAfterWrite)
 , mNotWanted(aThat.mNotWanted)
 , mSecret(aThat.mSecret)
+, mDoomWhenFoundPinned(aThat.mDoomWhenFoundPinned)
+, mDoomWhenFoundNonPinned(aThat.mDoomWhenFoundNonPinned)
 {
   MOZ_COUNT_CTOR(CacheEntry::Callback);
 
@@ -135,6 +155,20 @@ void CacheEntry::Callback::ExchangeEntry(CacheEntry* aEntry)
   mEntry = aEntry;
 }
 
+bool CacheEntry::Callback::DeferDoom(bool *aDoom) const
+{
+  MOZ_ASSERT(mEntry->mPinningKnown);
+
+  if (MOZ_UNLIKELY(mDoomWhenFoundNonPinned) || MOZ_UNLIKELY(mDoomWhenFoundPinned)) {
+    *aDoom = (MOZ_UNLIKELY(mDoomWhenFoundNonPinned) && MOZ_LIKELY(!mEntry->mPinned)) ||
+             (MOZ_UNLIKELY(mDoomWhenFoundPinned) && MOZ_UNLIKELY(mEntry->mPinned));
+
+    return true;
+  }
+
+  return false;
+}
+
 nsresult CacheEntry::Callback::OnCheckThread(bool *aOnCheckThread) const
 {
   if (!mCheckOnAnyThread) {
@@ -163,7 +197,8 @@ CacheEntry::CacheEntry(const nsACString& aStorageID,
                        nsIURI* aURI,
                        const nsACString& aEnhanceID,
                        bool aUseDisk,
-                       bool aSkipSizeCheck)
+                       bool aSkipSizeCheck,
+                       bool aPin)
 : mFrecency(0)
 , mSortingExpirationTime(uint32_t(-1))
 , mLock("CacheEntry")
@@ -173,10 +208,12 @@ CacheEntry::CacheEntry(const nsACString& aStorageID,
 , mStorageID(aStorageID)
 , mUseDisk(aUseDisk)
 , mSkipSizeCheck(aSkipSizeCheck)
-, mIsDoomed(false)
 , mSecurityInfoLoaded(false)
 , mPreventCallbacks(false)
 , mHasData(false)
+, mPinned(aPin)
+, mPinningKnown(false)
+, mIsDoomed(false)
 , mState(NOTLOADED)
 , mRegistration(NEVERREGISTERED)
 , mWriter(nullptr)
@@ -349,16 +386,18 @@ bool CacheEntry::Load(bool aTruncate, bool aPriority)
     if (NS_SUCCEEDED(CacheIndex::HasEntry(fileKey, &status))) {
       switch (status) {
       case CacheIndex::DOES_NOT_EXIST:
-        LOG(("  entry doesn't exist according information from the index, truncating"));
+        // Doesn't apply to memory-only entries, Load() is called only once for them
+        // and never again for their session lifetime.
         if (!aTruncate && mUseDisk) {
+          LOG(("  entry doesn't exist according information from the index, truncating"));
           reportMiss = true;
+          aTruncate = true;
         }
-        aTruncate = true;
         break;
       case CacheIndex::EXISTS:
       case CacheIndex::DO_NOT_KNOW:
         if (!mUseDisk) {
-          LOG(("  entry open as memory-only, but there is (status=%d) a file, dooming it", status));
+          LOG(("  entry open as memory-only, but there is a file, status=%d, dooming it", status));
           CacheFileIOManager::DoomFileByKey(fileKey, nullptr);
         }
         break;
@@ -371,6 +410,9 @@ bool CacheEntry::Load(bool aTruncate, bool aPriority)
   BackgroundOp(Ops::REGISTER);
 
   bool directLoad = aTruncate || !mUseDisk;
+  if (directLoad) {
+    mPinningKnown = true;
+  }
 
   {
     mozilla::MutexAutoUnlock unlock(mLock);
@@ -387,6 +429,7 @@ bool CacheEntry::Load(bool aTruncate, bool aPriority)
                        !mUseDisk,
                        mSkipSizeCheck,
                        aPriority,
+                       mPinned,
                        directLoad ? nullptr : this);
     }
 
@@ -412,9 +455,10 @@ NS_IMETHODIMP CacheEntry::OnFileReady(nsresult aResult, bool aIsNew)
       this, aResult, aIsNew));
 
   // OnFileReady, that is the only code that can transit from LOADING
-  // to any follow-on state, can only be invoked ones on an entry,
-  // thus no need to lock.  Until this moment there is no consumer that
-  // could manipulate the entry state.
+  // to any follow-on state and can only be invoked ones on an entry.
+  // Until this moment there is no consumer that could manipulate
+  // the entry state.
+
   mozilla::MutexAutoLock lock(mLock);
 
   MOZ_ASSERT(mState == LOADING);
@@ -425,6 +469,10 @@ NS_IMETHODIMP CacheEntry::OnFileReady(nsresult aResult, bool aIsNew)
 
   mFileStatus = aResult;
 
+  mPinned = mFile->IsPinned();;
+  mPinningKnown = true;
+  LOG(("  pinning=%d", mPinned));
+
   if (mState == READY) {
     mHasData = true;
 
@@ -436,6 +484,7 @@ NS_IMETHODIMP CacheEntry::OnFileReady(nsresult aResult, bool aIsNew)
   }
 
   InvokeCallbacks();
+
   return NS_OK;
 }
 
@@ -463,6 +512,13 @@ already_AddRefed<CacheEntryHandle> CacheEntry::ReopenTruncated(bool aMemoryOnly,
   RefPtr<CacheEntryHandle> handle;
   RefPtr<CacheEntry> newEntry;
   {
+    if (mPinned) {
+      MOZ_ASSERT(mUseDisk);
+      // We want to pin even no-store entries (the case we recreate a disk entry as
+      // a memory-only entry.)
+      aMemoryOnly = false;
+    }
+
     mozilla::MutexAutoUnlock unlock(mLock);
 
     // The following call dooms this entry (calls DoomAlreadyRemoved on us)
@@ -470,6 +526,7 @@ already_AddRefed<CacheEntryHandle> CacheEntry::ReopenTruncated(bool aMemoryOnly,
       GetStorageID(), GetURI(), GetEnhanceID(),
       mUseDisk && !aMemoryOnly,
       mSkipSizeCheck,
+      mPinned,
       true, // always create
       true, // truncate existing (this one)
       getter_AddRefs(handle));
@@ -557,6 +614,8 @@ bool CacheEntry::InvokeCallbacks(bool aReadOnly)
 {
   mLock.AssertCurrentThreadOwns();
 
+  RefPtr<CacheEntryHandle> recreatedHandle;
+
   uint32_t i = 0;
   while (i < mCallbacks.Length()) {
     if (mPreventCallbacks) {
@@ -569,6 +628,18 @@ bool CacheEntry::InvokeCallbacks(bool aReadOnly)
       return false;
     }
 
+    bool recreate;
+    if (mCallbacks[i].DeferDoom(&recreate)) {
+      mCallbacks.RemoveElementAt(i);
+      if (!recreate) {
+        continue;
+      }
+
+      LOG(("  defer doom marker callback hit positive, recreating"));
+      recreatedHandle = ReopenTruncated(!mUseDisk, nullptr);
+      break;
+    }
+
     if (mCallbacks[i].mReadOnly != aReadOnly) {
       // Callback is not r/w or r/o, go to another one in line
       ++i;
@@ -605,6 +676,12 @@ bool CacheEntry::InvokeCallbacks(bool aReadOnly)
     }
   }
 
+  if (recreatedHandle) {
+    // Must be released outside of the lock, enters InvokeCallback on the new entry
+    mozilla::MutexAutoUnlock unlock(mLock);
+    recreatedHandle = nullptr;
+  }
+
   return true;
 }
 
@@ -971,6 +1048,13 @@ NS_IMETHODIMP CacheEntry::GetIsForcedValid(bool *aIsForcedValid)
 {
   NS_ENSURE_ARG(aIsForcedValid);
 
+  MOZ_ASSERT(mState > LOADING);
+
+  if (mPinned) {
+    *aIsForcedValid = true;
+    return NS_OK;
+  }
+
   nsAutoCString key;
 
   nsresult rv = HashingKeyWithStorage(key);
@@ -1422,6 +1506,28 @@ void CacheEntry::SetRegistered(bool aRegistered)
   }
 }
 
+bool CacheEntry::DeferOrBypassRemovalOnPinStatus(bool aPinned)
+{
+  LOG(("CacheEntry::DeferOrBypassRemovalOnPinStatus [this=%p]", this));
+
+  mozilla::MutexAutoLock lock(mLock);
+
+  if (mPinningKnown) {
+    LOG(("  pinned=%d, caller=%d", mPinned, aPinned));
+    // Bypass when the pin status of this entry doesn't match the pin status
+    // caller wants to remove
+    return mPinned != aPinned;
+  }
+
+  LOG(("  pinning unknown, caller=%d", aPinned));
+  // Oterwise, remember to doom after the status is determined for any
+  // callback opening the entry after this point...
+  Callback c(this, aPinned);
+  RememberCallback(c);
+  // ...and always bypass
+  return true;
+}
+
 bool CacheEntry::Purge(uint32_t aWhat)
 {
   LOG(("CacheEntry::Purge [this=%p, what=%d]", this, aWhat));
@@ -1503,6 +1609,10 @@ void CacheEntry::DoomAlreadyRemoved()
 
   mIsDoomed = true;
 
+  // Pretend pinning is know.  This entry is now doomed for good, so don't
+  // bother with defering doom because of unknown pinning state any more.
+  mPinningKnown = true;
+
   // This schedules dooming of the file, dooming is ensured to happen
   // sooner than demand to open the same file made after this point
   // so that we don't get this file for any newer opened entry(s).
diff --git a/netwerk/cache2/CacheEntry.h b/netwerk/cache2/CacheEntry.h
index ca6524dd5d..92407625f1 100644
--- a/netwerk/cache2/CacheEntry.h
+++ b/netwerk/cache2/CacheEntry.h
@@ -55,7 +55,7 @@ public:
   NS_DECL_NSIRUNNABLE
 
   CacheEntry(const nsACString& aStorageID, nsIURI* aURI, const nsACString& aEnhanceID,
-             bool aUseDisk, bool aSkipSizeCheck);
+             bool aUseDisk, bool aSkipSizeCheck, bool aPin);
 
   void AsyncOpen(nsICacheEntryOpenCallback* aCallback, uint32_t aFlags);
 
@@ -71,6 +71,7 @@ public:
   bool IsReferenced() const;
   bool IsFileDoomed();
   bool IsDoomed() const { return mIsDoomed; }
+  bool IsPinned() const { return mPinned; }
 
   // Methods for entry management (eviction from memory),
   // called only on the management thread.
@@ -92,6 +93,7 @@ public:
     PURGE_WHOLE,
   };
 
+  bool DeferOrBypassRemovalOnPinStatus(bool aPinned);
   bool Purge(uint32_t aWhat);
   void PurgeAndDoom();
   void DoomAlreadyRemoved();
@@ -136,6 +138,9 @@ private:
     Callback(CacheEntry* aEntry,
              nsICacheEntryOpenCallback *aCallback,
              bool aReadOnly, bool aCheckOnAnyThread, bool aSecret);
+    // Special constructor for Callback objects added to the chain
+    // just to ensure proper defer dooming (recreation) of this entry.
+    Callback(CacheEntry* aEntry, bool aDoomWhenFoundInPinStatus);
     Callback(Callback const &aThat);
     ~Callback();
 
@@ -143,6 +148,10 @@ private:
     // mainly during recreation.
     void ExchangeEntry(CacheEntry* aEntry);
 
+    // Returns true when an entry is about to be "defer" doomed and this is
+    // a "defer" callback.
+    bool DeferDoom(bool *aDoom) const;
+
     // We are raising reference count here to take into account the pending
     // callback (that virtually holds a ref to this entry before it gets
     // it's pointer).
@@ -156,6 +165,13 @@ private:
     bool mNotWanted : 1;
     bool mSecret : 1;
 
+    // These are set only for the defer-doomer Callback instance inserted
+    // to the callback chain.  When any of these is set and also any of
+    // the corressponding flags on the entry is set, this callback will
+    // indicate (via DeferDoom()) the entry have to be recreated/doomed.
+    bool mDoomWhenFoundPinned : 1;
+    bool mDoomWhenFoundNonPinned : 1;
+
     nsresult OnCheckThread(bool *aOnCheckThread) const;
     nsresult OnAvailThread(bool *aOnAvailThread) const;
   };
@@ -274,14 +290,9 @@ private:
   nsCString mStorageID;
 
   // Whether it's allowed to persist the data to disk
-  bool const mUseDisk;
-
+  bool const mUseDisk : 1;
   // Whether it should skip max size check.
-  bool const mSkipSizeCheck;
-
-  // Set when entry is doomed with AsyncDoom() or DoomAlreadyRemoved().
-  // Left as a standalone flag to not bother with locking (there is no need).
-  bool mIsDoomed;
+  bool const mSkipSizeCheck : 1;
 
   // Following flags are all synchronized with the cache entry lock.
 
@@ -296,6 +307,15 @@ private:
   // false: after load and a new file, or dropped to back to false when a writer
   //        fails to open an output stream.
   bool mHasData : 1;
+  // The indication of pinning this entry was open with
+  bool mPinned : 1;
+  // Whether the pinning state of the entry is known (equals to the actual state
+  // of the cache file)
+  bool mPinningKnown : 1;
+
+  // Set when entry is doomed with AsyncDoom() or DoomAlreadyRemoved().
+  // Left as a standalone flag to not bother with locking (there is no need).
+  bool mIsDoomed;
 
   static char const * StateString(uint32_t aState);
 
diff --git a/netwerk/cache2/CacheFile.cpp b/netwerk/cache2/CacheFile.cpp
index 8d09a0f265..6a36da54c2 100644
--- a/netwerk/cache2/CacheFile.cpp
+++ b/netwerk/cache2/CacheFile.cpp
@@ -101,7 +101,7 @@ protected:
   nsCOMPtr<CacheFileChunkListener> mCallback;
   nsresult                         mRV;
   uint32_t                         mChunkIdx;
-  RefPtr<CacheFileChunk>         mChunk;
+  RefPtr<CacheFileChunk>           mChunk;
 };
 
 
@@ -184,6 +184,7 @@ CacheFile::CacheFile()
   , mMemoryOnly(false)
   , mSkipSizeCheck(false)
   , mOpenAsMemoryOnly(false)
+  , mPinned(false)
   , mPriority(false)
   , mDataAccessed(false)
   , mDataIsDirty(false)
@@ -214,17 +215,21 @@ CacheFile::Init(const nsACString &aKey,
                 bool aMemoryOnly,
                 bool aSkipSizeCheck,
                 bool aPriority,
+                bool aPinned,
                 CacheFileListener *aCallback)
 {
   MOZ_ASSERT(!mListener);
   MOZ_ASSERT(!mHandle);
 
+  MOZ_ASSERT(!(aMemoryOnly && aPinned));
+
   nsresult rv;
 
   mKey = aKey;
   mOpenAsMemoryOnly = mMemoryOnly = aMemoryOnly;
   mSkipSizeCheck = aSkipSizeCheck;
   mPriority = aPriority;
+  mPinned = aPinned;
 
   // Some consumers (at least nsHTTPCompressConv) assume that Read() can read
   // such amount of data that was announced by Available().
@@ -243,7 +248,7 @@ CacheFile::Init(const nsACString &aKey,
   if (mMemoryOnly) {
     MOZ_ASSERT(!aCallback);
 
-    mMetadata = new CacheFileMetadata(mOpenAsMemoryOnly, mKey);
+    mMetadata = new CacheFileMetadata(mOpenAsMemoryOnly, false, mKey);
     mReady = true;
     mDataSize = mMetadata->Offset();
     return NS_OK;
@@ -255,7 +260,7 @@ CacheFile::Init(const nsACString &aKey,
       flags = CacheFileIOManager::CREATE_NEW;
 
       // make sure we can use this entry immediately
-      mMetadata = new CacheFileMetadata(mOpenAsMemoryOnly, mKey);
+      mMetadata = new CacheFileMetadata(mOpenAsMemoryOnly, mPinned, mKey);
       mReady = true;
       mDataSize = mMetadata->Offset();
     } else {
@@ -266,6 +271,10 @@ CacheFile::Init(const nsACString &aKey,
       flags |= CacheFileIOManager::PRIORITY;
     }
 
+    if (mPinned) {
+      flags |= CacheFileIOManager::PINNED;
+    }
+
     mOpeningFile = true;
     mListener = aCallback;
     rv = CacheFileIOManager::OpenFile(mKey, flags, this);
@@ -273,6 +282,12 @@ CacheFile::Init(const nsACString &aKey,
       mListener = nullptr;
       mOpeningFile = false;
 
+      if (mPinned) {
+        LOG(("CacheFile::Init() - CacheFileIOManager::OpenFile() failed "
+             "but we want to pin, fail the file opening. [this=%p]", this));
+        return NS_ERROR_NOT_AVAILABLE;
+      }
+
       if (aCreateNew) {
         NS_WARNING("Forcing memory-only entry since OpenFile failed");
         LOG(("CacheFile::Init() - CacheFileIOManager::OpenFile() failed "
@@ -288,7 +303,7 @@ CacheFile::Init(const nsACString &aKey,
              "initializing entry as memory-only. [this=%p]", this));
 
         mMemoryOnly = true;
-        mMetadata = new CacheFileMetadata(mOpenAsMemoryOnly, mKey);
+        mMetadata = new CacheFileMetadata(mOpenAsMemoryOnly, mPinned, mKey);
         mReady = true;
         mDataSize = mMetadata->Offset();
 
@@ -481,7 +496,8 @@ CacheFile::OnFileOpened(CacheFileHandle *aHandle, nsresult aResult)
       autoDoom.mAlreadyDoomed = true;
       return NS_OK;
     }
-    else if (NS_FAILED(aResult)) {
+
+    if (NS_FAILED(aResult)) {
       if (mMetadata) {
         // This entry was initialized as createNew, just switch to memory-only
         // mode.
@@ -493,7 +509,8 @@ CacheFile::OnFileOpened(CacheFileHandle *aHandle, nsresult aResult)
         mMemoryOnly = true;
         return NS_OK;
       }
-      else if (aResult == NS_ERROR_FILE_INVALID_PATH) {
+
+      if (aResult == NS_ERROR_FILE_INVALID_PATH) {
         // CacheFileIOManager doesn't have mCacheDirectory, switch to
         // memory-only mode.
         NS_WARNING("Forcing memory-only entry since CacheFileIOManager doesn't "
@@ -503,22 +520,20 @@ CacheFile::OnFileOpened(CacheFileHandle *aHandle, nsresult aResult)
              this));
 
         mMemoryOnly = true;
-        mMetadata = new CacheFileMetadata(mOpenAsMemoryOnly, mKey);
+        mMetadata = new CacheFileMetadata(mOpenAsMemoryOnly, mPinned, mKey);
         mReady = true;
         mDataSize = mMetadata->Offset();
 
         isNew = true;
         retval = NS_OK;
-      }
-      else {
+      } else {
         // CacheFileIOManager::OpenFile() failed for another reason.
         isNew = false;
         retval = aResult;
       }
 
       mListener.swap(listener);
-    }
-    else {
+    } else {
       mHandle = aHandle;
       if (NS_FAILED(mStatus)) {
         CacheFileIOManager::DoomFile(mHandle, nullptr);
@@ -582,6 +597,7 @@ CacheFile::OnMetadataRead(nsresult aResult)
 
   bool isNew = false;
   if (NS_SUCCEEDED(aResult)) {
+    mPinned = mMetadata->Pinned();
     mReady = true;
     mDataSize = mMetadata->Offset();
     if (mDataSize == 0 && mMetadata->ElementsSize() == 0) {
@@ -1936,7 +1952,8 @@ CacheFile::InitIndexEntry()
   rv = CacheFileIOManager::InitIndexEntry(mHandle,
                                           mMetadata->OriginAttributes().mAppId,
                                           mMetadata->IsAnonymous(),
-                                          mMetadata->OriginAttributes().mInBrowser);
+                                          mMetadata->OriginAttributes().mInBrowser,
+                                          mPinned);
   NS_ENSURE_SUCCESS(rv, rv);
 
   uint32_t expTime;
diff --git a/netwerk/cache2/CacheFile.h b/netwerk/cache2/CacheFile.h
index 80eb206494..878119b9b2 100644
--- a/netwerk/cache2/CacheFile.h
+++ b/netwerk/cache2/CacheFile.h
@@ -58,6 +58,7 @@ public:
                 bool aMemoryOnly,
                 bool aSkipSizeCheck,
                 bool aPriority,
+                bool aPinned,
                 CacheFileListener *aCallback);
 
   NS_IMETHOD OnChunkRead(nsresult aResult, CacheFileChunk *aChunk) override;
@@ -103,6 +104,7 @@ public:
   bool DataSize(int64_t* aSize);
   void Key(nsACString& aKey) { aKey = mKey; }
   bool IsDoomed();
+  bool IsPinned() const { return mPinned; }
   bool IsWriteInProgress();
 
   // Memory reporting
@@ -196,6 +198,7 @@ private:
   bool           mMemoryOnly;
   bool           mSkipSizeCheck;
   bool           mOpenAsMemoryOnly;
+  bool           mPinned;
   bool           mPriority;
   bool           mDataAccessed;
   bool           mDataIsDirty;
@@ -206,8 +209,8 @@ private:
   int64_t        mDataSize;
   nsCString      mKey;
 
-  RefPtr<CacheFileHandle>    mHandle;
-  RefPtr<CacheFileMetadata>  mMetadata;
+  RefPtr<CacheFileHandle>      mHandle;
+  RefPtr<CacheFileMetadata>    mMetadata;
   nsCOMPtr<CacheFileListener>  mListener;
   nsCOMPtr<CacheFileIOListener>   mDoomAfterOpenListener;
 
diff --git a/netwerk/cache2/CacheFileChunk.cpp b/netwerk/cache2/CacheFileChunk.cpp
index aaec9a329e..bef03b153d 100644
--- a/netwerk/cache2/CacheFileChunk.cpp
+++ b/netwerk/cache2/CacheFileChunk.cpp
@@ -44,7 +44,7 @@ public:
 
 protected:
   nsCOMPtr<CacheFileChunkListener> mCallback;
-  RefPtr<CacheFileChunk>         mChunk;
+  RefPtr<CacheFileChunk>           mChunk;
 };
 
 bool
diff --git a/netwerk/cache2/CacheFileChunk.h b/netwerk/cache2/CacheFileChunk.h
index b81658b6d3..55ee9d3b55 100644
--- a/netwerk/cache2/CacheFileChunk.h
+++ b/netwerk/cache2/CacheFileChunk.h
@@ -150,7 +150,7 @@ private:
   uint32_t            mRWBufSize;
   CacheHash::Hash16_t mReadHash;
 
-  RefPtr<CacheFile>              mFile; // is null if chunk is cached to
+  RefPtr<CacheFile>                mFile; // is null if chunk is cached to
                                           // prevent reference cycles
   nsCOMPtr<CacheFileChunkListener> mListener;
   nsTArray<ChunkListenerItem *>    mUpdateListeners;
diff --git a/netwerk/cache2/CacheFileContextEvictor.cpp b/netwerk/cache2/CacheFileContextEvictor.cpp
index dff8c3a744..7940229772 100644
--- a/netwerk/cache2/CacheFileContextEvictor.cpp
+++ b/netwerk/cache2/CacheFileContextEvictor.cpp
@@ -81,32 +81,49 @@ CacheFileContextEvictor::ContextsCount()
 }
 
 nsresult
-CacheFileContextEvictor::AddContext(nsILoadContextInfo *aLoadContextInfo)
+CacheFileContextEvictor::AddContext(nsILoadContextInfo *aLoadContextInfo,
+                                    bool aPinned)
 {
-  LOG(("CacheFileContextEvictor::AddContext() [this=%p, loadContextInfo=%p]",
-       this, aLoadContextInfo));
+  LOG(("CacheFileContextEvictor::AddContext() [this=%p, loadContextInfo=%p, pinned=%d]",
+       this, aLoadContextInfo, aPinned));
 
   nsresult rv;
 
   MOZ_ASSERT(CacheFileIOManager::IsOnIOThread());
 
   CacheFileContextEvictorEntry *entry = nullptr;
-  for (uint32_t i = 0; i < mEntries.Length(); ++i) {
-    if (mEntries[i]->mInfo->Equals(aLoadContextInfo)) {
-      entry = mEntries[i];
-      break;
+  if (aLoadContextInfo) {
+    for (uint32_t i = 0; i < mEntries.Length(); ++i) {
+      if (mEntries[i]->mInfo &&
+          mEntries[i]->mInfo->Equals(aLoadContextInfo) &&
+          mEntries[i]->mPinned == aPinned) {
+        entry = mEntries[i];
+        break;
+      }
+    }
+  } else {
+    // Not providing load context info means we want to delete everything,
+    // so let's not bother with any currently running context cleanups
+    // for the same pinning state.
+    for (uint32_t i = mEntries.Length(); i > 0;) {
+      --i;
+      if (mEntries[i]->mInfo && mEntries[i]->mPinned == aPinned) {
+        RemoveEvictInfoFromDisk(mEntries[i]->mInfo, mEntries[i]->mPinned);
+        mEntries.RemoveElementAt(i);
+      }
     }
   }
 
   if (!entry) {
     entry = new CacheFileContextEvictorEntry();
     entry->mInfo = aLoadContextInfo;
+    entry->mPinned = aPinned;
     mEntries.AppendElement(entry);
   }
 
   entry->mTimeStamp = PR_Now() / PR_USEC_PER_MSEC;
 
-  PersistEvictionInfoToDisk(aLoadContextInfo);
+  PersistEvictionInfoToDisk(aLoadContextInfo, aPinned);
 
   if (mIndexIsUpToDate) {
     // Already existing context could be added again, in this case the iterator
@@ -180,58 +197,62 @@ CacheFileContextEvictor::CacheIndexStateChanged()
 
 nsresult
 CacheFileContextEvictor::WasEvicted(const nsACString &aKey, nsIFile *aFile,
-                                    bool *_retval)
+                                    bool *aEvictedAsPinned, bool *aEvictedAsNonPinned)
 {
   LOG(("CacheFileContextEvictor::WasEvicted() [key=%s]",
        PromiseFlatCString(aKey).get()));
 
   nsresult rv;
 
+  *aEvictedAsPinned = false;
+  *aEvictedAsNonPinned = false;
+
   MOZ_ASSERT(CacheFileIOManager::IsOnIOThread());
 
   nsCOMPtr<nsILoadContextInfo> info = CacheFileUtils::ParseKey(aKey);
   MOZ_ASSERT(info);
   if (!info) {
     LOG(("CacheFileContextEvictor::WasEvicted() - Cannot parse key!"));
-    *_retval = false;
     return NS_OK;
   }
 
-  CacheFileContextEvictorEntry *entry = nullptr;
   for (uint32_t i = 0; i < mEntries.Length(); ++i) {
-    if (info->Equals(mEntries[i]->mInfo)) {
-      entry = mEntries[i];
-      break;
+    CacheFileContextEvictorEntry *entry = mEntries[i];
+
+    if (entry->mInfo && !info->Equals(entry->mInfo)) {
+      continue;
+    }
+
+    PRTime lastModifiedTime;
+    rv = aFile->GetLastModifiedTime(&lastModifiedTime);
+    if (NS_FAILED(rv)) {
+      LOG(("CacheFileContextEvictor::WasEvicted() - Cannot get last modified time"
+            ", returning false."));
+      return NS_OK;
+    }
+
+    if (lastModifiedTime > entry->mTimeStamp) {
+      // File has been modified since context eviction.
+      continue;
+    }
+
+    LOG(("CacheFileContextEvictor::WasEvicted() - evicted [pinning=%d, "
+         "mTimeStamp=%lld, lastModifiedTime=%lld]",
+         entry->mPinned, entry->mTimeStamp, lastModifiedTime));
+
+    if (entry->mPinned) {
+      *aEvictedAsPinned = true;
+    } else {
+      *aEvictedAsNonPinned = true;
     }
   }
 
-  if (!entry) {
-    LOG(("CacheFileContextEvictor::WasEvicted() - Didn't find equal context, "
-         "returning false."));
-    *_retval = false;
-    return NS_OK;
-  }
-
-  PRTime lastModifiedTime;
-  rv = aFile->GetLastModifiedTime(&lastModifiedTime);
-  if (NS_FAILED(rv)) {
-    LOG(("CacheFileContextEvictor::WasEvicted() - Cannot get last modified time"
-         ", returning false."));
-    *_retval = false;
-    return NS_OK;
-  }
-
-  *_retval = !(lastModifiedTime > entry->mTimeStamp);
-  LOG(("CacheFileContextEvictor::WasEvicted() - returning %s. [mTimeStamp=%lld,"
-       " lastModifiedTime=%lld]", *_retval ? "true" : "false",
-       mEntries[0]->mTimeStamp, lastModifiedTime));
-
   return NS_OK;
 }
 
 nsresult
 CacheFileContextEvictor::PersistEvictionInfoToDisk(
-  nsILoadContextInfo *aLoadContextInfo)
+  nsILoadContextInfo *aLoadContextInfo, bool aPinned)
 {
   LOG(("CacheFileContextEvictor::PersistEvictionInfoToDisk() [this=%p, "
        "loadContextInfo=%p]", this, aLoadContextInfo));
@@ -241,7 +262,7 @@ CacheFileContextEvictor::PersistEvictionInfoToDisk(
   MOZ_ASSERT(CacheFileIOManager::IsOnIOThread());
 
   nsCOMPtr<nsIFile> file;
-  rv = GetContextFile(aLoadContextInfo, getter_AddRefs(file));
+  rv = GetContextFile(aLoadContextInfo, aPinned, getter_AddRefs(file));
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return rv;
   }
@@ -268,7 +289,7 @@ CacheFileContextEvictor::PersistEvictionInfoToDisk(
 
 nsresult
 CacheFileContextEvictor::RemoveEvictInfoFromDisk(
-  nsILoadContextInfo *aLoadContextInfo)
+  nsILoadContextInfo *aLoadContextInfo, bool aPinned)
 {
   LOG(("CacheFileContextEvictor::RemoveEvictInfoFromDisk() [this=%p, "
        "loadContextInfo=%p]", this, aLoadContextInfo));
@@ -278,7 +299,7 @@ CacheFileContextEvictor::RemoveEvictInfoFromDisk(
   MOZ_ASSERT(CacheFileIOManager::IsOnIOThread());
 
   nsCOMPtr<nsIFile> file;
-  rv = GetContextFile(aLoadContextInfo, getter_AddRefs(file));
+  rv = GetContextFile(aLoadContextInfo, aPinned, getter_AddRefs(file));
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return rv;
   }
@@ -363,16 +384,26 @@ CacheFileContextEvictor::LoadEvictInfoFromDisk()
       continue;
     }
 
-    nsCOMPtr<nsILoadContextInfo> info = CacheFileUtils::ParseKey(decoded);
-
-    if (!info) {
-      LOG(("CacheFileContextEvictor::LoadEvictInfoFromDisk() - Cannot parse "
-           "context key, removing file. [contextKey=%s, file=%s]",
-           decoded.get(), leaf.get()));
-      file->Remove(false);
-      continue;
+    bool pinned = decoded[0] == '\t';
+    if (pinned) {
+      decoded = Substring(decoded, 1);
     }
 
+    nsCOMPtr<nsILoadContextInfo> info;
+    if (!NS_LITERAL_CSTRING("*").Equals(decoded)) {
+      // "*" is indication of 'delete all', info left null will pass
+      // to CacheFileContextEvictor::AddContext and clear all the cache data.
+      info = CacheFileUtils::ParseKey(decoded);
+      if (!info) {
+        LOG(("CacheFileContextEvictor::LoadEvictInfoFromDisk() - Cannot parse "
+             "context key, removing file. [contextKey=%s, file=%s]",
+             decoded.get(), leaf.get()));
+        file->Remove(false);
+        continue;
+      }
+    }
+
+
     PRTime lastModifiedTime;
     rv = file->GetLastModifiedTime(&lastModifiedTime);
     if (NS_FAILED(rv)) {
@@ -381,6 +412,7 @@ CacheFileContextEvictor::LoadEvictInfoFromDisk()
 
     CacheFileContextEvictorEntry *entry = new CacheFileContextEvictorEntry();
     entry->mInfo = info;
+    entry->mPinned = pinned;
     entry->mTimeStamp = lastModifiedTime;
     mEntries.AppendElement(entry);
   }
@@ -390,6 +422,7 @@ CacheFileContextEvictor::LoadEvictInfoFromDisk()
 
 nsresult
 CacheFileContextEvictor::GetContextFile(nsILoadContextInfo *aLoadContextInfo,
+                                        bool aPinned,
                                         nsIFile **_retval)
 {
   nsresult rv;
@@ -398,7 +431,16 @@ CacheFileContextEvictor::GetContextFile(nsILoadContextInfo *aLoadContextInfo,
   leafName.AssignLiteral(CONTEXT_EVICTION_PREFIX);
 
   nsAutoCString keyPrefix;
-  CacheFileUtils::AppendKeyPrefix(aLoadContextInfo, keyPrefix);
+  if (aPinned) {
+    // Mark pinned context files with a tab char at the start.
+    // Tab is chosen because it can never be used as a context key tag.
+    keyPrefix.Append('\t');
+  }
+  if (aLoadContextInfo) {
+    CacheFileUtils::AppendKeyPrefix(aLoadContextInfo, keyPrefix);
+  } else {
+    keyPrefix.Append('*');
+  }
 
   nsAutoCString data64;
   rv = Base64Encode(keyPrefix, data64);
@@ -530,7 +572,7 @@ CacheFileContextEvictor::EvictEntries()
       LOG(("CacheFileContextEvictor::EvictEntries() - No more entries left in "
            "iterator. [iterator=%p, info=%p]", mEntries[0]->mIterator.get(),
            mEntries[0]->mInfo.get()));
-      RemoveEvictInfoFromDisk(mEntries[0]->mInfo);
+      RemoveEvictInfoFromDisk(mEntries[0]->mInfo, mEntries[0]->mPinned);
       mEntries.RemoveElementAt(0);
       continue;
     } else if (NS_FAILED(rv)) {
@@ -557,6 +599,20 @@ CacheFileContextEvictor::EvictEntries()
       continue;
     }
 
+    CacheIndex::EntryStatus status;
+    bool pinned;
+    rv = CacheIndex::HasEntry(hash, &status, &pinned);
+    // This must never fail, since eviction (this code) happens only when the index
+    // is up-to-date and thus the informatin is known.
+    MOZ_ASSERT(NS_SUCCEEDED(rv));
+
+    if (pinned != mEntries[0]->mPinned) {
+      LOG(("CacheFileContextEvictor::EvictEntries() - Skipping entry since pinning "
+           "doesn't match [evicting pinned=%d, entry pinned=%d]",
+           mEntries[0]->mPinned, pinned));
+      continue;
+    }
+
     nsAutoCString leafName;
     CacheFileIOManager::HashToStr(&hash, leafName);
 
diff --git a/netwerk/cache2/CacheFileContextEvictor.h b/netwerk/cache2/CacheFileContextEvictor.h
index 0a595bd830..f5fd49ecae 100644
--- a/netwerk/cache2/CacheFileContextEvictor.h
+++ b/netwerk/cache2/CacheFileContextEvictor.h
@@ -20,6 +20,7 @@ class CacheIndexIterator;
 struct CacheFileContextEvictorEntry
 {
   nsCOMPtr<nsILoadContextInfo> mInfo;
+  bool                         mPinned;
   PRTime                       mTimeStamp; // in milliseconds
   RefPtr<CacheIndexIterator> mIterator;
 };
@@ -40,7 +41,7 @@ public:
   // Returns number of contexts that are being evicted.
   uint32_t ContextsCount();
   // Start evicting given context.
-  nsresult AddContext(nsILoadContextInfo *aLoadContextInfo);
+  nsresult AddContext(nsILoadContextInfo *aLoadContextInfo, bool aPinned);
   // CacheFileIOManager calls this method when CacheIndex's state changes. We
   // check whether the index is up to date and start or stop evicting according
   // to index's state.
@@ -50,21 +51,22 @@ public:
   // info to the given key and the last modified time of the entry file is
   // earlier than the time stamp of the time when the context was added to the
   // evictor.
-  nsresult WasEvicted(const nsACString &aKey, nsIFile *aFile, bool *_retval);
+  nsresult WasEvicted(const nsACString &aKey, nsIFile *aFile,
+                      bool *aEvictedAsPinned, bool *aEvictedAsNonPinned);
 
 private:
   // Writes information about eviction of the given context to the disk. This is
   // done for every context added to the evictor to be able to recover eviction
   // after a shutdown or crash. When the context file is found after startup, we
   // restore mTimeStamp from the last modified time of the file.
-  nsresult PersistEvictionInfoToDisk(nsILoadContextInfo *aLoadContextInfo);
+  nsresult PersistEvictionInfoToDisk(nsILoadContextInfo *aLoadContextInfo, bool aPinned);
   // Once we are done with eviction for the given context, the eviction info is
   // removed from the disk.
-  nsresult RemoveEvictInfoFromDisk(nsILoadContextInfo *aLoadContextInfo);
+  nsresult RemoveEvictInfoFromDisk(nsILoadContextInfo *aLoadContextInfo, bool aPinned);
   // Tries to load all contexts from the disk. This method is called just once
   // after startup.
   nsresult LoadEvictInfoFromDisk();
-  nsresult GetContextFile(nsILoadContextInfo *aLoadContextInfo,
+  nsresult GetContextFile(nsILoadContextInfo *aLoadContextInfo, bool aPinned,
                           nsIFile **_retval);
 
   void     CreateIterators();
diff --git a/netwerk/cache2/CacheFileIOManager.cpp b/netwerk/cache2/CacheFileIOManager.cpp
index 71595594af..cdd88c5c52 100644
--- a/netwerk/cache2/CacheFileIOManager.cpp
+++ b/netwerk/cache2/CacheFileIOManager.cpp
@@ -107,13 +107,16 @@ NS_INTERFACE_MAP_BEGIN(CacheFileHandle)
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END_THREADSAFE
 
-CacheFileHandle::CacheFileHandle(const SHA1Sum::Hash *aHash, bool aPriority)
+CacheFileHandle::CacheFileHandle(const SHA1Sum::Hash *aHash, bool aPriority, PinningStatus aPinning)
   : mHash(aHash)
   , mPriority(aPriority)
   , mClosed(false)
   , mSpecialFile(false)
   , mInvalid(false)
   , mFileExists(false)
+  , mPinning(aPinning)
+  , mDoomWhenFoundPinned(false)
+  , mDoomWhenFoundNonPinned(false)
   , mFileSize(-1)
   , mFD(nullptr)
 {
@@ -126,13 +129,16 @@ CacheFileHandle::CacheFileHandle(const SHA1Sum::Hash *aHash, bool aPriority)
        , this, LOGSHA1(aHash)));
 }
 
-CacheFileHandle::CacheFileHandle(const nsACString &aKey, bool aPriority)
+CacheFileHandle::CacheFileHandle(const nsACString &aKey, bool aPriority, PinningStatus aPinning)
   : mHash(nullptr)
   , mPriority(aPriority)
   , mClosed(false)
   , mSpecialFile(true)
   , mInvalid(false)
   , mFileExists(false)
+  , mPinning(aPinning)
+  , mDoomWhenFoundPinned(false)
+  , mDoomWhenFoundNonPinned(false)
   , mFileSize(-1)
   , mFD(nullptr)
   , mKey(aKey)
@@ -198,6 +204,32 @@ CacheFileHandle::FileSizeInK() const
   return size;
 }
 
+bool
+CacheFileHandle::SetPinned(bool aPinned)
+{
+  LOG(("CacheFileHandle::SetPinned [this=%p, pinned=%d]", this, aPinned));
+
+  MOZ_ASSERT(CacheFileIOManager::IsOnIOThreadOrCeased());
+
+  mPinning = aPinned
+    ? PinningStatus::PINNED
+    : PinningStatus::NON_PINNED;
+
+  if ((MOZ_UNLIKELY(mDoomWhenFoundPinned) && aPinned) ||
+      (MOZ_UNLIKELY(mDoomWhenFoundNonPinned) && !aPinned)) {
+
+    LOG(("  dooming, when: pinned=%d, non-pinned=%d, found: pinned=%d",
+      bool(mDoomWhenFoundPinned), bool(mDoomWhenFoundNonPinned), aPinned));
+
+    mDoomWhenFoundPinned = false;
+    mDoomWhenFoundNonPinned = false;
+
+    return false;
+  }
+
+  return true;
+}
+
 // Memory reporting
 
 size_t
@@ -359,7 +391,7 @@ CacheFileHandles::GetHandle(const SHA1Sum::Hash *aHash,
 
 nsresult
 CacheFileHandles::NewHandle(const SHA1Sum::Hash *aHash,
-                            bool aPriority,
+                            bool aPriority, CacheFileHandle::PinningStatus aPinning,
                             CacheFileHandle **_retval)
 {
   MOZ_ASSERT(CacheFileIOManager::IsOnIOThreadOrCeased());
@@ -380,7 +412,7 @@ CacheFileHandles::NewHandle(const SHA1Sum::Hash *aHash,
   entry->AssertHandlesState();
 #endif
 
-  RefPtr<CacheFileHandle> handle = new CacheFileHandle(entry->Hash(), aPriority);
+  RefPtr<CacheFileHandle> handle = new CacheFileHandle(entry->Hash(), aPriority, aPinning);
   entry->AddHandle(handle);
 
   LOG(("CacheFileHandles::NewHandle() hash=%08x%08x%08x%08x%08x "
@@ -575,8 +607,8 @@ public:
         }
       }
     }
-    mCallback->OnFileOpened(mHandle, rv);
 
+    mCallback->OnFileOpened(mHandle, rv);
     return NS_OK;
   }
 
@@ -584,8 +616,8 @@ protected:
   SHA1Sum::Hash                 mHash;
   uint32_t                      mFlags;
   nsCOMPtr<CacheFileIOListener> mCallback;
-  RefPtr<CacheFileIOManager>  mIOMan;
-  RefPtr<CacheFileHandle>     mHandle;
+  RefPtr<CacheFileIOManager>    mIOMan;
+  RefPtr<CacheFileHandle>       mHandle;
   nsCString                     mKey;
 };
 
@@ -625,7 +657,7 @@ public:
   }
 
 protected:
-  RefPtr<CacheFileHandle>     mHandle;
+  RefPtr<CacheFileHandle>       mHandle;
   int64_t                       mOffset;
   char                         *mBuf;
   int32_t                       mCount;
@@ -684,7 +716,7 @@ public:
   }
 
 protected:
-  RefPtr<CacheFileHandle>     mHandle;
+  RefPtr<CacheFileHandle>       mHandle;
   int64_t                       mOffset;
   const char                   *mBuf;
   int32_t                       mCount;
@@ -728,9 +760,9 @@ public:
   }
 
 protected:
-  nsCOMPtr<CacheFileIOListener> mCallback;
-  nsCOMPtr<nsIEventTarget>      mTarget;
-  RefPtr<CacheFileHandle>     mHandle;
+  nsCOMPtr<CacheFileIOListener>              mCallback;
+  nsCOMPtr<nsIEventTarget>                   mTarget;
+  RefPtr<CacheFileHandle>                    mHandle;
 };
 
 class DoomFileByKeyEvent : public nsRunnable {
@@ -776,7 +808,7 @@ public:
 protected:
   SHA1Sum::Hash                 mHash;
   nsCOMPtr<CacheFileIOListener> mCallback;
-  RefPtr<CacheFileIOManager>  mIOMan;
+  RefPtr<CacheFileIOManager>    mIOMan;
 };
 
 class ReleaseNSPRHandleEvent : public nsRunnable {
@@ -804,7 +836,7 @@ public:
   }
 
 protected:
-  RefPtr<CacheFileHandle>     mHandle;
+  RefPtr<CacheFileHandle>       mHandle;
 };
 
 class TruncateSeekSetEOFEvent : public nsRunnable {
@@ -845,7 +877,7 @@ public:
   }
 
 protected:
-  RefPtr<CacheFileHandle>     mHandle;
+  RefPtr<CacheFileHandle>       mHandle;
   int64_t                       mTruncatePos;
   int64_t                       mEOFPos;
   nsCOMPtr<CacheFileIOListener> mCallback;
@@ -888,7 +920,7 @@ public:
   }
 
 protected:
-  RefPtr<CacheFileHandle>     mHandle;
+  RefPtr<CacheFileHandle>       mHandle;
   nsCString                     mNewName;
   nsCOMPtr<CacheFileIOListener> mCallback;
 };
@@ -896,11 +928,12 @@ protected:
 class InitIndexEntryEvent : public nsRunnable {
 public:
   InitIndexEntryEvent(CacheFileHandle *aHandle, uint32_t aAppId,
-                      bool aAnonymous, bool aInBrowser)
+                      bool aAnonymous, bool aInBrowser, bool aPinning)
     : mHandle(aHandle)
     , mAppId(aAppId)
     , mAnonymous(aAnonymous)
     , mInBrowser(aInBrowser)
+    , mPinning(aPinning)
   {
     MOZ_COUNT_CTOR(InitIndexEntryEvent);
   }
@@ -918,7 +951,7 @@ public:
       return NS_OK;
     }
 
-    CacheIndex::InitEntry(mHandle->Hash(), mAppId, mAnonymous, mInBrowser);
+    CacheIndex::InitEntry(mHandle->Hash(), mAppId, mAnonymous, mInBrowser, mPinning);
 
     // We cannot set the filesize before we init the entry. If we're opening
     // an existing entry file, frecency and expiration time will be set after
@@ -935,6 +968,7 @@ protected:
   uint32_t                  mAppId;
   bool                      mAnonymous;
   bool                      mInBrowser;
+  bool                      mPinning;
 };
 
 class UpdateIndexEntryEvent : public nsRunnable {
@@ -1519,6 +1553,10 @@ CacheFileIOManager::OpenFileInternal(const SHA1Sum::Hash *aHash,
     if (NS_FAILED(rv)) return rv;
   }
 
+  CacheFileHandle::PinningStatus pinning = aFlags & PINNED
+    ? CacheFileHandle::PinningStatus::PINNED
+    : CacheFileHandle::PinningStatus::NON_PINNED;
+
   nsCOMPtr<nsIFile> file;
   rv = GetFile(aHash, getter_AddRefs(file));
   NS_ENSURE_SUCCESS(rv, rv);
@@ -1533,7 +1571,7 @@ CacheFileIOManager::OpenFileInternal(const SHA1Sum::Hash *aHash,
       handle = nullptr;
     }
 
-    rv = mHandles.NewHandle(aHash, aFlags & PRIORITY, getter_AddRefs(handle));
+    rv = mHandles.NewHandle(aHash, aFlags & PRIORITY, pinning, getter_AddRefs(handle));
     NS_ENSURE_SUCCESS(rv, rv);
 
     bool exists;
@@ -1563,7 +1601,7 @@ CacheFileIOManager::OpenFileInternal(const SHA1Sum::Hash *aHash,
     return NS_OK;
   }
 
-  bool exists;
+  bool exists, evictedAsPinned = false, evictedAsNonPinned = false;
   rv = file->Exists(&exists);
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -1571,15 +1609,7 @@ CacheFileIOManager::OpenFileInternal(const SHA1Sum::Hash *aHash,
     if (mContextEvictor->ContextsCount() == 0) {
       mContextEvictor = nullptr;
     } else {
-      bool wasEvicted = false;
-      mContextEvictor->WasEvicted(aKey, file, &wasEvicted);
-      if (wasEvicted) {
-        LOG(("CacheFileIOManager::OpenFileInternal() - Removing file since the "
-             "entry was evicted by EvictByContext()"));
-        exists = false;
-        file->Remove(false);
-        CacheIndex::RemoveEntry(aHash);
-      }
+      mContextEvictor->WasEvicted(aKey, file, &evictedAsPinned, &evictedAsNonPinned);
     }
   }
 
@@ -1587,10 +1617,29 @@ CacheFileIOManager::OpenFileInternal(const SHA1Sum::Hash *aHash,
     return NS_ERROR_NOT_AVAILABLE;
   }
 
-  rv = mHandles.NewHandle(aHash, aFlags & PRIORITY, getter_AddRefs(handle));
+  if (exists) {
+    // For existing files we determine the pinning status later, after the metadata gets parsed.
+    pinning = CacheFileHandle::PinningStatus::UNKNOWN;
+  }
+
+  rv = mHandles.NewHandle(aHash, aFlags & PRIORITY, pinning, getter_AddRefs(handle));
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (exists) {
+    // If this file has been found evicted through the context file evictor above for
+    // any of pinned or non-pinned state, these calls ensure we doom the handle ASAP
+    // we know the real pinning state after metadta has been parsed.  DoomFileInternal
+    // on the |handle| doesn't doom right now, since the pinning state is unknown
+    // and we pass down a pinning restriction.
+    if (evictedAsPinned) {
+      rv = DoomFileInternal(handle, DOOM_WHEN_PINNED);
+      MOZ_ASSERT(!handle->IsDoomed() && NS_SUCCEEDED(rv));
+    }
+    if (evictedAsNonPinned) {
+      rv = DoomFileInternal(handle, DOOM_WHEN_NON_PINNED);
+      MOZ_ASSERT(!handle->IsDoomed() && NS_SUCCEEDED(rv));
+    }
+
     rv = file->GetFileSize(&handle->mFileSize);
     NS_ENSURE_SUCCESS(rv, rv);
 
@@ -1648,7 +1697,7 @@ CacheFileIOManager::OpenSpecialFileInternal(const nsACString &aKey,
       handle = nullptr;
     }
 
-    handle = new CacheFileHandle(aKey, aFlags & PRIORITY);
+    handle = new CacheFileHandle(aKey, aFlags & PRIORITY, CacheFileHandle::PinningStatus::NON_PINNED);
     mSpecialHandles.AppendElement(handle);
 
     bool exists;
@@ -1683,7 +1732,7 @@ CacheFileIOManager::OpenSpecialFileInternal(const nsACString &aKey,
     return NS_ERROR_NOT_AVAILABLE;
   }
 
-  handle = new CacheFileHandle(aKey, aFlags & PRIORITY);
+  handle = new CacheFileHandle(aKey, aFlags & PRIORITY, CacheFileHandle::PinningStatus::NON_PINNED);
   mSpecialHandles.AppendElement(handle);
 
   if (exists) {
@@ -1980,17 +2029,52 @@ CacheFileIOManager::DoomFile(CacheFileHandle *aHandle,
 }
 
 nsresult
-CacheFileIOManager::DoomFileInternal(CacheFileHandle *aHandle)
+CacheFileIOManager::DoomFileInternal(CacheFileHandle *aHandle,
+                                     PinningDoomRestriction aPinningDoomRestriction)
 {
   LOG(("CacheFileIOManager::DoomFileInternal() [handle=%p]", aHandle));
   aHandle->Log();
 
+  MOZ_ASSERT(CacheFileIOManager::IsOnIOThreadOrCeased());
+
   nsresult rv;
 
   if (aHandle->IsDoomed()) {
     return NS_OK;
   }
 
+  if (aPinningDoomRestriction > NO_RESTRICTION) {
+    switch (aHandle->mPinning) {
+    case CacheFileHandle::PinningStatus::NON_PINNED:
+      if (MOZ_LIKELY(aPinningDoomRestriction != DOOM_WHEN_NON_PINNED)) {
+        LOG(("  not dooming, it's a non-pinned handle"));
+        return NS_OK;
+      }
+      // Doom now
+      break;
+
+    case CacheFileHandle::PinningStatus::PINNED:
+      if (MOZ_UNLIKELY(aPinningDoomRestriction != DOOM_WHEN_PINNED)) {
+        LOG(("  not dooming, it's a pinned handle"));
+        return NS_OK;
+      }
+      // Doom now
+      break;
+
+    case CacheFileHandle::PinningStatus::UNKNOWN:
+      if (MOZ_LIKELY(aPinningDoomRestriction == DOOM_WHEN_NON_PINNED)) {
+        LOG(("  doom when non-pinned set"));
+        aHandle->mDoomWhenFoundNonPinned = true;
+      } else if (MOZ_UNLIKELY(aPinningDoomRestriction == DOOM_WHEN_PINNED)) {
+        LOG(("  doom when pinned set"));
+        aHandle->mDoomWhenFoundPinned = true;
+      }
+
+      LOG(("  pinning status not known, deferring doom decision"));
+      return NS_OK;
+    }
+  }
+
   if (aHandle->mFileExists) {
     // we need to move the current file to the doomed directory
     if (aHandle->mFD) {
@@ -2294,7 +2378,7 @@ CacheFileIOManager::GetEntryInfo(const SHA1Sum::Hash *aHash,
 
   // Call directly on the callback.
   aCallback->OnEntryInfo(uriSpec, enhanceId, dataSize, fetchCount,
-                         lastModified, expirationTime);
+                         lastModified, expirationTime, metadata->Pinned());
 
   return NS_OK;
 }
@@ -2780,7 +2864,7 @@ CacheFileIOManager::EvictAllInternal()
 
 // static
 nsresult
-CacheFileIOManager::EvictByContext(nsILoadContextInfo *aLoadContextInfo)
+CacheFileIOManager::EvictByContext(nsILoadContextInfo *aLoadContextInfo, bool aPinned)
 {
   LOG(("CacheFileIOManager::EvictByContext() [loadContextInfo=%p]",
        aLoadContextInfo));
@@ -2793,8 +2877,8 @@ CacheFileIOManager::EvictByContext(nsILoadContextInfo *aLoadContextInfo)
   }
 
   nsCOMPtr<nsIRunnable> ev;
-  ev = NS_NewRunnableMethodWithArg<nsCOMPtr<nsILoadContextInfo> >
-         (ioMan, &CacheFileIOManager::EvictByContextInternal, aLoadContextInfo);
+  ev = NS_NewRunnableMethodWithArgs<nsCOMPtr<nsILoadContextInfo>, bool>
+         (ioMan, &CacheFileIOManager::EvictByContextInternal, aLoadContextInfo, aPinned);
 
   rv = ioMan->mIOThread->DispatchAfterPendingOpens(ev);
   if (NS_WARN_IF(NS_FAILED(rv))) {
@@ -2805,24 +2889,35 @@ CacheFileIOManager::EvictByContext(nsILoadContextInfo *aLoadContextInfo)
 }
 
 nsresult
-CacheFileIOManager::EvictByContextInternal(nsILoadContextInfo *aLoadContextInfo)
+CacheFileIOManager::EvictByContextInternal(nsILoadContextInfo *aLoadContextInfo, bool aPinned)
 {
-  nsAutoCString suffix;
-  aLoadContextInfo->OriginAttributesPtr()->CreateSuffix(suffix);
-  LOG(("CacheFileIOManager::EvictByContextInternal() [loadContextInfo=%p, "
-       "anonymous=%u, suffix=%s]", aLoadContextInfo, aLoadContextInfo->IsAnonymous(),
-       suffix.get()));
+  LOG(("CacheFileIOManager::EvictByContextInternal() [loadContextInfo=%p, pinned=%d]",
+      aLoadContextInfo, aPinned));
 
   nsresult rv;
 
-  MOZ_ASSERT(mIOThread->IsCurrentThread());
+  if (aLoadContextInfo) {
+    nsAutoCString suffix;
+    aLoadContextInfo->OriginAttributesPtr()->CreateSuffix(suffix);
+    LOG(("  anonymous=%u, suffix=%s]", aLoadContextInfo->IsAnonymous(), suffix.get()));
 
-  MOZ_ASSERT(!aLoadContextInfo->IsPrivate());
-  if (aLoadContextInfo->IsPrivate()) {
-    return NS_ERROR_INVALID_ARG;
+    MOZ_ASSERT(mIOThread->IsCurrentThread());
+
+    MOZ_ASSERT(!aLoadContextInfo->IsPrivate());
+    if (aLoadContextInfo->IsPrivate()) {
+      return NS_ERROR_INVALID_ARG;
+    }
   }
 
   if (!mCacheDirectory) {
+    // This is a kind of hack. Somebody called EvictAll() without a profile.
+    // This happens in xpcshell tests that use cache without profile. We need
+    // to notify observers in this case since the tests are waiting for it.
+    // Also notify for aPinned == true, those are interested as well.
+    if (!aLoadContextInfo) {
+      RefPtr<EvictionNotifierRunnable> r = new EvictionNotifierRunnable();
+      NS_DispatchToMainThread(r);
+    }
     return NS_ERROR_FILE_INVALID_PATH;
   }
 
@@ -2842,24 +2937,38 @@ CacheFileIOManager::EvictByContextInternal(nsILoadContextInfo *aLoadContextInfo)
   mHandles.GetActiveHandles(&handles);
 
   for (uint32_t i = 0; i < handles.Length(); ++i) {
-    bool equals;
-    rv = CacheFileUtils::KeyMatchesLoadContextInfo(handles[i]->Key(),
-                                                   aLoadContextInfo,
-                                                   &equals);
-    if (NS_FAILED(rv)) {
-      LOG(("CacheFileIOManager::EvictByContextInternal() - Cannot parse key in "
-           "handle! [handle=%p, key=%s]", handles[i].get(),
-           handles[i]->Key().get()));
-      MOZ_CRASH("Unexpected error!");
-    }
+    CacheFileHandle* handle = handles[i];
 
-    if (equals) {
-      rv = DoomFileInternal(handles[i]);
-      if (NS_WARN_IF(NS_FAILED(rv))) {
-        LOG(("CacheFileIOManager::EvictByContextInternal() - Cannot doom handle"
-             " [handle=%p]", handles[i].get()));
+    if (aLoadContextInfo) {
+      bool equals;
+      rv = CacheFileUtils::KeyMatchesLoadContextInfo(handle->Key(),
+                                                     aLoadContextInfo,
+                                                     &equals);
+      if (NS_FAILED(rv)) {
+        LOG(("CacheFileIOManager::EvictByContextInternal() - Cannot parse key in "
+             "handle! [handle=%p, key=%s]", handle, handle->Key().get()));
+        MOZ_CRASH("Unexpected error!");
+      }
+
+      if (!equals) {
+        continue;
       }
     }
+
+    // handle will be doomed only when pinning status is known and equal or
+    // doom decision will be deferred until pinning status is determined.
+    rv = DoomFileInternal(handle, aPinned
+                                  ? CacheFileIOManager::DOOM_WHEN_PINNED
+                                  : CacheFileIOManager::DOOM_WHEN_NON_PINNED);
+    if (NS_WARN_IF(NS_FAILED(rv))) {
+      LOG(("CacheFileIOManager::EvictByContextInternal() - Cannot doom handle"
+            " [handle=%p]", handle));
+    }
+  }
+
+  if (!aLoadContextInfo) {
+    RefPtr<EvictionNotifierRunnable> r = new EvictionNotifierRunnable();
+    NS_DispatchToMainThread(r);
   }
 
   if (!mContextEvictor) {
@@ -2867,7 +2976,7 @@ CacheFileIOManager::EvictByContextInternal(nsILoadContextInfo *aLoadContextInfo)
     mContextEvictor->Init(mCacheDirectory);
   }
 
-  mContextEvictor->AddContext(aLoadContextInfo);
+  mContextEvictor->AddContext(aLoadContextInfo, aPinned);
 
   return NS_OK;
 }
@@ -3249,10 +3358,11 @@ nsresult
 CacheFileIOManager::InitIndexEntry(CacheFileHandle *aHandle,
                                    uint32_t         aAppId,
                                    bool             aAnonymous,
-                                   bool             aInBrowser)
+                                   bool             aInBrowser,
+                                   bool             aPinning)
 {
   LOG(("CacheFileIOManager::InitIndexEntry() [handle=%p, appId=%u, anonymous=%d"
-       ", inBrowser=%d]", aHandle, aAppId, aAnonymous, aInBrowser));
+       ", inBrowser=%d, pinned=%d]", aHandle, aAppId, aAnonymous, aInBrowser, aPinning));
 
   nsresult rv;
   RefPtr<CacheFileIOManager> ioMan = gInstance;
@@ -3266,7 +3376,7 @@ CacheFileIOManager::InitIndexEntry(CacheFileHandle *aHandle,
   }
 
   RefPtr<InitIndexEntryEvent> ev =
-    new InitIndexEntryEvent(aHandle, aAppId, aAnonymous, aInBrowser);
+    new InitIndexEntryEvent(aHandle, aAppId, aAnonymous, aInBrowser, aPinning);
   rv = ioMan->mIOThread->Dispatch(ev, CacheIOThread::WRITE);
   NS_ENSURE_SUCCESS(rv, rv);
 
diff --git a/netwerk/cache2/CacheFileIOManager.h b/netwerk/cache2/CacheFileIOManager.h
index 96dc91ca1c..eeeac61200 100644
--- a/netwerk/cache2/CacheFileIOManager.h
+++ b/netwerk/cache2/CacheFileIOManager.h
@@ -29,6 +29,8 @@ namespace mozilla {
 namespace net {
 
 class CacheFile;
+class CacheFileIOListener;
+
 #ifdef DEBUG_HANDLES
 class CacheFileHandlesEntry;
 #endif
@@ -41,12 +43,17 @@ class CacheFileHandlesEntry;
 class CacheFileHandle : public nsISupports
 {
 public:
+  enum class PinningStatus : uint32_t {
+    UNKNOWN,
+    NON_PINNED,
+    PINNED
+  };
+
   NS_DECL_THREADSAFE_ISUPPORTS
   bool DispatchRelease();
 
-  CacheFileHandle(const SHA1Sum::Hash *aHash, bool aPriority);
-  CacheFileHandle(const nsACString &aKey, bool aPriority);
-  CacheFileHandle(const CacheFileHandle &aOther);
+  CacheFileHandle(const SHA1Sum::Hash *aHash, bool aPriority, PinningStatus aPinning);
+  CacheFileHandle(const nsACString &aKey, bool aPriority, PinningStatus aPinning);
   void Log();
   bool IsDoomed() const { return mIsDoomed; }
   const SHA1Sum::Hash *Hash() const { return mHash; }
@@ -58,6 +65,9 @@ public:
   bool IsSpecialFile() const { return mSpecialFile; }
   nsCString & Key() { return mKey; }
 
+  // Returns false when this handle has been doomed based on the pinning state update.
+  bool SetPinned(bool aPinned);
+
   // Memory reporting
   size_t SizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf) const;
   size_t SizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) const;
@@ -79,6 +89,22 @@ private:
                                     // but it can be still deleted by OS/user
                                     // and then a subsequent OpenNSPRFileDesc()
                                     // will fail.
+
+  // For existing files this is always pre-set to UNKNOWN.  The status is udpated accordingly
+  // after the matadata has been parsed.
+  // For new files the flag is set according to which storage kind is opening
+  // the cache entry and remains so for the handle's lifetime.
+  // The status can only change from UNKNOWN (if set so initially) to one of PINNED or NON_PINNED
+  // and it stays unchanged afterwards.
+  // This status is only accessed on the IO thread.
+  PinningStatus        mPinning;
+  // Both initially false.  Can be raised to true only when this handle is to be doomed
+  // during the period when the pinning status is unknown.  After the pinning status
+  // determination we check these flags and possibly doom.
+  // These flags are only accessed on the IO thread.
+  bool                 mDoomWhenFoundPinned : 1;
+  bool                 mDoomWhenFoundNonPinned : 1;
+
   nsCOMPtr<nsIFile>    mFile;
   int64_t              mFileSize;
   PRFileDesc          *mFD;  // if null then the file doesn't exists on the disk
@@ -91,7 +117,8 @@ public:
   ~CacheFileHandles();
 
   nsresult GetHandle(const SHA1Sum::Hash *aHash, CacheFileHandle **_retval);
-  nsresult NewHandle(const SHA1Sum::Hash *aHash, bool aPriority, CacheFileHandle **_retval);
+  nsresult NewHandle(const SHA1Sum::Hash *aHash, bool aPriority,
+                     CacheFileHandle::PinningStatus aPinning, CacheFileHandle **_retval);
   void     RemoveHandle(CacheFileHandle *aHandlle);
   void     GetAllHandles(nsTArray<RefPtr<CacheFileHandle> > *_retval);
   void     GetActiveHandles(nsTArray<RefPtr<CacheFileHandle> > *_retval);
@@ -212,11 +239,12 @@ public:
   NS_DECL_NSITIMERCALLBACK
 
   enum {
-    OPEN         = 0U,
-    CREATE       = 1U,
-    CREATE_NEW   = 2U,
-    PRIORITY     = 4U,
-    SPECIAL_FILE = 8U
+    OPEN         =  0U,
+    CREATE       =  1U,
+    CREATE_NEW   =  2U,
+    PRIORITY     =  4U,
+    SPECIAL_FILE =  8U,
+    PINNED       = 16U
   };
 
   CacheFileIOManager();
@@ -247,6 +275,19 @@ public:
   static nsresult Write(CacheFileHandle *aHandle, int64_t aOffset,
                         const char *aBuf, int32_t aCount, bool aValidate,
                         bool aTruncate, CacheFileIOListener *aCallback);
+  // PinningDoomRestriction:
+  // NO_RESTRICTION
+  //    no restriction is checked, the file is simply always doomed
+  // DOOM_WHEN_(NON)_PINNED, we branch based on the pinning status of the handle:
+  //   UNKNOWN: the handle is marked to be doomed when later found (non)pinned
+  //   PINNED/NON_PINNED: doom only when the restriction matches the pin status
+  //      and the handle has not yet been required to doom during the UNKNOWN
+  //      period
+  enum PinningDoomRestriction {
+    NO_RESTRICTION,
+    DOOM_WHEN_NON_PINNED,
+    DOOM_WHEN_PINNED
+  };
   static nsresult DoomFile(CacheFileHandle *aHandle,
                            CacheFileIOListener *aCallback);
   static nsresult DoomFileByKey(const nsACString &aKey,
@@ -260,12 +301,14 @@ public:
                              CacheFileIOListener *aCallback);
   static nsresult EvictIfOverLimit();
   static nsresult EvictAll();
-  static nsresult EvictByContext(nsILoadContextInfo *aLoadContextInfo);
+  static nsresult EvictByContext(nsILoadContextInfo *aLoadContextInfo,
+                                 bool aPinning);
 
   static nsresult InitIndexEntry(CacheFileHandle *aHandle,
                                  uint32_t         aAppId,
                                  bool             aAnonymous,
-                                 bool             aInBrowser);
+                                 bool             aInBrowser,
+                                 bool             aPinning);
   static nsresult UpdateIndexEntry(CacheFileHandle *aHandle,
                                    const uint32_t  *aFrecency,
                                    const uint32_t  *aExpirationTime);
@@ -329,7 +372,8 @@ private:
   nsresult WriteInternal(CacheFileHandle *aHandle, int64_t aOffset,
                          const char *aBuf, int32_t aCount, bool aValidate,
                          bool aTruncate);
-  nsresult DoomFileInternal(CacheFileHandle *aHandle);
+  nsresult DoomFileInternal(CacheFileHandle *aHandle,
+                            PinningDoomRestriction aPinningStatusRestriction = NO_RESTRICTION);
   nsresult DoomFileByKeyInternal(const SHA1Sum::Hash *aHash);
   nsresult ReleaseNSPRHandleInternal(CacheFileHandle *aHandle);
   nsresult TruncateSeekSetEOFInternal(CacheFileHandle *aHandle,
@@ -339,7 +383,8 @@ private:
   nsresult EvictIfOverLimitInternal();
   nsresult OverLimitEvictionInternal();
   nsresult EvictAllInternal();
-  nsresult EvictByContextInternal(nsILoadContextInfo *aLoadContextInfo);
+  nsresult EvictByContextInternal(nsILoadContextInfo *aLoadContextInfo,
+                                  bool aPinning);
 
   nsresult TrashDirectory(nsIFile *aFile);
   static void OnTrashTimer(nsITimer *aTimer, void *aClosure);
@@ -383,7 +428,7 @@ private:
   static CacheFileIOManager           *gInstance;
   TimeStamp                            mStartTime;
   bool                                 mShuttingDown;
-  RefPtr<CacheIOThread>              mIOThread;
+  RefPtr<CacheIOThread>                mIOThread;
   nsCOMPtr<nsIFile>                    mCacheDirectory;
 #if defined(MOZ_WIDGET_ANDROID)
   // On Android we add the active profile directory name between the path
@@ -396,7 +441,7 @@ private:
   CacheFileHandles                     mHandles;
   nsTArray<CacheFileHandle *>          mHandlesByLastUsed;
   nsTArray<CacheFileHandle *>          mSpecialHandles;
-  nsTArray<RefPtr<CacheFile> >       mScheduledMetadataWrites;
+  nsTArray<RefPtr<CacheFile> >         mScheduledMetadataWrites;
   nsCOMPtr<nsITimer>                   mMetadataWritesTimer;
   bool                                 mOverLimitEvicting;
   bool                                 mRemovingTrashDirs;
@@ -404,7 +449,7 @@ private:
   nsCOMPtr<nsIFile>                    mTrashDir;
   nsCOMPtr<nsIDirectoryEnumerator>     mTrashDirEnumerator;
   nsTArray<nsCString>                  mFailedTrashDirs;
-  RefPtr<CacheFileContextEvictor>    mContextEvictor;
+  RefPtr<CacheFileContextEvictor>      mContextEvictor;
   TimeStamp                            mLastSmartSizeTime;
 };
 
diff --git a/netwerk/cache2/CacheFileInputStream.h b/netwerk/cache2/CacheFileInputStream.h
index ab18ea2fd9..2b75420eed 100644
--- a/netwerk/cache2/CacheFileInputStream.h
+++ b/netwerk/cache2/CacheFileInputStream.h
@@ -53,7 +53,7 @@ private:
   void NotifyListener();
   void MaybeNotifyListener();
 
-  RefPtr<CacheFile>      mFile;
+  RefPtr<CacheFile>        mFile;
   RefPtr<CacheFileChunk> mChunk;
   int64_t                  mPos;
   bool                     mClosed;
diff --git a/netwerk/cache2/CacheFileMetadata.cpp b/netwerk/cache2/CacheFileMetadata.cpp
index 6d12997d1b..9579b0b0af 100644
--- a/netwerk/cache2/CacheFileMetadata.cpp
+++ b/netwerk/cache2/CacheFileMetadata.cpp
@@ -34,8 +34,6 @@ namespace net {
 // Max size of elements in bytes.
 #define kMaxElementsSize 64*1024
 
-#define kCacheEntryVersion 1
-
 #define NOW_SECONDS() (uint32_t(PR_Now() / PR_USEC_PER_SEC))
 
 NS_IMPL_ISUPPORTS(CacheFileMetadata, CacheFileIOListener)
@@ -69,7 +67,7 @@ CacheFileMetadata::CacheFileMetadata(CacheFileHandle *aHandle, const nsACString
   MOZ_ASSERT(NS_SUCCEEDED(rv));
 }
 
-CacheFileMetadata::CacheFileMetadata(bool aMemoryOnly, const nsACString &aKey)
+CacheFileMetadata::CacheFileMetadata(bool aMemoryOnly, bool aPinned, const nsACString &aKey)
   : CacheMemoryConsumer(aMemoryOnly ? MEMORY_ONLY : NORMAL)
   , mHandle(nullptr)
   , mHashArray(nullptr)
@@ -90,6 +88,9 @@ CacheFileMetadata::CacheFileMetadata(bool aMemoryOnly, const nsACString &aKey)
   MOZ_COUNT_CTOR(CacheFileMetadata);
   memset(&mMetaHdr, 0, sizeof(CacheFileMetadataHeader));
   mMetaHdr.mVersion = kCacheEntryVersion;
+  if (aPinned) {
+    AddFlags(kCacheEntryIsPinned);
+  }
   mMetaHdr.mExpirationTime = nsICacheEntry::NO_EXPIRATION_TIME;
   mKey = aKey;
   mMetaHdr.mKeySize = mKey.Length();
@@ -529,6 +530,29 @@ CacheFileMetadata::SetHash(uint32_t aIndex, CacheHash::Hash16_t aHash)
   return NS_OK;
 }
 
+nsresult
+CacheFileMetadata::AddFlags(uint32_t aFlags)
+{
+  MarkDirty(false);
+  mMetaHdr.mFlags |= aFlags;
+  return NS_OK;
+}
+
+nsresult
+CacheFileMetadata::RemoveFlags(uint32_t aFlags)
+{
+  MarkDirty(false);
+  mMetaHdr.mFlags &= ~aFlags;
+  return NS_OK;
+}
+
+nsresult
+CacheFileMetadata::GetFlags(uint32_t *_retval)
+{
+  *_retval = mMetaHdr.mFlags;
+  return NS_OK;
+}
+
 nsresult
 CacheFileMetadata::SetExpirationTime(uint32_t aExpirationTime)
 {
@@ -794,11 +818,16 @@ CacheFileMetadata::InitEmptyMetadata()
   mMetaHdr.mExpirationTime = nsICacheEntry::NO_EXPIRATION_TIME;
   mMetaHdr.mKeySize = mKey.Length();
 
+  // Deliberately not touching the "kCacheEntryIsPinned" flag.
+
   DoMemoryReport(MemoryUsage());
 
   // We're creating a new entry. If there is any old data truncate it.
-  if (mHandle && mHandle->FileExists() && mHandle->FileSize()) {
-    CacheFileIOManager::TruncateSeekSetEOF(mHandle, 0, 0, nullptr);
+  if (mHandle) {
+    mHandle->SetPinned(Pinned());
+    if (mHandle->FileExists() && mHandle->FileSize()) {
+      CacheFileIOManager::TruncateSeekSetEOF(mHandle, 0, 0, nullptr);
+    }
   }
 }
 
@@ -833,12 +862,19 @@ CacheFileMetadata::ParseMetadata(uint32_t aMetaOffset, uint32_t aBufOffset,
 
   mMetaHdr.ReadFromBuf(mBuf + hdrOffset);
 
-  if (mMetaHdr.mVersion != kCacheEntryVersion) {
+  if (mMetaHdr.mVersion == 1) {
+    // Backward compatibility before we've added flags to the header
+    keyOffset -= sizeof(uint32_t);
+  } else if (mMetaHdr.mVersion != kCacheEntryVersion) {
     LOG(("CacheFileMetadata::ParseMetadata() - Not a version we understand to. "
          "[version=0x%x, this=%p]", mMetaHdr.mVersion, this));
     return NS_ERROR_UNEXPECTED;
   }
 
+  // Update the version stored in the header to make writes
+  // store the header in the current version form.
+  mMetaHdr.mVersion = kCacheEntryVersion;
+
   uint32_t elementsOffset = mMetaHdr.mKeySize + keyOffset + 1;
 
   if (elementsOffset > metaposOffset) {
@@ -897,6 +933,14 @@ CacheFileMetadata::ParseMetadata(uint32_t aMetaOffset, uint32_t aBufOffset,
   if (NS_FAILED(rv))
     return rv;
 
+  if (mHandle) {
+    if (!mHandle->SetPinned(Pinned())) {
+      LOG(("CacheFileMetadata::ParseMetadata() - handle was doomed for this "
+           "pinning state, truncate the file [this=%p, pinned=%d]", this, Pinned()));
+      return NS_ERROR_FILE_CORRUPTED;
+    }
+  }
+
   mHashArraySize = hashesLen;
   mHashCount = hashCount;
   if (mHashArraySize) {
diff --git a/netwerk/cache2/CacheFileMetadata.h b/netwerk/cache2/CacheFileMetadata.h
index e8ff99bf77..c006485f35 100644
--- a/netwerk/cache2/CacheFileMetadata.h
+++ b/netwerk/cache2/CacheFileMetadata.h
@@ -19,6 +19,12 @@ class nsICacheEntryMetaDataVisitor;
 namespace mozilla {
 namespace net {
 
+// Flags stored in CacheFileMetadataHeader.mFlags
+
+// Whether an entry is a pinned entry (created with
+// nsICacheStorageService.pinningCacheStorage.)
+static const uint32_t kCacheEntryIsPinned = 1 << 0;
+
 // By multiplying with the current half-life we convert the frecency
 // to time independent of half-life value.  The range fits 32bits.
 // When decay time changes on next run of the browser, we convert
@@ -30,6 +36,9 @@ namespace net {
   ((double)(aInt) / (double)CacheObserver::HalfLifeSeconds())
 
 
+#define kCacheEntryVersion 2
+
+
 #pragma pack(push)
 #pragma pack(1)
 
@@ -42,19 +51,22 @@ public:
   uint32_t        mFrecency;
   uint32_t        mExpirationTime;
   uint32_t        mKeySize;
+  uint32_t        mFlags;
 
   void WriteToBuf(void *aBuf)
   {
     EnsureCorrectClassSize();
 
     uint8_t* ptr = static_cast<uint8_t*>(aBuf);
+    MOZ_ASSERT(mVersion == kCacheEntryVersion);
     NetworkEndian::writeUint32(ptr, mVersion); ptr += sizeof(uint32_t);
     NetworkEndian::writeUint32(ptr, mFetchCount); ptr += sizeof(uint32_t);
     NetworkEndian::writeUint32(ptr, mLastFetched); ptr += sizeof(uint32_t);
     NetworkEndian::writeUint32(ptr, mLastModified); ptr += sizeof(uint32_t);
     NetworkEndian::writeUint32(ptr, mFrecency); ptr += sizeof(uint32_t);
     NetworkEndian::writeUint32(ptr, mExpirationTime); ptr += sizeof(uint32_t);
-    NetworkEndian::writeUint32(ptr, mKeySize);
+    NetworkEndian::writeUint32(ptr, mKeySize); ptr += sizeof(uint32_t);
+    NetworkEndian::writeUint32(ptr, mFlags);
   }
 
   void ReadFromBuf(const void *aBuf)
@@ -68,14 +80,19 @@ public:
     mLastModified = BigEndian::readUint32(ptr); ptr += sizeof(uint32_t);
     mFrecency = BigEndian::readUint32(ptr); ptr += sizeof(uint32_t);
     mExpirationTime = BigEndian::readUint32(ptr); ptr += sizeof(uint32_t);
-    mKeySize = BigEndian::readUint32(ptr);
+    mKeySize = BigEndian::readUint32(ptr); ptr += sizeof(uint32_t);
+    if (mVersion >= kCacheEntryVersion) {
+      mFlags = BigEndian::readUint32(ptr);
+    } else {
+      mFlags = 0;
+    }
   }
 
   inline void EnsureCorrectClassSize()
   {
     static_assert((sizeof(mVersion) + sizeof(mFetchCount) +
       sizeof(mLastFetched) + sizeof(mLastModified) + sizeof(mFrecency) +
-      sizeof(mExpirationTime) + sizeof(mKeySize)) ==
+      sizeof(mExpirationTime) + sizeof(mKeySize)) + sizeof(mFlags) ==
       sizeof(CacheFileMetadataHeader),
       "Unexpected sizeof(CacheFileMetadataHeader)!");
   }
@@ -114,6 +131,7 @@ public:
   CacheFileMetadata(CacheFileHandle *aHandle,
                     const nsACString &aKey);
   CacheFileMetadata(bool aMemoryOnly,
+                    bool aPinned,
                     const nsACString &aKey);
   CacheFileMetadata();
 
@@ -127,8 +145,9 @@ public:
                          CacheFileMetadataListener *aListener);
   nsresult SyncReadMetadata(nsIFile *aFile);
 
-  bool     IsAnonymous() { return mAnonymous; }
+  bool     IsAnonymous() const { return mAnonymous; }
   mozilla::OriginAttributes const & OriginAttributes() const { return mOriginAttributes; }
+  bool     Pinned() const      { return !!(mMetaHdr.mFlags & kCacheEntryIsPinned); }
 
   const char * GetElement(const char *aKey);
   nsresult     SetElement(const char *aKey, const char *aValue);
@@ -137,6 +156,9 @@ public:
   CacheHash::Hash16_t GetHash(uint32_t aIndex);
   nsresult            SetHash(uint32_t aIndex, CacheHash::Hash16_t aHash);
 
+  nsresult AddFlags(uint32_t aFlags);
+  nsresult RemoveFlags(uint32_t aFlags);
+  nsresult GetFlags(uint32_t *_retval);
   nsresult SetExpirationTime(uint32_t aExpirationTime);
   nsresult GetExpirationTime(uint32_t *_retval);
   nsresult SetFrecency(uint32_t aFrecency);
@@ -175,7 +197,7 @@ private:
   nsresult EnsureBuffer(uint32_t aSize);
   nsresult ParseKey(const nsACString &aKey);
 
-  RefPtr<CacheFileHandle>           mHandle;
+  RefPtr<CacheFileHandle>             mHandle;
   nsCString                           mKey;
   CacheHash::Hash16_t                *mHashArray;
   uint32_t                            mHashArraySize;
diff --git a/netwerk/cache2/CacheFileOutputStream.h b/netwerk/cache2/CacheFileOutputStream.h
index 3326e5338a..804e95b5b6 100644
--- a/netwerk/cache2/CacheFileOutputStream.h
+++ b/netwerk/cache2/CacheFileOutputStream.h
@@ -50,7 +50,7 @@ private:
   void FillHole();
   void NotifyListener();
 
-  RefPtr<CacheFile>      mFile;
+  RefPtr<CacheFile>        mFile;
   RefPtr<CacheFileChunk> mChunk;
   RefPtr<CacheOutputCloseListener> mCloseListener;
   int64_t                  mPos;
diff --git a/netwerk/cache2/CacheIndex.cpp b/netwerk/cache2/CacheIndex.cpp
index 5352377ed3..beccf7b26a 100644
--- a/netwerk/cache2/CacheIndex.cpp
+++ b/netwerk/cache2/CacheIndex.cpp
@@ -705,11 +705,12 @@ nsresult
 CacheIndex::InitEntry(const SHA1Sum::Hash *aHash,
                       uint32_t             aAppId,
                       bool                 aAnonymous,
-                      bool                 aInBrowser)
+                      bool                 aInBrowser,
+                      bool                 aPinned)
 {
   LOG(("CacheIndex::InitEntry() [hash=%08x%08x%08x%08x%08x, appId=%u, "
-       "anonymous=%d, inBrowser=%d]", LOGSHA1(aHash), aAppId, aAnonymous,
-       aInBrowser));
+       "anonymous=%d, inBrowser=%d, pinned=%d]", LOGSHA1(aHash), aAppId,
+       aAnonymous, aInBrowser, aPinned));
 
   RefPtr<CacheIndex> index = gInstance;
 
@@ -799,10 +800,10 @@ CacheIndex::InitEntry(const SHA1Sum::Hash *aHash,
     }
 
     if (updated) {
-      updated->Init(aAppId, aAnonymous, aInBrowser);
+      updated->Init(aAppId, aAnonymous, aInBrowser, aPinned);
       updated->MarkDirty();
     } else {
-      entry->Init(aAppId, aAnonymous, aInBrowser);
+      entry->Init(aAppId, aAnonymous, aInBrowser, aPinned);
       entry->MarkDirty();
     }
   }
@@ -1108,10 +1109,22 @@ CacheIndex::RemoveAll()
 
 // static
 nsresult
-CacheIndex::HasEntry(const nsACString &aKey, EntryStatus *_retval)
+CacheIndex::HasEntry(const nsACString &aKey, EntryStatus *_retval, bool *_pinned)
 {
   LOG(("CacheIndex::HasEntry() [key=%s]", PromiseFlatCString(aKey).get()));
 
+  SHA1Sum sum;
+  SHA1Sum::Hash hash;
+  sum.update(aKey.BeginReading(), aKey.Length());
+  sum.finish(hash);
+
+  return HasEntry(hash, _retval, _pinned);
+}
+
+// static
+nsresult
+CacheIndex::HasEntry(const SHA1Sum::Hash &hash, EntryStatus *_retval, bool *_pinned)
+{
   RefPtr<CacheIndex> index = gInstance;
 
   if (!index) {
@@ -1124,10 +1137,9 @@ CacheIndex::HasEntry(const nsACString &aKey, EntryStatus *_retval)
     return NS_ERROR_NOT_AVAILABLE;
   }
 
-  SHA1Sum sum;
-  SHA1Sum::Hash hash;
-  sum.update(aKey.BeginReading(), aKey.Length());
-  sum.finish(hash);
+  if (_pinned) {
+    *_pinned = false;
+  }
 
   const CacheIndexEntry *entry = nullptr;
 
@@ -1163,6 +1175,9 @@ CacheIndex::HasEntry(const nsACString &aKey, EntryStatus *_retval)
       }
     } else {
       *_retval = EXISTS;
+      if (_pinned && entry->IsPinned()) {
+        *_pinned = true;
+      }
     }
   }
 
@@ -1193,7 +1208,7 @@ CacheIndex::GetEntryForEviction(bool aIgnoreEmptyEntries, SHA1Sum::Hash *aHash,
   bool foundEntry = false;
   uint32_t i;
 
-  // find first non-forced valid entry with the lowest frecency
+  // find first non-forced valid and unpinned entry with the lowest frecency
   index->mFrecencyArray.Sort(FrecencyComparator());
   for (i = 0; i < index->mFrecencyArray.Length(); ++i) {
     memcpy(&hash, &index->mFrecencyArray[i]->mHash, sizeof(SHA1Sum::Hash));
@@ -1202,6 +1217,10 @@ CacheIndex::GetEntryForEviction(bool aIgnoreEmptyEntries, SHA1Sum::Hash *aHash,
       continue;
     }
 
+    if (CacheIndexEntry::IsPinned(index->mFrecencyArray[i])) {
+      continue;
+    }
+
     if (aIgnoreEmptyEntries &&
         !CacheIndexEntry::GetFileSize(index->mFrecencyArray[i])) {
       continue;
@@ -2552,7 +2571,8 @@ CacheIndex::InitEntryFromDiskData(CacheIndexEntry *aEntry,
   // Bug 1201042 - will pass OriginAttributes directly.
   aEntry->Init(aMetaData->OriginAttributes().mAppId,
                aMetaData->IsAnonymous(),
-               aMetaData->OriginAttributes().mInBrowser);
+               aMetaData->OriginAttributes().mInBrowser,
+               aMetaData->Pinned());
 
   uint32_t expirationTime;
   aMetaData->GetExpirationTime(&expirationTime);
diff --git a/netwerk/cache2/CacheIndex.h b/netwerk/cache2/CacheIndex.h
index 6e16046ae4..87b12ba31a 100644
--- a/netwerk/cache2/CacheIndex.h
+++ b/netwerk/cache2/CacheIndex.h
@@ -148,7 +148,7 @@ public:
     mRec->mFlags = 0;
   }
 
-  void Init(uint32_t aAppId, bool aAnonymous, bool aInBrowser)
+  void Init(uint32_t aAppId, bool aAnonymous, bool aInBrowser, bool aPinned)
   {
     MOZ_ASSERT(mRec->mFrecency == 0);
     MOZ_ASSERT(mRec->mExpirationTime == nsICacheEntry::NO_EXPIRATION_TIME);
@@ -164,6 +164,9 @@ public:
     if (aInBrowser) {
       mRec->mFlags |= kInBrowserMask;
     }
+    if (aPinned) {
+      mRec->mFlags |= kPinnedMask;
+    }
   }
 
   const SHA1Sum::Hash * Hash() const { return &mRec->mHash; }
@@ -184,6 +187,8 @@ public:
   bool IsFresh() const { return !!(mRec->mFlags & kFreshMask); }
   void MarkFresh() { mRec->mFlags |= kFreshMask; }
 
+  bool IsPinned() const { return !!(mRec->mFlags & kPinnedMask); }
+
   void     SetFrecency(uint32_t aFrecency) { mRec->mFrecency = aFrecency; }
   uint32_t GetFrecency() const { return mRec->mFrecency; }
 
@@ -210,6 +215,10 @@ public:
   {
     return aRec->mFlags & kFileSizeMask;
   }
+  static uint32_t IsPinned(CacheIndexRecord *aRec)
+  {
+    return aRec->mFlags & kPinnedMask;
+  }
   bool     IsFileEmpty() const { return GetFileSize() == 0; }
 
   void WriteToBuf(void *aBuf)
@@ -301,7 +310,10 @@ private:
   // this entry during update or build process.
   static const uint32_t kFreshMask       = 0x04000000;
 
-  static const uint32_t kReservedMask    = 0x03000000;
+  // Indicates a pinned entry.
+  static const uint32_t kPinnedMask      = 0x02000000;
+
+  static const uint32_t kReservedMask    = 0x01000000;
 
   // FileSize in kilobytes
   static const uint32_t kFileSizeMask    = 0x00FFFFFF;
@@ -610,7 +622,8 @@ public:
   static nsresult InitEntry(const SHA1Sum::Hash *aHash,
                             uint32_t             aAppId,
                             bool                 aAnonymous,
-                            bool                 aInBrowser);
+                            bool                 aInBrowser,
+                            bool                 aPinned);
 
   // Remove entry from index. The entry should be present in index.
   static nsresult RemoveEntry(const SHA1Sum::Hash *aHash);
@@ -635,12 +648,16 @@ public:
 
   // Returns status of the entry in index for the given key. It can be called
   // on any thread.
-  static nsresult HasEntry(const nsACString &aKey, EntryStatus *_retval);
+  // If _pinned is non-null, it's filled with pinning status of the entry.
+  static nsresult HasEntry(const nsACString &aKey, EntryStatus *_retval,
+                           bool *_pinned = nullptr);
+  static nsresult HasEntry(const SHA1Sum::Hash &hash, EntryStatus *_retval,
+                           bool *_pinned = nullptr);
 
   // Returns a hash of the least important entry that should be evicted if the
   // cache size is over limit and also returns a total number of all entries in
-  // the index minus the number of forced valid entries that we encounter
-  // when searching (see below)
+  // the index minus the number of forced valid entries and unpinned entries
+  // that we encounter when searching (see below)
   static nsresult GetEntryForEviction(bool aIgnoreEmptyEntries, SHA1Sum::Hash *aHash, uint32_t *aCnt);
 
   // Checks if a cache entry is currently forced valid. Used to prevent an entry
@@ -964,7 +981,7 @@ private:
   char                     *mRWBuf;
   uint32_t                  mRWBufSize;
   uint32_t                  mRWBufPos;
-  RefPtr<CacheHash>       mRWHash;
+  RefPtr<CacheHash>         mRWHash;
 
   // Reading of journal succeeded if true.
   bool                      mJournalReadSuccessfully;
@@ -976,9 +993,9 @@ private:
   // Used to check the existence of the file during reading process.
   RefPtr<CacheFileHandle> mTmpHandle;
 
-  RefPtr<FileOpenHelper>  mIndexFileOpener;
-  RefPtr<FileOpenHelper>  mJournalFileOpener;
-  RefPtr<FileOpenHelper>  mTmpFileOpener;
+  RefPtr<FileOpenHelper>    mIndexFileOpener;
+  RefPtr<FileOpenHelper>    mJournalFileOpener;
+  RefPtr<FileOpenHelper>    mTmpFileOpener;
 
   // Directory enumerator used when building and updating index.
   nsCOMPtr<nsIDirectoryEnumerator> mDirEnumerator;
diff --git a/netwerk/cache2/CacheIndexIterator.h b/netwerk/cache2/CacheIndexIterator.h
index 7312fa8e8c..9ec06a676f 100644
--- a/netwerk/cache2/CacheIndexIterator.h
+++ b/netwerk/cache2/CacheIndexIterator.h
@@ -49,7 +49,7 @@ protected:
                      CacheIndexRecord *aNewRecord);
 
   nsresult                     mStatus;
-  RefPtr<CacheIndex>         mIndex;
+  RefPtr<CacheIndex>           mIndex;
   nsTArray<CacheIndexRecord *> mRecords;
   bool                         mAddNew;
 };
diff --git a/netwerk/cache2/CacheStorage.cpp b/netwerk/cache2/CacheStorage.cpp
index 8eb6446ec6..69ccd0de54 100644
--- a/netwerk/cache2/CacheStorage.cpp
+++ b/netwerk/cache2/CacheStorage.cpp
@@ -26,11 +26,13 @@ NS_IMPL_ISUPPORTS(CacheStorage, nsICacheStorage)
 CacheStorage::CacheStorage(nsILoadContextInfo* aInfo,
                            bool aAllowDisk,
                            bool aLookupAppCache,
-                           bool aSkipSizeCheck)
+                           bool aSkipSizeCheck,
+                           bool aPinning)
 : mLoadContextInfo(GetLoadContextInfo(aInfo))
 , mWriteToDisk(aAllowDisk)
 , mLookupAppCache(aLookupAppCache)
 , mSkipSizeCheck(aSkipSizeCheck)
+, mPinning(aPinning)
 {
 }
 
diff --git a/netwerk/cache2/CacheStorage.h b/netwerk/cache2/CacheStorage.h
index a916a5858f..85c5bccdbb 100644
--- a/netwerk/cache2/CacheStorage.h
+++ b/netwerk/cache2/CacheStorage.h
@@ -53,7 +53,8 @@ public:
   CacheStorage(nsILoadContextInfo* aInfo,
                bool aAllowDisk,
                bool aLookupAppCache,
-               bool aSkipSizeCheck);
+               bool aSkipSizeCheck,
+               bool aPinning);
 
 protected:
   virtual ~CacheStorage();
@@ -64,12 +65,14 @@ protected:
   bool mWriteToDisk : 1;
   bool mLookupAppCache : 1;
   bool mSkipSizeCheck: 1;
+  bool mPinning : 1;
 
 public:
   nsILoadContextInfo* LoadInfo() const { return mLoadContextInfo; }
   bool WriteToDisk() const { return mWriteToDisk && !mLoadContextInfo->IsPrivate(); }
   bool LookupAppCache() const { return mLookupAppCache; }
   bool SkipSizeCheck() const { return mSkipSizeCheck; }
+  bool Pinning() const { return mPinning; }
 };
 
 } // namespace net
diff --git a/netwerk/cache2/CacheStorageService.cpp b/netwerk/cache2/CacheStorageService.cpp
index e689e60a56..4bca73e39b 100644
--- a/netwerk/cache2/CacheStorageService.cpp
+++ b/netwerk/cache2/CacheStorageService.cpp
@@ -103,7 +103,8 @@ CacheStorageService::MemoryPool::Limit() const
 NS_IMPL_ISUPPORTS(CacheStorageService,
                   nsICacheStorageService,
                   nsIMemoryReporter,
-                  nsITimerCallback)
+                  nsITimerCallback,
+                  nsICacheTesting)
 
 CacheStorageService* CacheStorageService::sSelf = nullptr;
 
@@ -310,7 +311,8 @@ private:
 
   virtual void OnEntryInfo(const nsACString & aURISpec, const nsACString & aIdEnhance,
                            int64_t aDataSize, int32_t aFetchCount,
-                           uint32_t aLastModifiedTime, uint32_t aExpirationTime)
+                           uint32_t aLastModifiedTime, uint32_t aExpirationTime,
+                           bool aPinned)
   {
     nsCOMPtr<nsIURI> uri;
     nsresult rv = NS_NewURI(getter_AddRefs(uri), aURISpec);
@@ -318,7 +320,7 @@ private:
       return;
 
     mCallback->OnCacheEntryInfo(uri, aIdEnhance, aDataSize, aFetchCount,
-                                aLastModifiedTime, aExpirationTime);
+                                aLastModifiedTime, aExpirationTime, aPinned);
   }
 
 private:
@@ -378,7 +380,7 @@ private:
 
       mWalker->mCallback->OnCacheEntryInfo(
         uri, mIdEnhance, mDataSize, mFetchCount,
-        mLastModifiedTime, mExpirationTime);
+        mLastModifiedTime, mExpirationTime, mPinned);
       return NS_OK;
     }
 
@@ -390,6 +392,7 @@ private:
     int32_t mFetchCount;
     uint32_t mLastModifiedTime;
     uint32_t mExpirationTime;
+    bool mPinned;
   };
 
   NS_IMETHODIMP Run()
@@ -469,7 +472,8 @@ private:
 
   virtual void OnEntryInfo(const nsACString & aURISpec, const nsACString & aIdEnhance,
                            int64_t aDataSize, int32_t aFetchCount,
-                           uint32_t aLastModifiedTime, uint32_t aExpirationTime)
+                           uint32_t aLastModifiedTime, uint32_t aExpirationTime,
+                           bool aPinned)
   {
     // Called directly from CacheFileIOManager::GetEntryInfo.
 
@@ -481,6 +485,7 @@ private:
     info->mFetchCount = aFetchCount;
     info->mLastModifiedTime = aLastModifiedTime;
     info->mExpirationTime = aExpirationTime;
+    info->mPinned = aPinned;
 
     NS_DispatchToMainThread(info);
   }
@@ -536,7 +541,7 @@ void CacheStorageService::DropPrivateBrowsingEntries()
   sGlobalEntryTables->EnumerateRead(&CollectPrivateContexts, &keys);
 
   for (uint32_t i = 0; i < keys.Length(); ++i)
-    DoomStorageEntries(keys[i], nullptr, true, nullptr);
+    DoomStorageEntries(keys[i], nullptr, true, false, nullptr);
 }
 
 namespace {
@@ -681,7 +686,7 @@ NS_IMETHODIMP CacheStorageService::MemoryCacheStorage(nsILoadContextInfo *aLoadC
 
   nsCOMPtr<nsICacheStorage> storage;
   if (CacheObserver::UseNewCache()) {
-    storage = new CacheStorage(aLoadContextInfo, false, false, false);
+    storage = new CacheStorage(aLoadContextInfo, false, false, false, false);
   }
   else {
     storage = new _OldStorage(aLoadContextInfo, false, false, false, nullptr);
@@ -706,7 +711,7 @@ NS_IMETHODIMP CacheStorageService::DiskCacheStorage(nsILoadContextInfo *aLoadCon
 
   nsCOMPtr<nsICacheStorage> storage;
   if (CacheObserver::UseNewCache()) {
-    storage = new CacheStorage(aLoadContextInfo, useDisk, aLookupAppCache, false);
+    storage = new CacheStorage(aLoadContextInfo, useDisk, aLookupAppCache, false /* size limit */, false /* don't pin */);
   }
   else {
     storage = new _OldStorage(aLoadContextInfo, useDisk, aLookupAppCache, false, nullptr);
@@ -716,6 +721,27 @@ NS_IMETHODIMP CacheStorageService::DiskCacheStorage(nsILoadContextInfo *aLoadCon
   return NS_OK;
 }
 
+NS_IMETHODIMP CacheStorageService::PinningCacheStorage(nsILoadContextInfo *aLoadContextInfo,
+                                                       nsICacheStorage * *_retval)
+{
+  NS_ENSURE_ARG(aLoadContextInfo);
+  NS_ENSURE_ARG(_retval);
+
+  if (!CacheObserver::UseNewCache()) {
+    return NS_ERROR_NOT_IMPLEMENTED;
+  }
+
+  // When disk cache is disabled don't pretend we cache.
+  if (!CacheObserver::UseDiskCache()) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+
+  nsCOMPtr<nsICacheStorage> storage = new CacheStorage(
+    aLoadContextInfo, true /* use disk */, false /* no appcache */, true /* ignore size checks */, true /* pin */);
+  storage.forget(_retval);
+  return NS_OK;
+}
+
 NS_IMETHODIMP CacheStorageService::AppCacheStorage(nsILoadContextInfo *aLoadContextInfo,
                                                    nsIApplicationCache *aApplicationCache,
                                                    nsICacheStorage * *_retval)
@@ -745,7 +771,7 @@ NS_IMETHODIMP CacheStorageService::SynthesizedCacheStorage(nsILoadContextInfo *a
 
   nsCOMPtr<nsICacheStorage> storage;
   if (CacheObserver::UseNewCache()) {
-    storage = new CacheStorage(aLoadContextInfo, false, false, true /* skip size checks for synthesized cache */);
+    storage = new CacheStorage(aLoadContextInfo, false, false, true /* skip size checks for synthesized cache */, false /* no pinning */);
   }
   else {
     storage = new _OldStorage(aLoadContextInfo, false, false, false, nullptr);
@@ -768,12 +794,15 @@ NS_IMETHODIMP CacheStorageService::Clear()
       nsTArray<nsCString> keys;
       sGlobalEntryTables->EnumerateRead(&CollectContexts, &keys);
 
-      for (uint32_t i = 0; i < keys.Length(); ++i)
-        DoomStorageEntries(keys[i], nullptr, true, nullptr);
-    }
+      for (uint32_t i = 0; i < keys.Length(); ++i) {
+        DoomStorageEntries(keys[i], nullptr, true, false, nullptr);
+      }
 
-    rv = CacheFileIOManager::EvictAll();
-    NS_ENSURE_SUCCESS(rv, rv);
+      // Passing null as a load info means to evict all contexts.
+      // EvictByContext() respects the entry pinning.  EvictAll() does not.
+      rv = CacheFileIOManager::EvictByContext(nullptr, false);
+      NS_ENSURE_SUCCESS(rv, rv);
+    }
   } else {
     nsCOMPtr<nsICacheService> serv =
         do_GetService(NS_CACHESERVICE_CONTRACTID, &rv);
@@ -813,6 +842,29 @@ NS_IMETHODIMP CacheStorageService::PurgeFromMemory(uint32_t aWhat)
   return Dispatch(event);
 }
 
+NS_IMETHODIMP CacheStorageService::PurgeFromMemoryRunnable::Run()
+{
+  if (NS_IsMainThread()) {
+    nsCOMPtr<nsIObserverService> observerService =
+      mozilla::services::GetObserverService();
+    if (observerService) {
+      observerService->NotifyObservers(nullptr, "cacheservice:purge-memory-pools", nullptr);
+    }
+
+    return NS_OK;
+  }
+
+  if (mService) {
+    // TODO not all flags apply to both pools
+    mService->Pool(true).PurgeAll(mWhat);
+    mService->Pool(false).PurgeAll(mWhat);
+    mService = nullptr;
+  }
+
+  NS_DispatchToMainThread(this);
+  return NS_OK;
+}
+
 NS_IMETHODIMP CacheStorageService::AsyncGetDiskConsumption(
   nsICacheStorageConsumptionObserver* aObserver)
 {
@@ -920,7 +972,7 @@ CacheStorageService::UnregisterEntry(CacheEntry* aEntry)
 
 static bool
 AddExactEntry(CacheEntryTable* aEntries,
-              nsCString const& aKey,
+              nsACString const& aKey,
               CacheEntry* aEntry,
               bool aOverwrite)
 {
@@ -938,7 +990,7 @@ AddExactEntry(CacheEntryTable* aEntries,
 
 static bool
 RemoveExactEntry(CacheEntryTable* aEntries,
-                 nsCString const& aKey,
+                 nsACString const& aKey,
                  CacheEntry* aEntry,
                  bool aOverwrite)
 {
@@ -1353,7 +1405,9 @@ CacheStorageService::AddStorageEntry(CacheStorage const* aStorage,
   CacheFileUtils::AppendKeyPrefix(aStorage->LoadInfo(), contextKey);
 
   return AddStorageEntry(contextKey, aURI, aIdExtension,
-                         aStorage->WriteToDisk(), aStorage->SkipSizeCheck(),
+                         aStorage->WriteToDisk(),
+                         aStorage->SkipSizeCheck(),
+                         aStorage->Pinning(),
                          aCreateIfNotExist, aReplace,
                          aResult);
 }
@@ -1364,6 +1418,7 @@ CacheStorageService::AddStorageEntry(nsCSubstring const& aContextKey,
                                      const nsACString & aIdExtension,
                                      bool aWriteToDisk,
                                      bool aSkipSizeCheck,
+                                     bool aPin,
                                      bool aCreateIfNotExist,
                                      bool aReplace,
                                      CacheEntryHandle** aResult)
@@ -1398,12 +1453,8 @@ CacheStorageService::AddStorageEntry(nsCSubstring const& aContextKey,
     bool entryExists = entries->Get(entryKey, getter_AddRefs(entry));
 
     if (entryExists && !aReplace) {
-      // check whether the file is already doomed or we want to turn this entry
-      // to a memory-only.
-      if (MOZ_UNLIKELY(entry->IsFileDoomed())) {
-        LOG(("  file already doomed, replacing the entry"));
-        aReplace = true;
-      } else if (MOZ_UNLIKELY(!aWriteToDisk) && MOZ_LIKELY(entry->IsUsingDisk())) {
+      // check whether we want to turn this entry to a memory-only.
+      if (MOZ_UNLIKELY(!aWriteToDisk) && MOZ_LIKELY(entry->IsUsingDisk())) {
         LOG(("  entry is persistnet but we want mem-only, replacing it"));
         aReplace = true;
       }
@@ -1426,7 +1477,7 @@ CacheStorageService::AddStorageEntry(nsCSubstring const& aContextKey,
     // Ensure entry for the particular URL, if not read/only
     if (!entryExists && (aCreateIfNotExist || aReplace)) {
       // Entry is not in the hashtable or has just been truncated...
-      entry = new CacheEntry(aContextKey, aURI, aIdExtension, aWriteToDisk, aSkipSizeCheck);
+      entry = new CacheEntry(aContextKey, aURI, aIdExtension, aWriteToDisk, aSkipSizeCheck, aPin);
       entries->Put(entryKey, entry);
       LOG(("  new entry %p for %s", entry.get(), entryKey.get()));
     }
@@ -1664,15 +1715,19 @@ CacheStorageService::DoomStorageEntries(CacheStorage const* aStorage,
   mozilla::MutexAutoLock lock(mLock);
 
   return DoomStorageEntries(contextKey, aStorage->LoadInfo(),
-                            aStorage->WriteToDisk(), aCallback);
+                            aStorage->WriteToDisk(), aStorage->Pinning(),
+                            aCallback);
 }
 
 nsresult
 CacheStorageService::DoomStorageEntries(nsCSubstring const& aContextKey,
                                         nsILoadContextInfo* aContext,
                                         bool aDiskStorage,
+                                        bool aPinned,
                                         nsICacheEntryDoomCallback* aCallback)
 {
+  LOG(("CacheStorageService::DoomStorageEntries [context=%s]", aContextKey.BeginReading()));
+
   mLock.AssertCurrentThreadOwns();
 
   NS_ENSURE_TRUE(!mShutdown, NS_ERROR_NOT_INITIALIZED);
@@ -1683,30 +1738,31 @@ CacheStorageService::DoomStorageEntries(nsCSubstring const& aContextKey,
   if (aDiskStorage) {
     LOG(("  dooming disk+memory storage of %s", aContextKey.BeginReading()));
 
-    // Just remove all entries, CacheFileIOManager will take care of the files.
-    sGlobalEntryTables->Remove(aContextKey);
-    sGlobalEntryTables->Remove(memoryStorageID);
+    // Walk one by one and remove entries according their pin status
+    CacheEntryTable *diskEntries, *memoryEntries;
+    if (sGlobalEntryTables->Get(aContextKey, &diskEntries)) {
+      sGlobalEntryTables->Get(memoryStorageID, &memoryEntries);
+
+      for (auto iter = diskEntries->Iter(); !iter.Done(); iter.Next()) {
+        auto entry = iter.Data();
+        if (entry->DeferOrBypassRemovalOnPinStatus(aPinned)) {
+          continue;
+        }
+
+        if (memoryEntries) {
+          RemoveExactEntry(memoryEntries, iter.Key(), entry, false);
+        }
+        iter.Remove();
+      }
+    }
 
     if (aContext && !aContext->IsPrivate()) {
       LOG(("  dooming disk entries"));
-      CacheFileIOManager::EvictByContext(aContext);
+      CacheFileIOManager::EvictByContext(aContext, aPinned);
     }
   } else {
     LOG(("  dooming memory-only storage of %s", aContextKey.BeginReading()));
 
-    class MemoryEntriesRemoval {
-    public:
-      static PLDHashOperator EvictEntry(const nsACString& aKey,
-                                        CacheEntry* aEntry,
-                                        void* aClosure)
-      {
-        CacheEntryTable* entries = static_cast<CacheEntryTable*>(aClosure);
-        nsCString key(aKey);
-        RemoveExactEntry(entries, key, aEntry, false);
-        return PL_DHASH_NEXT;
-      }
-    };
-
     // Remove the memory entries table from the global tables.
     // Since we store memory entries also in the disk entries table
     // we need to remove the memory entries from the disk table one
@@ -1714,10 +1770,14 @@ CacheStorageService::DoomStorageEntries(nsCSubstring const& aContextKey,
     nsAutoPtr<CacheEntryTable> memoryEntries;
     sGlobalEntryTables->RemoveAndForget(memoryStorageID, memoryEntries);
 
-    CacheEntryTable* entries;
-    sGlobalEntryTables->Get(aContextKey, &entries);
-    if (memoryEntries && entries)
-      memoryEntries->EnumerateRead(&MemoryEntriesRemoval::EvictEntry, entries);
+    CacheEntryTable* diskEntries;
+    sGlobalEntryTables->Get(aContextKey, &diskEntries);
+    if (memoryEntries && diskEntries) {
+      for (auto iter = memoryEntries->Iter(); !iter.Done(); iter.Next()) {
+        auto entry = iter.Data();
+        RemoveExactEntry(diskEntries, iter.Key(), entry, false);
+      }
+    }
   }
 
   // An artificial callback.  This is a candidate for removal tho.  In the new
@@ -1794,9 +1854,6 @@ CacheStorageService::CacheFileDoomed(nsILoadContextInfo* aLoadContextInfo,
   if (!entry->IsFileDoomed())
     return;
 
-  if (entry->IsReferenced())
-    return;
-
   // Need to remove under the lock to avoid possible race leading
   // to duplication of the entry per its key.
   RemoveExactEntry(entries, entryKey, entry, false);
@@ -1867,7 +1924,8 @@ CacheStorageService::GetCacheEntryInfo(CacheEntry* aEntry,
   }
 
   aCallback->OnEntryInfo(uriSpec, enhanceId, dataSize,
-                         fetchCount, lastModified, expirationTime);
+                         fetchCount, lastModified, expirationTime,
+                         aEntry->IsPinned());
 }
 
 // nsIMemoryReporter
@@ -1999,5 +2057,46 @@ CacheStorageService::CollectReports(nsIMemoryReporterCallback* aHandleReport,
   return NS_OK;
 }
 
+// nsICacheTesting
+
+NS_IMETHODIMP
+CacheStorageService::IOThreadSuspender::Run()
+{
+  MonitorAutoLock mon(mMon);
+  mon.Wait();
+  return NS_OK;
+}
+
+void
+CacheStorageService::IOThreadSuspender::Notify()
+{
+  MonitorAutoLock mon(mMon);
+  mon.Notify();
+}
+
+NS_IMETHODIMP
+CacheStorageService::SuspendCacheIOThread(uint32_t aLevel)
+{
+  RefPtr<CacheIOThread> thread = CacheFileIOManager::IOThread();
+  if (!thread) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+
+  MOZ_ASSERT(!mActiveIOSuspender);
+  mActiveIOSuspender = new IOThreadSuspender();
+  return thread->Dispatch(mActiveIOSuspender, aLevel);
+}
+
+NS_IMETHODIMP
+CacheStorageService::ResumeCacheIOThread()
+{
+  MOZ_ASSERT(mActiveIOSuspender);
+
+  RefPtr<IOThreadSuspender> suspender;
+  suspender.swap(mActiveIOSuspender);
+  suspender->Notify();
+  return NS_OK;
+}
+
 } // namespace net
 } // namespace mozilla
diff --git a/netwerk/cache2/CacheStorageService.h b/netwerk/cache2/CacheStorageService.h
index 3dde0e0b67..9c7c20acc3 100644
--- a/netwerk/cache2/CacheStorageService.h
+++ b/netwerk/cache2/CacheStorageService.h
@@ -7,8 +7,9 @@
 
 #include "nsICacheStorageService.h"
 #include "nsIMemoryReporter.h"
-
 #include "nsITimer.h"
+#include "nsICacheTesting.h"
+
 #include "nsClassHashtable.h"
 #include "nsDataHashtable.h"
 #include "nsString.h"
@@ -65,12 +66,14 @@ protected:
 class CacheStorageService final : public nsICacheStorageService
                                 , public nsIMemoryReporter
                                 , public nsITimerCallback
+                                , public nsICacheTesting
 {
 public:
   NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSICACHESTORAGESERVICE
   NS_DECL_NSIMEMORYREPORTER
   NS_DECL_NSITIMERCALLBACK
+  NS_DECL_NSICACHETESTING
 
   CacheStorageService();
 
@@ -100,7 +103,8 @@ public:
   public:
     virtual void OnEntryInfo(const nsACString & aURISpec, const nsACString & aIdEnhance,
                              int64_t aDataSize, int32_t aFetchCount,
-                             uint32_t aLastModifiedTime, uint32_t aExpirationTime) = 0;
+                             uint32_t aLastModifiedTime, uint32_t aExpirationTime,
+                             bool aPinned) = 0;
   };
 
   // Invokes OnEntryInfo for the given aEntry, synchronously.
@@ -267,12 +271,14 @@ private:
   nsresult DoomStorageEntries(nsCSubstring const& aContextKey,
                               nsILoadContextInfo* aContext,
                               bool aDiskStorage,
+                              bool aPin,
                               nsICacheEntryDoomCallback* aCallback);
   nsresult AddStorageEntry(nsCSubstring const& aContextKey,
                            nsIURI* aURI,
                            const nsACString & aIdExtension,
                            bool aWriteToDisk,
                            bool aSkipSizeCheck,
+                           bool aPin,
                            bool aCreateIfNotExist,
                            bool aReplace,
                            CacheEntryHandle** aResult);
@@ -338,18 +344,26 @@ private:
   private:
     virtual ~PurgeFromMemoryRunnable() { }
 
-    NS_IMETHOD Run()
-    {
-      // TODO not all flags apply to both pools
-      mService->Pool(true).PurgeAll(mWhat);
-      mService->Pool(false).PurgeAll(mWhat);
-      return NS_OK;
-    }
+    NS_IMETHOD Run() override;
 
     RefPtr<CacheStorageService> mService;
     uint32_t mWhat;
   };
 
+  // nsICacheTesting
+  class IOThreadSuspender : public nsRunnable
+  {
+  public:
+    IOThreadSuspender() : mMon("IOThreadSuspender") { }
+    void Notify();
+  private:
+    virtual ~IOThreadSuspender() { }
+    NS_IMETHOD Run() override;
+
+    Monitor mMon;
+  };
+
+  RefPtr<IOThreadSuspender> mActiveIOSuspender;
 };
 
 template<class T>
diff --git a/netwerk/cache2/OldWrappers.cpp b/netwerk/cache2/OldWrappers.cpp
index 18b1d0c882..7ed090b662 100644
--- a/netwerk/cache2/OldWrappers.cpp
+++ b/netwerk/cache2/OldWrappers.cpp
@@ -267,7 +267,7 @@ NS_IMETHODIMP _OldVisitCallbackWrapper::VisitEntry(const char * deviceID,
 
   // Send them to the consumer.
   rv = mCB->OnCacheEntryInfo(
-    uri, enhanceId, (int64_t)dataSize, fetchCount, lastModified, expirationTime);
+    uri, enhanceId, (int64_t)dataSize, fetchCount, lastModified, expirationTime, false);
 
   *_retval = NS_SUCCEEDED(rv);
   return NS_OK;
diff --git a/netwerk/cache2/moz.build b/netwerk/cache2/moz.build
index ae2f485769..c85bbae952 100644
--- a/netwerk/cache2/moz.build
+++ b/netwerk/cache2/moz.build
@@ -11,6 +11,7 @@ XPIDL_SOURCES += [
     'nsICacheStorage.idl',
     'nsICacheStorageService.idl',
     'nsICacheStorageVisitor.idl',
+    'nsICacheTesting.idl',
 ]
 
 XPIDL_MODULE = 'necko_cache2'
diff --git a/netwerk/cache2/nsICacheStorageService.idl b/netwerk/cache2/nsICacheStorageService.idl
index 56cb96d539..2be9b1bab0 100644
--- a/netwerk/cache2/nsICacheStorageService.idl
+++ b/netwerk/cache2/nsICacheStorageService.idl
@@ -13,7 +13,7 @@ interface nsICacheStorageConsumptionObserver;
 /**
  * Provides access to particual cache storages of the network URI cache.
  */
-[scriptable, uuid(9c9dc1d6-533e-4716-9ad8-11e08c3763b3)]
+[scriptable, uuid(ae29c44b-fbc3-4552-afaf-0a157ce771e7)]
 interface nsICacheStorageService : nsISupports
 {
   /**
@@ -42,6 +42,13 @@ interface nsICacheStorageService : nsISupports
   nsICacheStorage diskCacheStorage(in nsILoadContextInfo aLoadContextInfo,
                                    in bool aLookupAppCache);
 
+  /**
+   * Get storage where entries will be written to disk and marked as pinned.
+   * These pinned entries are immune to over limit eviction and call of clear()
+   * on this service.
+   */
+  nsICacheStorage pinningCacheStorage(in nsILoadContextInfo aLoadContextInfo);
+
   /**
    * Get storage for a specified application cache obtained using some different
    * mechanism.
diff --git a/netwerk/cache2/nsICacheStorageVisitor.idl b/netwerk/cache2/nsICacheStorageVisitor.idl
index 77e1bcc680..d6720acce7 100644
--- a/netwerk/cache2/nsICacheStorageVisitor.idl
+++ b/netwerk/cache2/nsICacheStorageVisitor.idl
@@ -7,7 +7,7 @@
 interface nsIURI;
 interface nsIFile;
 
-[scriptable, uuid(946bd799-9410-4945-9085-79c7fe019e83)]
+[scriptable, uuid(6cc7c253-93b6-482b-8e9d-1e04d8e9d655)]
 interface nsICacheStorageVisitor : nsISupports
 {
   /**
@@ -24,7 +24,8 @@ interface nsICacheStorageVisitor : nsISupports
                         in int64_t aDataSize,
                         in long aFetchCount,
                         in uint32_t aLastModifiedTime,
-                        in uint32_t aExpirationTime);
+                        in uint32_t aExpirationTime,
+                        in boolean aPinned);
 
   /**
    */
diff --git a/netwerk/cache2/nsICacheTesting.idl b/netwerk/cache2/nsICacheTesting.idl
new file mode 100644
index 0000000000..d71891f0da
--- /dev/null
+++ b/netwerk/cache2/nsICacheTesting.idl
@@ -0,0 +1,17 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+/**
+ * This is an internal interface used only for testing purposes.
+ *
+ * THIS IS NOT AN API TO BE USED BY EXTENSIONS! ONLY USED BY MOZILLA TESTS.
+ */
+[scriptable, builtinclass, uuid(4e8ba935-92e1-4a74-944b-b1a2f02a7480)]
+interface nsICacheTesting : nsISupports
+{
+  void suspendCacheIOThread(in uint32_t aLevel);
+  void resumeCacheIOThread();
+};
diff --git a/netwerk/cookie/nsICookieService.idl b/netwerk/cookie/nsICookieService.idl
index f6d8950e92..053fad6db1 100644
--- a/netwerk/cookie/nsICookieService.idl
+++ b/netwerk/cookie/nsICookieService.idl
@@ -71,7 +71,7 @@ interface nsIChannel;
  *           to set the cookie.
  * data   :  the referrer, or "?" if unknown
  */
-[scriptable, uuid(537a0a1b-27c3-40b4-9e68-e68d144ed040)]
+[scriptable, uuid(1e94e283-2811-4f43-b947-d22b1549d824)]
 interface nsICookieService : nsISupports
 {
   /*
@@ -87,7 +87,7 @@ interface nsICookieService : nsISupports
    * Possible values for the "network.cookie.lifetimePolicy" preference.
    */
   const uint32_t ACCEPT_NORMALLY   = 0; // accept normally
-  // Value = 1 is considered the same as 0 (See #1475).
+  // Value = 1 is considered the same as 0 (See Bug 606655).
   const uint32_t ACCEPT_SESSION    = 2; // downgrade to session
   const uint32_t ACCEPT_FOR_N_DAYS = 3; // limit lifetime to N days
 
diff --git a/netwerk/protocol/about/nsAboutCache.cpp b/netwerk/protocol/about/nsAboutCache.cpp
index b108d3686d..31f4a02c82 100644
--- a/netwerk/protocol/about/nsAboutCache.cpp
+++ b/netwerk/protocol/about/nsAboutCache.cpp
@@ -346,7 +346,8 @@ nsAboutCache::OnCacheStorageInfo(uint32_t aEntryCount, uint64_t aConsumption,
 NS_IMETHODIMP
 nsAboutCache::OnCacheEntryInfo(nsIURI *aURI, const nsACString & aIdEnhance,
                                int64_t aDataSize, int32_t aFetchCount,
-                               uint32_t aLastModified, uint32_t aExpirationTime)
+                               uint32_t aLastModified, uint32_t aExpirationTime,
+                               bool aPinned)
 {
     // We need mStream for this
     if (!mStream) {
@@ -362,6 +363,7 @@ nsAboutCache::OnCacheEntryInfo(nsIURI *aURI, const nsACString & aIdEnhance,
                               "   <col id=\"col-fetchCount\">\n"
                               "   <col id=\"col-lastModified\">\n"
                               "   <col id=\"col-expires\">\n"
+                              "   <col id=\"col-pinned\">\n"
                               "  </colgroup>\n"
                               "  <thead>\n"
                               "    <tr>\n"
@@ -370,6 +372,7 @@ nsAboutCache::OnCacheEntryInfo(nsIURI *aURI, const nsACString & aIdEnhance,
                               "      <th>Fetch count</th>\n"
                               "      <th>Last Modifed</th>\n"
                               "      <th>Expires</th>\n"
+                              "      <th>Pinning</th>\n"
                               "    </tr>\n"
                               "  </thead>\n");
         mEntriesHeaderAdded = true;
@@ -446,6 +449,15 @@ nsAboutCache::OnCacheEntryInfo(nsIURI *aURI, const nsACString & aIdEnhance,
     }
     mBuffer.AppendLiteral("</td>\n");
 
+    // Pinning
+    mBuffer.AppendLiteral("    <td>");
+    if (aPinned) {
+      mBuffer.Append(NS_LITERAL_CSTRING("Pinned"));
+    } else {
+      mBuffer.Append(NS_LITERAL_CSTRING("&nbsp;"));
+    }
+    mBuffer.AppendLiteral("</td>\n");
+
     // Entry is done...
     mBuffer.AppendLiteral("  </tr>\n");
 
diff --git a/netwerk/protocol/data/DataChannelChild.cpp b/netwerk/protocol/data/DataChannelChild.cpp
index 58d5518f8b..a6f969bf93 100644
--- a/netwerk/protocol/data/DataChannelChild.cpp
+++ b/netwerk/protocol/data/DataChannelChild.cpp
@@ -73,5 +73,5 @@ DataChannelChild::ActorDestroy(ActorDestroyReason why)
     Release();
 }
 
-} // namespace mozilla
 } // namespace net
+} // namespace mozilla
diff --git a/netwerk/protocol/data/DataChannelParent.cpp b/netwerk/protocol/data/DataChannelParent.cpp
index 62871f61c8..68b14b40bd 100644
--- a/netwerk/protocol/data/DataChannelParent.cpp
+++ b/netwerk/protocol/data/DataChannelParent.cpp
@@ -84,5 +84,5 @@ DataChannelParent::OnDataAvailable(nsIRequest *aRequest,
     MOZ_CRASH("Should never be called");
 }
 
-} // namespace mozilla
 } // namespace net
+} // namespace mozilla
diff --git a/netwerk/protocol/data/DataChannelParent.h b/netwerk/protocol/data/DataChannelParent.h
index 6927271849..e75fa737ed 100644
--- a/netwerk/protocol/data/DataChannelParent.h
+++ b/netwerk/protocol/data/DataChannelParent.h
@@ -35,7 +35,7 @@ private:
     virtual void ActorDestroy(ActorDestroyReason why) override;
 };
 
-} // namespace mozilla
 } // namespace net
+} // namespace mozilla
 
 #endif /* NS_DATACHANNELPARENT_H */
diff --git a/netwerk/protocol/data/nsDataHandler.cpp b/netwerk/protocol/data/nsDataHandler.cpp
index de15b14a44..bad5964f35 100644
--- a/netwerk/protocol/data/nsDataHandler.cpp
+++ b/netwerk/protocol/data/nsDataHandler.cpp
@@ -169,7 +169,8 @@ nsDataHandler::ParseURI(nsCString& spec,
 
     // First, find the start of the data
     char *comma = strchr(buffer, ',');
-    if (!comma)
+    char *hash = strchr(buffer, '#');
+    if (!comma || (hash && hash < comma))
         return NS_ERROR_MALFORMED_URI;
 
     *comma = '\0';
@@ -224,7 +225,6 @@ nsDataHandler::ParseURI(nsCString& spec,
 
     // Split encoded data from terminal "#ref" (if present)
     char *data = comma + 1;
-    char *hash = strchr(data, '#');
     if (!hash) {
         dataBuffer.Assign(data);
         hashRef.Truncate();
diff --git a/netwerk/protocol/file/nsFileChannel.cpp b/netwerk/protocol/file/nsFileChannel.cpp
index ee9cb67370..e11e878fc6 100644
--- a/netwerk/protocol/file/nsFileChannel.cpp
+++ b/netwerk/protocol/file/nsFileChannel.cpp
@@ -272,6 +272,14 @@ nsFileChannel::nsFileChannel(nsIURI *uri)
                                          getter_AddRefs(resolvedFile))) &&
       NS_SUCCEEDED(NS_NewFileURI(getter_AddRefs(targetURI), 
                    resolvedFile, nullptr))) {
+    // Make an effort to match up the query strings.
+    nsCOMPtr<nsIURL> origURL = do_QueryInterface(uri);
+    nsCOMPtr<nsIURL> targetURL = do_QueryInterface(targetURI);
+    nsAutoCString queryString;
+    if (origURL && targetURL && NS_SUCCEEDED(origURL->GetQuery(queryString))) {
+      targetURL->SetQuery(queryString);
+    }
+
     SetURI(targetURI);
     SetOriginalURI(uri);
     nsLoadFlags loadFlags = 0;
diff --git a/netwerk/protocol/http/ConnectionDiagnostics.cpp b/netwerk/protocol/http/ConnectionDiagnostics.cpp
index a331e3dbfa..5a3b818b23 100644
--- a/netwerk/protocol/http/ConnectionDiagnostics.cpp
+++ b/netwerk/protocol/http/ConnectionDiagnostics.cpp
@@ -15,8 +15,7 @@
 #include "nsIConsoleService.h"
 #include "nsHttpRequestHead.h"
 #include "nsServiceManagerUtils.h"
-
-extern PRThread *gSocketThread;
+#include "nsSocketTransportService2.h"
 
 namespace mozilla {
 namespace net {
diff --git a/netwerk/protocol/http/Http2Compression.cpp b/netwerk/protocol/http/Http2Compression.cpp
index d952a5a575..4942958378 100644
--- a/netwerk/protocol/http/Http2Compression.cpp
+++ b/netwerk/protocol/http/Http2Compression.cpp
@@ -18,8 +18,6 @@
 #include "Http2HuffmanOutgoing.h"
 #include "mozilla/StaticPtr.h"
 
-extern PRThread *gSocketThread;
-
 namespace mozilla {
 namespace net {
 
diff --git a/netwerk/protocol/http/Http2Session.cpp b/netwerk/protocol/http/Http2Session.cpp
index 86988fd934..8fa9dc453f 100644
--- a/netwerk/protocol/http/Http2Session.cpp
+++ b/netwerk/protocol/http/Http2Session.cpp
@@ -19,6 +19,7 @@
 #include "Http2Stream.h"
 #include "Http2Push.h"
 
+#include "mozilla/Endian.h"
 #include "mozilla/Preferences.h"
 #include "nsHttp.h"
 #include "nsHttpHandler.h"
@@ -30,14 +31,10 @@
 #include "nsISupportsPriority.h"
 #include "nsStandardURL.h"
 #include "nsURLHelper.h"
-#include "prprf.h"
 #include "prnetdb.h"
 #include "sslt.h"
-
-#ifdef DEBUG
-// defined by the socket transport service while active
-extern PRThread *gSocketThread;
-#endif
+#include "mozilla/Snprintf.h"
+#include "nsSocketTransportService2.h"
 
 namespace mozilla {
 namespace net {
@@ -93,6 +90,8 @@ Http2Session::Http2Session(nsISocketTransport *aSocketTransport, uint32_t versio
   , mCleanShutdown(false)
   , mTLSProfileConfirmed(false)
   , mGoAwayReason(NO_HTTP_ERROR)
+  , mClientGoAwayReason(UNASSIGNED)
+  , mPeerGoAwayReason(UNASSIGNED)
   , mGoAwayID(0)
   , mOutgoingGoAwayID(0)
   , mConcurrent(0)
@@ -134,30 +133,6 @@ Http2Session::Http2Session(nsISocketTransport *aSocketTransport, uint32_t versio
   mPreviousPingThreshold = mPingThreshold;
 }
 
-// Copy the 32 bit number into the destination, using network byte order
-// in the destination.
-template<typename charType> static void
-CopyAsNetwork32(charType dest,   // where to store it
-                uint32_t number) // the 32 bit number in native format
-{
-  number = PR_htonl(number);
-  memcpy(dest, &number, sizeof(number));
-}
-
-template void CopyAsNetwork32(char *dest, uint32_t number);
-template void CopyAsNetwork32(uint8_t *dest, uint32_t number);
-
-template<typename charType> static void
-CopyAsNetwork16(charType dest, // where to store it
-                uint16_t number) // the 16 bit number in native format
-{
-  number = PR_htons(number);
-  memcpy(dest, &number, sizeof(number));
-}
-
-template void CopyAsNetwork16(char *dest, uint16_t number);
-template void CopyAsNetwork16(uint8_t *dest, uint16_t number);
-
 PLDHashOperator
 Http2Session::ShutdownEnumerator(nsAHttpTransaction *key,
                                  nsAutoPtr<Http2Stream> &stream,
@@ -238,11 +213,10 @@ Http2Session::LogIO(Http2Session *self, Http2Stream *stream,
         LOG5(("%s", linebuf));
       }
       line = linebuf;
-      PR_snprintf(line, 128, "%08X: ", index);
+      snprintf(line, 128, "%08X: ", index);
       line += 10;
     }
-    PR_snprintf(line, 128 - (line - linebuf), "%02X ",
-                (reinterpret_cast<const uint8_t *>(data))[index]);
+    snprintf(line, 128 - (line - linebuf), "%02X ", (reinterpret_cast<const uint8_t *>(data))[index]);
     line += 3;
   }
   if (index) {
@@ -672,10 +646,10 @@ Http2Session::CreateFrameHeader(charType dest, uint16_t frameLength,
   MOZ_ASSERT(!(streamID & 0x80000000));
 
   dest[0] = 0x00;
-  CopyAsNetwork16(dest + 1, frameLength);
+  NetworkEndian::writeUint16(dest + 1, frameLength);
   dest[3] = frameType;
   dest[4] = frameFlags;
-  CopyAsNetwork32(dest + 5, streamID);
+  NetworkEndian::writeUint32(dest + 5, streamID);
 }
 
 char *
@@ -782,7 +756,7 @@ Http2Session::GeneratePriority(uint32_t aID, uint8_t aPriorityWeight)
   mOutputQueueUsed += frameSize;
 
   CreateFrameHeader(packet, 5, FRAME_TYPE_PRIORITY, 0, aID);
-  CopyAsNetwork32(packet + kFrameHeaderBytes, 0);
+  NetworkEndian::writeUint32(packet + kFrameHeaderBytes, 0);
   memcpy(packet + frameSize - 1, &aPriorityWeight, 1);
   LogIO(this, nullptr, "Generate Priority", packet, frameSize);
   FlushOutputQueue();
@@ -809,7 +783,7 @@ Http2Session::GenerateRstStream(uint32_t aStatusCode, uint32_t aID)
   mOutputQueueUsed += frameSize;
   CreateFrameHeader(packet, 4, FRAME_TYPE_RST_STREAM, 0, aID);
 
-  CopyAsNetwork32(packet + kFrameHeaderBytes, aStatusCode);
+  NetworkEndian::writeUint32(packet + kFrameHeaderBytes, aStatusCode);
 
   LogIO(this, nullptr, "Generate Reset", packet, frameSize);
   FlushOutputQueue();
@@ -821,6 +795,7 @@ Http2Session::GenerateGoAway(uint32_t aStatusCode)
   MOZ_ASSERT(PR_GetCurrentThread() == gSocketThread);
   LOG3(("Http2Session::GenerateGoAway %p code=%X\n", this, aStatusCode));
 
+  mClientGoAwayReason = aStatusCode;
   uint32_t frameSize = kFrameHeaderBytes + 8;
   char *packet = EnsureOutputBuffer(frameSize);
   mOutputQueueUsed += frameSize;
@@ -828,10 +803,10 @@ Http2Session::GenerateGoAway(uint32_t aStatusCode)
   CreateFrameHeader(packet, 8, FRAME_TYPE_GOAWAY, 0, 0);
 
   // last-good-stream-id are bytes 9-12 reflecting pushes
-  CopyAsNetwork32(packet + kFrameHeaderBytes, mOutgoingGoAwayID);
+  NetworkEndian::writeUint32(packet + kFrameHeaderBytes, mOutgoingGoAwayID);
 
   // bytes 13-16 are the status code.
-  CopyAsNetwork32(packet + frameSize - 4, aStatusCode);
+  NetworkEndian::writeUint32(packet + frameSize - 4, aStatusCode);
 
   LogIO(this, nullptr, "Generate GoAway", packet, frameSize);
   FlushOutputQueue();
@@ -877,11 +852,11 @@ Http2Session::SendHello()
   if (!gHttpHandler->AllowPush()) {
     // If we don't support push then set MAX_CONCURRENT to 0 and also
     // set ENABLE_PUSH to 0
-    CopyAsNetwork16(packet + kFrameHeaderBytes + (6 * numberOfEntries), SETTINGS_TYPE_ENABLE_PUSH);
+    NetworkEndian::writeUint16(packet + kFrameHeaderBytes + (6 * numberOfEntries), SETTINGS_TYPE_ENABLE_PUSH);
     // The value portion of the setting pair is already initialized to 0
     numberOfEntries++;
 
-    CopyAsNetwork16(packet + kFrameHeaderBytes + (6 * numberOfEntries), SETTINGS_TYPE_MAX_CONCURRENT);
+    NetworkEndian::writeUint16(packet + kFrameHeaderBytes + (6 * numberOfEntries), SETTINGS_TYPE_MAX_CONCURRENT);
     // The value portion of the setting pair is already initialized to 0
     numberOfEntries++;
 
@@ -890,14 +865,14 @@ Http2Session::SendHello()
 
   // Advertise the Push RWIN for the session, and on each new pull stream
   // send a window update
-  CopyAsNetwork16(packet + kFrameHeaderBytes + (6 * numberOfEntries), SETTINGS_TYPE_INITIAL_WINDOW);
-  CopyAsNetwork32(packet + kFrameHeaderBytes + (6 * numberOfEntries) + 2, mPushAllowance);
+  NetworkEndian::writeUint16(packet + kFrameHeaderBytes + (6 * numberOfEntries), SETTINGS_TYPE_INITIAL_WINDOW);
+  NetworkEndian::writeUint32(packet + kFrameHeaderBytes + (6 * numberOfEntries) + 2, mPushAllowance);
   numberOfEntries++;
 
   // Make sure the other endpoint knows that we're sticking to the default max
   // frame size
-  CopyAsNetwork16(packet + kFrameHeaderBytes + (6 * numberOfEntries), SETTINGS_TYPE_MAX_FRAME_SIZE);
-  CopyAsNetwork32(packet + kFrameHeaderBytes + (6 * numberOfEntries) + 2, kMaxFrameData);
+  NetworkEndian::writeUint16(packet + kFrameHeaderBytes + (6 * numberOfEntries), SETTINGS_TYPE_MAX_FRAME_SIZE);
+  NetworkEndian::writeUint32(packet + kFrameHeaderBytes + (6 * numberOfEntries) + 2, kMaxFrameData);
   numberOfEntries++;
 
   MOZ_ASSERT(numberOfEntries <= maxSettings);
@@ -916,7 +891,7 @@ Http2Session::SendHello()
     packet = mOutputQueueBuffer.get() + mOutputQueueUsed;
     CreateFrameHeader(packet, 4, FRAME_TYPE_WINDOW_UPDATE, 0, 0);
     mOutputQueueUsed += kFrameHeaderBytes + 4;
-    CopyAsNetwork32(packet + kFrameHeaderBytes, sessionWindowBump);
+    NetworkEndian::writeUint32(packet + kFrameHeaderBytes, sessionWindowBump);
 
     LOG3(("Session Window increase at start of session %p %u\n",
           this, sessionWindowBump));
@@ -952,7 +927,7 @@ Http2Session::CreatePriorityNode(uint32_t streamID, uint32_t dependsOn, uint8_t
   char *packet = mOutputQueueBuffer.get() + mOutputQueueUsed;
   CreateFrameHeader(packet, 5, FRAME_TYPE_PRIORITY, 0, streamID);
   mOutputQueueUsed += kFrameHeaderBytes + 5;
-  CopyAsNetwork32(packet + kFrameHeaderBytes, dependsOn); // depends on
+  NetworkEndian::writeUint32(packet + kFrameHeaderBytes, dependsOn); // depends on
   packet[kFrameHeaderBytes + 4] = weight; // weight
 
   LOG3(("Http2Session %p generate Priority Frame 0x%X depends on 0x%X "
@@ -1172,9 +1147,12 @@ Http2Session::ParsePadding(uint8_t &paddingControlBytes, uint16_t &paddingLength
   if (mInputFrameFlags & kFlag_PADDED) {
     paddingLength = *reinterpret_cast<uint8_t *>(mInputFrameBuffer + kFrameHeaderBytes);
     paddingControlBytes = 1;
+  } else {
+    paddingLength = 0;
+    paddingControlBytes = 0;
   }
 
-  if (paddingLength > mInputFrameDataSize) {
+  if (static_cast<uint32_t>(paddingLength + paddingControlBytes) > mInputFrameDataSize) {
     // This is fatal to the session
     LOG3(("Http2Session::ParsePadding %p stream 0x%x PROTOCOL_ERROR "
           "paddingLength %d > frame size %d\n",
@@ -1232,6 +1210,11 @@ Http2Session::RecvHeaders(Http2Session *self)
         paddingLength,
         self->mInputFrameFlags & kFlag_PADDED));
 
+  if ((paddingControlBytes + priorityLen + paddingLength) > self->mInputFrameDataSize) {
+    // This is fatal to the session
+    RETURN_SESSION_ERROR(self, PROTOCOL_ERROR);
+  }
+
   if (!self->mInputFrameDataStream) {
     // Cannot find stream. We can continue the session, but we need to
     // uncompress the header block to maintain the correct compression context
@@ -1385,8 +1368,8 @@ Http2Session::RecvPriority(Http2Session *self)
   if (NS_FAILED(rv))
     return rv;
 
-  uint32_t newPriorityDependency =
-    PR_ntohl(*reinterpret_cast<uint32_t *>(self->mInputFrameBuffer.get() + kFrameHeaderBytes));
+  uint32_t newPriorityDependency = NetworkEndian::readUint32(
+      self->mInputFrameBuffer.get() + kFrameHeaderBytes);
   bool exclusive = !!(newPriorityDependency & 0x80000000);
   newPriorityDependency &= 0x7fffffff;
   uint8_t newPriorityWeight = *(self->mInputFrameBuffer.get() + kFrameHeaderBytes + 4);
@@ -1416,8 +1399,8 @@ Http2Session::RecvRstStream(Http2Session *self)
     RETURN_SESSION_ERROR(self, PROTOCOL_ERROR);
   }
 
-  self->mDownstreamRstReason =
-    PR_ntohl(*reinterpret_cast<uint32_t *>(self->mInputFrameBuffer.get() + kFrameHeaderBytes));
+  self->mDownstreamRstReason = NetworkEndian::readUint32(
+      self->mInputFrameBuffer.get() + kFrameHeaderBytes);
 
   LOG3(("Http2Session::RecvRstStream %p RST_STREAM Reason Code %u ID %x\n",
         self, self->mDownstreamRstReason, self->mInputFrameID));
@@ -1478,8 +1461,8 @@ Http2Session::RecvSettings(Http2Session *self)
     uint8_t *setting = reinterpret_cast<uint8_t *>
       (self->mInputFrameBuffer.get()) + kFrameHeaderBytes + index * 6;
 
-    uint16_t id = PR_ntohs(*reinterpret_cast<uint16_t *>(setting));
-    uint32_t value = PR_ntohl(*reinterpret_cast<uint32_t *>(setting + 2));
+    uint16_t id = NetworkEndian::readUint16(setting);
+    uint32_t value = NetworkEndian::readUint32(setting + 2);
     LOG3(("Settings ID %u, Value %u", id, value));
 
     switch (id)
@@ -1563,8 +1546,8 @@ Http2Session::RecvPushPromise(Http2Session *self)
       return rv;
     }
     promiseLen = 4;
-    promisedID =
-      PR_ntohl(*reinterpret_cast<uint32_t *>(self->mInputFrameBuffer.get() + kFrameHeaderBytes + paddingControlBytes));
+    promisedID = NetworkEndian::readUint32(
+        self->mInputFrameBuffer.get() + kFrameHeaderBytes + paddingControlBytes);
     promisedID &= 0x7fffffff;
   }
 
@@ -1578,11 +1561,11 @@ Http2Session::RecvPushPromise(Http2Session *self)
     self->mContinuedPromiseStream = promisedID;
   }
 
-  if (paddingLength > self->mInputFrameDataSize) {
+  if ((paddingControlBytes + promiseLen + paddingLength) > self->mInputFrameDataSize) {
     // This is fatal to the session
     LOG3(("Http2Session::RecvPushPromise %p ID 0x%X assoc ID 0x%X "
-          "PROTOCOL_ERROR paddingLength %d > frame size %d\n",
-          self, promisedID, associatedID, paddingLength,
+          "PROTOCOL_ERROR extra %d > frame size %d\n",
+          self, promisedID, associatedID, (paddingControlBytes + promiseLen + paddingLength),
           self->mInputFrameDataSize));
     RETURN_SESSION_ERROR(self, PROTOCOL_ERROR);
   }
@@ -1834,12 +1817,12 @@ Http2Session::RecvGoAway(Http2Session *self)
   }
 
   self->mShouldGoAway = true;
-  self->mGoAwayID =
-    PR_ntohl(*reinterpret_cast<uint32_t *>(self->mInputFrameBuffer.get() + kFrameHeaderBytes));
+  self->mGoAwayID = NetworkEndian::readUint32(
+      self->mInputFrameBuffer.get() + kFrameHeaderBytes);
   self->mGoAwayID &= 0x7fffffff;
   self->mCleanShutdown = true;
-  uint32_t statusCode =
-    PR_ntohl(*reinterpret_cast<uint32_t *>(self->mInputFrameBuffer.get() + kFrameHeaderBytes + 4));
+  self->mPeerGoAwayReason = NetworkEndian::readUint32(
+      self->mInputFrameBuffer.get() + kFrameHeaderBytes + 4);
 
   // Find streams greater than the last-good ID and mark them for deletion
   // in the mGoAwayStreamsToRestart queue with the GoAwayEnumerator. The
@@ -1852,7 +1835,7 @@ Http2Session::RecvGoAway(Http2Session *self)
     Http2Stream *stream =
       static_cast<Http2Stream *>(self->mGoAwayStreamsToRestart.PopFront());
 
-    if (statusCode == HTTP_1_1_REQUIRED) {
+    if (self->mPeerGoAwayReason == HTTP_1_1_REQUIRED) {
       stream->Transaction()->DisableSpdy();
     }
     self->CloseStream(stream, NS_ERROR_NET_RESET);
@@ -1870,7 +1853,7 @@ Http2Session::RecvGoAway(Http2Session *self)
       static_cast<Http2Stream *>(self->mQueuedStreams.PopFront());
     MOZ_ASSERT(stream->Queued());
     stream->SetQueued(false);
-    if (statusCode == HTTP_1_1_REQUIRED) {
+    if (self->mPeerGoAwayReason == HTTP_1_1_REQUIRED) {
       stream->Transaction()->DisableSpdy();
     }
     self->CloseStream(stream, NS_ERROR_NET_RESET);
@@ -1878,7 +1861,7 @@ Http2Session::RecvGoAway(Http2Session *self)
   }
 
   LOG3(("Http2Session::RecvGoAway %p GOAWAY Last-Good-ID 0x%X status 0x%X "
-        "live streams=%d\n", self, self->mGoAwayID, statusCode,
+        "live streams=%d\n", self, self->mGoAwayID, self->mPeerGoAwayReason,
         self->mStreamTransactionHash.Count()));
 
   self->ResetDownstreamState();
@@ -1912,8 +1895,8 @@ Http2Session::RecvWindowUpdate(Http2Session *self)
     RETURN_SESSION_ERROR(self, PROTOCOL_ERROR);
   }
 
-  uint32_t delta =
-    PR_ntohl(*reinterpret_cast<uint32_t *>(self->mInputFrameBuffer.get() + kFrameHeaderBytes));
+  uint32_t delta = NetworkEndian::readUint32(
+      self->mInputFrameBuffer.get() + kFrameHeaderBytes);
   delta &= 0x7fffffff;
 
   LOG3(("Http2Session::RecvWindowUpdate %p len=%d Stream 0x%X.\n",
@@ -2088,8 +2071,8 @@ Http2Session::RecvAltSvc(Http2Session *self)
     return NS_OK;
   }
 
-  uint16_t originLen =
-    PR_ntohs(*reinterpret_cast<uint16_t *>(self->mInputFrameBuffer.get() + kFrameHeaderBytes));
+  uint16_t originLen = NetworkEndian::readUint16(
+      self->mInputFrameBuffer.get() + kFrameHeaderBytes);
   if (originLen + 2U > self->mInputFrameDataSize) {
     LOG3(("Http2Session::RecvAltSvc %p origin len too big for frame", self));
     self->ResetDownstreamState();
@@ -2541,15 +2524,16 @@ Http2Session::WriteSegments(nsAHttpSegmentWriter *writer,
 
     // 3 bytes of length, 1 type byte, 1 flag byte, 1 unused bit, 31 bits of ID
     uint8_t totallyWastedByte = mInputFrameBuffer.get()[0];
-    mInputFrameDataSize = PR_ntohs(*reinterpret_cast<uint16_t *>(mInputFrameBuffer.get() + 1));
+    mInputFrameDataSize = NetworkEndian::readUint16(
+        mInputFrameBuffer.get() + 1);
     if (totallyWastedByte || (mInputFrameDataSize > kMaxFrameData)) {
       LOG3(("Got frame too large 0x%02X%04X", totallyWastedByte, mInputFrameDataSize));
       RETURN_SESSION_ERROR(this, PROTOCOL_ERROR);
     }
     mInputFrameType = *reinterpret_cast<uint8_t *>(mInputFrameBuffer.get() + kFrameLengthBytes);
     mInputFrameFlags = *reinterpret_cast<uint8_t *>(mInputFrameBuffer.get() + kFrameLengthBytes + kFrameTypeBytes);
-    mInputFrameID =
-      PR_ntohl(*reinterpret_cast<uint32_t *>(mInputFrameBuffer.get() + kFrameLengthBytes + kFrameTypeBytes + kFrameFlagBytes));
+    mInputFrameID = NetworkEndian::readUint32(
+        mInputFrameBuffer.get() + kFrameLengthBytes + kFrameTypeBytes + kFrameFlagBytes);
     mInputFrameID &= 0x7fffffff;
     mInputFrameDataRead = 0;
 
@@ -2969,7 +2953,7 @@ Http2Session::UpdateLocalStreamWindow(Http2Stream *stream, uint32_t bytes)
   MOZ_ASSERT(mOutputQueueUsed <= mOutputQueueSize);
 
   CreateFrameHeader(packet, 4, FRAME_TYPE_WINDOW_UPDATE, 0, stream->StreamID());
-  CopyAsNetwork32(packet + kFrameHeaderBytes, toack);
+  NetworkEndian::writeUint32(packet + kFrameHeaderBytes, toack);
 
   LogIO(this, stream, "Stream Window Update", packet, kFrameHeaderBytes + 4);
   // dont flush here, this write can commonly be coalesced with a
@@ -3012,7 +2996,7 @@ Http2Session::UpdateLocalSessionWindow(uint32_t bytes)
   MOZ_ASSERT(mOutputQueueUsed <= mOutputQueueSize);
 
   CreateFrameHeader(packet, 4, FRAME_TYPE_WINDOW_UPDATE, 0, 0);
-  CopyAsNetwork32(packet + kFrameHeaderBytes, toack);
+  NetworkEndian::writeUint32(packet + kFrameHeaderBytes, toack);
 
   LogIO(this, nullptr, "Session Window Update", packet, kFrameHeaderBytes + 4);
   // dont flush here, this write can commonly be coalesced with others
@@ -3205,7 +3189,9 @@ Http2Session::OnWriteSegment(char *buf,
     return NS_ERROR_FAILURE;
   }
 
-  if (mDownstreamState == NOT_USING_NETWORK) {
+  if (mDownstreamState == NOT_USING_NETWORK ||
+      mDownstreamState == BUFFERING_FRAME_HEADER ||
+      mDownstreamState == DISCARDING_DATA_FRAME_PADDING) {
     return NS_BASE_STREAM_WOULD_BLOCK;
   }
 
@@ -3287,6 +3273,7 @@ Http2Session::OnWriteSegment(char *buf,
     return NS_OK;
   }
 
+  MOZ_ASSERT(false);
   return NS_ERROR_UNEXPECTED;
 }
 
diff --git a/netwerk/protocol/http/Http2Session.h b/netwerk/protocol/http/Http2Session.h
index 6d8b4f044f..8f61691346 100644
--- a/netwerk/protocol/http/Http2Session.h
+++ b/netwerk/protocol/http/Http2Session.h
@@ -106,7 +106,8 @@ public:
     CONNECT_ERROR = 10,
     ENHANCE_YOUR_CALM = 11,
     INADEQUATE_SECURITY = 12,
-    HTTP_1_1_REQUIRED = 13
+    HTTP_1_1_REQUIRED = 13,
+    UNASSIGNED = 31
   };
 
   // These are frame flags. If they, or other undefined flags, are
@@ -423,6 +424,11 @@ private:
   // only NO_HTTP_ERROR, PROTOCOL_ERROR, or INTERNAL_ERROR will be sent.
   errorType            mGoAwayReason;
 
+  // The error code sent/received on the session goaway frame. UNASSIGNED/31
+  // if not transmitted.
+  int32_t             mClientGoAwayReason;
+  int32_t             mPeerGoAwayReason;
+
   // If a GoAway message was received this is the ID of the last valid
   // stream. 0 otherwise. (0 is never a valid stream id.)
   uint32_t             mGoAwayID;
diff --git a/netwerk/protocol/http/Http2Stream.cpp b/netwerk/protocol/http/Http2Stream.cpp
index 9ce9e4b8da..f135174ca8 100644
--- a/netwerk/protocol/http/Http2Stream.cpp
+++ b/netwerk/protocol/http/Http2Stream.cpp
@@ -31,11 +31,6 @@
 #include "nsStandardURL.h"
 #include "prnetdb.h"
 
-#ifdef DEBUG
-// defined by the socket transport service while active
-extern PRThread *gSocketThread;
-#endif
-
 namespace mozilla {
 namespace net {
 
@@ -333,8 +328,20 @@ Http2Stream::WriteSegments(nsAHttpSegmentWriter *writer,
     // won't block other streams. but we should not advance the flow control window
     // so that we'll eventually push back on the sender.
 
+    // with tunnels you need to make sure that this is an underlying connction established
+    // that can be meaningfully giving this signal
+    bool doBuffer = true;
+    if (mIsTunnel) {
+      RefPtr<SpdyConnectTransaction> qiTrans(mTransaction->QuerySpdyConnectTransaction());
+      if (qiTrans) {
+        doBuffer = qiTrans->ConnectedReadyForInput();
+      }
+    }
     // stash this data
-    rv = BufferInput(count, countWritten);
+    if (doBuffer) {
+      rv = BufferInput(count, countWritten);
+      LOG3(("Http2Stream::WriteSegments %p Buffered %X %d\n", this, rv, *countWritten));
+    }
   }
   mSegmentWriter = nullptr;
   return rv;
diff --git a/netwerk/protocol/http/HttpBaseChannel.cpp b/netwerk/protocol/http/HttpBaseChannel.cpp
index 4a17bbd484..f2baa831bd 100644
--- a/netwerk/protocol/http/HttpBaseChannel.cpp
+++ b/netwerk/protocol/http/HttpBaseChannel.cpp
@@ -42,8 +42,10 @@
 #include "mozIThirdPartyUtil.h"
 #include "nsStreamUtils.h"
 #include "nsContentSecurityManager.h"
+#include "nsIChannelEventSink.h"
 #include "nsILoadGroupChild.h"
 #include "mozilla/ConsoleReportCollector.h"
+#include "LoadInfo.h"
 
 #include <algorithm>
 
@@ -2355,6 +2357,12 @@ HttpBaseChannel::FlushConsoleReports(nsIDocument* aDocument)
   mReportCollector->FlushConsoleReports(aDocument);
 }
 
+void
+HttpBaseChannel::FlushConsoleReports(nsIConsoleReportCollector* aCollector)
+{
+  mReportCollector->FlushConsoleReports(aCollector);
+}
+
 nsIPrincipal *
 HttpBaseChannel::GetURIPrincipal()
 {
@@ -2550,11 +2558,13 @@ HttpBaseChannel::ShouldRewriteRedirectToGET(uint32_t httpStatus,
 nsresult
 HttpBaseChannel::SetupReplacementChannel(nsIURI       *newURI,
                                          nsIChannel   *newChannel,
-                                         bool          preserveMethod)
+                                         bool          preserveMethod,
+                                         uint32_t      redirectFlags)
 {
   LOG(("HttpBaseChannel::SetupReplacementChannel "
      "[this=%p newChannel=%p preserveMethod=%d]",
      this, newChannel, preserveMethod));
+
   uint32_t newLoadFlags = mLoadFlags | LOAD_REPLACE;
   // if the original channel was using SSL and this channel is not using
   // SSL, then no need to inhibit persistent caching.  however, if the
@@ -2583,8 +2593,22 @@ HttpBaseChannel::SetupReplacementChannel(nsIURI       *newURI,
     }
   }
 
-  // Propagate our loadinfo if needed.
-  newChannel->SetLoadInfo(mLoadInfo);
+  // make a copy of the loadinfo, append to the redirectchain
+  // and set it on the new channel
+  if (mLoadInfo) {
+    nsCOMPtr<nsILoadInfo> newLoadInfo =
+      static_cast<mozilla::LoadInfo*>(mLoadInfo.get())->Clone();
+    bool isInternalRedirect =
+      (redirectFlags & (nsIChannelEventSink::REDIRECT_INTERNAL |
+                        nsIChannelEventSink::REDIRECT_STS_UPGRADE));
+    newLoadInfo->AppendRedirectedPrincipal(GetURIPrincipal(), isInternalRedirect);
+    newChannel->SetLoadInfo(newLoadInfo);
+  }
+  else {
+    // the newChannel was created with a dummy loadInfo, we should clear
+    // it in case the original channel does not have a loadInfo
+    newChannel->SetLoadInfo(nullptr);
+  }
 
   nsCOMPtr<nsIHttpChannel> httpChannel = do_QueryInterface(newChannel);
   if (!httpChannel)
diff --git a/netwerk/protocol/http/HttpBaseChannel.h b/netwerk/protocol/http/HttpBaseChannel.h
index 4c8d98e651..77ae968860 100644
--- a/netwerk/protocol/http/HttpBaseChannel.h
+++ b/netwerk/protocol/http/HttpBaseChannel.h
@@ -247,6 +247,9 @@ public:
   void
   FlushConsoleReports(nsIDocument* aDocument) override;
 
+  void
+  FlushConsoleReports(nsIConsoleReportCollector* aCollector) override;
+
   class nsContentEncodings : public nsIUTF8StringEnumerator
     {
     public:
@@ -312,7 +315,8 @@ protected:
   void AddCookiesToRequest();
   virtual nsresult SetupReplacementChannel(nsIURI *,
                                            nsIChannel *,
-                                           bool preserveMethod);
+                                           bool preserveMethod,
+                                           uint32_t redirectFlags);
 
   // bundle calling OMR observers and marking flag into one function
   inline void CallOnModifyRequestObservers() {
diff --git a/netwerk/protocol/http/HttpChannelChild.cpp b/netwerk/protocol/http/HttpChannelChild.cpp
index fa2a5fdcf3..9b72b7d369 100644
--- a/netwerk/protocol/http/HttpChannelChild.cpp
+++ b/netwerk/protocol/http/HttpChannelChild.cpp
@@ -1172,6 +1172,7 @@ HttpChannelChild::RecvRedirect1Begin(const uint32_t& newChannelId,
 nsresult
 HttpChannelChild::SetupRedirect(nsIURI* uri,
                                 const nsHttpResponseHead* responseHead,
+                                const uint32_t& redirectFlags,
                                 nsIChannel** outChannel)
 {
   LOG(("HttpChannelChild::SetupRedirect [this=%p]\n", this));
@@ -1197,7 +1198,7 @@ HttpChannelChild::SetupRedirect(nsIURI* uri,
   bool rewriteToGET = HttpBaseChannel::ShouldRewriteRedirectToGET(mResponseHead->Status(),
                                                                   mRequestHead.ParsedMethod());
 
-  rv = SetupReplacementChannel(uri, newChannel, !rewriteToGET);
+  rv = SetupReplacementChannel(uri, newChannel, !rewriteToGET, redirectFlags);
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsIHttpChannelChild> httpChannelChild = do_QueryInterface(newChannel);
@@ -1233,6 +1234,7 @@ HttpChannelChild::Redirect1Begin(const uint32_t& newChannelId,
   nsCOMPtr<nsIChannel> newChannel;
   nsresult rv = SetupRedirect(uri,
                               &responseHead,
+                              redirectFlags,
                               getter_AddRefs(newChannel));
 
   if (NS_SUCCEEDED(rv)) {
@@ -1261,6 +1263,7 @@ HttpChannelChild::BeginNonIPCRedirect(nsIURI* responseURI,
   nsCOMPtr<nsIChannel> newChannel;
   nsresult rv = SetupRedirect(responseURI,
                               responseHead,
+                              nsIChannelEventSink::REDIRECT_INTERNAL,
                               getter_AddRefs(newChannel));
 
   if (NS_SUCCEEDED(rv)) {
diff --git a/netwerk/protocol/http/HttpChannelChild.h b/netwerk/protocol/http/HttpChannelChild.h
index 21809e1862..b3f64cd5e5 100644
--- a/netwerk/protocol/http/HttpChannelChild.h
+++ b/netwerk/protocol/http/HttpChannelChild.h
@@ -276,6 +276,7 @@ private:
   // response headers.
   nsresult SetupRedirect(nsIURI* uri,
                          const nsHttpResponseHead* responseHead,
+                         const uint32_t& redirectFlags,
                          nsIChannel** outChannel);
 
   // Perform a redirection without communicating with the parent process at all.
diff --git a/netwerk/protocol/http/InterceptedChannel.cpp b/netwerk/protocol/http/InterceptedChannel.cpp
index 39be9bdcd5..3e0900eba4 100644
--- a/netwerk/protocol/http/InterceptedChannel.cpp
+++ b/netwerk/protocol/http/InterceptedChannel.cpp
@@ -13,6 +13,7 @@
 #include "nsHttpChannel.h"
 #include "HttpChannelChild.h"
 #include "nsHttpResponseHead.h"
+#include "mozilla/ConsoleReportCollector.h"
 #include "mozilla/dom/ChannelInfo.h"
 
 namespace mozilla {
@@ -37,6 +38,7 @@ NS_IMPL_ISUPPORTS(InterceptedChannelBase, nsIInterceptedChannel)
 
 InterceptedChannelBase::InterceptedChannelBase(nsINetworkInterceptController* aController)
 : mController(aController)
+, mReportCollector(new ConsoleReportCollector())
 {
 }
 
@@ -105,6 +107,15 @@ InterceptedChannelBase::DoSynthesizeHeader(const nsACString& aName, const nsACSt
     return NS_OK;
 }
 
+NS_IMETHODIMP
+InterceptedChannelBase::GetConsoleReportCollector(nsIConsoleReportCollector** aCollectorOut)
+{
+  MOZ_ASSERT(aCollectorOut);
+  nsCOMPtr<nsIConsoleReportCollector> ref = mReportCollector;
+  ref.forget(aCollectorOut);
+  return NS_OK;
+}
+
 InterceptedChannelChrome::InterceptedChannelChrome(nsHttpChannel* aChannel,
                                                    nsINetworkInterceptController* aController,
                                                    nsICacheEntry* aEntry)
@@ -132,16 +143,6 @@ InterceptedChannelChrome::NotifyController()
   DoNotifyController();
 }
 
-nsIConsoleReportCollector*
-InterceptedChannelChrome::GetConsoleReportCollector() const
-{
-  // The ConsoleReportCollector should only be used when the inner channel is
-  // stable.  Nothing should try to use it once we return to the main thread
-  // and clear the inner channel.
-  MOZ_ASSERT(mChannel);
-  return mChannel;
-}
-
 NS_IMETHODIMP
 InterceptedChannelChrome::GetChannel(nsIChannel** aChannel)
 {
@@ -156,6 +157,8 @@ InterceptedChannelChrome::ResetInterception()
     return NS_ERROR_NOT_AVAILABLE;
   }
 
+  mReportCollector->FlushConsoleReports(mChannel);
+
   mSynthesizedCacheEntry->AsyncDoom(nullptr);
   mSynthesizedCacheEntry = nullptr;
 
@@ -198,6 +201,8 @@ InterceptedChannelChrome::FinishSynthesizedResponse(const nsACString& aFinalURLS
     return NS_ERROR_NOT_AVAILABLE;
   }
 
+  mReportCollector->FlushConsoleReports(mChannel);
+
   EnsureSynthesizedResponse();
 
   // If the synthesized response is a redirect, then we want to respect
@@ -271,6 +276,8 @@ InterceptedChannelChrome::Cancel(nsresult aStatus)
     return NS_ERROR_FAILURE;
   }
 
+  mReportCollector->FlushConsoleReports(mChannel);
+
   // we need to use AsyncAbort instead of Cancel since there's no active pump
   // to cancel which will provide OnStart/OnStopRequest to the channel.
   nsresult rv = mChannel->AsyncAbort(aStatus);
@@ -320,16 +327,6 @@ InterceptedChannelContent::NotifyController()
   DoNotifyController();
 }
 
-nsIConsoleReportCollector*
-InterceptedChannelContent::GetConsoleReportCollector() const
-{
-  // The ConsoleReportCollector should only be used when the inner channel is
-  // stable.  Nothing should try to use it once we return to the main thread
-  // and clear the inner channel.
-  MOZ_ASSERT(mChannel);
-  return mChannel;
-}
-
 NS_IMETHODIMP
 InterceptedChannelContent::GetChannel(nsIChannel** aChannel)
 {
@@ -344,6 +341,8 @@ InterceptedChannelContent::ResetInterception()
     return NS_ERROR_NOT_AVAILABLE;
   }
 
+  mReportCollector->FlushConsoleReports(mChannel);
+
   mResponseBody = nullptr;
   mSynthesizedInput = nullptr;
 
@@ -379,6 +378,8 @@ InterceptedChannelContent::FinishSynthesizedResponse(const nsACString& aFinalURL
     return NS_ERROR_NOT_AVAILABLE;
   }
 
+  mReportCollector->FlushConsoleReports(mChannel);
+
   EnsureSynthesizedResponse();
 
   nsCOMPtr<nsIURI> originalURI;
@@ -418,6 +419,8 @@ InterceptedChannelContent::Cancel(nsresult aStatus)
     return NS_ERROR_FAILURE;
   }
 
+  mReportCollector->FlushConsoleReports(mChannel);
+
   // we need to use AsyncAbort instead of Cancel since there's no active pump
   // to cancel which will provide OnStart/OnStopRequest to the channel.
   nsresult rv = mChannel->AsyncAbort(aStatus);
diff --git a/netwerk/protocol/http/InterceptedChannel.h b/netwerk/protocol/http/InterceptedChannel.h
index 229d567057..f12b2e99d6 100644
--- a/netwerk/protocol/http/InterceptedChannel.h
+++ b/netwerk/protocol/http/InterceptedChannel.h
@@ -36,6 +36,8 @@ protected:
   // Response head for use when synthesizing
   Maybe<nsAutoPtr<nsHttpResponseHead>> mSynthesizedResponseHead;
 
+  nsCOMPtr<nsIConsoleReportCollector> mReportCollector;
+
   void EnsureSynthesizedResponse();
   void DoNotifyController();
   nsresult DoSynthesizeStatus(uint16_t aStatus, const nsACString& aReason);
@@ -52,6 +54,7 @@ public:
   NS_DECL_ISUPPORTS
 
   NS_IMETHOD GetResponseBody(nsIOutputStream** aOutput) override;
+  NS_IMETHOD GetConsoleReportCollector(nsIConsoleReportCollector** aCollectorOut) override;
 };
 
 class InterceptedChannelChrome : public InterceptedChannelBase
@@ -82,9 +85,6 @@ public:
   NS_IMETHOD GetInternalContentPolicyType(nsContentPolicyType *aInternalContentPolicyType) override;
 
   virtual void NotifyController() override;
-
-  virtual nsIConsoleReportCollector*
-  GetConsoleReportCollector() const override;
 };
 
 class InterceptedChannelContent : public InterceptedChannelBase
@@ -113,9 +113,6 @@ public:
   NS_IMETHOD GetInternalContentPolicyType(nsContentPolicyType *aInternalContentPolicyType) override;
 
   virtual void NotifyController() override;
-
-  virtual nsIConsoleReportCollector*
-  GetConsoleReportCollector() const override;
 };
 
 } // namespace net
diff --git a/netwerk/protocol/http/SpdySession31.cpp b/netwerk/protocol/http/SpdySession31.cpp
index 766f863e69..eb1685897a 100644
--- a/netwerk/protocol/http/SpdySession31.cpp
+++ b/netwerk/protocol/http/SpdySession31.cpp
@@ -14,25 +14,21 @@
 #define LOG_ENABLED() LOG5_ENABLED()
 
 #include "mozilla/Preferences.h"
+#include "mozilla/Snprintf.h"
 #include "nsHttp.h"
 #include "nsHttpHandler.h"
 #include "nsHttpConnection.h"
 #include "nsISchedulingContext.h"
 #include "nsISupportsPriority.h"
-#include "prprf.h"
 #include "prnetdb.h"
 #include "SpdyPush31.h"
 #include "SpdySession31.h"
 #include "SpdyStream31.h"
 #include "SpdyZlibReporter.h"
+#include "nsSocketTransportService2.h"
 
 #include <algorithm>
 
-#ifdef DEBUG
-// defined by the socket transport service while active
-extern PRThread *gSocketThread;
-#endif
-
 namespace mozilla {
 namespace net {
 
@@ -171,11 +167,10 @@ SpdySession31::LogIO(SpdySession31 *self, SpdyStream31 *stream, const char *labe
         LOG5(("%s", linebuf));
       }
       line = linebuf;
-      PR_snprintf(line, 128, "%08X: ", index);
+      snprintf(line, 128, "%08X: ", index);
       line += 10;
     }
-    PR_snprintf(line, 128 - (line - linebuf), "%02X ",
-                ((unsigned char *)data)[index]);
+    snprintf(line, 128 - (line - linebuf), "%02X ", ((unsigned char *)data)[index]);
     line += 3;
   }
   if (index) {
diff --git a/netwerk/protocol/http/SpdyStream31.cpp b/netwerk/protocol/http/SpdyStream31.cpp
index afaf0a5bdd..07075fcd9f 100644
--- a/netwerk/protocol/http/SpdyStream31.cpp
+++ b/netwerk/protocol/http/SpdyStream31.cpp
@@ -27,11 +27,6 @@
 
 #include <algorithm>
 
-#ifdef DEBUG
-// defined by the socket transport service while active
-extern PRThread *gSocketThread;
-#endif
-
 namespace mozilla {
 namespace net {
 
diff --git a/netwerk/protocol/http/TunnelUtils.cpp b/netwerk/protocol/http/TunnelUtils.cpp
index b8cd6dd79b..37d9d30e02 100644
--- a/netwerk/protocol/http/TunnelUtils.cpp
+++ b/netwerk/protocol/http/TunnelUtils.cpp
@@ -24,11 +24,6 @@
 #include "nsServiceManagerUtils.h"
 #include "nsComponentManagerUtils.h"
 
-#ifdef DEBUG
-// defined by the socket transport service while active
-extern PRThread *gSocketThread;
-#endif
-
 namespace mozilla {
 namespace net {
 
@@ -1269,6 +1264,12 @@ SpdyConnectTransaction::WriteSegments(nsAHttpSegmentWriter *writer,
   return rv;
 }
 
+bool
+SpdyConnectTransaction::ConnectedReadyForInput()
+{
+  return mTunneledConn && mTunnelStreamIn->mCallback;
+}
+
 nsHttpRequestHead *
 SpdyConnectTransaction::RequestHead()
 {
diff --git a/netwerk/protocol/http/TunnelUtils.h b/netwerk/protocol/http/TunnelUtils.h
index dd7b9f95d4..3c59aed44d 100644
--- a/netwerk/protocol/http/TunnelUtils.h
+++ b/netwerk/protocol/http/TunnelUtils.h
@@ -201,6 +201,10 @@ public:
   nsHttpRequestHead *RequestHead() override final;
   void Close(nsresult reason) override final;
 
+  // ConnectedReadyForInput() tests whether the spdy connect transaction is attached to
+  // an nsHttpConnection that can properly deal with flow control, etc..
+  bool ConnectedReadyForInput();
+
 private:
   friend class InputStreamShim;
   friend class OutputStreamShim;
diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp
index 2087acd282..fc213b7c03 100644
--- a/netwerk/protocol/http/nsHttpChannel.cpp
+++ b/netwerk/protocol/http/nsHttpChannel.cpp
@@ -185,11 +185,6 @@ AutoRedirectVetoNotifier::ReportRedirectResult(bool succeeded)
     if (!mChannel)
         return;
 
-    // Append the initial uri of the channel to the redirectChain
-    if (succeeded && mChannel->mLoadInfo) {
-        mChannel->mLoadInfo->AppendRedirectedPrincipal(mChannel->GetURIPrincipal(), false);
-    }
-
     mChannel->mRedirectChannel = nullptr;
 
     nsCOMPtr<nsIRedirectResultListener> vetoHook;
@@ -239,6 +234,7 @@ nsHttpChannel::nsHttpChannel()
     , mConcurentCacheAccess(0)
     , mIsPartialRequest(0)
     , mHasAutoRedirectVetoNotifier(0)
+    , mPinCacheContent(0)
     , mIsPackagedAppResource(0)
     , mIsCorsPreflightDone(0)
     , mPushedStream(nullptr)
@@ -2059,7 +2055,7 @@ nsHttpChannel::StartRedirectChannelToURI(nsIURI *upgradedURI, uint32_t flags)
                                ioService);
     NS_ENSURE_SUCCESS(rv, rv);
 
-    rv = SetupReplacementChannel(upgradedURI, newChannel, true);
+    rv = SetupReplacementChannel(upgradedURI, newChannel, true, flags);
     NS_ENSURE_SUCCESS(rv, rv);
 
     // Inform consumers about this fake redirect
@@ -2181,13 +2177,14 @@ nsHttpChannel::AsyncDoReplaceWithProxy(nsIProxyInfo* pi)
     if (NS_FAILED(rv))
         return rv;
 
-    rv = SetupReplacementChannel(mURI, newChannel, true);
+    uint32_t flags = nsIChannelEventSink::REDIRECT_INTERNAL;
+
+    rv = SetupReplacementChannel(mURI, newChannel, true, flags);
     if (NS_FAILED(rv))
         return rv;
 
     // Inform consumers about this fake redirect
     mRedirectChannel = newChannel;
-    uint32_t flags = nsIChannelEventSink::REDIRECT_INTERNAL;
 
     PushRedirectAsyncFunc(&nsHttpChannel::ContinueDoReplaceWithProxy);
     rv = gHttpHandler->AsyncOnChannelRedirect(this, newChannel, flags);
@@ -2832,7 +2829,8 @@ nsHttpChannel::ProcessFallback(bool *waitingForRedirectCallback)
                                    getter_AddRefs(newChannel));
     NS_ENSURE_SUCCESS(rv, rv);
 
-    rv = SetupReplacementChannel(mURI, newChannel, true);
+    uint32_t redirectFlags = nsIChannelEventSink::REDIRECT_INTERNAL;
+    rv = SetupReplacementChannel(mURI, newChannel, true, redirectFlags);
     NS_ENSURE_SUCCESS(rv, rv);
 
     // Make sure the new channel loads from the fallback key.
@@ -2849,7 +2847,6 @@ nsHttpChannel::ProcessFallback(bool *waitingForRedirectCallback)
 
     // Inform consumers about this fake redirect
     mRedirectChannel = newChannel;
-    uint32_t redirectFlags = nsIChannelEventSink::REDIRECT_INTERNAL;
 
     PushRedirectAsyncFunc(&nsHttpChannel::ContinueProcessFallback);
     rv = gHttpHandler->AsyncOnChannelRedirect(this, newChannel, redirectFlags);
@@ -3041,6 +3038,10 @@ nsHttpChannel::OpenCacheEntry(bool isHttps)
         rv = cacheStorageService->MemoryCacheStorage(info, // ? choose app cache as well...
             getter_AddRefs(cacheStorage));
     }
+    else if (mPinCacheContent) {
+        rv = cacheStorageService->PinningCacheStorage(info,
+            getter_AddRefs(cacheStorage));
+    }
     else {
         rv = cacheStorageService->DiskCacheStorage(info,
             !mPostID && (mChooseApplicationCache || (mLoadFlags & LOAD_CHECK_OFFLINE_CACHE)),
@@ -4640,13 +4641,16 @@ nsHttpChannel::ClearBogusContentEncodingIfNeeded()
 nsresult
 nsHttpChannel::SetupReplacementChannel(nsIURI       *newURI,
                                        nsIChannel   *newChannel,
-                                       bool          preserveMethod)
+                                       bool          preserveMethod,
+                                       uint32_t      redirectFlags)
 {
     LOG(("nsHttpChannel::SetupReplacementChannel "
          "[this=%p newChannel=%p preserveMethod=%d]",
          this, newChannel, preserveMethod));
 
-    nsresult rv = HttpBaseChannel::SetupReplacementChannel(newURI, newChannel, preserveMethod);
+    nsresult rv =
+      HttpBaseChannel::SetupReplacementChannel(newURI, newChannel,
+                                               preserveMethod, redirectFlags);
     if (NS_FAILED(rv))
         return rv;
 
@@ -4777,15 +4781,16 @@ nsHttpChannel::ContinueProcessRedirectionAfterFallback(nsresult rv)
                                ioService);
     NS_ENSURE_SUCCESS(rv, rv);
 
-    rv = SetupReplacementChannel(mRedirectURI, newChannel, !rewriteToGET);
-    if (NS_FAILED(rv)) return rv;
-
     uint32_t redirectFlags;
     if (nsHttp::IsPermanentRedirect(mRedirectType))
         redirectFlags = nsIChannelEventSink::REDIRECT_PERMANENT;
     else
         redirectFlags = nsIChannelEventSink::REDIRECT_TEMPORARY;
 
+    rv = SetupReplacementChannel(mRedirectURI, newChannel,
+                                 !rewriteToGET, redirectFlags);
+    if (NS_FAILED(rv)) return rv;
+
     // verify that this is a legal redirect
     mRedirectChannel = newChannel;
 
@@ -6538,6 +6543,26 @@ nsHttpChannel::SetCacheOnlyMetadata(bool aOnlyMetadata)
     return NS_OK;
 }
 
+NS_IMETHODIMP
+nsHttpChannel::GetPin(bool *aPin)
+{
+    NS_ENSURE_ARG(aPin);
+    *aPin = mPinCacheContent;
+    return NS_OK;
+}
+
+NS_IMETHODIMP
+nsHttpChannel::SetPin(bool aPin)
+{
+    LOG(("nsHttpChannel::SetPin [this=%p pin=%d]\n",
+        this, aPin));
+
+    ENSURE_CALLED_BEFORE_CONNECT();
+
+    mPinCacheContent = aPin;
+    return NS_OK;
+}
+
 //-----------------------------------------------------------------------------
 // nsHttpChannel::nsIResumableChannel
 //-----------------------------------------------------------------------------
diff --git a/netwerk/protocol/http/nsHttpChannel.h b/netwerk/protocol/http/nsHttpChannel.h
index cb6ed76277..e42db216fd 100644
--- a/netwerk/protocol/http/nsHttpChannel.h
+++ b/netwerk/protocol/http/nsHttpChannel.h
@@ -297,7 +297,9 @@ private:
     void     HandleAsyncFallback();
     nsresult ContinueHandleAsyncFallback(nsresult);
     nsresult PromptTempRedirect();
-    virtual  nsresult SetupReplacementChannel(nsIURI *, nsIChannel *, bool preserveMethod) override;
+    virtual  nsresult SetupReplacementChannel(nsIURI *, nsIChannel *,
+                                              bool preserveMethod,
+                                              uint32_t redirectFlags) override;
 
     // proxy specific methods
     nsresult ProxyFailover();
@@ -500,6 +502,9 @@ private:
     uint32_t                          mIsPartialRequest : 1;
     // true iff there is AutoRedirectVetoNotifier on the stack
     uint32_t                          mHasAutoRedirectVetoNotifier : 1;
+    // consumers set this to true to use cache pinning, this has effect
+    // only when the channel is in an app context (load context has an appid)
+    uint32_t                          mPinCacheContent : 1;
     // Whether fetching the content is meant to be handled by the
     // packaged app service, which behaves like a caching layer.
     // Upon successfully fetching the package, the resource will be placed in
diff --git a/netwerk/protocol/http/nsHttpConnection.cpp b/netwerk/protocol/http/nsHttpConnection.cpp
index fdf818db6d..48b9d50448 100644
--- a/netwerk/protocol/http/nsHttpConnection.cpp
+++ b/netwerk/protocol/http/nsHttpConnection.cpp
@@ -32,11 +32,6 @@
 #include "sslt.h"
 #include "TunnelUtils.h"
 
-#ifdef DEBUG
-// defined by the socket transport service while active
-extern PRThread *gSocketThread;
-#endif
-
 namespace mozilla {
 namespace net {
 
diff --git a/netwerk/protocol/http/nsHttpConnectionMgr.cpp b/netwerk/protocol/http/nsHttpConnectionMgr.cpp
index dffda0cb8b..e9d0b825ea 100644
--- a/netwerk/protocol/http/nsHttpConnectionMgr.cpp
+++ b/netwerk/protocol/http/nsHttpConnectionMgr.cpp
@@ -34,9 +34,6 @@
 #include "mozilla/ChaosMode.h"
 #include "mozilla/unused.h"
 
-// defined by the socket transport service while active
-extern PRThread *gSocketThread;
-
 namespace mozilla {
 namespace net {
 
diff --git a/netwerk/protocol/http/nsHttpHandler.cpp b/netwerk/protocol/http/nsHttpHandler.cpp
index 161e64a1f3..cd3929456d 100644
--- a/netwerk/protocol/http/nsHttpHandler.cpp
+++ b/netwerk/protocol/http/nsHttpHandler.cpp
@@ -29,6 +29,7 @@
 #include "nsCOMPtr.h"
 #include "nsNetCID.h"
 #include "prprf.h"
+#include "mozilla/Snprintf.h"
 #include "nsAsyncRedirectVerifyHelper.h"
 #include "nsSocketTransportService2.h"
 #include "nsAlgorithm.h"
@@ -50,6 +51,7 @@
 #include "nsHttpChannelAuthProvider.h"
 #include "nsServiceManagerUtils.h"
 #include "nsComponentManagerUtils.h"
+#include "nsSocketTransportService2.h"
 
 #include "mozilla/net/NeckoChild.h"
 #include "mozilla/ipc/URIUtils.h"
@@ -71,11 +73,6 @@
 #include "mozilla/net/HttpChannelChild.h"
 
 
-#ifdef DEBUG
-// defined by the socket transport service while active
-extern PRThread *gSocketThread;
-#endif
-
 #define UA_PREF_PREFIX          "general.useragent."
 #ifdef XP_WIN
 #define UA_SPARE_PLATFORM
@@ -1727,9 +1724,9 @@ PrepareAcceptLanguages(const char *i_AcceptLanguages, nsACString &o_AcceptLangua
                     qval_str = "%s%s;q=0.%02u";
                 }
 
-                wrote = PR_snprintf(p2, available, qval_str, comma, token, u);
+                wrote = snprintf(p2, available, qval_str, comma, token, u);
             } else {
-                wrote = PR_snprintf(p2, available, "%s%s", comma, token);
+                wrote = snprintf(p2, available, "%s%s", comma, token);
             }
 
             q -= dec;
diff --git a/netwerk/protocol/http/nsHttpPipeline.cpp b/netwerk/protocol/http/nsHttpPipeline.cpp
index 5c33c2839c..b4c537221a 100644
--- a/netwerk/protocol/http/nsHttpPipeline.cpp
+++ b/netwerk/protocol/http/nsHttpPipeline.cpp
@@ -12,12 +12,11 @@
 #include "nsISocketTransport.h"
 #include "nsIPipe.h"
 #include "nsCOMPtr.h"
+#include "nsSocketTransportService2.h"
 #include <algorithm>
 
 #ifdef DEBUG
 #include "prthread.h"
-// defined by the socket transport service while active
-extern PRThread *gSocketThread;
 #endif
 
 namespace mozilla {
diff --git a/netwerk/protocol/http/nsHttpTransaction.cpp b/netwerk/protocol/http/nsHttpTransaction.cpp
index 628b6433d8..c83818b3f1 100644
--- a/netwerk/protocol/http/nsHttpTransaction.cpp
+++ b/netwerk/protocol/http/nsHttpTransaction.cpp
@@ -44,13 +44,6 @@
 
 //-----------------------------------------------------------------------------
 
-#ifdef DEBUG
-// defined by the socket transport service while active
-extern PRThread *gSocketThread;
-#endif
-
-//-----------------------------------------------------------------------------
-
 static NS_DEFINE_CID(kMultiplexInputStream, NS_MULTIPLEXINPUTSTREAM_CID);
 
 // Place a limit on how much non-compliant HTTP can be skipped while
diff --git a/netwerk/protocol/websocket/WebSocketChannel.cpp b/netwerk/protocol/websocket/WebSocketChannel.cpp
index 0b9eeefce3..7b1eb07771 100644
--- a/netwerk/protocol/websocket/WebSocketChannel.cpp
+++ b/netwerk/protocol/websocket/WebSocketChannel.cpp
@@ -54,7 +54,7 @@
 #include "nsINode.h"
 #include "mozilla/StaticMutex.h"
 #include "mozilla/TimeStamp.h"
-#include "mozilla/CheckedInt.h"
+#include "nsSocketTransportService2.h"
 
 #include "plbase64.h"
 #include "prmem.h"
@@ -70,8 +70,6 @@
 // dupe one constant we need from it
 #define CLOSE_GOING_AWAY 1001
 
-extern PRThread *gSocketThread;
-
 using namespace mozilla;
 using namespace mozilla::net;
 
@@ -1704,7 +1702,7 @@ WebSocketChannel::ProcessInput(uint8_t *buffer, uint32_t count)
                                         opcode, maskBit, mask, utf8Data);
 
         if (frame) {
-          mService->FrameReceived(mSerial, mInnerWindowID, frame);
+          mService->FrameReceived(mSerial, mInnerWindowID, frame.forget());
         }
 
         mTargetThread->Dispatch(new CallOnMessageAvailable(this, utf8Data, -1),
@@ -1763,8 +1761,7 @@ WebSocketChannel::ProcessInput(uint8_t *buffer, uint32_t count)
         if (frame) {
           // We send the frame immediately becuase we want to have it dispatched
           // before the CallOnServerClose.
-          mService->FrameReceived(mSerial, mInnerWindowID, frame);
-          frame = nullptr;
+          mService->FrameReceived(mSerial, mInnerWindowID, frame.forget());
         }
 
         if (mListenerMT) {
@@ -1803,7 +1800,7 @@ WebSocketChannel::ProcessInput(uint8_t *buffer, uint32_t count)
       }
 
       if (frame) {
-        mService->FrameReceived(mSerial, mInnerWindowID, frame);
+        mService->FrameReceived(mSerial, mInnerWindowID, frame.forget());
       }
     } else if (opcode == nsIWebSocketFrame::OPCODE_BINARY) {
       bool isDeflated = mPMCECompressor && mPMCECompressor->IsMessageDeflated();
@@ -1832,7 +1829,7 @@ WebSocketChannel::ProcessInput(uint8_t *buffer, uint32_t count)
           mService->CreateFrameIfNeeded(finBit, rsvBit1, rsvBit2, rsvBit3,
                                         opcode, maskBit, mask, binaryData);
         if (frame) {
-          mService->FrameReceived(mSerial, mInnerWindowID, frame);
+          mService->FrameReceived(mSerial, mInnerWindowID, frame.forget());
         }
 
         mTargetThread->Dispatch(
@@ -2191,7 +2188,7 @@ WebSocketChannel::PrimeNewOutgoingMessage()
                            mCurrentOut->OrigLength());
 
   if (frame) {
-    mService->FrameSent(mSerial, mInnerWindowID, frame);
+    mService->FrameSent(mSerial, mInnerWindowID, frame.forget());
   }
 
   while (payload < (mOutHeader + mHdrOutToSend)) {
@@ -3163,16 +3160,14 @@ WebSocketChannel::Notify(nsITimer *timer)
     }
 
     if (!mPingOutstanding) {
-      // Allow for the case where a PING was force-sent even though ping
-      // interval isn't enabled. Only issue a new PING if it truly is enabled.
-      if (mPingInterval || mPingForced) {
-        LOG(("nsWebSocketChannel:: Generating Ping\n"));
-        mPingOutstanding = 1;
-        mPingForced = 0;
-        GeneratePing();
-        mPingTimer->InitWithCallback(this, mPingResponseTimeout,
-                                     nsITimer::TYPE_ONE_SHOT);
-      }
+      // Ping interval must be non-null or PING was forced by OnNetworkChanged()
+      MOZ_ASSERT(mPingInterval || mPingForced);
+      LOG(("nsWebSocketChannel:: Generating Ping\n"));
+      mPingOutstanding = 1;
+      mPingForced = 0;
+      GeneratePing();
+      mPingTimer->InitWithCallback(this, mPingResponseTimeout,
+                                   nsITimer::TYPE_ONE_SHOT);
     } else {
       LOG(("nsWebSocketChannel:: Timed out Ping\n"));
       mPingTimer = nullptr;
diff --git a/netwerk/protocol/websocket/WebSocketChannel.h b/netwerk/protocol/websocket/WebSocketChannel.h
index c054b96fe9..e0df2204d9 100644
--- a/netwerk/protocol/websocket/WebSocketChannel.h
+++ b/netwerk/protocol/websocket/WebSocketChannel.h
@@ -180,7 +180,14 @@ private:
   {
     mPingOutstanding = 0;
     if (mPingTimer) {
-      mPingTimer->SetDelay(mPingInterval);
+      if (!mPingInterval) {
+        // The timer was created by forced ping and regular pinging is disabled,
+        // so cancel and null out mPingTimer.
+        mPingTimer->Cancel();
+        mPingTimer = nullptr;
+      } else {
+        mPingTimer->SetDelay(mPingInterval);
+      }
     }
   }
 
diff --git a/netwerk/protocol/websocket/WebSocketEventListenerChild.cpp b/netwerk/protocol/websocket/WebSocketEventListenerChild.cpp
index 08a57b817b..82553a49b1 100644
--- a/netwerk/protocol/websocket/WebSocketEventListenerChild.cpp
+++ b/netwerk/protocol/websocket/WebSocketEventListenerChild.cpp
@@ -82,7 +82,7 @@ WebSocketEventListenerChild::RecvFrameReceived(const uint32_t& aWebSocketSerialI
 {
   if (mService) {
     RefPtr<WebSocketFrame> frame = new WebSocketFrame(aFrameData);
-    mService->FrameReceived(aWebSocketSerialID, mInnerWindowID, frame);
+    mService->FrameReceived(aWebSocketSerialID, mInnerWindowID, frame.forget());
   }
 
   return true;
@@ -94,7 +94,7 @@ WebSocketEventListenerChild::RecvFrameSent(const uint32_t& aWebSocketSerialID,
 {
   if (mService) {
     RefPtr<WebSocketFrame> frame = new WebSocketFrame(aFrameData);
-    mService->FrameSent(aWebSocketSerialID, mInnerWindowID, frame);
+    mService->FrameSent(aWebSocketSerialID, mInnerWindowID, frame.forget());
   }
 
   return true;
diff --git a/netwerk/protocol/websocket/WebSocketEventService.cpp b/netwerk/protocol/websocket/WebSocketEventService.cpp
index 06984e75ef..30ac95b064 100644
--- a/netwerk/protocol/websocket/WebSocketEventService.cpp
+++ b/netwerk/protocol/websocket/WebSocketEventService.cpp
@@ -12,8 +12,7 @@
 #include "mozilla/StaticPtr.h"
 #include "nsISupportsPrimitives.h"
 #include "nsXULAppAPI.h"
-
-extern PRThread *gSocketThread;
+#include "nsSocketTransportService2.h"
 
 namespace mozilla {
 namespace net {
@@ -71,10 +70,10 @@ class WebSocketFrameRunnable final : public WebSocketBaseRunnable
 public:
   WebSocketFrameRunnable(uint32_t aWebSocketSerialID,
                          uint64_t aInnerWindowID,
-                         WebSocketFrame* aFrame,
+                         already_AddRefed<WebSocketFrame> aFrame,
                          bool aFrameSent)
     : WebSocketBaseRunnable(aWebSocketSerialID, aInnerWindowID)
-    , mFrame(aFrame)
+    , mFrame(Move(aFrame))
     , mFrameSent(aFrameSent)
   {}
 
@@ -316,9 +315,10 @@ WebSocketEventService::WebSocketClosed(uint32_t aWebSocketSerialID,
 void
 WebSocketEventService::FrameReceived(uint32_t aWebSocketSerialID,
                                      uint64_t aInnerWindowID,
-                                     WebSocketFrame* aFrame)
+                                     already_AddRefed<WebSocketFrame> aFrame)
 {
-  MOZ_ASSERT(aFrame);
+  RefPtr<WebSocketFrame> frame(Move(aFrame));
+  MOZ_ASSERT(frame);
 
   // Let's continue only if we have some listeners.
   if (!HasListeners()) {
@@ -327,7 +327,7 @@ WebSocketEventService::FrameReceived(uint32_t aWebSocketSerialID,
 
   RefPtr<WebSocketFrameRunnable> runnable =
     new WebSocketFrameRunnable(aWebSocketSerialID, aInnerWindowID,
-                               aFrame, false /* frameSent */);
+                               frame.forget(), false /* frameSent */);
   nsresult rv = NS_DispatchToMainThread(runnable);
   NS_WARN_IF(NS_FAILED(rv));
 }
@@ -335,9 +335,10 @@ WebSocketEventService::FrameReceived(uint32_t aWebSocketSerialID,
 void
 WebSocketEventService::FrameSent(uint32_t aWebSocketSerialID,
                                  uint64_t aInnerWindowID,
-                                 WebSocketFrame* aFrame)
+                                 already_AddRefed<WebSocketFrame> aFrame)
 {
-  MOZ_ASSERT(aFrame);
+  RefPtr<WebSocketFrame> frame(Move(aFrame));
+  MOZ_ASSERT(frame);
 
   // Let's continue only if we have some listeners.
   if (!HasListeners()) {
@@ -346,7 +347,7 @@ WebSocketEventService::FrameSent(uint32_t aWebSocketSerialID,
 
   RefPtr<WebSocketFrameRunnable> runnable =
     new WebSocketFrameRunnable(aWebSocketSerialID, aInnerWindowID,
-                               aFrame, true /* frameSent */);
+                               frame.forget(), true /* frameSent */);
 
   nsresult rv = NS_DispatchToMainThread(runnable);
   NS_WARN_IF(NS_FAILED(rv));
@@ -502,7 +503,7 @@ WebSocketEventService::ShutdownActorListener(WindowListener* aListener)
   aListener->mActor = nullptr;
 }
 
-WebSocketFrame*
+already_AddRefed<WebSocketFrame>
 WebSocketEventService::CreateFrameIfNeeded(bool aFinBit, bool aRsvBit1,
                                            bool aRsvBit2, bool aRsvBit3,
                                            uint8_t aOpCode, bool aMaskBit,
@@ -513,11 +514,11 @@ WebSocketEventService::CreateFrameIfNeeded(bool aFinBit, bool aRsvBit1,
     return nullptr;
   }
 
-  return new WebSocketFrame(aFinBit, aRsvBit1, aRsvBit2, aRsvBit3, aOpCode,
-                            aMaskBit, aMask, aPayload);
+  return MakeAndAddRef<WebSocketFrame>(aFinBit, aRsvBit1, aRsvBit2, aRsvBit3,
+                                       aOpCode, aMaskBit, aMask, aPayload);
 }
 
-WebSocketFrame*
+already_AddRefed<WebSocketFrame>
 WebSocketEventService::CreateFrameIfNeeded(bool aFinBit, bool aRsvBit1,
                                            bool aRsvBit2, bool aRsvBit3,
                                            uint8_t aOpCode, bool aMaskBit,
@@ -534,11 +535,11 @@ WebSocketEventService::CreateFrameIfNeeded(bool aFinBit, bool aRsvBit1,
     return nullptr;
   }
 
-  return new WebSocketFrame(aFinBit, aRsvBit1, aRsvBit2, aRsvBit3, aOpCode,
-                            aMaskBit, aMask, payloadStr);
+  return MakeAndAddRef<WebSocketFrame>(aFinBit, aRsvBit1, aRsvBit2, aRsvBit3,
+                                       aOpCode, aMaskBit, aMask, payloadStr);
 }
 
-WebSocketFrame*
+already_AddRefed<WebSocketFrame>
 WebSocketEventService::CreateFrameIfNeeded(bool aFinBit, bool aRsvBit1,
                                            bool aRsvBit2, bool aRsvBit3,
                                            uint8_t aOpCode, bool aMaskBit,
@@ -571,8 +572,8 @@ WebSocketEventService::CreateFrameIfNeeded(bool aFinBit, bool aRsvBit1,
     return nullptr;
   }
 
-  return new WebSocketFrame(aFinBit, aRsvBit1, aRsvBit2, aRsvBit3, aOpCode,
-                            aMaskBit, aMask, payloadStr);
+  return MakeAndAddRef<WebSocketFrame>(aFinBit, aRsvBit1, aRsvBit2, aRsvBit3,
+                                       aOpCode, aMaskBit, aMask, payloadStr);
 }
 
 } // net namespace
diff --git a/netwerk/protocol/websocket/WebSocketEventService.h b/netwerk/protocol/websocket/WebSocketEventService.h
index 2515c05ebf..6f97975576 100644
--- a/netwerk/protocol/websocket/WebSocketEventService.h
+++ b/netwerk/protocol/websocket/WebSocketEventService.h
@@ -7,6 +7,7 @@
 #ifndef mozilla_net_WebSocketEventService_h
 #define mozilla_net_WebSocketEventService_h
 
+#include "mozilla/AlreadyAddRefed.h"
 #include "mozilla/Atomics.h"
 #include "nsIWebSocketEventService.h"
 #include "nsAutoPtr.h"
@@ -59,23 +60,23 @@ public:
 
   void FrameReceived(uint32_t aWebSocketSerialID,
                      uint64_t aInnerWindowID,
-                     WebSocketFrame* aFrame);
+                     already_AddRefed<WebSocketFrame> aFrame);
 
   void  FrameSent(uint32_t aWebSocketSerialID,
                   uint64_t aInnerWindowID,
-                  WebSocketFrame* aFrame);
+                  already_AddRefed<WebSocketFrame> aFrame);
 
-  WebSocketFrame*
+  already_AddRefed<WebSocketFrame>
   CreateFrameIfNeeded(bool aFinBit, bool aRsvBit1, bool aRsvBit2, bool aRsvBit3,
                       uint8_t aOpCode, bool aMaskBit, uint32_t aMask,
                       const nsCString& aPayload);
 
-  WebSocketFrame*
+  already_AddRefed<WebSocketFrame>
   CreateFrameIfNeeded(bool aFinBit, bool aRsvBit1, bool aRsvBit2, bool aRsvBit3,
                       uint8_t aOpCode, bool aMaskBit, uint32_t aMask,
                       uint8_t* aPayload, uint32_t aPayloadLength);
 
-  WebSocketFrame*
+  already_AddRefed<WebSocketFrame>
   CreateFrameIfNeeded(bool aFinBit, bool aRsvBit1, bool aRsvBit2, bool aRsvBit3,
                       uint8_t aOpCode, bool aMaskBit, uint32_t aMask,
                       uint8_t* aPayloadInHdr, uint32_t aPayloadInHdrLength,
diff --git a/netwerk/protocol/websocket/WebSocketFrame.cpp b/netwerk/protocol/websocket/WebSocketFrame.cpp
index 209942dc56..c8ce329f11 100644
--- a/netwerk/protocol/websocket/WebSocketFrame.cpp
+++ b/netwerk/protocol/websocket/WebSocketFrame.cpp
@@ -7,8 +7,7 @@
 #include "WebSocketFrame.h"
 
 #include "WebSocketChannel.h"
-
-extern PRThread *gSocketThread;
+#include "nsSocketTransportService2.h"
 
 namespace mozilla {
 namespace net {
diff --git a/netwerk/streamconv/converters/ParseFTPList.cpp b/netwerk/streamconv/converters/ParseFTPList.cpp
index 9048f5afac..d80719152a 100644
--- a/netwerk/streamconv/converters/ParseFTPList.cpp
+++ b/netwerk/streamconv/converters/ParseFTPList.cpp
@@ -11,6 +11,8 @@
 #include "nsDebug.h"
 #include "prprf.h"
 #include "mozilla/CheckedInt.h"
+#include "mozilla/IntegerPrintfMacros.h"
+#include "mozilla/Snprintf.h"
 
 /* ==================================================================== */
 
@@ -27,7 +29,7 @@ int ParseFTPList(const char *line, struct list_state *state,
                  struct list_result *result )
 {
   unsigned int carry_buf_len; /* copy of state->carry_buf_len */
-  unsigned int linelen, pos;
+  unsigned int pos;
   const char *p;
 
   if (!line || !state || !result)
@@ -40,8 +42,6 @@ int ParseFTPList(const char *line, struct list_state *state,
   carry_buf_len = state->carry_buf_len;
   state->carry_buf_len = 0;
 
-  linelen = 0;
-
   /* strip leading whitespace */
   while (*line == ' ' || *line == '\t')
     line++;
@@ -50,7 +50,7 @@ int ParseFTPList(const char *line, struct list_state *state,
   p = line;
   while (*p && *p != '\n')
     p++;
-  linelen = p - line;
+  unsigned int linelen = p - line;
 
   if (linelen > 0 && *p == '\n' && *(p-1) == '\r')
     linelen--;
@@ -490,8 +490,7 @@ int ParseFTPList(const char *line, struct list_state *state,
                * than not showing the size at all.
               */
               uint64_t fsz = uint64_t(strtoul(tokens[1], (char **)0, 10) * 512);
-              PR_snprintf(result->fe_size, sizeof(result->fe_size), 
-                          "%lld", fsz);
+              snprintf_literal(result->fe_size, "%" PRId64, fsz);
             } 
 
           } /* if (result->fe_type != 'd') */
@@ -726,7 +725,13 @@ int ParseFTPList(const char *line, struct list_state *state,
        * "07-21-00  01:19PM                52275 Name Plate.jpg"
        * "07-14-00  01:38PM              2250540 Valentineoffprank-HiRes.jpg"
       */
-      if ((numtoks >= 4) && (toklen[0] == 8 || toklen[0] == 10) && toklen[1] == 7 && 
+      // Microsoft FTP server with FtpDirBrowseShowLongDate set returns year
+      // in 4-digit format:
+      // "10-10-2014  10:10AM       <DIR>        FTP"
+      // Windows CE FTP server returns time in 24-hour format:
+      // "05-03-13  22:01       <DIR>          APPS"
+      if ((numtoks >= 4) && (toklen[0] == 8 || toklen[0] == 10) &&
+          (toklen[1] == 5 || toklen[1] == 7) &&
           (*tokens[2] == '<' || isdigit(*tokens[2])) )
       {
         p = tokens[0];
@@ -737,7 +742,8 @@ int ParseFTPList(const char *line, struct list_state *state,
           p = tokens[1];
           if ( isdigit(p[0]) && isdigit(p[1]) && p[2]==':' && 
                isdigit(p[3]) && isdigit(p[4]) && 
-               (p[5]=='A' || p[5]=='P') && p[6]=='M')
+               (toklen[1] == 5 || (toklen[1] == 7 &&
+                                  (p[5]=='A' || p[5]=='P') && p[6]=='M')))
           {
             lstyle = 'W';
             if (!state->lstyle)
@@ -834,10 +840,13 @@ int ParseFTPList(const char *line, struct list_state *state,
 
         result->fe_time.tm_hour = atoi(tokens[1]+0);
         result->fe_time.tm_min = atoi(tokens[1]+3);
-        if ((tokens[1][5]) == 'P' && result->fe_time.tm_hour < 12)
-          result->fe_time.tm_hour += 12;
-	else if ((tokens[1][5]) == 'A' && result->fe_time.tm_hour == 12)
-          result->fe_time.tm_hour = 0;
+        if (toklen[1] == 7)
+        {
+          if ((tokens[1][5]) == 'P' && result->fe_time.tm_hour < 12)
+            result->fe_time.tm_hour += 12;
+          else if ((tokens[1][5]) == 'A' && result->fe_time.tm_hour == 12)
+            result->fe_time.tm_hour = 0;
+        }
 
         /* the caller should do this (if dropping "." and ".." is desired)
         if (result->fe_type == 'd' && result->fe_fname[0] == '.' &&
diff --git a/netwerk/test/TestCookie.cpp b/netwerk/test/TestCookie.cpp
index 217ef79b57..e123ec66b2 100644
--- a/netwerk/test/TestCookie.cpp
+++ b/netwerk/test/TestCookie.cpp
@@ -28,7 +28,6 @@ static const char kCookiesPermissions[] = "network.cookie.cookieBehavior";
 static const char kCookiesLifetimeEnabled[] = "network.cookie.lifetime.enabled";
 static const char kCookiesLifetimeDays[] = "network.cookie.lifetime.days";
 static const char kCookiesLifetimeCurrentSession[] = "network.cookie.lifetime.behavior";
-static const char kCookiesAskPermission[] = "network.cookie.warnAboutCookies";
 static const char kCookiesMaxPerHost[] = "network.cookie.maxPerHost";
 
 static char *sBuffer;
@@ -183,7 +182,6 @@ InitPrefs(nsIPrefBranch *aPrefBranch)
     aPrefBranch->SetBoolPref(kCookiesLifetimeEnabled, true);
     aPrefBranch->SetIntPref(kCookiesLifetimeCurrentSession, 0);
     aPrefBranch->SetIntPref(kCookiesLifetimeDays, 1);
-    aPrefBranch->SetBoolPref(kCookiesAskPermission, false);
     // Set the base domain limit to 50 so we have a known value.
     aPrefBranch->SetIntPref(kCookiesMaxPerHost, 50);
 }
diff --git a/netwerk/test/unit/head_cache.js b/netwerk/test/unit/head_cache.js
index 617df1d911..6c8cf0d4a8 100644
--- a/netwerk/test/unit/head_cache.js
+++ b/netwerk/test/unit/head_cache.js
@@ -50,6 +50,7 @@ function getCacheStorage(where, lci, appcache)
     case "disk": return svc.diskCacheStorage(lci, false);
     case "memory": return svc.memoryCacheStorage(lci);
     case "appcache": return svc.appCacheStorage(lci, appcache);
+    case "pin": return svc.pinningCacheStorage(lci);
   }
   return null;
 }
diff --git a/netwerk/test/unit/head_cache2.js b/netwerk/test/unit/head_cache2.js
index 5d2adf48bf..19c31201ab 100644
--- a/netwerk/test/unit/head_cache2.js
+++ b/netwerk/test/unit/head_cache2.js
@@ -49,6 +49,8 @@ const DONTFILL =        1 << 13;
 const DONTSETVALID =    1 << 14;
 // Notify before checking the data, useful for proper callback ordering checks
 const NOTIFYBEFOREREAD = 1 << 15;
+// It's allowed to not get an existing entry (result of opening is undetermined)
+const MAYBE_NEW =       1 << 16;
 
 var log_c2 = true;
 function LOG_C2(o, m)
@@ -150,6 +152,10 @@ OpenCallback.prototype =
   },
   onCacheEntryAvailable: function(entry, isnew, appCache, status)
   {
+    if ((this.behavior & MAYBE_NEW) && isnew) {
+      this.behavior |= NEW;
+    }
+
     LOG_C2(this, "onCacheEntryAvailable, " + this.behavior);
     do_check_true(!this.onAvailPassed);
     this.onAvailPassed = true;
@@ -207,9 +213,13 @@ OpenCallback.prototype =
         }
         do_execute_soon(function() { // emulate more network latency
           if (self.behavior & DOOMED) {
+            LOG_C2(self, "checking doom state");
             try {
               var os = entry.openOutputStream(0);
-              do_check_true(false);
+              // Unfortunately, in the undetermined state we cannot even check whether the entry
+              // is actually doomed or not.
+              os.close();
+              do_check_true(!!(self.behavior & MAYBE_NEW));
             } catch (ex) {
               do_check_true(true);
             }
@@ -258,9 +268,9 @@ OpenCallback.prototype =
   {
     LOG_C2(this, "selfCheck");
 
-    do_check_true(this.onCheckPassed);
+    do_check_true(this.onCheckPassed || (this.behavior & MAYBE_NEW));
     do_check_true(this.onAvailPassed);
-    do_check_true(this.onDataCheckPassed);
+    do_check_true(this.onDataCheckPassed || (this.behavior & MAYBE_NEW));
   },
   throwAndNotify: function(entry)
   {
@@ -386,6 +396,10 @@ MultipleCallbacks.prototype =
       else
         this.goon();
     }
+  },
+  add: function()
+  {
+    ++this.pending;
   }
 }
 
diff --git a/netwerk/test/unit/test_cache2-28-concurrent_read_resumable_entry_size_zero.js b/netwerk/test/unit/test_cache2-29a-concurrent_read_resumable_entry_size_zero.js
similarity index 100%
rename from netwerk/test/unit/test_cache2-28-concurrent_read_resumable_entry_size_zero.js
rename to netwerk/test/unit/test_cache2-29a-concurrent_read_resumable_entry_size_zero.js
diff --git a/netwerk/test/unit/test_cache2-29-concurrent_read_non-resumable_entry_size_zero.js b/netwerk/test/unit/test_cache2-29b-concurrent_read_non-resumable_entry_size_zero.js
similarity index 100%
rename from netwerk/test/unit/test_cache2-29-concurrent_read_non-resumable_entry_size_zero.js
rename to netwerk/test/unit/test_cache2-29b-concurrent_read_non-resumable_entry_size_zero.js
diff --git a/netwerk/test/unit/test_cache2-30a-entry-pinning.js b/netwerk/test/unit/test_cache2-30a-entry-pinning.js
new file mode 100644
index 0000000000..ace537884f
--- /dev/null
+++ b/netwerk/test/unit/test_cache2-30a-entry-pinning.js
@@ -0,0 +1,28 @@
+function run_test()
+{
+  do_get_profile();
+
+  // Open for write, write
+  asyncOpenCacheEntry("http://a/", "pin", Ci.nsICacheStorage.OPEN_TRUNCATE, LoadContextInfo.default,
+    new OpenCallback(NEW|WAITFORWRITE, "a1m", "a1d", function(entry) {
+      // Open for read and check
+      asyncOpenCacheEntry("http://a/", "disk", Ci.nsICacheStorage.OPEN_NORMALLY, LoadContextInfo.default,
+        new OpenCallback(NORMAL, "a1m", "a1d", function(entry) {
+
+          // Now clear the whole cache
+          get_cache_service().clear();
+
+          // The pinned entry should be intact
+          asyncOpenCacheEntry("http://a/", "disk", Ci.nsICacheStorage.OPEN_NORMALLY, LoadContextInfo.default,
+            new OpenCallback(NORMAL, "a1m", "a1d", function(entry) {
+              finish_cache2_test();
+            })
+          );
+
+        })
+      );
+    })
+  );
+
+  do_test_pending();
+}
diff --git a/netwerk/test/unit/test_cache2-30b-pinning-storage-clear.js b/netwerk/test/unit/test_cache2-30b-pinning-storage-clear.js
new file mode 100644
index 0000000000..617697a8fa
--- /dev/null
+++ b/netwerk/test/unit/test_cache2-30b-pinning-storage-clear.js
@@ -0,0 +1,34 @@
+function run_test()
+{
+  do_get_profile();
+  var lci = LoadContextInfo.default;
+
+  // Open a pinned entry for write, write
+  asyncOpenCacheEntry("http://a/", "pin", Ci.nsICacheStorage.OPEN_TRUNCATE, lci,
+    new OpenCallback(NEW|WAITFORWRITE, "a1m", "a1d", function(entry) {
+
+      // Now clear the disk storage, that should leave the pinned  entry in the cache
+      var diskStorage = getCacheStorage("disk", lci);
+      diskStorage.asyncEvictStorage(null);
+
+      // Open for read and check, it should still be there
+      asyncOpenCacheEntry("http://a/", "disk", Ci.nsICacheStorage.OPEN_NORMALLY, lci,
+        new OpenCallback(NORMAL, "a1m", "a1d", function(entry) {
+
+          // Now clear the pinning storage, entry should be gone
+          var pinningStorage = getCacheStorage("pin", lci);
+          pinningStorage.asyncEvictStorage(null);
+
+          asyncOpenCacheEntry("http://a/", "disk", Ci.nsICacheStorage.OPEN_NORMALLY, lci,
+            new OpenCallback(NEW, "", "", function(entry) {
+              finish_cache2_test();
+            })
+          );
+
+        })
+      );
+    })
+  );
+
+  do_test_pending();
+}
diff --git a/netwerk/test/unit/test_cache2-30c-pinning-deferred-doom.js b/netwerk/test/unit/test_cache2-30c-pinning-deferred-doom.js
new file mode 100644
index 0000000000..657e96798e
--- /dev/null
+++ b/netwerk/test/unit/test_cache2-30c-pinning-deferred-doom.js
@@ -0,0 +1,129 @@
+/*
+
+This is a complex test checking the internal "deferred doom" functionality in both CacheEntry and CacheFileHandle.
+
+- We create a batch of 10 non-pinned and 10 pinned entries, write something to them.
+- Then we purge them from memory, so they have to reload from disk.
+- After that the IO thread is suspended not to process events on the READ (3) level.  This forces opening operation and eviction
+  sync operations happen before we know actual pinning status of already cached entries.
+- We async-open the same batch of the 10+10 entries again, all should open as existing with the expected, previously stored
+  content
+- After all these entries are made to open, we clear the cache.  This does some synchronous operations on the entries
+  being open and also on the handles being in an already open state (but before the entry metadata has started to be read.)
+  Expected is to leave the pinned entries only.
+- Now, we resume the IO thread, so it start reading.  One could say this is a hack, but this can very well happen in reality
+  on slow disk or when a large number of entries is about to be open at once.  Suspending the IO thread is just doing this
+  simulation is a fully deterministic way and actually very easily and elegantly.
+- After the resume we want to open all those 10+10 entries once again (no purgin involved this time.).  It is expected
+  to open all the pinning entries intact and loose all the non-pinned entries (get them as new and empty again.)
+
+*/
+
+const kENTRYCOUNT = 10;
+
+function log_(msg) { if (true) dump(">>>>>>>>>>>>> " + msg + "\n"); }
+
+function run_test()
+{
+  do_get_profile();
+  var lci = LoadContextInfo.default;
+  var testingInterface = get_cache_service().QueryInterface(Ci.nsICacheTesting);
+  do_check_true(testingInterface);
+
+  var mc = new MultipleCallbacks(1, function() {
+    // (2)
+
+    mc = new MultipleCallbacks(1, finish_cache2_test);
+    // Release all references to cache entries so that they can be purged
+    // Calling gc() four times is needed to force it to actually release
+    // entries that are obviously unreferenced.  Yeah, I know, this is wacky...
+    gc();
+    gc();
+    do_execute_soon(() => {
+      gc();
+      gc();
+      log_("purging");
+
+      // Invokes cacheservice:purge-memory-pools when done.
+      get_cache_service().purgeFromMemory(Ci.nsICacheStorageService.PURGE_EVERYTHING); // goes to (3)
+    });
+  }, true);
+
+  // (1), here we start
+
+  var i;
+  for (i = 0; i < kENTRYCOUNT; ++i) {
+    log_("first set of opens");
+
+    // Callbacks 1-20
+    mc.add();
+    asyncOpenCacheEntry("http://pinned" + i + "/", "pin", Ci.nsICacheStorage.OPEN_TRUNCATE, lci,
+      new OpenCallback(NEW|WAITFORWRITE, "m" + i, "p" + i, function(entry) { mc.fired(); }));
+
+    mc.add();
+    asyncOpenCacheEntry("http://common" + i + "/", "disk", Ci.nsICacheStorage.OPEN_TRUNCATE, lci,
+      new OpenCallback(NEW|WAITFORWRITE, "m" + i, "d" + i, function(entry) { mc.fired(); }));
+  }
+
+  mc.fired(); // Goes to (2)
+
+  var os = Cc["@mozilla.org/observer-service;1"].getService(Ci.nsIObserverService);
+  os.addObserver({
+    observe: function(subject, topic, data)
+    {
+      // (3)
+
+      log_("after purge, second set of opens");
+      // Prevent the I/O thread from reading the data.  We first want to schedule clear of the cache.
+      // This deterministically emulates a slow hard drive.
+      testingInterface.suspendCacheIOThread(3);
+
+      // All entries should load
+      // Callbacks 21-40
+      for (i = 0; i < kENTRYCOUNT; ++i) {
+        mc.add();
+        asyncOpenCacheEntry("http://pinned" + i + "/", "disk", Ci.nsICacheStorage.OPEN_NORMALLY, lci,
+          new OpenCallback(NORMAL, "m" + i, "p" + i, function(entry) { mc.fired(); }));
+
+        // Unfortunately we cannot ensure that entries existing in the cache will be delivered to the consumer
+        // when soon after are evicted by some cache API call.  It's better to not ensure getting an entry
+        // than allowing to get an entry that was just evicted from the cache.  Entries may be delievered
+        // as new, but are already doomed.  Output stream cannot be openned, or the file handle is already
+        // writing to a doomed file.
+        //
+        // The API now just ensures that entries removed by any of the cache eviction APIs are never more
+        // available to consumers.
+        mc.add();
+        asyncOpenCacheEntry("http://common" + i + "/", "disk", Ci.nsICacheStorage.OPEN_NORMALLY, lci,
+          new OpenCallback(MAYBE_NEW|DOOMED, "m" + i, "d" + i, function(entry) { mc.fired(); }));
+      }
+
+      log_("clearing");
+      // Now clear everything except pinned, all entries are in state of reading
+      get_cache_service().clear();
+      log_("cleared");
+
+      // Resume reading the cache data, only now the pinning status on entries will be discovered,
+      // the deferred dooming code will trigger.
+      testingInterface.resumeCacheIOThread();
+
+      log_("third set of opens");
+      // Now open again.  Pinned entries should be there, disk entries should be the renewed entries.
+      // Callbacks 41-60
+      for (i = 0; i < kENTRYCOUNT; ++i) {
+        mc.add();
+        asyncOpenCacheEntry("http://pinned" + i + "/", "disk", Ci.nsICacheStorage.OPEN_NORMALLY, lci,
+          new OpenCallback(NORMAL, "m" + i, "p" + i, function(entry) { mc.fired(); }));
+
+        mc.add();
+        asyncOpenCacheEntry("http://common" + i + "/", "disk", Ci.nsICacheStorage.OPEN_NORMALLY, lci,
+          new OpenCallback(NEW, "m2" + i, "d2" + i, function(entry) { mc.fired(); }));
+      }
+
+      mc.fired(); // Finishes this test
+    }
+  }, "cacheservice:purge-memory-pools", false);
+
+
+  do_test_pending();
+}
diff --git a/netwerk/test/unit/test_cache2-30d-pinning-WasEvicted-API.js b/netwerk/test/unit/test_cache2-30d-pinning-WasEvicted-API.js
new file mode 100644
index 0000000000..1dad338214
--- /dev/null
+++ b/netwerk/test/unit/test_cache2-30d-pinning-WasEvicted-API.js
@@ -0,0 +1,107 @@
+/*
+
+This test exercises the CacheFileContextEvictor::WasEvicted API and code using it.
+
+- We store 10+10 (pinned and non-pinned) entries to the cache, wait for them being written.
+- Then we purge the memory pools.
+- Now the IO thread is suspended on the EVICT (8) level to prevent actual deletion of the files.
+- Index is disabled.
+- We do clear() of the cache, this creates the "ce_*" file and posts to the EVICT level
+  the eviction loop mechanics.
+- We open again those 10+10 entries previously stored.
+- IO is resumed
+- We expect to get all the pinned and
+  loose all the non-pinned (common) entries.
+
+*/
+
+const kENTRYCOUNT = 10;
+
+function log_(msg) { if (true) dump(">>>>>>>>>>>>> " + msg + "\n"); }
+
+function run_test()
+{
+  do_get_profile();
+  var lci = LoadContextInfo.default;
+  var testingInterface = get_cache_service().QueryInterface(Ci.nsICacheTesting);
+  do_check_true(testingInterface);
+
+  var mc = new MultipleCallbacks(1, function() {
+    // (2)
+
+    mc = new MultipleCallbacks(1, finish_cache2_test);
+    // Release all references to cache entries so that they can be purged
+    // Calling gc() four times is needed to force it to actually release
+    // entries that are obviously unreferenced.  Yeah, I know, this is wacky...
+    gc();
+    gc();
+    do_execute_soon(() => {
+      gc();
+      gc();
+      log_("purging");
+
+      // Invokes cacheservice:purge-memory-pools when done.
+      get_cache_service().purgeFromMemory(Ci.nsICacheStorageService.PURGE_EVERYTHING); // goes to (3)
+    });
+  }, true);
+
+  // (1), here we start
+
+  var i;
+  for (i = 0; i < kENTRYCOUNT; ++i) {
+    log_("first set of opens");
+
+    // Callbacks 1-20
+    mc.add();
+    asyncOpenCacheEntry("http://pinned" + i + "/", "pin", Ci.nsICacheStorage.OPEN_TRUNCATE, lci,
+      new OpenCallback(NEW|WAITFORWRITE, "m" + i, "p" + i, function(entry) { mc.fired(); }));
+
+    mc.add();
+    asyncOpenCacheEntry("http://common" + i + "/", "disk", Ci.nsICacheStorage.OPEN_TRUNCATE, lci,
+      new OpenCallback(NEW|WAITFORWRITE, "m" + i, "d" + i, function(entry) { mc.fired(); }));
+  }
+
+  mc.fired(); // Goes to (2)
+
+  var os = Cc["@mozilla.org/observer-service;1"].getService(Ci.nsIObserverService);
+  os.addObserver({
+    observe: function(subject, topic, data)
+    {
+      // (3)
+
+      log_("after purge");
+      // Prevent the I/O thread from evicting physically the data.  We first want to re-open the entries.
+      // This deterministically emulates a slow hard drive.
+      testingInterface.suspendCacheIOThread(8);
+
+      log_("clearing");
+      // Now clear everything except pinned.  Stores the "ce_*" file and schedules background eviction.
+      get_cache_service().clear();
+      log_("cleared");
+
+      log_("second set of opens");
+      // Now open again.  Pinned entries should be there, disk entries should be the renewed entries.
+      // Callbacks 21-40
+      for (i = 0; i < kENTRYCOUNT; ++i) {
+        mc.add();
+        asyncOpenCacheEntry("http://pinned" + i + "/", "disk", Ci.nsICacheStorage.OPEN_NORMALLY, lci,
+          new OpenCallback(NORMAL, "m" + i, "p" + i, function(entry) { mc.fired(); }));
+
+        mc.add();
+        asyncOpenCacheEntry("http://common" + i + "/", "disk", Ci.nsICacheStorage.OPEN_NORMALLY, lci,
+          new OpenCallback(NEW, "m2" + i, "d2" + i, function(entry) { mc.fired(); }));
+      }
+
+      // Resume IO, this will just pop-off the CacheFileContextEvictor::EvictEntries() because of
+      // an early check on CacheIOThread::YieldAndRerun() in that method.
+      // CacheFileIOManager::OpenFileInternal should now run and CacheFileContextEvictor::WasEvicted
+      // should be checked on.
+      testingInterface.resumeCacheIOThread();
+
+      mc.fired(); // Finishes this test
+    }
+  }, "cacheservice:purge-memory-pools", false);
+
+
+  do_test_pending();
+}
diff --git a/netwerk/test/unit/test_cache_jar.js b/netwerk/test/unit/test_cache_jar.js
index 515ba1c891..591f433d04 100644
--- a/netwerk/test/unit/test_cache_jar.js
+++ b/netwerk/test/unit/test_cache_jar.js
@@ -99,7 +99,8 @@ function run_test() {
 
 function doneFirstLoad(req, buffer, expected) {
   // Load it again, make sure it hits the cache
-  var chan = makeChan(URL, 0, false);
+  var nc = req.notificationCallbacks.getInterface(Ci.nsILoadContext);
+  var chan = makeChan(URL, nc.appId, nc.isInBrowserElement);
   chan.asyncOpen(new ChannelListener(doneSecondLoad, expected), null);
 }
 
diff --git a/netwerk/test/unit/xpcshell.ini b/netwerk/test/unit/xpcshell.ini
index 3fc382d579..d82bf37cec 100644
--- a/netwerk/test/unit/xpcshell.ini
+++ b/netwerk/test/unit/xpcshell.ini
@@ -68,8 +68,12 @@ skip-if = true
 [test_cache2-28a-OPEN_SECRETLY.js]
 # This test will be fixed in bug 1067931
 skip-if = true
-[test_cache2-28-concurrent_read_resumable_entry_size_zero.js]
-[test_cache2-29-concurrent_read_non-resumable_entry_size_zero.js]
+[test_cache2-29a-concurrent_read_resumable_entry_size_zero.js]
+[test_cache2-29b-concurrent_read_non-resumable_entry_size_zero.js]
+[test_cache2-30a-entry-pinning.js]
+[test_cache2-30b-pinning-storage-clear.js]
+[test_cache2-30c-pinning-deferred-doom.js]
+[test_cache2-30d-pinning-WasEvicted-API.js]
 [test_partial_response_entry_size_smart_shrink.js]
 [test_304_responses.js]
 [test_421.js]
diff --git a/netwerk/test/urltest.cpp b/netwerk/test/urltest.cpp
index e796659394..c96fdcb927 100644
--- a/netwerk/test/urltest.cpp
+++ b/netwerk/test/urltest.cpp
@@ -23,6 +23,7 @@
 #include "nsServiceManagerUtils.h"
 #include "nsXPCOM.h"
 #include "prprf.h"
+#include "mozilla/Snprintf.h"
 
 // Define CIDs...
 static NS_DEFINE_CID(kIOServiceCID,              NS_IOSERVICE_CID);
@@ -92,7 +93,7 @@ nsresult writeoutto(const char* i_pURL, char** o_Result, int32_t urlFactory = UR
         output += ',';
         rv = tURL->GetPort(&port);
         char portbuffer[40];
-        PR_snprintf(portbuffer, sizeof(portbuffer), "%d", port);
+        snprintf_literal(portbuffer, "%d", port);
         output.Append(portbuffer);
         output += ',';
         rv = tURL->GetDirectory(temp);
diff --git a/services/common/tests/unit/test_tokenserverclient.js b/services/common/tests/unit/test_tokenserverclient.js
index a2cb88c2ff..b24d2fbec4 100644
--- a/services/common/tests/unit/test_tokenserverclient.js
+++ b/services/common/tests/unit/test_tokenserverclient.js
@@ -100,6 +100,8 @@ add_test(function test_conditions_required_response_handling() {
   function onResponse(error, token) {
     do_check_true(error instanceof TokenServerClientServerError);
     do_check_eq(error.cause, "conditions-required");
+    // Check a JSON.stringify works on our errors as our logging will try and use it.
+    do_check_true(JSON.stringify(error), "JSON.stringify worked");
     do_check_null(token);
 
     do_check_eq(error.urls.tos, tosURL);
diff --git a/services/common/tokenserverclient.js b/services/common/tokenserverclient.js
index ad921aaab4..69341d5aaf 100644
--- a/services/common/tokenserverclient.js
+++ b/services/common/tokenserverclient.js
@@ -44,6 +44,11 @@ TokenServerClientError.prototype._toStringFields = function() {
 TokenServerClientError.prototype.toString = function() {
   return this.name + "(" + JSON.stringify(this._toStringFields()) + ")";
 }
+TokenServerClientError.prototype.toJSON = function() {
+  let result = this._toStringFields();
+  result["name"] = this.name;
+  return result;
+}
 
 /**
  * Represents a TokenServerClient error that occurred in the network layer.
diff --git a/testing/xpcshell/head.js b/testing/xpcshell/head.js
index e07bcfe207..28a8b2a546 100644
--- a/testing/xpcshell/head.js
+++ b/testing/xpcshell/head.js
@@ -387,7 +387,8 @@ function _setupDebuggerServer(breakpointFiles, callback) {
           // Add a breakpoint for the first line in our test files.
           let threadActor = subject.wrappedJSObject;
           for (let file of breakpointFiles) {
-            let sourceActor = threadActor.sources.source({originalUrl: file});
+            // Pass an empty `source` object to workaround `source` function assertion
+            let sourceActor = threadActor.sources.source({originalUrl: file, source: {}});
             sourceActor._getOrCreateBreakpointActor(new OriginalLocation(sourceActor, 1));
           }
         } catch (ex) {
diff --git a/toolkit/components/moz.build b/toolkit/components/moz.build
index 769fabdc41..2f9045f973 100644
--- a/toolkit/components/moz.build
+++ b/toolkit/components/moz.build
@@ -40,6 +40,7 @@ DIRS += [
     'perf',
     'perfmonitoring',
     'places',
+    'privatebrowsing',
     'processsingleton',
     'promiseworker',
     'prompts',
@@ -84,6 +85,9 @@ if CONFIG['MOZ_XUL']:
 if CONFIG['MOZ_TOOLKIT_SEARCH']:
     DIRS += ['search']
 
+if CONFIG['MOZ_URL_CLASSIFIER']:
+    DIRS += ['url-classifier']
+
 DIRS += ['captivedetect']
 
 if CONFIG['MOZ_WIDGET_TOOLKIT'] != "gonk" and CONFIG['MOZ_WIDGET_TOOLKIT'] != 'android':
diff --git a/toolkit/components/privatebrowsing/PrivateBrowsing.manifest b/toolkit/components/privatebrowsing/PrivateBrowsing.manifest
new file mode 100644
index 0000000000..36b39bb85e
--- /dev/null
+++ b/toolkit/components/privatebrowsing/PrivateBrowsing.manifest
@@ -0,0 +1,2 @@
+component {a319b616-c45d-4037-8d86-01c592b5a9af} PrivateBrowsingTrackingProtectionWhitelist.js
+contract @mozilla.org/pbm-tp-whitelist;1 {a319b616-c45d-4037-8d86-01c592b5a9af}
diff --git a/toolkit/components/privatebrowsing/PrivateBrowsingTrackingProtectionWhitelist.js b/toolkit/components/privatebrowsing/PrivateBrowsingTrackingProtectionWhitelist.js
new file mode 100644
index 0000000000..5c1c27874d
--- /dev/null
+++ b/toolkit/components/privatebrowsing/PrivateBrowsingTrackingProtectionWhitelist.js
@@ -0,0 +1,68 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+const Ci = Components.interfaces;
+const Cu = Components.utils;
+
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
+
+function PrivateBrowsingTrackingProtectionWhitelist() {
+  // The list of URIs explicitly excluded from tracking protection.
+  this._allowlist = [];
+
+  Services.obs.addObserver(this, "last-pb-context-exited", true);
+}
+
+PrivateBrowsingTrackingProtectionWhitelist.prototype = {
+  classID: Components.ID("{a319b616-c45d-4037-8d86-01c592b5a9af}"),
+  QueryInterface: XPCOMUtils.generateQI([Ci.nsIPrivateBrowsingTrackingProtectionWhitelist,
+                                         Ci.nsIObserver,
+                                         Ci.nsISupportsWeakReference,
+                                         Ci.nsISupports]),
+  _xpcom_factory: XPCOMUtils.generateSingletonFactory(PrivateBrowsingTrackingProtectionWhitelist),
+
+  /**
+   * Add the provided URI to the list of allowed tracking sites.
+   *
+   * @param uri nsIURI
+   *        The URI to add to the list.
+   */
+  addToAllowList(uri) {
+    if (this._allowlist.indexOf(uri.spec) === -1) {
+      this._allowlist.push(uri.spec);
+    }
+  },
+
+  /**
+   * Remove the provided URI from the list of allowed tracking sites.
+   *
+   * @param uri nsIURI
+   *        The URI to add to the list.
+   */
+  removeFromAllowList(uri) {
+    let index = this._allowlist.indexOf(uri.spec);
+    if (index !== -1) {
+      this._allowlist.splice(index, 1);
+    }
+  },
+
+  /**
+   * Check if the provided URI exists in the list of allowed tracking sites.
+   *
+   * @param uri nsIURI
+   *        The URI to add to the list.
+   */
+  existsInAllowList(uri) {
+    return this._allowlist.indexOf(uri.spec) !== -1;
+  },
+
+  observe: function (subject, topic, data) {
+    if (topic == "last-pb-context-exited") {
+      this._allowlist = [];
+    }
+  }
+};
+
+this.NSGetFactory = XPCOMUtils.generateNSGetFactory([PrivateBrowsingTrackingProtectionWhitelist]);
diff --git a/toolkit/components/privatebrowsing/moz.build b/toolkit/components/privatebrowsing/moz.build
new file mode 100644
index 0000000000..a2df18696e
--- /dev/null
+++ b/toolkit/components/privatebrowsing/moz.build
@@ -0,0 +1,16 @@
+# -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+XPIDL_SOURCES += [
+    'nsIPrivateBrowsingTrackingProtectionWhitelist.idl',
+]
+
+XPIDL_MODULE = 'privatebrowsing'
+
+EXTRA_COMPONENTS += [
+    'PrivateBrowsing.manifest',
+    'PrivateBrowsingTrackingProtectionWhitelist.js',
+]
diff --git a/toolkit/components/privatebrowsing/nsIPrivateBrowsingTrackingProtectionWhitelist.idl b/toolkit/components/privatebrowsing/nsIPrivateBrowsingTrackingProtectionWhitelist.idl
new file mode 100644
index 0000000000..d572b4e7e1
--- /dev/null
+++ b/toolkit/components/privatebrowsing/nsIPrivateBrowsingTrackingProtectionWhitelist.idl
@@ -0,0 +1,46 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+interface nsIURI;
+
+/**
+ * The Private Browsing Tracking Protection service checks a URI against an
+ * in-memory list of tracking sites.
+ */
+[scriptable, uuid(c77ddfac-6cd6-43a9-84e8-91682a1a7b18)]
+interface nsIPrivateBrowsingTrackingProtectionWhitelist : nsISupports
+{
+  /**
+   * Add a URI to the list of allowed tracking sites in Private Browsing mode
+   * (essentially a tracking whitelist). This operation will cause the URI to
+   * be registered if it does not currently exist. If it already exists, then
+   * the operation is essentially a no-op.
+   *
+   * @param uri         the uri to add to the list
+   */
+  void addToAllowList(in nsIURI uri);
+
+  /**
+   * Remove a URI from the list of allowed tracking sites in Private Browsing
+   * mode (the tracking whitelist). If the URI is not already in the list,
+   * then the operation is essentially a no-op.
+   *
+   * @param uri         the uri to remove from the list
+   */
+  void removeFromAllowList(in nsIURI uri);
+
+  /**
+   * Check if a URI exists in the list of allowed tracking sites in Private
+   * Browsing mode (the tracking whitelist).
+   *
+   * @param uri         the uri to look for in the list
+   */
+  bool existsInAllowList(in nsIURI uri);
+};
+
+%{ C++
+#define NS_PBTRACKINGPROTECTIONWHITELIST_CONTRACTID "@mozilla.org/pbm-tp-whitelist;1"
+%}
diff --git a/toolkit/components/telemetry/Histograms.json b/toolkit/components/telemetry/Histograms.json
index 49b4515f04..9212d61e49 100644
--- a/toolkit/components/telemetry/Histograms.json
+++ b/toolkit/components/telemetry/Histograms.json
@@ -193,13 +193,6 @@
     "n_buckets": 50,
     "description": "Time spent in between cycle collections (seconds)"
   },
-  "CYCLE_COLLECTOR_CONTENT_UNBIND": {
-    "expires_in_version": "never",
-    "kind": "exponential",
-    "high": "10000",
-    "n_buckets": 50,
-    "description": "Time spent on one ContentUnbinder (ms)"
-  },
   "CYCLE_COLLECTOR_OOM": {
     "expires_in_version": "never",
     "kind": "flag",
@@ -5785,6 +5778,22 @@
     "n_buckets": "1000",
     "description": "The time (in milliseconds) that it took a 'listAddons' request to go round trip."
   },
+  "DEVTOOLS_DEBUGGER_RDP_LOCAL_LISTWORKERS_MS": {
+    "alert_emails": ["dev-developer-tools@lists.mozilla.org", "jan@mozilla.com"],
+    "expires_in_version": "55",
+    "kind": "exponential",
+    "high": "10000",
+    "n_buckets": "50",
+    "description": "The time (in milliseconds) that it took a 'listWorkers' request to go round trip."
+  },
+  "DEVTOOLS_DEBUGGER_RDP_REMOTE_LISTWORKERS_MS": {
+    "alert_emails": ["dev-developer-tools@lists.mozilla.org", "jan@mozilla.com"],
+    "expires_in_version": "55",
+    "kind": "exponential",
+    "high": "10000",
+    "n_buckets": "50",
+    "description": "The time (in milliseconds) that it took a 'listWorkers' request to go round trip."
+  },
   "DEVTOOLS_DEBUGGER_RDP_LOCAL_LISTPROCESSES_MS": {
     "expires_in_version": "never",
     "kind": "exponential",
diff --git a/toolkit/components/url-classifier/ChunkSet.cpp b/toolkit/components/url-classifier/ChunkSet.cpp
new file mode 100644
index 0000000000..8906fe816f
--- /dev/null
+++ b/toolkit/components/url-classifier/ChunkSet.cpp
@@ -0,0 +1,98 @@
+//* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ChunkSet.h"
+
+namespace mozilla {
+namespace safebrowsing {
+
+nsresult
+ChunkSet::Serialize(nsACString& aChunkStr)
+{
+  aChunkStr.Truncate();
+
+  uint32_t i = 0;
+  while (i < mChunks.Length()) {
+    if (i != 0) {
+      aChunkStr.Append(',');
+    }
+    aChunkStr.AppendInt((int32_t)mChunks[i]);
+
+    uint32_t first = i;
+    uint32_t last = first;
+    i++;
+    while (i < mChunks.Length() && (mChunks[i] == mChunks[i - 1] + 1 || mChunks[i] == mChunks[i - 1])) {
+      last = i++;
+    }
+
+    if (last != first) {
+      aChunkStr.Append('-');
+      aChunkStr.AppendInt((int32_t)mChunks[last]);
+    }
+  }
+
+  return NS_OK;
+}
+
+nsresult
+ChunkSet::Set(uint32_t aChunk)
+{
+  size_t idx = mChunks.BinaryIndexOf(aChunk);
+  if (idx == nsTArray<uint32_t>::NoIndex) {
+    if (!mChunks.InsertElementSorted(aChunk, fallible)) {
+      return NS_ERROR_OUT_OF_MEMORY;
+    }
+  }
+  return NS_OK;
+}
+
+bool
+ChunkSet::Has(uint32_t aChunk) const
+{
+  return mChunks.BinaryIndexOf(aChunk) != nsTArray<uint32_t>::NoIndex;
+}
+
+nsresult
+ChunkSet::Merge(const ChunkSet& aOther)
+{
+  const uint32_t *dupIter = aOther.mChunks.Elements();
+  const uint32_t *end = aOther.mChunks.Elements() + aOther.mChunks.Length();
+
+  for (const uint32_t *iter = dupIter; iter != end; iter++) {
+    nsresult rv = Set(*iter);
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
+
+  return NS_OK;
+}
+
+nsresult
+ChunkSet::Remove(const ChunkSet& aOther)
+{
+  uint32_t *addIter = mChunks.Elements();
+  uint32_t *end = mChunks.Elements() + mChunks.Length();
+
+  for (uint32_t *iter = addIter; iter != end; iter++) {
+    if (!aOther.Has(*iter)) {
+      *addIter = *iter;
+      addIter++;
+    }
+  }
+
+  if (!mChunks.SetLength(addIter - mChunks.Elements(), fallible)) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  return NS_OK;
+}
+
+void
+ChunkSet::Clear()
+{
+  mChunks.Clear();
+}
+
+} // namespace safebrowsing
+} // namespace mozilla
diff --git a/toolkit/components/url-classifier/ChunkSet.h b/toolkit/components/url-classifier/ChunkSet.h
new file mode 100644
index 0000000000..c7aae13d7e
--- /dev/null
+++ b/toolkit/components/url-classifier/ChunkSet.h
@@ -0,0 +1,49 @@
+//* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef ChunkSet_h__
+#define ChunkSet_h__
+
+#include "Entries.h"
+#include "nsString.h"
+#include "nsTArray.h"
+
+namespace mozilla {
+namespace safebrowsing {
+
+/**
+ * Store the chunk numbers as an array of uint32_t. We need chunk numbers in
+ * order to ask for incremental updates from the server.
+ * XXX: We should optimize this further to compress the many consecutive
+ * numbers.
+ */
+class ChunkSet {
+public:
+  ChunkSet() {}
+  ~ChunkSet() {}
+
+  nsresult Serialize(nsACString& aStr);
+  nsresult Set(uint32_t aChunk);
+  bool Has(uint32_t chunk) const;
+  nsresult Merge(const ChunkSet& aOther);
+  uint32_t Length() const { return mChunks.Length(); }
+  nsresult Remove(const ChunkSet& aOther);
+  void Clear();
+
+  nsresult Write(nsIOutputStream* aOut) {
+    return WriteTArray(aOut, mChunks);
+  }
+  nsresult Read(nsIInputStream* aIn, uint32_t aNumElements) {
+    return ReadTArray(aIn, &mChunks, aNumElements);
+  }
+
+private:
+  FallibleTArray<uint32_t> mChunks;
+};
+
+} // namespace safebrowsing
+} // namespace mozilla
+
+#endif
diff --git a/toolkit/components/url-classifier/Classifier.cpp b/toolkit/components/url-classifier/Classifier.cpp
new file mode 100644
index 0000000000..2adae10967
--- /dev/null
+++ b/toolkit/components/url-classifier/Classifier.cpp
@@ -0,0 +1,747 @@
+//* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "Classifier.h"
+#include "nsIPrefBranch.h"
+#include "nsIPrefService.h"
+#include "nsISimpleEnumerator.h"
+#include "nsIRandomGenerator.h"
+#include "nsIInputStream.h"
+#include "nsISeekableStream.h"
+#include "nsIFile.h"
+#include "nsNetCID.h"
+#include "nsThreadUtils.h"
+#include "mozilla/Telemetry.h"
+#include "mozilla/Logging.h"
+
+// NSPR_LOG_MODULES=UrlClassifierDbService:5
+extern PRLogModuleInfo *gUrlClassifierDbServiceLog;
+#define LOG(args) MOZ_LOG(gUrlClassifierDbServiceLog, mozilla::LogLevel::Debug, args)
+#define LOG_ENABLED() MOZ_LOG_TEST(gUrlClassifierDbServiceLog, mozilla::LogLevel::Debug)
+
+#define STORE_DIRECTORY      NS_LITERAL_CSTRING("safebrowsing")
+#define TO_DELETE_DIR_SUFFIX NS_LITERAL_CSTRING("-to_delete")
+#define BACKUP_DIR_SUFFIX    NS_LITERAL_CSTRING("-backup")
+
+namespace mozilla {
+namespace safebrowsing {
+
+void
+Classifier::SplitTables(const nsACString& str, nsTArray<nsCString>& tables)
+{
+  tables.Clear();
+
+  nsACString::const_iterator begin, iter, end;
+  str.BeginReading(begin);
+  str.EndReading(end);
+  while (begin != end) {
+    iter = begin;
+    FindCharInReadable(',', iter, end);
+    nsDependentCSubstring table = Substring(begin,iter);
+    if (!table.IsEmpty()) {
+      tables.AppendElement(Substring(begin, iter));
+    }
+    begin = iter;
+    if (begin != end) {
+      begin++;
+    }
+  }
+}
+
+Classifier::Classifier()
+{
+}
+
+Classifier::~Classifier()
+{
+  Close();
+}
+
+nsresult
+Classifier::SetupPathNames()
+{
+  // Get the root directory where to store all the databases.
+  nsresult rv = mCacheDirectory->Clone(getter_AddRefs(mStoreDirectory));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = mStoreDirectory->AppendNative(STORE_DIRECTORY);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // Make sure LookupCaches (which are persistent and survive updates)
+  // are reading/writing in the right place. We will be moving their
+  // files "underneath" them during backup/restore.
+  for (uint32_t i = 0; i < mLookupCaches.Length(); i++) {
+    mLookupCaches[i]->UpdateDirHandle(mStoreDirectory);
+  }
+
+  // Directory where to move a backup before an update.
+  rv = mCacheDirectory->Clone(getter_AddRefs(mBackupDirectory));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = mBackupDirectory->AppendNative(STORE_DIRECTORY + BACKUP_DIR_SUFFIX);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // Directory where to move the backup so we can atomically
+  // delete (really move) it.
+  rv = mCacheDirectory->Clone(getter_AddRefs(mToDeleteDirectory));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = mToDeleteDirectory->AppendNative(STORE_DIRECTORY + TO_DELETE_DIR_SUFFIX);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return NS_OK;
+}
+
+nsresult
+Classifier::CreateStoreDirectory()
+{
+  // Ensure the safebrowsing directory exists.
+  bool storeExists;
+  nsresult rv = mStoreDirectory->Exists(&storeExists);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (!storeExists) {
+    rv = mStoreDirectory->Create(nsIFile::DIRECTORY_TYPE, 0755);
+    NS_ENSURE_SUCCESS(rv, rv);
+  } else {
+    bool storeIsDir;
+    rv = mStoreDirectory->IsDirectory(&storeIsDir);
+    NS_ENSURE_SUCCESS(rv, rv);
+    if (!storeIsDir)
+      return NS_ERROR_FILE_DESTINATION_NOT_DIR;
+  }
+
+  return NS_OK;
+}
+
+nsresult
+Classifier::Open(nsIFile& aCacheDirectory)
+{
+  // Remember the Local profile directory.
+  nsresult rv = aCacheDirectory.Clone(getter_AddRefs(mCacheDirectory));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // Create the handles to the update and backup directories.
+  rv = SetupPathNames();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // Clean up any to-delete directories that haven't been deleted yet.
+  rv = CleanToDelete();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // Check whether we have an incomplete update and recover from the
+  // backup if so.
+  rv = RecoverBackups();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // Make sure the main store directory exists.
+  rv = CreateStoreDirectory();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  mCryptoHash = do_CreateInstance(NS_CRYPTO_HASH_CONTRACTID, &rv);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // Build the list of know urlclassifier lists
+  // XXX: Disk IO potentially on the main thread during startup
+  RegenActiveTables();
+
+  return NS_OK;
+}
+
+void
+Classifier::Close()
+{
+  DropStores();
+}
+
+void
+Classifier::Reset()
+{
+  DropStores();
+
+  mStoreDirectory->Remove(true);
+  mBackupDirectory->Remove(true);
+  mToDeleteDirectory->Remove(true);
+
+  CreateStoreDirectory();
+
+  mTableFreshness.Clear();
+  RegenActiveTables();
+}
+
+void
+Classifier::TableRequest(nsACString& aResult)
+{
+  nsTArray<nsCString> tables;
+  ActiveTables(tables);
+  for (uint32_t i = 0; i < tables.Length(); i++) {
+    HashStore store(tables[i], mStoreDirectory);
+
+    nsresult rv = store.Open();
+    if (NS_FAILED(rv))
+      continue;
+
+    aResult.Append(store.TableName());
+    aResult.Append(';');
+
+    ChunkSet &adds = store.AddChunks();
+    ChunkSet &subs = store.SubChunks();
+
+    if (adds.Length() > 0) {
+      aResult.AppendLiteral("a:");
+      nsAutoCString addList;
+      adds.Serialize(addList);
+      aResult.Append(addList);
+    }
+
+    if (subs.Length() > 0) {
+      if (adds.Length() > 0)
+        aResult.Append(':');
+      aResult.AppendLiteral("s:");
+      nsAutoCString subList;
+      subs.Serialize(subList);
+      aResult.Append(subList);
+    }
+
+    aResult.Append('\n');
+  }
+}
+
+nsresult
+Classifier::Check(const nsACString& aSpec,
+                  const nsACString& aTables,
+                  uint32_t aFreshnessGuarantee,
+                  LookupResultArray& aResults)
+{
+  Telemetry::AutoTimer<Telemetry::URLCLASSIFIER_CL_CHECK_TIME> timer;
+
+  // Get the set of fragments based on the url. This is necessary because we
+  // only look up at most 5 URLs per aSpec, even if aSpec has more than 5
+  // components.
+  nsTArray<nsCString> fragments;
+  nsresult rv = LookupCache::GetLookupFragments(aSpec, &fragments);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsTArray<nsCString> activeTables;
+  SplitTables(aTables, activeTables);
+
+  nsTArray<LookupCache*> cacheArray;
+  for (uint32_t i = 0; i < activeTables.Length(); i++) {
+    LOG(("Checking table %s", activeTables[i].get()));
+    LookupCache *cache = GetLookupCache(activeTables[i]);
+    if (cache) {
+      cacheArray.AppendElement(cache);
+    } else {
+      return NS_ERROR_FAILURE;
+    }
+  }
+
+  // Now check each lookup fragment against the entries in the DB.
+  for (uint32_t i = 0; i < fragments.Length(); i++) {
+    Completion lookupHash;
+    lookupHash.FromPlaintext(fragments[i], mCryptoHash);
+
+    if (LOG_ENABLED()) {
+      nsAutoCString checking;
+      lookupHash.ToHexString(checking);
+      LOG(("Checking fragment %s, hash %s (%X)", fragments[i].get(),
+           checking.get(), lookupHash.ToUint32()));
+    }
+
+    for (uint32_t i = 0; i < cacheArray.Length(); i++) {
+      LookupCache *cache = cacheArray[i];
+      bool has, complete;
+      rv = cache->Has(lookupHash, &has, &complete);
+      NS_ENSURE_SUCCESS(rv, rv);
+      if (has) {
+        LookupResult *result = aResults.AppendElement();
+        if (!result)
+          return NS_ERROR_OUT_OF_MEMORY;
+
+        int64_t age;
+        bool found = mTableFreshness.Get(cache->TableName(), &age);
+        if (!found) {
+          age = 24 * 60 * 60; // just a large number
+        } else {
+          int64_t now = (PR_Now() / PR_USEC_PER_SEC);
+          age = now - age;
+        }
+
+        LOG(("Found a result in %s: %s (Age: %Lds)",
+             cache->TableName().get(),
+             complete ? "complete." : "Not complete.",
+             age));
+
+        result->hash.complete = lookupHash;
+        result->mComplete = complete;
+        result->mFresh = (age < aFreshnessGuarantee);
+        result->mTableName.Assign(cache->TableName());
+      }
+    }
+
+  }
+
+  return NS_OK;
+}
+
+nsresult
+Classifier::ApplyUpdates(nsTArray<TableUpdate*>* aUpdates)
+{
+  Telemetry::AutoTimer<Telemetry::URLCLASSIFIER_CL_UPDATE_TIME> timer;
+
+  PRIntervalTime clockStart = 0;
+  if (LOG_ENABLED()) {
+    clockStart = PR_IntervalNow();
+  }
+
+  LOG(("Backup before update."));
+
+  nsresult rv = BackupTables();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  LOG(("Applying %d table updates.", aUpdates->Length()));
+
+  for (uint32_t i = 0; i < aUpdates->Length(); i++) {
+    // Previous ApplyTableUpdates() may have consumed this update..
+    if ((*aUpdates)[i]) {
+      // Run all updates for one table
+      nsCString updateTable(aUpdates->ElementAt(i)->TableName());
+      rv = ApplyTableUpdates(aUpdates, updateTable);
+      if (NS_FAILED(rv)) {
+        if (rv != NS_ERROR_OUT_OF_MEMORY) {
+          Reset();
+        }
+        return rv;
+      }
+    }
+  }
+  aUpdates->Clear();
+
+  rv = RegenActiveTables();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  LOG(("Cleaning up backups."));
+
+  // Move the backup directory away (signaling the transaction finished
+  // successfully). This is atomic.
+  rv = RemoveBackupTables();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // Do the actual deletion of the backup files.
+  rv = CleanToDelete();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  LOG(("Done applying updates."));
+
+  if (LOG_ENABLED()) {
+    PRIntervalTime clockEnd = PR_IntervalNow();
+    LOG(("update took %dms\n",
+         PR_IntervalToMilliseconds(clockEnd - clockStart)));
+  }
+
+  return NS_OK;
+}
+
+nsresult
+Classifier::MarkSpoiled(nsTArray<nsCString>& aTables)
+{
+  for (uint32_t i = 0; i < aTables.Length(); i++) {
+    LOG(("Spoiling table: %s", aTables[i].get()));
+    // Spoil this table by marking it as no known freshness
+    mTableFreshness.Remove(aTables[i]);
+    // Remove any cached Completes for this table
+    LookupCache *cache = GetLookupCache(aTables[i]);
+    if (cache) {
+      cache->ClearCompleteCache();
+    }
+  }
+  return NS_OK;
+}
+
+void
+Classifier::SetLastUpdateTime(const nsACString &aTable,
+                              uint64_t updateTime)
+{
+  LOG(("Marking table %s as last updated on %u",
+       PromiseFlatCString(aTable).get(), updateTime));
+  mTableFreshness.Put(aTable, updateTime / PR_MSEC_PER_SEC);
+}
+
+void
+Classifier::DropStores()
+{
+  for (uint32_t i = 0; i < mHashStores.Length(); i++) {
+    delete mHashStores[i];
+  }
+  mHashStores.Clear();
+  for (uint32_t i = 0; i < mLookupCaches.Length(); i++) {
+    delete mLookupCaches[i];
+  }
+  mLookupCaches.Clear();
+}
+
+nsresult
+Classifier::RegenActiveTables()
+{
+  mActiveTablesCache.Clear();
+
+  nsTArray<nsCString> foundTables;
+  ScanStoreDir(foundTables);
+
+  for (uint32_t i = 0; i < foundTables.Length(); i++) {
+    nsCString table(foundTables[i]);
+    HashStore store(table, mStoreDirectory);
+
+    nsresult rv = store.Open();
+    if (NS_FAILED(rv))
+      continue;
+
+    LookupCache *lookupCache = GetLookupCache(store.TableName());
+    if (!lookupCache) {
+      continue;
+    }
+
+    if (!lookupCache->IsPrimed())
+      continue;
+
+    const ChunkSet &adds = store.AddChunks();
+    const ChunkSet &subs = store.SubChunks();
+
+    if (adds.Length() == 0 && subs.Length() == 0)
+      continue;
+
+    LOG(("Active table: %s", store.TableName().get()));
+    mActiveTablesCache.AppendElement(store.TableName());
+  }
+
+  return NS_OK;
+}
+
+nsresult
+Classifier::ScanStoreDir(nsTArray<nsCString>& aTables)
+{
+  nsCOMPtr<nsISimpleEnumerator> entries;
+  nsresult rv = mStoreDirectory->GetDirectoryEntries(getter_AddRefs(entries));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  bool hasMore;
+  while (NS_SUCCEEDED(rv = entries->HasMoreElements(&hasMore)) && hasMore) {
+    nsCOMPtr<nsISupports> supports;
+    rv = entries->GetNext(getter_AddRefs(supports));
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    nsCOMPtr<nsIFile> file = do_QueryInterface(supports);
+
+    nsCString leafName;
+    rv = file->GetNativeLeafName(leafName);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    nsCString suffix(NS_LITERAL_CSTRING(".sbstore"));
+
+    int32_t dot = leafName.RFind(suffix, 0);
+    if (dot != -1) {
+      leafName.Cut(dot, suffix.Length());
+      aTables.AppendElement(leafName);
+    }
+  }
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return NS_OK;
+}
+
+nsresult
+Classifier::ActiveTables(nsTArray<nsCString>& aTables)
+{
+  aTables = mActiveTablesCache;
+  return NS_OK;
+}
+
+nsresult
+Classifier::CleanToDelete()
+{
+  bool exists;
+  nsresult rv = mToDeleteDirectory->Exists(&exists);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (exists) {
+    rv = mToDeleteDirectory->Remove(true);
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
+
+  return NS_OK;
+}
+
+nsresult
+Classifier::BackupTables()
+{
+  // We have to work in reverse here: first move the normal directory
+  // away to be the backup directory, then copy the files over
+  // to the normal directory. This ensures that if we crash the backup
+  // dir always has a valid, complete copy, instead of a partial one,
+  // because that's the one we will copy over the normal store dir.
+
+  nsCString backupDirName;
+  nsresult rv = mBackupDirectory->GetNativeLeafName(backupDirName);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCString storeDirName;
+  rv = mStoreDirectory->GetNativeLeafName(storeDirName);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = mStoreDirectory->MoveToNative(nullptr, backupDirName);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = mStoreDirectory->CopyToNative(nullptr, storeDirName);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // We moved some things to new places, so move the handles around, too.
+  rv = SetupPathNames();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return NS_OK;
+}
+
+nsresult
+Classifier::RemoveBackupTables()
+{
+  nsCString toDeleteName;
+  nsresult rv = mToDeleteDirectory->GetNativeLeafName(toDeleteName);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = mBackupDirectory->MoveToNative(nullptr, toDeleteName);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // mBackupDirectory now points to toDelete, fix that up.
+  rv = SetupPathNames();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return NS_OK;
+}
+
+nsresult
+Classifier::RecoverBackups()
+{
+  bool backupExists;
+  nsresult rv = mBackupDirectory->Exists(&backupExists);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (backupExists) {
+    // Remove the safebrowsing dir if it exists
+    nsCString storeDirName;
+    rv = mStoreDirectory->GetNativeLeafName(storeDirName);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    bool storeExists;
+    rv = mStoreDirectory->Exists(&storeExists);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    if (storeExists) {
+      rv = mStoreDirectory->Remove(true);
+      NS_ENSURE_SUCCESS(rv, rv);
+    }
+
+    // Move the backup to the store location
+    rv = mBackupDirectory->MoveToNative(nullptr, storeDirName);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    // mBackupDirectory now points to storeDir, fix up.
+    rv = SetupPathNames();
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
+
+  return NS_OK;
+}
+
+/*
+ * This will consume+delete updates from the passed nsTArray.
+*/
+nsresult
+Classifier::ApplyTableUpdates(nsTArray<TableUpdate*>* aUpdates,
+                              const nsACString& aTable)
+{
+  LOG(("Classifier::ApplyTableUpdates(%s)", PromiseFlatCString(aTable).get()));
+
+  HashStore store(aTable, mStoreDirectory);
+
+  // take the quick exit if there is no valid update for us
+  // (common case)
+  uint32_t validupdates = 0;
+
+  for (uint32_t i = 0; i < aUpdates->Length(); i++) {
+    TableUpdate *update = aUpdates->ElementAt(i);
+    if (!update || !update->TableName().Equals(store.TableName()))
+      continue;
+    if (update->Empty()) {
+      aUpdates->ElementAt(i) = nullptr;
+      delete update;
+      continue;
+    }
+    validupdates++;
+  }
+
+  if (!validupdates) {
+    // This can happen if the update was only valid for one table.
+    return NS_OK;
+  }
+
+  nsresult rv = store.Open();
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = store.BeginUpdate();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // Read the part of the store that is (only) in the cache
+  LookupCache *prefixSet = GetLookupCache(store.TableName());
+  if (!prefixSet) {
+    return NS_ERROR_FAILURE;
+  }
+  FallibleTArray<uint32_t> AddPrefixHashes;
+  rv = prefixSet->GetPrefixes(AddPrefixHashes);
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = store.AugmentAdds(AddPrefixHashes);
+  NS_ENSURE_SUCCESS(rv, rv);
+  AddPrefixHashes.Clear();
+
+  uint32_t applied = 0;
+  bool updateFreshness = false;
+  bool hasCompletes = false;
+
+  for (uint32_t i = 0; i < aUpdates->Length(); i++) {
+    TableUpdate *update = aUpdates->ElementAt(i);
+    if (!update || !update->TableName().Equals(store.TableName()))
+      continue;
+
+    rv = store.ApplyUpdate(*update);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    applied++;
+
+    LOG(("Applied update to table %s:", store.TableName().get()));
+    LOG(("  %d add chunks", update->AddChunks().Length()));
+    LOG(("  %d add prefixes", update->AddPrefixes().Length()));
+    LOG(("  %d add completions", update->AddCompletes().Length()));
+    LOG(("  %d sub chunks", update->SubChunks().Length()));
+    LOG(("  %d sub prefixes", update->SubPrefixes().Length()));
+    LOG(("  %d sub completions", update->SubCompletes().Length()));
+    LOG(("  %d add expirations", update->AddExpirations().Length()));
+    LOG(("  %d sub expirations", update->SubExpirations().Length()));
+
+    if (!update->IsLocalUpdate()) {
+      updateFreshness = true;
+      LOG(("Remote update, updating freshness"));
+    }
+
+    if (update->AddCompletes().Length() > 0
+        || update->SubCompletes().Length() > 0) {
+      hasCompletes = true;
+      LOG(("Contains Completes, keeping cache."));
+    }
+
+    aUpdates->ElementAt(i) = nullptr;
+    delete update;
+  }
+
+  LOG(("Applied %d update(s) to %s.", applied, store.TableName().get()));
+
+  rv = store.Rebuild();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // Not an update with Completes, clear all completes data.
+  if (!hasCompletes) {
+    store.ClearCompletes();
+  }
+
+  LOG(("Table %s now has:", store.TableName().get()));
+  LOG(("  %d add chunks", store.AddChunks().Length()));
+  LOG(("  %d add prefixes", store.AddPrefixes().Length()));
+  LOG(("  %d add completions", store.AddCompletes().Length()));
+  LOG(("  %d sub chunks", store.SubChunks().Length()));
+  LOG(("  %d sub prefixes", store.SubPrefixes().Length()));
+  LOG(("  %d sub completions", store.SubCompletes().Length()));
+
+  rv = store.WriteFile();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // At this point the store is updated and written out to disk, but
+  // the data is still in memory.  Build our quick-lookup table here.
+  rv = prefixSet->Build(store.AddPrefixes(), store.AddCompletes());
+  NS_ENSURE_SUCCESS(rv, rv);
+
+#if defined(DEBUG)
+  prefixSet->Dump();
+#endif
+  rv = prefixSet->WriteFile();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (updateFreshness) {
+    int64_t now = (PR_Now() / PR_USEC_PER_SEC);
+    LOG(("Successfully updated %s", store.TableName().get()));
+    mTableFreshness.Put(store.TableName(), now);
+  }
+
+  return NS_OK;
+}
+
+LookupCache *
+Classifier::GetLookupCache(const nsACString& aTable)
+{
+  for (uint32_t i = 0; i < mLookupCaches.Length(); i++) {
+    if (mLookupCaches[i]->TableName().Equals(aTable)) {
+      return mLookupCaches[i];
+    }
+  }
+
+  LookupCache *cache = new LookupCache(aTable, mStoreDirectory);
+  nsresult rv = cache->Init();
+  if (NS_FAILED(rv)) {
+    return nullptr;
+  }
+  rv = cache->Open();
+  if (NS_FAILED(rv)) {
+    if (rv == NS_ERROR_FILE_CORRUPTED) {
+      Reset();
+    }
+    return nullptr;
+  }
+  mLookupCaches.AppendElement(cache);
+  return cache;
+}
+
+nsresult
+Classifier::ReadNoiseEntries(const Prefix& aPrefix,
+                             const nsACString& aTableName,
+                             uint32_t aCount,
+                             PrefixArray* aNoiseEntries)
+{
+  LookupCache *cache = GetLookupCache(aTableName);
+  if (!cache) {
+    return NS_ERROR_FAILURE;
+  }
+
+  FallibleTArray<uint32_t> prefixes;
+  nsresult rv = cache->GetPrefixes(prefixes);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  size_t idx = prefixes.BinaryIndexOf(aPrefix.ToUint32());
+
+  if (idx == nsTArray<uint32_t>::NoIndex) {
+    NS_WARNING("Could not find prefix in PrefixSet during noise lookup");
+    return NS_ERROR_FAILURE;
+  }
+
+  idx -= idx % aCount;
+
+  for (size_t i = 0; (i < aCount) && ((idx+i) < prefixes.Length()); i++) {
+    Prefix newPref;
+    newPref.FromUint32(prefixes[idx+i]);
+    if (newPref != aPrefix) {
+      aNoiseEntries->AppendElement(newPref);
+    }
+  }
+
+  return NS_OK;
+}
+
+} // namespace safebrowsing
+} // namespace mozilla
diff --git a/toolkit/components/url-classifier/Classifier.h b/toolkit/components/url-classifier/Classifier.h
new file mode 100644
index 0000000000..5587371998
--- /dev/null
+++ b/toolkit/components/url-classifier/Classifier.h
@@ -0,0 +1,111 @@
+//* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef Classifier_h__
+#define Classifier_h__
+
+#include "Entries.h"
+#include "HashStore.h"
+#include "ProtocolParser.h"
+#include "LookupCache.h"
+#include "nsCOMPtr.h"
+#include "nsString.h"
+#include "nsIFile.h"
+#include "nsICryptoHash.h"
+#include "nsDataHashtable.h"
+
+namespace mozilla {
+namespace safebrowsing {
+
+/**
+ * Maintains the stores and LookupCaches for the url classifier.
+ */
+class Classifier {
+public:
+  Classifier();
+  ~Classifier();
+
+  nsresult Open(nsIFile& aCacheDirectory);
+  void Close();
+  void Reset();
+
+  /**
+   * Get the list of active tables and their chunks in a format
+   * suitable for an update request.
+   */
+  void TableRequest(nsACString& aResult);
+
+  /*
+   * Get all tables that we know about.
+   */
+  nsresult ActiveTables(nsTArray<nsCString>& aTables);
+
+  /**
+   * Check a URL against the specified tables.
+   */
+  nsresult Check(const nsACString& aSpec,
+                 const nsACString& tables,
+                 uint32_t aFreshnessGuarantee,
+                 LookupResultArray& aResults);
+
+  /**
+   * Apply the table updates in the array.  Takes ownership of
+   * the updates in the array and clears it.  Wacky!
+   */
+  nsresult ApplyUpdates(nsTArray<TableUpdate*>* aUpdates);
+  /**
+   * Failed update. Spoil the entries so we don't block hosts
+   * unnecessarily
+   */
+  nsresult MarkSpoiled(nsTArray<nsCString>& aTables);
+  void SetLastUpdateTime(const nsACString& aTableName, uint64_t updateTime);
+  nsresult CacheCompletions(const CacheResultArray& aResults);
+  uint32_t GetHashKey(void) { return mHashKey; }
+  /*
+   * Get a bunch of extra prefixes to query for completion
+   * and mask the real entry being requested
+   */
+  nsresult ReadNoiseEntries(const Prefix& aPrefix,
+                            const nsACString& aTableName,
+                            uint32_t aCount,
+                            PrefixArray* aNoiseEntries);
+  static void SplitTables(const nsACString& str, nsTArray<nsCString>& tables);
+
+private:
+  void DropStores();
+  nsresult CreateStoreDirectory();
+  nsresult SetupPathNames();
+  nsresult RecoverBackups();
+  nsresult CleanToDelete();
+  nsresult BackupTables();
+  nsresult RemoveBackupTables();
+  nsresult RegenActiveTables();
+  nsresult ScanStoreDir(nsTArray<nsCString>& aTables);
+
+  nsresult ApplyTableUpdates(nsTArray<TableUpdate*>* aUpdates,
+                             const nsACString& aTable);
+
+  LookupCache *GetLookupCache(const nsACString& aTable);
+
+  // Root dir of the Local profile.
+  nsCOMPtr<nsIFile> mCacheDirectory;
+  // Main directory where to store the databases.
+  nsCOMPtr<nsIFile> mStoreDirectory;
+  // Used for atomically updating the other dirs.
+  nsCOMPtr<nsIFile> mBackupDirectory;
+  nsCOMPtr<nsIFile> mToDeleteDirectory;
+  nsCOMPtr<nsICryptoHash> mCryptoHash;
+  nsTArray<HashStore*> mHashStores;
+  nsTArray<LookupCache*> mLookupCaches;
+  nsTArray<nsCString> mActiveTablesCache;
+  uint32_t mHashKey;
+  // Stores the last time a given table was updated (seconds).
+  nsDataHashtable<nsCStringHashKey, int64_t> mTableFreshness;
+};
+
+} // namespace safebrowsing
+} // namespace mozilla
+
+#endif
diff --git a/toolkit/components/url-classifier/Entries.h b/toolkit/components/url-classifier/Entries.h
new file mode 100644
index 0000000000..fa5aaea684
--- /dev/null
+++ b/toolkit/components/url-classifier/Entries.h
@@ -0,0 +1,304 @@
+//* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+// This header file defines the storage types of the actual safebrowsing
+// chunk data, which may be either 32-bit hashes or complete 256-bit hashes.
+// Chunk numbers are represented in ChunkSet.h.
+
+#ifndef SBEntries_h__
+#define SBEntries_h__
+
+#include "nsTArray.h"
+#include "nsString.h"
+#include "nsICryptoHash.h"
+#include "nsNetUtil.h"
+#include "nsIOutputStream.h"
+
+#if DEBUG
+#include "plbase64.h"
+#endif
+
+namespace mozilla {
+namespace safebrowsing {
+
+#define PREFIX_SIZE   4
+#define COMPLETE_SIZE 32
+
+// This is the struct that contains 4-byte hash prefixes.
+template <uint32_t S, class Comparator>
+struct SafebrowsingHash
+{
+  static const uint32_t sHashSize = S;
+  typedef SafebrowsingHash<S, Comparator> self_type;
+  uint8_t buf[S];
+
+  nsresult FromPlaintext(const nsACString& aPlainText, nsICryptoHash* aHash) {
+    // From the protocol doc:
+    // Each entry in the chunk is composed
+    // of the SHA 256 hash of a suffix/prefix expression.
+
+    nsresult rv = aHash->Init(nsICryptoHash::SHA256);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    rv = aHash->Update
+      (reinterpret_cast<const uint8_t*>(aPlainText.BeginReading()),
+       aPlainText.Length());
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    nsAutoCString hashed;
+    rv = aHash->Finish(false, hashed);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    NS_ASSERTION(hashed.Length() >= sHashSize,
+                 "not enough characters in the hash");
+
+    memcpy(buf, hashed.BeginReading(), sHashSize);
+
+    return NS_OK;
+  }
+
+  void Assign(const nsACString& aStr) {
+    NS_ASSERTION(aStr.Length() >= sHashSize,
+                 "string must be at least sHashSize characters long");
+    memcpy(buf, aStr.BeginReading(), sHashSize);
+  }
+
+  int Compare(const self_type& aOther) const {
+    return Comparator::Compare(buf, aOther.buf);
+  }
+
+  bool operator==(const self_type& aOther) const {
+    return Comparator::Compare(buf, aOther.buf) == 0;
+  }
+
+  bool operator!=(const self_type& aOther) const {
+    return Comparator::Compare(buf, aOther.buf) != 0;
+  }
+
+  bool operator<(const self_type& aOther) const {
+    return Comparator::Compare(buf, aOther.buf) < 0;
+  }
+
+#ifdef DEBUG
+  void ToString(nsACString& aStr) const {
+    uint32_t len = ((sHashSize + 2) / 3) * 4;
+    aStr.SetCapacity(len + 1);
+    PL_Base64Encode((char*)buf, sHashSize, aStr.BeginWriting());
+    aStr.BeginWriting()[len] = '\0';
+  }
+#endif
+
+  void ToHexString(nsACString& aStr) const {
+    static const char* const lut = "0123456789ABCDEF";
+    // 32 bytes is the longest hash
+    size_t len = 32;
+
+    aStr.SetCapacity(2 * len);
+    for (size_t i = 0; i < len; ++i) {
+      const char c = static_cast<const char>(buf[i]);
+      aStr.Append(lut[(c >> 4) & 0x0F]);
+      aStr.Append(lut[c & 15]);
+    }
+  }
+
+  uint32_t ToUint32() const {
+      return *((uint32_t*)buf);
+  }
+  void FromUint32(uint32_t aHash) {
+      *((uint32_t*)buf) = aHash;
+  }
+};
+
+class PrefixComparator {
+public:
+  static int Compare(const uint8_t* a, const uint8_t* b) {
+      uint32_t first = *((uint32_t*)a);
+      uint32_t second = *((uint32_t*)b);
+      if (first > second) {
+          return 1;
+      } else if (first == second) {
+          return 0;
+      } else {
+          return -1;
+      }
+  }
+};
+// Use this for 4-byte hashes
+typedef SafebrowsingHash<PREFIX_SIZE, PrefixComparator> Prefix;
+typedef nsTArray<Prefix> PrefixArray;
+
+class CompletionComparator {
+public:
+  static int Compare(const uint8_t* a, const uint8_t* b) {
+    return memcmp(a, b, COMPLETE_SIZE);
+  }
+};
+// Use this for 32-byte hashes
+typedef SafebrowsingHash<COMPLETE_SIZE, CompletionComparator> Completion;
+typedef nsTArray<Completion> CompletionArray;
+
+struct AddPrefix {
+  // The truncated hash.
+  Prefix prefix;
+  // The chunk number to which it belongs.
+  uint32_t addChunk;
+
+  AddPrefix() : addChunk(0) {}
+
+  // Returns the chunk number.
+  uint32_t Chunk() const { return addChunk; }
+  const Prefix &PrefixHash() const { return prefix; }
+
+  template<class T>
+  int Compare(const T& other) const {
+    int cmp = prefix.Compare(other.PrefixHash());
+    if (cmp != 0) {
+      return cmp;
+    }
+    return addChunk - other.addChunk;
+  }
+};
+
+struct AddComplete {
+  Completion complete;
+  uint32_t addChunk;
+
+  AddComplete() : addChunk(0) {}
+
+  uint32_t Chunk() const { return addChunk; }
+  // The 4-byte prefix of the sha256 hash.
+  uint32_t ToUint32() const { return complete.ToUint32(); }
+  // The 32-byte sha256 hash.
+  const Completion &CompleteHash() const { return complete; }
+
+  template<class T>
+  int Compare(const T& other) const {
+    int cmp = complete.Compare(other.CompleteHash());
+    if (cmp != 0) {
+      return cmp;
+    }
+    return addChunk - other.addChunk;
+  }
+};
+
+struct SubPrefix {
+  // The hash to subtract.
+  Prefix prefix;
+  // The chunk number of the add chunk to which the hash belonged.
+  uint32_t addChunk;
+  // The chunk number of this sub chunk.
+  uint32_t subChunk;
+
+  SubPrefix(): addChunk(0), subChunk(0) {}
+
+  uint32_t Chunk() const { return subChunk; }
+  uint32_t AddChunk() const { return addChunk; }
+  const Prefix &PrefixHash() const { return prefix; }
+
+  template<class T>
+  // Returns 0 if and only if the chunks are the same in every way.
+  int Compare(const T& aOther) const {
+    int cmp = prefix.Compare(aOther.PrefixHash());
+    if (cmp != 0)
+      return cmp;
+    if (addChunk != aOther.addChunk)
+      return addChunk - aOther.addChunk;
+    return subChunk - aOther.subChunk;
+  }
+
+  template<class T>
+  int CompareAlt(const T& aOther) const {
+    Prefix other;
+    other.FromUint32(aOther.ToUint32());
+    int cmp = prefix.Compare(other);
+    if (cmp != 0)
+      return cmp;
+    return addChunk - aOther.addChunk;
+  }
+};
+
+struct SubComplete {
+  Completion complete;
+  uint32_t addChunk;
+  uint32_t subChunk;
+
+  SubComplete() : addChunk(0), subChunk(0) {}
+
+  uint32_t Chunk() const { return subChunk; }
+  uint32_t AddChunk() const { return addChunk; }
+  const Completion &CompleteHash() const { return complete; }
+  // The 4-byte prefix of the sha256 hash.
+  uint32_t ToUint32() const { return complete.ToUint32(); }
+
+  int Compare(const SubComplete& aOther) const {
+    int cmp = complete.Compare(aOther.complete);
+    if (cmp != 0)
+      return cmp;
+    if (addChunk != aOther.addChunk)
+      return addChunk - aOther.addChunk;
+    return subChunk - aOther.subChunk;
+  }
+};
+
+typedef FallibleTArray<AddPrefix>   AddPrefixArray;
+typedef FallibleTArray<AddComplete> AddCompleteArray;
+typedef FallibleTArray<SubPrefix>   SubPrefixArray;
+typedef FallibleTArray<SubComplete> SubCompleteArray;
+
+/**
+ * Compares chunks by their add chunk, then their prefix.
+ */
+template<class T>
+class EntryCompare {
+public:
+  typedef T elem_type;
+  static int Compare(const void* e1, const void* e2) {
+    const elem_type* a = static_cast<const elem_type*>(e1);
+    const elem_type* b = static_cast<const elem_type*>(e2);
+    return a->Compare(*b);
+  }
+};
+
+/**
+ * Sort an array of store entries.  nsTArray::Sort uses Equal/LessThan
+ * to sort, this does a single Compare so it's a bit quicker over the
+ * large sorts we do.
+ */
+template<class T, class Alloc>
+void
+EntrySort(nsTArray_Impl<T, Alloc>& aArray)
+{
+  qsort(aArray.Elements(), aArray.Length(), sizeof(T),
+        EntryCompare<T>::Compare);
+}
+
+template<class T, class Alloc>
+nsresult
+ReadTArray(nsIInputStream* aStream, nsTArray_Impl<T, Alloc>* aArray, uint32_t aNumElements)
+{
+  if (!aArray->SetLength(aNumElements, fallible))
+    return NS_ERROR_OUT_OF_MEMORY;
+
+  void *buffer = aArray->Elements();
+  nsresult rv = NS_ReadInputStreamToBuffer(aStream, &buffer,
+                                           (aNumElements * sizeof(T)));
+  NS_ENSURE_SUCCESS(rv, rv);
+  return NS_OK;
+}
+
+template<class T, class Alloc>
+nsresult
+WriteTArray(nsIOutputStream* aStream, nsTArray_Impl<T, Alloc>& aArray)
+{
+  uint32_t written;
+  return aStream->Write(reinterpret_cast<char*>(aArray.Elements()),
+                        aArray.Length() * sizeof(T),
+                        &written);
+}
+
+} // namespace safebrowsing
+} // namespace mozilla
+
+#endif // SBEntries_h__
diff --git a/toolkit/components/url-classifier/HashStore.cpp b/toolkit/components/url-classifier/HashStore.cpp
new file mode 100644
index 0000000000..935644da91
--- /dev/null
+++ b/toolkit/components/url-classifier/HashStore.cpp
@@ -0,0 +1,1058 @@
+//* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+// Originally based on Chrome sources:
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//    * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//    * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//    * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+#include "HashStore.h"
+#include "nsICryptoHash.h"
+#include "nsISeekableStream.h"
+#include "nsIStreamConverterService.h"
+#include "nsNetUtil.h"
+#include "nsCheckSummedOutputStream.h"
+#include "prio.h"
+#include "mozilla/Logging.h"
+#include "zlib.h"
+
+// Main store for SafeBrowsing protocol data. We store
+// known add/sub chunks, prefixes and completions in memory
+// during an update, and serialize to disk.
+// We do not store the add prefixes, those are retrieved by
+// decompressing the PrefixSet cache whenever we need to apply
+// an update.
+//
+// byte slicing: Many of the 4-byte values stored here are strongly
+// correlated in the upper bytes, and uncorrelated in the lower
+// bytes. Because zlib/DEFLATE requires match lengths of at least
+// 3 to achieve good compression, and we don't get those if only
+// the upper 16-bits are correlated, it is worthwhile to slice 32-bit
+// values into 4 1-byte slices and compress the slices individually.
+// The slices corresponding to MSBs will compress very well, and the
+// slice corresponding to LSB almost nothing. Because of this, we
+// only apply DEFLATE to the 3 most significant bytes, and store the
+// LSB uncompressed.
+//
+// byte sliced (numValues) data format:
+//    uint32_t compressed-size
+//    compressed-size bytes    zlib DEFLATE data
+//        0...numValues        byte MSB of 4-byte numValues data
+//    uint32_t compressed-size
+//    compressed-size bytes    zlib DEFLATE data
+//        0...numValues        byte 2nd byte of 4-byte numValues data
+//    uint32_t compressed-size
+//    compressed-size bytes    zlib DEFLATE data
+//        0...numValues        byte 3rd byte of 4-byte numValues data
+//    0...numValues            byte LSB of 4-byte numValues data
+//
+// Store data format:
+//    uint32_t magic
+//    uint32_t version
+//    uint32_t numAddChunks
+//    uint32_t numSubChunks
+//    uint32_t numAddPrefixes
+//    uint32_t numSubPrefixes
+//    uint32_t numAddCompletes
+//    uint32_t numSubCompletes
+//    0...numAddChunks               uint32_t addChunk
+//    0...numSubChunks               uint32_t subChunk
+//    byte sliced (numAddPrefixes)   uint32_t add chunk of AddPrefixes
+//    byte sliced (numSubPrefixes)   uint32_t add chunk of SubPrefixes
+//    byte sliced (numSubPrefixes)   uint32_t sub chunk of SubPrefixes
+//    byte sliced (numSubPrefixes)   uint32_t SubPrefixes
+//    0...numAddCompletes            32-byte Completions + uint32_t addChunk
+//    0...numSubCompletes            32-byte Completions + uint32_t addChunk
+//                                                       + uint32_t subChunk
+//    16-byte MD5 of all preceding data
+
+// Name of the SafeBrowsing store
+#define STORE_SUFFIX ".sbstore"
+
+// NSPR_LOG_MODULES=UrlClassifierDbService:5
+extern PRLogModuleInfo *gUrlClassifierDbServiceLog;
+#define LOG(args) MOZ_LOG(gUrlClassifierDbServiceLog, mozilla::LogLevel::Debug, args)
+#define LOG_ENABLED() MOZ_LOG_TEST(gUrlClassifierDbServiceLog, mozilla::LogLevel::Debug)
+
+// Either the return was successful or we call the Reset function (unless we
+// hit an OOM).  Used while reading in the store.
+#define SUCCESS_OR_RESET(res)                                             \
+  do {                                                                    \
+    nsresult __rv = res; /* Don't evaluate |res| more than once */        \
+    if (__rv == NS_ERROR_OUT_OF_MEMORY) {                                 \
+      NS_WARNING("SafeBrowsing OOM.");                                    \
+      return __rv;                                                        \
+    }                                                                     \
+    if (NS_FAILED(__rv)) {                                                \
+      NS_WARNING("SafeBrowsing store corrupted or out of date.");         \
+      Reset();                                                            \
+      return __rv;                                                        \
+    }                                                                     \
+  } while(0)
+
+namespace mozilla {
+namespace safebrowsing {
+
+const uint32_t STORE_MAGIC = 0x1231af3b;
+const uint32_t CURRENT_VERSION = 3;
+
+nsresult
+TableUpdate::NewAddPrefix(uint32_t aAddChunk, const Prefix& aHash)
+{
+  AddPrefix *add = mAddPrefixes.AppendElement(fallible);
+  if (!add) return NS_ERROR_OUT_OF_MEMORY;
+  add->addChunk = aAddChunk;
+  add->prefix = aHash;
+  return NS_OK;
+}
+
+nsresult
+TableUpdate::NewSubPrefix(uint32_t aAddChunk, const Prefix& aHash, uint32_t aSubChunk)
+{
+  SubPrefix *sub = mSubPrefixes.AppendElement(fallible);
+  if (!sub) return NS_ERROR_OUT_OF_MEMORY;
+  sub->addChunk = aAddChunk;
+  sub->prefix = aHash;
+  sub->subChunk = aSubChunk;
+  return NS_OK;
+}
+
+nsresult
+TableUpdate::NewAddComplete(uint32_t aAddChunk, const Completion& aHash)
+{
+  AddComplete *add = mAddCompletes.AppendElement(fallible);
+  if (!add) return NS_ERROR_OUT_OF_MEMORY;
+  add->addChunk = aAddChunk;
+  add->complete = aHash;
+  return NS_OK;
+}
+
+nsresult
+TableUpdate::NewSubComplete(uint32_t aAddChunk, const Completion& aHash, uint32_t aSubChunk)
+{
+  SubComplete *sub = mSubCompletes.AppendElement(fallible);
+  if (!sub) return NS_ERROR_OUT_OF_MEMORY;
+  sub->addChunk = aAddChunk;
+  sub->complete = aHash;
+  sub->subChunk = aSubChunk;
+  return NS_OK;
+}
+
+HashStore::HashStore(const nsACString& aTableName, nsIFile* aStoreDir)
+  : mTableName(aTableName)
+  , mStoreDirectory(aStoreDir)
+  , mInUpdate(false)
+{
+}
+
+HashStore::~HashStore()
+{
+}
+
+nsresult
+HashStore::Reset()
+{
+  LOG(("HashStore resetting"));
+
+  nsCOMPtr<nsIFile> storeFile;
+  nsresult rv = mStoreDirectory->Clone(getter_AddRefs(storeFile));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = storeFile->AppendNative(mTableName + NS_LITERAL_CSTRING(STORE_SUFFIX));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = storeFile->Remove(false);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return NS_OK;
+}
+
+nsresult
+HashStore::CheckChecksum(nsIFile* aStoreFile,
+                         uint32_t aFileSize)
+{
+  // Check for file corruption by
+  // comparing the stored checksum to actual checksum of data
+  nsAutoCString hash;
+  nsAutoCString compareHash;
+  char *data;
+  uint32_t read;
+
+  nsresult rv = CalculateChecksum(hash, aFileSize, true);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  compareHash.GetMutableData(&data, hash.Length());
+
+  if (hash.Length() > aFileSize) {
+    NS_WARNING("SafeBrowing file not long enough to store its hash");
+    return NS_ERROR_FAILURE;
+  }
+  nsCOMPtr<nsISeekableStream> seekIn = do_QueryInterface(mInputStream);
+  rv = seekIn->Seek(nsISeekableStream::NS_SEEK_SET, aFileSize - hash.Length());
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = mInputStream->Read(data, hash.Length(), &read);
+  NS_ENSURE_SUCCESS(rv, rv);
+  NS_ASSERTION(read == hash.Length(), "Could not read hash bytes");
+
+  if (!hash.Equals(compareHash)) {
+    NS_WARNING("Safebrowing file failed checksum.");
+    return NS_ERROR_FAILURE;
+  }
+
+  return NS_OK;
+}
+
+nsresult
+HashStore::Open()
+{
+  nsCOMPtr<nsIFile> storeFile;
+  nsresult rv = mStoreDirectory->Clone(getter_AddRefs(storeFile));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = storeFile->AppendNative(mTableName + NS_LITERAL_CSTRING(".sbstore"));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIInputStream> origStream;
+  rv = NS_NewLocalFileInputStream(getter_AddRefs(origStream), storeFile,
+                                  PR_RDONLY | nsIFile::OS_READAHEAD);
+
+  if (rv == NS_ERROR_FILE_NOT_FOUND) {
+    UpdateHeader();
+    return NS_OK;
+  } else {
+    SUCCESS_OR_RESET(rv);
+  }
+
+  int64_t fileSize;
+  rv = storeFile->GetFileSize(&fileSize);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (fileSize < 0 || fileSize > UINT32_MAX) {
+    return NS_ERROR_FAILURE;
+  }
+
+  uint32_t fileSize32 = static_cast<uint32_t>(fileSize);
+
+  rv = NS_NewBufferedInputStream(getter_AddRefs(mInputStream), origStream,
+                                 fileSize32);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = CheckChecksum(storeFile, fileSize32);
+  SUCCESS_OR_RESET(rv);
+
+  rv = ReadHeader();
+  SUCCESS_OR_RESET(rv);
+
+  rv = SanityCheck();
+  SUCCESS_OR_RESET(rv);
+
+  rv = ReadChunkNumbers();
+  SUCCESS_OR_RESET(rv);
+
+  return NS_OK;
+}
+
+nsresult
+HashStore::ReadHeader()
+{
+  if (!mInputStream) {
+    UpdateHeader();
+    return NS_OK;
+  }
+
+  nsCOMPtr<nsISeekableStream> seekable = do_QueryInterface(mInputStream);
+  nsresult rv = seekable->Seek(nsISeekableStream::NS_SEEK_SET, 0);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  void *buffer = &mHeader;
+  rv = NS_ReadInputStreamToBuffer(mInputStream,
+                                  &buffer,
+                                  sizeof(Header));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return NS_OK;
+}
+
+nsresult
+HashStore::SanityCheck()
+{
+  if (mHeader.magic != STORE_MAGIC || mHeader.version != CURRENT_VERSION) {
+    NS_WARNING("Unexpected header data in the store.");
+    return NS_ERROR_FAILURE;
+  }
+
+  return NS_OK;
+}
+
+nsresult
+HashStore::CalculateChecksum(nsAutoCString& aChecksum,
+                             uint32_t aFileSize,
+                             bool aChecksumPresent)
+{
+  aChecksum.Truncate();
+
+  // Reset mInputStream to start
+  nsCOMPtr<nsISeekableStream> seekable = do_QueryInterface(mInputStream);
+  nsresult rv = seekable->Seek(nsISeekableStream::NS_SEEK_SET, 0);
+
+  nsCOMPtr<nsICryptoHash> hash = do_CreateInstance(NS_CRYPTO_HASH_CONTRACTID, &rv);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // Size of MD5 hash in bytes
+  const uint32_t CHECKSUM_SIZE = 16;
+
+  // MD5 is not a secure hash function, but since this is a filesystem integrity
+  // check, this usage is ok.
+  rv = hash->Init(nsICryptoHash::MD5);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (!aChecksumPresent) {
+    // Hash entire file
+    rv = hash->UpdateFromStream(mInputStream, UINT32_MAX);
+  } else {
+    // Hash everything but last checksum bytes
+    if (aFileSize < CHECKSUM_SIZE) {
+      NS_WARNING("SafeBrowsing file isn't long enough to store its checksum");
+      return NS_ERROR_FAILURE;
+    }
+    rv = hash->UpdateFromStream(mInputStream, aFileSize - CHECKSUM_SIZE);
+  }
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = hash->Finish(false, aChecksum);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return NS_OK;
+}
+
+void
+HashStore::UpdateHeader()
+{
+  mHeader.magic = STORE_MAGIC;
+  mHeader.version = CURRENT_VERSION;
+
+  mHeader.numAddChunks = mAddChunks.Length();
+  mHeader.numSubChunks = mSubChunks.Length();
+  mHeader.numAddPrefixes = mAddPrefixes.Length();
+  mHeader.numSubPrefixes = mSubPrefixes.Length();
+  mHeader.numAddCompletes = mAddCompletes.Length();
+  mHeader.numSubCompletes = mSubCompletes.Length();
+}
+
+nsresult
+HashStore::ReadChunkNumbers()
+{
+  NS_ENSURE_STATE(mInputStream);
+
+  nsCOMPtr<nsISeekableStream> seekable = do_QueryInterface(mInputStream);
+  nsresult rv = seekable->Seek(nsISeekableStream::NS_SEEK_SET,
+                               sizeof(Header));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = mAddChunks.Read(mInputStream, mHeader.numAddChunks);
+  NS_ENSURE_SUCCESS(rv, rv);
+  NS_ASSERTION(mAddChunks.Length() == mHeader.numAddChunks, "Read the right amount of add chunks.");
+
+  rv = mSubChunks.Read(mInputStream, mHeader.numSubChunks);
+  NS_ENSURE_SUCCESS(rv, rv);
+  NS_ASSERTION(mSubChunks.Length() == mHeader.numSubChunks, "Read the right amount of sub chunks.");
+
+  return NS_OK;
+}
+
+nsresult
+HashStore::ReadHashes()
+{
+  if (!mInputStream) {
+    // BeginUpdate has been called but Open hasn't initialized mInputStream,
+    // because the existing HashStore is empty.
+    return NS_OK;
+  }
+
+  nsCOMPtr<nsISeekableStream> seekable = do_QueryInterface(mInputStream);
+
+  uint32_t offset = sizeof(Header);
+  offset += (mHeader.numAddChunks + mHeader.numSubChunks) * sizeof(uint32_t);
+  nsresult rv = seekable->Seek(nsISeekableStream::NS_SEEK_SET, offset);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = ReadAddPrefixes();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = ReadSubPrefixes();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = ReadTArray(mInputStream, &mAddCompletes, mHeader.numAddCompletes);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = ReadTArray(mInputStream, &mSubCompletes, mHeader.numSubCompletes);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return NS_OK;
+}
+
+nsresult
+HashStore::BeginUpdate()
+{
+  // Read the rest of the store in memory.
+  nsresult rv = ReadHashes();
+  SUCCESS_OR_RESET(rv);
+
+  // Close input stream, won't be needed any more and
+  // we will rewrite ourselves.
+  if (mInputStream) {
+    rv = mInputStream->Close();
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
+
+  mInUpdate = true;
+
+  return NS_OK;
+}
+
+template<class T>
+static nsresult
+Merge(ChunkSet* aStoreChunks,
+      FallibleTArray<T>* aStorePrefixes,
+      ChunkSet& aUpdateChunks,
+      FallibleTArray<T>& aUpdatePrefixes,
+      bool aAllowMerging = false)
+{
+  EntrySort(aUpdatePrefixes);
+
+  T* updateIter = aUpdatePrefixes.Elements();
+  T* updateEnd = aUpdatePrefixes.Elements() + aUpdatePrefixes.Length();
+
+  T* storeIter = aStorePrefixes->Elements();
+  T* storeEnd = aStorePrefixes->Elements() + aStorePrefixes->Length();
+
+  // use a separate array so we can keep the iterators valid
+  // if the nsTArray grows
+  nsTArray<T> adds;
+
+  for (; updateIter != updateEnd; updateIter++) {
+    // skip this chunk if we already have it, unless we're
+    // merging completions, in which case we'll always already
+    // have the chunk from the original prefix
+    if (aStoreChunks->Has(updateIter->Chunk()))
+      if (!aAllowMerging)
+        continue;
+    // XXX: binary search for insertion point might be faster in common
+    // case?
+    while (storeIter < storeEnd && (storeIter->Compare(*updateIter) < 0)) {
+      // skip forward to matching element (or not...)
+      storeIter++;
+    }
+    // no match, add
+    if (storeIter == storeEnd
+        || storeIter->Compare(*updateIter) != 0) {
+      if (!adds.AppendElement(*updateIter))
+        return NS_ERROR_OUT_OF_MEMORY;
+    }
+  }
+
+  // Chunks can be empty, but we should still report we have them
+  // to make the chunkranges continuous.
+  aStoreChunks->Merge(aUpdateChunks);
+
+  aStorePrefixes->AppendElements(adds, fallible);
+  EntrySort(*aStorePrefixes);
+
+  return NS_OK;
+}
+
+nsresult
+HashStore::ApplyUpdate(TableUpdate &update)
+{
+  nsresult rv = mAddExpirations.Merge(update.AddExpirations());
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = mSubExpirations.Merge(update.SubExpirations());
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = Expire();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = Merge(&mAddChunks, &mAddPrefixes,
+             update.AddChunks(), update.AddPrefixes());
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = Merge(&mAddChunks, &mAddCompletes,
+             update.AddChunks(), update.AddCompletes(), true);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = Merge(&mSubChunks, &mSubPrefixes,
+             update.SubChunks(), update.SubPrefixes());
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = Merge(&mSubChunks, &mSubCompletes,
+             update.SubChunks(), update.SubCompletes(), true);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return NS_OK;
+}
+
+nsresult
+HashStore::Rebuild()
+{
+  NS_ASSERTION(mInUpdate, "Must be in update to rebuild.");
+
+  nsresult rv = ProcessSubs();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  UpdateHeader();
+
+  return NS_OK;
+}
+
+void
+HashStore::ClearCompletes()
+{
+  NS_ASSERTION(mInUpdate, "Must be in update to clear completes.");
+
+  mAddCompletes.Clear();
+  mSubCompletes.Clear();
+
+  UpdateHeader();
+}
+
+template<class T>
+static void
+ExpireEntries(FallibleTArray<T>* aEntries, ChunkSet& aExpirations)
+{
+  T* addIter = aEntries->Elements();
+  T* end = aEntries->Elements() + aEntries->Length();
+
+  for (T *iter = addIter; iter != end; iter++) {
+    if (!aExpirations.Has(iter->Chunk())) {
+      *addIter = *iter;
+      addIter++;
+    }
+  }
+
+  aEntries->TruncateLength(addIter - aEntries->Elements());
+}
+
+nsresult
+HashStore::Expire()
+{
+  ExpireEntries(&mAddPrefixes, mAddExpirations);
+  ExpireEntries(&mAddCompletes, mAddExpirations);
+  ExpireEntries(&mSubPrefixes, mSubExpirations);
+  ExpireEntries(&mSubCompletes, mSubExpirations);
+
+  mAddChunks.Remove(mAddExpirations);
+  mSubChunks.Remove(mSubExpirations);
+
+  mAddExpirations.Clear();
+  mSubExpirations.Clear();
+
+  return NS_OK;
+}
+
+template<class T>
+nsresult DeflateWriteTArray(nsIOutputStream* aStream, nsTArray<T>& aIn)
+{
+  uLongf insize = aIn.Length() * sizeof(T);
+  uLongf outsize = compressBound(insize);
+  FallibleTArray<char> outBuff;
+  if (!outBuff.SetLength(outsize, fallible)) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  int zerr = compress(reinterpret_cast<Bytef*>(outBuff.Elements()),
+                      &outsize,
+                      reinterpret_cast<const Bytef*>(aIn.Elements()),
+                      insize);
+  if (zerr != Z_OK) {
+    return NS_ERROR_FAILURE;
+  }
+  LOG(("DeflateWriteTArray: %d in %d out", insize, outsize));
+
+  outBuff.TruncateLength(outsize);
+
+  // Length of compressed data stream
+  uint32_t dataLen = outBuff.Length();
+  uint32_t written;
+  nsresult rv = aStream->Write(reinterpret_cast<char*>(&dataLen), sizeof(dataLen), &written);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  NS_ASSERTION(written == sizeof(dataLen), "Error writing deflate length");
+
+  // Store to stream
+  rv = WriteTArray(aStream, outBuff);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return NS_OK;
+}
+
+template<class T>
+nsresult InflateReadTArray(nsIInputStream* aStream, FallibleTArray<T>* aOut,
+                           uint32_t aExpectedSize)
+{
+
+  uint32_t inLen;
+  uint32_t read;
+  nsresult rv = aStream->Read(reinterpret_cast<char*>(&inLen), sizeof(inLen), &read);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  NS_ASSERTION(read == sizeof(inLen), "Error reading inflate length");
+
+  FallibleTArray<char> inBuff;
+  if (!inBuff.SetLength(inLen, fallible)) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  rv = ReadTArray(aStream, &inBuff, inLen);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  uLongf insize = inLen;
+  uLongf outsize = aExpectedSize * sizeof(T);
+  if (!aOut->SetLength(aExpectedSize, fallible)) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  int zerr = uncompress(reinterpret_cast<Bytef*>(aOut->Elements()),
+                        &outsize,
+                        reinterpret_cast<const Bytef*>(inBuff.Elements()),
+                        insize);
+  if (zerr != Z_OK) {
+    return NS_ERROR_FAILURE;
+  }
+  LOG(("InflateReadTArray: %d in %d out", insize, outsize));
+
+  NS_ASSERTION(outsize == aExpectedSize * sizeof(T), "Decompression size mismatch");
+
+  return NS_OK;
+}
+
+static nsresult
+ByteSliceWrite(nsIOutputStream* aOut, nsTArray<uint32_t>& aData)
+{
+  nsTArray<uint8_t> slice1;
+  nsTArray<uint8_t> slice2;
+  nsTArray<uint8_t> slice3;
+  nsTArray<uint8_t> slice4;
+  uint32_t count = aData.Length();
+
+  slice1.SetCapacity(count);
+  slice2.SetCapacity(count);
+  slice3.SetCapacity(count);
+  slice4.SetCapacity(count);
+
+  for (uint32_t i = 0; i < count; i++) {
+    slice1.AppendElement( aData[i] >> 24);
+    slice2.AppendElement((aData[i] >> 16) & 0xFF);
+    slice3.AppendElement((aData[i] >>  8) & 0xFF);
+    slice4.AppendElement( aData[i]        & 0xFF);
+  }
+
+  nsresult rv = DeflateWriteTArray(aOut, slice1);
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = DeflateWriteTArray(aOut, slice2);
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = DeflateWriteTArray(aOut, slice3);
+  NS_ENSURE_SUCCESS(rv, rv);
+  // The LSB slice is generally uncompressible, don't bother
+  // compressing it.
+  rv = WriteTArray(aOut, slice4);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return NS_OK;
+}
+
+static nsresult
+ByteSliceRead(nsIInputStream* aInStream, FallibleTArray<uint32_t>* aData, uint32_t count)
+{
+  FallibleTArray<uint8_t> slice1;
+  FallibleTArray<uint8_t> slice2;
+  FallibleTArray<uint8_t> slice3;
+  FallibleTArray<uint8_t> slice4;
+
+  nsresult rv = InflateReadTArray(aInStream, &slice1, count);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = InflateReadTArray(aInStream, &slice2, count);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = InflateReadTArray(aInStream, &slice3, count);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = ReadTArray(aInStream, &slice4, count);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (!aData->SetCapacity(count, fallible)) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  for (uint32_t i = 0; i < count; i++) {
+    aData->AppendElement((slice1[i] << 24) |
+                           (slice2[i] << 16) |
+                           (slice3[i] << 8) |
+                           (slice4[i]),
+                         fallible);
+  }
+
+  return NS_OK;
+}
+
+nsresult
+HashStore::ReadAddPrefixes()
+{
+  FallibleTArray<uint32_t> chunks;
+  uint32_t count = mHeader.numAddPrefixes;
+
+  nsresult rv = ByteSliceRead(mInputStream, &chunks, count);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (!mAddPrefixes.SetCapacity(count, fallible)) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+  for (uint32_t i = 0; i < count; i++) {
+    AddPrefix *add = mAddPrefixes.AppendElement(fallible);
+    add->prefix.FromUint32(0);
+    add->addChunk = chunks[i];
+  }
+
+  return NS_OK;
+}
+
+nsresult
+HashStore::ReadSubPrefixes()
+{
+  FallibleTArray<uint32_t> addchunks;
+  FallibleTArray<uint32_t> subchunks;
+  FallibleTArray<uint32_t> prefixes;
+  uint32_t count = mHeader.numSubPrefixes;
+
+  nsresult rv = ByteSliceRead(mInputStream, &addchunks, count);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = ByteSliceRead(mInputStream, &subchunks, count);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = ByteSliceRead(mInputStream, &prefixes, count);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (!mSubPrefixes.SetCapacity(count, fallible)) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+  for (uint32_t i = 0; i < count; i++) {
+    SubPrefix *sub = mSubPrefixes.AppendElement(fallible);
+    sub->addChunk = addchunks[i];
+    sub->prefix.FromUint32(prefixes[i]);
+    sub->subChunk = subchunks[i];
+  }
+
+  return NS_OK;
+}
+
+// Split up PrefixArray back into the constituents
+nsresult
+HashStore::WriteAddPrefixes(nsIOutputStream* aOut)
+{
+  nsTArray<uint32_t> chunks;
+  uint32_t count = mAddPrefixes.Length();
+  chunks.SetCapacity(count);
+
+  for (uint32_t i = 0; i < count; i++) {
+    chunks.AppendElement(mAddPrefixes[i].Chunk());
+  }
+
+  nsresult rv = ByteSliceWrite(aOut, chunks);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return NS_OK;
+}
+
+nsresult
+HashStore::WriteSubPrefixes(nsIOutputStream* aOut)
+{
+  nsTArray<uint32_t> addchunks;
+  nsTArray<uint32_t> subchunks;
+  nsTArray<uint32_t> prefixes;
+  uint32_t count = mSubPrefixes.Length();
+  addchunks.SetCapacity(count);
+  subchunks.SetCapacity(count);
+  prefixes.SetCapacity(count);
+
+  for (uint32_t i = 0; i < count; i++) {
+    addchunks.AppendElement(mSubPrefixes[i].AddChunk());
+    prefixes.AppendElement(mSubPrefixes[i].PrefixHash().ToUint32());
+    subchunks.AppendElement(mSubPrefixes[i].Chunk());
+  }
+
+  nsresult rv = ByteSliceWrite(aOut, addchunks);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = ByteSliceWrite(aOut, subchunks);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = ByteSliceWrite(aOut, prefixes);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return NS_OK;
+}
+
+nsresult
+HashStore::WriteFile()
+{
+  NS_ASSERTION(mInUpdate, "Must be in update to write database.");
+
+  nsCOMPtr<nsIFile> storeFile;
+  nsresult rv = mStoreDirectory->Clone(getter_AddRefs(storeFile));
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = storeFile->AppendNative(mTableName + NS_LITERAL_CSTRING(".sbstore"));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIOutputStream> out;
+  rv = NS_NewCheckSummedOutputStream(getter_AddRefs(out), storeFile,
+                                     PR_WRONLY | PR_TRUNCATE | PR_CREATE_FILE);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  uint32_t written;
+  rv = out->Write(reinterpret_cast<char*>(&mHeader), sizeof(mHeader), &written);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // Write chunk numbers.
+  rv = mAddChunks.Write(out);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = mSubChunks.Write(out);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // Write hashes.
+  rv = WriteAddPrefixes(out);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = WriteSubPrefixes(out);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = WriteTArray(out, mAddCompletes);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = WriteTArray(out, mSubCompletes);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsISafeOutputStream> safeOut = do_QueryInterface(out, &rv);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = safeOut->Finish();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return NS_OK;
+}
+
+template <class T>
+static void
+Erase(FallibleTArray<T>* array, T* iterStart, T* iterEnd)
+{
+  uint32_t start = iterStart - array->Elements();
+  uint32_t count = iterEnd - iterStart;
+
+  if (count > 0) {
+    array->RemoveElementsAt(start, count);
+  }
+}
+
+// Find items matching between |subs| and |adds|, and remove them,
+// recording the item from |adds| in |adds_removed|.  To minimize
+// copies, the inputs are processing in parallel, so |subs| and |adds|
+// should be compatibly ordered (either by SBAddPrefixLess or
+// SBAddPrefixHashLess).
+//
+// |predAS| provides add < sub, |predSA| provides sub < add, for the
+// tightest compare appropriate (see calls in SBProcessSubs).
+template<class TSub, class TAdd>
+static void
+KnockoutSubs(FallibleTArray<TSub>* aSubs, FallibleTArray<TAdd>* aAdds)
+{
+  // Keep a pair of output iterators for writing kept items.  Due to
+  // deletions, these may lag the main iterators.  Using erase() on
+  // individual items would result in O(N^2) copies.  Using a list
+  // would work around that, at double or triple the memory cost.
+  TAdd* addOut = aAdds->Elements();
+  TAdd* addIter = aAdds->Elements();
+
+  TSub* subOut = aSubs->Elements();
+  TSub* subIter = aSubs->Elements();
+
+  TAdd* addEnd = addIter + aAdds->Length();
+  TSub* subEnd = subIter + aSubs->Length();
+
+  while (addIter != addEnd && subIter != subEnd) {
+    // additer compare, so it compares on add chunk
+    int32_t cmp = addIter->Compare(*subIter);
+    if (cmp > 0) {
+      // If |*sub_iter| < |*add_iter|, retain the sub.
+      *subOut = *subIter;
+      ++subOut;
+      ++subIter;
+    } else if (cmp < 0) {
+      // If |*add_iter| < |*sub_iter|, retain the add.
+      *addOut = *addIter;
+      ++addOut;
+      ++addIter;
+    } else {
+      // Drop equal items
+      ++addIter;
+      ++subIter;
+    }
+  }
+
+  Erase(aAdds, addOut, addIter);
+  Erase(aSubs, subOut, subIter);
+}
+
+// Remove items in |removes| from |fullHashes|.  |fullHashes| and
+// |removes| should be ordered by SBAddPrefix component.
+template <class T>
+static void
+RemoveMatchingPrefixes(const SubPrefixArray& aSubs, FallibleTArray<T>* aFullHashes)
+{
+  // Where to store kept items.
+  T* out = aFullHashes->Elements();
+  T* hashIter = out;
+  T* hashEnd = aFullHashes->Elements() + aFullHashes->Length();
+
+  SubPrefix const * removeIter = aSubs.Elements();
+  SubPrefix const * removeEnd = aSubs.Elements() + aSubs.Length();
+
+  while (hashIter != hashEnd && removeIter != removeEnd) {
+    int32_t cmp = removeIter->CompareAlt(*hashIter);
+    if (cmp > 0) {
+      // Keep items less than |*removeIter|.
+      *out = *hashIter;
+      ++out;
+      ++hashIter;
+    } else if (cmp < 0) {
+      // No hit for |*removeIter|, bump it forward.
+      ++removeIter;
+    } else {
+      // Drop equal items, there may be multiple hits.
+      do {
+        ++hashIter;
+      } while (hashIter != hashEnd &&
+               !(removeIter->CompareAlt(*hashIter) < 0));
+      ++removeIter;
+    }
+  }
+  Erase(aFullHashes, out, hashIter);
+}
+
+static void
+RemoveDeadSubPrefixes(SubPrefixArray& aSubs, ChunkSet& aAddChunks)
+{
+  SubPrefix * subIter = aSubs.Elements();
+  SubPrefix * subEnd = aSubs.Elements() + aSubs.Length();
+
+  for (SubPrefix * iter = subIter; iter != subEnd; iter++) {
+    bool hasChunk = aAddChunks.Has(iter->AddChunk());
+    // Keep the subprefix if the chunk it refers to is one
+    // we haven't seen it yet.
+    if (!hasChunk) {
+      *subIter = *iter;
+      subIter++;
+    }
+  }
+
+  LOG(("Removed %u dead SubPrefix entries.", subEnd - subIter));
+  aSubs.TruncateLength(subIter - aSubs.Elements());
+}
+
+#ifdef DEBUG
+template <class T>
+static void EnsureSorted(FallibleTArray<T>* aArray)
+{
+  T* start = aArray->Elements();
+  T* end = aArray->Elements() + aArray->Length();
+  T* iter = start;
+  T* previous = start;
+
+  while (iter != end) {
+    previous = iter;
+    ++iter;
+    if (iter != end) {
+      MOZ_ASSERT(iter->Compare(*previous) >= 0);
+    }
+  }
+
+  return;
+}
+#endif
+
+nsresult
+HashStore::ProcessSubs()
+{
+#ifdef DEBUG
+  EnsureSorted(&mAddPrefixes);
+  EnsureSorted(&mSubPrefixes);
+  EnsureSorted(&mAddCompletes);
+  EnsureSorted(&mSubCompletes);
+  LOG(("All databases seem to have a consistent sort order."));
+#endif
+
+  RemoveMatchingPrefixes(mSubPrefixes, &mAddCompletes);
+  RemoveMatchingPrefixes(mSubPrefixes, &mSubCompletes);
+
+  // Remove any remaining subbed prefixes from both addprefixes
+  // and addcompletes.
+  KnockoutSubs(&mSubPrefixes, &mAddPrefixes);
+  KnockoutSubs(&mSubCompletes, &mAddCompletes);
+
+  // Remove any remaining subprefixes referring to addchunks that
+  // we have (and hence have been processed above).
+  RemoveDeadSubPrefixes(mSubPrefixes, mAddChunks);
+
+#ifdef DEBUG
+  EnsureSorted(&mAddPrefixes);
+  EnsureSorted(&mSubPrefixes);
+  EnsureSorted(&mAddCompletes);
+  EnsureSorted(&mSubCompletes);
+  LOG(("All databases seem to have a consistent sort order."));
+#endif
+
+  return NS_OK;
+}
+
+nsresult
+HashStore::AugmentAdds(const nsTArray<uint32_t>& aPrefixes)
+{
+  uint32_t cnt = aPrefixes.Length();
+  if (cnt != mAddPrefixes.Length()) {
+    LOG(("Amount of prefixes in cache not consistent with store (%d vs %d)",
+         aPrefixes.Length(), mAddPrefixes.Length()));
+    return NS_ERROR_FAILURE;
+  }
+  for (uint32_t i = 0; i < cnt; i++) {
+    mAddPrefixes[i].prefix.FromUint32(aPrefixes[i]);
+  }
+  return NS_OK;
+}
+
+} // namespace safebrowsing
+} // namespace mozilla
diff --git a/toolkit/components/url-classifier/HashStore.h b/toolkit/components/url-classifier/HashStore.h
new file mode 100644
index 0000000000..f8799c30e4
--- /dev/null
+++ b/toolkit/components/url-classifier/HashStore.h
@@ -0,0 +1,211 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef HashStore_h__
+#define HashStore_h__
+
+#include "Entries.h"
+#include "ChunkSet.h"
+
+#include "nsString.h"
+#include "nsTArray.h"
+#include "nsIFile.h"
+#include "nsIFileStreams.h"
+#include "nsCOMPtr.h"
+
+namespace mozilla {
+namespace safebrowsing {
+
+// A table update is built from a single update chunk from the server. As the
+// protocol parser processes each chunk, it constructs a table update with the
+// new hashes.
+class TableUpdate {
+public:
+  explicit TableUpdate(const nsACString& aTable)
+      : mTable(aTable), mLocalUpdate(false) {}
+  const nsCString& TableName() const { return mTable; }
+
+  bool Empty() const {
+    return mAddChunks.Length() == 0 &&
+      mSubChunks.Length() == 0 &&
+      mAddExpirations.Length() == 0 &&
+      mSubExpirations.Length() == 0 &&
+      mAddPrefixes.Length() == 0 &&
+      mSubPrefixes.Length() == 0 &&
+      mAddCompletes.Length() == 0 &&
+      mSubCompletes.Length() == 0;
+  }
+
+  // Throughout, uint32_t aChunk refers only to the chunk number. Chunk data is
+  // stored in the Prefix structures.
+  MOZ_WARN_UNUSED_RESULT nsresult NewAddChunk(uint32_t aChunk) {
+    return mAddChunks.Set(aChunk);
+  };
+  MOZ_WARN_UNUSED_RESULT nsresult NewSubChunk(uint32_t aChunk) {
+    return mSubChunks.Set(aChunk);
+  };
+  MOZ_WARN_UNUSED_RESULT nsresult NewAddExpiration(uint32_t aChunk) {
+    return mAddExpirations.Set(aChunk);
+  };
+  MOZ_WARN_UNUSED_RESULT nsresult NewSubExpiration(uint32_t aChunk) {
+    return mSubExpirations.Set(aChunk);
+  };
+  MOZ_WARN_UNUSED_RESULT nsresult NewAddPrefix(uint32_t aAddChunk,
+                                               const Prefix& aPrefix);
+  MOZ_WARN_UNUSED_RESULT nsresult NewSubPrefix(uint32_t aAddChunk,
+                                               const Prefix& aPrefix,
+                                               uint32_t aSubChunk);
+  MOZ_WARN_UNUSED_RESULT nsresult NewAddComplete(uint32_t aChunk,
+                                                 const Completion& aCompletion);
+  MOZ_WARN_UNUSED_RESULT nsresult NewSubComplete(uint32_t aAddChunk,
+                                                 const Completion& aCompletion,
+                                                 uint32_t aSubChunk);
+  void SetLocalUpdate(void) { mLocalUpdate = true; }
+  bool IsLocalUpdate(void) { return mLocalUpdate; }
+
+  ChunkSet& AddChunks() { return mAddChunks; }
+  ChunkSet& SubChunks() { return mSubChunks; }
+
+  // Expirations for chunks.
+  ChunkSet& AddExpirations() { return mAddExpirations; }
+  ChunkSet& SubExpirations() { return mSubExpirations; }
+
+  // Hashes associated with this chunk.
+  AddPrefixArray& AddPrefixes() { return mAddPrefixes; }
+  SubPrefixArray& SubPrefixes() { return mSubPrefixes; }
+  AddCompleteArray& AddCompletes() { return mAddCompletes; }
+  SubCompleteArray& SubCompletes() { return mSubCompletes; }
+
+private:
+  nsCString mTable;
+  // Update not from the remote server (no freshness)
+  bool mLocalUpdate;
+
+  // The list of chunk numbers that we have for each of the type of chunks.
+  ChunkSet mAddChunks;
+  ChunkSet mSubChunks;
+  ChunkSet mAddExpirations;
+  ChunkSet mSubExpirations;
+
+  // 4-byte sha256 prefixes.
+  AddPrefixArray mAddPrefixes;
+  SubPrefixArray mSubPrefixes;
+
+  // 32-byte hashes.
+  AddCompleteArray mAddCompletes;
+  SubCompleteArray mSubCompletes;
+};
+
+// There is one hash store per table.
+class HashStore {
+public:
+  HashStore(const nsACString& aTableName, nsIFile* aStoreFile);
+  ~HashStore();
+
+  const nsCString& TableName() const { return mTableName; }
+
+  nsresult Open();
+  // Add Prefixes are stored partly in the PrefixSet (contains the
+  // Prefix data organized for fast lookup/low RAM usage) and partly in the
+  // HashStore (Add Chunk numbers - only used for updates, slow retrieval).
+  // AugmentAdds function joins the separate datasets into one complete
+  // prefixes+chunknumbers dataset.
+  nsresult AugmentAdds(const nsTArray<uint32_t>& aPrefixes);
+
+  ChunkSet& AddChunks() { return mAddChunks; }
+  ChunkSet& SubChunks() { return mSubChunks; }
+  AddPrefixArray& AddPrefixes() { return mAddPrefixes; }
+  AddCompleteArray& AddCompletes() { return mAddCompletes; }
+  SubPrefixArray& SubPrefixes() { return mSubPrefixes; }
+  SubCompleteArray& SubCompletes() { return mSubCompletes; }
+
+  // =======
+  // Updates
+  // =======
+  // Begin the update process.  Reads the store into memory.
+  nsresult BeginUpdate();
+
+  // Imports the data from a TableUpdate.
+  nsresult ApplyUpdate(TableUpdate &aUpdate);
+
+  // Process expired chunks
+  nsresult Expire();
+
+  // Rebuild the store, Incorporating all the applied updates.
+  nsresult Rebuild();
+
+  // Write the current state of the store to disk.
+  // If you call between ApplyUpdate() and Rebuild(), you'll
+  // have a mess on your hands.
+  nsresult WriteFile();
+
+  // Wipe out all Completes.
+  void ClearCompletes();
+
+private:
+  nsresult Reset();
+
+  nsresult ReadHeader();
+  nsresult SanityCheck();
+  nsresult CalculateChecksum(nsAutoCString& aChecksum, uint32_t aFileSize,
+                             bool aChecksumPresent);
+  nsresult CheckChecksum(nsIFile* aStoreFile, uint32_t aFileSize);
+  void UpdateHeader();
+
+  nsresult ReadChunkNumbers();
+  nsresult ReadHashes();
+
+  nsresult ReadAddPrefixes();
+  nsresult ReadSubPrefixes();
+
+  nsresult WriteAddPrefixes(nsIOutputStream* aOut);
+  nsresult WriteSubPrefixes(nsIOutputStream* aOut);
+
+  nsresult ProcessSubs();
+
+ // This is used for checking that the database is correct and for figuring out
+ // the number of chunks, etc. to read from disk on restart.
+  struct Header {
+    uint32_t magic;
+    uint32_t version;
+    uint32_t numAddChunks;
+    uint32_t numSubChunks;
+    uint32_t numAddPrefixes;
+    uint32_t numSubPrefixes;
+    uint32_t numAddCompletes;
+    uint32_t numSubCompletes;
+  };
+
+  Header mHeader;
+
+  // The name of the table (must end in -shavar or -digest256, or evidently
+  // -simple for unittesting.
+  nsCString mTableName;
+  nsCOMPtr<nsIFile> mStoreDirectory;
+
+  bool mInUpdate;
+
+  nsCOMPtr<nsIInputStream> mInputStream;
+
+  // Chunk numbers, stored as uint32_t arrays.
+  ChunkSet mAddChunks;
+  ChunkSet mSubChunks;
+
+  ChunkSet mAddExpirations;
+  ChunkSet mSubExpirations;
+
+  // Chunk data for shavar tables. See Entries.h for format.
+  AddPrefixArray mAddPrefixes;
+  SubPrefixArray mSubPrefixes;
+
+  // See bug 806422 for background. We must be able to distinguish between
+  // updates from the completion server and updates from the regular server.
+  AddCompleteArray mAddCompletes;
+  SubCompleteArray mSubCompletes;
+};
+
+} // namespace safebrowsing
+} // namespace mozilla
+
+#endif
diff --git a/toolkit/components/url-classifier/LookupCache.cpp b/toolkit/components/url-classifier/LookupCache.cpp
new file mode 100644
index 0000000000..7e2c2cf3f0
--- /dev/null
+++ b/toolkit/components/url-classifier/LookupCache.cpp
@@ -0,0 +1,651 @@
+//* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "LookupCache.h"
+#include "HashStore.h"
+#include "nsISeekableStream.h"
+#include "nsISafeOutputStream.h"
+#include "mozilla/Telemetry.h"
+#include "mozilla/Logging.h"
+#include "nsNetUtil.h"
+#include "prprf.h"
+
+// We act as the main entry point for all the real lookups,
+// so note that those are not done to the actual HashStore.
+// The latter solely exists to store the data needed to handle
+// the updates from the protocol.
+
+// This module has its own store, which stores the Completions,
+// mostly caching lookups that have happened over the net.
+// The prefixes are cached/checked by looking them up in the
+// PrefixSet.
+
+// Data format for the ".cache" files:
+//    uint32_t magic           Identify the file type
+//    uint32_t version         Version identifier for file format
+//    uint32_t numCompletions  Amount of completions stored
+//    0...numCompletions     256-bit Completions
+
+// Name of the lookupcomplete cache
+#define CACHE_SUFFIX ".cache"
+
+// Name of the persistent PrefixSet storage
+#define PREFIXSET_SUFFIX  ".pset"
+
+// NSPR_LOG_MODULES=UrlClassifierDbService:5
+extern PRLogModuleInfo *gUrlClassifierDbServiceLog;
+#define LOG(args) MOZ_LOG(gUrlClassifierDbServiceLog, mozilla::LogLevel::Debug, args)
+#define LOG_ENABLED() MOZ_LOG_TEST(gUrlClassifierDbServiceLog, mozilla::LogLevel::Debug)
+
+namespace mozilla {
+namespace safebrowsing {
+
+const uint32_t LOOKUPCACHE_MAGIC = 0x1231af3e;
+const uint32_t CURRENT_VERSION = 2;
+
+LookupCache::LookupCache(const nsACString& aTableName, nsIFile* aStoreDir)
+  : mPrimed(false)
+  , mTableName(aTableName)
+  , mStoreDirectory(aStoreDir)
+{
+}
+
+nsresult
+LookupCache::Init()
+{
+  mPrefixSet = new nsUrlClassifierPrefixSet();
+  nsresult rv = mPrefixSet->Init(mTableName);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return NS_OK;
+}
+
+LookupCache::~LookupCache()
+{
+}
+
+nsresult
+LookupCache::Open()
+{
+  nsCOMPtr<nsIFile> storeFile;
+
+  nsresult rv = mStoreDirectory->Clone(getter_AddRefs(storeFile));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = storeFile->AppendNative(mTableName + NS_LITERAL_CSTRING(CACHE_SUFFIX));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIInputStream> inputStream;
+  rv = NS_NewLocalFileInputStream(getter_AddRefs(inputStream), storeFile,
+                                  PR_RDONLY | nsIFile::OS_READAHEAD);
+
+  if (NS_FAILED(rv) && rv != NS_ERROR_FILE_NOT_FOUND) {
+    Reset();
+    return rv;
+  }
+
+  if (rv == NS_ERROR_FILE_NOT_FOUND) {
+    // Simply lacking a .cache file is a recoverable error,
+    // as unlike the .pset/.sbstore files it is a pure cache.
+    // Just create a new empty one.
+    ClearCompleteCache();
+  } else {
+    // Read in the .cache file
+    rv = ReadHeader(inputStream);
+    NS_ENSURE_SUCCESS(rv, rv);
+    LOG(("ReadCompletions"));
+    rv = ReadCompletions(inputStream);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    rv = inputStream->Close();
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
+
+  LOG(("Loading PrefixSet"));
+  rv = LoadPrefixSet();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return NS_OK;
+}
+
+nsresult
+LookupCache::UpdateDirHandle(nsIFile* aStoreDirectory)
+{
+  return aStoreDirectory->Clone(getter_AddRefs(mStoreDirectory));
+}
+
+nsresult
+LookupCache::Reset()
+{
+  LOG(("LookupCache resetting"));
+
+  nsCOMPtr<nsIFile> storeFile;
+  nsCOMPtr<nsIFile> prefixsetFile;
+  nsresult rv = mStoreDirectory->Clone(getter_AddRefs(storeFile));
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = mStoreDirectory->Clone(getter_AddRefs(prefixsetFile));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = storeFile->AppendNative(mTableName + NS_LITERAL_CSTRING(CACHE_SUFFIX));
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = prefixsetFile->AppendNative(mTableName + NS_LITERAL_CSTRING(PREFIXSET_SUFFIX));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = storeFile->Remove(false);
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = prefixsetFile->Remove(false);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  ClearAll();
+
+  return NS_OK;
+}
+
+
+nsresult
+LookupCache::Build(AddPrefixArray& aAddPrefixes,
+                   AddCompleteArray& aAddCompletes)
+{
+  Telemetry::Accumulate(Telemetry::URLCLASSIFIER_LC_COMPLETIONS,
+                        static_cast<uint32_t>(aAddCompletes.Length()));
+
+  mCompletions.Clear();
+  mCompletions.SetCapacity(aAddCompletes.Length());
+  for (uint32_t i = 0; i < aAddCompletes.Length(); i++) {
+    mCompletions.AppendElement(aAddCompletes[i].CompleteHash());
+  }
+  aAddCompletes.Clear();
+  mCompletions.Sort();
+
+  Telemetry::Accumulate(Telemetry::URLCLASSIFIER_LC_PREFIXES,
+                        static_cast<uint32_t>(aAddPrefixes.Length()));
+
+  nsresult rv = ConstructPrefixSet(aAddPrefixes);
+  NS_ENSURE_SUCCESS(rv, rv);
+  mPrimed = true;
+
+  return NS_OK;
+}
+
+#if defined(DEBUG)
+void
+LookupCache::Dump()
+{
+  if (!LOG_ENABLED())
+    return;
+
+  for (uint32_t i = 0; i < mCompletions.Length(); i++) {
+    nsAutoCString str;
+    mCompletions[i].ToHexString(str);
+    LOG(("Completion: %s", str.get()));
+  }
+}
+#endif
+
+nsresult
+LookupCache::Has(const Completion& aCompletion,
+                 bool* aHas, bool* aComplete)
+{
+  *aHas = *aComplete = false;
+
+  uint32_t prefix = aCompletion.ToUint32();
+
+  bool found;
+  nsresult rv = mPrefixSet->Contains(prefix, &found);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  LOG(("Probe in %s: %X, found %d", mTableName.get(), prefix, found));
+
+  if (found) {
+    *aHas = true;
+  }
+
+  if (mCompletions.BinaryIndexOf(aCompletion) != nsTArray<Completion>::NoIndex) {
+    LOG(("Complete in %s", mTableName.get()));
+    *aComplete = true;
+    *aHas = true;
+  }
+
+  return NS_OK;
+}
+
+nsresult
+LookupCache::WriteFile()
+{
+  nsCOMPtr<nsIFile> storeFile;
+  nsresult rv = mStoreDirectory->Clone(getter_AddRefs(storeFile));
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = storeFile->AppendNative(mTableName + NS_LITERAL_CSTRING(CACHE_SUFFIX));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIOutputStream> out;
+  rv = NS_NewSafeLocalFileOutputStream(getter_AddRefs(out), storeFile,
+                                       PR_WRONLY | PR_TRUNCATE | PR_CREATE_FILE);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  UpdateHeader();
+  LOG(("Writing %d completions", mHeader.numCompletions));
+
+  uint32_t written;
+  rv = out->Write(reinterpret_cast<char*>(&mHeader), sizeof(mHeader), &written);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = WriteTArray(out, mCompletions);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsISafeOutputStream> safeOut = do_QueryInterface(out);
+  rv = safeOut->Finish();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = EnsureSizeConsistent();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIFile> psFile;
+  rv = mStoreDirectory->Clone(getter_AddRefs(psFile));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = psFile->AppendNative(mTableName + NS_LITERAL_CSTRING(PREFIXSET_SUFFIX));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = mPrefixSet->StoreToFile(psFile);
+  NS_WARN_IF_FALSE(NS_SUCCEEDED(rv), "failed to store the prefixset");
+
+  return NS_OK;
+}
+
+void
+LookupCache::ClearAll()
+{
+  ClearCompleteCache();
+  mPrefixSet->SetPrefixes(nullptr, 0);
+  mPrimed = false;
+}
+
+void
+LookupCache::ClearCompleteCache()
+{
+  mCompletions.Clear();
+  UpdateHeader();
+}
+
+void
+LookupCache::UpdateHeader()
+{
+  mHeader.magic = LOOKUPCACHE_MAGIC;
+  mHeader.version = CURRENT_VERSION;
+  mHeader.numCompletions = mCompletions.Length();
+}
+
+nsresult
+LookupCache::EnsureSizeConsistent()
+{
+  nsCOMPtr<nsIFile> storeFile;
+  nsresult rv = mStoreDirectory->Clone(getter_AddRefs(storeFile));
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = storeFile->AppendNative(mTableName + NS_LITERAL_CSTRING(CACHE_SUFFIX));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  int64_t fileSize;
+  rv = storeFile->GetFileSize(&fileSize);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (fileSize < 0) {
+    return NS_ERROR_FAILURE;
+  }
+
+  int64_t expectedSize = sizeof(mHeader)
+                        + mHeader.numCompletions*sizeof(Completion);
+  if (expectedSize != fileSize) {
+    NS_WARNING("File length does not match. Probably corrupted.");
+    Reset();
+    return NS_ERROR_FILE_CORRUPTED;
+  }
+
+  return NS_OK;
+}
+
+nsresult
+LookupCache::ReadHeader(nsIInputStream* aInputStream)
+{
+  if (!aInputStream) {
+    ClearCompleteCache();
+    return NS_OK;
+  }
+
+  nsCOMPtr<nsISeekableStream> seekable = do_QueryInterface(aInputStream);
+  nsresult rv = seekable->Seek(nsISeekableStream::NS_SEEK_SET, 0);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  void *buffer = &mHeader;
+  rv = NS_ReadInputStreamToBuffer(aInputStream,
+                                  &buffer,
+                                  sizeof(Header));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (mHeader.magic != LOOKUPCACHE_MAGIC || mHeader.version != CURRENT_VERSION) {
+    NS_WARNING("Unexpected header data in the store.");
+    Reset();
+    return NS_ERROR_FILE_CORRUPTED;
+  }
+  LOG(("%d completions present", mHeader.numCompletions));
+
+  rv = EnsureSizeConsistent();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return NS_OK;
+}
+
+nsresult
+LookupCache::ReadCompletions(nsIInputStream* aInputStream)
+{
+  if (!mHeader.numCompletions) {
+    mCompletions.Clear();
+    return NS_OK;
+  }
+
+  nsCOMPtr<nsISeekableStream> seekable = do_QueryInterface(aInputStream);
+  nsresult rv = seekable->Seek(nsISeekableStream::NS_SEEK_SET, sizeof(Header));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = ReadTArray(aInputStream, &mCompletions, mHeader.numCompletions);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  LOG(("Read %d completions", mCompletions.Length()));
+
+  return NS_OK;
+}
+
+/* static */ bool
+LookupCache::IsCanonicalizedIP(const nsACString& aHost)
+{
+  // The canonicalization process will have left IP addresses in dotted
+  // decimal with no surprises.
+  uint32_t i1, i2, i3, i4;
+  char c;
+  if (PR_sscanf(PromiseFlatCString(aHost).get(), "%u.%u.%u.%u%c",
+                &i1, &i2, &i3, &i4, &c) == 4) {
+    return (i1 <= 0xFF && i2 <= 0xFF && i3 <= 0xFF && i4 <= 0xFF);
+  }
+
+  return false;
+}
+
+/* static */ nsresult
+LookupCache::GetLookupFragments(const nsACString& aSpec,
+                                nsTArray<nsCString>* aFragments)
+
+{
+  aFragments->Clear();
+
+  nsACString::const_iterator begin, end, iter;
+  aSpec.BeginReading(begin);
+  aSpec.EndReading(end);
+
+  iter = begin;
+  if (!FindCharInReadable('/', iter, end)) {
+    return NS_OK;
+  }
+
+  const nsCSubstring& host = Substring(begin, iter++);
+  nsAutoCString path;
+  path.Assign(Substring(iter, end));
+
+  /**
+   * From the protocol doc:
+   * For the hostname, the client will try at most 5 different strings.  They
+   * are:
+   * a) The exact hostname of the url
+   * b) The 4 hostnames formed by starting with the last 5 components and
+   *    successivly removing the leading component.  The top-level component
+   *    can be skipped. This is not done if the hostname is a numerical IP.
+   */
+  nsTArray<nsCString> hosts;
+  hosts.AppendElement(host);
+
+  if (!IsCanonicalizedIP(host)) {
+    host.BeginReading(begin);
+    host.EndReading(end);
+    int numHostComponents = 0;
+    while (RFindInReadable(NS_LITERAL_CSTRING("."), begin, end) &&
+           numHostComponents < MAX_HOST_COMPONENTS) {
+      // don't bother checking toplevel domains
+      if (++numHostComponents >= 2) {
+        host.EndReading(iter);
+        hosts.AppendElement(Substring(end, iter));
+      }
+      end = begin;
+      host.BeginReading(begin);
+    }
+  }
+
+  /**
+   * From the protocol doc:
+   * For the path, the client will also try at most 6 different strings.
+   * They are:
+   * a) the exact path of the url, including query parameters
+   * b) the exact path of the url, without query parameters
+   * c) the 4 paths formed by starting at the root (/) and
+   *    successively appending path components, including a trailing
+   *    slash.  This behavior should only extend up to the next-to-last
+   *    path component, that is, a trailing slash should never be
+   *    appended that was not present in the original url.
+   */
+  nsTArray<nsCString> paths;
+  nsAutoCString pathToAdd;
+
+  path.BeginReading(begin);
+  path.EndReading(end);
+  iter = begin;
+  if (FindCharInReadable('?', iter, end)) {
+    pathToAdd = Substring(begin, iter);
+    paths.AppendElement(pathToAdd);
+    end = iter;
+  }
+
+  int numPathComponents = 1;
+  iter = begin;
+  while (FindCharInReadable('/', iter, end) &&
+         numPathComponents < MAX_PATH_COMPONENTS) {
+    iter++;
+    pathToAdd.Assign(Substring(begin, iter));
+    paths.AppendElement(pathToAdd);
+    numPathComponents++;
+  }
+
+  // If we haven't already done so, add the full path
+  if (!pathToAdd.Equals(path)) {
+    paths.AppendElement(path);
+  }
+  // Check an empty path (for whole-domain blacklist entries)
+  paths.AppendElement(EmptyCString());
+
+  for (uint32_t hostIndex = 0; hostIndex < hosts.Length(); hostIndex++) {
+    for (uint32_t pathIndex = 0; pathIndex < paths.Length(); pathIndex++) {
+      nsCString key;
+      key.Assign(hosts[hostIndex]);
+      key.Append('/');
+      key.Append(paths[pathIndex]);
+      LOG(("Checking fragment %s", key.get()));
+
+      aFragments->AppendElement(key);
+    }
+  }
+
+  return NS_OK;
+}
+
+/* static */ nsresult
+LookupCache::GetHostKeys(const nsACString& aSpec,
+                         nsTArray<nsCString>* aHostKeys)
+{
+  nsACString::const_iterator begin, end, iter;
+  aSpec.BeginReading(begin);
+  aSpec.EndReading(end);
+
+  iter = begin;
+  if (!FindCharInReadable('/', iter, end)) {
+    return NS_OK;
+  }
+
+  const nsCSubstring& host = Substring(begin, iter);
+
+  if (IsCanonicalizedIP(host)) {
+    nsCString *key = aHostKeys->AppendElement();
+    if (!key)
+      return NS_ERROR_OUT_OF_MEMORY;
+
+    key->Assign(host);
+    key->Append("/");
+    return NS_OK;
+  }
+
+  nsTArray<nsCString> hostComponents;
+  ParseString(PromiseFlatCString(host), '.', hostComponents);
+
+  if (hostComponents.Length() < 2) {
+    // no host or toplevel host, this won't match anything in the db
+    return NS_OK;
+  }
+
+  // First check with two domain components
+  int32_t last = int32_t(hostComponents.Length()) - 1;
+  nsCString *lookupHost = aHostKeys->AppendElement();
+  if (!lookupHost)
+    return NS_ERROR_OUT_OF_MEMORY;
+
+  lookupHost->Assign(hostComponents[last - 1]);
+  lookupHost->Append(".");
+  lookupHost->Append(hostComponents[last]);
+  lookupHost->Append("/");
+
+  // Now check with three domain components
+  if (hostComponents.Length() > 2) {
+    nsCString *lookupHost2 = aHostKeys->AppendElement();
+    if (!lookupHost2)
+      return NS_ERROR_OUT_OF_MEMORY;
+    lookupHost2->Assign(hostComponents[last - 2]);
+    lookupHost2->Append(".");
+    lookupHost2->Append(*lookupHost);
+  }
+
+  return NS_OK;
+}
+
+bool LookupCache::IsPrimed()
+{
+  return mPrimed;
+}
+
+#ifdef DEBUG
+template <class T>
+static void EnsureSorted(T* aArray)
+{
+  typename T::elem_type* start = aArray->Elements();
+  typename T::elem_type* end = aArray->Elements() + aArray->Length();
+  typename T::elem_type* iter = start;
+  typename T::elem_type* previous = start;
+
+  while (iter != end) {
+    previous = iter;
+    ++iter;
+    if (iter != end) {
+      MOZ_ASSERT(*previous <= *iter);
+    }
+  }
+  return;
+}
+#endif
+
+nsresult
+LookupCache::ConstructPrefixSet(AddPrefixArray& aAddPrefixes)
+{
+  Telemetry::AutoTimer<Telemetry::URLCLASSIFIER_PS_CONSTRUCT_TIME> timer;
+
+  nsTArray<uint32_t> array;
+  array.SetCapacity(aAddPrefixes.Length());
+
+  for (uint32_t i = 0; i < aAddPrefixes.Length(); i++) {
+    array.AppendElement(aAddPrefixes[i].PrefixHash().ToUint32());
+  }
+  aAddPrefixes.Clear();
+
+#ifdef DEBUG
+  // PrefixSet requires sorted order
+  EnsureSorted(&array);
+#endif
+
+  // construct new one, replace old entries
+  nsresult rv = mPrefixSet->SetPrefixes(array.Elements(), array.Length());
+  if (NS_FAILED(rv)) {
+    goto error_bailout;
+  }
+
+#ifdef DEBUG
+  uint32_t size;
+  size = mPrefixSet->SizeInMemory();
+  LOG(("SB tree done, size = %d bytes\n", size));
+#endif
+
+  mPrimed = true;
+
+  return NS_OK;
+
+ error_bailout:
+  Telemetry::Accumulate(Telemetry::URLCLASSIFIER_PS_FAILURE, 1);
+  return rv;
+}
+
+nsresult
+LookupCache::LoadPrefixSet()
+{
+  nsCOMPtr<nsIFile> psFile;
+  nsresult rv = mStoreDirectory->Clone(getter_AddRefs(psFile));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = psFile->AppendNative(mTableName + NS_LITERAL_CSTRING(PREFIXSET_SUFFIX));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  bool exists;
+  rv = psFile->Exists(&exists);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (exists) {
+    LOG(("stored PrefixSet exists, loading from disk"));
+    rv = mPrefixSet->LoadFromFile(psFile);
+    if (NS_FAILED(rv)) {
+      if (rv == NS_ERROR_FILE_CORRUPTED) {
+        Reset();
+      }
+      return rv;
+    }
+    mPrimed = true;
+  } else {
+    LOG(("no (usable) stored PrefixSet found"));
+  }
+
+#ifdef DEBUG
+  if (mPrimed) {
+    uint32_t size = mPrefixSet->SizeInMemory();
+    LOG(("SB tree done, size = %d bytes\n", size));
+  }
+#endif
+
+  return NS_OK;
+}
+
+nsresult
+LookupCache::GetPrefixes(FallibleTArray<uint32_t>& aAddPrefixes)
+{
+  if (!mPrimed) {
+    // This can happen if its a new table, so no error.
+    LOG(("GetPrefixes from empty LookupCache"));
+    return NS_OK;
+  }
+  return mPrefixSet->GetPrefixesNative(aAddPrefixes);
+}
+
+
+} // namespace safebrowsing
+} // namespace mozilla
diff --git a/toolkit/components/url-classifier/LookupCache.h b/toolkit/components/url-classifier/LookupCache.h
new file mode 100644
index 0000000000..885c352e60
--- /dev/null
+++ b/toolkit/components/url-classifier/LookupCache.h
@@ -0,0 +1,145 @@
+//* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef LookupCache_h__
+#define LookupCache_h__
+
+#include "Entries.h"
+#include "nsString.h"
+#include "nsTArray.h"
+#include "nsCOMPtr.h"
+#include "nsIFile.h"
+#include "nsIFileStreams.h"
+#include "mozilla/RefPtr.h"
+#include "nsUrlClassifierPrefixSet.h"
+#include "mozilla/Logging.h"
+
+namespace mozilla {
+namespace safebrowsing {
+
+#define MAX_HOST_COMPONENTS 5
+#define MAX_PATH_COMPONENTS 4
+
+class LookupResult {
+public:
+  LookupResult() : mComplete(false), mNoise(false),
+                   mFresh(false), mProtocolConfirmed(false) {}
+
+  // The fragment that matched in the LookupCache
+  union {
+    Prefix prefix;
+    Completion complete;
+  } hash;
+
+  const Prefix &PrefixHash() {
+    return hash.prefix;
+  }
+  const Completion &CompleteHash() {
+    MOZ_ASSERT(!mNoise);
+    return hash.complete;
+  }
+
+  bool Confirmed() const { return (mComplete && mFresh) || mProtocolConfirmed; }
+  bool Complete() const { return mComplete; }
+
+  // True if we have a complete match for this hash in the table.
+  bool mComplete;
+
+  // True if this is a noise entry, i.e. an extra entry
+  // that is inserted to mask the true URL we are requesting.
+  // Noise entries will not have a complete 256-bit hash as
+  // they are fetched from the local 32-bit database and we
+  // don't know the corresponding full URL.
+  bool mNoise;
+
+  // True if we've updated this table recently-enough.
+  bool mFresh;
+
+  bool mProtocolConfirmed;
+
+  nsCString mTableName;
+};
+
+typedef nsTArray<LookupResult> LookupResultArray;
+
+struct CacheResult {
+  AddComplete entry;
+  nsCString table;
+};
+typedef nsTArray<CacheResult> CacheResultArray;
+
+class LookupCache {
+public:
+  // Check for a canonicalized IP address.
+  static bool IsCanonicalizedIP(const nsACString& aHost);
+
+  // take a lookup string (www.hostname.com/path/to/resource.html) and
+  // expand it into the set of fragments that should be searched for in an
+  // entry
+  static nsresult GetLookupFragments(const nsACString& aSpec,
+                                     nsTArray<nsCString>* aFragments);
+  // Similar to GetKey(), but if the domain contains three or more components,
+  // two keys will be returned:
+  //  hostname.com/foo/bar -> [hostname.com]
+  //  mail.hostname.com/foo/bar -> [hostname.com, mail.hostname.com]
+  //  www.mail.hostname.com/foo/bar -> [hostname.com, mail.hostname.com]
+  static nsresult GetHostKeys(const nsACString& aSpec,
+                              nsTArray<nsCString>* aHostKeys);
+
+  LookupCache(const nsACString& aTableName, nsIFile* aStoreFile);
+  ~LookupCache();
+
+  const nsCString &TableName() const { return mTableName; }
+
+  nsresult Init();
+  nsresult Open();
+  // The directory handle where we operate will
+  // be moved away when a backup is made.
+  nsresult UpdateDirHandle(nsIFile* aStoreDirectory);
+  // This will Clear() the passed arrays when done.
+  nsresult Build(AddPrefixArray& aAddPrefixes,
+                 AddCompleteArray& aAddCompletes);
+  nsresult GetPrefixes(FallibleTArray<uint32_t>& aAddPrefixes);
+  void ClearCompleteCache();
+
+#if DEBUG
+  void Dump();
+#endif
+  nsresult WriteFile();
+  nsresult Has(const Completion& aCompletion,
+               bool* aHas, bool* aComplete);
+  bool IsPrimed();
+
+private:
+  void ClearAll();
+  nsresult Reset();
+  void UpdateHeader();
+  nsresult ReadHeader(nsIInputStream* aInputStream);
+  nsresult ReadCompletions(nsIInputStream* aInputStream);
+  nsresult EnsureSizeConsistent();
+  nsresult LoadPrefixSet();
+  // Construct a Prefix Set with known prefixes.
+  // This will Clear() aAddPrefixes when done.
+  nsresult ConstructPrefixSet(AddPrefixArray& aAddPrefixes);
+
+  struct Header {
+    uint32_t magic;
+    uint32_t version;
+    uint32_t numCompletions;
+  };
+  Header mHeader;
+
+  bool mPrimed;
+  nsCString mTableName;
+  nsCOMPtr<nsIFile> mStoreDirectory;
+  CompletionArray mCompletions;
+  // Set of prefixes known to be in the database
+  RefPtr<nsUrlClassifierPrefixSet> mPrefixSet;
+};
+
+} // namespace safebrowsing
+} // namespace mozilla
+
+#endif
diff --git a/toolkit/components/url-classifier/PrivateBrowsingTrackingProtectionWhitelist.js b/toolkit/components/url-classifier/PrivateBrowsingTrackingProtectionWhitelist.js
new file mode 100644
index 0000000000..5c1c27874d
--- /dev/null
+++ b/toolkit/components/url-classifier/PrivateBrowsingTrackingProtectionWhitelist.js
@@ -0,0 +1,68 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+const Ci = Components.interfaces;
+const Cu = Components.utils;
+
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
+
+function PrivateBrowsingTrackingProtectionWhitelist() {
+  // The list of URIs explicitly excluded from tracking protection.
+  this._allowlist = [];
+
+  Services.obs.addObserver(this, "last-pb-context-exited", true);
+}
+
+PrivateBrowsingTrackingProtectionWhitelist.prototype = {
+  classID: Components.ID("{a319b616-c45d-4037-8d86-01c592b5a9af}"),
+  QueryInterface: XPCOMUtils.generateQI([Ci.nsIPrivateBrowsingTrackingProtectionWhitelist,
+                                         Ci.nsIObserver,
+                                         Ci.nsISupportsWeakReference,
+                                         Ci.nsISupports]),
+  _xpcom_factory: XPCOMUtils.generateSingletonFactory(PrivateBrowsingTrackingProtectionWhitelist),
+
+  /**
+   * Add the provided URI to the list of allowed tracking sites.
+   *
+   * @param uri nsIURI
+   *        The URI to add to the list.
+   */
+  addToAllowList(uri) {
+    if (this._allowlist.indexOf(uri.spec) === -1) {
+      this._allowlist.push(uri.spec);
+    }
+  },
+
+  /**
+   * Remove the provided URI from the list of allowed tracking sites.
+   *
+   * @param uri nsIURI
+   *        The URI to add to the list.
+   */
+  removeFromAllowList(uri) {
+    let index = this._allowlist.indexOf(uri.spec);
+    if (index !== -1) {
+      this._allowlist.splice(index, 1);
+    }
+  },
+
+  /**
+   * Check if the provided URI exists in the list of allowed tracking sites.
+   *
+   * @param uri nsIURI
+   *        The URI to add to the list.
+   */
+  existsInAllowList(uri) {
+    return this._allowlist.indexOf(uri.spec) !== -1;
+  },
+
+  observe: function (subject, topic, data) {
+    if (topic == "last-pb-context-exited") {
+      this._allowlist = [];
+    }
+  }
+};
+
+this.NSGetFactory = XPCOMUtils.generateNSGetFactory([PrivateBrowsingTrackingProtectionWhitelist]);
diff --git a/toolkit/components/url-classifier/ProtocolParser.cpp b/toolkit/components/url-classifier/ProtocolParser.cpp
new file mode 100644
index 0000000000..9c1e73ed7f
--- /dev/null
+++ b/toolkit/components/url-classifier/ProtocolParser.cpp
@@ -0,0 +1,701 @@
+//* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ProtocolParser.h"
+#include "LookupCache.h"
+#include "nsNetCID.h"
+#include "mozilla/Logging.h"
+#include "prnetdb.h"
+#include "prprf.h"
+
+#include "nsUrlClassifierUtils.h"
+
+// NSPR_LOG_MODULES=UrlClassifierProtocolParser:5
+PRLogModuleInfo *gUrlClassifierProtocolParserLog = nullptr;
+#define PARSER_LOG(args) MOZ_LOG(gUrlClassifierProtocolParserLog, mozilla::LogLevel::Debug, args)
+
+namespace mozilla {
+namespace safebrowsing {
+
+// Updates will fail if fed chunks larger than this
+const uint32_t MAX_CHUNK_SIZE = (1024 * 1024);
+// Updates will fail if the total number of tocuhed chunks is larger than this
+const uint32_t MAX_CHUNK_RANGE = 1000000;
+
+const uint32_t DOMAIN_SIZE = 4;
+
+// Parse one stringified range of chunks of the form "n" or "n-m" from a
+// comma-separated list of chunks.  Upon return, 'begin' will point to the
+// next range of chunks in the list of chunks.
+static bool
+ParseChunkRange(nsACString::const_iterator& aBegin,
+                const nsACString::const_iterator& aEnd,
+                uint32_t* aFirst, uint32_t* aLast)
+{
+  nsACString::const_iterator iter = aBegin;
+  FindCharInReadable(',', iter, aEnd);
+
+  nsAutoCString element(Substring(aBegin, iter));
+  aBegin = iter;
+  if (aBegin != aEnd)
+    aBegin++;
+
+  uint32_t numRead = PR_sscanf(element.get(), "%u-%u", aFirst, aLast);
+  if (numRead == 2) {
+    if (*aFirst > *aLast) {
+      uint32_t tmp = *aFirst;
+      *aFirst = *aLast;
+      *aLast = tmp;
+    }
+    return true;
+  }
+
+  if (numRead == 1) {
+    *aLast = *aFirst;
+    return true;
+  }
+
+  return false;
+}
+
+ProtocolParser::ProtocolParser()
+    : mState(PROTOCOL_STATE_CONTROL)
+  , mUpdateStatus(NS_OK)
+  , mUpdateWait(0)
+  , mResetRequested(false)
+{
+}
+
+ProtocolParser::~ProtocolParser()
+{
+  CleanupUpdates();
+}
+
+nsresult
+ProtocolParser::Init(nsICryptoHash* aHasher)
+{
+  if (!gUrlClassifierProtocolParserLog) {
+    gUrlClassifierProtocolParserLog =
+      PR_NewLogModule("UrlClassifierProtocolParser");
+  }
+  mCryptoHash = aHasher;
+  return NS_OK;
+}
+
+void
+ProtocolParser::SetCurrentTable(const nsACString& aTable)
+{
+  mTableUpdate = GetTableUpdate(aTable);
+}
+
+nsresult
+ProtocolParser::AppendStream(const nsACString& aData)
+{
+  if (NS_FAILED(mUpdateStatus))
+    return mUpdateStatus;
+
+  nsresult rv;
+  mPending.Append(aData);
+
+  bool done = false;
+  while (!done) {
+    if (mState == PROTOCOL_STATE_CONTROL) {
+      rv = ProcessControl(&done);
+    } else if (mState == PROTOCOL_STATE_CHUNK) {
+      rv = ProcessChunk(&done);
+    } else {
+      NS_ERROR("Unexpected protocol state");
+      rv = NS_ERROR_FAILURE;
+    }
+    if (NS_FAILED(rv)) {
+      mUpdateStatus = rv;
+      return rv;
+    }
+  }
+  return NS_OK;
+}
+
+nsresult
+ProtocolParser::ProcessControl(bool* aDone)
+{
+  nsresult rv;
+
+  nsAutoCString line;
+  *aDone = true;
+  while (NextLine(line)) {
+    PARSER_LOG(("Processing %s\n", line.get()));
+
+    if (StringBeginsWith(line, NS_LITERAL_CSTRING("i:"))) {
+      // Set the table name from the table header line.
+      SetCurrentTable(Substring(line, 2));
+    } else if (StringBeginsWith(line, NS_LITERAL_CSTRING("n:"))) {
+      if (PR_sscanf(line.get(), "n:%d", &mUpdateWait) != 1) {
+        PARSER_LOG(("Error parsing n: '%s' (%d)", line.get(), mUpdateWait));
+        mUpdateWait = 0;
+      }
+    } else if (line.EqualsLiteral("r:pleasereset")) {
+      mResetRequested = true;
+    } else if (StringBeginsWith(line, NS_LITERAL_CSTRING("u:"))) {
+      rv = ProcessForward(line);
+      NS_ENSURE_SUCCESS(rv, rv);
+    } else if (StringBeginsWith(line, NS_LITERAL_CSTRING("a:")) ||
+               StringBeginsWith(line, NS_LITERAL_CSTRING("s:"))) {
+      rv = ProcessChunkControl(line);
+      NS_ENSURE_SUCCESS(rv, rv);
+      *aDone = false;
+      return NS_OK;
+    } else if (StringBeginsWith(line, NS_LITERAL_CSTRING("ad:")) ||
+               StringBeginsWith(line, NS_LITERAL_CSTRING("sd:"))) {
+      rv = ProcessExpirations(line);
+      NS_ENSURE_SUCCESS(rv, rv);
+    }
+  }
+
+  *aDone = true;
+  return NS_OK;
+}
+
+nsresult
+ProtocolParser::ProcessExpirations(const nsCString& aLine)
+{
+  if (!mTableUpdate) {
+    NS_WARNING("Got an expiration without a table.");
+    return NS_ERROR_FAILURE;
+  }
+  const nsCSubstring &list = Substring(aLine, 3);
+  nsACString::const_iterator begin, end;
+  list.BeginReading(begin);
+  list.EndReading(end);
+  while (begin != end) {
+    uint32_t first, last;
+    if (ParseChunkRange(begin, end, &first, &last)) {
+      if (last < first) return NS_ERROR_FAILURE;
+      if (last - first > MAX_CHUNK_RANGE) return NS_ERROR_FAILURE;
+      for (uint32_t num = first; num <= last; num++) {
+        if (aLine[0] == 'a') {
+          nsresult rv = mTableUpdate->NewAddExpiration(num);
+          if (NS_FAILED(rv)) {
+            return rv;
+          }
+        } else {
+          nsresult rv = mTableUpdate->NewSubExpiration(num);
+          if (NS_FAILED(rv)) {
+            return rv;
+          }
+        }
+      }
+    } else {
+      return NS_ERROR_FAILURE;
+    }
+  }
+  return NS_OK;
+}
+
+nsresult
+ProtocolParser::ProcessChunkControl(const nsCString& aLine)
+{
+  if (!mTableUpdate) {
+    NS_WARNING("Got a chunk before getting a table.");
+    return NS_ERROR_FAILURE;
+  }
+
+  mState = PROTOCOL_STATE_CHUNK;
+  char command;
+
+  mChunkState.Clear();
+
+  if (PR_sscanf(aLine.get(),
+                "%c:%d:%d:%d",
+                &command,
+                &mChunkState.num, &mChunkState.hashSize, &mChunkState.length)
+      != 4)
+  {
+    NS_WARNING(("PR_sscanf failed"));
+    return NS_ERROR_FAILURE;
+  }
+
+  if (mChunkState.length > MAX_CHUNK_SIZE) {
+    NS_WARNING("Invalid length specified in update.");
+    return NS_ERROR_FAILURE;
+  }
+
+  if (!(mChunkState.hashSize == PREFIX_SIZE || mChunkState.hashSize == COMPLETE_SIZE)) {
+    NS_WARNING("Invalid hash size specified in update.");
+    return NS_ERROR_FAILURE;
+  }
+
+  if (StringEndsWith(mTableUpdate->TableName(),
+                     NS_LITERAL_CSTRING("-shavar")) ||
+      StringEndsWith(mTableUpdate->TableName(),
+                     NS_LITERAL_CSTRING("-simple"))) {
+    // Accommodate test tables ending in -simple for now.
+    mChunkState.type = (command == 'a') ? CHUNK_ADD : CHUNK_SUB;
+  } else if (StringEndsWith(mTableUpdate->TableName(),
+    NS_LITERAL_CSTRING("-digest256"))) {
+    mChunkState.type = (command == 'a') ? CHUNK_ADD_DIGEST : CHUNK_SUB_DIGEST;
+  }
+  nsresult rv;
+  switch (mChunkState.type) {
+    case CHUNK_ADD:
+      rv = mTableUpdate->NewAddChunk(mChunkState.num);
+      if (NS_FAILED(rv)) {
+        return rv;
+      }
+      break;
+    case CHUNK_SUB:
+      rv = mTableUpdate->NewSubChunk(mChunkState.num);
+      if (NS_FAILED(rv)) {
+        return rv;
+      }
+      break;
+    case CHUNK_ADD_DIGEST:
+      rv = mTableUpdate->NewAddChunk(mChunkState.num);
+      if (NS_FAILED(rv)) {
+        return rv;
+      }
+      break;
+    case CHUNK_SUB_DIGEST:
+      rv = mTableUpdate->NewSubChunk(mChunkState.num);
+      if (NS_FAILED(rv)) {
+        return rv;
+      }
+      break;
+  }
+
+  return NS_OK;
+}
+
+nsresult
+ProtocolParser::ProcessForward(const nsCString& aLine)
+{
+  const nsCSubstring &forward = Substring(aLine, 2);
+  return AddForward(forward);
+}
+
+nsresult
+ProtocolParser::AddForward(const nsACString& aUrl)
+{
+  if (!mTableUpdate) {
+    NS_WARNING("Forward without a table name.");
+    return NS_ERROR_FAILURE;
+  }
+
+  ForwardedUpdate *forward = mForwards.AppendElement();
+  forward->table = mTableUpdate->TableName();
+  forward->url.Assign(aUrl);
+
+  return NS_OK;
+}
+
+nsresult
+ProtocolParser::ProcessChunk(bool* aDone)
+{
+  if (!mTableUpdate) {
+    NS_WARNING("Processing chunk without an active table.");
+    return NS_ERROR_FAILURE;
+  }
+
+  NS_ASSERTION(mChunkState.num != 0, "Must have a chunk number.");
+
+  if (mPending.Length() < mChunkState.length) {
+    *aDone = true;
+    return NS_OK;
+  }
+
+  // Pull the chunk out of the pending stream data.
+  nsAutoCString chunk;
+  chunk.Assign(Substring(mPending, 0, mChunkState.length));
+  mPending.Cut(0, mChunkState.length);
+
+  *aDone = false;
+  mState = PROTOCOL_STATE_CONTROL;
+
+  if (StringEndsWith(mTableUpdate->TableName(),
+                     NS_LITERAL_CSTRING("-shavar"))) {
+    return ProcessShaChunk(chunk);
+  }
+  if (StringEndsWith(mTableUpdate->TableName(),
+             NS_LITERAL_CSTRING("-digest256"))) {
+    return ProcessDigestChunk(chunk);
+  }
+  return ProcessPlaintextChunk(chunk);
+}
+
+/**
+ * Process a plaintext chunk (currently only used in unit tests).
+ */
+nsresult
+ProtocolParser::ProcessPlaintextChunk(const nsACString& aChunk)
+{
+  if (!mTableUpdate) {
+    NS_WARNING("Chunk received with no table.");
+    return NS_ERROR_FAILURE;
+  }
+
+  PARSER_LOG(("Handling a %d-byte simple chunk", aChunk.Length()));
+
+  nsTArray<nsCString> lines;
+  ParseString(PromiseFlatCString(aChunk), '\n', lines);
+
+  // non-hashed tables need to be hashed
+  for (uint32_t i = 0; i < lines.Length(); i++) {
+    nsCString& line = lines[i];
+
+    if (mChunkState.type == CHUNK_ADD) {
+      if (mChunkState.hashSize == COMPLETE_SIZE) {
+        Completion hash;
+        hash.FromPlaintext(line, mCryptoHash);
+        nsresult rv = mTableUpdate->NewAddComplete(mChunkState.num, hash);
+        if (NS_FAILED(rv)) {
+          return rv;
+        }
+      } else {
+        NS_ASSERTION(mChunkState.hashSize == 4, "Only 32- or 4-byte hashes can be used for add chunks.");
+        Prefix hash;
+        hash.FromPlaintext(line, mCryptoHash);
+        nsresult rv = mTableUpdate->NewAddPrefix(mChunkState.num, hash);
+        if (NS_FAILED(rv)) {
+          return rv;
+        }
+      }
+    } else {
+      nsCString::const_iterator begin, iter, end;
+      line.BeginReading(begin);
+      line.EndReading(end);
+      iter = begin;
+      uint32_t addChunk;
+      if (!FindCharInReadable(':', iter, end) ||
+          PR_sscanf(lines[i].get(), "%d:", &addChunk) != 1) {
+        NS_WARNING("Received sub chunk without associated add chunk.");
+        return NS_ERROR_FAILURE;
+      }
+      iter++;
+
+      if (mChunkState.hashSize == COMPLETE_SIZE) {
+        Completion hash;
+        hash.FromPlaintext(Substring(iter, end), mCryptoHash);
+        nsresult rv = mTableUpdate->NewSubComplete(addChunk, hash, mChunkState.num);
+        if (NS_FAILED(rv)) {
+          return rv;
+        }
+      } else {
+        NS_ASSERTION(mChunkState.hashSize == 4, "Only 32- or 4-byte hashes can be used for add chunks.");
+        Prefix hash;
+        hash.FromPlaintext(Substring(iter, end), mCryptoHash);
+        nsresult rv = mTableUpdate->NewSubPrefix(addChunk, hash, mChunkState.num);
+        if (NS_FAILED(rv)) {
+          return rv;
+        }
+      }
+    }
+  }
+
+  return NS_OK;
+}
+
+nsresult
+ProtocolParser::ProcessShaChunk(const nsACString& aChunk)
+{
+  uint32_t start = 0;
+  while (start < aChunk.Length()) {
+    // First four bytes are the domain key.
+    Prefix domain;
+    domain.Assign(Substring(aChunk, start, DOMAIN_SIZE));
+    start += DOMAIN_SIZE;
+
+    // Then a count of entries.
+    uint8_t numEntries = static_cast<uint8_t>(aChunk[start]);
+    start++;
+
+    PARSER_LOG(("Handling a %d-byte shavar chunk containing %u entries"
+                " for domain %X", aChunk.Length(), numEntries,
+                domain.ToUint32()));
+
+    nsresult rv;
+    if (mChunkState.type == CHUNK_ADD && mChunkState.hashSize == PREFIX_SIZE) {
+      rv = ProcessHostAdd(domain, numEntries, aChunk, &start);
+    } else if (mChunkState.type == CHUNK_ADD && mChunkState.hashSize == COMPLETE_SIZE) {
+      rv = ProcessHostAddComplete(numEntries, aChunk, &start);
+    } else if (mChunkState.type == CHUNK_SUB && mChunkState.hashSize == PREFIX_SIZE) {
+      rv = ProcessHostSub(domain, numEntries, aChunk, &start);
+    } else if (mChunkState.type == CHUNK_SUB && mChunkState.hashSize == COMPLETE_SIZE) {
+      rv = ProcessHostSubComplete(numEntries, aChunk, &start);
+    } else {
+      NS_WARNING("Unexpected chunk type/hash size!");
+      PARSER_LOG(("Got an unexpected chunk type/hash size: %s:%d",
+           mChunkState.type == CHUNK_ADD ? "add" : "sub",
+           mChunkState.hashSize));
+      return NS_ERROR_FAILURE;
+    }
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
+
+  return NS_OK;
+}
+
+nsresult
+ProtocolParser::ProcessDigestChunk(const nsACString& aChunk)
+{
+  PARSER_LOG(("Handling a %d-byte digest256 chunk", aChunk.Length()));
+
+  if (mChunkState.type == CHUNK_ADD_DIGEST) {
+    return ProcessDigestAdd(aChunk);
+  }
+  if (mChunkState.type == CHUNK_SUB_DIGEST) {
+    return ProcessDigestSub(aChunk);
+  }
+  return NS_ERROR_UNEXPECTED;
+}
+
+nsresult
+ProtocolParser::ProcessDigestAdd(const nsACString& aChunk)
+{
+  // The ABNF format for add chunks is (HASH)+, where HASH is 32 bytes.
+  MOZ_ASSERT(aChunk.Length() % 32 == 0,
+             "Chunk length in bytes must be divisible by 4");
+  uint32_t start = 0;
+  while (start < aChunk.Length()) {
+    Completion hash;
+    hash.Assign(Substring(aChunk, start, COMPLETE_SIZE));
+    start += COMPLETE_SIZE;
+    nsresult rv = mTableUpdate->NewAddComplete(mChunkState.num, hash);
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
+  }
+  return NS_OK;
+}
+
+nsresult
+ProtocolParser::ProcessDigestSub(const nsACString& aChunk)
+{
+  // The ABNF format for sub chunks is (ADDCHUNKNUM HASH)+, where ADDCHUNKNUM
+  // is a 4 byte chunk number, and HASH is 32 bytes.
+  MOZ_ASSERT(aChunk.Length() % 36 == 0,
+             "Chunk length in bytes must be divisible by 36");
+  uint32_t start = 0;
+  while (start < aChunk.Length()) {
+    // Read ADDCHUNKNUM
+    const nsCSubstring& addChunkStr = Substring(aChunk, start, 4);
+    start += 4;
+
+    uint32_t addChunk;
+    memcpy(&addChunk, addChunkStr.BeginReading(), 4);
+    addChunk = PR_ntohl(addChunk);
+
+    // Read the hash
+    Completion hash;
+    hash.Assign(Substring(aChunk, start, COMPLETE_SIZE));
+    start += COMPLETE_SIZE;
+
+    nsresult rv = mTableUpdate->NewSubComplete(addChunk, hash, mChunkState.num);
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
+  }
+  return NS_OK;
+}
+
+nsresult
+ProtocolParser::ProcessHostAdd(const Prefix& aDomain, uint8_t aNumEntries,
+                               const nsACString& aChunk, uint32_t* aStart)
+{
+  NS_ASSERTION(mChunkState.hashSize == PREFIX_SIZE,
+               "ProcessHostAdd should only be called for prefix hashes.");
+
+  if (aNumEntries == 0) {
+    nsresult rv = mTableUpdate->NewAddPrefix(mChunkState.num, aDomain);
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
+    return NS_OK;
+  }
+
+  if (*aStart + (PREFIX_SIZE * aNumEntries) > aChunk.Length()) {
+    NS_WARNING("Chunk is not long enough to contain the expected entries.");
+    return NS_ERROR_FAILURE;
+  }
+
+  for (uint8_t i = 0; i < aNumEntries; i++) {
+    Prefix hash;
+    hash.Assign(Substring(aChunk, *aStart, PREFIX_SIZE));
+    PARSER_LOG(("Add prefix %X", hash.ToUint32()));
+    nsresult rv = mTableUpdate->NewAddPrefix(mChunkState.num, hash);
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
+    *aStart += PREFIX_SIZE;
+  }
+
+  return NS_OK;
+}
+
+nsresult
+ProtocolParser::ProcessHostSub(const Prefix& aDomain, uint8_t aNumEntries,
+                               const nsACString& aChunk, uint32_t *aStart)
+{
+  NS_ASSERTION(mChunkState.hashSize == PREFIX_SIZE,
+               "ProcessHostSub should only be called for prefix hashes.");
+
+  if (aNumEntries == 0) {
+    if ((*aStart) + 4 > aChunk.Length()) {
+      NS_WARNING("Received a zero-entry sub chunk without an associated add.");
+      return NS_ERROR_FAILURE;
+    }
+
+    const nsCSubstring& addChunkStr = Substring(aChunk, *aStart, 4);
+    *aStart += 4;
+
+    uint32_t addChunk;
+    memcpy(&addChunk, addChunkStr.BeginReading(), 4);
+    addChunk = PR_ntohl(addChunk);
+
+    PARSER_LOG(("Sub prefix (addchunk=%u)", addChunk));
+    nsresult rv = mTableUpdate->NewSubPrefix(addChunk, aDomain, mChunkState.num);
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
+    return NS_OK;
+  }
+
+  if (*aStart + ((PREFIX_SIZE + 4) * aNumEntries) > aChunk.Length()) {
+    NS_WARNING("Chunk is not long enough to contain the expected entries.");
+    return NS_ERROR_FAILURE;
+  }
+
+  for (uint8_t i = 0; i < aNumEntries; i++) {
+    const nsCSubstring& addChunkStr = Substring(aChunk, *aStart, 4);
+    *aStart += 4;
+
+    uint32_t addChunk;
+    memcpy(&addChunk, addChunkStr.BeginReading(), 4);
+    addChunk = PR_ntohl(addChunk);
+
+    Prefix prefix;
+    prefix.Assign(Substring(aChunk, *aStart, PREFIX_SIZE));
+    *aStart += PREFIX_SIZE;
+
+    PARSER_LOG(("Sub prefix %X (addchunk=%u)", prefix.ToUint32(), addChunk));
+    nsresult rv = mTableUpdate->NewSubPrefix(addChunk, prefix, mChunkState.num);
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
+  }
+
+  return NS_OK;
+}
+
+nsresult
+ProtocolParser::ProcessHostAddComplete(uint8_t aNumEntries,
+                                       const nsACString& aChunk, uint32_t* aStart)
+{
+  NS_ASSERTION(mChunkState.hashSize == COMPLETE_SIZE,
+               "ProcessHostAddComplete should only be called for complete hashes.");
+
+  if (aNumEntries == 0) {
+    // this is totally comprehensible.
+    // My sarcasm detector is going off!
+    NS_WARNING("Expected > 0 entries for a 32-byte hash add.");
+    return NS_OK;
+  }
+
+  if (*aStart + (COMPLETE_SIZE * aNumEntries) > aChunk.Length()) {
+    NS_WARNING("Chunk is not long enough to contain the expected entries.");
+    return NS_ERROR_FAILURE;
+  }
+
+  for (uint8_t i = 0; i < aNumEntries; i++) {
+    Completion hash;
+    hash.Assign(Substring(aChunk, *aStart, COMPLETE_SIZE));
+    nsresult rv = mTableUpdate->NewAddComplete(mChunkState.num, hash);
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
+    *aStart += COMPLETE_SIZE;
+  }
+
+  return NS_OK;
+}
+
+nsresult
+ProtocolParser::ProcessHostSubComplete(uint8_t aNumEntries,
+                                       const nsACString& aChunk, uint32_t* aStart)
+{
+  NS_ASSERTION(mChunkState.hashSize == COMPLETE_SIZE,
+               "ProcessHostSubComplete should only be called for complete hashes.");
+
+  if (aNumEntries == 0) {
+    // this is totally comprehensible.
+    NS_WARNING("Expected > 0 entries for a 32-byte hash sub.");
+    return NS_OK;
+  }
+
+  if (*aStart + ((COMPLETE_SIZE + 4) * aNumEntries) > aChunk.Length()) {
+    NS_WARNING("Chunk is not long enough to contain the expected entries.");
+    return NS_ERROR_FAILURE;
+  }
+
+  for (uint8_t i = 0; i < aNumEntries; i++) {
+    Completion hash;
+    hash.Assign(Substring(aChunk, *aStart, COMPLETE_SIZE));
+    *aStart += COMPLETE_SIZE;
+
+    const nsCSubstring& addChunkStr = Substring(aChunk, *aStart, 4);
+    *aStart += 4;
+
+    uint32_t addChunk;
+    memcpy(&addChunk, addChunkStr.BeginReading(), 4);
+    addChunk = PR_ntohl(addChunk);
+
+    nsresult rv = mTableUpdate->NewSubComplete(addChunk, hash, mChunkState.num);
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
+  }
+
+  return NS_OK;
+}
+
+bool
+ProtocolParser::NextLine(nsACString& aLine)
+{
+  int32_t newline = mPending.FindChar('\n');
+  if (newline == kNotFound) {
+    return false;
+  }
+  aLine.Assign(Substring(mPending, 0, newline));
+  mPending.Cut(0, newline + 1);
+  return true;
+}
+
+void
+ProtocolParser::CleanupUpdates()
+{
+  for (uint32_t i = 0; i < mTableUpdates.Length(); i++) {
+    delete mTableUpdates[i];
+  }
+  mTableUpdates.Clear();
+}
+
+TableUpdate *
+ProtocolParser::GetTableUpdate(const nsACString& aTable)
+{
+  for (uint32_t i = 0; i < mTableUpdates.Length(); i++) {
+    if (aTable.Equals(mTableUpdates[i]->TableName())) {
+      return mTableUpdates[i];
+    }
+  }
+
+  // We free automatically on destruction, ownership of these
+  // updates can be transferred to DBServiceWorker, which passes
+  // them back to Classifier when doing the updates, and that
+  // will free them.
+  TableUpdate *update = new TableUpdate(aTable);
+  mTableUpdates.AppendElement(update);
+  return update;
+}
+
+} // namespace safebrowsing
+} // namespace mozilla
diff --git a/toolkit/components/url-classifier/ProtocolParser.h b/toolkit/components/url-classifier/ProtocolParser.h
new file mode 100644
index 0000000000..edc602d2da
--- /dev/null
+++ b/toolkit/components/url-classifier/ProtocolParser.h
@@ -0,0 +1,119 @@
+//* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef ProtocolParser_h__
+#define ProtocolParser_h__
+
+#include "HashStore.h"
+#include "nsICryptoHMAC.h"
+
+namespace mozilla {
+namespace safebrowsing {
+
+/**
+ * Some helpers for parsing the safe
+ */
+class ProtocolParser {
+public:
+  struct ForwardedUpdate {
+    nsCString table;
+    nsCString url;
+  };
+
+  ProtocolParser();
+  ~ProtocolParser();
+
+  nsresult Status() const { return mUpdateStatus; }
+
+  nsresult Init(nsICryptoHash* aHasher);
+
+  void SetCurrentTable(const nsACString& aTable);
+
+  nsresult Begin();
+  nsresult AppendStream(const nsACString& aData);
+
+  // Forget the table updates that were created by this pass.  It
+  // becomes the caller's responsibility to free them.  This is shitty.
+  TableUpdate *GetTableUpdate(const nsACString& aTable);
+  void ForgetTableUpdates() { mTableUpdates.Clear(); }
+  nsTArray<TableUpdate*> &GetTableUpdates() { return mTableUpdates; }
+
+  // Update information.
+  const nsTArray<ForwardedUpdate> &Forwards() const { return mForwards; }
+  int32_t UpdateWait() { return mUpdateWait; }
+  bool ResetRequested() { return mResetRequested; }
+
+private:
+  nsresult ProcessControl(bool* aDone);
+  nsresult ProcessExpirations(const nsCString& aLine);
+  nsresult ProcessChunkControl(const nsCString& aLine);
+  nsresult ProcessForward(const nsCString& aLine);
+  nsresult AddForward(const nsACString& aUrl);
+  nsresult ProcessChunk(bool* done);
+  // Remove this, it's only used for testing
+  nsresult ProcessPlaintextChunk(const nsACString& aChunk);
+  nsresult ProcessShaChunk(const nsACString& aChunk);
+  nsresult ProcessHostAdd(const Prefix& aDomain, uint8_t aNumEntries,
+                          const nsACString& aChunk, uint32_t* aStart);
+  nsresult ProcessHostSub(const Prefix& aDomain, uint8_t aNumEntries,
+                          const nsACString& aChunk, uint32_t* aStart);
+  nsresult ProcessHostAddComplete(uint8_t aNumEntries, const nsACString& aChunk,
+                                  uint32_t *aStart);
+  nsresult ProcessHostSubComplete(uint8_t numEntries, const nsACString& aChunk,
+                                  uint32_t* start);
+  // Digest chunks are very similar to shavar chunks, except digest chunks
+  // always contain the full hash, so there is no need for chunk data to
+  // contain prefix sizes.
+  nsresult ProcessDigestChunk(const nsACString& aChunk);
+  nsresult ProcessDigestAdd(const nsACString& aChunk);
+  nsresult ProcessDigestSub(const nsACString& aChunk);
+  bool NextLine(nsACString& aLine);
+
+  void CleanupUpdates();
+
+  enum ParserState {
+    PROTOCOL_STATE_CONTROL,
+    PROTOCOL_STATE_CHUNK
+  };
+  ParserState mState;
+
+  enum ChunkType {
+    // Types for shavar tables.
+    CHUNK_ADD,
+    CHUNK_SUB,
+    // Types for digest256 tables. digest256 tables differ in format from
+    // shavar tables since they only contain complete hashes.
+    CHUNK_ADD_DIGEST,
+    CHUNK_SUB_DIGEST
+  };
+
+  struct ChunkState {
+    ChunkType type;
+    uint32_t num;
+    uint32_t hashSize;
+    uint32_t length;
+    void Clear() { num = 0; hashSize = 0; length = 0; }
+  };
+  ChunkState mChunkState;
+
+  nsCOMPtr<nsICryptoHash> mCryptoHash;
+
+  nsresult mUpdateStatus;
+  nsCString mPending;
+
+  uint32_t mUpdateWait;
+  bool mResetRequested;
+
+  nsTArray<ForwardedUpdate> mForwards;
+  // Keep track of updates to apply before passing them to the DBServiceWorkers.
+  nsTArray<TableUpdate*> mTableUpdates;
+  // Updates to apply to the current table being parsed.
+  TableUpdate *mTableUpdate;
+};
+
+} // namespace safebrowsing
+} // namespace mozilla
+
+#endif
diff --git a/toolkit/components/url-classifier/SafeBrowsing.jsm b/toolkit/components/url-classifier/SafeBrowsing.jsm
index 17a24b62fe..61057c2a02 100644
--- a/toolkit/components/url-classifier/SafeBrowsing.jsm
+++ b/toolkit/components/url-classifier/SafeBrowsing.jsm
@@ -10,10 +10,33 @@ const Cu = Components.utils;
 
 Cu.import("resource://gre/modules/Services.jsm");
 
+// Log only if browser.safebrowsing.debug is true
+function log(...stuff) {
+  let logging = null;
+  try {
+    logging = Services.prefs.getBoolPref("browser.safebrowsing.debug");
+  } catch(e) {
+    return;
+  }
+  if (!logging) {
+    return;
+  }
+
+  var d = new Date();
+  let msg = "SafeBrowsing: " + d.toTimeString() + ": " + stuff.join(" ");
+  dump(msg + "\n");
+}
+
 // Skip all the ones containining "test", because we never need to ask for
 // updates for them.
 function getLists(prefName) {
-  let pref = Services.prefs.getCharPref(prefName);
+  log("getLists: " + prefName);
+  let pref = null;
+  try {
+    pref = Services.prefs.getCharPref(prefName);
+  } catch(e) {
+    return null;
+  }
   // Splitting an empty string returns [''], we really want an empty array.
   if (!pref) {
     return [];
@@ -31,17 +54,6 @@ const downloadAllowLists = getLists("urlclassifier.downloadAllowTable");
 const trackingProtectionLists = getLists("urlclassifier.trackingTable");
 const trackingProtectionWhitelists = getLists("urlclassifier.trackingWhitelistTable");
 
-var debug = false;
-function log(...stuff) {
-  if (!debug)
-    return;
-
-  var d = new Date();
-  let msg = "SafeBrowsing: " + d.toTimeString() + ": " + stuff.join(" ");
-  Services.console.logStringMessage(msg);
-  dump(msg + "\n");
-}
-
 this.SafeBrowsing = {
 
   init: function() {
@@ -53,32 +65,6 @@ this.SafeBrowsing = {
     Services.prefs.addObserver("browser.safebrowsing", this.readPrefs.bind(this), false);
     Services.prefs.addObserver("privacy.trackingprotection", this.readPrefs.bind(this), false);
     this.readPrefs();
-
-    // Register our two types of tables, and add custom Mozilla entries
-    let listManager = Cc["@mozilla.org/url-classifier/listmanager;1"].
-                      getService(Ci.nsIUrlListManager);
-    for (let i = 0; i < phishingLists.length; ++i) {
-      listManager.registerTable(phishingLists[i], this.updateURL, this.gethashURL);
-    }
-    for (let i = 0; i < malwareLists.length; ++i) {
-      listManager.registerTable(malwareLists[i], this.updateURL, this.gethashURL);
-    }
-    for (let i = 0; i < downloadBlockLists.length; ++i) {
-      listManager.registerTable(downloadBlockLists[i], this.updateURL, this.gethashURL);
-    }
-    for (let i = 0; i < downloadAllowLists.length; ++i) {
-      listManager.registerTable(downloadAllowLists[i], this.updateURL, this.gethashURL);
-    }
-    for (let i = 0; i < trackingProtectionLists.length; ++i) {
-      listManager.registerTable(trackingProtectionLists[i],
-                                this.trackingUpdateURL,
-                                this.trackingGethashURL);
-    }
-    for (let i = 0; i < trackingProtectionWhitelists.length; ++i) {
-      listManager.registerTable(trackingProtectionWhitelists[i],
-                                this.trackingUpdateURL,
-                                this.trackingGethashURL);
-    }
     this.addMozEntries();
 
     this.controlUpdateChecking();
@@ -87,6 +73,37 @@ this.SafeBrowsing = {
     log("init() finished");
   },
 
+  registerTableWithURLs: function(listname) {
+    let listManager = Cc["@mozilla.org/url-classifier/listmanager;1"].
+      getService(Ci.nsIUrlListManager);
+
+    let providerName = this.listToProvider[listname];
+    let provider = this.providers[providerName];
+
+    listManager.registerTable(listname, providerName, provider.updateURL, provider.gethashURL);
+  },
+
+  registerTables: function() {
+    for (let i = 0; i < phishingLists.length; ++i) {
+      this.registerTableWithURLs(phishingLists[i]);
+    }
+    for (let i = 0; i < malwareLists.length; ++i) {
+      this.registerTableWithURLs(malwareLists[i]);
+    }
+    for (let i = 0; i < downloadBlockLists.length; ++i) {
+      this.registerTableWithURLs(downloadBlockLists[i]);
+    }
+    for (let i = 0; i < downloadAllowLists.length; ++i) {
+      this.registerTableWithURLs(downloadAllowLists[i]);
+    }
+    for (let i = 0; i < trackingProtectionLists.length; ++i) {
+      this.registerTableWithURLs(trackingProtectionLists[i]);
+    }
+    for (let i = 0; i < trackingProtectionWhitelists.length; ++i) {
+      this.registerTableWithURLs(trackingProtectionWhitelists[i]);
+    }
+  },
+
 
   initialized:     false,
   phishingEnabled: false,
@@ -132,11 +149,12 @@ this.SafeBrowsing = {
   readPrefs: function() {
     log("reading prefs");
 
-    debug = Services.prefs.getBoolPref("browser.safebrowsing.debug");
+    this.debug = Services.prefs.getBoolPref("browser.safebrowsing.debug");
     this.phishingEnabled = Services.prefs.getBoolPref("browser.safebrowsing.enabled");
     this.malwareEnabled = Services.prefs.getBoolPref("browser.safebrowsing.malware.enabled");
     this.trackingEnabled = Services.prefs.getBoolPref("privacy.trackingprotection.enabled") || Services.prefs.getBoolPref("privacy.trackingprotection.pbmode.enabled");
     this.updateProviderURLs();
+    this.registerTables();
 
     // XXX The listManager backend gets confused if this is called before the
     // lists are registered. So only call it here when a pref changes, and not
@@ -151,21 +169,61 @@ this.SafeBrowsing = {
     try {
       var clientID = Services.prefs.getCharPref("browser.safebrowsing.id");
     } catch(e) {
-      var clientID = Services.appinfo.name;
+      clientID = Services.appinfo.name;
     }
 
-    log("initializing safe browsing URLs, client id ", clientID);
+    log("initializing safe browsing URLs, client id", clientID);
 
-    // Urls used to update DB
-    this.updateURL  = Services.urlFormatter.formatURLPref("browser.safebrowsing.updateURL");
-    this.gethashURL = Services.urlFormatter.formatURLPref("browser.safebrowsing.gethashURL");
+    // Get the different providers
+    let branch = Services.prefs.getBranch("browser.safebrowsing.provider.");
+    let children = branch.getChildList("", {});
+    this.providers = {};
+    this.listToProvider = {};
 
-    this.updateURL  = this.updateURL.replace("SAFEBROWSING_ID", clientID);
-    this.gethashURL = this.gethashURL.replace("SAFEBROWSING_ID", clientID);
-    this.trackingUpdateURL = Services.urlFormatter.formatURLPref(
-      "browser.trackingprotection.updateURL");
-    this.trackingGethashURL = Services.urlFormatter.formatURLPref(
-      "browser.trackingprotection.gethashURL");
+    for (let child of children) {
+      log("Child: " + child);
+      let prefComponents =  child.split(".");
+      let providerName = prefComponents[0];
+      this.providers[providerName] = {};
+    }
+
+    if (this.debug) {
+      let providerStr = "";
+      Object.keys(this.providers).forEach(function(provider) {
+        if (providerStr === "") {
+          providerStr = provider;
+        } else {
+          providerStr += ", " + provider;
+        }
+      });
+      log("Providers: " + providerStr);
+    }
+
+    Object.keys(this.providers).forEach(function(provider) {
+      let updateURL = Services.urlFormatter.formatURLPref(
+        "browser.safebrowsing.provider." + provider + ".updateURL");
+      let gethashURL = Services.urlFormatter.formatURLPref(
+        "browser.safebrowsing.provider." + provider + ".gethashURL");
+      updateURL = updateURL.replace("SAFEBROWSING_ID", clientID);
+      gethashURL = gethashURL.replace("SAFEBROWSING_ID", clientID);
+
+      log("Provider: " + provider + " updateURL=" + updateURL);
+      log("Provider: " + provider + " gethashURL=" + gethashURL);
+
+      // Urls used to update DB
+      this.providers[provider].updateURL  = updateURL;
+      this.providers[provider].gethashURL = gethashURL;
+
+      // Get lists this provider manages
+      let lists = getLists("browser.safebrowsing.provider." + provider + ".lists");
+      if (lists) {
+        lists.forEach(function(list) {
+          this.listToProvider[list] = provider;
+        }, this);
+      } else {
+        log("Update URL given but no lists managed for provider: " + provider);
+      }
+    }, this);
   },
 
   controlUpdateChecking: function() {
diff --git a/toolkit/components/url-classifier/content/listmanager.js b/toolkit/components/url-classifier/content/listmanager.js
new file mode 100644
index 0000000000..d37a35776e
--- /dev/null
+++ b/toolkit/components/url-classifier/content/listmanager.js
@@ -0,0 +1,528 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+var Cu = Components.utils;
+Cu.import("resource://gre/modules/Services.jsm");
+
+// This is the only implementation of nsIUrlListManager.
+// A class that manages lists, namely white and black lists for
+// phishing or malware protection. The ListManager knows how to fetch,
+// update, and store lists.
+//
+// There is a single listmanager for the whole application.
+//
+// TODO more comprehensive update tests, for example add unittest check 
+//      that the listmanagers tables are properly written on updates
+
+// Log only if browser.safebrowsing.debug is true
+this.log = function log(...stuff) {
+  var prefs_ = new G_Preferences();
+  var debug = prefs_.getPref("browser.safebrowsing.debug");
+  if (!debug) {
+    return;
+  }
+
+  var d = new Date();
+  let msg = "listmanager: " + d.toTimeString() + ": " + stuff.join(" ");
+  Services.console.logStringMessage(msg);
+  dump(msg + "\n");
+}
+
+this.QueryAdapter = function QueryAdapter(callback) {
+  this.callback_ = callback;
+};
+
+QueryAdapter.prototype.handleResponse = function(value) {
+  this.callback_.handleEvent(value);
+}
+
+/**
+ * A ListManager keeps track of black and white lists and knows
+ * how to update them.
+ *
+ * @constructor
+ */
+this.PROT_ListManager = function PROT_ListManager() {
+  log("Initializing list manager");
+  this.prefs_ = new G_Preferences();
+  this.updateInterval = this.prefs_.getPref("urlclassifier.updateinterval", 30 * 60) * 1000;
+
+  // A map of tableNames to objects of type
+  // { updateUrl: <updateUrl>, gethashUrl: <gethashUrl> }
+  this.tablesData = {};
+  // A map of updateUrls to maps of tables requiring updates, e.g.
+  // { safebrowsing-update-url: { goog-phish-shavar: true,
+  //                              goog-malware-shavar: true }
+  this.needsUpdate_ = {};
+
+  this.observerServiceObserver_ = new G_ObserverServiceObserver(
+                                          'quit-application',
+                                          BindToObject(this.shutdown_, this),
+                                          true /*only once*/);
+
+  // A map of updateUrls to single-use G_Alarms. An entry exists if and only if
+  // there is at least one table with updates enabled for that url. G_Alarms
+  // are reset when enabling/disabling updates or on update callbacks (update
+  // success, update failure, download error).
+  this.updateCheckers_ = {};
+  this.requestBackoffs_ = {};
+  this.dbService_ = Cc["@mozilla.org/url-classifier/dbservice;1"]
+                   .getService(Ci.nsIUrlClassifierDBService);
+
+
+  this.hashCompleter_ = Cc["@mozilla.org/url-classifier/hashcompleter;1"]
+                        .getService(Ci.nsIUrlClassifierHashCompleter);
+}
+
+/**
+ * xpcom-shutdown callback
+ * Delete all of our data tables which seem to leak otherwise.
+ */
+PROT_ListManager.prototype.shutdown_ = function() {
+  for (var name in this.tablesData) {
+    delete this.tablesData[name];
+  }
+}
+
+/**
+ * Register a new table table
+ * @param tableName - the name of the table
+ * @param updateUrl - the url for updating the table
+ * @param gethashUrl - the url for fetching hash completions
+ * @returns true if the table could be created; false otherwise
+ */
+PROT_ListManager.prototype.registerTable = function(tableName,
+                                                    providerName,
+                                                    updateUrl,
+                                                    gethashUrl) {
+  log("registering " + tableName + " with " + updateUrl);
+  if (!updateUrl) {
+    log("Can't register table " + tableName + " without updateUrl");
+    return false;
+  }
+  this.tablesData[tableName] = {};
+  this.tablesData[tableName].updateUrl = updateUrl;
+  this.tablesData[tableName].gethashUrl = gethashUrl;
+  this.tablesData[tableName].provider = providerName;
+
+  // Keep track of all of our update URLs.
+  if (!this.needsUpdate_[updateUrl]) {
+    this.needsUpdate_[updateUrl] = {};
+    /* Backoff interval should be between 30 and 60 minutes. */
+    var backoffInterval = 30 * 60 * 1000;
+    backoffInterval += Math.floor(Math.random() * (30 * 60 * 1000));
+
+    log("Creating request backoff for " + updateUrl);
+    this.requestBackoffs_[updateUrl] = new RequestBackoff(2 /* max errors */,
+                                      60*1000 /* retry interval, 1 min */,
+                                            4 /* num requests */,
+                                   60*60*1000 /* request time, 60 min */,
+                              backoffInterval /* backoff interval, 60 min */,
+                                 8*60*60*1000 /* max backoff, 8hr */);
+
+  }
+  this.needsUpdate_[updateUrl][tableName] = false;
+
+  return true;
+}
+
+PROT_ListManager.prototype.getGethashUrl = function(tableName) {
+  if (this.tablesData[tableName] && this.tablesData[tableName].gethashUrl) {
+    return this.tablesData[tableName].gethashUrl;
+  }
+  return "";
+}
+
+/**
+ * Enable updates for some tables
+ * @param tables - an array of table names that need updating
+ */
+PROT_ListManager.prototype.enableUpdate = function(tableName) {
+  var table = this.tablesData[tableName];
+  if (table) {
+    log("Enabling table updates for " + tableName);
+    this.needsUpdate_[table.updateUrl][tableName] = true;
+  }
+}
+
+/**
+ * Returns true if any table associated with the updateUrl requires updates.
+ * @param updateUrl - the updateUrl
+ */
+PROT_ListManager.prototype.updatesNeeded_ = function(updateUrl) {
+  let updatesNeeded = false;
+  for (var tableName in this.needsUpdate_[updateUrl]) {
+    if (this.needsUpdate_[updateUrl][tableName]) {
+      updatesNeeded = true;
+    }
+  }
+  return updatesNeeded;
+}
+
+/**
+ * Disables updates for some tables
+ * @param tables - an array of table names that no longer need updating
+ */
+PROT_ListManager.prototype.disableUpdate = function(tableName) {
+  var table = this.tablesData[tableName];
+  if (table) {
+    log("Disabling table updates for " + tableName);
+    this.needsUpdate_[table.updateUrl][tableName] = false;
+    if (!this.updatesNeeded_(table.updateUrl) &&
+        this.updateCheckers_[table.updateUrl]) {
+      this.updateCheckers_[table.updateUrl].cancel();
+      this.updateCheckers_[table.updateUrl] = null;
+    }
+  }
+}
+
+/**
+ * Determine if we have some tables that need updating.
+ */
+PROT_ListManager.prototype.requireTableUpdates = function() {
+  for (var name in this.tablesData) {
+    // Tables that need updating even if other tables don't require it
+    if (this.needsUpdate_[this.tablesData[name].updateUrl][name]) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+/**
+ * Acts as a nsIUrlClassifierCallback for getTables.
+ */
+PROT_ListManager.prototype.kickoffUpdate_ = function (onDiskTableData)
+{
+  this.startingUpdate_ = false;
+  var initialUpdateDelay = 3000;
+  // Add a fuzz of 0-5 minutes.
+  initialUpdateDelay += Math.floor(Math.random() * (5 * 60 * 1000));
+
+  // If the user has never downloaded tables, do the check now.
+  log("needsUpdate: " + JSON.stringify(this.needsUpdate_, undefined, 2));
+  for (var updateUrl in this.needsUpdate_) {
+    // If we haven't already kicked off updates for this updateUrl, set a
+    // non-repeating timer for it. The timer delay will be reset either on
+    // updateSuccess to this.updateinterval, or backed off on downloadError.
+    // Don't set the updateChecker unless at least one table has updates
+    // enabled.
+    if (this.updatesNeeded_(updateUrl) && !this.updateCheckers_[updateUrl]) {
+      let provider = null;
+      Object.keys(this.tablesData).forEach(function(table) {
+        if (this.tablesData[table].updateUrl === updateUrl) {
+          let newProvider = this.tablesData[table].provider;
+          if (provider) {
+            if (newProvider !== provider) {
+              log("Multiple tables for the same updateURL have a different provider?!");
+            }
+          } else {
+            provider = newProvider;
+          }
+        }
+      }, this);
+      log("Initializing update checker for " + updateUrl
+          + " provided by " + provider);
+
+      // Use the initialUpdateDelay + fuzz unless we had previous updates
+      // and the server told us when to try again.
+      let updateDelay = initialUpdateDelay;
+      let targetPref = "browser.safebrowsing.provider." + provider + ".nextupdatetime";
+      let nextUpdate = this.prefs_.getPref(targetPref);
+      if (nextUpdate) {
+        updateDelay = Math.max(0, nextUpdate - Date.now());
+        log("Next update at " + nextUpdate);
+      }
+      log("Next update " + updateDelay + "ms from now");
+
+      // Set the last update time to verify if data is still valid.
+      let freshnessPref = "browser.safebrowsing.provider." + provider + ".lastupdatetime";
+      let freshness = this.prefs_.getPref(freshnessPref);
+      if (freshness) {
+        Object.keys(this.tablesData).forEach(function(table) {
+        if (this.tablesData[table].provider === provider) {
+          this.dbService_.setLastUpdateTime(table, freshness);
+        }}, this);
+      }
+
+      this.updateCheckers_[updateUrl] =
+        new G_Alarm(BindToObject(this.checkForUpdates, this, updateUrl),
+                    updateDelay, false /* repeating */);
+    } else {
+      log("No updates needed or already initialized for " + updateUrl);
+    }
+  }
+}
+
+PROT_ListManager.prototype.stopUpdateCheckers = function() {
+  log("Stopping updates");
+  for (var updateUrl in this.updateCheckers_) {
+    if (this.updateCheckers_[updateUrl]) {
+      this.updateCheckers_[updateUrl].cancel();
+      this.updateCheckers_[updateUrl] = null;
+    }
+  }
+}
+
+/**
+ * Determine if we have any tables that require updating.  Different
+ * Wardens may call us with new tables that need to be updated.
+ */
+PROT_ListManager.prototype.maybeToggleUpdateChecking = function() {
+  // We update tables if we have some tables that want updates.  If there
+  // are no tables that want to be updated - we dont need to check anything.
+  if (this.requireTableUpdates()) {
+    log("Starting managing lists");
+
+    // Get the list of existing tables from the DBService before making any
+    // update requests.
+    if (!this.startingUpdate_) {
+      this.startingUpdate_ = true;
+      // check the current state of tables in the database
+      this.dbService_.getTables(BindToObject(this.kickoffUpdate_, this));
+    }
+  } else {
+    log("Stopping managing lists (if currently active)");
+    this.stopUpdateCheckers();                    // Cancel pending updates
+  }
+}
+
+/**
+ * Provides an exception free way to look up the data in a table. We
+ * use this because at certain points our tables might not be loaded,
+ * and querying them could throw.
+ *
+ * @param table String Name of the table that we want to consult
+ * @param key Principal being used to lookup the database
+ * @param callback nsIUrlListManagerCallback (ie., Function) given false or the
+ *        value in the table corresponding to key.  If the table name does not
+ *        exist, we return false, too.
+ */
+PROT_ListManager.prototype.safeLookup = function(key, callback) {
+  try {
+    log("safeLookup: " + key);
+    var cb = new QueryAdapter(callback);
+    this.dbService_.lookup(key,
+                           BindToObject(cb.handleResponse, cb),
+                           true);
+  } catch(e) {
+    log("safeLookup masked failure for key " + key + ": " + e);
+    callback.handleEvent("");
+  }
+}
+
+/**
+ * Updates our internal tables from the update server
+ *
+ * @param updateUrl: request updates for tables associated with that url, or
+ * for all tables if the url is empty.
+ */
+PROT_ListManager.prototype.checkForUpdates = function(updateUrl) {
+  log("checkForUpdates with " + updateUrl);
+  // See if we've triggered the request backoff logic.
+  if (!updateUrl) {
+    return false;
+  }
+  if (!this.requestBackoffs_[updateUrl] ||
+      !this.requestBackoffs_[updateUrl].canMakeRequest()) {
+    log("Can't make update request");
+    return false;
+  }
+  // Grab the current state of the tables from the database
+  this.dbService_.getTables(BindToObject(this.makeUpdateRequest_, this,
+                            updateUrl));
+  return true;
+}
+
+/**
+ * Method that fires the actual HTTP update request.
+ * First we reset any tables that have disappeared.
+ * @param tableData List of table data already in the database, in the form
+ *        tablename;<chunk ranges>\n
+ */
+PROT_ListManager.prototype.makeUpdateRequest_ = function(updateUrl, tableData) {
+  log("this.tablesData: " + JSON.stringify(this.tablesData, undefined, 2));
+  log("existing chunks: " + tableData + "\n");
+  // Disallow blank updateUrls
+  if (!updateUrl) {
+    return;
+  }
+  // An object of the form
+  // { tableList: comma-separated list of tables to request,
+  //   tableNames: map of tables that need updating,
+  //   request: list of tables and existing chunk ranges from tableData
+  // }
+  var streamerMap = { tableList: null, tableNames: {}, request: "" };
+  for (var tableName in this.tablesData) {
+    // Skip tables not matching this update url
+    if (this.tablesData[tableName].updateUrl != updateUrl) {
+      continue;
+    }
+    if (this.needsUpdate_[this.tablesData[tableName].updateUrl][tableName]) {
+      streamerMap.tableNames[tableName] = true;
+    }
+    if (!streamerMap.tableList) {
+      streamerMap.tableList = tableName;
+    } else {
+      streamerMap.tableList += "," + tableName;
+    }
+  }
+  // Build the request. For each table already in the database, include the
+  // chunk data from the database
+  var lines = tableData.split("\n");
+  for (var i = 0; i < lines.length; i++) {
+    var fields = lines[i].split(";");
+    var name = fields[0];
+    if (streamerMap.tableNames[name]) {
+      streamerMap.request += lines[i] + "\n";
+      delete streamerMap.tableNames[name];
+    }
+  }
+  // For each requested table that didn't have chunk data in the database,
+  // request it fresh
+  for (let tableName in streamerMap.tableNames) {
+    streamerMap.request += tableName + ";\n";
+  }
+
+  log("update request: " + JSON.stringify(streamerMap, undefined, 2) + "\n");
+
+  // Don't send an empty request.
+  if (streamerMap.request.length > 0) {
+    this.makeUpdateRequestForEntry_(updateUrl, streamerMap.tableList,
+                                    streamerMap.request);
+  } else {
+    // We were disabled between kicking off getTables and now.
+    log("Not sending empty request");
+  }
+}
+
+PROT_ListManager.prototype.makeUpdateRequestForEntry_ = function(updateUrl,
+                                                                 tableList,
+                                                                 request) {
+  log("makeUpdateRequestForEntry_: request " + request +
+      " update: " + updateUrl + " tablelist: " + tableList + "\n");
+  var streamer = Cc["@mozilla.org/url-classifier/streamupdater;1"]
+                 .getService(Ci.nsIUrlClassifierStreamUpdater);
+
+  this.requestBackoffs_[updateUrl].noteRequest();
+
+  if (!streamer.downloadUpdates(
+        tableList,
+        request,
+        updateUrl,
+        BindToObject(this.updateSuccess_, this, tableList, updateUrl),
+        BindToObject(this.updateError_, this, tableList, updateUrl),
+        BindToObject(this.downloadError_, this, tableList, updateUrl))) {
+    // Our alarm gets reset in one of the 3 callbacks.
+    log("pending update, queued request until later");
+  }
+}
+
+/**
+ * Callback function if the update request succeeded.
+ * @param waitForUpdate String The number of seconds that the client should
+ *        wait before requesting again.
+ */
+PROT_ListManager.prototype.updateSuccess_ = function(tableList, updateUrl,
+                                                     waitForUpdate) {
+  log("update success for " + tableList + " from " + updateUrl + ": " +
+      waitForUpdate + "\n");
+  var delay;
+  if (waitForUpdate) {
+    delay = parseInt(waitForUpdate, 10);
+  }
+  // As long as the delay is something sane (5 minutes or more), update
+  // our delay time for requesting updates. We always use a non-repeating
+  // timer since the delay is set differently at every callback.
+  if (delay >= (5 * 60)) {
+    log("Waiting " + delay + " seconds");
+    delay = delay * 1000;
+  } else {
+    log("Ignoring delay from server, waiting " + this.updateInterval / 1000);
+    delay = this.updateInterval;
+  }
+  this.updateCheckers_[updateUrl] =
+    new G_Alarm(BindToObject(this.checkForUpdates, this, updateUrl),
+                delay, false);
+
+  // Let the backoff object know that we completed successfully.
+  this.requestBackoffs_[updateUrl].noteServerResponse(200);
+
+  // Set last update time for provider
+  // Get the provider for these tables, check for consistency
+  let tables = tableList.split(",");
+  let provider = null;
+  for (let table of tables) {
+    let newProvider = this.tablesData[table].provider;
+    if (provider) {
+      if (newProvider !== provider) {
+        log("Multiple tables for the same updateURL have a different provider?!");
+      }
+    } else {
+      provider = newProvider;
+    }
+  }
+
+  // Store the last update time (needed to know if the table is "fresh")
+  // and the next update time (to know when to update next).
+  let lastUpdatePref = "browser.safebrowsing.provider." + provider + ".lastupdatetime";
+  let now = Date.now();
+  log("Setting last update of " + provider + " to " + now);
+  this.prefs_.setPref(lastUpdatePref, now.toString());
+
+  let nextUpdatePref = "browser.safebrowsing.provider." + provider + ".nextupdatetime";
+  let targetTime = now + delay;
+  log("Setting next update of " + provider + " to " + targetTime
+      + " (" + delay + "ms from now)");
+  this.prefs_.setPref(nextUpdatePref, targetTime.toString());
+}
+
+/**
+ * Callback function if the update request succeeded.
+ * @param result String The error code of the failure
+ */
+PROT_ListManager.prototype.updateError_ = function(table, updateUrl, result) {
+  log("update error for " + table + " from " + updateUrl + ": " + result + "\n");
+  // There was some trouble applying the updates. Don't try again for at least
+  // updateInterval seconds.
+  this.updateCheckers_[updateUrl] =
+    new G_Alarm(BindToObject(this.checkForUpdates, this, updateUrl),
+                this.updateInterval, false);
+}
+
+/**
+ * Callback function when the download failed
+ * @param status String http status or an empty string if connection refused.
+ */
+PROT_ListManager.prototype.downloadError_ = function(table, updateUrl, status) {
+  log("download error for " + table + ": " + status + "\n");
+  // If status is empty, then we assume that we got an NS_CONNECTION_REFUSED
+  // error.  In this case, we treat this is a http 500 error.
+  if (!status) {
+    status = 500;
+  }
+  status = parseInt(status, 10);
+  this.requestBackoffs_[updateUrl].noteServerResponse(status);
+  var delay = this.updateInterval;
+  if (this.requestBackoffs_[updateUrl].isErrorStatus(status)) {
+    // Schedule an update for when our backoff is complete
+    delay = this.requestBackoffs_[updateUrl].nextRequestDelay();
+  } else {
+    log("Got non error status for error callback?!");
+  }
+  this.updateCheckers_[updateUrl] =
+    new G_Alarm(BindToObject(this.checkForUpdates, this, updateUrl),
+                delay, false);
+
+}
+
+PROT_ListManager.prototype.QueryInterface = function(iid) {
+  if (iid.equals(Ci.nsISupports) ||
+      iid.equals(Ci.nsIUrlListManager) ||
+      iid.equals(Ci.nsITimerCallback))
+    return this;
+
+  throw Components.results.NS_ERROR_NO_INTERFACE;
+}
diff --git a/toolkit/components/url-classifier/content/moz/alarm.js b/toolkit/components/url-classifier/content/moz/alarm.js
new file mode 100644
index 0000000000..7de0675461
--- /dev/null
+++ b/toolkit/components/url-classifier/content/moz/alarm.js
@@ -0,0 +1,157 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+
+// An Alarm fires a callback after a certain amount of time, or at
+// regular intervals. It's a convenient replacement for
+// setTimeout/Interval when you don't want to bind to a specific
+// window.
+//
+// The ConditionalAlarm is an Alarm that cancels itself if its callback 
+// returns a value that type-converts to true.
+//
+// Example:
+//
+//  function foo() { dump('hi'); };
+//  new G_Alarm(foo, 10*1000);                   // Fire foo in 10 seconds
+//  new G_Alarm(foo, 10*1000, true /*repeat*/);  // Fire foo every 10 seconds
+//  new G_Alarm(foo, 10*1000, true, 7);          // Fire foo every 10 seconds
+//                                               // seven times
+//  new G_ConditionalAlarm(foo, 1000, true); // Fire every sec until foo()==true
+//
+//  // Fire foo every 10 seconds until foo returns true or until it fires seven
+//  // times, whichever happens first.
+//  new G_ConditionalAlarm(foo, 10*1000, true /*repeating*/, 7);
+//
+// TODO: maybe pass an isFinal flag to the callback if they opted to
+// set maxTimes and this is the last iteration?
+
+
+/**
+ * Set an alarm to fire after a given amount of time, or at specific 
+ * intervals.
+ *
+ * @param callback Function to call when the alarm fires
+ * @param delayMS Number indicating the length of the alarm period in ms
+ * @param opt_repeating Boolean indicating whether this should fire 
+ *                      periodically
+ * @param opt_maxTimes Number indicating a maximum number of times to 
+ *                     repeat (obviously only useful when opt_repeating==true)
+ */
+this.G_Alarm =
+function G_Alarm(callback, delayMS, opt_repeating, opt_maxTimes) {
+  this.debugZone = "alarm";
+  this.callback_ = callback;
+  this.repeating_ = !!opt_repeating;
+  this.timer_ = Cc["@mozilla.org/timer;1"].createInstance(Ci.nsITimer);
+  var type = opt_repeating ? 
+             this.timer_.TYPE_REPEATING_SLACK : 
+             this.timer_.TYPE_ONE_SHOT;
+  this.maxTimes_ = opt_maxTimes ? opt_maxTimes : null;
+  this.nTimes_ = 0;
+
+  this.observerServiceObserver_ = new G_ObserverServiceObserver(
+                                        'xpcom-shutdown',
+                                        BindToObject(this.cancel, this));
+
+  // Ask the timer to use nsITimerCallback (.notify()) when ready
+  this.timer_.initWithCallback(this, delayMS, type);
+}
+
+/**
+ * Cancel this timer 
+ */
+G_Alarm.prototype.cancel = function() {
+  if (!this.timer_) {
+    return;
+  }
+
+  this.timer_.cancel();
+  // Break circular reference created between this.timer_ and the G_Alarm
+  // instance (this)
+  this.timer_ = null;
+  this.callback_ = null;
+
+  // We don't need the shutdown observer anymore
+  this.observerServiceObserver_.unregister();
+}
+
+/**
+ * Invoked by the timer when it fires
+ * 
+ * @param timer Reference to the nsITimer which fired (not currently 
+ *              passed along)
+ */
+G_Alarm.prototype.notify = function(timer) {
+  // fire callback and save results
+  var ret = this.callback_();
+  
+  // If they've given us a max number of times to fire, enforce it
+  this.nTimes_++;
+  if (this.repeating_ && 
+      typeof this.maxTimes_ == "number" 
+      && this.nTimes_ >= this.maxTimes_) {
+    this.cancel();
+  } else if (!this.repeating_) {
+    // Clear out the callback closure for TYPE_ONE_SHOT timers
+    this.cancel();
+  }
+  // We don't cancel/cleanup timers that repeat forever until either
+  // xpcom-shutdown occurs or cancel() is called explicitly.
+
+  return ret;
+}
+
+G_Alarm.prototype.setDelay = function(delay) {
+  this.timer_.delay = delay;
+}
+
+/**
+ * XPCOM cruft
+ */
+G_Alarm.prototype.QueryInterface = function(iid) {
+  if (iid.equals(Components.interfaces.nsISupports) ||
+      iid.equals(Components.interfaces.nsITimerCallback))
+    return this;
+
+  throw Components.results.NS_ERROR_NO_INTERFACE;
+}
+
+
+/**
+ * An alarm with the additional property that it cancels itself if its 
+ * callback returns true.
+ *
+ * For parameter documentation, see G_Alarm
+ */
+this.G_ConditionalAlarm =
+function G_ConditionalAlarm(callback, delayMS, opt_repeating, opt_maxTimes) {
+  G_Alarm.call(this, callback, delayMS, opt_repeating, opt_maxTimes);
+  this.debugZone = "conditionalalarm";
+}
+
+G_ConditionalAlarm.inherits = function(parentCtor) {
+  var tempCtor = function(){};
+  tempCtor.prototype = parentCtor.prototype;
+  this.superClass_ = parentCtor.prototype;
+  this.prototype = new tempCtor();
+}
+
+G_ConditionalAlarm.inherits(G_Alarm);
+
+/**
+ * Invoked by the timer when it fires
+ * 
+ * @param timer Reference to the nsITimer which fired (not currently 
+ *              passed along)
+ */
+G_ConditionalAlarm.prototype.notify = function(timer) {
+  // Call G_Alarm::notify
+  var rv = G_Alarm.prototype.notify.call(this, timer);
+
+  if (this.repeating_ && rv) {
+    G_Debug(this, "Callback of a repeating alarm returned true; cancelling.");
+    this.cancel();
+  }
+}
diff --git a/toolkit/components/url-classifier/content/moz/cryptohasher.js b/toolkit/components/url-classifier/content/moz/cryptohasher.js
new file mode 100644
index 0000000000..a1294aa938
--- /dev/null
+++ b/toolkit/components/url-classifier/content/moz/cryptohasher.js
@@ -0,0 +1,176 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+
+// A very thin wrapper around nsICryptoHash. It's not strictly
+// necessary, but makes the code a bit cleaner and gives us the
+// opportunity to verify that our implementations give the results that
+// we expect, for example if we have to interoperate with a server.
+//
+// The digest* methods reset the state of the hasher, so it's
+// necessary to call init() explicitly after them.
+//
+// Works only in Firefox 1.5+.
+//
+// IMPORTANT NOTE: Due to https://bugzilla.mozilla.org/show_bug.cgi?id=321024
+// you cannot use the cryptohasher before app-startup. The symptom of doing
+// so is a segfault in NSS.
+
+/**
+ * Instantiate a new hasher. You must explicitly call init() before use!
+ */
+this.G_CryptoHasher =
+function G_CryptoHasher() {
+  this.debugZone = "cryptohasher";
+  this.hasher_ = null;
+}
+
+G_CryptoHasher.algorithms = {
+  MD2: Ci.nsICryptoHash.MD2,
+  MD5: Ci.nsICryptoHash.MD5,
+  SHA1: Ci.nsICryptoHash.SHA1,
+  SHA256: Ci.nsICryptoHash.SHA256,
+  SHA384: Ci.nsICryptoHash.SHA384,
+  SHA512: Ci.nsICryptoHash.SHA512,
+};
+
+/**
+ * Initialize the hasher. This function must be called after every call
+ * to one of the digest* methods.
+ *
+ * @param algorithm Constant from G_CryptoHasher.algorithms specifying the
+ *                  algorithm this hasher will use
+ */ 
+G_CryptoHasher.prototype.init = function(algorithm) {
+  var validAlgorithm = false;
+  for (var alg in G_CryptoHasher.algorithms)
+    if (algorithm == G_CryptoHasher.algorithms[alg])
+      validAlgorithm = true;
+
+  if (!validAlgorithm)
+    throw new Error("Invalid algorithm: " + algorithm);
+
+  this.hasher_ = Cc["@mozilla.org/security/hash;1"]
+                 .createInstance(Ci.nsICryptoHash);
+  this.hasher_.init(algorithm);
+}
+
+/**
+ * Update the hash's internal state with input given in a string. Can be
+ * called multiple times for incrementeal hash updates.
+ *
+ * @param input String containing data to hash.
+ */ 
+G_CryptoHasher.prototype.updateFromString = function(input) {
+  if (!this.hasher_)
+    throw new Error("You must initialize the hasher first!");
+
+  var stream = Cc['@mozilla.org/io/string-input-stream;1']
+               .createInstance(Ci.nsIStringInputStream);
+  stream.setData(input, input.length);
+  this.updateFromStream(stream);
+}
+
+/**
+ * Update the hash's internal state with input given in an array. Can be
+ * called multiple times for incremental hash updates.
+ *
+ * @param input Array containing data to hash.
+ */ 
+G_CryptoHasher.prototype.updateFromArray = function(input) {
+  if (!this.hasher_)
+    throw new Error("You must initialize the hasher first!");
+
+  this.hasher_.update(input, input.length);
+}
+
+/**
+ * Update the hash's internal state with input given in a stream. Can be
+ * called multiple times from incremental hash updates.
+ */
+G_CryptoHasher.prototype.updateFromStream = function(stream) {
+  if (!this.hasher_)
+    throw new Error("You must initialize the hasher first!");
+
+  if (stream.available())
+    this.hasher_.updateFromStream(stream, stream.available());
+}
+
+/**
+ * @returns The hash value as a string (sequence of 8-bit values)
+ */ 
+G_CryptoHasher.prototype.digestRaw = function() {
+  var digest = this.hasher_.finish(false /* not b64 encoded */);
+  this.hasher_ = null;
+  return digest;
+}
+
+/**
+ * @returns The hash value as a base64-encoded string
+ */ 
+G_CryptoHasher.prototype.digestBase64 = function() {
+  var digest = this.hasher_.finish(true /* b64 encoded */);
+  this.hasher_ = null;
+  return digest;
+}
+
+/**
+ * @returns The hash value as a hex-encoded string
+ */ 
+G_CryptoHasher.prototype.digestHex = function() {
+  var raw = this.digestRaw();
+  return this.toHex_(raw);
+}
+
+/**
+ * Converts a sequence of values to a hex-encoded string. The input is a
+ * a string, so you can stick 16-bit values in each character.
+ *
+ * @param str String to conver to hex. (Often this is just a sequence of
+ *            16-bit values)
+ *
+ * @returns String containing the hex representation of the input
+ */ 
+G_CryptoHasher.prototype.toHex_ = function(str) {
+  var hexchars = '0123456789ABCDEF';
+  var hexrep = new Array(str.length * 2);
+
+  for (var i = 0; i < str.length; ++i) {
+    hexrep[i * 2] = hexchars.charAt((str.charCodeAt(i) >> 4) & 15);
+    hexrep[i * 2 + 1] = hexchars.charAt(str.charCodeAt(i) & 15);
+  }
+  return hexrep.join('');
+}
+
+#ifdef DEBUG
+/**
+ * Lame unittest function
+ */
+this.TEST_G_CryptoHasher = function TEST_G_CryptoHasher() {
+  if (G_GDEBUG) {
+    var z = "cryptohasher UNITTEST";
+    G_debugService.enableZone(z);
+
+    G_Debug(z, "Starting");
+
+    var md5 = function(str) {
+      var hasher = new G_CryptoHasher();
+      hasher.init(G_CryptoHasher.algorithms.MD5);
+      hasher.updateFromString(str);
+      return hasher.digestHex().toLowerCase();
+    };
+
+    // test vectors from: http://www.faqs.org/rfcs/rfc1321.html
+    var vectors = {"": "d41d8cd98f00b204e9800998ecf8427e",
+                   "a": "0cc175b9c0f1b6a831c399e269772661",
+                   "abc": "900150983cd24fb0d6963f7d28e17f72",
+                   "message digest": "f96b697d7cb7938d525a2f31aaf161d0",
+                   "abcdefghijklmnopqrstuvwxyz": "c3fcd3d76192e4007dfb496cca67e13b",
+                   "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789": "d174ab98d277d9f5a5611c2c9f419d9f",
+                   "12345678901234567890123456789012345678901234567890123456789012345678901234567890": "57edf4a22be3c955ac49da2e2107b67a"};
+                   
+    G_Debug(z, "PASSED");
+  }
+}
+#endif
diff --git a/toolkit/components/url-classifier/content/moz/debug.js b/toolkit/components/url-classifier/content/moz/debug.js
new file mode 100644
index 0000000000..ed4c117932
--- /dev/null
+++ b/toolkit/components/url-classifier/content/moz/debug.js
@@ -0,0 +1,867 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#ifdef DEBUG
+
+// Generic logging/debugging functionality that:
+//
+// (*) when disabled compiles to no-ops at worst (for calls to the service) 
+//     and to nothing at best (calls to G_Debug() and similar are compiled
+//     away when you use a jscompiler that strips dead code)
+//
+// (*) has dynamically configurable/creatable debugging "zones" enabling 
+//     selective logging
+// 
+// (*) hides its plumbing so that all calls in different zones are uniform,
+//     so you can drop files using this library into other apps that use it
+//     without any configuration 
+//
+// (*) can be controlled programmatically or via preferences.  The
+//     preferences that control the service and its zones are under
+//     the preference branch "safebrowsing-debug-service."
+//
+// (*) outputs function call traces when the "loggifier" zone is enabled
+// 
+// (*) can write output to logfiles so that you can get a call trace
+//     from someone who is having a problem
+//
+// Example:
+//
+// var G_GDEBUG = true                           // Enable this module
+// var G_debugService = new G_DebugService();    // in global context
+//
+// // You can use it with arbitrary primitive first arguement
+// G_Debug("myzone", "Yo yo yo");   // outputs: [myzone] Yo yo yo\n
+//
+// // But it's nice to use it with an object; it will probe for the zone name
+// function Obj() {
+//   this.debugZone = "someobj";
+// }
+// Obj.prototype.foo = function() {
+//   G_Debug(this, "foo called");
+// }
+// (new Obj).foo();                        // outputs: [someobj] foo called\n
+//
+// G_debugService.loggifier.loggify(Obj.prototype);  // enable call tracing
+//
+// // En/disable specific zones programmatically (you can also use preferences)
+// G_debugService.enableZone("somezone");
+// G_debugService.disableZone("someotherzone");
+// G_debugService.enableAllZones();
+//
+// // We also have asserts and errors:
+// G_Error(this, "Some error occurred");                    // will throw
+// G_Assert(this, (x > 3), "x not greater than three!");    // will throw
+//
+// See classes below for more methods. 
+//
+// TODO add code to set prefs when not found to the default value of a tristate
+// TODO add error level support
+// TODO add ability to turn off console output
+//
+// -------> TO START DEBUGGING: set G_GDEBUG to true
+
+// These are the functions code will typically call. Everything is
+// wrapped in if's so we can compile it away when G_GDEBUG is false.
+
+
+if (typeof G_GDEBUG == "undefined") {
+  throw new Error("G_GDEBUG constant must be set before loading debug.js");
+}
+
+
+/**
+ * Write out a debugging message.
+ *
+ * @param who The thingy to convert into a zone name corresponding to the 
+ *            zone to which this message belongs
+ * @param msg Message to output
+ */
+this.G_Debug = function G_Debug(who, msg) {
+  if (G_GDEBUG) {
+    G_GetDebugZone(who).debug(msg);
+  }
+}
+
+/**
+ * Debugs loudly
+ */
+this.G_DebugL = function G_DebugL(who, msg) {
+  if (G_GDEBUG) {
+    var zone = G_GetDebugZone(who);
+
+    if (zone.zoneIsEnabled()) {
+      G_debugService.dump(
+        "\n************************************************************\n");
+
+      G_Debug(who, msg);
+
+      G_debugService.dump(
+        "************************************************************\n\n");
+    }
+  }
+}
+
+/**
+ * Write out a call tracing message
+ *
+ * @param who The thingy to convert into a zone name corresponding to the 
+ *            zone to which this message belongs
+ * @param msg Message to output
+ */
+this.G_TraceCall = function G_TraceCall(who, msg) {
+  if (G_GDEBUG) {
+    if (G_debugService.callTracingEnabled()) {
+      G_debugService.dump(msg + "\n");
+    }
+  }
+}
+
+/**
+ * Write out an error (and throw)
+ *
+ * @param who The thingy to convert into a zone name corresponding to the 
+ *            zone to which this message belongs
+ * @param msg Message to output
+ */
+this.G_Error = function G_Error(who, msg) {
+  if (G_GDEBUG) {
+    G_GetDebugZone(who).error(msg);
+  }
+}
+
+/**
+ * Assert something as true and signal an error if it's not
+ *
+ * @param who The thingy to convert into a zone name corresponding to the 
+ *            zone to which this message belongs
+ * @param condition Boolean condition to test
+ * @param msg Message to output
+ */
+this.G_Assert = function G_Assert(who, condition, msg) {
+  if (G_GDEBUG) {
+    G_GetDebugZone(who).assert(condition, msg);
+  }
+}
+
+/**
+ * Helper function that takes input and returns the DebugZone
+ * corresponding to it.
+ *
+ * @param who Arbitrary input that will be converted into a zone name. Most
+ *            likely an object that has .debugZone property, or a string.
+ * @returns The DebugZone object corresponding to the input
+ */
+this.G_GetDebugZone = function G_GetDebugZone(who) {
+  if (G_GDEBUG) {
+    var zone = "?";
+
+    if (who && who.debugZone) {
+      zone = who.debugZone;
+    } else if (typeof who == "string") {
+      zone = who;
+    }
+
+    return G_debugService.getZone(zone);
+  }
+}
+
+// Classes that implement the functionality.
+
+/**
+ * A debug "zone" is a string derived from arbitrary types (but
+ * typically derived from another string or an object). All debugging
+ * messages using a particular zone can be enabled or disabled
+ * independent of other zones. This enables you to turn on/off logging
+ * of particular objects or modules. This object implements a single
+ * zone and the methods required to use it.
+ *
+ * @constructor
+ * @param service Reference to the DebugService object we use for 
+ *                registration
+ * @param prefix String indicating the unique prefix we should use
+ *               when creating preferences to control this zone
+ * @param zone String indicating the name of the zone
+ */
+this.G_DebugZone = function G_DebugZone(service, prefix, zone) {
+  if (G_GDEBUG) {
+    this.debugService_ = service;
+    this.prefix_ = prefix;
+    this.zone_ = zone;
+    this.zoneEnabledPrefName_ = prefix + ".zone." + this.zone_;
+    this.settings_ = new G_DebugSettings();
+  }
+}
+  
+/**
+ * @returns Boolean indicating if this zone is enabled
+ */
+G_DebugZone.prototype.zoneIsEnabled = function() {
+  if (G_GDEBUG) {
+    var explicit = this.settings_.getSetting(this.zoneEnabledPrefName_, null);
+
+    if (explicit !== null) {
+      return explicit;
+    } else {
+      return this.debugService_.allZonesEnabled();
+    }
+  }
+}
+
+/**
+ * Enable this logging zone
+ */
+G_DebugZone.prototype.enableZone = function() {
+  if (G_GDEBUG) {
+    this.settings_.setDefault(this.zoneEnabledPrefName_, true);
+  }
+}
+
+/**
+ * Disable this logging zone
+ */
+G_DebugZone.prototype.disableZone = function() {
+  if (G_GDEBUG) {
+    this.settings_.setDefault(this.zoneEnabledPrefName_, false);
+  }
+}
+
+/**
+ * Write a debugging message to this zone
+ *
+ * @param msg String of message to write
+ */
+G_DebugZone.prototype.debug = function(msg) {
+  if (G_GDEBUG) {
+    if (this.zoneIsEnabled()) {
+      this.debugService_.dump("[" + this.zone_ + "] " + msg + "\n");
+    }
+  }
+}
+
+/**
+ * Write an error to this zone and throw
+ *
+ * @param msg String of error to write
+ */
+G_DebugZone.prototype.error = function(msg) {
+  if (G_GDEBUG) {
+    this.debugService_.dump("[" + this.zone_ + "] " + msg + "\n");
+    throw new Error(msg);
+    debugger;
+  }
+}
+
+/**
+ * Assert something as true and error if it is not
+ *
+ * @param condition Boolean condition to test
+ * @param msg String of message to write if is false
+ */
+G_DebugZone.prototype.assert = function(condition, msg) {
+  if (G_GDEBUG) {
+    if (condition !== true) {
+      G_Error(this.zone_, "ASSERT FAILED: " + msg);
+    }
+  }
+}
+
+
+/**
+ * The debug service handles auto-registration of zones, namespacing
+ * the zones preferences, and various global settings such as whether
+ * all zones are enabled.
+ *
+ * @constructor
+ * @param opt_prefix Optional string indicating the unique prefix we should 
+ *                   use when creating preferences
+ */
+this.G_DebugService = function G_DebugService(opt_prefix) {
+  if (G_GDEBUG) {
+    this.prefix_ = opt_prefix ? opt_prefix : "safebrowsing-debug-service";
+    this.consoleEnabledPrefName_ = this.prefix_ + ".alsologtoconsole";
+    this.allZonesEnabledPrefName_ = this.prefix_ + ".enableallzones";
+    this.callTracingEnabledPrefName_ = this.prefix_ + ".trace-function-calls";
+    this.logFileEnabledPrefName_ = this.prefix_ + ".logfileenabled";
+    this.logFileErrorLevelPrefName_ = this.prefix_ + ".logfile-errorlevel";
+    this.zones_ = {};
+
+    this.loggifier = new G_Loggifier();
+    this.settings_ = new G_DebugSettings();
+  }
+}
+
+// Error levels for reporting console messages to the log.
+G_DebugService.ERROR_LEVEL_INFO = "INFO";
+G_DebugService.ERROR_LEVEL_WARNING = "WARNING";
+G_DebugService.ERROR_LEVEL_EXCEPTION = "EXCEPTION";
+
+
+/**
+ * @returns Boolean indicating if we should send messages to the jsconsole
+ */
+G_DebugService.prototype.alsoDumpToConsole = function() {
+  if (G_GDEBUG) {
+    return this.settings_.getSetting(this.consoleEnabledPrefName_, false);
+  }
+}
+
+/**
+ * @returns whether to log output to a file as well as the console.
+ */
+G_DebugService.prototype.logFileIsEnabled = function() {
+  if (G_GDEBUG) {
+    return this.settings_.getSetting(this.logFileEnabledPrefName_, false);
+  }
+}
+
+/**
+ * Turns on file logging. dump() output will also go to the file specified by
+ * setLogFile()
+ */
+G_DebugService.prototype.enableLogFile = function() {
+  if (G_GDEBUG) {
+    this.settings_.setDefault(this.logFileEnabledPrefName_, true);
+  }
+}
+
+/**
+ * Turns off file logging
+ */
+G_DebugService.prototype.disableLogFile = function() {
+  if (G_GDEBUG) {
+    this.settings_.setDefault(this.logFileEnabledPrefName_, false);
+  }
+}
+
+/**
+ * @returns an nsIFile instance pointing to the current log file location
+ */
+G_DebugService.prototype.getLogFile = function() {
+  if (G_GDEBUG) {
+    return this.logFile_;
+  }
+}
+
+/**
+ * Sets a new log file location
+ */
+G_DebugService.prototype.setLogFile = function(file) {
+  if (G_GDEBUG) {
+    this.logFile_ = file;
+  }
+}
+
+/**
+ * Enables sending messages to the jsconsole
+ */
+G_DebugService.prototype.enableDumpToConsole = function() {
+  if (G_GDEBUG) {
+    this.settings_.setDefault(this.consoleEnabledPrefName_, true);
+  }
+}
+
+/**
+ * Disables sending messages to the jsconsole
+ */
+G_DebugService.prototype.disableDumpToConsole = function() {
+  if (G_GDEBUG) {
+    this.settings_.setDefault(this.consoleEnabledPrefName_, false);
+  }
+}
+
+/**
+ * @param zone Name of the zone to get
+ * @returns The DebugZone object corresopnding to input. If not such
+ *          zone exists, a new one is created and returned
+ */
+G_DebugService.prototype.getZone = function(zone) {
+  if (G_GDEBUG) {
+    if (!this.zones_[zone]) 
+      this.zones_[zone] = new G_DebugZone(this, this.prefix_, zone);
+    
+    return this.zones_[zone];
+  }
+}
+
+/**
+ * @param zone Zone to enable debugging for
+ */
+G_DebugService.prototype.enableZone = function(zone) {
+  if (G_GDEBUG) {
+    var toEnable = this.getZone(zone);
+    toEnable.enableZone();
+  }
+}
+
+/**
+ * @param zone Zone to disable debugging for
+ */
+G_DebugService.prototype.disableZone = function(zone) {
+  if (G_GDEBUG) {
+    var toDisable = this.getZone(zone);
+    toDisable.disableZone();
+  }
+}
+
+/**
+ * @returns Boolean indicating whether debugging is enabled for all zones
+ */
+G_DebugService.prototype.allZonesEnabled = function() {
+  if (G_GDEBUG) {
+    return this.settings_.getSetting(this.allZonesEnabledPrefName_, false);
+  }
+}
+
+/**
+ * Enables all debugging zones
+ */
+G_DebugService.prototype.enableAllZones = function() {
+  if (G_GDEBUG) {
+    this.settings_.setDefault(this.allZonesEnabledPrefName_, true);
+  }
+}
+
+/**
+ * Disables all debugging zones
+ */
+G_DebugService.prototype.disableAllZones = function() {
+  if (G_GDEBUG) {
+    this.settings_.setDefault(this.allZonesEnabledPrefName_, false);
+  }
+}
+
+/**
+ * @returns Boolean indicating whether call tracing is enabled
+ */
+G_DebugService.prototype.callTracingEnabled = function() {
+  if (G_GDEBUG) {
+    return this.settings_.getSetting(this.callTracingEnabledPrefName_, false);
+  }
+}
+
+/**
+ * Enables call tracing
+ */
+G_DebugService.prototype.enableCallTracing = function() {
+  if (G_GDEBUG) {
+    this.settings_.setDefault(this.callTracingEnabledPrefName_, true);
+  }
+}
+
+/**
+ * Disables call tracing
+ */
+G_DebugService.prototype.disableCallTracing = function() {
+  if (G_GDEBUG) {
+    this.settings_.setDefault(this.callTracingEnabledPrefName_, false);
+  }
+}
+
+/**
+ * Gets the minimum error that will be reported to the log.
+ */
+G_DebugService.prototype.getLogFileErrorLevel = function() {
+  if (G_GDEBUG) {
+    var level = this.settings_.getSetting(this.logFileErrorLevelPrefName_, 
+                                          G_DebugService.ERROR_LEVEL_EXCEPTION);
+
+    return level.toUpperCase();
+  }
+}
+
+/**
+ * Sets the minimum error level that will be reported to the log.
+ */
+G_DebugService.prototype.setLogFileErrorLevel = function(level) {
+  if (G_GDEBUG) {
+    // normalize case just to make it slightly easier to not screw up.
+    level = level.toUpperCase();
+
+    if (level != G_DebugService.ERROR_LEVEL_INFO &&
+        level != G_DebugService.ERROR_LEVEL_WARNING &&
+        level != G_DebugService.ERROR_LEVEL_EXCEPTION) {
+      throw new Error("Invalid error level specified: {" + level + "}");
+    }
+
+    this.settings_.setDefault(this.logFileErrorLevelPrefName_, level);
+  }
+}
+
+/**
+ * Internal dump() method
+ *
+ * @param msg String of message to dump
+ */
+G_DebugService.prototype.dump = function(msg) {
+  if (G_GDEBUG) {
+    dump(msg);
+    
+    if (this.alsoDumpToConsole()) {
+      try {
+        var console = Components.classes['@mozilla.org/consoleservice;1']
+                      .getService(Components.interfaces.nsIConsoleService);
+        console.logStringMessage(msg);
+      } catch(e) {
+        dump("G_DebugZone ERROR: COULD NOT DUMP TO CONSOLE\n");
+      }
+    }
+
+    this.maybeDumpToFile(msg);
+  }
+}
+
+/**
+ * Writes the specified message to the log file, if file logging is enabled.
+ */
+G_DebugService.prototype.maybeDumpToFile = function(msg) {
+  if (this.logFileIsEnabled() && this.logFile_) {
+
+    /* try to get the correct line end character for this platform */
+    if (!this._LINE_END_CHAR)
+      this._LINE_END_CHAR =
+        Cc["@mozilla.org/xre/app-info;1"].getService(Ci.nsIXULRuntime)
+                                         .OS == "WINNT" ? "\r\n" : "\n";
+    if (this._LINE_END_CHAR != "\n")
+      msg = msg.replace(/\n/g, this._LINE_END_CHAR);
+
+    try {
+      var stream = Cc["@mozilla.org/network/file-output-stream;1"]
+                   .createInstance(Ci.nsIFileOutputStream);
+      stream.init(this.logFile_,
+                  0x02 | 0x08 | 0x10 /* PR_WRONLY | PR_CREATE_FILE | PR_APPEND */
+                  -1 /* default perms */, 0 /* no special behavior */);
+      stream.write(msg, msg.length);
+    } finally {
+      stream.close();
+    }
+  }
+}
+
+/**
+ * Implements nsIConsoleListener.observe(). Gets called when an error message
+ * gets reported to the console and sends it to the log file as well.
+ */
+G_DebugService.prototype.observe = function(consoleMessage) {
+  if (G_GDEBUG) {
+    var errorLevel = this.getLogFileErrorLevel();
+
+    // consoleMessage can be either nsIScriptError or nsIConsoleMessage. The
+    // latter does not have things like line number, etc. So we special case 
+    // it first. 
+    if (!(consoleMessage instanceof Ci.nsIScriptError)) {
+      // Only report these messages if the error level is INFO.
+      if (errorLevel == G_DebugService.ERROR_LEVEL_INFO) {
+        this.maybeDumpToFile(G_DebugService.ERROR_LEVEL_INFO + ": " + 
+                             consoleMessage.message + "\n");
+      }
+
+      return;
+    }
+
+    // We make a local copy of these fields because writing to it doesn't seem
+    // to work.
+    var flags = consoleMessage.flags;
+    var sourceName = consoleMessage.sourceName;
+    var lineNumber = consoleMessage.lineNumber;
+
+    // Sometimes, a scripterror instance won't have any flags set. We 
+    // default to exception.
+    if (!flags) {
+      flags = Ci.nsIScriptError.exceptionFlag;
+    }
+
+    // Default the filename and line number if they aren't set.
+    if (!sourceName) {
+      sourceName = "<unknown>";
+    }
+
+    if (!lineNumber) {
+      lineNumber = "<unknown>";
+    }
+
+    // Report the error in the log file.
+    if (flags & Ci.nsIScriptError.warningFlag) {
+      // Only report warnings if the error level is warning or better. 
+      if (errorLevel == G_DebugService.ERROR_LEVEL_WARNING ||
+          errorLevel == G_DebugService.ERROR_LEVEL_INFO) {
+        this.reportScriptError_(consoleMessage.message,
+                                sourceName,
+                                lineNumber,
+                                G_DebugService.ERROR_LEVEL_WARNING);
+      }
+    } else if (flags & Ci.nsIScriptError.exceptionFlag) {
+      // Always report exceptions.
+      this.reportScriptError_(consoleMessage.message,
+                              sourceName,
+                              lineNumber,
+                              G_DebugService.ERROR_LEVEL_EXCEPTION);
+    }
+  }
+}
+
+/**
+ * Private helper to report an nsIScriptError instance to the log/console.
+ */
+G_DebugService.prototype.reportScriptError_ = function(message, sourceName, 
+                                                       lineNumber, label) {
+  message = "\n------------------------------------------------------------\n" +
+            label + ": " + message +
+            "\nlocation: " + sourceName + ", " + "line: " + lineNumber +
+            "\n------------------------------------------------------------\n\n";
+
+  dump(message);
+  this.maybeDumpToFile(message);
+}
+
+
+
+/**
+ * A class that instruments methods so they output a call trace,
+ * including the values of their actual parameters and return value.
+ * This code is mostly stolen from Aaron Boodman's original
+ * implementation in clobber utils.
+ *
+ * Note that this class uses the "loggifier" debug zone, so you'll see 
+ * a complete call trace when that zone is enabled.
+ *
+ * @constructor
+ */
+this.G_Loggifier = function G_Loggifier() {
+  if (G_GDEBUG) {
+    // Careful not to loggify ourselves!
+    this.mark_(this);  
+  }
+}
+
+/**
+ * Marks an object as having been loggified. Loggification is not 
+ * idempotent :)
+ *
+ * @param obj Object to be marked
+ */
+G_Loggifier.prototype.mark_ = function(obj) {
+  if (G_GDEBUG) {
+    obj.__loggified_ = true;
+  }
+}
+
+/**
+ * @param obj Object to be examined
+ * @returns Boolean indicating if the object has been loggified
+ */
+G_Loggifier.prototype.isLoggified = function(obj) {
+  if (G_GDEBUG) {
+    return !!obj.__loggified_;
+  }
+}
+
+/**
+ * Attempt to extract the class name from the constructor definition.
+ * Assumes the object was created using new.
+ *
+ * @param constructor String containing the definition of a constructor,
+ *                    for example what you'd get by examining obj.constructor
+ * @returns Name of the constructor/object if it could be found, else "???"
+ */
+G_Loggifier.prototype.getFunctionName_ = function(constructor) {
+  if (G_GDEBUG) {
+    return constructor.name || "???";
+  }
+}
+
+/**
+ * Wraps all the methods in an object so that call traces are
+ * automatically outputted.
+ *
+ * @param obj Object to loggify. SHOULD BE THE PROTOTYPE OF A USER-DEFINED
+ *            object. You can get into trouble if you attempt to 
+ *            loggify something that isn't, for example the Window.
+ *
+ * Any additional parameters are considered method names which should not be
+ * loggified.
+ *
+ * Usage:
+ * G_debugService.loggifier.loggify(MyClass.prototype,
+ *                                  "firstMethodNotToLog",
+ *                                  "secondMethodNotToLog",
+ *                                  ... etc ...);
+ */
+G_Loggifier.prototype.loggify = function(obj) {
+  if (G_GDEBUG) {
+    if (!G_debugService.callTracingEnabled()) {
+      return;
+    }
+
+    if (typeof window != "undefined" && obj == window || 
+        this.isLoggified(obj))   // Don't go berserk!
+      return;
+
+    var zone = G_GetDebugZone(obj);
+    if (!zone || !zone.zoneIsEnabled()) {
+      return;
+    }
+
+    this.mark_(obj);
+
+    // Helper function returns an instrumented version of
+    // objName.meth, with "this" bound properly. (BTW, because we're
+    // in a conditional here, functions will only be defined as
+    // they're encountered during execution, so declare this helper
+    // before using it.)
+
+    let wrap = function (meth, objName, methName) {
+      return function() {
+        
+        // First output the call along with actual parameters
+        var args = new Array(arguments.length);
+        var argsString = "";
+        for (var i = 0; i < args.length; i++) {
+          args[i] = arguments[i];
+          argsString += (i == 0 ? "" : ", ");
+          
+          if (typeof args[i] == "function") {
+            argsString += "[function]";
+          } else {
+            argsString += args[i];
+          }
+        }
+
+        G_TraceCall(this, "> " + objName + "." + methName + "(" + 
+                    argsString + ")");
+        
+        // Then run the function, capturing the return value and throws
+        try {
+          var retVal = meth.apply(this, arguments);
+          var reportedRetVal = retVal;
+
+          if (typeof reportedRetVal == "undefined")
+            reportedRetVal = "void";
+          else if (reportedRetVal === "")
+            reportedRetVal = "\"\" (empty string)";
+        } catch (e) {
+          if (e && !e.__logged) {
+            G_TraceCall(this, "Error: " + e.message + ". " + 
+                        e.fileName + ": " + e.lineNumber);
+            try {
+              e.__logged = true;
+            } catch (e2) {
+              // Sometimes we can't add the __logged flag because it's an
+              // XPC wrapper
+              throw e;
+            }
+          }
+          
+          throw e;      // Re-throw!
+        }
+
+        // And spit it out already
+        G_TraceCall(
+          this, 
+          "< " + objName + "." + methName + ": " + reportedRetVal);
+
+        return retVal;
+      };
+    };
+
+    var ignoreLookup = {};
+
+    if (arguments.length > 1) {
+      for (var i = 1; i < arguments.length; i++) {
+        ignoreLookup[arguments[i]] = true;
+      }
+    }
+    
+    // Wrap each method of obj
+    for (var p in obj) {
+      // Work around bug in Firefox. In ffox typeof RegExp is "function",
+      // so make sure this really is a function. Bug as of FFox 1.5b2.
+      if (typeof obj[p] == "function" && obj[p].call && !ignoreLookup[p]) {
+        var objName = this.getFunctionName_(obj.constructor);
+        obj[p] = wrap(obj[p], objName, p);
+      }
+    }
+  }
+}
+
+
+/**
+ * Simple abstraction around debug settings. The thing with debug settings is
+ * that we want to be able to specify a default in the application's startup,
+ * but have that default be overridable by the user via their prefs.
+ *
+ * To generalize this, we package up a dictionary of defaults with the 
+ * preferences tree. If a setting isn't in the preferences tree, then we grab it
+ * from the defaults.
+ */
+this.G_DebugSettings = function G_DebugSettings() {
+  this.defaults_ = {};
+  this.prefs_ = new G_Preferences();
+}
+
+/**
+ * Returns the value of a settings, optionally defaulting to a given value if it
+ * doesn't exist. If no default is specified, the default is |undefined|.
+ */
+G_DebugSettings.prototype.getSetting = function(name, opt_default) {
+  var override = this.prefs_.getPref(name, null);
+
+  if (override !== null) {
+    return override;
+  } else if (typeof this.defaults_[name] != "undefined") {
+    return this.defaults_[name];
+  } else {
+    return opt_default;
+  }
+}
+
+/**
+ * Sets the default value for a setting. If the user doesn't override it with a
+ * preference, this is the value which will be returned by getSetting().
+ */
+G_DebugSettings.prototype.setDefault = function(name, val) {
+  this.defaults_[name] = val;
+}
+
+var G_debugService = new G_DebugService(); // Instantiate us!
+
+if (G_GDEBUG) {
+  G_debugService.enableAllZones();
+}
+
+#else
+
+// Stubs for the debugging aids scattered through this component.
+// They will be expanded if you compile yourself a debug build.
+
+this.G_Debug = function G_Debug(who, msg) { }
+this.G_Assert = function G_Assert(who, condition, msg) { }
+this.G_Error = function G_Error(who, msg) { }
+this.G_debugService = {
+    alsoDumpToConsole: () => {},
+    logFileIsEnabled: () => {},
+    enableLogFile: () => {},
+    disableLogFile: () => {},
+    getLogFile: () => {},
+    setLogFile: () => {},
+    enableDumpToConsole: () => {},
+    disableDumpToConsole: () => {},
+    getZone: () => {},
+    enableZone: () => {},
+    disableZone: () => {},
+    allZonesEnabled: () => {},
+    enableAllZones: () => {},
+    disableAllZones: () => {},
+    callTracingEnabled: () => {},
+    enableCallTracing: () => {},
+    disableCallTracing: () => {},
+    getLogFileErrorLevel: () => {},
+    setLogFileErrorLevel: () => {},
+    dump: () => {},
+    maybeDumpToFile: () => {},
+    observe: () => {},
+    reportScriptError_: () => {}
+};
+
+#endif
diff --git a/toolkit/components/url-classifier/content/moz/lang.js b/toolkit/components/url-classifier/content/moz/lang.js
new file mode 100644
index 0000000000..804a6e973e
--- /dev/null
+++ b/toolkit/components/url-classifier/content/moz/lang.js
@@ -0,0 +1,82 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+
+/**
+ * lang.js - Some missing JavaScript language features
+ */
+
+/**
+ * Partially applies a function to a particular "this object" and zero or
+ * more arguments. The result is a new function with some arguments of the first
+ * function pre-filled and the value of |this| "pre-specified".
+ *
+ * Remaining arguments specified at call-time are appended to the pre-
+ * specified ones.
+ *
+ * Usage:
+ * var barMethBound = BindToObject(myFunction, myObj, "arg1", "arg2");
+ * barMethBound("arg3", "arg4");
+ *
+ * @param fn {string} Reference to the function to be bound
+ *
+ * @param self {object} Specifies the object which |this| should point to
+ * when the function is run. If the value is null or undefined, it will default
+ * to the global object.
+ *
+ * @returns {function} A partially-applied form of the speficied function.
+ */
+this.BindToObject = function BindToObject(fn, self, opt_args) {
+  var boundargs = fn.boundArgs_ || [];
+  boundargs = boundargs.concat(Array.slice(arguments, 2, arguments.length));
+
+  if (fn.boundSelf_)
+    self = fn.boundSelf_;
+  if (fn.boundFn_)
+    fn = fn.boundFn_;
+
+  var newfn = function() {
+    // Combine the static args and the new args into one big array
+    var args = boundargs.concat(Array.slice(arguments));
+    return fn.apply(self, args);
+  }
+
+  newfn.boundArgs_ = boundargs;
+  newfn.boundSelf_ = self;
+  newfn.boundFn_ = fn;
+
+  return newfn;
+}
+
+/**
+ * Inherit the prototype methods from one constructor into another.
+ *
+ * Usage:
+ *
+ * function ParentClass(a, b) { }
+ * ParentClass.prototype.foo = function(a) { }
+ *
+ * function ChildClass(a, b, c) {
+ *   ParentClass.call(this, a, b);
+ * }
+ *
+ * ChildClass.inherits(ParentClass);
+ *
+ * var child = new ChildClass("a", "b", "see");
+ * child.foo(); // works
+ *
+ * In addition, a superclass' implementation of a method can be invoked
+ * as follows:
+ *
+ * ChildClass.prototype.foo = function(a) {
+ *   ChildClass.superClass_.foo.call(this, a);
+ *   // other code
+ * };
+ */
+Function.prototype.inherits = function(parentCtor) {
+  var tempCtor = function(){};
+  tempCtor.prototype = parentCtor.prototype;
+  this.superClass_ = parentCtor.prototype;
+  this.prototype = new tempCtor();
+}
diff --git a/toolkit/components/url-classifier/content/moz/observer.js b/toolkit/components/url-classifier/content/moz/observer.js
new file mode 100644
index 0000000000..526cf7de28
--- /dev/null
+++ b/toolkit/components/url-classifier/content/moz/observer.js
@@ -0,0 +1,145 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+
+// A couple of classes to simplify creating observers. 
+//
+// // Example1:
+//
+// function doSomething() { ... }
+// var observer = new G_ObserverWrapper(topic, doSomething);
+// someObj.addObserver(topic, observer);
+//
+// // Example2: 
+//
+// function doSomething() { ... }
+// new G_ObserverServiceObserver("profile-after-change", 
+//                               doSomething,
+//                               true /* run only once */);
+
+
+/**
+ * This class abstracts the admittedly simple boilerplate required of
+ * an nsIObserver. It saves you the trouble of implementing the
+ * indirection of your own observe() function.
+ *
+ * @param topic String containing the topic the observer will filter for
+ *
+ * @param observeFunction Reference to the function to call when the 
+ *                        observer fires
+ *
+ * @constructor
+ */
+this.G_ObserverWrapper = function G_ObserverWrapper(topic, observeFunction) {
+  this.debugZone = "observer";
+  this.topic_ = topic;
+  this.observeFunction_ = observeFunction;
+}
+
+/**
+ * XPCOM
+ */
+G_ObserverWrapper.prototype.QueryInterface = function(iid) {
+  if (iid.equals(Ci.nsISupports) || iid.equals(Ci.nsIObserver))
+    return this;
+  throw Components.results.NS_ERROR_NO_INTERFACE;
+}
+
+/**
+ * Invoked by the thingy being observed
+ */
+G_ObserverWrapper.prototype.observe = function(subject, topic, data) {
+  if (topic == this.topic_)
+    this.observeFunction_(subject, topic, data);
+}
+
+
+/**
+ * This class abstracts the admittedly simple boilerplate required of
+ * observing an observerservice topic. It implements the indirection
+ * required, and automatically registers to hear the topic.
+ *
+ * @param topic String containing the topic the observer will filter for
+ *
+ * @param observeFunction Reference to the function to call when the 
+ *                        observer fires
+ *
+ * @param opt_onlyOnce Boolean indicating if the observer should unregister
+ *                     after it has fired
+ *
+ * @constructor
+ */
+this.G_ObserverServiceObserver =
+function G_ObserverServiceObserver(topic, observeFunction, opt_onlyOnce) {
+  this.debugZone = "observerserviceobserver";
+  this.topic_ = topic;
+  this.observeFunction_ = observeFunction;
+  this.onlyOnce_ = !!opt_onlyOnce;
+  
+  this.observer_ = new G_ObserverWrapper(this.topic_, 
+                                         BindToObject(this.observe_, this));
+  this.observerService_ = Cc["@mozilla.org/observer-service;1"]
+                          .getService(Ci.nsIObserverService);
+  this.observerService_.addObserver(this.observer_, this.topic_, false);
+}
+
+/**
+ * Unregister the observer from the observerservice
+ */
+G_ObserverServiceObserver.prototype.unregister = function() {
+  this.observerService_.removeObserver(this.observer_, this.topic_);
+  this.observerService_ = null;
+}
+
+/**
+ * Invoked by the observerservice
+ */
+G_ObserverServiceObserver.prototype.observe_ = function(subject, topic, data) {
+  this.observeFunction_(subject, topic, data);
+  if (this.onlyOnce_)
+    this.unregister();
+}
+
+#ifdef DEBUG
+this.TEST_G_Observer = function TEST_G_Observer() {
+  if (G_GDEBUG) {
+
+    var z = "observer UNITTEST";
+    G_debugService.enableZone(z);
+
+    G_Debug(z, "Starting");
+
+    var regularObserverRan = 0;
+    var observerServiceObserverRan = 0;
+
+    let regularObserver = function () {
+      regularObserverRan++;
+    };
+
+    let observerServiceObserver = function () {
+      observerServiceObserverRan++;
+    };
+
+    var service = Cc["@mozilla.org/observer-service;1"]
+                  .getService(Ci.nsIObserverService);
+    var topic = "google-observer-test";
+
+    var o1 = new G_ObserverWrapper(topic, regularObserver);
+    service.addObserver(o1, topic, false);
+
+    new G_ObserverServiceObserver(topic, 
+                                  observerServiceObserver, true /* once */);
+
+    // Notifications happen synchronously, so this is easy
+    service.notifyObservers(null, topic, null);
+    service.notifyObservers(null, topic, null);
+
+    G_Assert(z, regularObserverRan == 2, "Regular observer broken");
+    G_Assert(z, observerServiceObserverRan == 1, "ObsServObs broken");
+
+    service.removeObserver(o1, topic);
+    G_Debug(z, "PASSED");
+  }
+}
+#endif
diff --git a/toolkit/components/url-classifier/content/moz/preferences.js b/toolkit/components/url-classifier/content/moz/preferences.js
new file mode 100644
index 0000000000..30105ab344
--- /dev/null
+++ b/toolkit/components/url-classifier/content/moz/preferences.js
@@ -0,0 +1,276 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+
+// Class for manipulating preferences. Aside from wrapping the pref
+// service, useful functionality includes:
+//
+// - abstracting prefobserving so that you can observe preferences
+//   without implementing nsIObserver 
+// 
+// - getters that return a default value when the pref doesn't exist 
+//   (instead of throwing)
+// 
+// - get-and-set getters
+//
+// Example:
+// 
+// var p = new PROT_Preferences();
+// dump(p.getPref("some-true-pref"));     // shows true
+// dump(p.getPref("no-such-pref", true)); // shows true   
+// dump(p.getPref("no-such-pref", null)); // shows null
+//
+// function observe(prefThatChanged) {
+//   dump("Pref changed: " + prefThatChanged);
+// };
+//
+// p.addObserver("somepref", observe);
+// p.setPref("somepref", true);            // dumps
+// p.removeObserver("somepref", observe);
+//
+// TODO: should probably have the prefobserver pass in the new and old
+//       values
+
+// TODO(tc): Maybe remove this class and just call natively since we're no
+//           longer an extension.
+
+/**
+ * A class that wraps the preferences service.
+ *
+ * @param opt_startPoint        A starting point on the prefs tree to resolve 
+ *                              names passed to setPref and getPref.
+ *
+ * @param opt_useDefaultPranch  Set to true to work against the default 
+ *                              preferences tree instead of the profile one.
+ *
+ * @constructor
+ */
+this.G_Preferences =
+function G_Preferences(opt_startPoint, opt_getDefaultBranch) {
+  this.debugZone = "prefs";
+  this.observers_ = {};
+  this.getDefaultBranch_ = !!opt_getDefaultBranch;
+
+  this.startPoint_ = opt_startPoint || null;
+}
+
+G_Preferences.setterMap_ = { "string": "setCharPref",
+                             "boolean": "setBoolPref",
+                             "number": "setIntPref" };
+
+G_Preferences.getterMap_ = {};
+G_Preferences.getterMap_[Ci.nsIPrefBranch.PREF_STRING] = "getCharPref";
+G_Preferences.getterMap_[Ci.nsIPrefBranch.PREF_BOOL] = "getBoolPref";
+G_Preferences.getterMap_[Ci.nsIPrefBranch.PREF_INT] = "getIntPref";
+
+G_Preferences.prototype.__defineGetter__('prefs_', function() {
+  var prefs;
+  var prefSvc = Cc["@mozilla.org/preferences-service;1"]
+                  .getService(Ci.nsIPrefService);
+
+  if (this.getDefaultBranch_) {
+    prefs = prefSvc.getDefaultBranch(this.startPoint_);
+  } else {
+    prefs = prefSvc.getBranch(this.startPoint_);
+  }
+
+  // QI to prefs in case we want to add observers
+  prefs.QueryInterface(Ci.nsIPrefBranchInternal);
+  return prefs;
+});
+
+/**
+ * Stores a key/value in a user preference. Valid types for val are string,
+ * boolean, and number. Complex values are not yet supported (but feel free to
+ * add them!).
+ */
+G_Preferences.prototype.setPref = function(key, val) {
+  var datatype = typeof(val);
+
+  if (datatype == "number" && (val % 1 != 0)) {
+    throw new Error("Cannot store non-integer numbers in preferences.");
+  }
+
+  var meth = G_Preferences.setterMap_[datatype];
+
+  if (!meth) {
+    throw new Error("Pref datatype {" + datatype + "} not supported.");
+  }
+
+  return this.prefs_[meth](key, val);
+}
+
+/**
+ * Retrieves a user preference. Valid types for the value are the same as for
+ * setPref. If the preference is not found, opt_default will be returned 
+ * instead.
+ */
+G_Preferences.prototype.getPref = function(key, opt_default) {
+  var type = this.prefs_.getPrefType(key);
+
+  // zero means that the specified pref didn't exist
+  if (type == Ci.nsIPrefBranch.PREF_INVALID) {
+    return opt_default;
+  }
+
+  var meth = G_Preferences.getterMap_[type];
+
+  if (!meth) {
+    throw new Error("Pref datatype {" + type + "} not supported.");
+  }
+
+  // If a pref has been cleared, it will have a valid type but won't
+  // be gettable, so this will throw.
+  try {
+    return this.prefs_[meth](key);
+  } catch(e) {
+    return opt_default;
+  }
+}
+
+/**
+ * Delete a preference. 
+ *
+ * @param which Name of preference to obliterate
+ */
+G_Preferences.prototype.clearPref = function(which) {
+  try {
+    // This throws if the pref doesn't exist, which is fine because a 
+    // nonexistent pref is cleared
+    this.prefs_.clearUserPref(which);
+  } catch(e) {}
+}
+
+/**
+ * Add an observer for a given pref.
+ *
+ * @param which String containing the pref to listen to
+ * @param callback Function to be called when the pref changes. This
+ *                 function will receive a single argument, a string 
+ *                 holding the preference name that changed
+ */
+G_Preferences.prototype.addObserver = function(which, callback) {
+  // Need to store the observer we create so we can eventually unregister it
+  if (!this.observers_[which])
+    this.observers_[which] = { callbacks: [], observers: [] };
+
+  /* only add an observer if the callback hasn't been registered yet */
+  if (this.observers_[which].callbacks.indexOf(callback) == -1) {
+    var observer = new G_PreferenceObserver(callback);
+    this.observers_[which].callbacks.push(callback);
+    this.observers_[which].observers.push(observer);
+    this.prefs_.addObserver(which, observer, false /* strong reference */);
+  }
+}
+
+/**
+ * Remove an observer for a given pref.
+ *
+ * @param which String containing the pref to stop listening to
+ * @param callback Function to remove as an observer
+ */
+G_Preferences.prototype.removeObserver = function(which, callback) {
+  var ix = this.observers_[which].callbacks.indexOf(callback);
+  G_Assert(this, ix != -1, "Tried to unregister a nonexistent observer"); 
+  this.observers_[which].callbacks.splice(ix, 1);
+  var observer = this.observers_[which].observers.splice(ix, 1)[0];
+  this.prefs_.removeObserver(which, observer);
+}
+
+/**
+ * Remove all preference observers registered through this object.
+ */
+G_Preferences.prototype.removeAllObservers = function() {
+  for (var which in this.observers_) {
+    for (var observer of this.observers_[which].observers) {
+      this.prefs_.removeObserver(which, observer);
+    }
+  }
+  this.observers_ = {};
+}
+
+/**
+ * Helper class that knows how to observe preference changes and
+ * invoke a callback when they do
+ *
+ * @constructor
+ * @param callback Function to call when the preference changes
+ */
+this.G_PreferenceObserver =
+function G_PreferenceObserver(callback) {
+  this.debugZone = "prefobserver";
+  this.callback_ = callback;
+}
+
+/**
+ * Invoked by the pref system when a preference changes. Passes the
+ * message along to the callback.
+ *
+ * @param subject The nsIPrefBranch that changed
+ * @param topic String "nsPref:changed" (aka 
+ *              NS_PREFBRANCH_PREFCHANGE_OBSERVER_ID -- but where does it
+ *              live???)
+ * @param data Name of the pref that changed
+ */
+G_PreferenceObserver.prototype.observe = function(subject, topic, data) {
+  G_Debug(this, "Observed pref change: " + data);
+  this.callback_(data);
+}
+
+/**
+ * XPCOM cruft
+ *
+ * @param iid Interface id of the interface the caller wants
+ */
+G_PreferenceObserver.prototype.QueryInterface = function(iid) {
+  if (iid.equals(Ci.nsISupports) || 
+      iid.equals(Ci.nsIObserver) ||
+      iid.equals(Ci.nsISupportsWeakReference))
+    return this;
+  throw Components.results.NS_ERROR_NO_INTERFACE;
+}
+
+#ifdef DEBUG
+// UNITTESTS
+this.TEST_G_Preferences = function TEST_G_Preferences() {
+  if (G_GDEBUG) {
+    var z = "preferences UNITTEST";
+    G_debugService.enableZone(z);
+    G_Debug(z, "Starting");
+
+    var p = new G_Preferences();
+    
+    var testPref = "test-preferences-unittest";
+    var noSuchPref = "test-preferences-unittest-aypabtu";
+    
+    // Used to test observing
+    var observeCount = 0;
+    let observe = function (prefChanged) {
+      G_Assert(z, prefChanged == testPref, "observer broken");
+      observeCount++;
+    };
+
+    // Test setting, getting, and observing
+    p.addObserver(testPref, observe);
+    p.setPref(testPref, true);
+    G_Assert(z, p.getPref(testPref), "get or set broken");
+    G_Assert(z, observeCount == 1, "observer adding not working");
+
+    p.removeObserver(testPref, observe);
+
+    p.setPref(testPref, false);
+    G_Assert(z, observeCount == 1, "observer removal not working");
+    G_Assert(z, !p.getPref(testPref), "get broken");
+    
+    // Remember to clean up the prefs we've set, and test removing prefs 
+    // while we're at it
+    p.clearPref(noSuchPref);
+    G_Assert(z, !p.getPref(noSuchPref, false), "clear broken");
+    
+    p.clearPref(testPref);
+    
+    G_Debug(z, "PASSED");
+  }
+}
+#endif
diff --git a/toolkit/components/url-classifier/content/moz/protocol4.js b/toolkit/components/url-classifier/content/moz/protocol4.js
new file mode 100644
index 0000000000..a75f6b531e
--- /dev/null
+++ b/toolkit/components/url-classifier/content/moz/protocol4.js
@@ -0,0 +1,133 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+
+// A helper class that knows how to parse from and serialize to
+// protocol4. This is a simple, historical format used by some Google
+// interfaces, for example the Toolbar (i.e., ancient services).
+//
+// Protocol4 consists of a newline-separated sequence of name/value
+// pairs (strings). Each line consists of the name, the value length,
+// and the value itself, all separated by colons. Example:
+//
+// foo:6:barbaz\n
+// fritz:33:issickofdynamicallytypedlanguages\n
+
+
+/**
+ * This class knows how to serialize/deserialize maps to/from their
+ * protocol4 representation.
+ *
+ * @constructor
+ */
+this.G_Protocol4Parser = function G_Protocol4Parser() {
+  this.debugZone = "protocol4";
+
+  this.protocol4RegExp_ = new RegExp("([^:]+):\\d+:(.*)$");
+  this.newlineRegExp_ = new RegExp("(\\r)?\\n");
+}
+
+/**
+ * Create a map from a protocol4 string. Silently skips invalid lines.
+ *
+ * @param text String holding the protocol4 representation
+ * 
+ * @returns Object as an associative array with keys and values 
+ *          given in text. The empty object is returned if none
+ *          are parsed.
+ */
+G_Protocol4Parser.prototype.parse = function(text) {
+
+  var response = {};
+  if (!text)
+    return response;
+
+  // Responses are protocol4: (repeated) name:numcontentbytes:content\n
+  var lines = text.split(this.newlineRegExp_);
+  for (var i = 0; i < lines.length; i++)
+    if (this.protocol4RegExp_.exec(lines[i]))
+      response[RegExp.$1] = RegExp.$2;
+
+  return response;
+}
+
+/**
+ * Create a protocol4 string from a map (object). Throws an error on 
+ * an invalid input.
+ *
+ * @param map Object as an associative array with keys and values 
+ *            given as strings.
+ *
+ * @returns text String holding the protocol4 representation
+ */
+G_Protocol4Parser.prototype.serialize = function(map) {
+  if (typeof map != "object")
+    throw new Error("map must be an object");
+
+  var text = "";
+  for (var key in map) {
+    if (typeof map[key] != "string")
+      throw new Error("Keys and values must be strings");
+    
+    text += key + ":" + map[key].length + ":" + map[key] + "\n";
+  }
+  
+  return text;
+}
+
+#ifdef DEBUG
+/**
+ * Cheesey unittests
+ */
+this.TEST_G_Protocol4Parser = function TEST_G_Protocol4Parser() {
+  if (G_GDEBUG) {
+    var z = "protocol4 UNITTEST";
+    G_debugService.enableZone(z);
+
+    G_Debug(z, "Starting");
+
+    var p = new G_Protocol4Parser();
+    
+    let isEmpty = function (map) {
+      for (var key in map) 
+        return false;
+      return true;
+    };
+
+    G_Assert(z, isEmpty(p.parse(null)), "Parsing null broken");
+    G_Assert(z, isEmpty(p.parse("")), "Parsing nothing broken");
+
+    var t = "foo:3:bar";
+    G_Assert(z, p.parse(t)["foo"] === "bar", "Parsing one line broken");
+
+    t = "foo:3:bar\n";
+    G_Assert(z, p.parse(t)["foo"] === "bar", "Parsing line with lf broken");
+
+    t = "foo:3:bar\r\n";
+    G_Assert(z, p.parse(t)["foo"] === "bar", "Parsing with crlf broken");
+
+
+    t = "foo:3:bar\nbar:3:baz\r\nbom:3:yaz\n";
+    G_Assert(z, p.parse(t)["foo"] === "bar", "First in multiline");
+    G_Assert(z, p.parse(t)["bar"] === "baz", "Second in multiline");
+    G_Assert(z, p.parse(t)["bom"] === "yaz", "Third in multiline");
+    G_Assert(z, p.parse(t)[""] === undefined, "Nonexistent in multiline");
+    
+    // Test serialization
+
+    var original = { 
+      "1": "1", 
+      "2": "2", 
+      "foobar": "baz",
+      "hello there": "how are you?" ,
+    };
+    var deserialized = p.parse(p.serialize(original));
+    for (var key in original) 
+      G_Assert(z, original[key] === deserialized[key], 
+               "Trouble (de)serializing " + key);
+
+    G_Debug(z, "PASSED");  
+  }
+}
+#endif
diff --git a/toolkit/components/url-classifier/content/multi-querier.js b/toolkit/components/url-classifier/content/multi-querier.js
new file mode 100644
index 0000000000..f79db8154d
--- /dev/null
+++ b/toolkit/components/url-classifier/content/multi-querier.js
@@ -0,0 +1,137 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+/**
+ * This class helps us batch a series of async calls to the db.
+ * If any of the tokens is in the database, we fire callback with
+ * true as a param.  If all the tokens are not in the  database,
+ * we fire callback with false as a param.
+ * This is an "Abstract" base class.  Subclasses need to supply
+ * the condition_ method.
+ *
+ * @param tokens Array of strings to lookup in the db
+ * @param tableName String name of the table
+ * @param callback Function callback function that takes true if the condition
+ *        passes.
+ */
+this.MultiQuerier =
+function MultiQuerier(tokens, tableName, callback) {
+  this.tokens_ = tokens;
+  this.tableName_ = tableName;
+  this.callback_ = callback;
+  this.dbservice_ = Cc["@mozilla.org/url-classifier/dbservice;1"]
+                    .getService(Ci.nsIUrlClassifierDBService);
+  // We put the current token in this variable.
+  this.key_ = null;
+}
+
+/**
+ * Run the remaining tokens against the db.
+ */
+MultiQuerier.prototype.run = function() {
+  if (this.tokens_.length == 0) {
+    this.callback_.handleEvent(false);
+    this.dbservice_ = null;
+    this.callback_ = null;
+    return;
+  }
+  
+  this.key_ = this.tokens_.pop();
+  G_Debug(this, "Looking up " + this.key_ + " in " + this.tableName_);
+  this.dbservice_.exists(this.tableName_, this.key_,
+                         BindToObject(this.result_, this));
+}
+
+/**
+ * Callback from the db.  If the returned value passes the this.condition_
+ * test, go ahead and call the main callback.
+ */
+MultiQuerier.prototype.result_ = function(value) {
+  if (this.condition_(value)) {
+    this.callback_.handleEvent(true)
+    this.dbservice_ = null;
+    this.callback_ = null;
+  } else {
+    this.run();
+  }
+}
+
+// Subclasses must override this.
+MultiQuerier.prototype.condition_ = function(value) {
+  throw "MultiQuerier is an abstract base class";
+}
+
+
+/**
+ * Concrete MultiQuerier that stops if the key exists in the db.
+ */
+this.ExistsMultiQuerier =
+function ExistsMultiQuerier(tokens, tableName, callback) {
+  MultiQuerier.call(this, tokens, tableName, callback);
+  this.debugZone = "existsMultiQuerier";
+}
+
+ExistsMultiQuerier.inherits = function(parentCtor) {
+  var tempCtor = function(){};
+  tempCtor.prototype = parentCtor.prototype;
+  this.superClass_ = parentCtor.prototype;
+  this.prototype = new tempCtor();
+}
+ExistsMultiQuerier.inherits(MultiQuerier);
+
+ExistsMultiQuerier.prototype.condition_ = function(value) {
+  return value.length > 0;
+}
+
+
+/**
+ * Concrete MultiQuerier that looks up a key, decrypts it, then
+ * checks the the resulting regular expressions for a match.
+ * @param tokens Array of hosts
+ */
+this.EnchashMultiQuerier =
+function EnchashMultiQuerier(tokens, tableName, callback, url) {
+  MultiQuerier.call(this, tokens, tableName, callback);
+  this.url_ = url;
+  this.enchashDecrypter_ = new PROT_EnchashDecrypter();
+  this.debugZone = "enchashMultiQuerier";
+}
+
+EnchashMultiQuerier.inherits = function(parentCtor) {
+  var tempCtor = function(){};
+  tempCtor.prototype = parentCtor.prototype;
+  this.superClass_ = parentCtor.prototype;
+  this.prototype = new tempCtor();
+}
+EnchashMultiQuerier.inherits(MultiQuerier);
+
+EnchashMultiQuerier.prototype.run = function() {
+  if (this.tokens_.length == 0) {
+    this.callback_.handleEvent(false);
+    this.dbservice_ = null;
+    this.callback_ = null;
+    return;
+  }
+  var host = this.tokens_.pop();
+  this.key_ = host;
+  var lookupKey = this.enchashDecrypter_.getLookupKey(host);
+  this.dbservice_.exists(this.tableName_, lookupKey,
+                         BindToObject(this.result_, this));
+}
+
+EnchashMultiQuerier.prototype.condition_ = function(encryptedValue) {
+  if (encryptedValue.length > 0) {
+    // We have encrypted regular expressions for this host. Let's 
+    // decrypt them and see if we have a match.
+    var decrypted = this.enchashDecrypter_.decryptData(encryptedValue,
+                                                       this.key_);
+    var res = this.enchashDecrypter_.parseRegExps(decrypted);
+    for (var j = 0; j < res.length; j++) {
+      if (res[j].test(this.url_)) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
diff --git a/toolkit/components/url-classifier/content/request-backoff.js b/toolkit/components/url-classifier/content/request-backoff.js
new file mode 100644
index 0000000000..17e815cf14
--- /dev/null
+++ b/toolkit/components/url-classifier/content/request-backoff.js
@@ -0,0 +1,116 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+// This implements logic for stopping requests if the server starts to return
+// too many errors.  If we get MAX_ERRORS errors in ERROR_PERIOD minutes, we
+// back off for TIMEOUT_INCREMENT minutes.  If we get another error
+// immediately after we restart, we double the timeout and add
+// TIMEOUT_INCREMENT minutes, etc.
+// 
+// This is similar to the logic used by the search suggestion service.
+
+// HTTP responses that count as an error.  We also include any 5xx response
+// as an error.
+this.HTTP_FOUND                 = 302;
+this.HTTP_SEE_OTHER             = 303;
+this.HTTP_TEMPORARY_REDIRECT    = 307;
+
+/**
+ * @param maxErrors Number of times to request before backing off.
+ * @param retryIncrement Time (ms) for each retry before backing off.
+ * @param maxRequests Number the number of requests needed to trigger backoff
+ * @param requestPeriod Number time (ms) in which maxRequests have to occur to
+ *     trigger the backoff behavior (0 to disable maxRequests)
+ * @param timeoutIncrement Number time (ms) the starting timeout period
+ *     we double this time for consecutive errors
+ * @param maxTimeout Number time (ms) maximum timeout period
+ */
+this.RequestBackoff =
+function RequestBackoff(maxErrors, retryIncrement,
+                        maxRequests, requestPeriod,
+                        timeoutIncrement, maxTimeout) {
+  this.MAX_ERRORS_ = maxErrors;
+  this.RETRY_INCREMENT_ = retryIncrement;
+  this.MAX_REQUESTS_ = maxRequests;
+  this.REQUEST_PERIOD_ = requestPeriod;
+  this.TIMEOUT_INCREMENT_ = timeoutIncrement;
+  this.MAX_TIMEOUT_ = maxTimeout;
+
+  // Queue of ints keeping the time of all requests
+  this.requestTimes_ = [];
+
+  this.numErrors_ = 0;
+  this.errorTimeout_ = 0;
+  this.nextRequestTime_ = 0;
+}
+
+/**
+ * Reset the object for reuse. This deliberately doesn't clear requestTimes_.
+ */
+RequestBackoff.prototype.reset = function() {
+  this.numErrors_ = 0;
+  this.errorTimeout_ = 0;
+  this.nextRequestTime_ = 0;
+}
+
+/**
+ * Check to see if we can make a request.
+ */
+RequestBackoff.prototype.canMakeRequest = function() {
+  var now = Date.now();
+  if (now < this.nextRequestTime_) {
+    return false;
+  }
+
+  return (this.requestTimes_.length < this.MAX_REQUESTS_ ||
+          (now - this.requestTimes_[0]) > this.REQUEST_PERIOD_);
+}
+
+RequestBackoff.prototype.noteRequest = function() {
+  var now = Date.now();
+  this.requestTimes_.push(now);
+
+  // We only care about keeping track of MAX_REQUESTS
+  if (this.requestTimes_.length > this.MAX_REQUESTS_)
+    this.requestTimes_.shift();
+}
+
+RequestBackoff.prototype.nextRequestDelay = function() {
+  return Math.max(0, this.nextRequestTime_ - Date.now());
+}
+
+/**
+ * Notify this object of the last server response.  If it's an error,
+ */
+RequestBackoff.prototype.noteServerResponse = function(status) {
+  if (this.isErrorStatus(status)) {
+    this.numErrors_++;
+
+    if (this.numErrors_ < this.MAX_ERRORS_)
+      this.errorTimeout_ = this.RETRY_INCREMENT_;
+    else if (this.numErrors_ == this.MAX_ERRORS_)
+      this.errorTimeout_ = this.TIMEOUT_INCREMENT_;
+    else
+      this.errorTimeout_ *= 2;
+
+    this.errorTimeout_ = Math.min(this.errorTimeout_, this.MAX_TIMEOUT_);
+    this.nextRequestTime_ = Date.now() + this.errorTimeout_;
+  } else {
+    // Reset error timeout, allow requests to go through.
+    this.reset();
+  }
+}
+
+/**
+ * We consider 302, 303, 307, 4xx, and 5xx http responses to be errors.
+ * @param status Number http status
+ * @return Boolean true if we consider this http status an error
+ */
+RequestBackoff.prototype.isErrorStatus = function(status) {
+  return ((400 <= status && status <= 599) ||
+          HTTP_FOUND == status ||
+          HTTP_SEE_OTHER == status ||
+          HTTP_TEMPORARY_REDIRECT == status);
+}
+
diff --git a/toolkit/components/url-classifier/content/trtable.js b/toolkit/components/url-classifier/content/trtable.js
new file mode 100644
index 0000000000..c58a80c9ad
--- /dev/null
+++ b/toolkit/components/url-classifier/content/trtable.js
@@ -0,0 +1,169 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// XXX: This should all be moved into the dbservice class so it happens
+// in the background thread.
+
+/**
+ * Abstract base class for a lookup table.
+ * @construction
+ */
+this.UrlClassifierTable = function UrlClassifierTable() {
+  this.debugZone = "urlclassifier-table";
+  this.name = '';
+  this.needsUpdate = false;
+  this.enchashDecrypter_ = new PROT_EnchashDecrypter();
+  this.wrappedJSObject = this;
+}
+
+UrlClassifierTable.prototype.QueryInterface = function(iid) {
+  if (iid.equals(Components.interfaces.nsISupports) ||
+      iid.equals(Components.interfaces.nsIUrlClassifierTable))
+    return this;
+
+  throw Components.results.NS_ERROR_NO_INTERFACE;
+}
+
+/**
+ * Subclasses need to implement this method.
+ */
+UrlClassifierTable.prototype.exists = function(url, callback) {
+  throw Components.results.NS_ERROR_NOT_IMPLEMENTED;
+}
+
+/////////////////////////////////////////////////////////////////////
+// Url table implementation
+this.UrlClassifierTableUrl = function UrlClassifierTableUrl() {
+  UrlClassifierTable.call(this);
+}
+
+UrlClassifierTableUrl.inherits = function(parentCtor) {
+  var tempCtor = function(){};
+  tempCtor.prototype = parentCtor.prototype;
+  this.superClass_ = parentCtor.prototype;
+  this.prototype = new tempCtor();
+}
+UrlClassifierTableUrl.inherits(UrlClassifierTable);
+
+/**
+ * Look up a URL in a URL table
+ */
+UrlClassifierTableUrl.prototype.exists = function(url, callback) {
+  // nsIUrlClassifierUtils.canonicalizeURL is the old way of canonicalizing a
+  // URL.  Unfortunately, it doesn't normalize numeric domains so alternate IP
+  // formats (hex, octal, etc) won't trigger a match.
+  // this.enchashDecrypter_.getCanonicalUrl does the right thing and
+  // normalizes a URL to 4 decimal numbers, but the update server may still be
+  // giving us encoded IP addresses.  So to be safe, we check both cases.
+  var urlUtils = Cc["@mozilla.org/url-classifier/utils;1"]
+                 .getService(Ci.nsIUrlClassifierUtils);
+  var oldCanonicalized = urlUtils.canonicalizeURL(url);
+  var canonicalized = this.enchashDecrypter_.getCanonicalUrl(url);
+  G_Debug(this, "Looking up: " + url + " (" + oldCanonicalized + " and " +
+                canonicalized + ")");
+  (new ExistsMultiQuerier([oldCanonicalized, canonicalized],
+                          this.name,
+                          callback)).run();
+}
+
+/////////////////////////////////////////////////////////////////////
+// Domain table implementation
+
+this.UrlClassifierTableDomain = function UrlClassifierTableDomain() {
+  UrlClassifierTable.call(this);
+  this.debugZone = "urlclassifier-table-domain";
+  this.ioService_ = Cc["@mozilla.org/network/io-service;1"]
+                    .getService(Ci.nsIIOService);
+}
+
+UrlClassifierTableDomain.inherits = function(parentCtor) {
+  var tempCtor = function(){};
+  tempCtor.prototype = parentCtor.prototype;
+  this.superClass_ = parentCtor.prototype;
+  this.prototype = new tempCtor();
+}
+UrlClassifierTableDomain.inherits(UrlClassifierTable);
+
+/**
+ * Look up a URL in a domain table
+ * We also try to lookup domain + first path component (e.g.,
+ * www.mozilla.org/products).
+ *
+ * @returns Boolean true if the url domain is in the table
+ */
+UrlClassifierTableDomain.prototype.exists = function(url, callback) {
+  var canonicalized = this.enchashDecrypter_.getCanonicalUrl(url);
+  var urlObj = this.ioService_.newURI(canonicalized, null, null);
+  var host = '';
+  try {
+    host = urlObj.host;
+  } catch (e) { }
+  var hostComponents = host.split(".");
+
+  // Try to get the path of the URL.  Pseudo urls (like wyciwyg:) throw
+  // errors when trying to convert to an nsIURL so we wrap in a try/catch
+  // block.
+  var path = ""
+  try {
+    urlObj.QueryInterface(Ci.nsIURL);
+    path = urlObj.filePath;
+  } catch (e) { }
+
+  var pathComponents = path.split("/");
+
+  // We don't have a good way map from hosts to domains, so we instead try
+  // each possibility. Could probably optimize to start at the second dot?
+  var possible = [];
+  for (var i = 0; i < hostComponents.length - 1; i++) {
+    host = hostComponents.slice(i).join(".");
+    possible.push(host);
+
+    // The path starts with a "/", so we are interested in the second path
+    // component if it is available
+    if (pathComponents.length >= 2 && pathComponents[1].length > 0) {
+      host = host + "/" + pathComponents[1];
+      possible.push(host);
+    }
+  }
+
+  // Run the possible domains against the db.
+  (new ExistsMultiQuerier(possible, this.name, callback)).run();
+}
+
+/////////////////////////////////////////////////////////////////////
+// Enchash table implementation
+
+this.UrlClassifierTableEnchash = function UrlClassifierTableEnchash() {
+  UrlClassifierTable.call(this);
+  this.debugZone = "urlclassifier-table-enchash";
+}
+
+UrlClassifierTableEnchash.inherits = function(parentCtor) {
+  var tempCtor = function(){};
+  tempCtor.prototype = parentCtor.prototype;
+  this.superClass_ = parentCtor.prototype;
+  this.prototype = new tempCtor();
+}
+UrlClassifierTableEnchash.inherits(UrlClassifierTable);
+
+/**
+ * Look up a URL in an enchashDB.  We try all sub domains (up to MAX_DOTS).
+ */
+UrlClassifierTableEnchash.prototype.exists = function(url, callback) {
+  url = this.enchashDecrypter_.getCanonicalUrl(url);
+  var host = this.enchashDecrypter_.getCanonicalHost(url,
+                                               PROT_EnchashDecrypter.MAX_DOTS);
+
+  var possible = [];
+  for (var i = 0; i < PROT_EnchashDecrypter.MAX_DOTS + 1; i++) {
+    possible.push(host);
+
+    var index = host.indexOf(".");
+    if (index == -1)
+      break;
+    host = host.substring(index + 1);
+  }
+  // Run the possible domains against the db.
+  (new EnchashMultiQuerier(possible, this.name, callback, url)).run();
+}
diff --git a/toolkit/components/url-classifier/content/wireformat.js b/toolkit/components/url-classifier/content/wireformat.js
new file mode 100644
index 0000000000..a24b120e6b
--- /dev/null
+++ b/toolkit/components/url-classifier/content/wireformat.js
@@ -0,0 +1,230 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+
+// A class that serializes and deserializes opaque key/value string to
+// string maps to/from maps (trtables). It knows how to create
+// trtables from the serialized format, so it also understands
+// meta-information like the name of the table and the table's
+// version. See docs for the protocol description.
+// 
+// TODO: wireformatreader: if you have multiple updates for one table
+//       in a call to deserialize, the later ones will be merged 
+//       (all but the last will be ignored). To fix, merge instead
+//       of replace when you have an existing table, and only do so once.
+// TODO must have blank line between successive types -- problem?
+// TODO doesn't tolerate blank lines very well
+//
+// Maybe: These classes could use a LOT more cleanup, but it's not a
+//       priority at the moment. For example, the tablesData/Known
+//       maps should be combined into a single object, the parser
+//       for a given type should be separate from the version info,
+//       and there should be synchronous interfaces for testing.
+
+
+/**
+ * A class that knows how to serialize and deserialize meta-information.
+ * This meta information is the table name and version number, and 
+ * in its serialized form looks like the first line below:
+ * 
+ * [name-of-table X.Y update?]                
+ * ...key/value pairs to add or delete follow...
+ * <blank line ends the table>
+ *
+ * The X.Y is the version number and the optional "update" token means 
+ * that the table is a differential from the curent table the extension
+ * has. Its absence means that this is a full, new table.
+ */
+this.PROT_VersionParser =
+function PROT_VersionParser(type, opt_major, opt_minor, opt_requireMac) {
+  this.debugZone = "versionparser";
+  this.type = type;
+  this.major = 0;
+  this.minor = 0;
+
+  this.badHeader = false;
+
+  // Should the wireformatreader compute a mac?
+  this.mac = false;
+  this.macval = "";
+  this.macFailed = false;
+  this.requireMac = !!opt_requireMac;
+
+  this.update = false;
+  this.needsUpdate = false;  // used by ListManager to determine update policy
+  // Used by ListerManager to see if we have read data for this table from
+  // disk.  Once we read a table from disk, we are not going to do so again
+  // but instead update remotely if necessary.
+  this.didRead = false;
+  if (opt_major)
+    this.major = parseInt(opt_major);
+  if (opt_minor)
+    this.minor = parseInt(opt_minor);
+}
+
+/** Import the version information from another VersionParser
+ * @params version a version parser object
+ */
+PROT_VersionParser.prototype.ImportVersion = function(version) {
+  this.major = version.major;
+  this.minor = version.minor;
+
+  this.mac = version.mac;
+  this.macFailed = version.macFailed;
+  this.macval = version.macval;
+  // Don't set requireMac, since we create vparsers from scratch and doesn't
+  // know about it
+}
+
+/** 
+ * Creates a string like [goog-white-black 1.1] from internal information
+ * 
+ * @returns String
+ */
+PROT_VersionParser.prototype.toString = function() {
+  var s = "[" + this.type + " " + this.major + "." + this.minor + "]";
+  return s;
+}
+
+/**
+ * Creates a string like 1.123 with the version number.  This is the
+ * format we store in prefs.
+ * @return String
+ */
+PROT_VersionParser.prototype.versionString = function() {
+  return this.major + "." + this.minor;
+}
+
+/** 
+ * Creates a string like 1:1 from internal information used for
+ * fetching updates from the server. Called by the listmanager.
+ * 
+ * @returns String
+ */
+PROT_VersionParser.prototype.toUrl = function() {
+  return this.major + ":" + this.minor;
+}
+
+/**
+ * Process the old format, [type major.minor [update]]
+ *
+ * @returns true if the string could be parsed, false otherwise
+ */
+PROT_VersionParser.prototype.processOldFormat_ = function(line) {
+  if (line[0] != '[' || line.slice(-1) != ']')
+    return false;
+
+  var description = line.slice(1, -1);
+
+  // Get the type name and version number of this table
+  var tokens = description.split(" ");
+  this.type = tokens[0];
+  var majorminor = tokens[1].split(".");
+  this.major = parseInt(majorminor[0]);
+  this.minor = parseInt(majorminor[1]);
+  if (isNaN(this.major) || isNaN(this.minor))
+    return false;
+
+  if (tokens.length >= 3) {
+     this.update = tokens[2] == "update";
+  }
+
+  return true;
+}
+
+/**
+ * Takes a string like [name-of-table 1.1 [update]][mac=MAC] and figures out the
+ * type and corresponding version numbers.
+ * @returns true if the string could be parsed, false otherwise
+ */
+PROT_VersionParser.prototype.fromString = function(line) {
+  G_Debug(this, "Calling fromString with line: " + line);
+  if (line[0] != '[' || line.slice(-1) != ']')
+    return false;
+
+  // There could be two [][], so take care of it
+  var secondBracket = line.indexOf('[', 1);
+  var firstPart = null;
+  var secondPart = null;
+
+  if (secondBracket != -1) {
+    firstPart = line.substring(0, secondBracket);
+    secondPart = line.substring(secondBracket);
+    G_Debug(this, "First part: " + firstPart + " Second part: " + secondPart);
+  } else {
+    firstPart = line;
+    G_Debug(this, "Old format: " + firstPart);
+  }
+
+  if (!this.processOldFormat_(firstPart))
+    return false;
+
+  if (secondPart && !this.processOptTokens_(secondPart))
+    return false;
+
+  return true;
+}
+
+/**
+ * Process optional tokens
+ *
+ * @param line A string [token1=val1 token2=val2...]
+ * @returns true if the string could be parsed, false otherwise
+ */
+PROT_VersionParser.prototype.processOptTokens_ = function(line) {
+  if (line[0] != '[' || line.slice(-1) != ']')
+    return false;
+  var description = line.slice(1, -1);
+  // Get the type name and version number of this table
+  var tokens = description.split(" ");
+
+  for (var i = 0; i < tokens.length; i++) {
+    G_Debug(this, "Processing optional token: " + tokens[i]);
+    var tokenparts = tokens[i].split("=");
+    switch(tokenparts[0]){
+    case "mac":
+      this.mac = true;
+      if (tokenparts.length < 2) {
+        G_Debug(this, "Found mac flag but not mac value!");
+        return false;
+      }
+      // The mac value may have "=" in it, so we can't just use tokenparts[1].
+      // Instead, just take the rest of tokens[i] after the first "="
+      this.macval = tokens[i].substr(tokens[i].indexOf("=")+1);
+      break;
+    default:
+      G_Debug(this, "Found unrecognized token: " + tokenparts[0]);
+      break;
+    }
+  }
+
+  return true;
+}
+
+#ifdef DEBUG
+this.TEST_PROT_WireFormat = function TEST_PROT_WireFormat() {
+  if (G_GDEBUG) {
+    var z = "versionparser UNITTEST";
+    G_Debug(z, "Starting");
+
+    var vp = new PROT_VersionParser("dummy");
+    G_Assert(z, vp.fromString("[foo-bar-url 1.234]"),
+             "failed to parse old format");
+    G_Assert(z, "foo-bar-url" == vp.type, "failed to parse type");
+    G_Assert(z, "1" == vp.major, "failed to parse major");
+    G_Assert(z, "234" == vp.minor, "failed to parse minor");
+
+    vp = new PROT_VersionParser("dummy");
+    G_Assert(z, vp.fromString("[foo-bar-url 1.234][mac=567]"),
+             "failed to parse new format");
+    G_Assert(z, "foo-bar-url" == vp.type, "failed to parse type");
+    G_Assert(z, "1" == vp.major, "failed to parse major");
+    G_Assert(z, "234" == vp.minor, "failed to parse minor");
+    G_Assert(z, true == vp.mac, "failed to parse mac");
+    G_Assert(z, "567" == vp.macval, "failed to parse macval");
+
+    G_Debug(z, "PASSED");
+  }
+}
+#endif
diff --git a/toolkit/components/url-classifier/content/xml-fetcher.js b/toolkit/components/url-classifier/content/xml-fetcher.js
new file mode 100644
index 0000000000..9f88d74460
--- /dev/null
+++ b/toolkit/components/url-classifier/content/xml-fetcher.js
@@ -0,0 +1,125 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// A simple class that encapsulates a request. You'll notice the
+// style here is different from the rest of the extension; that's
+// because this was re-used from really old code we had. At some
+// point it might be nice to replace this with something better
+// (e.g., something that has explicit onerror handler, ability
+// to set headers, and so on).
+
+/**
+ * Because we might be in a component, we can't just assume that
+ * XMLHttpRequest exists. So we use this tiny factory function to wrap the
+ * XPCOM version.
+ *
+ * @return XMLHttpRequest object
+ */
+this.PROT_NewXMLHttpRequest = function PROT_NewXMLHttpRequest() {
+  var Cc = Components.classes;
+  var Ci = Components.interfaces;
+  var request = Cc["@mozilla.org/xmlextras/xmlhttprequest;1"]
+                .createInstance(Ci.nsIXMLHttpRequest);
+  // Need the following so we get onerror/load/progresschange
+  request.QueryInterface(Ci.nsIJSXMLHttpRequest);
+  return request;
+}
+
+/**
+ * A helper class that does HTTP GETs and calls back a function with
+ * the content it receives. Asynchronous, so uses a closure for the
+ * callback.
+ *
+ * Note, that XMLFetcher is only used for SafeBrowsing, therefore
+ * we inherit from nsILoadContext, so we can use the callbacks on the
+ * channel to separate the safebrowsing cookie based on a reserved
+ * appId.
+ * @constructor
+ */
+this.PROT_XMLFetcher = function PROT_XMLFetcher() {
+  this.debugZone = "xmlfetcher";
+  this._request = PROT_NewXMLHttpRequest();
+  // implements nsILoadContext
+  this.appId = Ci.nsIScriptSecurityManager.SAFEBROWSING_APP_ID;
+  this.isInBrowserElement = false;
+  this.usePrivateBrowsing = false;
+  this.isContent = false;
+}
+
+PROT_XMLFetcher.prototype = {
+  /**
+   * Function that will be called back upon fetch completion.
+   */
+  _callback: null,
+  
+
+  /**
+   * Fetches some content.
+   * 
+   * @param page URL to fetch
+   * @param callback Function to call back when complete.
+   */
+  get: function(page, callback) {
+    this._request.abort();                // abort() is asynchronous, so
+    this._request = PROT_NewXMLHttpRequest();
+    this._callback = callback;
+    var asynchronous = true;
+    this._request.loadInfo.originAttributes = { appId: this.appId,
+                                                inBrowser: this.isInBrowserElement
+                                              }
+    this._request.open("GET", page, asynchronous);
+    this._request.channel.notificationCallbacks = this;
+
+    // Create a closure
+    var self = this;
+    this._request.addEventListener("readystatechange", function() {
+      self.readyStateChange(self);
+    }, false);
+
+    this._request.send(null);
+  },
+
+  cancel: function() {
+    this._request.abort();
+    this._request = null;
+  },
+
+  /**
+   * Called periodically by the request to indicate some state change. 4
+   * means content has been received.
+   */
+  readyStateChange: function(fetcher) {
+    if (fetcher._request.readyState != 4)
+      return;
+
+    // If the request fails, on trunk we get status set to
+    // NS_ERROR_NOT_AVAILABLE.  On 1.8.1 branch we get an exception
+    // forwarded from nsIHttpChannel::GetResponseStatus.  To be consistent
+    // between branch and trunk, we send back NS_ERROR_NOT_AVAILABLE for
+    // http failures.
+    var responseText = null;
+    var status = Components.results.NS_ERROR_NOT_AVAILABLE;
+    try {
+      G_Debug(this, "xml fetch status code: \"" + 
+              fetcher._request.status + "\"");
+      status = fetcher._request.status;
+      responseText = fetcher._request.responseText;
+    } catch(e) {
+      G_Debug(this, "Caught exception trying to read xmlhttprequest " +
+              "status/response.");
+      G_Debug(this, e);
+    }
+    if (fetcher._callback)
+      fetcher._callback(responseText, status);
+  },
+
+  // nsIInterfaceRequestor
+  getInterface: function(iid) {
+    return this.QueryInterface(iid);
+  },
+
+  QueryInterface: XPCOMUtils.generateQI([Ci.nsIInterfaceRequestor,
+                                         Ci.nsISupports,
+                                         Ci.nsILoadContext])
+};
diff --git a/toolkit/components/url-classifier/moz.build b/toolkit/components/url-classifier/moz.build
new file mode 100644
index 0000000000..f970aeb41f
--- /dev/null
+++ b/toolkit/components/url-classifier/moz.build
@@ -0,0 +1,70 @@
+# -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+TEST_DIRS += ['tests']
+
+XPIDL_SOURCES += [
+    'nsIUrlClassifierDBService.idl',
+    'nsIUrlClassifierHashCompleter.idl',
+    'nsIUrlClassifierPrefixSet.idl',
+    'nsIUrlClassifierStreamUpdater.idl',
+    'nsIUrlClassifierUtils.idl',
+    'nsIUrlListManager.idl',
+]
+
+XPIDL_MODULE = 'url-classifier'
+
+UNIFIED_SOURCES += [
+    'ChunkSet.cpp',
+    'Classifier.cpp',
+    'LookupCache.cpp',
+    'nsCheckSummedOutputStream.cpp',
+    'nsUrlClassifierDBService.cpp',
+    'nsUrlClassifierProxies.cpp',
+    'nsUrlClassifierUtils.cpp',
+    'ProtocolParser.cpp',
+]
+
+# define conflicting LOG() macros
+SOURCES += [
+    'nsUrlClassifierPrefixSet.cpp',
+    'nsUrlClassifierStreamUpdater.cpp',
+]
+
+# contains variables that conflict with LookupCache.cpp
+SOURCES += [
+    'HashStore.cpp',
+]
+
+EXTRA_COMPONENTS += [
+    'nsURLClassifier.manifest',
+    'nsUrlClassifierHashCompleter.js',
+]
+
+# Same as JS components that are run through the pre-processor.
+EXTRA_PP_COMPONENTS += [
+    'nsUrlClassifierLib.js',
+    'nsUrlClassifierListManager.js',
+]
+
+EXTRA_JS_MODULES += [
+    'SafeBrowsing.jsm',
+]
+
+EXPORTS += [
+    'Entries.h',
+    'LookupCache.h',
+    'nsUrlClassifierPrefixSet.h',
+]
+
+FINAL_LIBRARY = 'xul'
+
+LOCAL_INCLUDES += [
+    '../build',
+    '/ipc/chromium/src',
+]
+
+CXXFLAGS += CONFIG['SQLITE_CFLAGS']
diff --git a/toolkit/components/url-classifier/nsCheckSummedOutputStream.cpp b/toolkit/components/url-classifier/nsCheckSummedOutputStream.cpp
new file mode 100644
index 0000000000..68f9f1f6f4
--- /dev/null
+++ b/toolkit/components/url-classifier/nsCheckSummedOutputStream.cpp
@@ -0,0 +1,59 @@
+//* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsILocalFile.h"
+#include "nsCRT.h"
+#include "nsIFile.h"
+#include "nsISupportsImpl.h"
+#include "nsCheckSummedOutputStream.h"
+
+////////////////////////////////////////////////////////////////////////////////
+// nsCheckSummedOutputStream
+
+NS_IMPL_ISUPPORTS_INHERITED(nsCheckSummedOutputStream,
+                            nsSafeFileOutputStream,
+                            nsISafeOutputStream,
+                            nsIOutputStream,
+                            nsIFileOutputStream)
+
+NS_IMETHODIMP
+nsCheckSummedOutputStream::Init(nsIFile* file, int32_t ioFlags, int32_t perm,
+                                int32_t behaviorFlags)
+{
+  nsresult rv;
+  mHash = do_CreateInstance(NS_CRYPTO_HASH_CONTRACTID, &rv);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = mHash->Init(nsICryptoHash::MD5);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return nsSafeFileOutputStream::Init(file, ioFlags, perm, behaviorFlags);
+}
+
+NS_IMETHODIMP
+nsCheckSummedOutputStream::Finish()
+{
+  nsresult rv = mHash->Finish(false, mCheckSum);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  uint32_t written;
+  rv = nsSafeFileOutputStream::Write(reinterpret_cast<const char*>(mCheckSum.BeginReading()),
+                                     mCheckSum.Length(), &written);
+  NS_ASSERTION(written == mCheckSum.Length(), "Error writing stream checksum");
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return nsSafeFileOutputStream::Finish();
+}
+
+NS_IMETHODIMP
+nsCheckSummedOutputStream::Write(const char *buf, uint32_t count, uint32_t *result)
+{
+  nsresult rv = mHash->Update(reinterpret_cast<const uint8_t*>(buf), count);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return nsSafeFileOutputStream::Write(buf, count, result);
+}
+
+////////////////////////////////////////////////////////////////////////////////
diff --git a/toolkit/components/url-classifier/nsCheckSummedOutputStream.h b/toolkit/components/url-classifier/nsCheckSummedOutputStream.h
new file mode 100644
index 0000000000..7e049aa250
--- /dev/null
+++ b/toolkit/components/url-classifier/nsCheckSummedOutputStream.h
@@ -0,0 +1,55 @@
+//* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef nsCheckSummedOutputStream_h__
+#define nsCheckSummedOutputStream_h__
+
+#include "nsILocalFile.h"
+#include "nsIFile.h"
+#include "nsIOutputStream.h"
+#include "nsICryptoHash.h"
+#include "nsNetCID.h"
+#include "nsString.h"
+#include "../../../netwerk/base/nsFileStreams.h"
+#include "nsToolkitCompsCID.h"
+
+class nsCheckSummedOutputStream : public nsSafeFileOutputStream
+{
+public:
+  NS_DECL_ISUPPORTS_INHERITED
+
+  // Size of MD5 hash in bytes
+  static const uint32_t CHECKSUM_SIZE = 16;
+
+  nsCheckSummedOutputStream() {}
+
+  NS_IMETHOD Finish() override;
+  NS_IMETHOD Write(const char *buf, uint32_t count, uint32_t *result) override;
+  NS_IMETHOD Init(nsIFile* file, int32_t ioFlags, int32_t perm, int32_t behaviorFlags) override;
+
+protected:
+  virtual ~nsCheckSummedOutputStream() { nsSafeFileOutputStream::Close(); }
+
+  nsCOMPtr<nsICryptoHash> mHash;
+  nsAutoCString mCheckSum;
+};
+
+// returns a file output stream which can be QI'ed to nsIFileOutputStream.
+inline nsresult
+NS_NewCheckSummedOutputStream(nsIOutputStream **result,
+                              nsIFile         *file,
+                              int32_t         ioFlags       = -1,
+                              int32_t         perm          = -1,
+                              int32_t         behaviorFlags =  0)
+{
+    nsCOMPtr<nsIFileOutputStream> out = new nsCheckSummedOutputStream();
+    nsresult rv = out->Init(file, ioFlags, perm, behaviorFlags);
+    if (NS_SUCCEEDED(rv)) {
+      out.forget(result);
+    }
+    return rv;
+}
+
+#endif
diff --git a/toolkit/components/url-classifier/nsIPrivateBrowsingTrackingProtectionWhitelist.idl b/toolkit/components/url-classifier/nsIPrivateBrowsingTrackingProtectionWhitelist.idl
new file mode 100644
index 0000000000..c3621ce233
--- /dev/null
+++ b/toolkit/components/url-classifier/nsIPrivateBrowsingTrackingProtectionWhitelist.idl
@@ -0,0 +1,46 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+interface nsIURI;
+
+/**
+ * The Private Browsing Tracking Protection service checks a URI against an
+ * in-memory list of tracking sites.
+ */
+[scriptable, uuid(c77ddfac-6cd6-43a9-84e8-91682a1a7b18)]
+interface nsIPrivateBrowsingTrackingProtectionWhitelist : nsISupports
+{
+  /**
+   * Add a URI to the list of allowed tracking sites in Private Browsing mode
+   * (essentially a tracking whitelist). This operation will cause the URI to
+   * be registered if it does not currently exist. If it already exists, then
+   * the operation is essentially a no-op.
+   *
+   * @param uri         the uri to add to the list
+   */
+  void addToAllowList(in nsIURI uri);
+
+  /**
+   * Remove a URI from the list of allowed tracking sites in Private Browsing
+   * mode (the tracking whitelist). If the URI is not already in the list,
+   * then the operation is essentially a no-op.
+   *
+   * @param uri         the uri to remove from the list
+   */
+  void removeFromAllowList(in nsIURI uri);
+
+  /**
+   * Check if a URI exists in the list of allowed tracking sites in Private
+   * Browsing mode (the tracking whitelist).
+   *
+   * @param uri         the uri to look for in the list
+   */
+  bool existsInAllowList(in nsIURI uri);
+};
+
+%{ C++
+#define NS_PBTRACKINGPROTECTIONWHITELIST_CONTRACTID "@mozilla.org/url-classifier/pbm-tp-whitelist;1"
+%}
diff --git a/toolkit/components/url-classifier/nsIUrlClassifierDBService.idl b/toolkit/components/url-classifier/nsIUrlClassifierDBService.idl
new file mode 100644
index 0000000000..2cb7a084cf
--- /dev/null
+++ b/toolkit/components/url-classifier/nsIUrlClassifierDBService.idl
@@ -0,0 +1,226 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+%{C++
+#include "Entries.h"
+#include "LookupCache.h"
+class nsUrlClassifierLookupResult;
+%}
+[ptr] native ResultArray(nsTArray<mozilla::safebrowsing::LookupResult>);
+[ptr] native CacheCompletionArray(nsTArray<mozilla::safebrowsing::CacheResult>);
+[ptr] native PrefixArray(mozilla::safebrowsing::PrefixArray);
+
+interface nsIUrlClassifierHashCompleter;
+interface nsIPrincipal;
+
+// Interface for JS function callbacks
+[scriptable, function, uuid(4ca27b6b-a674-4b3d-ab30-d21e2da2dffb)]
+interface nsIUrlClassifierCallback : nsISupports {
+  void handleEvent(in ACString value);
+};
+
+/**
+ * The nsIUrlClassifierUpdateObserver interface is implemented by
+ * clients streaming updates to the url-classifier (usually
+ * nsUrlClassifierStreamUpdater.
+ */
+[scriptable, uuid(9fa11561-5816-4e1b-bcc9-b629ca05cce6)]
+interface nsIUrlClassifierUpdateObserver : nsISupports {
+  /**
+   * The update requested a new URL whose contents should be downloaded
+   * and sent to the classifier as a new stream.
+   *
+   * @param url The url that was requested.
+   * @param table The table name that this URL's contents will be associated
+   *              with.  This should be passed back to beginStream().
+   */
+  void updateUrlRequested(in ACString url,
+                          in ACString table);
+
+  /**
+   * A stream update has completed.
+   *
+   * @param status The state of the update process.
+   * @param delay The amount of time the updater should wait to fetch the
+   *              next URL in ms.
+   */
+  void streamFinished(in nsresult status, in unsigned long delay);
+
+  /* The update has encountered an error and should be cancelled */
+  void updateError(in nsresult error);
+
+  /**
+   * The update has completed successfully.
+   *
+   * @param requestedTimeout The number of seconds that the caller should
+   *                         wait before trying to update again.
+   **/
+  void updateSuccess(in unsigned long requestedTimeout);
+};
+
+/**
+ * This is a proxy class that is instantiated and called from the JS thread.
+ * It provides async methods for querying and updating the database.  As the
+ * methods complete, they call the callback function.
+ */
+[scriptable, uuid(7a258022-6765-11e5-b379-b37b1f2354be)]
+interface nsIUrlClassifierDBService : nsISupports
+{
+  /**
+   * Looks up a URI in the specified tables.
+   *
+   * @param principal: The principal containing the URI to search.
+   * @param c: The callback will be called with a comma-separated list
+   *        of tables to which the key belongs.
+   */
+  void lookup(in nsIPrincipal principal,
+              in ACString tables,
+              in nsIUrlClassifierCallback c);
+
+  /**
+   * Lists the tables along with which chunks are available in each table.
+   * This list is in the format of the request body:
+   *   tablename;chunkdata\n
+   *   tablename2;chunkdata2\n
+   *
+   * For example:
+   *   goog-phish-regexp;a:10,14,30-40s:56,67
+   *   goog-white-regexp;a:1-3,5
+   */
+  void getTables(in nsIUrlClassifierCallback c);
+
+  /**
+   * Set the nsIUrlClassifierCompleter object for a given table.  This
+   * object will be used to request complete versions of partial
+   * hashes.
+   */
+  void setHashCompleter(in ACString tableName,
+                        in nsIUrlClassifierHashCompleter completer);
+
+  /**
+   * Set the last update time for the given table. We use this to
+   * remember freshness past restarts. Time is in milliseconds since epoch.
+   */
+  void setLastUpdateTime(in ACString tableName,
+                         in unsigned long long lastUpdateTime);
+
+  ////////////////////////////////////////////////////////////////////////////
+  // Incremental update methods.
+  //
+  // An update to the database has the following steps:
+  //
+  // 1) The update process is started with beginUpdate().  The client
+  //    passes an nsIUrlClassifierUpdateObserver object which will be
+  //    notified as the update is processed by the dbservice.
+  // 2) The client sends an initial update stream to the dbservice,
+  //    using beginStream/updateStream/finishStream.
+  // 3) While reading this initial update stream, the dbservice may
+  //    request additional streams from the client as requested by the
+  //    update stream.
+  // 4) For each additional update stream, the client feeds the
+  //    contents to the dbservice using beginStream/updateStream/endStream.
+  // 5) Once all streams have been processed, the client calls
+  //    finishUpdate.  When the dbservice has finished processing
+  //    all streams, it will notify the observer that the update process
+  //    is complete.
+
+  /**
+   * Begin an update process.  Will throw NS_ERROR_NOT_AVAILABLE if there
+   * is already an update in progress.
+   *
+   * @param updater The update observer tied to this update.
+   * @param tables A comma-separated list of tables included in this update.
+   */
+  void beginUpdate(in nsIUrlClassifierUpdateObserver updater,
+                   in ACString tables);
+
+  /**
+   * Begin a stream update.  This should be called once per url being
+   * fetched.
+   *
+   * @param table The table the contents of this stream will be associated
+   *              with, or empty for the initial stream.
+   */
+  void beginStream(in ACString table);
+
+  /**
+   * Update the table incrementally.
+   */
+  void updateStream(in ACString updateChunk);
+
+  // It would be nice to have an updateFromStream method to round out the
+  // interface, but it's tricky because of XPCOM proxies.
+
+  /**
+   * Finish an individual stream update.  Must be called for every
+   * beginStream() call, before the next beginStream() or finishUpdate().
+   *
+   * The update observer's streamFinished will be called once the
+   * stream has been processed.
+   */
+  void finishStream();
+
+  /**
+   * Finish an incremental update.  This will attempt to commit any
+   * pending changes and resets the update interface.
+   *
+   * The update observer's updateSucceeded or updateError methods
+   * will be called when the update has been processed.
+   */
+  void finishUpdate();
+
+  /**
+   * Cancel an incremental update.  This rolls back any pending changes.
+   * and resets the update interface.
+   *
+   * The update observer's updateError method will be called when the
+   * update has been rolled back.
+   */
+  void cancelUpdate();
+
+  /**
+   * Reset the url-classifier database.  This call will delete the existing
+   * database, emptying all tables.  Mostly intended for use in unit tests.
+   */
+  void resetDatabase();
+};
+
+/**
+ * Interface for the actual worker thread.  Implementations of this need not
+ * be thread aware and just work on the database.
+ */
+[scriptable, uuid(b7b505d0-bfa2-44db-abf8-6e2bfc25bbab)]
+interface nsIUrlClassifierDBServiceWorker : nsIUrlClassifierDBService
+{
+  // Open the DB connection
+  void openDb();
+  // Provide a way to forcibly close the db connection.
+  void closeDb();
+
+  [noscript]void cacheCompletions(in CacheCompletionArray completions);
+  [noscript]void cacheMisses(in PrefixArray misses);
+};
+
+/**
+ * This is an internal helper interface for communication between the
+ * main thread and the dbservice worker thread.  It is called for each
+ * lookup to provide a set of possible results, which the main thread
+ * may need to expand using an nsIUrlClassifierCompleter.
+ */
+[uuid(b903dc8f-dff1-42fe-894b-36e7a59bb801)]
+interface nsIUrlClassifierLookupCallback : nsISupports
+{
+  /**
+   * The lookup process is complete.
+   *
+   * @param results
+   *        If this parameter is null, there were no results found.
+   *        If not, it contains an array of nsUrlClassifierEntry objects
+   *        with possible matches.  The callee is responsible for freeing
+   *        this array.
+   */
+  void lookupComplete(in ResultArray results);
+};
diff --git a/toolkit/components/url-classifier/nsIUrlClassifierHashCompleter.idl b/toolkit/components/url-classifier/nsIUrlClassifierHashCompleter.idl
new file mode 100644
index 0000000000..a3a8ab6171
--- /dev/null
+++ b/toolkit/components/url-classifier/nsIUrlClassifierHashCompleter.idl
@@ -0,0 +1,65 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+/**
+ * This interface is implemented by nsIUrlClassifierHashCompleter clients.
+ */
+[scriptable, uuid(da16de40-df26-414d-bde7-c4faf4504868)]
+interface nsIUrlClassifierHashCompleterCallback : nsISupports
+{
+  /**
+   * A complete hash has been found that matches the partial hash.
+   * This method may be called 0-n times for a given
+   * nsIUrlClassifierCompleter::complete() call.
+   *
+   * @param hash
+   *        The 128-bit hash that was discovered.
+   * @param table
+   *        The name of the table that this hash belongs to.
+   * @param chunkId
+   *        The database chunk that this hash belongs to.
+   */
+  void completion(in ACString hash,
+                  in ACString table,
+                  in uint32_t chunkId);
+
+  /**
+   * The completion is complete.  This method is called once per
+   * nsIUrlClassifierCompleter::complete() call, after all completion()
+   * calls are finished.
+   *
+   * @param status
+   *        NS_OK if the request completed successfully, or an error code.
+   */
+  void completionFinished(in nsresult status);
+};
+
+/**
+ * Clients updating the url-classifier database have the option of sending
+ * partial (32-bit) hashes of URL fragments to be blacklisted.  If the
+ * url-classifier encounters one of these truncated hashes, it will ask an
+ * nsIUrlClassifierCompleter instance to asynchronously provide the complete
+ * hash, along with some associated metadata.
+ * This is only ever used for testing and should absolutely be deleted (I
+ * think).
+ */
+[scriptable, uuid(231fb2ad-ea8a-4e63-a331-eafc3b434811)]
+interface nsIUrlClassifierHashCompleter : nsISupports
+{
+  /**
+   * Request a completed hash from the given gethash url.
+   *
+   * @param partialHash
+   *        The 32-bit hash encountered by the url-classifier.
+   * @param gethashUrl
+   *        The gethash url to use.
+   * @param callback
+   *        An nsIUrlClassifierCompleterCallback instance.
+   */
+  void complete(in ACString partialHash,
+                in ACString gethashUrl,
+                in nsIUrlClassifierHashCompleterCallback callback);
+};
diff --git a/toolkit/components/url-classifier/nsIUrlClassifierPrefixSet.idl b/toolkit/components/url-classifier/nsIUrlClassifierPrefixSet.idl
new file mode 100644
index 0000000000..7e1a527d76
--- /dev/null
+++ b/toolkit/components/url-classifier/nsIUrlClassifierPrefixSet.idl
@@ -0,0 +1,29 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+#include "nsIFile.idl"
+
+// Note that the PrefixSet name is historical and we do properly support
+// duplicated values, so it's really a Prefix Trie.
+// All methods are thread-safe.
+[scriptable, uuid(3d8579f0-75fa-4e00-ba41-38661d5b5d17)]
+interface nsIUrlClassifierPrefixSet : nsISupports
+{
+  // Initialize the PrefixSet. Give it a name for memory reporting.
+  void init(in ACString aName);
+  // Fills the PrefixSet with the given array of prefixes.
+  // Can send an empty Array to clear the tree.
+  // Requires array to be sorted.
+  void setPrefixes([const, array, size_is(aLength)] in unsigned long aPrefixes,
+                   in unsigned long aLength);
+  void getPrefixes(out unsigned long aCount,
+                  [array, size_is(aCount), retval] out unsigned long aPrefixes);
+  // Do a lookup in the PrefixSet, return whether the value is present.
+  boolean contains(in unsigned long aPrefix);
+  boolean isEmpty();
+  void loadFromFile(in nsIFile aFile);
+  void storeToFile(in nsIFile aFile);
+};
diff --git a/toolkit/components/url-classifier/nsIUrlClassifierStreamUpdater.idl b/toolkit/components/url-classifier/nsIUrlClassifierStreamUpdater.idl
new file mode 100644
index 0000000000..ff80b856f0
--- /dev/null
+++ b/toolkit/components/url-classifier/nsIUrlClassifierStreamUpdater.idl
@@ -0,0 +1,36 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+#include "nsIUrlClassifierDBService.idl"
+
+/**
+ * This is a class to manage large table updates from the server.  Rather than
+ * downloading the whole update and then updating the sqlite database, we
+ * update tables as the data is streaming in.
+ */
+[scriptable, uuid(e1797597-f4d6-4dd3-a1e1-745ad352cd80)]
+interface nsIUrlClassifierStreamUpdater : nsISupports
+{
+  /**
+   * Try to download updates from updateUrl. If an update is already in
+   * progress, queues the requested update. This is used in nsIUrlListManager
+   * as well as in testing.
+   * @param aRequestTables Comma-separated list of tables included in this
+   *        update.
+   * @param aRequestBody The body for the request.
+   * @param aUpdateUrl The plaintext url from which to request updates.
+   * @param aSuccessCallback Called after a successful update.
+   * @param aUpdateErrorCallback Called for problems applying the update
+   * @param aDownloadErrorCallback Called if we get an http error or a
+   *        connection refused error.
+   */
+  boolean downloadUpdates(in ACString aRequestTables,
+                          in ACString aRequestBody,
+                          in ACString aUpdateUrl,
+                          in nsIUrlClassifierCallback aSuccessCallback,
+                          in nsIUrlClassifierCallback aUpdateErrorCallback,
+                          in nsIUrlClassifierCallback aDownloadErrorCallback);
+};
diff --git a/toolkit/components/url-classifier/nsIUrlClassifierTable.idl b/toolkit/components/url-classifier/nsIUrlClassifierTable.idl
new file mode 100644
index 0000000000..123069556e
--- /dev/null
+++ b/toolkit/components/url-classifier/nsIUrlClassifierTable.idl
@@ -0,0 +1,31 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+#include "nsIUrlListManager.idl"
+
+// A map that contains a string keys mapped to string values.
+
+[scriptable, uuid(fd1f8334-1859-472d-b01f-4ac6b1121ce4)]
+interface nsIUrlClassifierTable : nsISupports
+{
+    /**
+     * The name used to identify this table
+     */
+    attribute ACString name;
+
+    /**
+     * Set to false if we don't want to update this table.
+     */
+    attribute boolean needsUpdate;
+
+    /**
+     * In the simple case, exists just looks up the string in the
+     * table and call the callback after the query returns with true or
+     * false.  It's possible that something more complex happens
+     * (e.g., canonicalize the url).
+     */
+    void exists(in ACString key, in nsIUrlListManagerCallback cb);
+};
diff --git a/toolkit/components/url-classifier/nsIUrlClassifierUtils.idl b/toolkit/components/url-classifier/nsIUrlClassifierUtils.idl
new file mode 100644
index 0000000000..56fe17195c
--- /dev/null
+++ b/toolkit/components/url-classifier/nsIUrlClassifierUtils.idl
@@ -0,0 +1,24 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+/**
+ * Some utility methods used by the url classifier.
+ */
+
+interface nsIURI;
+
+[scriptable, uuid(e4f0e59c-b922-48b0-a7b6-1735c1f96fed)]
+interface nsIUrlClassifierUtils : nsISupports
+{
+  /**
+   * Get the lookup string for a given URI.  This normalizes the hostname,
+   * url-decodes the string, and strips off the protocol.
+   *
+   * @param uri URI to get the lookup key for.
+   *
+   * @returns String containing the canonicalized URI.
+   */
+  ACString getKeyForURI(in nsIURI uri);
+};
diff --git a/toolkit/components/url-classifier/nsIUrlListManager.idl b/toolkit/components/url-classifier/nsIUrlListManager.idl
new file mode 100644
index 0000000000..112c567dcd
--- /dev/null
+++ b/toolkit/components/url-classifier/nsIUrlListManager.idl
@@ -0,0 +1,67 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+interface nsIPrincipal;
+
+/**
+ * Interface for a class that manages updates of the url classifier database.
+ */
+
+// Interface for JS function callbacks
+[scriptable, function, uuid(fa4caf12-d057-4e7e-81e9-ce066ceee90b)]
+interface nsIUrlListManagerCallback : nsISupports {
+  void handleEvent(in ACString value);
+};
+
+
+[scriptable, uuid(d60a08ee-5c83-4eb6-bdfb-79fd0716501e)]
+interface nsIUrlListManager : nsISupports
+{
+    /**
+     * Get the gethash url for this table
+     */
+    ACString getGethashUrl(in ACString tableName);
+
+    /**
+     * Add a table to the list of tables we are managing. The name is a
+     * string of the format provider_name-semantic_type-table_type.  For
+     * @param tableName A string of the format
+     *        provider_name-semantic_type-table_type.  For example,
+     *        goog-white-enchash or goog-black-url.
+     * @param providerName The name of the entity providing the list.
+     * @param updateUrl The URL from which to fetch updates.
+     * @param gethashUrl The URL from which to fetch hash completions.
+     */
+    boolean registerTable(in ACString tableName,
+                          in ACString providerName,
+                          in ACString updateUrl,
+                          in ACString gethashUrl);
+
+    /**
+     * Turn on update checking for a table. I.e., during the next server
+     * check, download updates for this table.
+     */
+    void enableUpdate(in ACString tableName);
+
+    /**
+     * Turn off update checking for a table.
+     */
+    void disableUpdate(in ACString tableName);
+
+    /**
+     * Toggle update checking, if necessary.
+     */
+    void maybeToggleUpdateChecking();
+
+    /**
+     * Lookup a key.  Should not raise exceptions.  Calls the callback
+     * function with a comma-separated list of tables to which the key
+     * belongs.
+     */
+    void safeLookup(in nsIPrincipal key,
+                    in nsIUrlListManagerCallback cb);
+};
diff --git a/toolkit/components/url-classifier/nsURLClassifier.manifest b/toolkit/components/url-classifier/nsURLClassifier.manifest
new file mode 100644
index 0000000000..f035dea809
--- /dev/null
+++ b/toolkit/components/url-classifier/nsURLClassifier.manifest
@@ -0,0 +1,6 @@
+component {26a4a019-2827-4a89-a85c-5931a678823a} nsUrlClassifierLib.js
+contract @mozilla.org/url-classifier/jslib;1 {26a4a019-2827-4a89-a85c-5931a678823a}
+component {ca168834-cc00-48f9-b83c-fd018e58cae3} nsUrlClassifierListManager.js
+contract @mozilla.org/url-classifier/listmanager;1 {ca168834-cc00-48f9-b83c-fd018e58cae3}
+component {9111de73-9322-4bfc-8b65-2b727f3e6ec8} nsUrlClassifierHashCompleter.js
+contract @mozilla.org/url-classifier/hashcompleter;1 {9111de73-9322-4bfc-8b65-2b727f3e6ec8}
diff --git a/toolkit/components/url-classifier/nsUrlClassifierDBService.cpp b/toolkit/components/url-classifier/nsUrlClassifierDBService.cpp
index 828a945e5a..4fa251357d 100644
--- a/toolkit/components/url-classifier/nsUrlClassifierDBService.cpp
+++ b/toolkit/components/url-classifier/nsUrlClassifierDBService.cpp
@@ -26,7 +26,6 @@
 #include "nsString.h"
 #include "nsReadableUtils.h"
 #include "nsTArray.h"
-#include "nsNetUtil.h"
 #include "nsNetCID.h"
 #include "nsThreadUtils.h"
 #include "nsXPCOMStrings.h"
@@ -34,11 +33,12 @@
 #include "nsString.h"
 #include "mozilla/Atomics.h"
 #include "mozilla/DebugOnly.h"
+#include "mozilla/ErrorNames.h"
 #include "mozilla/Mutex.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/TimeStamp.h"
 #include "mozilla/Telemetry.h"
-#include "prlog.h"
+#include "mozilla/Logging.h"
 #include "prprf.h"
 #include "prnetdb.h"
 #include "Entries.h"
@@ -55,14 +55,9 @@ using namespace mozilla;
 using namespace mozilla::safebrowsing;
 
 // NSPR_LOG_MODULES=UrlClassifierDbService:5
-#if defined(PR_LOGGING)
 PRLogModuleInfo *gUrlClassifierDbServiceLog = nullptr;
-#define LOG(args) PR_LOG(gUrlClassifierDbServiceLog, PR_LOG_DEBUG, args)
-#define LOG_ENABLED() PR_LOG_TEST(gUrlClassifierDbServiceLog, 4)
-#else
-#define LOG(args)
-#define LOG_ENABLED() (false)
-#endif
+#define LOG(args) MOZ_LOG(gUrlClassifierDbServiceLog, mozilla::LogLevel::Debug, args)
+#define LOG_ENABLED() MOZ_LOG_TEST(gUrlClassifierDbServiceLog, mozilla::LogLevel::Debug)
 
 // Prefs for implementing nsIURIClassifier to block page loads
 #define CHECK_MALWARE_PREF      "browser.safebrowsing.malware.enabled"
@@ -74,6 +69,9 @@ PRLogModuleInfo *gUrlClassifierDbServiceLog = nullptr;
 #define CHECK_TRACKING_PREF     "privacy.trackingprotection.enabled"
 #define CHECK_TRACKING_DEFAULT  false
 
+#define CHECK_TRACKING_PB_PREF    "privacy.trackingprotection.pbmode.enabled"
+#define CHECK_TRACKING_PB_DEFAULT false
+
 #define GETHASH_NOISE_PREF      "urlclassifier.gethashnoise"
 #define GETHASH_NOISE_DEFAULT   4
 
@@ -186,6 +184,9 @@ TablesToResponse(const nsACString& tables)
   if (FindInReadable(NS_LITERAL_CSTRING("-track-"), tables)) {
     return NS_ERROR_TRACKING_URI;
   }
+  if (FindInReadable(NS_LITERAL_CSTRING("-unwanted-"), tables)) {
+    return NS_ERROR_UNWANTED_URI;
+  }
   return NS_OK;
 }
 
@@ -232,12 +233,10 @@ nsUrlClassifierDBServiceWorker::DoLookup(const nsACString& spec,
     return NS_ERROR_NOT_INITIALIZED;
   }
 
-#if defined(PR_LOGGING)
   PRIntervalTime clockStart = 0;
   if (LOG_ENABLED()) {
     clockStart = PR_IntervalNow();
   }
-#endif
 
   nsAutoPtr<LookupResultArray> results(new LookupResultArray());
   if (!results) {
@@ -254,13 +253,11 @@ nsUrlClassifierDBServiceWorker::DoLookup(const nsACString& spec,
   LOG(("Found %d results.", results->Length()));
 
 
-#if defined(PR_LOGGING)
   if (LOG_ENABLED()) {
     PRIntervalTime clockEnd = PR_IntervalNow();
     LOG(("query took %dms\n",
          PR_IntervalToMilliseconds(clockEnd - clockStart)));
   }
-#endif
 
   nsAutoPtr<LookupResultArray> completes(new LookupResultArray());
 
@@ -520,6 +517,8 @@ nsUrlClassifierDBServiceWorker::FinishStream()
     mTableUpdates.AppendElements(mProtocolParser->GetTableUpdates());
     mProtocolParser->ForgetTableUpdates();
   } else {
+    LOG(("nsUrlClassifierDBService::FinishStream Failed to parse the stream "
+         "using mProtocolParser."));
     mUpdateStatus = mProtocolParser->Status();
   }
   mUpdateObserver->StreamFinished(mProtocolParser->Status(), 0);
@@ -544,6 +543,9 @@ nsUrlClassifierDBServiceWorker::FinishUpdate()
 
   if (NS_SUCCEEDED(mUpdateStatus)) {
     mUpdateStatus = ApplyUpdate();
+  } else {
+    LOG(("nsUrlClassifierDBServiceWorker::FinishUpdate() Not running "
+         "ApplyUpdate() since the update has already failed."));
   }
 
   mMissCache.Clear();
@@ -552,7 +554,12 @@ nsUrlClassifierDBServiceWorker::FinishUpdate()
     LOG(("Notifying success: %d", mUpdateWait));
     mUpdateObserver->UpdateSuccess(mUpdateWait);
   } else {
-    LOG(("Notifying error: %d", mUpdateStatus));
+    if (LOG_ENABLED()) {
+      nsAutoCString errorName;
+      mozilla::GetErrorName(mUpdateStatus, errorName);
+      LOG(("Notifying error: %s (%d)", errorName.get(), mUpdateStatus));
+    }
+
     mUpdateObserver->UpdateError(mUpdateStatus);
     /*
      * mark the tables as spoiled, we don't want to block hosts
@@ -698,7 +705,7 @@ nsUrlClassifierDBServiceWorker::CacheMisses(PrefixArray *results)
 
   for (uint32_t i = 0; i < resultsPtr->Length(); i++) {
     mMissCache.AppendElement(resultsPtr->ElementAt(i));
-   }
+  }
   return NS_OK;
 }
 
@@ -728,6 +735,18 @@ nsUrlClassifierDBServiceWorker::OpenDb()
   return NS_OK;
 }
 
+nsresult
+nsUrlClassifierDBServiceWorker::SetLastUpdateTime(const nsACString &table,
+                                                  uint64_t updateTime)
+{
+  MOZ_ASSERT(!NS_IsMainThread(), "Must be on the background thread");
+  MOZ_ASSERT(mClassifier, "Classifier connection must be opened");
+
+  mClassifier->SetLastUpdateTime(table, updateTime);
+
+  return NS_OK;
+}
+
 // -------------------------------------------------------------------------
 // nsUrlClassifierLookupCallback
 //
@@ -807,6 +826,8 @@ nsUrlClassifierLookupCallback::LookupComplete(nsTArray<LookupResult>* results)
       NS_ENSURE_SUCCESS(rv, rv);
       rv = listManager->GetGethashUrl(result.mTableName, gethashUrl);
       NS_ENSURE_SUCCESS(rv, rv);
+      LOG(("The match from %s needs to be completed at %s",
+           result.mTableName.get(), gethashUrl.get()));
       // gethashUrls may be empty in 2 cases: test tables, and on startup where
       // we may have found a prefix in an existing table before the listmanager
       // has registered the table. In the second case we should not call
@@ -829,6 +850,8 @@ nsUrlClassifierLookupCallback::LookupComplete(nsTArray<LookupResult>* results)
         // in 45 minutes.
         if (result.Complete()) {
           result.mFresh = true;
+          LOG(("Skipping completion in a table without a valid completer (%s).",
+               result.mTableName.get()));
         } else {
           NS_WARNING("Partial match in a table without a valid completer, ignoring partial match.");
         }
@@ -891,7 +914,9 @@ nsUrlClassifierLookupCallback::Completion(const nsACString& completeHash,
     LookupResult& result = mResults->ElementAt(i);
 
     // Now, see if it verifies a lookup
-    if (result.CompleteHash() == hash && result.mTableName.Equals(tableName)) {
+    if (!result.mNoise
+        && result.CompleteHash() == hash
+        && result.mTableName.Equals(tableName)) {
       result.mProtocolConfirmed = true;
     }
   }
@@ -915,8 +940,11 @@ nsUrlClassifierLookupCallback::HandleResults()
     // Leave out results that weren't confirmed, as their existence on
     // the list can't be verified.  Also leave out randomly-generated
     // noise.
-    if (!result.Confirmed() || result.mNoise) {
-      LOG(("Skipping result from table %s", result.mTableName.get()));
+    if (!result.Confirmed()) {
+      LOG(("Skipping result from table %s (not confirmed)", result.mTableName.get()));
+      continue;
+    } else if (result.mNoise) {
+      LOG(("Skipping result from table %s (noise)", result.mTableName.get()));
       continue;
     }
 
@@ -1090,10 +1118,8 @@ nsUrlClassifierDBService::ReadTablesFromPrefs()
 nsresult
 nsUrlClassifierDBService::Init()
 {
-#if defined(PR_LOGGING)
   if (!gUrlClassifierDbServiceLog)
     gUrlClassifierDbServiceLog = PR_NewLogModule("UrlClassifierDbService");
-#endif
   MOZ_ASSERT(NS_IsMainThread(), "Must initialize DB service on main thread");
   nsCOMPtr<nsIXULRuntime> appInfo = do_GetService("@mozilla.org/xre/app-info;1");
   if (appInfo) {
@@ -1109,8 +1135,9 @@ nsUrlClassifierDBService::Init()
     CHECK_MALWARE_DEFAULT);
   mCheckPhishing = Preferences::GetBool(CHECK_PHISHING_PREF,
     CHECK_PHISHING_DEFAULT);
-  mCheckTracking = Preferences::GetBool(CHECK_TRACKING_PREF,
-    CHECK_TRACKING_DEFAULT);
+  mCheckTracking =
+    Preferences::GetBool(CHECK_TRACKING_PREF, CHECK_TRACKING_DEFAULT) ||
+    Preferences::GetBool(CHECK_TRACKING_PB_PREF, CHECK_TRACKING_PB_DEFAULT);
   uint32_t gethashNoise = Preferences::GetUint(GETHASH_NOISE_PREF,
     GETHASH_NOISE_DEFAULT);
   gFreshnessGuarantee = Preferences::GetInt(CONFIRM_AGE_PREF,
@@ -1121,6 +1148,7 @@ nsUrlClassifierDBService::Init()
   Preferences::AddStrongObserver(this, CHECK_MALWARE_PREF);
   Preferences::AddStrongObserver(this, CHECK_PHISHING_PREF);
   Preferences::AddStrongObserver(this, CHECK_TRACKING_PREF);
+  Preferences::AddStrongObserver(this, CHECK_TRACKING_PB_PREF);
   Preferences::AddStrongObserver(this, GETHASH_NOISE_PREF);
   Preferences::AddStrongObserver(this, CONFIRM_AGE_PREF);
   Preferences::AddStrongObserver(this, PHISH_TABLE_PREF);
@@ -1227,7 +1255,7 @@ nsUrlClassifierDBService::Classify(nsIPrincipal* aPrincipal,
   NS_ENSURE_ARG(aPrincipal);
   NS_ENSURE_TRUE(gDbBackgroundThread, NS_ERROR_NOT_INITIALIZED);
 
-  if (!(mCheckMalware || mCheckPhishing)) {
+  if (!(mCheckMalware || mCheckPhishing || aTrackingProtectionEnabled)) {
     *result = false;
     return NS_OK;
   }
@@ -1394,6 +1422,15 @@ nsUrlClassifierDBService::SetHashCompleter(const nsACString &tableName,
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsUrlClassifierDBService::SetLastUpdateTime(const nsACString &tableName,
+                                            uint64_t lastUpdateTime)
+{
+  NS_ENSURE_TRUE(gDbBackgroundThread, NS_ERROR_NOT_INITIALIZED);
+
+  return mWorkerProxy->SetLastUpdateTime(tableName, lastUpdateTime);
+}
+
 NS_IMETHODIMP
 nsUrlClassifierDBService::BeginUpdate(nsIUrlClassifierUpdateObserver *observer,
                                       const nsACString &updateTables)
@@ -1522,9 +1559,11 @@ nsUrlClassifierDBService::Observe(nsISupports *aSubject, const char *aTopic,
     } else if (NS_LITERAL_STRING(CHECK_PHISHING_PREF).Equals(aData)) {
       mCheckPhishing = Preferences::GetBool(CHECK_PHISHING_PREF,
         CHECK_PHISHING_DEFAULT);
-    } else if (NS_LITERAL_STRING(CHECK_TRACKING_PREF).Equals(aData)) {
-      mCheckTracking = Preferences::GetBool(CHECK_TRACKING_PREF,
-        CHECK_TRACKING_DEFAULT);
+    } else if (NS_LITERAL_STRING(CHECK_TRACKING_PREF).Equals(aData) ||
+               NS_LITERAL_STRING(CHECK_TRACKING_PB_PREF).Equals(aData)) {
+      mCheckTracking =
+        Preferences::GetBool(CHECK_TRACKING_PREF, CHECK_TRACKING_DEFAULT) ||
+        Preferences::GetBool(CHECK_TRACKING_PB_PREF, CHECK_TRACKING_PB_DEFAULT);
     } else if (
       NS_LITERAL_STRING(PHISH_TABLE_PREF).Equals(aData) ||
       NS_LITERAL_STRING(MALWARE_TABLE_PREF).Equals(aData) ||
@@ -1565,6 +1604,7 @@ nsUrlClassifierDBService::Shutdown()
     prefs->RemoveObserver(CHECK_MALWARE_PREF, this);
     prefs->RemoveObserver(CHECK_PHISHING_PREF, this);
     prefs->RemoveObserver(CHECK_TRACKING_PREF, this);
+    prefs->RemoveObserver(CHECK_TRACKING_PB_PREF, this);
     prefs->RemoveObserver(PHISH_TABLE_PREF, this);
     prefs->RemoveObserver(MALWARE_TABLE_PREF, this);
     prefs->RemoveObserver(TRACKING_TABLE_PREF, this);
diff --git a/toolkit/components/url-classifier/nsUrlClassifierDBService.h b/toolkit/components/url-classifier/nsUrlClassifierDBService.h
new file mode 100644
index 0000000000..eeb13bb16b
--- /dev/null
+++ b/toolkit/components/url-classifier/nsUrlClassifierDBService.h
@@ -0,0 +1,238 @@
+//* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-/
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef nsUrlClassifierDBService_h_
+#define nsUrlClassifierDBService_h_
+
+#include <nsISupportsUtils.h>
+
+#include "nsID.h"
+#include "nsInterfaceHashtable.h"
+#include "nsIObserver.h"
+#include "nsUrlClassifierPrefixSet.h"
+#include "nsIUrlClassifierHashCompleter.h"
+#include "nsIUrlListManager.h"
+#include "nsIUrlClassifierDBService.h"
+#include "nsIURIClassifier.h"
+#include "nsToolkitCompsCID.h"
+#include "nsICryptoHMAC.h"
+#include "mozilla/Attributes.h"
+#include "mozilla/Mutex.h"
+#include "mozilla/TimeStamp.h"
+
+#include "Entries.h"
+#include "LookupCache.h"
+
+// The hash length for a domain key.
+#define DOMAIN_LENGTH 4
+
+// The hash length of a partial hash entry.
+#define PARTIAL_LENGTH 4
+
+// The hash length of a complete hash entry.
+#define COMPLETE_LENGTH 32
+
+using namespace mozilla::safebrowsing;
+
+class nsUrlClassifierDBServiceWorker;
+class nsIThread;
+class nsIURI;
+class UrlClassifierDBServiceWorkerProxy;
+namespace mozilla {
+namespace safebrowsing {
+class Classifier;
+class ProtocolParser;
+class TableUpdate;
+} // namespace safebrowsing
+} // namespace mozilla
+
+// This is a proxy class that just creates a background thread and delagates
+// calls to the background thread.
+class nsUrlClassifierDBService final : public nsIUrlClassifierDBService,
+                                       public nsIURIClassifier,
+                                       public nsIObserver
+{
+public:
+  // This is thread safe. It throws an exception if the thread is busy.
+  nsUrlClassifierDBService();
+
+  nsresult Init();
+
+  static nsUrlClassifierDBService* GetInstance(nsresult *result);
+
+  NS_DECLARE_STATIC_IID_ACCESSOR(NS_URLCLASSIFIERDBSERVICE_CID)
+
+  NS_DECL_THREADSAFE_ISUPPORTS
+  NS_DECL_NSIURLCLASSIFIERDBSERVICE
+  NS_DECL_NSIURICLASSIFIER
+  NS_DECL_NSIOBSERVER
+
+  bool GetCompleter(const nsACString& tableName,
+                      nsIUrlClassifierHashCompleter** completer);
+  nsresult CacheCompletions(mozilla::safebrowsing::CacheResultArray *results);
+  nsresult CacheMisses(mozilla::safebrowsing::PrefixArray *results);
+
+  static nsIThread* BackgroundThread();
+
+private:
+  // No subclassing
+  ~nsUrlClassifierDBService();
+
+  // Disallow copy constructor
+  nsUrlClassifierDBService(nsUrlClassifierDBService&);
+
+  nsresult LookupURI(nsIPrincipal* aPrincipal,
+                     const nsACString& tables,
+                     nsIUrlClassifierCallback* c,
+                     bool forceCheck, bool *didCheck);
+
+  // Close db connection and join the background thread if it exists.
+  nsresult Shutdown();
+
+  // Check if the key is on a known-clean host.
+  nsresult CheckClean(const nsACString &lookupKey,
+                      bool *clean);
+
+  // Read everything into mGethashTables and mDisallowCompletionTables
+  nsresult ReadTablesFromPrefs();
+
+  // Build a comma-separated list of tables to check
+  void BuildTables(bool trackingProtectionEnabled, nsCString& tables);
+
+  RefPtr<nsUrlClassifierDBServiceWorker> mWorker;
+  RefPtr<UrlClassifierDBServiceWorkerProxy> mWorkerProxy;
+
+  nsInterfaceHashtable<nsCStringHashKey, nsIUrlClassifierHashCompleter> mCompleters;
+
+  // TRUE if the nsURIClassifier implementation should check for malware
+  // uris on document loads.
+  bool mCheckMalware;
+
+  // TRUE if the nsURIClassifier implementation should check for phishing
+  // uris on document loads.
+  bool mCheckPhishing;
+
+  // TRUE if the nsURIClassifier implementation should check for tracking
+  // uris on document loads.
+  bool mCheckTracking;
+
+  // TRUE if a BeginUpdate() has been called without an accompanying
+  // CancelUpdate()/FinishUpdate().  This is used to prevent competing
+  // updates, not to determine whether an update is still being
+  // processed.
+  bool mInUpdate;
+
+  // The list of tables that can use the default hash completer object.
+  nsTArray<nsCString> mGethashTables;
+
+  // The list of tables that should never be hash completed.
+  nsTArray<nsCString> mDisallowCompletionsTables;
+
+  // Thread that we do the updates on.
+  static nsIThread* gDbBackgroundThread;
+};
+
+class nsUrlClassifierDBServiceWorker final :
+  public nsIUrlClassifierDBServiceWorker
+{
+public:
+  nsUrlClassifierDBServiceWorker();
+
+  NS_DECL_THREADSAFE_ISUPPORTS
+  NS_DECL_NSIURLCLASSIFIERDBSERVICE
+  NS_DECL_NSIURLCLASSIFIERDBSERVICEWORKER
+
+  nsresult Init(uint32_t aGethashNoise, nsCOMPtr<nsIFile> aCacheDir);
+
+  // Queue a lookup for the worker to perform, called in the main thread.
+  // tables is a comma-separated list of tables to query
+  nsresult QueueLookup(const nsACString& lookupKey,
+                       const nsACString& tables,
+                       nsIUrlClassifierLookupCallback* callback);
+
+  // Handle any queued-up lookups.  We call this function during long-running
+  // update operations to prevent lookups from blocking for too long.
+  nsresult HandlePendingLookups();
+
+  // Perform a blocking classifier lookup for a given url. Can be called on
+  // either the main thread or the worker thread.
+  nsresult DoLocalLookup(const nsACString& spec,
+                         const nsACString& tables,
+                         LookupResultArray* results);
+
+private:
+  // No subclassing
+  ~nsUrlClassifierDBServiceWorker();
+
+  // Disallow copy constructor
+  nsUrlClassifierDBServiceWorker(nsUrlClassifierDBServiceWorker&);
+
+  // Applies the current transaction and resets the update/working times.
+  nsresult ApplyUpdate();
+
+  // Reset the in-progress update stream
+  void ResetStream();
+
+  // Reset the in-progress update
+  void ResetUpdate();
+
+  // Perform a classifier lookup for a given url.
+  nsresult DoLookup(const nsACString& spec,
+                    const nsACString& tables,
+                    nsIUrlClassifierLookupCallback* c);
+
+  nsresult AddNoise(const Prefix aPrefix,
+                    const nsCString tableName,
+                    uint32_t aCount,
+                    LookupResultArray& results);
+
+  // Can only be used on the background thread
+  nsCOMPtr<nsICryptoHash> mCryptoHash;
+
+  nsAutoPtr<mozilla::safebrowsing::Classifier> mClassifier;
+  // The class that actually parses the update chunks.
+  nsAutoPtr<ProtocolParser> mProtocolParser;
+
+  // Directory where to store the SB databases.
+  nsCOMPtr<nsIFile> mCacheDir;
+
+  // XXX: maybe an array of autoptrs.  Or maybe a class specifically
+  // storing a series of updates.
+  nsTArray<mozilla::safebrowsing::TableUpdate*> mTableUpdates;
+
+  int32_t mUpdateWait;
+
+  // Entries that cannot be completed. We expect them to die at
+  // the next update
+  PrefixArray mMissCache;
+
+  nsresult mUpdateStatus;
+  nsTArray<nsCString> mUpdateTables;
+
+  nsCOMPtr<nsIUrlClassifierUpdateObserver> mUpdateObserver;
+  bool mInStream;
+
+  // The number of noise entries to add to the set of lookup results.
+  uint32_t mGethashNoise;
+
+  // Pending lookups are stored in a queue for processing.  The queue
+  // is protected by mPendingLookupLock.
+  mozilla::Mutex mPendingLookupLock;
+
+  class PendingLookup {
+  public:
+    mozilla::TimeStamp mStartTime;
+    nsCString mKey;
+    nsCString mTables;
+    nsCOMPtr<nsIUrlClassifierLookupCallback> mCallback;
+  };
+
+  // list of pending lookups
+  nsTArray<PendingLookup> mPendingLookups;
+};
+
+NS_DEFINE_STATIC_IID_ACCESSOR(nsUrlClassifierDBService, NS_URLCLASSIFIERDBSERVICE_CID)
+
+#endif // nsUrlClassifierDBService_h_
diff --git a/toolkit/components/url-classifier/nsUrlClassifierHashCompleter.js b/toolkit/components/url-classifier/nsUrlClassifierHashCompleter.js
new file mode 100644
index 0000000000..b22b19e2c8
--- /dev/null
+++ b/toolkit/components/url-classifier/nsUrlClassifierHashCompleter.js
@@ -0,0 +1,487 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+const Cc = Components.classes;
+const Ci = Components.interfaces;
+const Cr = Components.results;
+const Cu = Components.utils;
+
+// COMPLETE_LENGTH and PARTIAL_LENGTH copied from nsUrlClassifierDBService.h,
+// they correspond to the length, in bytes, of a hash prefix and the total
+// hash.
+const COMPLETE_LENGTH = 32;
+const PARTIAL_LENGTH = 4;
+
+// These backoff related constants are taken from v2 of the Google Safe Browsing
+// API. All times are in milliseconds.
+// BACKOFF_ERRORS: the number of errors incurred until we start to back off.
+// BACKOFF_INTERVAL: the initial time to wait once we start backing
+//                   off.
+// BACKOFF_MAX: as the backoff time doubles after each failure, this is a
+//              ceiling on the time to wait.
+
+const BACKOFF_ERRORS = 2;
+const BACKOFF_INTERVAL = 30 * 60 * 1000;
+const BACKOFF_MAX = 8 * 60 * 60 * 1000;
+
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
+
+// Log only if browser.safebrowsing.debug is true
+function log(...stuff) {
+  let logging = null;
+  try {
+    logging = Services.prefs.getBoolPref("browser.safebrowsing.debug");
+  } catch(e) {
+    return;
+  }
+  if (!logging) {
+    return;
+  }
+
+  var d = new Date();
+  let msg = "hashcompleter: " + d.toTimeString() + ": " + stuff.join(" ");
+  dump(msg + "\n");
+}
+
+function HashCompleter() {
+  // The current HashCompleterRequest in flight. Once it is started, it is set
+  // to null. It may be used by multiple calls to |complete| in succession to
+  // avoid creating multiple requests to the same gethash URL.
+  this._currentRequest = null;
+  // A map of gethashUrls to HashCompleterRequests that haven't yet begun.
+  this._pendingRequests = {};
+
+  // A map of gethash URLs to RequestBackoff objects.
+  this._backoffs = {};
+
+  // Whether we have been informed of a shutdown by the xpcom-shutdown event.
+  this._shuttingDown = false;
+
+  Services.obs.addObserver(this, "xpcom-shutdown", true);
+}
+
+HashCompleter.prototype = {
+  classID: Components.ID("{9111de73-9322-4bfc-8b65-2b727f3e6ec8}"),
+  QueryInterface: XPCOMUtils.generateQI([Ci.nsIUrlClassifierHashCompleter,
+                                         Ci.nsIRunnable,
+                                         Ci.nsIObserver,
+                                         Ci.nsISupportsWeakReference,
+                                         Ci.nsITimerCallback,
+                                         Ci.nsISupports]),
+
+  // This is mainly how the HashCompleter interacts with other components.
+  // Even though it only takes one partial hash and callback, subsequent
+  // calls are made into the same HTTP request by using a thread dispatch.
+  complete: function HC_complete(aPartialHash, aGethashUrl, aCallback) {
+    if (!aGethashUrl) {
+      throw Cr.NS_ERROR_NOT_INITIALIZED;
+    }
+
+    if (!this._currentRequest) {
+      this._currentRequest = new HashCompleterRequest(this, aGethashUrl);
+    }
+    if (this._currentRequest.gethashUrl == aGethashUrl) {
+      this._currentRequest.add(aPartialHash, aCallback);
+    } else {
+      if (!this._pendingRequests[aGethashUrl]) {
+        this._pendingRequests[aGethashUrl] =
+          new HashCompleterRequest(this, aGethashUrl);
+      }
+      this._pendingRequests[aGethashUrl].add(aPartialHash, aCallback);
+    }
+
+    if (!this._backoffs[aGethashUrl]) {
+      // Initialize request backoffs separately, since requests are deleted
+      // after they are dispatched.
+      var jslib = Cc["@mozilla.org/url-classifier/jslib;1"]
+                  .getService().wrappedJSObject;
+      this._backoffs[aGethashUrl] = new jslib.RequestBackoff(
+        BACKOFF_ERRORS /* max errors */,
+        60*1000 /* retry interval, 1 min */,
+        10 /* keep track of max requests */,
+        0 /* don't throttle on successful requests per time period */,
+        BACKOFF_INTERVAL /* backoff interval, 60 min */,
+        BACKOFF_MAX /* max backoff, 8hr */);
+    }
+    // Start off this request. Without dispatching to a thread, every call to
+    // complete makes an individual HTTP request.
+    Services.tm.currentThread.dispatch(this, Ci.nsIThread.DISPATCH_NORMAL);
+  },
+
+  // This is called after several calls to |complete|, or after the
+  // currentRequest has finished.  It starts off the HTTP request by making a
+  // |begin| call to the HashCompleterRequest.
+  run: function() {
+    // Clear everything on shutdown
+    if (this._shuttingDown) {
+      this._currentRequest = null;
+      this._pendingRequests = null;
+      for (var url in this._backoffs) {
+        this._backoffs[url] = null;
+      }
+      throw Cr.NS_ERROR_NOT_INITIALIZED;
+    }
+
+    // If we don't have an in-flight request, make one
+    let pendingUrls = Object.keys(this._pendingRequests);
+    if (!this._currentRequest && (pendingUrls.length > 0)) {
+      let nextUrl = pendingUrls[0];
+      this._currentRequest = this._pendingRequests[nextUrl];
+      delete this._pendingRequests[nextUrl];
+    }
+
+    if (this._currentRequest) {
+      try {
+        this._currentRequest.begin();
+      } finally {
+        // If |begin| fails, we should get rid of our request.
+        this._currentRequest = null;
+      }
+    }
+  },
+
+  // Pass the server response status to the RequestBackoff for the given
+  // gethashUrl and fetch the next pending request, if there is one.
+  finishRequest: function(url, aStatus) {
+    this._backoffs[url].noteServerResponse(aStatus);
+    Services.tm.currentThread.dispatch(this, Ci.nsIThread.DISPATCH_NORMAL);
+  },
+
+  // Returns true if we can make a request from the given url, false otherwise.
+  canMakeRequest: function(aGethashUrl) {
+    return this._backoffs[aGethashUrl].canMakeRequest();
+  },
+
+  // Notifies the RequestBackoff of a new request so we can throttle based on
+  // max requests/time period. This must be called before a channel is opened,
+  // and finishRequest must be called once the response is received.
+  noteRequest: function(aGethashUrl) {
+    return this._backoffs[aGethashUrl].noteRequest();
+  },
+
+  observe: function HC_observe(aSubject, aTopic, aData) {
+    if (aTopic == "xpcom-shutdown") {
+      this._shuttingDown = true;
+    }
+  },
+};
+
+function HashCompleterRequest(aCompleter, aGethashUrl) {
+  // HashCompleter object that created this HashCompleterRequest.
+  this._completer = aCompleter;
+  // The internal set of hashes and callbacks that this request corresponds to.
+  this._requests = [];
+  // nsIChannel that the hash completion query is transmitted over.
+  this._channel = null;
+  // Response body of hash completion. Created in onDataAvailable.
+  this._response = "";
+  // Whether we have been informed of a shutdown by the xpcom-shutdown event.
+  this._shuttingDown = false;
+  this.gethashUrl = aGethashUrl;
+}
+HashCompleterRequest.prototype = {
+  QueryInterface: XPCOMUtils.generateQI([Ci.nsIRequestObserver,
+                                         Ci.nsIStreamListener,
+                                         Ci.nsIObserver,
+                                         Ci.nsISupports]),
+
+  // This is called by the HashCompleter to add a hash and callback to the
+  // HashCompleterRequest. It must be called before calling |begin|.
+  add: function HCR_add(aPartialHash, aCallback) {
+    this._requests.push({
+      partialHash: aPartialHash,
+      callback: aCallback,
+      responses: []
+    });
+  },
+
+  // This initiates the HTTP request. It can fail due to backoff timings and
+  // will notify all callbacks as necessary. We notify the backoff object on
+  // begin.
+  begin: function HCR_begin() {
+    if (!this._completer.canMakeRequest(this.gethashUrl)) {
+      dump("hashcompleter: Can't make request to " + this.gethashUrl + "\n");
+      this.notifyFailure(Cr.NS_ERROR_ABORT);
+      return;
+    }
+
+    Services.obs.addObserver(this, "xpcom-shutdown", false);
+
+    try {
+      this.openChannel();
+      // Notify the RequestBackoff if opening the channel succeeded. At this
+      // point, finishRequest must be called.
+      this._completer.noteRequest(this.gethashUrl);
+    }
+    catch (err) {
+      this.notifyFailure(err);
+      throw err;
+    }
+  },
+
+  notify: function HCR_notify() {
+    // If we haven't gotten onStopRequest, just cancel. This will call us
+    // with onStopRequest since we implement nsIStreamListener on the
+    // channel.
+    if (this._channel && this._channel.isPending()) {
+      dump("hashcompleter: cancelling request to " + this.gethashUrl + "\n");
+      this._channel.cancel(Cr.NS_BINDING_ABORTED);
+    }
+  },
+
+  // Creates an nsIChannel for the request and fills the body.
+  openChannel: function HCR_openChannel() {
+    let loadFlags = Ci.nsIChannel.INHIBIT_CACHING |
+                    Ci.nsIChannel.LOAD_BYPASS_CACHE;
+
+    let uri = Services.io.newURI(this.gethashUrl, null, null);
+    let channel = Services.io.newChannelFromURI2(uri,
+                                                 null,      // aLoadingNode
+                                                 Services.scriptSecurityManager.getSystemPrincipal(),
+                                                 null,      // aTriggeringPrincipal
+                                                 Ci.nsILoadInfo.SEC_NORMAL,
+                                                 Ci.nsIContentPolicy.TYPE_OTHER);
+    channel.loadFlags = loadFlags;
+
+    // Disable keepalive.
+    let httpChannel = channel.QueryInterface(Ci.nsIHttpChannel);
+    httpChannel.setRequestHeader("Connection", "close", false);
+
+    this._channel = channel;
+
+    let body = this.buildRequest();
+    this.addRequestBody(body);
+
+    // Set a timer that cancels the channel after timeout_ms in case we
+    // don't get a gethash response.
+    this.timer_ = Cc["@mozilla.org/timer;1"].createInstance(Ci.nsITimer);
+    // Ask the timer to use nsITimerCallback (.notify()) when ready
+    let timeout = Services.prefs.getIntPref(
+      "urlclassifier.gethash.timeout_ms");
+    this.timer_.initWithCallback(this, timeout, this.timer_.TYPE_ONE_SHOT);
+    channel.asyncOpen(this, null);
+  },
+
+  // Returns a string for the request body based on the contents of
+  // this._requests.
+  buildRequest: function HCR_buildRequest() {
+    // Sometimes duplicate entries are sent to HashCompleter but we do not need
+    // to propagate these to the server. (bug 633644)
+    let prefixes = [];
+
+    for (let i = 0; i < this._requests.length; i++) {
+      let request = this._requests[i];
+      if (prefixes.indexOf(request.partialHash) == -1) {
+        prefixes.push(request.partialHash);
+      }
+    }
+
+    // Randomize the order to obscure the original request from noise
+    // unbiased Fisher-Yates shuffle
+    let i = prefixes.length;
+    while (i--) {
+      let j = Math.floor(Math.random() * (i + 1));
+      let temp = prefixes[i];
+      prefixes[i] = prefixes[j];
+      prefixes[j] = temp;
+    }
+
+    let body;
+    body = PARTIAL_LENGTH + ":" + (PARTIAL_LENGTH * prefixes.length) +
+           "\n" + prefixes.join("");
+
+    log('Requesting completions for ' + prefixes.length + ' ' + PARTIAL_LENGTH + '-byte prefixes: ' + body);
+    return body;
+  },
+
+  // Sets the request body of this._channel.
+  addRequestBody: function HCR_addRequestBody(aBody) {
+    let inputStream = Cc["@mozilla.org/io/string-input-stream;1"].
+                      createInstance(Ci.nsIStringInputStream);
+
+    inputStream.setData(aBody, aBody.length);
+
+    let uploadChannel = this._channel.QueryInterface(Ci.nsIUploadChannel);
+    uploadChannel.setUploadStream(inputStream, "text/plain", -1);
+
+    let httpChannel = this._channel.QueryInterface(Ci.nsIHttpChannel);
+    httpChannel.requestMethod = "POST";
+  },
+
+  // Parses the response body and eventually adds items to the |responses| array
+  // for elements of |this._requests|.
+  handleResponse: function HCR_handleResponse() {
+    if (this._response == "") {
+      return;
+    }
+
+    log('Response: ' + this._response);
+    let start = 0;
+
+    let length = this._response.length;
+    while (start != length) {
+      start = this.handleTable(start);
+    }
+  },
+
+  // This parses a table entry in the response body and calls |handleItem|
+  // for complete hash in the table entry.
+  handleTable: function HCR_handleTable(aStart) {
+    let body = this._response.substring(aStart);
+
+    // deal with new line indexes as there could be
+    // new line characters in the data parts.
+    let newlineIndex = body.indexOf("\n");
+    if (newlineIndex == -1) {
+      throw errorWithStack();
+    }
+    let header = body.substring(0, newlineIndex);
+    let entries = header.split(":");
+    if (entries.length != 3) {
+      throw errorWithStack();
+    }
+
+    let list = entries[0];
+    let addChunk = parseInt(entries[1]);
+    let dataLength = parseInt(entries[2]);
+
+    log('Response includes add chunks for ' + list + ': ' + addChunk);
+    if (dataLength % COMPLETE_LENGTH != 0 ||
+        dataLength == 0 ||
+        dataLength > body.length - (newlineIndex + 1)) {
+      throw errorWithStack();
+    }
+
+    let data = body.substr(newlineIndex + 1, dataLength);
+    for (let i = 0; i < (dataLength / COMPLETE_LENGTH); i++) {
+      this.handleItem(data.substr(i * COMPLETE_LENGTH, COMPLETE_LENGTH), list,
+                      addChunk);
+    }
+
+    return aStart + newlineIndex + 1 + dataLength;
+  },
+
+  // This adds a complete hash to any entry in |this._requests| that matches
+  // the hash.
+  handleItem: function HCR_handleItem(aData, aTableName, aChunkId) {
+    for (let i = 0; i < this._requests.length; i++) {
+      let request = this._requests[i];
+      if (aData.substring(0,4) == request.partialHash) {
+        request.responses.push({
+          completeHash: aData,
+          tableName: aTableName,
+          chunkId: aChunkId,
+        });
+      }
+    }
+  },
+
+  // notifySuccess and notifyFailure are used to alert the callbacks with
+  // results. notifySuccess makes |completion| and |completionFinished| calls
+  // while notifyFailure only makes a |completionFinished| call with the error
+  // code.
+  notifySuccess: function HCR_notifySuccess() {
+    for (let i = 0; i < this._requests.length; i++) {
+      let request = this._requests[i];
+      for (let j = 0; j < request.responses.length; j++) {
+        let response = request.responses[j];
+        request.callback.completion(response.completeHash, response.tableName,
+                                    response.chunkId);
+      }
+
+      request.callback.completionFinished(Cr.NS_OK);
+    }
+  },
+
+  notifyFailure: function HCR_notifyFailure(aStatus) {
+    dump("hashcompleter: notifying failure\n");
+    for (let i = 0; i < this._requests.length; i++) {
+      let request = this._requests[i];
+      request.callback.completionFinished(aStatus);
+    }
+  },
+
+  onDataAvailable: function HCR_onDataAvailable(aRequest, aContext,
+                                                aInputStream, aOffset, aCount) {
+    let sis = Cc["@mozilla.org/scriptableinputstream;1"].
+              createInstance(Ci.nsIScriptableInputStream);
+    sis.init(aInputStream);
+    this._response += sis.readBytes(aCount);
+  },
+
+  onStartRequest: function HCR_onStartRequest(aRequest, aContext) {
+    // At this point no data is available for us and we have no reason to
+    // terminate the connection, so we do nothing until |onStopRequest|.
+  },
+
+  onStopRequest: function HCR_onStopRequest(aRequest, aContext, aStatusCode) {
+    Services.obs.removeObserver(this, "xpcom-shutdown");
+
+    if (this._shuttingDown) {
+      throw Cr.NS_ERROR_ABORT;
+    }
+
+    // Default HTTP status to service unavailable, in case we can't retrieve
+    // the true status from the channel.
+    let httpStatus = 503;
+    if (Components.isSuccessCode(aStatusCode)) {
+      let channel = aRequest.QueryInterface(Ci.nsIHttpChannel);
+      let success = channel.requestSucceeded;
+      httpStatus = channel.responseStatus;
+      if (!success) {
+        aStatusCode = Cr.NS_ERROR_ABORT;
+      }
+    }
+    log('Received a ' + httpStatus + ' status code from the gethash server.');
+
+    let success = Components.isSuccessCode(aStatusCode);
+    // Notify the RequestBackoff once a response is received.
+    this._completer.finishRequest(this.gethashUrl, httpStatus);
+
+    if (success) {
+      try {
+        this.handleResponse();
+      }
+      catch (err) {
+        dump(err.stack);
+        aStatusCode = err.value;
+        success = false;
+      }
+    }
+
+    if (success) {
+      this.notifySuccess();
+    } else {
+      this.notifyFailure(aStatusCode);
+    }
+  },
+
+  observe: function HCR_observe(aSubject, aTopic, aData) {
+    if (aTopic != "xpcom-shutdown") {
+      return;
+    }
+
+    this._shuttingDown = true;
+    if (this._channel) {
+      this._channel.cancel(Cr.NS_ERROR_ABORT);
+    }
+  },
+};
+
+// Converts a URL safe base64 string to a normal base64 string. Will not change
+// normal base64 strings. This is modelled after the same function in
+// nsUrlClassifierUtils.h.
+function unUrlsafeBase64(aStr) {
+  return !aStr ? "" : aStr.replace(/-/g, "+")
+                          .replace(/_/g, "/");
+}
+
+function errorWithStack() {
+  let err = new Error();
+  err.value = Cr.NS_ERROR_FAILURE;
+  return err;
+}
+
+this.NSGetFactory = XPCOMUtils.generateNSGetFactory([HashCompleter]);
diff --git a/toolkit/components/url-classifier/nsUrlClassifierLib.js b/toolkit/components/url-classifier/nsUrlClassifierLib.js
new file mode 100644
index 0000000000..2126dc755e
--- /dev/null
+++ b/toolkit/components/url-classifier/nsUrlClassifierLib.js
@@ -0,0 +1,35 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// We wastefully reload the same JS files across components.  This puts all
+// the common JS files used by safebrowsing and url-classifier into a
+// single component.
+
+const Cc = Components.classes;
+const Ci = Components.interfaces;
+const G_GDEBUG = false;
+
+Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
+
+#include ./content/moz/lang.js
+#include ./content/moz/preferences.js
+#include ./content/moz/debug.js
+#include ./content/moz/alarm.js
+#include ./content/moz/cryptohasher.js
+#include ./content/moz/observer.js
+#include ./content/moz/protocol4.js
+
+#include ./content/request-backoff.js
+#include ./content/xml-fetcher.js
+
+// Expose this whole component.
+var lib = this;
+
+function UrlClassifierLib() {
+  this.wrappedJSObject = lib;
+}
+UrlClassifierLib.prototype.classID = Components.ID("{26a4a019-2827-4a89-a85c-5931a678823a}");
+UrlClassifierLib.prototype.QueryInterface = XPCOMUtils.generateQI([]);
+
+this.NSGetFactory = XPCOMUtils.generateNSGetFactory([UrlClassifierLib]);
diff --git a/toolkit/components/url-classifier/nsUrlClassifierListManager.js b/toolkit/components/url-classifier/nsUrlClassifierListManager.js
new file mode 100644
index 0000000000..815a143680
--- /dev/null
+++ b/toolkit/components/url-classifier/nsUrlClassifierListManager.js
@@ -0,0 +1,53 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+const Cc = Components.classes;
+const Ci = Components.interfaces;
+
+Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
+
+#include ./content/listmanager.js
+
+var modScope = this;
+function Init() {
+  // Pull the library in.
+  var jslib = Cc["@mozilla.org/url-classifier/jslib;1"]
+              .getService().wrappedJSObject;
+  Function.prototype.inherits = function(parentCtor) {
+    var tempCtor = function(){};
+    tempCtor.prototype = parentCtor.prototype;
+    this.superClass_ = parentCtor.prototype;
+    this.prototype = new tempCtor();
+  },
+  modScope.G_Preferences = jslib.G_Preferences;
+  modScope.G_PreferenceObserver = jslib.G_PreferenceObserver;
+  modScope.G_ObserverServiceObserver = jslib.G_ObserverServiceObserver;
+  modScope.G_Debug = jslib.G_Debug;
+  modScope.G_Assert = jslib.G_Assert;
+  modScope.G_debugService = jslib.G_debugService;
+  modScope.G_Alarm = jslib.G_Alarm;
+  modScope.BindToObject = jslib.BindToObject;
+  modScope.PROT_XMLFetcher = jslib.PROT_XMLFetcher;
+  modScope.RequestBackoff = jslib.RequestBackoff;
+
+  // We only need to call Init once.
+  modScope.Init = function() {};
+}
+
+function RegistrationData()
+{
+}
+RegistrationData.prototype = {
+    classID: Components.ID("{ca168834-cc00-48f9-b83c-fd018e58cae3}"),
+    _xpcom_factory: {
+        createInstance: function(outer, iid) {
+            if (outer != null)
+                throw Components.results.NS_ERROR_NO_AGGREGATION;
+            Init();
+            return (new PROT_ListManager()).QueryInterface(iid);
+        }
+    },
+};
+
+this.NSGetFactory = XPCOMUtils.generateNSGetFactory([RegistrationData]);
diff --git a/toolkit/components/url-classifier/nsUrlClassifierPrefixSet.cpp b/toolkit/components/url-classifier/nsUrlClassifierPrefixSet.cpp
new file mode 100644
index 0000000000..0756913966
--- /dev/null
+++ b/toolkit/components/url-classifier/nsUrlClassifierPrefixSet.cpp
@@ -0,0 +1,433 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsCOMPtr.h"
+#include "nsDebug.h"
+#include "nsPrintfCString.h"
+#include "nsTArray.h"
+#include "nsString.h"
+#include "nsUrlClassifierPrefixSet.h"
+#include "nsIUrlClassifierPrefixSet.h"
+#include "nsIFile.h"
+#include "nsToolkitCompsCID.h"
+#include "nsTArray.h"
+#include "nsThreadUtils.h"
+#include "mozilla/MemoryReporting.h"
+#include "mozilla/Telemetry.h"
+#include "mozilla/FileUtils.h"
+#include "mozilla/Logging.h"
+
+using namespace mozilla;
+
+// NSPR_LOG_MODULES=UrlClassifierPrefixSet:5
+static const PRLogModuleInfo *gUrlClassifierPrefixSetLog = nullptr;
+#define LOG(args) MOZ_LOG(gUrlClassifierPrefixSetLog, mozilla::LogLevel::Debug, args)
+#define LOG_ENABLED() MOZ_LOG_TEST(gUrlClassifierPrefixSetLog, mozilla::LogLevel::Debug)
+
+NS_IMPL_ISUPPORTS(
+  nsUrlClassifierPrefixSet, nsIUrlClassifierPrefixSet, nsIMemoryReporter)
+
+MOZ_DEFINE_MALLOC_SIZE_OF(UrlClassifierMallocSizeOf)
+
+nsUrlClassifierPrefixSet::nsUrlClassifierPrefixSet()
+  : mTotalPrefixes(0)
+  , mMemoryInUse(0)
+  , mMemoryReportPath()
+{
+  if (!gUrlClassifierPrefixSetLog)
+    gUrlClassifierPrefixSetLog = PR_NewLogModule("UrlClassifierPrefixSet");
+}
+
+NS_IMETHODIMP
+nsUrlClassifierPrefixSet::Init(const nsACString& aName)
+{
+  mMemoryReportPath =
+    nsPrintfCString(
+      "explicit/storage/prefix-set/%s",
+      (!aName.IsEmpty() ? PromiseFlatCString(aName).get() : "?!")
+    );
+
+  RegisterWeakMemoryReporter(this);
+
+  return NS_OK;
+}
+
+nsUrlClassifierPrefixSet::~nsUrlClassifierPrefixSet()
+{
+  UnregisterWeakMemoryReporter(this);
+}
+
+NS_IMETHODIMP
+nsUrlClassifierPrefixSet::SetPrefixes(const uint32_t* aArray, uint32_t aLength)
+{
+  nsresult rv = NS_OK;
+
+  if (aLength <= 0) {
+    if (mIndexPrefixes.Length() > 0) {
+      LOG(("Clearing PrefixSet"));
+      mIndexDeltas.Clear();
+      mIndexPrefixes.Clear();
+      mTotalPrefixes = 0;
+    }
+  } else {
+    rv = MakePrefixSet(aArray, aLength);
+  }
+
+  mMemoryInUse = SizeOfIncludingThis(UrlClassifierMallocSizeOf);
+
+  return rv;
+}
+
+nsresult
+nsUrlClassifierPrefixSet::MakePrefixSet(const uint32_t* aPrefixes, uint32_t aLength)
+{
+  if (aLength == 0) {
+    return NS_OK;
+  }
+
+#ifdef DEBUG
+  for (uint32_t i = 1; i < aLength; i++) {
+    MOZ_ASSERT(aPrefixes[i] >= aPrefixes[i-1]);
+  }
+#endif
+
+  mIndexPrefixes.Clear();
+  mIndexDeltas.Clear();
+  mTotalPrefixes = aLength;
+
+  mIndexPrefixes.AppendElement(aPrefixes[0]);
+  mIndexDeltas.AppendElement();
+
+  uint32_t numOfDeltas = 0;
+  uint32_t totalDeltas = 0;
+  uint32_t currentItem = aPrefixes[0];
+  for (uint32_t i = 1; i < aLength; i++) {
+    if ((numOfDeltas >= DELTAS_LIMIT) ||
+          (aPrefixes[i] - currentItem >= MAX_INDEX_DIFF)) {
+      mIndexDeltas.AppendElement();
+      mIndexDeltas[mIndexDeltas.Length() - 1].Compact();
+      mIndexPrefixes.AppendElement(aPrefixes[i]);
+      numOfDeltas = 0;
+    } else {
+      uint16_t delta = aPrefixes[i] - currentItem;
+      mIndexDeltas[mIndexDeltas.Length() - 1].AppendElement(delta);
+      numOfDeltas++;
+      totalDeltas++;
+    }
+    currentItem = aPrefixes[i];
+  }
+
+  mIndexPrefixes.Compact();
+  mIndexDeltas.Compact();
+
+  LOG(("Total number of indices: %d", aLength));
+  LOG(("Total number of deltas: %d", totalDeltas));
+  LOG(("Total number of delta chunks: %d", mIndexDeltas.Length()));
+
+  return NS_OK;
+}
+
+nsresult
+nsUrlClassifierPrefixSet::GetPrefixesNative(FallibleTArray<uint32_t>& outArray)
+{
+  if (!outArray.SetLength(mTotalPrefixes, fallible)) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  uint32_t prefixIdxLength = mIndexPrefixes.Length();
+  uint32_t prefixCnt = 0;
+
+  for (uint32_t i = 0; i < prefixIdxLength; i++) {
+    uint32_t prefix = mIndexPrefixes[i];
+
+    outArray[prefixCnt++] = prefix;
+    for (uint32_t j = 0; j < mIndexDeltas[i].Length(); j++) {
+      prefix += mIndexDeltas[i][j];
+      outArray[prefixCnt++] = prefix;
+    }
+  }
+
+  NS_ASSERTION(mTotalPrefixes == prefixCnt, "Lengths are inconsistent");
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsUrlClassifierPrefixSet::GetPrefixes(uint32_t* aCount,
+                                      uint32_t** aPrefixes)
+{
+  NS_ENSURE_ARG_POINTER(aCount);
+  *aCount = 0;
+  NS_ENSURE_ARG_POINTER(aPrefixes);
+  *aPrefixes = nullptr;
+
+  FallibleTArray<uint32_t> prefixes;
+  nsresult rv = GetPrefixesNative(prefixes);
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+
+  uint64_t itemCount = prefixes.Length();
+  uint32_t* prefixArray = static_cast<uint32_t*>(moz_xmalloc(itemCount * sizeof(uint32_t)));
+  NS_ENSURE_TRUE(prefixArray, NS_ERROR_OUT_OF_MEMORY);
+
+  memcpy(prefixArray, prefixes.Elements(), sizeof(uint32_t) * itemCount);
+
+  *aCount = itemCount;
+  *aPrefixes = prefixArray;
+
+  return NS_OK;
+}
+
+uint32_t nsUrlClassifierPrefixSet::BinSearch(uint32_t start,
+                                             uint32_t end,
+                                             uint32_t target)
+{
+  while (start != end && end >= start) {
+    uint32_t i = start + ((end - start) >> 1);
+    uint32_t value = mIndexPrefixes[i];
+    if (value < target) {
+      start = i + 1;
+    } else if (value > target) {
+      end = i - 1;
+    } else {
+      return i;
+    }
+  }
+  return end;
+}
+
+NS_IMETHODIMP
+nsUrlClassifierPrefixSet::Contains(uint32_t aPrefix, bool* aFound)
+{
+  *aFound = false;
+
+  if (mIndexPrefixes.Length() == 0) {
+    return NS_OK;
+  }
+
+  uint32_t target = aPrefix;
+
+  // We want to do a "Price is Right" binary search, that is, we want to find
+  // the index of the value either equal to the target or the closest value
+  // that is less than the target.
+  //
+  if (target < mIndexPrefixes[0]) {
+    return NS_OK;
+  }
+
+  // |binsearch| does not necessarily return the correct index (when the
+  // target is not found) but rather it returns an index at least one away
+  // from the correct index.
+  // Because of this, we need to check if the target lies before the beginning
+  // of the indices.
+
+  uint32_t i = BinSearch(0, mIndexPrefixes.Length() - 1, target);
+  if (mIndexPrefixes[i] > target && i > 0) {
+    i--;
+  }
+
+  // Now search through the deltas for the target.
+  uint32_t diff = target - mIndexPrefixes[i];
+  uint32_t deltaSize  = mIndexDeltas[i].Length();
+  uint32_t deltaIndex = 0;
+
+  while (diff > 0 && deltaIndex < deltaSize) {
+    diff -= mIndexDeltas[i][deltaIndex];
+    deltaIndex++;
+  }
+
+  if (diff == 0) {
+    *aFound = true;
+  }
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsUrlClassifierPrefixSet::CollectReports(nsIHandleReportCallback* aHandleReport,
+                                         nsISupports* aData, bool aAnonymize)
+{
+  return aHandleReport->Callback(
+    EmptyCString(), mMemoryReportPath, KIND_HEAP, UNITS_BYTES,
+    mMemoryInUse,
+    NS_LITERAL_CSTRING("Memory used by the prefix set for a URL classifier."),
+    aData);
+}
+
+size_t
+nsUrlClassifierPrefixSet::SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf)
+{
+  size_t n = 0;
+  n += aMallocSizeOf(this);
+  n += mIndexDeltas.ShallowSizeOfExcludingThis(aMallocSizeOf);
+  for (uint32_t i = 0; i < mIndexDeltas.Length(); i++) {
+    n += mIndexDeltas[i].ShallowSizeOfExcludingThis(aMallocSizeOf);
+  }
+  n += mIndexPrefixes.ShallowSizeOfExcludingThis(aMallocSizeOf);
+  return n;
+}
+
+NS_IMETHODIMP
+nsUrlClassifierPrefixSet::IsEmpty(bool * aEmpty)
+{
+  *aEmpty = (mIndexPrefixes.Length() == 0);
+  return NS_OK;
+}
+
+nsresult
+nsUrlClassifierPrefixSet::LoadFromFd(AutoFDClose& fileFd)
+{
+  uint32_t magic;
+  int32_t read;
+
+  read = PR_Read(fileFd, &magic, sizeof(uint32_t));
+  NS_ENSURE_TRUE(read == sizeof(uint32_t), NS_ERROR_FAILURE);
+
+  if (magic == PREFIXSET_VERSION_MAGIC) {
+    uint32_t indexSize;
+    uint32_t deltaSize;
+
+    read = PR_Read(fileFd, &indexSize, sizeof(uint32_t));
+    NS_ENSURE_TRUE(read == sizeof(uint32_t), NS_ERROR_FILE_CORRUPTED);
+    read = PR_Read(fileFd, &deltaSize, sizeof(uint32_t));
+    NS_ENSURE_TRUE(read == sizeof(uint32_t), NS_ERROR_FILE_CORRUPTED);
+
+    if (indexSize == 0) {
+      LOG(("stored PrefixSet is empty!"));
+      return NS_OK;
+    }
+
+    if (deltaSize > (indexSize * DELTAS_LIMIT)) {
+      return NS_ERROR_FILE_CORRUPTED;
+    }
+
+    nsTArray<uint32_t> indexStarts;
+    indexStarts.SetLength(indexSize);
+    mIndexPrefixes.SetLength(indexSize);
+    mIndexDeltas.SetLength(indexSize);
+
+    mTotalPrefixes = indexSize;
+
+    int32_t toRead = indexSize*sizeof(uint32_t);
+    read = PR_Read(fileFd, mIndexPrefixes.Elements(), toRead);
+    NS_ENSURE_TRUE(read == toRead, NS_ERROR_FILE_CORRUPTED);
+    read = PR_Read(fileFd, indexStarts.Elements(), toRead);
+    NS_ENSURE_TRUE(read == toRead, NS_ERROR_FILE_CORRUPTED);
+    if (indexSize != 0 && indexStarts[0] != 0) {
+      return NS_ERROR_FILE_CORRUPTED;
+    }
+    for (uint32_t i = 0; i < indexSize; i++) {
+      uint32_t numInDelta = i == indexSize - 1 ? deltaSize - indexStarts[i]
+                               : indexStarts[i + 1] - indexStarts[i];
+      if (numInDelta > DELTAS_LIMIT) {
+        return NS_ERROR_FILE_CORRUPTED;
+      }
+      if (numInDelta > 0) {
+        mIndexDeltas[i].SetLength(numInDelta);
+        mTotalPrefixes += numInDelta;
+        toRead = numInDelta * sizeof(uint16_t);
+        read = PR_Read(fileFd, mIndexDeltas[i].Elements(), toRead);
+        NS_ENSURE_TRUE(read == toRead, NS_ERROR_FILE_CORRUPTED);
+      }
+    }
+  } else {
+    LOG(("Version magic mismatch, not loading"));
+    return NS_ERROR_FILE_CORRUPTED;
+  }
+
+  MOZ_ASSERT(mIndexPrefixes.Length() == mIndexDeltas.Length());
+  LOG(("Loading PrefixSet successful"));
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsUrlClassifierPrefixSet::LoadFromFile(nsIFile* aFile)
+{
+  Telemetry::AutoTimer<Telemetry::URLCLASSIFIER_PS_FILELOAD_TIME> timer;
+
+  nsresult rv;
+  AutoFDClose fileFd;
+  rv = aFile->OpenNSPRFileDesc(PR_RDONLY | nsIFile::OS_READAHEAD,
+                               0, &fileFd.rwget());
+  if (!NS_FAILED(rv)) {
+    rv = LoadFromFd(fileFd);
+    mMemoryInUse = SizeOfIncludingThis(UrlClassifierMallocSizeOf);
+  }
+
+  return rv;
+}
+
+nsresult
+nsUrlClassifierPrefixSet::StoreToFd(AutoFDClose& fileFd)
+{
+  {
+      Telemetry::AutoTimer<Telemetry::URLCLASSIFIER_PS_FALLOCATE_TIME> timer;
+      int64_t size = 4 * sizeof(uint32_t);
+      uint32_t deltas = mTotalPrefixes - mIndexPrefixes.Length();
+      size += 2 * mIndexPrefixes.Length() * sizeof(uint32_t);
+      size += deltas * sizeof(uint16_t);
+
+      mozilla::fallocate(fileFd, size);
+  }
+
+  int32_t written;
+  int32_t writelen = sizeof(uint32_t);
+  uint32_t magic = PREFIXSET_VERSION_MAGIC;
+  written = PR_Write(fileFd, &magic, writelen);
+  NS_ENSURE_TRUE(written == writelen, NS_ERROR_FAILURE);
+
+  uint32_t indexSize = mIndexPrefixes.Length();
+  uint32_t indexDeltaSize = mIndexDeltas.Length();
+  uint32_t totalDeltas = 0;
+
+  // Store the shape of mIndexDeltas by noting at which "count" of total
+  // indexes a new subarray starts. This is slightly cumbersome but keeps
+  // file format compatibility.
+  // If we ever update the format, we can gain space by storing the delta
+  // subarray sizes, which fit in bytes.
+  nsTArray<uint32_t> indexStarts;
+  indexStarts.AppendElement(0);
+
+  for (uint32_t i = 0; i < indexDeltaSize; i++) {
+    uint32_t deltaLength = mIndexDeltas[i].Length();
+    totalDeltas += deltaLength;
+    indexStarts.AppendElement(totalDeltas);
+  }
+
+  written = PR_Write(fileFd, &indexSize, writelen);
+  NS_ENSURE_TRUE(written == writelen, NS_ERROR_FAILURE);
+  written = PR_Write(fileFd, &totalDeltas, writelen);
+  NS_ENSURE_TRUE(written == writelen, NS_ERROR_FAILURE);
+
+  writelen = indexSize * sizeof(uint32_t);
+  written = PR_Write(fileFd, mIndexPrefixes.Elements(), writelen);
+  NS_ENSURE_TRUE(written == writelen, NS_ERROR_FAILURE);
+  written = PR_Write(fileFd, indexStarts.Elements(), writelen);
+  NS_ENSURE_TRUE(written == writelen, NS_ERROR_FAILURE);
+  if (totalDeltas > 0) {
+    for (uint32_t i = 0; i < indexDeltaSize; i++) {
+      writelen = mIndexDeltas[i].Length() * sizeof(uint16_t);
+      written = PR_Write(fileFd, mIndexDeltas[i].Elements(), writelen);
+      NS_ENSURE_TRUE(written == writelen, NS_ERROR_FAILURE);
+    }
+  }
+
+  LOG(("Saving PrefixSet successful\n"));
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsUrlClassifierPrefixSet::StoreToFile(nsIFile* aFile)
+{
+  AutoFDClose fileFd;
+  nsresult rv = aFile->OpenNSPRFileDesc(PR_RDWR | PR_TRUNCATE | PR_CREATE_FILE,
+                                        0644, &fileFd.rwget());
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return StoreToFd(fileFd);
+}
diff --git a/toolkit/components/url-classifier/nsUrlClassifierPrefixSet.h b/toolkit/components/url-classifier/nsUrlClassifierPrefixSet.h
new file mode 100644
index 0000000000..bd476a79cf
--- /dev/null
+++ b/toolkit/components/url-classifier/nsUrlClassifierPrefixSet.h
@@ -0,0 +1,75 @@
+//* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef nsUrlClassifierPrefixSet_h_
+#define nsUrlClassifierPrefixSet_h_
+
+#include "nsISupportsUtils.h"
+#include "nsID.h"
+#include "nsIFile.h"
+#include "nsIMemoryReporter.h"
+#include "nsIMutableArray.h"
+#include "nsIUrlClassifierPrefixSet.h"
+#include "nsTArray.h"
+#include "nsToolkitCompsCID.h"
+#include "mozilla/MemoryReporting.h"
+#include "mozilla/FileUtils.h"
+#include "mozilla/Atomics.h"
+
+class nsUrlClassifierPrefixSet final
+  : public nsIUrlClassifierPrefixSet
+  , public nsIMemoryReporter
+{
+public:
+  nsUrlClassifierPrefixSet();
+
+  NS_IMETHOD Init(const nsACString& aName) override;
+  NS_IMETHOD SetPrefixes(const uint32_t* aArray, uint32_t aLength) override;
+  NS_IMETHOD GetPrefixes(uint32_t* aCount, uint32_t** aPrefixes) override;
+  NS_IMETHOD Contains(uint32_t aPrefix, bool* aFound) override;
+  NS_IMETHOD IsEmpty(bool* aEmpty) override;
+  NS_IMETHOD LoadFromFile(nsIFile* aFile) override;
+  NS_IMETHOD StoreToFile(nsIFile* aFile) override;
+
+  nsresult GetPrefixesNative(FallibleTArray<uint32_t>& outArray);
+  size_t SizeInMemory() { return mMemoryInUse; };
+
+  NS_DECL_THREADSAFE_ISUPPORTS
+  NS_DECL_NSIMEMORYREPORTER
+
+protected:
+  virtual ~nsUrlClassifierPrefixSet();
+
+  static const uint32_t DELTAS_LIMIT = 120;
+  static const uint32_t MAX_INDEX_DIFF = (1 << 16);
+  static const uint32_t PREFIXSET_VERSION_MAGIC = 1;
+
+  nsresult MakePrefixSet(const uint32_t* aArray, uint32_t aLength);
+  uint32_t BinSearch(uint32_t start, uint32_t end, uint32_t target);
+  nsresult LoadFromFd(mozilla::AutoFDClose& fileFd);
+  nsresult StoreToFd(mozilla::AutoFDClose& fileFd);
+
+  // Return the estimated size of the set on disk and in memory, in bytes.
+  size_t SizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf);
+
+  // list of fully stored prefixes, that also form the
+  // start of a run of deltas in mIndexDeltas.
+  nsTArray<uint32_t> mIndexPrefixes;
+  // array containing arrays of deltas from indices.
+  // Index to the place that matches the closest lower
+  // prefix from mIndexPrefix. Then every "delta" corresponds
+  // to a prefix in the PrefixSet.
+  nsTArray<nsTArray<uint16_t> > mIndexDeltas;
+  // how many prefixes we have.
+  uint32_t mTotalPrefixes;
+
+  // memory report collection might happen while we're updating the prefixset
+  // on another thread, so pre-compute and remember the size (bug 1050108).
+  mozilla::Atomic<size_t> mMemoryInUse;
+  nsCString mMemoryReportPath;
+};
+
+#endif
diff --git a/toolkit/components/url-classifier/nsUrlClassifierProxies.cpp b/toolkit/components/url-classifier/nsUrlClassifierProxies.cpp
new file mode 100644
index 0000000000..73330d66da
--- /dev/null
+++ b/toolkit/components/url-classifier/nsUrlClassifierProxies.cpp
@@ -0,0 +1,334 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsUrlClassifierProxies.h"
+#include "nsUrlClassifierDBService.h"
+
+#include "mozilla/SyncRunnable.h"
+
+using namespace mozilla::safebrowsing;
+
+static nsresult
+DispatchToWorkerThread(nsIRunnable* r)
+{
+  nsIThread* t = nsUrlClassifierDBService::BackgroundThread();
+  if (!t)
+    return NS_ERROR_FAILURE;
+
+  return t->Dispatch(r, NS_DISPATCH_NORMAL);
+}
+
+NS_IMPL_ISUPPORTS(UrlClassifierDBServiceWorkerProxy,
+                  nsIUrlClassifierDBServiceWorker)
+
+NS_IMETHODIMP
+UrlClassifierDBServiceWorkerProxy::Lookup(nsIPrincipal* aPrincipal,
+                                          const nsACString& aTables,
+                                          nsIUrlClassifierCallback* aCB)
+{
+  nsCOMPtr<nsIRunnable> r = new LookupRunnable(mTarget, aPrincipal, aTables,
+                                               aCB);
+  return DispatchToWorkerThread(r);
+}
+
+NS_IMETHODIMP
+UrlClassifierDBServiceWorkerProxy::LookupRunnable::Run()
+{
+  (void) mTarget->Lookup(mPrincipal, mLookupTables, mCB);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+UrlClassifierDBServiceWorkerProxy::GetTables(nsIUrlClassifierCallback* aCB)
+{
+  nsCOMPtr<nsIRunnable> r = new GetTablesRunnable(mTarget, aCB);
+  return DispatchToWorkerThread(r);
+}
+
+NS_IMETHODIMP
+UrlClassifierDBServiceWorkerProxy::GetTablesRunnable::Run()
+{
+  mTarget->GetTables(mCB);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+UrlClassifierDBServiceWorkerProxy::SetHashCompleter
+  (const nsACString&, nsIUrlClassifierHashCompleter*)
+{
+  NS_NOTREACHED("This method should not be called!");
+  return NS_ERROR_NOT_IMPLEMENTED;
+}
+
+NS_IMETHODIMP
+UrlClassifierDBServiceWorkerProxy::BeginUpdate
+  (nsIUrlClassifierUpdateObserver* aUpdater,
+   const nsACString& aTables)
+{
+  nsCOMPtr<nsIRunnable> r = new BeginUpdateRunnable(mTarget, aUpdater,
+                                                    aTables);
+  return DispatchToWorkerThread(r);
+}
+
+NS_IMETHODIMP
+UrlClassifierDBServiceWorkerProxy::BeginUpdateRunnable::Run()
+{
+  mTarget->BeginUpdate(mUpdater, mTables);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+UrlClassifierDBServiceWorkerProxy::BeginStream(const nsACString& aTable)
+{
+  nsCOMPtr<nsIRunnable> r =
+    new BeginStreamRunnable(mTarget, aTable);
+  return DispatchToWorkerThread(r);
+}
+
+NS_IMETHODIMP
+UrlClassifierDBServiceWorkerProxy::BeginStreamRunnable::Run()
+{
+  mTarget->BeginStream(mTable);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+UrlClassifierDBServiceWorkerProxy::UpdateStream(const nsACString& aUpdateChunk)
+{
+  nsCOMPtr<nsIRunnable> r =
+    new UpdateStreamRunnable(mTarget, aUpdateChunk);
+  return DispatchToWorkerThread(r);
+}
+
+NS_IMETHODIMP
+UrlClassifierDBServiceWorkerProxy::UpdateStreamRunnable::Run()
+{
+  mTarget->UpdateStream(mUpdateChunk);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+UrlClassifierDBServiceWorkerProxy::FinishStream()
+{
+  nsCOMPtr<nsIRunnable> r =
+    NS_NewRunnableMethod(mTarget,
+                         &nsIUrlClassifierDBServiceWorker::FinishStream);
+  return DispatchToWorkerThread(r);
+}
+
+NS_IMETHODIMP
+UrlClassifierDBServiceWorkerProxy::DoLocalLookupRunnable::Run()
+{
+  mTarget->DoLocalLookup(mSpec, mTables, mResults);
+  return NS_OK;
+}
+
+nsresult
+UrlClassifierDBServiceWorkerProxy::DoLocalLookup(const nsACString& spec,
+                                                 const nsACString& tables,
+                                                 LookupResultArray* results)
+
+{
+  // Run synchronously on background thread. NS_DISPATCH_SYNC does *not* do
+  // what we want -- it continues processing events on the main thread loop
+  // before the Dispatch returns.
+  nsCOMPtr<nsIRunnable> r = new DoLocalLookupRunnable(mTarget, spec, tables, results);
+  nsIThread* t = nsUrlClassifierDBService::BackgroundThread();
+  if (!t)
+    return NS_ERROR_FAILURE;
+
+  mozilla::SyncRunnable::DispatchToThread(t, r);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+UrlClassifierDBServiceWorkerProxy::FinishUpdate()
+{
+  nsCOMPtr<nsIRunnable> r =
+    NS_NewRunnableMethod(mTarget,
+                         &nsIUrlClassifierDBServiceWorker::FinishUpdate);
+  return DispatchToWorkerThread(r);
+}
+
+NS_IMETHODIMP
+UrlClassifierDBServiceWorkerProxy::CancelUpdate()
+{
+  nsCOMPtr<nsIRunnable> r =
+    NS_NewRunnableMethod(mTarget,
+                         &nsIUrlClassifierDBServiceWorker::CancelUpdate);
+  return DispatchToWorkerThread(r);
+}
+
+NS_IMETHODIMP
+UrlClassifierDBServiceWorkerProxy::ResetDatabase()
+{
+  nsCOMPtr<nsIRunnable> r =
+    NS_NewRunnableMethod(mTarget,
+                         &nsIUrlClassifierDBServiceWorker::ResetDatabase);
+  return DispatchToWorkerThread(r);
+}
+
+NS_IMETHODIMP
+UrlClassifierDBServiceWorkerProxy::OpenDb()
+{
+  nsCOMPtr<nsIRunnable> r =
+    NS_NewRunnableMethod(mTarget,
+                         &nsIUrlClassifierDBServiceWorker::OpenDb);
+  return DispatchToWorkerThread(r);
+}
+
+NS_IMETHODIMP
+UrlClassifierDBServiceWorkerProxy::CloseDb()
+{
+  nsCOMPtr<nsIRunnable> r =
+    NS_NewRunnableMethod(mTarget,
+                         &nsIUrlClassifierDBServiceWorker::CloseDb);
+  return DispatchToWorkerThread(r);
+}
+
+NS_IMETHODIMP
+UrlClassifierDBServiceWorkerProxy::CacheCompletions(CacheResultArray * aEntries)
+{
+  nsCOMPtr<nsIRunnable> r = new CacheCompletionsRunnable(mTarget, aEntries);
+  return DispatchToWorkerThread(r);
+}
+
+NS_IMETHODIMP
+UrlClassifierDBServiceWorkerProxy::CacheCompletionsRunnable::Run()
+{
+  mTarget->CacheCompletions(mEntries);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+UrlClassifierDBServiceWorkerProxy::CacheMisses(PrefixArray * aEntries)
+{
+  nsCOMPtr<nsIRunnable> r = new CacheMissesRunnable(mTarget, aEntries);
+  return DispatchToWorkerThread(r);
+}
+
+NS_IMETHODIMP
+UrlClassifierDBServiceWorkerProxy::CacheMissesRunnable::Run()
+{
+  mTarget->CacheMisses(mEntries);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+UrlClassifierDBServiceWorkerProxy::SetLastUpdateTime(const nsACString& table,
+                                                     uint64_t lastUpdateTime)
+{
+  nsCOMPtr<nsIRunnable> r =
+    new SetLastUpdateTimeRunnable(mTarget, table, lastUpdateTime);
+  return DispatchToWorkerThread(r);
+}
+
+NS_IMETHODIMP
+UrlClassifierDBServiceWorkerProxy::SetLastUpdateTimeRunnable::Run()
+{
+  mTarget->SetLastUpdateTime(mTable, mUpdateTime);
+  return NS_OK;
+}
+
+NS_IMPL_ISUPPORTS(UrlClassifierLookupCallbackProxy,
+                  nsIUrlClassifierLookupCallback)
+
+NS_IMETHODIMP
+UrlClassifierLookupCallbackProxy::LookupComplete
+  (LookupResultArray * aResults)
+{
+  nsCOMPtr<nsIRunnable> r = new LookupCompleteRunnable(mTarget, aResults);
+  return NS_DispatchToMainThread(r);
+}
+
+NS_IMETHODIMP
+UrlClassifierLookupCallbackProxy::LookupCompleteRunnable::Run()
+{
+  mTarget->LookupComplete(mResults);
+  return NS_OK;
+}
+
+NS_IMPL_ISUPPORTS(UrlClassifierCallbackProxy,
+                  nsIUrlClassifierCallback)
+
+NS_IMETHODIMP
+UrlClassifierCallbackProxy::HandleEvent(const nsACString& aValue)
+{
+  nsCOMPtr<nsIRunnable> r = new HandleEventRunnable(mTarget, aValue);
+  return NS_DispatchToMainThread(r);
+}
+
+NS_IMETHODIMP
+UrlClassifierCallbackProxy::HandleEventRunnable::Run()
+{
+  mTarget->HandleEvent(mValue);
+  return NS_OK;
+}
+
+NS_IMPL_ISUPPORTS(UrlClassifierUpdateObserverProxy,
+                  nsIUrlClassifierUpdateObserver)
+
+NS_IMETHODIMP
+UrlClassifierUpdateObserverProxy::UpdateUrlRequested
+  (const nsACString& aURL,
+   const nsACString& aTable)
+{
+  nsCOMPtr<nsIRunnable> r =
+    new UpdateUrlRequestedRunnable(mTarget, aURL, aTable);
+  return NS_DispatchToMainThread(r);
+}
+
+NS_IMETHODIMP
+UrlClassifierUpdateObserverProxy::UpdateUrlRequestedRunnable::Run()
+{
+  mTarget->UpdateUrlRequested(mURL, mTable);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+UrlClassifierUpdateObserverProxy::StreamFinished(nsresult aStatus,
+                                                 uint32_t aDelay)
+{
+  nsCOMPtr<nsIRunnable> r =
+    new StreamFinishedRunnable(mTarget, aStatus, aDelay);
+  return NS_DispatchToMainThread(r);
+}
+
+NS_IMETHODIMP
+UrlClassifierUpdateObserverProxy::StreamFinishedRunnable::Run()
+{
+  mTarget->StreamFinished(mStatus, mDelay);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+UrlClassifierUpdateObserverProxy::UpdateError(nsresult aError)
+{
+  nsCOMPtr<nsIRunnable> r =
+    new UpdateErrorRunnable(mTarget, aError);
+  return NS_DispatchToMainThread(r);
+}
+
+NS_IMETHODIMP
+UrlClassifierUpdateObserverProxy::UpdateErrorRunnable::Run()
+{
+  mTarget->UpdateError(mError);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+UrlClassifierUpdateObserverProxy::UpdateSuccess(uint32_t aRequestedTimeout)
+{
+  nsCOMPtr<nsIRunnable> r =
+    new UpdateSuccessRunnable(mTarget, aRequestedTimeout);
+  return NS_DispatchToMainThread(r);
+}
+
+NS_IMETHODIMP
+UrlClassifierUpdateObserverProxy::UpdateSuccessRunnable::Run()
+{
+  mTarget->UpdateSuccess(mRequestedTimeout);
+  return NS_OK;
+}
diff --git a/toolkit/components/url-classifier/nsUrlClassifierProxies.h b/toolkit/components/url-classifier/nsUrlClassifierProxies.h
new file mode 100644
index 0000000000..087cd5df7b
--- /dev/null
+++ b/toolkit/components/url-classifier/nsUrlClassifierProxies.h
@@ -0,0 +1,357 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef nsUrlClassifierProxies_h
+#define nsUrlClassifierProxies_h
+
+#include "nsIUrlClassifierDBService.h"
+#include "nsUrlClassifierDBService.h"
+#include "nsProxyRelease.h"
+#include "nsThreadUtils.h"
+#include "mozilla/Attributes.h"
+#include "nsIPrincipal.h"
+#include "LookupCache.h"
+
+
+/**
+ * Thread proxy from the main thread to the worker thread.
+ */
+class UrlClassifierDBServiceWorkerProxy final :
+  public nsIUrlClassifierDBServiceWorker
+{
+public:
+  explicit UrlClassifierDBServiceWorkerProxy(nsUrlClassifierDBServiceWorker* aTarget)
+    : mTarget(aTarget)
+  { }
+
+  NS_DECL_THREADSAFE_ISUPPORTS
+  NS_DECL_NSIURLCLASSIFIERDBSERVICE
+  NS_DECL_NSIURLCLASSIFIERDBSERVICEWORKER
+
+  class LookupRunnable : public nsRunnable
+  {
+  public:
+    LookupRunnable(nsUrlClassifierDBServiceWorker* aTarget,
+                   nsIPrincipal* aPrincipal,
+                   const nsACString& aTables,
+                   nsIUrlClassifierCallback* aCB)
+      : mTarget(aTarget)
+      , mPrincipal(aPrincipal)
+      , mLookupTables(aTables)
+      , mCB(aCB)
+    { }
+
+    NS_DECL_NSIRUNNABLE
+
+  private:
+    RefPtr<nsUrlClassifierDBServiceWorker> mTarget;
+    nsCOMPtr<nsIPrincipal> mPrincipal;
+    nsCString mLookupTables;
+    nsCOMPtr<nsIUrlClassifierCallback> mCB;
+  };
+
+  class GetTablesRunnable : public nsRunnable
+  {
+  public:
+    GetTablesRunnable(nsUrlClassifierDBServiceWorker* aTarget,
+                      nsIUrlClassifierCallback* aCB)
+      : mTarget(aTarget)
+      , mCB(aCB)
+    { }
+
+    NS_DECL_NSIRUNNABLE
+
+  private:
+    RefPtr<nsUrlClassifierDBServiceWorker> mTarget;
+    nsCOMPtr<nsIUrlClassifierCallback> mCB;
+  };
+
+  class BeginUpdateRunnable : public nsRunnable
+  {
+  public:
+    BeginUpdateRunnable(nsUrlClassifierDBServiceWorker* aTarget,
+                        nsIUrlClassifierUpdateObserver* aUpdater,
+                        const nsACString& aTables)
+      : mTarget(aTarget)
+      , mUpdater(aUpdater)
+      , mTables(aTables)
+    { }
+
+    NS_DECL_NSIRUNNABLE
+
+  private:
+    RefPtr<nsUrlClassifierDBServiceWorker> mTarget;
+    nsCOMPtr<nsIUrlClassifierUpdateObserver> mUpdater;
+    nsCString mTables;
+  };
+
+  class BeginStreamRunnable : public nsRunnable
+  {
+  public:
+    BeginStreamRunnable(nsUrlClassifierDBServiceWorker* aTarget,
+                        const nsACString& aTable)
+      : mTarget(aTarget)
+      , mTable(aTable)
+    { }
+
+    NS_DECL_NSIRUNNABLE
+
+  private:
+    RefPtr<nsUrlClassifierDBServiceWorker> mTarget;
+    nsCString mTable;
+  };
+
+  class UpdateStreamRunnable : public nsRunnable
+  {
+  public:
+    UpdateStreamRunnable(nsUrlClassifierDBServiceWorker* aTarget,
+                         const nsACString& aUpdateChunk)
+      : mTarget(aTarget)
+      , mUpdateChunk(aUpdateChunk)
+    { }
+
+    NS_DECL_NSIRUNNABLE
+
+  private:
+    RefPtr<nsUrlClassifierDBServiceWorker> mTarget;
+    nsCString mUpdateChunk;
+  };
+
+  class CacheCompletionsRunnable : public nsRunnable
+  {
+  public:
+    CacheCompletionsRunnable(nsUrlClassifierDBServiceWorker* aTarget,
+                             mozilla::safebrowsing::CacheResultArray *aEntries)
+      : mTarget(aTarget)
+      , mEntries(aEntries)
+    { }
+
+    NS_DECL_NSIRUNNABLE
+
+  private:
+    RefPtr<nsUrlClassifierDBServiceWorker> mTarget;
+     mozilla::safebrowsing::CacheResultArray *mEntries;
+  };
+
+  class CacheMissesRunnable : public nsRunnable
+  {
+  public:
+    CacheMissesRunnable(nsUrlClassifierDBServiceWorker* aTarget,
+                        mozilla::safebrowsing::PrefixArray *aEntries)
+      : mTarget(aTarget)
+      , mEntries(aEntries)
+    { }
+
+    NS_DECL_NSIRUNNABLE
+
+  private:
+    RefPtr<nsUrlClassifierDBServiceWorker> mTarget;
+    mozilla::safebrowsing::PrefixArray *mEntries;
+  };
+
+  class DoLocalLookupRunnable : public nsRunnable
+  {
+  public:
+    DoLocalLookupRunnable(nsUrlClassifierDBServiceWorker* aTarget,
+                          const nsACString& spec,
+                          const nsACString& tables,
+                          mozilla::safebrowsing::LookupResultArray* results)
+      : mTarget(aTarget)
+      , mSpec(spec)
+      , mTables(tables)
+      , mResults(results)
+    { }
+
+    NS_DECL_NSIRUNNABLE
+  private:
+    RefPtr<nsUrlClassifierDBServiceWorker> mTarget;
+
+    nsCString mSpec;
+    nsCString mTables;
+    mozilla::safebrowsing::LookupResultArray* mResults;
+  };
+
+  class SetLastUpdateTimeRunnable : public nsRunnable
+  {
+  public:
+    SetLastUpdateTimeRunnable(nsUrlClassifierDBServiceWorker* aTarget,
+                              const nsACString& table,
+                              uint64_t updateTime)
+      : mTarget(aTarget),
+        mTable(table),
+        mUpdateTime(updateTime)
+    { }
+
+    NS_DECL_NSIRUNNABLE
+  private:
+    RefPtr<nsUrlClassifierDBServiceWorker> mTarget;
+    nsCString mTable;
+    uint64_t mUpdateTime;
+  };
+
+public:
+  nsresult DoLocalLookup(const nsACString& spec,
+                         const nsACString& tables,
+                         mozilla::safebrowsing::LookupResultArray* results);
+
+private:
+  ~UrlClassifierDBServiceWorkerProxy() {}
+
+  RefPtr<nsUrlClassifierDBServiceWorker> mTarget;
+};
+
+// The remaining classes here are all proxies to the main thread
+
+class UrlClassifierLookupCallbackProxy final :
+  public nsIUrlClassifierLookupCallback
+{
+public:
+  explicit UrlClassifierLookupCallbackProxy(nsIUrlClassifierLookupCallback* aTarget)
+    : mTarget(new nsMainThreadPtrHolder<nsIUrlClassifierLookupCallback>(aTarget))
+  { }
+
+  NS_DECL_THREADSAFE_ISUPPORTS
+  NS_DECL_NSIURLCLASSIFIERLOOKUPCALLBACK
+
+  class LookupCompleteRunnable : public nsRunnable
+  {
+  public:
+    LookupCompleteRunnable(const nsMainThreadPtrHandle<nsIUrlClassifierLookupCallback>& aTarget,
+                           mozilla::safebrowsing::LookupResultArray *aResults)
+      : mTarget(aTarget)
+      , mResults(aResults)
+    { }
+
+    NS_DECL_NSIRUNNABLE
+
+  private:
+    nsMainThreadPtrHandle<nsIUrlClassifierLookupCallback> mTarget;
+    mozilla::safebrowsing::LookupResultArray * mResults;
+  };
+
+private:
+  ~UrlClassifierLookupCallbackProxy() {}
+
+  nsMainThreadPtrHandle<nsIUrlClassifierLookupCallback> mTarget;
+};
+
+class UrlClassifierCallbackProxy final : public nsIUrlClassifierCallback
+{
+public:
+  explicit UrlClassifierCallbackProxy(nsIUrlClassifierCallback* aTarget)
+    : mTarget(new nsMainThreadPtrHolder<nsIUrlClassifierCallback>(aTarget))
+  { }
+
+  NS_DECL_THREADSAFE_ISUPPORTS
+  NS_DECL_NSIURLCLASSIFIERCALLBACK
+
+  class HandleEventRunnable : public nsRunnable
+  {
+  public:
+    HandleEventRunnable(const nsMainThreadPtrHandle<nsIUrlClassifierCallback>& aTarget,
+                        const nsACString& aValue)
+      : mTarget(aTarget)
+      , mValue(aValue)
+    { }
+
+    NS_DECL_NSIRUNNABLE
+
+  private:
+    nsMainThreadPtrHandle<nsIUrlClassifierCallback> mTarget;
+    nsCString mValue;
+  };
+
+private:
+  ~UrlClassifierCallbackProxy() {}
+
+  nsMainThreadPtrHandle<nsIUrlClassifierCallback> mTarget;
+};
+
+class UrlClassifierUpdateObserverProxy final :
+  public nsIUrlClassifierUpdateObserver
+{
+public:
+  explicit UrlClassifierUpdateObserverProxy(nsIUrlClassifierUpdateObserver* aTarget)
+    : mTarget(new nsMainThreadPtrHolder<nsIUrlClassifierUpdateObserver>(aTarget))
+  { }
+
+  NS_DECL_THREADSAFE_ISUPPORTS
+  NS_DECL_NSIURLCLASSIFIERUPDATEOBSERVER
+
+  class UpdateUrlRequestedRunnable : public nsRunnable
+  {
+  public:
+    UpdateUrlRequestedRunnable(const nsMainThreadPtrHandle<nsIUrlClassifierUpdateObserver>& aTarget,
+                               const nsACString& aURL,
+                               const nsACString& aTable)
+      : mTarget(aTarget)
+      , mURL(aURL)
+      , mTable(aTable)
+    { }
+
+    NS_DECL_NSIRUNNABLE
+
+  private:
+    nsMainThreadPtrHandle<nsIUrlClassifierUpdateObserver> mTarget;
+    nsCString mURL, mTable;
+  };
+
+  class StreamFinishedRunnable : public nsRunnable
+  {
+  public:
+    StreamFinishedRunnable(const nsMainThreadPtrHandle<nsIUrlClassifierUpdateObserver>& aTarget,
+                           nsresult aStatus, uint32_t aDelay)
+      : mTarget(aTarget)
+      , mStatus(aStatus)
+      , mDelay(aDelay)
+    { }
+
+    NS_DECL_NSIRUNNABLE
+
+  private:
+    nsMainThreadPtrHandle<nsIUrlClassifierUpdateObserver> mTarget;
+    nsresult mStatus;
+    uint32_t mDelay;
+  };
+
+  class UpdateErrorRunnable : public nsRunnable
+  {
+  public:
+    UpdateErrorRunnable(const nsMainThreadPtrHandle<nsIUrlClassifierUpdateObserver>& aTarget,
+                        nsresult aError)
+      : mTarget(aTarget)
+      , mError(aError)
+    { }
+
+    NS_DECL_NSIRUNNABLE
+
+  private:
+    nsMainThreadPtrHandle<nsIUrlClassifierUpdateObserver> mTarget;
+    nsresult mError;
+  };
+
+  class UpdateSuccessRunnable : public nsRunnable
+  {
+  public:
+    UpdateSuccessRunnable(const nsMainThreadPtrHandle<nsIUrlClassifierUpdateObserver>& aTarget,
+                          uint32_t aRequestedTimeout)
+      : mTarget(aTarget)
+      , mRequestedTimeout(aRequestedTimeout)
+    { }
+
+    NS_DECL_NSIRUNNABLE
+
+  private:
+    nsMainThreadPtrHandle<nsIUrlClassifierUpdateObserver> mTarget;
+    uint32_t mRequestedTimeout;
+  };
+
+private:
+  ~UrlClassifierUpdateObserverProxy() {}
+
+  nsMainThreadPtrHandle<nsIUrlClassifierUpdateObserver> mTarget;
+};
+
+#endif // nsUrlClassifierProxies_h
diff --git a/toolkit/components/url-classifier/nsUrlClassifierStreamUpdater.cpp b/toolkit/components/url-classifier/nsUrlClassifierStreamUpdater.cpp
new file mode 100644
index 0000000000..55690a539c
--- /dev/null
+++ b/toolkit/components/url-classifier/nsUrlClassifierStreamUpdater.cpp
@@ -0,0 +1,635 @@
+//* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsCRT.h"
+#include "nsIHttpChannel.h"
+#include "nsIObserverService.h"
+#include "nsIStringStream.h"
+#include "nsIUploadChannel.h"
+#include "nsIURI.h"
+#include "nsIUrlClassifierDBService.h"
+#include "nsNetUtil.h"
+#include "nsStreamUtils.h"
+#include "nsStringStream.h"
+#include "nsToolkitCompsCID.h"
+#include "nsUrlClassifierStreamUpdater.h"
+#include "mozilla/BasePrincipal.h"
+#include "mozilla/ErrorNames.h"
+#include "mozilla/Logging.h"
+#include "nsIInterfaceRequestor.h"
+#include "mozilla/LoadContext.h"
+#include "nsContentUtils.h"
+
+static const char* gQuitApplicationMessage = "quit-application";
+
+#undef LOG
+
+// NSPR_LOG_MODULES=UrlClassifierStreamUpdater:5
+static const PRLogModuleInfo *gUrlClassifierStreamUpdaterLog = nullptr;
+#define LOG(args) MOZ_LOG(gUrlClassifierStreamUpdaterLog, mozilla::LogLevel::Debug, args)
+
+// This class does absolutely nothing, except pass requests onto the DBService.
+
+///////////////////////////////////////////////////////////////////////////////
+// nsIUrlClassiferStreamUpdater implementation
+// Handles creating/running the stream listener
+
+nsUrlClassifierStreamUpdater::nsUrlClassifierStreamUpdater()
+  : mIsUpdating(false), mInitialized(false), mDownloadError(false),
+    mBeganStream(false), mChannel(nullptr)
+{
+  if (!gUrlClassifierStreamUpdaterLog)
+    gUrlClassifierStreamUpdaterLog = PR_NewLogModule("UrlClassifierStreamUpdater");
+  LOG(("nsUrlClassifierStreamUpdater init [this=%p]", this));
+}
+
+NS_IMPL_ISUPPORTS(nsUrlClassifierStreamUpdater,
+                  nsIUrlClassifierStreamUpdater,
+                  nsIUrlClassifierUpdateObserver,
+                  nsIRequestObserver,
+                  nsIStreamListener,
+                  nsIObserver,
+                  nsIInterfaceRequestor,
+                  nsITimerCallback)
+
+/**
+ * Clear out the update.
+ */
+void
+nsUrlClassifierStreamUpdater::DownloadDone()
+{
+  LOG(("nsUrlClassifierStreamUpdater::DownloadDone [this=%p]", this));
+  mIsUpdating = false;
+
+  mPendingUpdates.Clear();
+  mDownloadError = false;
+  mSuccessCallback = nullptr;
+  mUpdateErrorCallback = nullptr;
+  mDownloadErrorCallback = nullptr;
+}
+
+///////////////////////////////////////////////////////////////////////////////
+// nsIUrlClassifierStreamUpdater implementation
+
+nsresult
+nsUrlClassifierStreamUpdater::FetchUpdate(nsIURI *aUpdateUrl,
+                                          const nsACString & aRequestBody,
+                                          const nsACString & aStreamTable)
+{
+
+#ifdef DEBUG
+  {
+    nsCString spec;
+    aUpdateUrl->GetSpec(spec);
+    LOG(("Fetching update %s from %s", aRequestBody.Data(), spec.get()));
+  }
+#endif
+
+  nsresult rv;
+  uint32_t loadFlags = nsIChannel::INHIBIT_CACHING |
+                       nsIChannel::LOAD_BYPASS_CACHE;
+  rv = NS_NewChannel(getter_AddRefs(mChannel),
+                     aUpdateUrl,
+                     nsContentUtils::GetSystemPrincipal(),
+                     nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL,
+                     nsIContentPolicy::TYPE_OTHER,
+                     nullptr,  // aLoadGroup
+                     this,     // aInterfaceRequestor
+                     loadFlags);
+
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsILoadInfo> loadInfo = mChannel->GetLoadInfo();
+  loadInfo->SetOriginAttributes(mozilla::OriginAttributes(NECKO_SAFEBROWSING_APP_ID, false));
+
+  mBeganStream = false;
+
+  // If aRequestBody is empty, construct it for the test.
+  if (!aRequestBody.IsEmpty()) {
+    rv = AddRequestBody(aRequestBody);
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
+
+  // Set the appropriate content type for file/data URIs, for unit testing
+  // purposes.
+  // This is only used for testing and should be deleted.
+  bool match;
+  if ((NS_SUCCEEDED(aUpdateUrl->SchemeIs("file", &match)) && match) ||
+      (NS_SUCCEEDED(aUpdateUrl->SchemeIs("data", &match)) && match)) {
+    mChannel->SetContentType(NS_LITERAL_CSTRING("application/vnd.google.safebrowsing-update"));
+  } else {
+    // We assume everything else is an HTTP request.
+
+    // Disable keepalive.
+    nsCOMPtr<nsIHttpChannel> httpChannel = do_QueryInterface(mChannel, &rv);
+    NS_ENSURE_SUCCESS(rv, rv);
+    rv = httpChannel->SetRequestHeader(NS_LITERAL_CSTRING("Connection"), NS_LITERAL_CSTRING("close"), false);
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
+
+  // Create a custom LoadContext for SafeBrowsing, so we can use callbacks on
+  // the channel to query the appId which allows separation of safebrowsing
+  // cookies in a separate jar.
+  nsCOMPtr<nsIInterfaceRequestor> sbContext =
+    new mozilla::LoadContext(NECKO_SAFEBROWSING_APP_ID);
+  rv = mChannel->SetNotificationCallbacks(sbContext);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // Make the request.
+  rv = mChannel->AsyncOpen2(this);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  mStreamTable = aStreamTable;
+
+  return NS_OK;
+}
+
+nsresult
+nsUrlClassifierStreamUpdater::FetchUpdate(const nsACString & aUpdateUrl,
+                                          const nsACString & aRequestBody,
+                                          const nsACString & aStreamTable)
+{
+  LOG(("(pre) Fetching update from %s\n", PromiseFlatCString(aUpdateUrl).get()));
+
+  nsCOMPtr<nsIURI> uri;
+  nsresult rv = NS_NewURI(getter_AddRefs(uri), aUpdateUrl);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsAutoCString urlSpec;
+  uri->GetAsciiSpec(urlSpec);
+
+  LOG(("(post) Fetching update from %s\n", urlSpec.get()));
+
+  return FetchUpdate(uri, aRequestBody, aStreamTable);
+}
+
+NS_IMETHODIMP
+nsUrlClassifierStreamUpdater::DownloadUpdates(
+  const nsACString &aRequestTables,
+  const nsACString &aRequestBody,
+  const nsACString &aUpdateUrl,
+  nsIUrlClassifierCallback *aSuccessCallback,
+  nsIUrlClassifierCallback *aUpdateErrorCallback,
+  nsIUrlClassifierCallback *aDownloadErrorCallback,
+  bool *_retval)
+{
+  NS_ENSURE_ARG(aSuccessCallback);
+  NS_ENSURE_ARG(aUpdateErrorCallback);
+  NS_ENSURE_ARG(aDownloadErrorCallback);
+
+  if (mIsUpdating) {
+    LOG(("Already updating, queueing update %s from %s", aRequestBody.Data(),
+         aUpdateUrl.Data()));
+    *_retval = false;
+    PendingRequest *request = mPendingRequests.AppendElement();
+    request->mTables = aRequestTables;
+    request->mRequest = aRequestBody;
+    request->mUrl = aUpdateUrl;
+    request->mSuccessCallback = aSuccessCallback;
+    request->mUpdateErrorCallback = aUpdateErrorCallback;
+    request->mDownloadErrorCallback = aDownloadErrorCallback;
+    return NS_OK;
+  }
+
+  if (aUpdateUrl.IsEmpty()) {
+    NS_ERROR("updateUrl not set");
+    return NS_ERROR_NOT_INITIALIZED;
+  }
+
+  nsresult rv;
+
+  if (!mInitialized) {
+    // Add an observer for shutdown so we can cancel any pending list
+    // downloads.  quit-application is the same event that the download
+    // manager listens for and uses to cancel pending downloads.
+    nsCOMPtr<nsIObserverService> observerService =
+      mozilla::services::GetObserverService();
+    if (!observerService)
+      return NS_ERROR_FAILURE;
+
+    observerService->AddObserver(this, gQuitApplicationMessage, false);
+
+    mDBService = do_GetService(NS_URLCLASSIFIERDBSERVICE_CONTRACTID, &rv);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    mInitialized = true;
+  }
+
+  rv = mDBService->BeginUpdate(this, aRequestTables);
+  if (rv == NS_ERROR_NOT_AVAILABLE) {
+    LOG(("Service busy, already updating, queuing update %s from %s",
+         aRequestBody.Data(), aUpdateUrl.Data()));
+    *_retval = false;
+    PendingRequest *request = mPendingRequests.AppendElement();
+    request->mTables = aRequestTables;
+    request->mRequest = aRequestBody;
+    request->mUrl = aUpdateUrl;
+    request->mSuccessCallback = aSuccessCallback;
+    request->mUpdateErrorCallback = aUpdateErrorCallback;
+    request->mDownloadErrorCallback = aDownloadErrorCallback;
+    return NS_OK;
+  }
+
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+
+  mSuccessCallback = aSuccessCallback;
+  mUpdateErrorCallback = aUpdateErrorCallback;
+  mDownloadErrorCallback = aDownloadErrorCallback;
+
+  mIsUpdating = true;
+  *_retval = true;
+
+  LOG(("FetchUpdate: %s", aUpdateUrl.Data()));
+  //LOG(("requestBody: %s", aRequestBody.Data()));
+
+  return FetchUpdate(aUpdateUrl, aRequestBody, EmptyCString());
+}
+
+///////////////////////////////////////////////////////////////////////////////
+// nsIUrlClassifierUpdateObserver implementation
+
+NS_IMETHODIMP
+nsUrlClassifierStreamUpdater::UpdateUrlRequested(const nsACString &aUrl,
+                                                 const nsACString &aTable)
+{
+  LOG(("Queuing requested update from %s\n", PromiseFlatCString(aUrl).get()));
+
+  PendingUpdate *update = mPendingUpdates.AppendElement();
+  if (!update)
+    return NS_ERROR_OUT_OF_MEMORY;
+
+  // Allow data: and file: urls for unit testing purposes, otherwise assume http
+  if (StringBeginsWith(aUrl, NS_LITERAL_CSTRING("data:")) ||
+      StringBeginsWith(aUrl, NS_LITERAL_CSTRING("file:"))) {
+    update->mUrl = aUrl;
+  } else {
+    // For unittesting update urls to localhost should use http, not https
+    // (otherwise the connection will fail silently, since there will be no
+    // cert available).
+    if (!StringBeginsWith(aUrl, NS_LITERAL_CSTRING("localhost"))) {
+      update->mUrl = NS_LITERAL_CSTRING("https://") + aUrl;
+    } else {
+      update->mUrl = NS_LITERAL_CSTRING("http://") + aUrl;
+    }
+  }
+  update->mTable = aTable;
+
+  return NS_OK;
+}
+
+nsresult
+nsUrlClassifierStreamUpdater::FetchNext()
+{
+  if (mPendingUpdates.Length() == 0) {
+    return NS_OK;
+  }
+
+  PendingUpdate &update = mPendingUpdates[0];
+  LOG(("Fetching update url: %s\n", update.mUrl.get()));
+  nsresult rv = FetchUpdate(update.mUrl, EmptyCString(),
+                            update.mTable);
+  if (NS_FAILED(rv)) {
+    LOG(("Error fetching update url: %s\n", update.mUrl.get()));
+    // We can commit the urls that we've applied so far.  This is
+    // probably a transient server problem, so trigger backoff.
+    mDownloadErrorCallback->HandleEvent(EmptyCString());
+    mDownloadError = true;
+    mDBService->FinishUpdate();
+    return rv;
+  }
+
+  mPendingUpdates.RemoveElementAt(0);
+
+  return NS_OK;
+}
+
+nsresult
+nsUrlClassifierStreamUpdater::FetchNextRequest()
+{
+  if (mPendingRequests.Length() == 0) {
+    LOG(("No more requests, returning"));
+    return NS_OK;
+  }
+
+  PendingRequest &request = mPendingRequests[0];
+  LOG(("Stream updater: fetching next request: %s, %s",
+       request.mTables.get(), request.mUrl.get()));
+  bool dummy;
+  DownloadUpdates(
+    request.mTables,
+    request.mRequest,
+    request.mUrl,
+    request.mSuccessCallback,
+    request.mUpdateErrorCallback,
+    request.mDownloadErrorCallback,
+    &dummy);
+  request.mSuccessCallback = nullptr;
+  request.mUpdateErrorCallback = nullptr;
+  request.mDownloadErrorCallback = nullptr;
+  mPendingRequests.RemoveElementAt(0);
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsUrlClassifierStreamUpdater::StreamFinished(nsresult status,
+                                             uint32_t requestedDelay)
+{
+  // We are a service and may not be reset with Init between calls, so reset
+  // mBeganStream manually.
+  mBeganStream = false;
+  LOG(("nsUrlClassifierStreamUpdater::StreamFinished [%x, %d]", status, requestedDelay));
+  if (NS_FAILED(status) || mPendingUpdates.Length() == 0) {
+    // We're done.
+    LOG(("nsUrlClassifierStreamUpdater::Done [this=%p]", this));
+    mDBService->FinishUpdate();
+    return NS_OK;
+  }
+
+  // Wait the requested amount of time before starting a new stream.
+  // This appears to be a duplicate timer (see bug 1110891)
+  nsresult rv;
+  mTimer = do_CreateInstance("@mozilla.org/timer;1", &rv);
+  if (NS_SUCCEEDED(rv)) {
+    rv = mTimer->InitWithCallback(this, requestedDelay,
+                                  nsITimer::TYPE_ONE_SHOT);
+  }
+
+  if (NS_FAILED(rv)) {
+    NS_WARNING("Unable to initialize timer, fetching next safebrowsing item immediately");
+    return FetchNext();
+  }
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsUrlClassifierStreamUpdater::UpdateSuccess(uint32_t requestedTimeout)
+{
+  LOG(("nsUrlClassifierStreamUpdater::UpdateSuccess [this=%p]", this));
+  if (mPendingUpdates.Length() != 0) {
+    NS_WARNING("Didn't fetch all safebrowsing update redirects");
+  }
+
+  // DownloadDone() clears mSuccessCallback, so we save it off here.
+  nsCOMPtr<nsIUrlClassifierCallback> successCallback = mDownloadError ? nullptr : mSuccessCallback.get();
+  DownloadDone();
+
+  nsAutoCString strTimeout;
+  strTimeout.AppendInt(requestedTimeout);
+  if (successCallback) {
+    LOG(("nsUrlClassifierStreamUpdater::UpdateSuccess callback [this=%p]",
+         this));
+    successCallback->HandleEvent(strTimeout);
+  } else {
+    LOG(("nsUrlClassifierStreamUpdater::UpdateSuccess skipping callback [this=%p]",
+         this));
+  }
+  // Now fetch the next request
+  LOG(("stream updater: calling into fetch next request"));
+  FetchNextRequest();
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsUrlClassifierStreamUpdater::UpdateError(nsresult result)
+{
+  LOG(("nsUrlClassifierStreamUpdater::UpdateError [this=%p]", this));
+
+  // DownloadDone() clears mUpdateErrorCallback, so we save it off here.
+  nsCOMPtr<nsIUrlClassifierCallback> errorCallback = mDownloadError ? nullptr : mUpdateErrorCallback.get();
+
+  DownloadDone();
+
+  nsAutoCString strResult;
+  strResult.AppendInt(static_cast<uint32_t>(result));
+  if (errorCallback) {
+    errorCallback->HandleEvent(strResult);
+  }
+
+  return NS_OK;
+}
+
+nsresult
+nsUrlClassifierStreamUpdater::AddRequestBody(const nsACString &aRequestBody)
+{
+  nsresult rv;
+  nsCOMPtr<nsIStringInputStream> strStream =
+    do_CreateInstance(NS_STRINGINPUTSTREAM_CONTRACTID, &rv);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = strStream->SetData(aRequestBody.BeginReading(),
+                          aRequestBody.Length());
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIUploadChannel> uploadChannel = do_QueryInterface(mChannel, &rv);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = uploadChannel->SetUploadStream(strStream,
+                                      NS_LITERAL_CSTRING("text/plain"),
+                                      -1);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIHttpChannel> httpChannel = do_QueryInterface(mChannel, &rv);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = httpChannel->SetRequestMethod(NS_LITERAL_CSTRING("POST"));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return NS_OK;
+}
+
+
+///////////////////////////////////////////////////////////////////////////////
+// nsIStreamListenerObserver implementation
+
+NS_IMETHODIMP
+nsUrlClassifierStreamUpdater::OnStartRequest(nsIRequest *request,
+                                             nsISupports* context)
+{
+  nsresult rv;
+  bool downloadError = false;
+  nsAutoCString strStatus;
+  nsresult status = NS_OK;
+
+  // Only update if we got http success header
+  nsCOMPtr<nsIHttpChannel> httpChannel = do_QueryInterface(request);
+  if (httpChannel) {
+    rv = httpChannel->GetStatus(&status);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    if (MOZ_LOG_TEST(gUrlClassifierStreamUpdaterLog, mozilla::LogLevel::Debug)) {
+      nsAutoCString errorName, spec;
+      mozilla::GetErrorName(status, errorName);
+      nsCOMPtr<nsIURI> uri;
+      rv = httpChannel->GetURI(getter_AddRefs(uri));
+      if (NS_SUCCEEDED(rv) && uri) {
+        uri->GetAsciiSpec(spec);
+      }
+      LOG(("nsUrlClassifierStreamUpdater::OnStartRequest "
+           "(status=%s, uri=%s, this=%p)", errorName.get(),
+           spec.get(), this));
+    }
+
+    if (NS_FAILED(status)) {
+      // Assume we're overloading the server and trigger backoff.
+      downloadError = true;
+    } else {
+      bool succeeded = false;
+      rv = httpChannel->GetRequestSucceeded(&succeeded);
+      NS_ENSURE_SUCCESS(rv, rv);
+
+      uint32_t requestStatus;
+      rv = httpChannel->GetResponseStatus(&requestStatus);
+      NS_ENSURE_SUCCESS(rv, rv);
+      LOG(("nsUrlClassifierStreamUpdater::OnStartRequest %s (%d)", succeeded ?
+           "succeeded" : "failed", requestStatus));
+      if (!succeeded) {
+        // 404 or other error, pass error status back
+        strStatus.AppendInt(requestStatus);
+        downloadError = true;
+      }
+    }
+  }
+
+  if (downloadError) {
+    LOG(("nsUrlClassifierStreamUpdater::Download error [this=%p]", this));
+
+    // It's possible for mDownloadErrorCallback to be null on shutdown.
+    if (mDownloadErrorCallback) {
+      mDownloadErrorCallback->HandleEvent(strStatus);
+    }
+
+    mDownloadError = true;
+    status = NS_ERROR_ABORT;
+  } else if (NS_SUCCEEDED(status)) {
+    MOZ_ASSERT(mDownloadErrorCallback);
+    mBeganStream = true;
+    LOG(("nsUrlClassifierStreamUpdater::Beginning stream [this=%p]", this));
+    rv = mDBService->BeginStream(mStreamTable);
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
+
+  mStreamTable.Truncate();
+
+  return status;
+}
+
+NS_IMETHODIMP
+nsUrlClassifierStreamUpdater::OnDataAvailable(nsIRequest *request,
+                                              nsISupports* context,
+                                              nsIInputStream *aIStream,
+                                              uint64_t aSourceOffset,
+                                              uint32_t aLength)
+{
+  if (!mDBService)
+    return NS_ERROR_NOT_INITIALIZED;
+
+  LOG(("OnDataAvailable (%d bytes)", aLength));
+
+  nsresult rv;
+
+  // Copy the data into a nsCString
+  nsCString chunk;
+  rv = NS_ConsumeStream(aIStream, aLength, chunk);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  //LOG(("Chunk (%d): %s\n\n", chunk.Length(), chunk.get()));
+  rv = mDBService->UpdateStream(chunk);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsUrlClassifierStreamUpdater::OnStopRequest(nsIRequest *request, nsISupports* context,
+                                            nsresult aStatus)
+{
+  if (!mDBService)
+    return NS_ERROR_NOT_INITIALIZED;
+
+  LOG(("OnStopRequest (status %x, beganStream %s, this=%p)", aStatus,
+       mBeganStream ? "true" : "false", this));
+
+  nsresult rv;
+
+  if (NS_SUCCEEDED(aStatus)) {
+    // Success, finish this stream and move on to the next.
+    rv = mDBService->FinishStream();
+  } else if (mBeganStream) {
+    LOG(("OnStopRequest::Canceling update [this=%p]", this));
+    // We began this stream and couldn't finish it.  We have to cancel the
+    // update, it's not in a consistent state.
+    rv = mDBService->CancelUpdate();
+  } else {
+    LOG(("OnStopRequest::Finishing update [this=%p]", this));
+    // The fetch failed, but we didn't start the stream (probably a
+    // server or connection error).  We can commit what we've applied
+    // so far, and request again later.
+    rv = mDBService->FinishUpdate();
+  }
+
+  mChannel = nullptr;
+
+  // If the fetch failed, return the network status rather than NS_OK, the
+  // result of finishing a possibly-empty update
+  if (NS_SUCCEEDED(aStatus)) {
+    return rv;
+  }
+  return aStatus;
+}
+
+///////////////////////////////////////////////////////////////////////////////
+// nsIObserver implementation
+
+NS_IMETHODIMP
+nsUrlClassifierStreamUpdater::Observe(nsISupports *aSubject, const char *aTopic,
+                                      const char16_t *aData)
+{
+  if (nsCRT::strcmp(aTopic, gQuitApplicationMessage) == 0) {
+    if (mIsUpdating && mChannel) {
+      LOG(("Cancel download"));
+      nsresult rv;
+      rv = mChannel->Cancel(NS_ERROR_ABORT);
+      NS_ENSURE_SUCCESS(rv, rv);
+      mIsUpdating = false;
+      mChannel = nullptr;
+    }
+    if (mTimer) {
+      mTimer->Cancel();
+      mTimer = nullptr;
+    }
+  }
+  return NS_OK;
+}
+
+///////////////////////////////////////////////////////////////////////////////
+// nsIInterfaceRequestor implementation
+
+NS_IMETHODIMP
+nsUrlClassifierStreamUpdater::GetInterface(const nsIID & eventSinkIID, void* *_retval)
+{
+  return QueryInterface(eventSinkIID, _retval);
+}
+
+
+///////////////////////////////////////////////////////////////////////////////
+// nsITimerCallback implementation
+NS_IMETHODIMP
+nsUrlClassifierStreamUpdater::Notify(nsITimer *timer)
+{
+  LOG(("nsUrlClassifierStreamUpdater::Notify [%p]", this));
+
+  mTimer = nullptr;
+
+  // Start the update process up again.
+  FetchNext();
+
+  return NS_OK;
+}
+
diff --git a/toolkit/components/url-classifier/nsUrlClassifierStreamUpdater.h b/toolkit/components/url-classifier/nsUrlClassifierStreamUpdater.h
new file mode 100644
index 0000000000..75c3962db5
--- /dev/null
+++ b/toolkit/components/url-classifier/nsUrlClassifierStreamUpdater.h
@@ -0,0 +1,100 @@
+//* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-/
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef nsUrlClassifierStreamUpdater_h_
+#define nsUrlClassifierStreamUpdater_h_
+
+#include <nsISupportsUtils.h>
+
+#include "nsCOMPtr.h"
+#include "nsIObserver.h"
+#include "nsIUrlClassifierStreamUpdater.h"
+#include "nsIStreamListener.h"
+#include "nsIChannel.h"
+#include "nsTArray.h"
+#include "nsITimer.h"
+#include "mozilla/Attributes.h"
+
+// Forward declare pointers
+class nsIURI;
+
+class nsUrlClassifierStreamUpdater final : public nsIUrlClassifierStreamUpdater,
+                                           public nsIUrlClassifierUpdateObserver,
+                                           public nsIStreamListener,
+                                           public nsIObserver,
+                                           public nsIInterfaceRequestor,
+                                           public nsITimerCallback
+{
+public:
+  nsUrlClassifierStreamUpdater();
+
+  NS_DECL_THREADSAFE_ISUPPORTS
+  NS_DECL_NSIURLCLASSIFIERSTREAMUPDATER
+  NS_DECL_NSIURLCLASSIFIERUPDATEOBSERVER
+  NS_DECL_NSIINTERFACEREQUESTOR
+  NS_DECL_NSIREQUESTOBSERVER
+  NS_DECL_NSISTREAMLISTENER
+  NS_DECL_NSIOBSERVER
+  NS_DECL_NSITIMERCALLBACK
+
+private:
+  // No subclassing
+  ~nsUrlClassifierStreamUpdater() {}
+
+  // When the dbservice sends an UpdateComplete or UpdateFailure, we call this
+  // to reset the stream updater.
+  void DownloadDone();
+
+  // Disallow copy constructor
+  nsUrlClassifierStreamUpdater(nsUrlClassifierStreamUpdater&);
+
+  nsresult AddRequestBody(const nsACString &aRequestBody);
+
+  // Fetches an update for a single table.
+  nsresult FetchUpdate(nsIURI *aURI,
+                       const nsACString &aRequestBody,
+                       const nsACString &aTable);
+  // Dumb wrapper so we don't have to create URIs.
+  nsresult FetchUpdate(const nsACString &aURI,
+                       const nsACString &aRequestBody,
+                       const nsACString &aTable);
+
+  // Fetches the next table, from mPendingUpdates.
+  nsresult FetchNext();
+  // Fetches the next request, from mPendingRequests
+  nsresult FetchNextRequest();
+
+
+  bool mIsUpdating;
+  bool mInitialized;
+  bool mDownloadError;
+  bool mBeganStream;
+  nsCString mStreamTable;
+  nsCOMPtr<nsIChannel> mChannel;
+  nsCOMPtr<nsIUrlClassifierDBService> mDBService;
+  nsCOMPtr<nsITimer> mTimer;
+
+  struct PendingRequest {
+    nsCString mTables;
+    nsCString mRequest;
+    nsCString mUrl;
+    nsCOMPtr<nsIUrlClassifierCallback> mSuccessCallback;
+    nsCOMPtr<nsIUrlClassifierCallback> mUpdateErrorCallback;
+    nsCOMPtr<nsIUrlClassifierCallback> mDownloadErrorCallback;
+  };
+  nsTArray<PendingRequest> mPendingRequests;
+
+  struct PendingUpdate {
+    nsCString mUrl;
+    nsCString mTable;
+  };
+  nsTArray<PendingUpdate> mPendingUpdates;
+
+  nsCOMPtr<nsIUrlClassifierCallback> mSuccessCallback;
+  nsCOMPtr<nsIUrlClassifierCallback> mUpdateErrorCallback;
+  nsCOMPtr<nsIUrlClassifierCallback> mDownloadErrorCallback;
+};
+
+#endif // nsUrlClassifierStreamUpdater_h_
diff --git a/toolkit/components/url-classifier/nsUrlClassifierUtils.cpp b/toolkit/components/url-classifier/nsUrlClassifierUtils.cpp
new file mode 100644
index 0000000000..5b7fb276d7
--- /dev/null
+++ b/toolkit/components/url-classifier/nsUrlClassifierUtils.cpp
@@ -0,0 +1,363 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsEscape.h"
+#include "nsString.h"
+#include "nsIURI.h"
+#include "nsUrlClassifierUtils.h"
+#include "nsTArray.h"
+#include "nsReadableUtils.h"
+#include "plbase64.h"
+#include "prprf.h"
+
+static char int_to_hex_digit(int32_t i)
+{
+  NS_ASSERTION((i >= 0) && (i <= 15), "int too big in int_to_hex_digit");
+  return static_cast<char>(((i < 10) ? (i + '0') : ((i - 10) + 'A')));
+}
+
+static bool
+IsDecimal(const nsACString & num)
+{
+  for (uint32_t i = 0; i < num.Length(); i++) {
+    if (!isdigit(num[i])) {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+static bool
+IsHex(const nsACString & num)
+{
+  if (num.Length() < 3) {
+    return false;
+  }
+
+  if (num[0] != '0' || !(num[1] == 'x' || num[1] == 'X')) {
+    return false;
+  }
+
+  for (uint32_t i = 2; i < num.Length(); i++) {
+    if (!isxdigit(num[i])) {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+static bool
+IsOctal(const nsACString & num)
+{
+  if (num.Length() < 2) {
+    return false;
+  }
+
+  if (num[0] != '0') {
+    return false;
+  }
+
+  for (uint32_t i = 1; i < num.Length(); i++) {
+    if (!isdigit(num[i]) || num[i] == '8' || num[i] == '9') {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+nsUrlClassifierUtils::nsUrlClassifierUtils() : mEscapeCharmap(nullptr)
+{
+}
+
+nsresult
+nsUrlClassifierUtils::Init()
+{
+  // Everything but alpha numerics, - and .
+  mEscapeCharmap = new Charmap(0xffffffff, 0xfc009fff, 0xf8000001, 0xf8000001,
+                               0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff);
+  if (!mEscapeCharmap)
+    return NS_ERROR_OUT_OF_MEMORY;
+  return NS_OK;
+}
+
+NS_IMPL_ISUPPORTS(nsUrlClassifierUtils, nsIUrlClassifierUtils)
+
+/////////////////////////////////////////////////////////////////////////////
+// nsIUrlClassifierUtils
+
+NS_IMETHODIMP
+nsUrlClassifierUtils::GetKeyForURI(nsIURI * uri, nsACString & _retval)
+{
+  nsCOMPtr<nsIURI> innerURI = NS_GetInnermostURI(uri);
+  if (!innerURI)
+    innerURI = uri;
+
+  nsAutoCString host;
+  innerURI->GetAsciiHost(host);
+
+  if (host.IsEmpty()) {
+    return NS_ERROR_MALFORMED_URI;
+  }
+
+  nsresult rv = CanonicalizeHostname(host, _retval);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsAutoCString path;
+  rv = innerURI->GetPath(path);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // strip out anchors
+  int32_t ref = path.FindChar('#');
+  if (ref != kNotFound)
+    path.SetLength(ref);
+
+  nsAutoCString temp;
+  rv = CanonicalizePath(path, temp);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  _retval.Append(temp);
+
+  return NS_OK;
+}
+
+/////////////////////////////////////////////////////////////////////////////
+// non-interface methods
+
+nsresult
+nsUrlClassifierUtils::CanonicalizeHostname(const nsACString & hostname,
+                                           nsACString & _retval)
+{
+  nsAutoCString unescaped;
+  if (!NS_UnescapeURL(PromiseFlatCString(hostname).get(),
+                      PromiseFlatCString(hostname).Length(),
+                      0, unescaped)) {
+    unescaped.Assign(hostname);
+  }
+
+  nsAutoCString cleaned;
+  CleanupHostname(unescaped, cleaned);
+
+  nsAutoCString temp;
+  ParseIPAddress(cleaned, temp);
+  if (!temp.IsEmpty()) {
+    cleaned.Assign(temp);
+  }
+
+  ToLowerCase(cleaned);
+  SpecialEncode(cleaned, false, _retval);
+
+  return NS_OK;
+}
+
+
+nsresult
+nsUrlClassifierUtils::CanonicalizePath(const nsACString & path,
+                                       nsACString & _retval)
+{
+  _retval.Truncate();
+
+  nsAutoCString decodedPath(path);
+  nsAutoCString temp;
+  while (NS_UnescapeURL(decodedPath.get(), decodedPath.Length(), 0, temp)) {
+    decodedPath.Assign(temp);
+    temp.Truncate();
+  }
+
+  SpecialEncode(decodedPath, true, _retval);
+  // XXX: lowercase the path?
+
+  return NS_OK;
+}
+
+void
+nsUrlClassifierUtils::CleanupHostname(const nsACString & hostname,
+                                      nsACString & _retval)
+{
+  _retval.Truncate();
+
+  const char* curChar = hostname.BeginReading();
+  const char* end = hostname.EndReading();
+  char lastChar = '\0';
+  while (curChar != end) {
+    unsigned char c = static_cast<unsigned char>(*curChar);
+    if (c == '.' && (lastChar == '\0' || lastChar == '.')) {
+      // skip
+    } else {
+      _retval.Append(*curChar);
+    }
+    lastChar = c;
+    ++curChar;
+  }
+
+  // cut off trailing dots
+  while (_retval.Length() > 0 && _retval[_retval.Length() - 1] == '.') {
+    _retval.SetLength(_retval.Length() - 1);
+  }
+}
+
+void
+nsUrlClassifierUtils::ParseIPAddress(const nsACString & host,
+                                     nsACString & _retval)
+{
+  _retval.Truncate();
+  nsACString::const_iterator iter, end;
+  host.BeginReading(iter);
+  host.EndReading(end);
+
+  if (host.Length() <= 15) {
+    // The Windows resolver allows a 4-part dotted decimal IP address to
+    // have a space followed by any old rubbish, so long as the total length
+    // of the string doesn't get above 15 characters. So, "10.192.95.89 xy"
+    // is resolved to 10.192.95.89.
+    // If the string length is greater than 15 characters, e.g.
+    // "10.192.95.89 xy.wildcard.example.com", it will be resolved through
+    // DNS.
+
+    if (FindCharInReadable(' ', iter, end)) {
+      end = iter;
+    }
+  }
+
+  for (host.BeginReading(iter); iter != end; iter++) {
+    if (!(isxdigit(*iter) || *iter == 'x' || *iter == 'X' || *iter == '.')) {
+      // not an IP
+      return;
+    }
+  }
+
+  host.BeginReading(iter);
+  nsTArray<nsCString> parts;
+  ParseString(PromiseFlatCString(Substring(iter, end)), '.', parts);
+  if (parts.Length() > 4) {
+    return;
+  }
+
+  // If any potentially-octal numbers (start with 0 but not hex) have
+  // non-octal digits, no part of the ip can be in octal
+  // XXX: this came from the old javascript implementation, is it really
+  // supposed to be like this?
+  bool allowOctal = true;
+  uint32_t i;
+
+  for (i = 0; i < parts.Length(); i++) {
+    const nsCString& part = parts[i];
+    if (part[0] == '0') {
+      for (uint32_t j = 1; j < part.Length(); j++) {
+        if (part[j] == 'x') {
+          break;
+        }
+        if (part[j] == '8' || part[j] == '9') {
+          allowOctal = false;
+          break;
+        }
+      }
+    }
+  }
+
+  for (i = 0; i < parts.Length(); i++) {
+    nsAutoCString canonical;
+
+    if (i == parts.Length() - 1) {
+      CanonicalNum(parts[i], 5 - parts.Length(), allowOctal, canonical);
+    } else {
+      CanonicalNum(parts[i], 1, allowOctal, canonical);
+    }
+
+    if (canonical.IsEmpty()) {
+      _retval.Truncate();
+      return;
+    }
+
+    if (_retval.IsEmpty()) {
+      _retval.Assign(canonical);
+    } else {
+      _retval.Append('.');
+      _retval.Append(canonical);
+    }
+  }
+  return;
+}
+
+void
+nsUrlClassifierUtils::CanonicalNum(const nsACString& num,
+                                   uint32_t bytes,
+                                   bool allowOctal,
+                                   nsACString& _retval)
+{
+  _retval.Truncate();
+
+  if (num.Length() < 1) {
+    return;
+  }
+
+  uint32_t val;
+  if (allowOctal && IsOctal(num)) {
+    if (PR_sscanf(PromiseFlatCString(num).get(), "%o", &val) != 1) {
+      return;
+    }
+  } else if (IsDecimal(num)) {
+    if (PR_sscanf(PromiseFlatCString(num).get(), "%u", &val) != 1) {
+      return;
+    }
+  } else if (IsHex(num)) {
+  if (PR_sscanf(PromiseFlatCString(num).get(), num[1] == 'X' ? "0X%x" : "0x%x",
+                &val) != 1) {
+      return;
+    }
+  } else {
+    return;
+  }
+
+  while (bytes--) {
+    char buf[20];
+    PR_snprintf(buf, sizeof(buf), "%u", val & 0xff);
+    if (_retval.IsEmpty()) {
+      _retval.Assign(buf);
+    } else {
+      _retval = nsDependentCString(buf) + NS_LITERAL_CSTRING(".") + _retval;
+    }
+    val >>= 8;
+  }
+}
+
+// This function will encode all "special" characters in typical url
+// encoding, that is %hh where h is a valid hex digit.  It will also fold
+// any duplicated slashes.
+bool
+nsUrlClassifierUtils::SpecialEncode(const nsACString & url,
+                                    bool foldSlashes,
+                                    nsACString & _retval)
+{
+  bool changed = false;
+  const char* curChar = url.BeginReading();
+  const char* end = url.EndReading();
+
+  unsigned char lastChar = '\0';
+  while (curChar != end) {
+    unsigned char c = static_cast<unsigned char>(*curChar);
+    if (ShouldURLEscape(c)) {
+      _retval.Append('%');
+      _retval.Append(int_to_hex_digit(c / 16));
+      _retval.Append(int_to_hex_digit(c % 16));
+
+      changed = true;
+    } else if (foldSlashes && (c == '/' && lastChar == '/')) {
+      // skip
+    } else {
+      _retval.Append(*curChar);
+    }
+    lastChar = c;
+    curChar++;
+  }
+  return changed;
+}
+
+bool
+nsUrlClassifierUtils::ShouldURLEscape(const unsigned char c) const
+{
+  return c <= 32 || c == '%' || c >=127;
+}
diff --git a/toolkit/components/url-classifier/nsUrlClassifierUtils.h b/toolkit/components/url-classifier/nsUrlClassifierUtils.h
new file mode 100644
index 0000000000..3a689b9e7a
--- /dev/null
+++ b/toolkit/components/url-classifier/nsUrlClassifierUtils.h
@@ -0,0 +1,89 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef nsUrlClassifierUtils_h_
+#define nsUrlClassifierUtils_h_
+
+#include "nsAutoPtr.h"
+#include "nsIUrlClassifierUtils.h"
+#include "nsTArray.h"
+#include "nsDataHashtable.h"
+#include "mozilla/Attributes.h"
+
+class nsUrlClassifierUtils final : public nsIUrlClassifierUtils
+{
+private:
+  /**
+   * A fast, bit-vector map for ascii characters.
+   *
+   * Internally stores 256 bits in an array of 8 ints.
+   * Does quick bit-flicking to lookup needed characters.
+   */
+  class Charmap
+  {
+  public:
+    Charmap(uint32_t b0, uint32_t b1, uint32_t b2, uint32_t b3,
+            uint32_t b4, uint32_t b5, uint32_t b6, uint32_t b7)
+    {
+      mMap[0] = b0; mMap[1] = b1; mMap[2] = b2; mMap[3] = b3;
+      mMap[4] = b4; mMap[5] = b5; mMap[6] = b6; mMap[7] = b7;
+    }
+
+    /**
+     * Do a quick lookup to see if the letter is in the map.
+     */
+    bool Contains(unsigned char c) const
+    {
+      return mMap[c >> 5] & (1 << (c & 31));
+    }
+
+  private:
+    // Store the 256 bits in an 8 byte array.
+    uint32_t mMap[8];
+  };
+
+
+public:
+  nsUrlClassifierUtils();
+
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIURLCLASSIFIERUTILS
+
+  nsresult Init();
+
+  nsresult CanonicalizeHostname(const nsACString & hostname,
+                                nsACString & _retval);
+  nsresult CanonicalizePath(const nsACString & url, nsACString & _retval);
+
+  // This function will encode all "special" characters in typical url encoding,
+  // that is %hh where h is a valid hex digit.  The characters which are encoded
+  // by this function are any ascii characters under 32(control characters and
+  // space), 37(%), and anything 127 or above (special characters).  Url is the
+  // string to encode, ret is the encoded string.  Function returns true if
+  // ret != url.
+  bool SpecialEncode(const nsACString & url,
+                       bool foldSlashes,
+                       nsACString & _retval);
+
+  void ParseIPAddress(const nsACString & host, nsACString & _retval);
+  void CanonicalNum(const nsACString & num,
+                    uint32_t bytes,
+                    bool allowOctal,
+                    nsACString & _retval);
+
+private:
+  ~nsUrlClassifierUtils() {}
+
+  // Disallow copy constructor
+  nsUrlClassifierUtils(const nsUrlClassifierUtils&);
+
+  // Function to tell if we should encode a character.
+  bool ShouldURLEscape(const unsigned char c) const;
+
+  void CleanupHostname(const nsACString & host, nsACString & _retval);
+
+  nsAutoPtr<Charmap> mEscapeCharmap;
+};
+
+#endif // nsUrlClassifierUtils_h_
diff --git a/toolkit/components/url-classifier/tests/mochitest/classifiedAnnotatedPBFrame.html b/toolkit/components/url-classifier/tests/mochitest/classifiedAnnotatedPBFrame.html
new file mode 100644
index 0000000000..f11ec1de3e
--- /dev/null
+++ b/toolkit/components/url-classifier/tests/mochitest/classifiedAnnotatedPBFrame.html
@@ -0,0 +1,24 @@
+<!DOCTYPE HTML>
+<!-- Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/ -->
+<html>
+<head>
+<title></title>
+
+<link id="badcss" rel="stylesheet" type="text/css" href="http://tracking.example.com/tests/toolkit/components/url-classifier/tests/mochitest/evil.css"></link>
+
+</head>
+<body>
+
+<script id="badscript" data-touched="not sure" src="http://tracking.example.com/tests/toolkit/components/url-classifier/tests/mochitest/evil.js" onload="this.dataset.touched = 'yes';" onerror="this.dataset.touched = 'no';"></script>
+
+<script id="goodscript" data-touched="not sure" src="http://itisatracker.org/tests/toolkit/components/url-classifier/tests/mochitest/good.js" onload="this.dataset.touched = 'yes';" onerror="this.dataset.touched = 'no';"></script>
+
+<!-- The image cache can cache JS handlers, so make sure we use a different URL for raptor.jpg each time -->
+<img id="badimage" data-touched="not sure" src="http://tracking.example.com/tests/toolkit/components/url-classifier/tests/mochitest/raptor.jpg?pbmode=test" onload="this.dataset.touched = 'yes';" onerror="this.dataset.touched = 'no';"/>
+
+The following should not be hidden:
+<div id="styleCheck">STYLE TEST</div>
+
+</body>
+</html>
diff --git a/toolkit/components/url-classifier/tests/mochitest/test_privatebrowsing_trackingprotection.html b/toolkit/components/url-classifier/tests/mochitest/test_privatebrowsing_trackingprotection.html
new file mode 100644
index 0000000000..02ef57b467
--- /dev/null
+++ b/toolkit/components/url-classifier/tests/mochitest/test_privatebrowsing_trackingprotection.html
@@ -0,0 +1,154 @@
+<!DOCTYPE HTML>
+<!-- Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/ -->
+<html>
+<head>
+  <title>Test Tracking Protection in Private Browsing mode</title>
+  <script type="text/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css">
+</head>
+
+<body>
+<p id="display"></p>
+<div id="content" style="display: none">
+</div>
+<pre id="test">
+
+<script class="testbody" type="text/javascript">
+
+var Cc = SpecialPowers.Cc;
+var Ci = SpecialPowers.Ci;
+
+var mainWindow = window.QueryInterface(Ci.nsIInterfaceRequestor)
+                    .getInterface(Ci.nsIWebNavigation)
+                    .QueryInterface(Ci.nsIDocShellTreeItem)
+                    .rootTreeItem
+                    .QueryInterface(Ci.nsIInterfaceRequestor)
+                    .getInterface(Ci.nsIDOMWindow);
+var contentPage = "http://www.itisatrap.org/tests/toolkit/components/url-classifier/tests/mochitest/classifiedAnnotatedPBFrame.html";
+
+Components.utils.import("resource://gre/modules/Services.jsm");
+Components.utils.import("resource://testing-common/UrlClassifierTestUtils.jsm");
+
+function whenDelayedStartupFinished(aWindow, aCallback) {
+  Services.obs.addObserver(function observer(aSubject, aTopic) {
+    if (aWindow == aSubject) {
+      Services.obs.removeObserver(observer, aTopic);
+      setTimeout(aCallback, 0);
+    }
+  }, "browser-delayed-startup-finished", false);
+}
+
+function testOnWindow(aPrivate, aCallback) {
+  var win = mainWindow.OpenBrowserWindow({private: aPrivate});
+  win.addEventListener("load", function onLoad() {
+    win.removeEventListener("load", onLoad, false);
+    whenDelayedStartupFinished(win, function() {
+      win.addEventListener("DOMContentLoaded", function onInnerLoad() {
+        if (win.content.location.href != contentPage) {
+          win.gBrowser.loadURI(contentPage);
+          return;
+        }
+        win.removeEventListener("DOMContentLoaded", onInnerLoad, true);
+
+        win.content.addEventListener('load', function innerLoad2() {
+          win.content.removeEventListener('load', innerLoad2, false);
+          SimpleTest.executeSoon(function() { aCallback(win); });
+        }, false, true);
+      }, true);
+      SimpleTest.executeSoon(function() { win.gBrowser.loadURI(contentPage); });
+    });
+  }, true);
+}
+
+var badids = [
+  "badscript",
+  "badimage",
+  "badcss"
+];
+
+function checkLoads(aWindow, aBlocked) {
+  var win = aWindow.content;
+  is(win.document.getElementById("badscript").dataset.touched, aBlocked ? "no" : "yes", "Should not load tracking javascript");
+  is(win.document.getElementById("badimage").dataset.touched, aBlocked ? "no" : "yes", "Should not load tracking images");
+  is(win.document.getElementById("goodscript").dataset.touched, "yes", "Should load whitelisted tracking javascript");
+
+  var elt = win.document.getElementById("styleCheck");
+  var style = win.document.defaultView.getComputedStyle(elt, "");
+  isnot(style.visibility, aBlocked ? "hidden" : "", "Should not load tracking css");
+
+  is(win.document.blockedTrackingNodeCount, aBlocked ? badids.length : 0, "Should identify all tracking elements");
+
+  var blockedTrackingNodes = win.document.blockedTrackingNodes;
+
+  // Make sure that every node in blockedTrackingNodes exists in the tree
+  // (that may not always be the case but do not expect any nodes to disappear
+  // from the tree here)
+  var allNodeMatch = true;
+  for (var i = 0; i < blockedTrackingNodes.length; i++) {
+    var nodeMatch = false;
+    for (var j = 0; j < badids.length && !nodeMatch; j++) {
+      nodeMatch = nodeMatch ||
+        (blockedTrackingNodes[i] == win.document.getElementById(badids[j]));
+    }
+
+    allNodeMatch = allNodeMatch && nodeMatch;
+  }
+  is(allNodeMatch, true, "All annotated nodes are expected in the tree");
+
+  // Make sure that every node with a badid (see badids) is found in the
+  // blockedTrackingNodes. This tells us if we are neglecting to annotate
+  // some nodes
+  allNodeMatch = true;
+  for (var j = 0; j < badids.length; j++) {
+    var nodeMatch = false;
+    for (var i = 0; i < blockedTrackingNodes.length && !nodeMatch; i++) {
+      nodeMatch = nodeMatch ||
+        (blockedTrackingNodes[i] == win.document.getElementById(badids[j]));
+    }
+
+    allNodeMatch = allNodeMatch && nodeMatch;
+  }
+  is(allNodeMatch, aBlocked, "All tracking nodes are expected to be annotated as such");
+}
+
+SpecialPowers.pushPrefEnv(
+  {"set" : [["urlclassifier.trackingTable", "test-track-simple"],
+            ["privacy.trackingprotection.enabled", false],
+            ["privacy.trackingprotection.pbmode.enabled", true],
+            ["channelclassifier.allowlist_example", true]]},
+  test);
+
+function test() {
+  SimpleTest.registerCleanupFunction(UrlClassifierTestUtils.cleanupTestTrackers);
+  UrlClassifierTestUtils.addTestTrackers().then(() => {
+    // Normal mode, with the pref (trackers should be loaded)
+    testOnWindow(false, function(aWindow) {
+      checkLoads(aWindow, false);
+      aWindow.close();
+
+      // Private Browsing, with the pref (trackers should be blocked)
+      testOnWindow(true, function(aWindow) {
+        checkLoads(aWindow, true);
+        aWindow.close();
+
+        // Private Browsing, without the pref (trackers should be loaded)
+        SpecialPowers.setBoolPref("privacy.trackingprotection.pbmode.enabled", false);
+        testOnWindow(true, function(aWindow) {
+          checkLoads(aWindow, false);
+          aWindow.close();
+          SimpleTest.finish();
+        });
+      });
+    });
+  });
+}
+
+SimpleTest.waitForExplicitFinish();
+
+</script>
+
+</pre>
+<iframe id="testFrame" width="100%" height="100%" onload=""></iframe>
+</body>
+</html>
diff --git a/toolkit/devtools/server/DominatorTree.h b/toolkit/devtools/server/DominatorTree.h
index dc7d988997..0a785dca53 100644
--- a/toolkit/devtools/server/DominatorTree.h
+++ b/toolkit/devtools/server/DominatorTree.h
@@ -42,6 +42,7 @@ public:
   virtual JSObject* WrapObject(JSContext* aCx,
                                JS::Handle<JSObject*> aGivenProto) override;
 
+  uint64_t Root() const { return mDominatorTree.root().identifier(); }
 };
 
 } // namespace devtools
diff --git a/toolkit/devtools/server/actors/object.js b/toolkit/devtools/server/actors/object.js
index 32eb81dcb5..a5fcbae50b 100644
--- a/toolkit/devtools/server/actors/object.js
+++ b/toolkit/devtools/server/actors/object.js
@@ -13,6 +13,8 @@ const DevToolsUtils = require("devtools/toolkit/DevToolsUtils");
 const { dbg_assert } = DevToolsUtils;
 const PromiseDebugging = require("PromiseDebugging");
 
+loader.lazyRequireGetter(this, "ThreadSafeChromeUtils");
+
 const TYPED_ARRAY_CLASSES = ["Uint8Array", "Uint8ClampedArray", "Uint16Array",
       "Uint32Array", "Int8Array", "Int16Array", "Int32Array", "Float32Array",
       "Float64Array"];
@@ -990,6 +992,43 @@ DebuggerServer.ObjectActorPreviewers = {
     return true;
   }],
 
+  WeakSet: [function({obj, hooks}, grip) {
+    let raw = obj.unsafeDereference();
+
+    // We currently lack XrayWrappers for WeakSet, so when we iterate over
+    // the values, the temporary iterator objects get created in the target
+    // compartment. However, we _do_ have Xrays to Object now, so we end up
+    // Xraying those temporary objects, and filtering access to |it.value|
+    // based on whether or not it's Xrayable and/or callable, which breaks
+    // the for/of iteration.
+    //
+    // This code is designed to handle untrusted objects, so we can safely
+    // waive Xrays on the iterable, and relying on the Debugger machinery to
+    // make sure we handle the resulting objects carefully.
+    let keys = Cu.waiveXrays(ThreadSafeChromeUtils.nondeterministicGetWeakSetKeys(raw));
+    grip.preview = {
+      kind: "ArrayLike",
+      length: keys.length,
+    };
+
+    // Avoid recursive object grips.
+    if (hooks.getGripDepth() > 1) {
+      return true;
+    }
+
+    let items = grip.preview.items = [];
+    for (let item of keys) {
+      item = Cu.unwaiveXrays(item);
+      item = makeDebuggeeValueIfNeeded(obj, item);
+      items.push(hooks.createValueGrip(item));
+      if (items.length == OBJECT_PREVIEW_MAX_ITEMS) {
+        break;
+      }
+    }
+
+    return true;
+  }],
+
   Map: [function({obj, hooks}, grip) {
     let size = DevToolsUtils.getProperty(obj, "size");
     if (typeof size != "number") {
@@ -1034,6 +1073,45 @@ DebuggerServer.ObjectActorPreviewers = {
     return true;
   }],
 
+  WeakMap: [function({obj, hooks}, grip) {
+    let raw = obj.unsafeDereference();
+    // We currently lack XrayWrappers for WeakMap, so when we iterate over
+    // the values, the temporary iterator objects get created in the target
+    // compartment. However, we _do_ have Xrays to Object now, so we end up
+    // Xraying those temporary objects, and filtering access to |it.value|
+    // based on whether or not it's Xrayable and/or callable, which breaks
+    // the for/of iteration.
+    //
+    // This code is designed to handle untrusted objects, so we can safely
+    // waive Xrays on the iterable, and relying on the Debugger machinery to
+    // make sure we handle the resulting objects carefully.
+    let rawEntries = Cu.waiveXrays(ThreadSafeChromeUtils.nondeterministicGetWeakMapKeys(raw));
+
+    grip.preview = {
+      kind: "MapLike",
+      size: rawEntries.length,
+    };
+
+    if (hooks.getGripDepth() > 1) {
+      return true;
+    }
+
+    let entries = grip.preview.entries = [];
+    for (let key of rawEntries) {
+      let value = Cu.unwaiveXrays(WeakMap.prototype.get.call(raw, key));
+      key = Cu.unwaiveXrays(key);
+      key = makeDebuggeeValueIfNeeded(obj, key);
+      value = makeDebuggeeValueIfNeeded(obj, value);
+      entries.push([hooks.createValueGrip(key),
+                    hooks.createValueGrip(value)]);
+      if (entries.length == OBJECT_PREVIEW_MAX_ITEMS) {
+        break;
+      }
+    }
+
+    return true;
+  }],
+
   DOMStringMap: [function({obj, hooks}, grip, rawObj) {
     if (!rawObj) {
       return false;
diff --git a/toolkit/devtools/webconsole/console-output.js b/toolkit/devtools/webconsole/console-output.js
index 591439445c..edc6971542 100644
--- a/toolkit/devtools/webconsole/console-output.js
+++ b/toolkit/devtools/webconsole/console-output.js
@@ -1797,7 +1797,8 @@ Messages.ConsoleTable.prototype = Heritage.extend(Messages.Extended.prototype,
 
     let data = this._arguments[0];
     if (data.class != "Array" && data.class != "Object" &&
-        data.class != "Map" && data.class != "Set") {
+        data.class != "Map" && data.class != "Set" &&
+        data.class != "WeakMap" && data.class != "WeakSet") {
       return;
     }
 
@@ -1877,7 +1878,7 @@ Messages.ConsoleTable.prototype = Heritage.extend(Messages.Extended.prototype,
 
         deferred.resolve();
       });
-    } else if (data.class == "Map") {
+    } else if (data.class == "Map" || data.class == "WeakMap") {
       let entries = data.preview.entries;
 
       if (!hasColumnsArg) {
@@ -1902,7 +1903,7 @@ Messages.ConsoleTable.prototype = Heritage.extend(Messages.Extended.prototype,
       }
 
       deferred.resolve();
-    } else if (data.class == "Set") {
+    } else if (data.class == "Set" || data.class == "WeakSet") {
       let entries = data.preview.items;
 
       if (!hasColumnsArg) {
diff --git a/toolkit/devtools/webconsole/test/browser_webconsole_output_02.js b/toolkit/devtools/webconsole/test/browser_webconsole_output_02.js
new file mode 100644
index 0000000000..fee82d78d8
--- /dev/null
+++ b/toolkit/devtools/webconsole/test/browser_webconsole_output_02.js
@@ -0,0 +1,186 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/
+ */
+
+// Test the webconsole output for various types of objects.
+
+"use strict";
+
+const TEST_URI = "http://example.com/browser/toolkit/devtools/webconsole/" +
+                 "test/test-console-output-02.html";
+
+var inputTests = [
+  // 0 - native named function
+  {
+    input: "document.getElementById",
+    output: "function getElementById()",
+    printOutput: "function getElementById() {\n    [native code]\n}",
+    inspectable: true,
+    variablesViewLabel: "getElementById()",
+  },
+
+  // 1 - anonymous function
+  {
+    input: "(function() { return 42; })",
+    output: "function ()",
+    printOutput: "function () { return 42; }",
+    inspectable: true,
+  },
+
+  // 2 - named function
+  {
+    input: "window.testfn1",
+    output: "function testfn1()",
+    printOutput: "function testfn1() { return 42; }",
+    inspectable: true,
+    variablesViewLabel: "testfn1()",
+  },
+
+  // 3 - anonymous function, but spidermonkey gives us an inferred name.
+  {
+    input: "testobj1.testfn2",
+    output: "function testobj1.testfn2()",
+    printOutput: "function () { return 42; }",
+    inspectable: true,
+    variablesViewLabel: "testobj1.testfn2()",
+  },
+
+  // 4 - named function with custom display name
+  {
+    input: "window.testfn3",
+    output: "function testfn3DisplayName()",
+    printOutput: "function testfn3() { return 42; }",
+    inspectable: true,
+    variablesViewLabel: "testfn3DisplayName()",
+  },
+
+  // 5 - basic array
+  {
+    input: "window.array1",
+    output: 'Array [ 1, 2, 3, "a", "b", "c", "4", "5" ]',
+    printOutput: "1,2,3,a,b,c,4,5",
+    inspectable: true,
+    variablesViewLabel: "Array[8]",
+  },
+
+  // 6 - array with objects
+  {
+    input: "window.array2",
+    output: 'Array [ "a", HTMLDocument \u2192 test-console-output-02.html, ' +
+            "<body>, DOMStringMap[0], DOMTokenList[0] ]",
+    printOutput: '"a,[object HTMLDocument],[object HTMLBodyElement],' +
+                 '[object DOMStringMap],"',
+    inspectable: true,
+    variablesViewLabel: "Array[5]",
+  },
+
+  // 7 - array with more than 10 elements
+  {
+    input: "window.array3",
+    output: 'Array [ 1, Window \u2192 test-console-output-02.html, null, ' +
+            '"a", "b", undefined, false, "", -Infinity, ' +
+            'testfn3DisplayName(), 3 more\u2026 ]',
+    printOutput: '"1,[object Window],,a,b,,false,,-Infinity,' +
+                 'function testfn3() { return 42; },[object Object],foo,bar"',
+    inspectable: true,
+    variablesViewLabel: "Array[13]",
+  },
+
+  // 8 - array with holes and a cyclic reference
+  {
+    input: "window.array4",
+    output: 'Array [ <5 empty slots>, "test", Array[7] ]',
+    printOutput: '",,,,,test,"',
+    inspectable: true,
+    variablesViewLabel: "Array[7]",
+  },
+
+  // 9
+  {
+    input: "window.typedarray1",
+    output: 'Int32Array [ 1, 287, 8651, 40983, 8754 ]',
+    printOutput: "[object Int32Array]",
+    inspectable: true,
+    variablesViewLabel: "Int32Array[5]",
+  },
+
+  // 10 - Set with cyclic reference
+  {
+    input: "window.set1",
+    output: 'Set [ 1, 2, null, Array[13], "a", "b", undefined, <head>, ' +
+            'Set[9] ]',
+    printOutput: "[object Set]",
+    inspectable: true,
+    variablesViewLabel: "Set[9]",
+  },
+
+  // 11 - Object with cyclic reference and a getter
+  {
+    input: "window.testobj2",
+    output: 'Object { a: "b", c: "d", e: 1, f: "2", foo: Object, ' +
+            "bar: Object, getterTest: Getter }",
+    printOutput: "[object Object]",
+    inspectable: true,
+    variablesViewLabel: "Object",
+  },
+
+  // 12 - Object with more than 10 properties
+  {
+    input: "window.testobj3",
+    output: 'Object { a: "b", c: "d", e: 1, f: "2", g: true, h: null, ' +
+            'i: undefined, j: "", k: StyleSheetList[0], l: NodeList[5], ' +
+            '2 more\u2026 }',
+    printOutput: "[object Object]",
+    inspectable: true,
+    variablesViewLabel: "Object",
+  },
+
+  // 13 - Object with a non-enumerable property that we do not show
+  {
+    input: "window.testobj4",
+    output: 'Object { a: "b", c: "d", 1 more\u2026 }',
+    printOutput: "[object Object]",
+    inspectable: true,
+    variablesViewLabel: "Object",
+  },
+
+  // 14 - Map with cyclic references
+  {
+    input: "window.map1",
+    output: 'Map { a: "b", HTMLCollection[2]: Object, Map[3]: Set[9] }',
+    printOutput: "[object Map]",
+    inspectable: true,
+    variablesViewLabel: "Map[3]",
+  },
+
+  // 15 - WeakSet
+  {
+    input: "window.weakset",
+    // Need a regexp because the order may vary.
+    output: new RegExp("WeakSet \\[ (String\\[7\\], <head>|<head>, String\\[7\\]) \\]"),
+    printOutput: "[object WeakSet]",
+    inspectable: true,
+    variablesViewLabel: "WeakSet[2]",
+  },
+
+  // 16 - WeakMap
+  {
+    input: "window.weakmap",
+    // Need a regexp because the order may vary.
+    output: new RegExp("WeakMap { (String\\[7\\]: 23, HTMLCollection\\[2\\]: Object|HTMLCollection\\[2\\]: Object, String\\[7\\]: 23) }"),
+    printOutput: "[object WeakMap]",
+    inspectable: true,
+    variablesViewLabel: "WeakMap[2]",
+  },
+];
+
+function test() {
+  requestLongerTimeout(2);
+  Task.spawn(function*() {
+    const {tab} = yield loadTab(TEST_URI);
+    const hud = yield openConsole(tab);
+    yield checkOutputForInputs(hud, inputTests);
+    inputTests = null;
+  }).then(finishTest);
+}
diff --git a/toolkit/devtools/webconsole/test/browser_webconsole_output_table.js b/toolkit/devtools/webconsole/test/browser_webconsole_output_table.js
new file mode 100644
index 0000000000..814ee6235e
--- /dev/null
+++ b/toolkit/devtools/webconsole/test/browser_webconsole_output_table.js
@@ -0,0 +1,198 @@
+ /* vim: set ft=javascript ts=2 et sw=2 tw=80: */
+ /* Any copyright is dedicated to the Public Domain.
+  http://creativecommons.org/publicdomain/zero/1.0/ */
+
+// Tests that console.table() works as intended.
+
+"use strict";
+
+const TEST_URI = "http://example.com/browser/toolkit/devtools/webconsole/" +
+                 "test/test-console-table.html";
+
+const TEST_DATA = [
+  {
+    command: "console.table(languages1)",
+    data: [
+        { _index: 0, name: "\"JavaScript\"", fileExtension: "Array[1]" },
+        { _index: 1, name: "Object", fileExtension: "\".ts\"" },
+        { _index: 2, name: "\"CoffeeScript\"", fileExtension: "\".coffee\"" }
+    ],
+    columns: { _index: "(index)", name: "name", fileExtension: "fileExtension" }
+  },
+  {
+    command: "console.table(languages1, 'name')",
+    data: [
+        { _index: 0, name: "\"JavaScript\"", fileExtension: "Array[1]" },
+        { _index: 1, name: "Object", fileExtension: "\".ts\"" },
+        { _index: 2, name: "\"CoffeeScript\"", fileExtension: "\".coffee\"" }
+    ],
+    columns: { _index: "(index)", name: "name" }
+  },
+  {
+    command: "console.table(languages1, ['name'])",
+    data: [
+        { _index: 0, name: "\"JavaScript\"", fileExtension: "Array[1]" },
+        { _index: 1, name: "Object", fileExtension: "\".ts\"" },
+        { _index: 2, name: "\"CoffeeScript\"", fileExtension: "\".coffee\"" }
+    ],
+    columns: { _index: "(index)", name: "name" }
+  },
+  {
+    command: "console.table(languages2)",
+    data: [
+      { _index: "csharp", name: "\"C#\"", paradigm: "\"object-oriented\"" },
+      { _index: "fsharp", name: "\"F#\"", paradigm: "\"functional\"" }
+    ],
+    columns: { _index: "(index)", name: "name", paradigm: "paradigm" }
+  },
+  {
+    command: "console.table([[1, 2], [3, 4]])",
+    data: [
+      { _index: 0, 0: "1", 1: "2" },
+      { _index: 1, 0: "3", 1: "4" }
+    ],
+    columns: { _index: "(index)", 0: "0", 1: "1" }
+  },
+  {
+    command: "console.table({a: [1, 2], b: [3, 4]})",
+    data: [
+      { _index: "a", 0: "1", 1: "2" },
+      { _index: "b", 0: "3", 1: "4" }
+    ],
+    columns: { _index: "(index)", 0: "0", 1: "1" }
+  },
+  {
+    command: "console.table(family)",
+    data: [
+      { _index: "mother", firstName: "\"Susan\"", lastName: "\"Doyle\"",
+        age: "32" },
+      { _index: "father", firstName: "\"John\"", lastName: "\"Doyle\"",
+        age: "33" },
+      { _index: "daughter", firstName: "\"Lily\"", lastName: "\"Doyle\"",
+        age: "5" },
+      { _index: "son", firstName: "\"Mike\"", lastName: "\"Doyle\"", age: "8" },
+    ],
+    columns: { _index: "(index)", firstName: "firstName", lastName: "lastName",
+               age: "age" }
+  },
+  {
+    command: "console.table(family, [])",
+    data: [
+      { _index: "mother", firstName: "\"Susan\"", lastName: "\"Doyle\"",
+        age: "32" },
+      { _index: "father", firstName: "\"John\"", lastName: "\"Doyle\"",
+        age: "33" },
+      { _index: "daughter", firstName: "\"Lily\"", lastName: "\"Doyle\"",
+        age: "5" },
+      { _index: "son", firstName: "\"Mike\"", lastName: "\"Doyle\"", age: "8" },
+    ],
+    columns: { _index: "(index)" }
+  },
+  {
+    command: "console.table(family, ['firstName', 'lastName'])",
+    data: [
+      { _index: "mother", firstName: "\"Susan\"", lastName: "\"Doyle\"",
+        age: "32" },
+      { _index: "father", firstName: "\"John\"", lastName: "\"Doyle\"",
+        age: "33" },
+      { _index: "daughter", firstName: "\"Lily\"", lastName: "\"Doyle\"",
+        age: "5" },
+      { _index: "son", firstName: "\"Mike\"", lastName: "\"Doyle\"", age: "8" },
+    ],
+    columns: { _index: "(index)", firstName: "firstName", lastName: "lastName" }
+  },
+  {
+    command: "console.table(mySet)",
+    data: [
+      { _index: 0, _value: "1" },
+      { _index: 1, _value: "5" },
+      { _index: 2, _value: "\"some text\"" },
+      { _index: 3, _value: "null" },
+      { _index: 4, _value: "undefined" }
+    ],
+    columns: { _index: "(iteration index)", _value: "Values" }
+  },
+  {
+    command: "console.table(myMap)",
+    data: [
+      { _index: 0, _key: "\"a string\"",
+        _value: "\"value associated with 'a string'\"" },
+      { _index: 1, _key: "5", _value: "\"value associated with 5\"" },
+    ],
+    columns: { _index: "(iteration index)", _key: "Key", _value: "Values" }
+  },
+  {
+    command: "console.table(weakset)",
+    data: [
+      { _value: "String[7]" },
+      { _value: "String[7]" },
+    ],
+    columns: { _index: "(iteration index)", _value: "Values" },
+    couldBeOutOfOrder: true,
+  },
+  {
+    command: "console.table(weakmap)",
+    data: [
+      { _key: "String[7]", _value: "\"oh no\"" },
+      { _key: "String[7]", _value: "23" },
+    ],
+    columns: { _index: "(iteration index)", _key: "Key", _value: "Values" },
+    couldBeOutOfOrder: true,
+  },
+];
+
+add_task(function*() {
+  const {tab} = yield loadTab(TEST_URI);
+  let hud = yield openConsole(tab);
+
+  for (let testdata of TEST_DATA) {
+    hud.jsterm.clearOutput();
+
+    info("Executing " + testdata.command);
+
+    let onTableRender = once(hud.ui, "messages-table-rendered");
+    hud.jsterm.execute(testdata.command);
+    yield onTableRender;
+
+    let [result] = yield waitForMessages({
+      webconsole: hud,
+      messages: [{
+        name: testdata.command + " output",
+        consoleTable: true
+      }],
+    });
+
+    let node = [...result.matched][0];
+    ok(node, "found trace log node");
+
+    let obj = node._messageObject;
+    ok(obj, "console.trace message object");
+
+    ok(obj._data, "found table data object");
+
+    let data = obj._data.map(entries => {
+      let entryResult = {};
+
+      for (let key of Object.keys(entries)) {
+        // If the results can be out of order, then ignore _index.
+        if (!testdata.couldBeOutOfOrder || key !== "_index") {
+          entryResult[key] = entries[key] instanceof HTMLElement ?
+            entries[key].textContent : entries[key];
+        }
+      }
+
+      return entryResult;
+    });
+
+    if (testdata.couldBeOutOfOrder) {
+      data = data.map(e => e.toSource()).sort().join(",");
+      let expected = testdata.data.map(e => e.toSource()).sort().join(",");
+      is(data, expected, "table data is correct");
+    } else {
+      is(data.toSource(), testdata.data.toSource(), "table data is correct");
+    }
+    ok(obj._columns, "found table column object");
+    is(obj._columns.toSource(), testdata.columns.toSource(),
+       "table column is correct");
+  }
+});
diff --git a/toolkit/devtools/webconsole/test/test-console-output-02.html b/toolkit/devtools/webconsole/test/test-console-output-02.html
new file mode 100644
index 0000000000..ad90f0ebfe
--- /dev/null
+++ b/toolkit/devtools/webconsole/test/test-console-output-02.html
@@ -0,0 +1,66 @@
+<!DOCTYPE HTML>
+<html dir="ltr" lang="en-US">
+<head>
+  <meta charset="utf-8">
+  <title>Test the web console output - 02</title>
+  <!--
+  - Any copyright is dedicated to the Public Domain.
+  - http://creativecommons.org/publicdomain/zero/1.0/
+  -->
+</head>
+<body>
+  <p>hello world!</p>
+  <script type="text/javascript">
+function testfn1() { return 42; }
+
+var testobj1 = {
+  testfn2: function() { return 42; },
+};
+
+function testfn3() { return 42; }
+testfn3.displayName = "testfn3DisplayName";
+
+var array1 = [1, 2, 3, "a", "b", "c", "4", "5"];
+
+var array2 = ["a", document, document.body, document.body.dataset,
+              document.body.classList];
+
+var array3 = [1, window, null, "a", "b", undefined, false, "", -Infinity, testfn3, testobj1, "foo", "bar"];
+
+var array4 = new Array(5);
+array4.push("test");
+array4.push(array4);
+
+var typedarray1 = new Int32Array([1, 287, 8651, 40983, 8754]);
+
+var set1 = new Set([1, 2, null, array3, "a", "b", undefined, document.head]);
+set1.add(set1);
+
+var bunnies = new String("bunnies")
+var weakset = new WeakSet([bunnies, document.head]);
+
+var testobj2 = {a: "b", c: "d", e: 1, f: "2"};
+testobj2.foo = testobj1;
+testobj2.bar = testobj2;
+Object.defineProperty(testobj2, "getterTest", {
+  enumerable: true,
+  get: function() {
+    return 42;
+  },
+});
+
+var testobj3 = {a: "b", c: "d", e: 1, f: "2", g: true, h: null, i: undefined,
+                j: "", k: document.styleSheets, l: document.body.childNodes,
+                o: new Array(125), m: document.head};
+
+var testobj4 = {a: "b", c: "d"};
+Object.defineProperty(testobj4, "nonEnumerable", { value: "hello world" });
+
+var map1 = new Map([["a", "b"], [document.body.children, testobj2]]);
+map1.set(map1, set1);
+
+var weakmap = new WeakMap([[bunnies, 23], [document.body.children, testobj2]]);
+
+  </script>
+</body>
+</html>
diff --git a/toolkit/devtools/webconsole/test/test-console-table.html b/toolkit/devtools/webconsole/test/test-console-table.html
new file mode 100644
index 0000000000..461dedcde8
--- /dev/null
+++ b/toolkit/devtools/webconsole/test/test-console-table.html
@@ -0,0 +1,63 @@
+<!DOCTYPE HTML>
+<html dir="ltr" lang="en">
+  <head>
+    <meta charset="utf8">
+    <!--
+    - Any copyright is dedicated to the Public Domain.
+    - http://creativecommons.org/publicdomain/zero/1.0/
+    -->
+    <title>Test for Bug 899753 - console.table support</title>
+    <script>
+      var languages1 = [
+        { name: "JavaScript", fileExtension: [".js"] },
+        { name: { a: "TypeScript" }, fileExtension: ".ts" },
+        { name: "CoffeeScript", fileExtension: ".coffee" }
+      ];
+
+      var languages2 = {
+        csharp: { name: "C#", paradigm: "object-oriented" },
+        fsharp: { name: "F#", paradigm: "functional" }
+      };
+
+      function Person(firstName, lastName, age)
+      {
+          this.firstName = firstName;
+          this.lastName = lastName;
+          this.age = age;
+      }
+
+      var family = {};
+      family.mother = new Person("Susan", "Doyle", 32);
+      family.father = new Person("John", "Doyle", 33);
+      family.daughter = new Person("Lily", "Doyle", 5);
+      family.son = new Person("Mike", "Doyle", 8);
+
+      var myMap = new Map();
+
+      myMap.set("a string", "value associated with 'a string'");
+      myMap.set(5, "value associated with 5");
+
+      var mySet = new Set();
+
+      mySet.add(1);
+      mySet.add(5);
+      mySet.add("some text");
+      mySet.add(null);
+      mySet.add(undefined);
+
+      // These are globals and so won't be reclaimed by the GC.
+      var bunnies = new String("bunnies");
+      var lizards = new String("lizards");
+
+      var weakmap = new WeakMap();
+      weakmap.set(bunnies, 23);
+      weakmap.set(lizards, "oh no");
+
+      var weakset = new WeakSet([bunnies, lizards]);
+
+    </script>
+  </head>
+  <body>
+    <p>Hello world!</p>
+  </body>
+</html>
diff --git a/toolkit/modules/PrivateBrowsingUtils.jsm b/toolkit/modules/PrivateBrowsingUtils.jsm
index f322347fa3..8eec35dd78 100644
--- a/toolkit/modules/PrivateBrowsingUtils.jsm
+++ b/toolkit/modules/PrivateBrowsingUtils.jsm
@@ -51,6 +51,18 @@ this.PrivateBrowsingUtils = {
                   .QueryInterface(Ci.nsILoadContext);
   },
 
+  addToTrackingAllowlist(aURI) {
+    let pbmtpWhitelist = Cc["@mozilla.org/url-classifier/pbm-tp-whitelist;1"]
+                           .getService(Ci.nsIPrivateBrowsingTrackingProtectionWhitelist);
+    pbmtpWhitelist.addToAllowList(aURI);
+  },
+
+  removeFromTrackingAllowlist(aURI) {
+    let pbmtpWhitelist = Cc["@mozilla.org/url-classifier/pbm-tp-whitelist;1"]
+                           .getService(Ci.nsIPrivateBrowsingTrackingProtectionWhitelist);
+    pbmtpWhitelist.removeFromAllowList(aURI);
+  },
+
   get permanentPrivateBrowsing() {
     try {
       return gTemporaryAutoStartMode ||
diff --git a/xpcom/base/CycleCollectedJSRuntime.cpp b/xpcom/base/CycleCollectedJSRuntime.cpp
index 9bc464e519..39d6a2d016 100644
--- a/xpcom/base/CycleCollectedJSRuntime.cpp
+++ b/xpcom/base/CycleCollectedJSRuntime.cpp
@@ -59,6 +59,7 @@
 #include "mozilla/ArrayUtils.h"
 #include "mozilla/AutoRestore.h"
 #include "mozilla/MemoryReporting.h"
+#include "mozilla/Telemetry.h"
 #include "mozilla/dom/BindingUtils.h"
 #include "mozilla/DebuggerOnGCRunnable.h"
 #include "mozilla/dom/DOMJSClass.h"
@@ -1204,7 +1205,7 @@ IncrementalFinalizeRunnable::ReleaseNow(bool aLimited)
           break;
         }
       } else {
-        function.run(UINT32_MAX, function.data);
+        while (!function.run(UINT32_MAX, function.data));
         ++mFinalizeFunctionToRun;
       }
     } while (mFinalizeFunctionToRun < mDeferredFinalizeFunctions.Length());
@@ -1227,6 +1228,7 @@ IncrementalFinalizeRunnable::Run()
     return NS_OK;
   }
 
+  TimeStamp start = TimeStamp::Now();
   ReleaseNow(true);
 
   if (mDeferredFinalizeFunctions.Length()) {
@@ -1236,6 +1238,9 @@ IncrementalFinalizeRunnable::Run()
     }
   }
 
+  uint32_t duration = (uint32_t)((TimeStamp::Now() - start).ToMilliseconds());
+  Telemetry::Accumulate(Telemetry::DEFERRED_FINALIZE_ASYNC, duration);
+
   return NS_OK;
 }
 
diff --git a/xpcom/base/DeferredFinalize.h b/xpcom/base/DeferredFinalize.h
index 28e170d7f6..7d9c588811 100644
--- a/xpcom/base/DeferredFinalize.h
+++ b/xpcom/base/DeferredFinalize.h
@@ -16,9 +16,10 @@ namespace mozilla {
 // the array.
 typedef void* (*DeferredFinalizeAppendFunction)(void* aPointers, void* aThing);
 
-// Called to finalize a number of objects. Slice is the number of objects
-// to finalize, or if it's UINT32_MAX, all objects should be finalized.
-// Return value indicates whether it finalized all objects in the buffer.
+// Called to finalize a number of objects. Slice is the number of objects to
+// finalize. The return value indicates whether it finalized all objects in the
+// buffer. If it returns true, the function will not be called again, so the
+// function should free aData.
 typedef bool (*DeferredFinalizeFunction)(uint32_t aSlice, void* aData);
 
 void DeferredFinalize(DeferredFinalizeAppendFunction aAppendFunc,