diff --git a/caps/nsScriptSecurityManager.cpp b/caps/nsScriptSecurityManager.cpp
index cafb5e4dc9..2ddd69395d 100644
--- a/caps/nsScriptSecurityManager.cpp
+++ b/caps/nsScriptSecurityManager.cpp
@@ -297,6 +297,15 @@ nsScriptSecurityManager::AppStatusForPrincipal(nsIPrincipal *aPrin)
                                   : nsIPrincipal::APP_STATUS_NOT_INSTALLED;
 }
 
+/*
+ * GetChannelResultPrincipal will return the principal that the resource
+ * returned by this channel will use.  For example, if the resource is in
+ * a sandbox, it will return the nullprincipal.  If the resource is forced
+ * to inherit principal, it will return the principal of its parent.  If
+ * the load doesn't require sandboxing or inheriting, it will return the same
+ * principal as GetChannelURIPrincipal. Namely the principal of the URI
+ * that is being loaded.
+ */
 NS_IMETHODIMP
 nsScriptSecurityManager::GetChannelResultPrincipal(nsIChannel* aChannel,
                                                    nsIPrincipal** aPrincipal)
@@ -331,6 +340,17 @@ nsScriptSecurityManager::GetChannelResultPrincipal(nsIChannel* aChannel,
     return GetChannelURIPrincipal(aChannel, aPrincipal);
 }
 
+/* The principal of the URI that this channel is loading. This is never
+ * affected by things like sandboxed loads, or loads where we forcefully
+ * inherit the principal.  Think of this as the principal of the server
+ * which this channel is loading from.  Most callers should use
+ * GetChannelResultPrincipal instead of GetChannelURIPrincipal.  Only
+ * call GetChannelURIPrincipal if you are sure that you want the
+ * principal that matches the uri, even in cases when the load is
+ * sandboxed or when the load could be a blob or data uri (i.e even when
+ * you encounter loads that may or may not be sandboxed and loads
+ * that may or may not inherit)."
+ */
 NS_IMETHODIMP
 nsScriptSecurityManager::GetChannelURIPrincipal(nsIChannel* aChannel,
                                                 nsIPrincipal** aPrincipal)
diff --git a/dom/base/nsContentSink.cpp b/dom/base/nsContentSink.cpp
index 804ad79d39..3f60173a89 100644
--- a/dom/base/nsContentSink.cpp
+++ b/dom/base/nsContentSink.cpp
@@ -450,6 +450,9 @@ nsContentSink::ProcessLinkHeader(const nsAString& aLinkData)
   nsAutoString type;
   nsAutoString media;
   nsAutoString anchor;
+  nsAutoString crossOrigin;
+
+  crossOrigin.SetIsVoid(true);
 
   // copy to work buffer
   nsAutoString stringList(aLinkData);
@@ -624,6 +627,12 @@ nsContentSink::ProcessLinkHeader(const nsAString& aLinkData)
               anchor = value;
               anchor.StripWhitespace();
             }
+          } else if (attr.LowerCaseEqualsLiteral("crossorigin")) {
+            if (crossOrigin.IsVoid()) {
+              crossOrigin.SetIsVoid(false);
+              crossOrigin = value;
+              crossOrigin.StripWhitespace();
+            }
           }
         }
       }
@@ -637,7 +646,7 @@ nsContentSink::ProcessLinkHeader(const nsAString& aLinkData)
         rv = ProcessLink(anchor, href, rel,
                          // prefer RFC 5987 variant over non-I18zed version
                          titleStar.IsEmpty() ? title : titleStar,
-                         type, media);
+                         type, media, crossOrigin);
       }
 
       href.Truncate();
@@ -646,6 +655,7 @@ nsContentSink::ProcessLinkHeader(const nsAString& aLinkData)
       type.Truncate();
       media.Truncate();
       anchor.Truncate();
+      crossOrigin.SetIsVoid(true);
       
       seenParameters = false;
     }
@@ -658,7 +668,7 @@ nsContentSink::ProcessLinkHeader(const nsAString& aLinkData)
     rv = ProcessLink(anchor, href, rel,
                      // prefer RFC 5987 variant over non-I18zed version
                      titleStar.IsEmpty() ? title : titleStar,
-                     type, media);
+                     type, media, crossOrigin);
   }
 
   return rv;
@@ -668,7 +678,8 @@ nsContentSink::ProcessLinkHeader(const nsAString& aLinkData)
 nsresult
 nsContentSink::ProcessLink(const nsSubstring& aAnchor, const nsSubstring& aHref,
                            const nsSubstring& aRel, const nsSubstring& aTitle,
-                           const nsSubstring& aType, const nsSubstring& aMedia)
+                           const nsSubstring& aType, const nsSubstring& aMedia,
+                           const nsSubstring& aCrossOrigin)
 {
   uint32_t linkTypes =
     nsStyleLinkElement::ParseLinkTypes(aRel, mDocument->NodePrincipal());
@@ -692,7 +703,7 @@ nsContentSink::ProcessLink(const nsSubstring& aAnchor, const nsSubstring& aHref,
   }
 
   if (!aHref.IsEmpty() && (linkTypes & nsStyleLinkElement::ePRECONNECT)) {
-    Preconnect(aHref);
+    Preconnect(aHref, aCrossOrigin);
   }
 
   // is it a stylesheet link?
@@ -873,7 +884,7 @@ nsContentSink::PrefetchDNS(const nsAString &aHref)
 }
 
 void
-nsContentSink::Preconnect(const nsAString &aHref)
+nsContentSink::Preconnect(const nsAString& aHref, const nsAString& aCrossOrigin)
 {
   // construct URI using document charset
   const nsACString& charset = mDocument->GetDocumentCharacterSet();
@@ -883,7 +894,7 @@ nsContentSink::Preconnect(const nsAString &aHref)
             mDocument->GetDocBaseURI());
 
   if (uri && mDocument) {
-    mDocument->MaybePreconnect(uri);
+    mDocument->MaybePreconnect(uri, dom::Element::StringToCORSMode(aCrossOrigin));
   }
 }
 
diff --git a/dom/base/nsContentSink.h b/dom/base/nsContentSink.h
index bf7b1ae100..f66359065b 100644
--- a/dom/base/nsContentSink.h
+++ b/dom/base/nsContentSink.h
@@ -151,7 +151,7 @@ protected:
   nsresult ProcessLink(const nsSubstring& aAnchor,
                        const nsSubstring& aHref, const nsSubstring& aRel,
                        const nsSubstring& aTitle, const nsSubstring& aType,
-                       const nsSubstring& aMedia);
+                       const nsSubstring& aMedia, const nsSubstring& aCrossOrigin);
 
   virtual nsresult ProcessStyleLink(nsIContent* aElement,
                                     const nsSubstring& aHref,
@@ -225,7 +225,7 @@ public:
 
   // For Preconnect() aHref can either be the usual
   // URI format or of the form "//www.hostname.com" without a scheme.
-  void Preconnect(const nsAString &aHref);
+  void Preconnect(const nsAString& aHref, const nsAString& aCrossOrigin);
 
 protected:
   // Tries to scroll to the URI's named anchor. Once we've successfully
diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp
index 38dca17d94..620cb278dc 100644
--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@@ -7973,4 +7973,16 @@ nsContentUtils::FirePageShowEvent(nsIDocShellTreeItem* aItem,
   if (doc->IsShowing() == aFireIfShowing) {
     doc->OnPageShow(true, aChromeEventHandler);
   }
-}
\ No newline at end of file
+}
+/* static */
+already_AddRefed<nsPIWindowRoot>
+nsContentUtils::GetWindowRoot(nsIDocument* aDoc)
+{
+  if (aDoc) {
+    nsPIDOMWindow* win = aDoc->GetWindow();
+    if (win) {
+      return win->GetTopWindowRoot();
+    }
+  }
+  return nullptr;
+}
diff --git a/dom/base/nsContentUtils.h b/dom/base/nsContentUtils.h
index eb55d356ef..6eb4d7702d 100644
--- a/dom/base/nsContentUtils.h
+++ b/dom/base/nsContentUtils.h
@@ -99,6 +99,7 @@ class nsViewportInfo;
 class nsWrapperCache;
 class nsAttrValue;
 class nsITransferable;
+class nsPIWindowRoot;
 
 struct JSPropertyDescriptor;
 struct JSRuntime;
@@ -2480,6 +2481,8 @@ public:
   static void FirePageHideEvent(nsIDocShellTreeItem* aItem,
                                 mozilla::dom::EventTarget* aChromeEventHandler);
 
+  static already_AddRefed<nsPIWindowRoot> GetWindowRoot(nsIDocument* aDoc);
+
 private:
   static bool InitializeEventTable();
 
diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
index 978a9f913d..d872a9b593 100644
--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -1547,6 +1547,9 @@ nsIDocument::nsIDocument()
     mAllowDNSPrefetch(true),
     mIsBeingUsedAsImage(false),
     mHasLinksToUpdate(false),
+    mFontFaceSetDirty(true),
+    mGetUserFontSetCalled(false),
+    mPostedFlushUserFontSet(false),
     mPartID(0),
     mDidFireDOMContentLoaded(true),
     mUserHasInteracted(false)
@@ -1930,6 +1933,7 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INTERNAL(nsDocument)
   // Traverse all nsIDocument pointer members.
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mSecurityInfo)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mDisplayDocument)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mFontFaceSet)
 
   // Traverse all nsDocument nsCOMPtrs.
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mParser)
@@ -2059,6 +2063,7 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsDocument)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mMasterDocument)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mImportManager)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mSubImportLinks)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mFontFaceSet)
 
   tmp->mParentDocument = nullptr;
 
@@ -3857,6 +3862,9 @@ nsDocument::doCreateShell(nsPresContext* aContext,
 
   MaybeRescheduleAnimationFrameNotifications();
 
+  // Now that we have a shell, we might have @font-face rules.
+  RebuildUserFontSet();
+
   return shell.forget();
 }
 
@@ -3943,6 +3951,10 @@ nsDocument::DeleteShell()
   // no longer intend to paint.
   mImageTracker.EnumerateRead(RequestDiscardEnumerator, nullptr);
 
+  // Now that we no longer have a shell, we need to forget about any FontFace
+  // objects for @font-face rules that came from the style set.
+  RebuildUserFontSet();
+
   mPresShell = nullptr;
 }
 
@@ -9745,8 +9757,26 @@ nsDocument::MaybePreLoadImage(nsIURI* uri, const nsAString &aCrossOriginAttr,
 }
 
 void
-nsDocument::MaybePreconnect(nsIURI* uri)
+nsDocument::MaybePreconnect(nsIURI* aOrigURI, mozilla::CORSMode aCORSMode)
 {
+  nsCOMPtr<nsIURI> uri;
+  if (NS_FAILED(aOrigURI->Clone(getter_AddRefs(uri)))) {
+      return;
+  }
+
+  // The URI created here is used in 2 contexts. One is nsISpeculativeConnect
+  // which ignores the path and uses only the origin. The other is for the
+  // document mPreloadedPreconnects de-duplication hash. Anonymous vs
+  // non-Anonymous preconnects create different connections on the wire and
+  // therefore should not be considred duplicates of each other and we
+  // normalize the path before putting it in the hash to accomplish that.
+
+  if (aCORSMode == CORS_ANONYMOUS) {
+    uri->SetPath(NS_LITERAL_CSTRING("/anonymous"));
+  } else {
+    uri->SetPath(NS_LITERAL_CSTRING("/"));
+  }
+
   if (mPreloadedPreconnects.Contains(uri)) {
     return;
   }
@@ -9758,7 +9788,11 @@ nsDocument::MaybePreconnect(nsIURI* uri)
     return;
   }
 
-  speculator->SpeculativeConnect(uri, nullptr);
+  if (aCORSMode == CORS_ANONYMOUS) {
+    speculator->SpeculativeAnonymousConnect(uri, nullptr);
+  } else {
+    speculator->SpeculativeConnect(uri, nullptr);
+  }
 }
 
 void
@@ -12993,22 +13027,124 @@ nsAutoSyncOperation::~nsAutoSyncOperation()
   nsContentUtils::SetMicroTaskLevel(mMicroTaskLevel);
 }
 
-FontFaceSet*
-nsIDocument::GetFonts(ErrorResult& aRv)
+gfxUserFontSet*
+nsIDocument::GetUserFontSet()
 {
-  nsIPresShell* shell = GetShell();
-  if (!shell) {
-    aRv.Throw(NS_ERROR_FAILURE);
+  // We want to initialize the user font set lazily the first time the
+  // user asks for it, rather than building it too early and forcing
+  // rule cascade creation.  Thus we try to enforce the invariant that
+  // we *never* build the user font set until the first call to
+  // GetUserFontSet.  However, once it's been requested, we can't wait
+  // for somebody to call GetUserFontSet in order to rebuild it (see
+  // comments below in RebuildUserFontSet for why).
+#ifdef DEBUG
+  bool userFontSetGottenBefore = mGetUserFontSetCalled;
+#endif
+  // Set mGetUserFontSetCalled up front, so that FlushUserFontSet will actually
+  // flush.
+  mGetUserFontSetCalled = true;
+  if (mFontFaceSetDirty) {
+    // If this assertion fails, and there have actually been changes to
+    // @font-face rules, then we will call StyleChangeReflow in
+    // FlushUserFontSet.  If we're in the middle of reflow,
+    // that's a bad thing to do, and the caller was responsible for
+    // flushing first.  If we're not (e.g., in frame construction), it's
+    // ok.
+    NS_ASSERTION(!userFontSetGottenBefore ||
+                 !GetShell() ||
+                 !GetShell()->IsReflowLocked(),
+                 "FlushUserFontSet should have been called first");
+    FlushUserFontSet();
+  }
+
+  if (!mFontFaceSet) {
     return nullptr;
   }
 
-  nsPresContext* presContext = shell->GetPresContext();
-  if (!presContext) {
-    aRv.Throw(NS_ERROR_FAILURE);
-    return nullptr;
+  return mFontFaceSet->GetUserFontSet();
+}
+
+void
+nsIDocument::FlushUserFontSet()
+{
+  if (!mGetUserFontSetCalled) {
+    return; // No one cares about this font set yet, but we want to be careful
+            // to not unset our mFontFaceSetDirty bit, so when someone really
+            // does we'll create it.
   }
 
-  return presContext->Fonts();
+  if (mFontFaceSetDirty) {
+    if (gfxPlatform::GetPlatform()->DownloadableFontsEnabled()) {
+      nsTArray<nsFontFaceRuleContainer> rules;
+      nsIPresShell* shell = GetShell();
+      if (shell && !shell->StyleSet()->AppendFontFaceRules(rules)) {
+        return;
+      }
+
+      bool changed = false;
+
+      if (!mFontFaceSet && !rules.IsEmpty()) {
+        nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(GetScopeObject());
+        mFontFaceSet = new FontFaceSet(window, this);
+      }
+      if (mFontFaceSet) {
+        changed = mFontFaceSet->UpdateRules(rules);
+      }
+
+      // We need to enqueue a style change reflow (for later) to
+      // reflect that we're modifying @font-face rules.  (However,
+      // without a reflow, nothing will happen to start any downloads
+      // that are needed.)
+      if (changed && shell) {
+        nsPresContext* presContext = shell->GetPresContext();
+        if (presContext) {
+          presContext->UserFontSetUpdated();
+        }
+      }
+    }
+
+    mFontFaceSetDirty = false;
+  }
+}
+
+void
+nsIDocument::RebuildUserFontSet()
+{
+  if (!mGetUserFontSetCalled) {
+    // We want to lazily build the user font set the first time it's
+    // requested (so we don't force creation of rule cascades too
+    // early), so don't do anything now.
+    return;
+  }
+
+  mFontFaceSetDirty = true;
+  SetNeedStyleFlush();
+
+  // Somebody has already asked for the user font set, so we need to
+  // post an event to rebuild it.  Setting the user font set to be dirty
+  // and lazily rebuilding it isn't sufficient, since it is only the act
+  // of rebuilding it that will trigger the style change reflow that
+  // calls GetUserFontSet.  (This reflow causes rebuilding of text runs,
+  // which starts font loads, whose completion causes another style
+  // change reflow).
+  if (!mPostedFlushUserFontSet) {
+    nsCOMPtr<nsIRunnable> ev =
+      NS_NewRunnableMethod(this, &nsIDocument::HandleRebuildUserFontSet);
+    if (NS_SUCCEEDED(NS_DispatchToCurrentThread(ev))) {
+      mPostedFlushUserFontSet = true;
+    }
+  }
+}
+
+FontFaceSet*
+nsIDocument::Fonts()
+{
+  if (!mFontFaceSet) {
+    nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(GetScopeObject());
+    mFontFaceSet = new FontFaceSet(window, this);
+    GetUserFontSet();  // this will cause the user font set to be created/updated
+  }
+  return mFontFaceSet;
 }
 
 Selection*
diff --git a/dom/base/nsDocument.h b/dom/base/nsDocument.h
index 9d5cb36c22..a9e0a35726 100644
--- a/dom/base/nsDocument.h
+++ b/dom/base/nsDocument.h
@@ -1118,7 +1118,8 @@ public:
                                  ReferrerPolicy aReferrerPolicy) override;
   virtual void ForgetImagePreload(nsIURI* aURI) override;
 
-  virtual void MaybePreconnect(nsIURI* uri) override;
+  virtual void MaybePreconnect(nsIURI* uri,
+                               mozilla::CORSMode aCORSMode) override;
 
   virtual void PreloadStyle(nsIURI* uri, const nsAString& charset,
                             const nsAString& aCrossOriginAttr,
diff --git a/dom/base/nsIDocument.h b/dom/base/nsIDocument.h
index 7285047fed..34edc95062 100644
--- a/dom/base/nsIDocument.h
+++ b/dom/base/nsIDocument.h
@@ -32,8 +32,10 @@
 #include "nsExpirationTracker.h"
 #include "nsClassHashtable.h"
 #include "prclist.h"
+#include "mozilla/CORSMode.h"
 #include <bitset>                        // for member
 
+class gfxUserFontSet;
 class imgIRequest;
 class nsAString;
 class nsBindingManager;
@@ -155,8 +157,8 @@ struct FullScreenOptions {
 } // namespace mozilla
 
 #define NS_IDOCUMENT_IID \
-{ 0x0b78eabe, 0x8b94, 0x4ea1, \
-  { 0x93, 0x31, 0x5d, 0x48, 0xe8, 0x3a, 0xda, 0x95 } }
+{ 0x21bbd52a, 0xc2d2, 0x4b2f, \
+  { 0xbc, 0x6c, 0xc9, 0x52, 0xbe, 0x23, 0x6b, 0x19 } }
 
 // Enum for requesting a particular type of document when creating a doc
 enum DocumentFlavor {
@@ -2078,7 +2080,8 @@ public:
   /**
    * Called by Parser for link rel=preconnect
    */
-  virtual void MaybePreconnect(nsIURI* uri) = 0;
+  virtual void MaybePreconnect(nsIURI* uri,
+                               mozilla::CORSMode aCORSMode) = 0;
 
   enum DocumentTheme {
     Doc_Theme_Uninitialized, // not determined yet
@@ -2604,8 +2607,13 @@ public:
     }
   }
 
+  gfxUserFontSet* GetUserFontSet();
+  void FlushUserFontSet();
+  void RebuildUserFontSet(); // asynchronously
+  mozilla::dom::FontFaceSet* GetFonts() { return mFontFaceSet; }
+
   // FontFaceSource
-  mozilla::dom::FontFaceSet* GetFonts(mozilla::ErrorResult& aRv);
+  mozilla::dom::FontFaceSet* Fonts();
 
   bool DidFireDOMContentLoaded() const { return mDidFireDOMContentLoaded; }
   
@@ -2664,6 +2672,11 @@ protected:
 
   mozilla::dom::XPathEvaluator* XPathEvaluator();
 
+  void HandleRebuildUserFontSet() {
+    mPostedFlushUserFontSet = false;
+    FlushUserFontSet();
+  }
+
   nsCString mReferrer;
   nsString mLastModified;
 
@@ -2720,6 +2733,9 @@ protected:
   // Our cached .children collection
   nsCOMPtr<nsIHTMLCollection> mChildrenCollection;
 
+  // container for per-context fonts (downloadable, SVG, etc.)
+  nsRefPtr<mozilla::dom::FontFaceSet> mFontFaceSet;
+
   // Compatibility mode
   nsCompatibility mCompatMode;
 
@@ -2852,6 +2868,15 @@ protected:
   bool mIsLinkUpdateRegistrationsForbidden;
 #endif
 
+  // Is the current mFontFaceSet valid?
+  bool mFontFaceSetDirty;
+
+  // Has GetUserFontSet() been called?
+  bool mGetUserFontSetCalled;
+
+  // Do we currently have an event posted to call FlushUserFontSet?
+  bool mPostedFlushUserFontSet;
+
   enum Type {
     eUnknown, // should never be used
     eHTML,
diff --git a/dom/base/nsObjectLoadingContent.cpp b/dom/base/nsObjectLoadingContent.cpp
index 3ceb0b9a4b..756a8d7de7 100644
--- a/dom/base/nsObjectLoadingContent.cpp
+++ b/dom/base/nsObjectLoadingContent.cpp
@@ -20,6 +20,7 @@
 #include "nsIDOMHTMLObjectElement.h"
 #include "nsIDOMHTMLAppletElement.h"
 #include "nsIExternalProtocolHandler.h"
+#include "nsIHttpChannelInternal.h"
 #include "nsIObjectFrame.h"
 #include "nsIPermissionManager.h"
 #include "nsPluginHost.h"
@@ -2517,6 +2518,13 @@ nsObjectLoadingContent::OpenChannel()
     scriptChannel->SetExecutionPolicy(nsIScriptChannel::EXECUTE_NORMAL);
   }
 
+  nsCOMPtr<nsIHttpChannelInternal> internalChannel = do_QueryInterface(httpChan);
+  if (internalChannel) {
+    // Bug 1168676. object/embed tags are not allowed to be intercepted by
+    // ServiceWorkers.
+    internalChannel->ForceNoIntercept();
+  }
+
   // AsyncOpen can fail if a file does not exist.
   rv = chan->AsyncOpen(shim, nullptr);
   NS_ENSURE_SUCCESS(rv, rv);
diff --git a/dom/base/nsPIWindowRoot.h b/dom/base/nsPIWindowRoot.h
index e37802f67f..f040318384 100644
--- a/dom/base/nsPIWindowRoot.h
+++ b/dom/base/nsPIWindowRoot.h
@@ -9,14 +9,21 @@
 
 #include "nsISupports.h"
 #include "mozilla/dom/EventTarget.h"
+#include "nsWeakReference.h"
 
 class nsPIDOMWindow;
 class nsIControllers;
 class nsIController;
 
+namespace mozilla {
+namespace dom {
+class TabParent;
+}
+}
+
 #define NS_IWINDOWROOT_IID \
-{ 0x728a2682, 0x55c0, 0x4860, \
- { 0x82, 0x6b, 0x0c, 0x30, 0x0a, 0xac, 0xaa, 0x60 } }
+{ 0x238edca0, 0xb30d, 0x46d3, \
+ { 0xb2, 0x6a, 0x17, 0xb6, 0x21, 0x28, 0x89, 0x7e } }
 
 class nsPIWindowRoot : public mozilla::dom::EventTarget
 {
@@ -38,6 +45,15 @@ public:
 
   virtual void SetParentTarget(mozilla::dom::EventTarget* aTarget) = 0;
   virtual mozilla::dom::EventTarget* GetParentTarget() = 0;
+
+  // Stores a weak reference to the browser.
+  virtual void AddBrowser(mozilla::dom::TabParent* aBrowser) = 0;
+  virtual void RemoveBrowser(mozilla::dom::TabParent* aBrowser) = 0;
+
+  typedef void (*BrowserEnumerator)(mozilla::dom::TabParent* aTab, void* aArg);
+
+  // Enumerate all stored browsers that for which the weak reference is valid.
+  virtual void EnumerateBrowsers(BrowserEnumerator aEnumFunc, void* aArg) = 0;
 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsPIWindowRoot, NS_IWINDOWROOT_IID)
diff --git a/dom/base/nsWindowRoot.cpp b/dom/base/nsWindowRoot.cpp
index 7b85a089a7..c5d7e231b7 100644
--- a/dom/base/nsWindowRoot.cpp
+++ b/dom/base/nsWindowRoot.cpp
@@ -24,6 +24,7 @@
 #include "nsIController.h"
 #include "xpcpublic.h"
 #include "nsCycleCollectionParticipant.h"
+#include "mozilla/dom/TabParent.h"
 
 #ifdef MOZ_XUL
 #include "nsIDOMXULElement.h"
@@ -385,6 +386,46 @@ nsWindowRoot::WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto)
   return mozilla::dom::WindowRootBinding::Wrap(aCx, this, aGivenProto);
 }
 
+void
+nsWindowRoot::AddBrowser(mozilla::dom::TabParent* aBrowser)
+{
+  nsWeakPtr weakBrowser = do_GetWeakReference(static_cast<nsITabParent*>(aBrowser));
+  mWeakBrowsers.PutEntry(weakBrowser);
+}
+
+void
+nsWindowRoot::RemoveBrowser(mozilla::dom::TabParent* aBrowser)
+{
+  nsWeakPtr weakBrowser = do_GetWeakReference(static_cast<nsITabParent*>(aBrowser));
+  mWeakBrowsers.RemoveEntry(weakBrowser);
+}
+
+static PLDHashOperator
+WeakBrowserEnumFunc(nsRefPtrHashKey<nsIWeakReference>* aKey, void* aArg)
+{
+  nsTArray<nsRefPtr<TabParent>>* tabParents =
+    static_cast<nsTArray<nsRefPtr<TabParent>>*>(aArg);
+  nsCOMPtr<nsITabParent> tabParent(do_QueryReferent((*aKey).GetKey()));
+  TabParent* tab = TabParent::GetFrom(tabParent);
+  if (tab) {
+    tabParents->AppendElement(tab);
+  }
+  return PL_DHASH_NEXT;
+}
+
+void
+nsWindowRoot::EnumerateBrowsers(BrowserEnumerator aEnumFunc, void* aArg)
+{
+  // Collect strong references to all browsers in a separate array in
+  // case aEnumFunc alters mWeakBrowsers.
+  nsTArray<nsRefPtr<TabParent>> tabParents;
+  mWeakBrowsers.EnumerateEntries(WeakBrowserEnumFunc, &tabParents);
+
+  for (uint32_t i = 0; i < tabParents.Length(); ++i) {
+    aEnumFunc(tabParents[i], aArg);
+  }
+}
+
 ///////////////////////////////////////////////////////////////////////////////////
 
 already_AddRefed<EventTarget>
diff --git a/dom/base/nsWindowRoot.h b/dom/base/nsWindowRoot.h
index 49686ad3ee..7113399709 100644
--- a/dom/base/nsWindowRoot.h
+++ b/dom/base/nsWindowRoot.h
@@ -69,6 +69,10 @@ public:
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_AMBIGUOUS(nsWindowRoot,
                                                          nsIDOMEventTarget)
 
+  virtual void AddBrowser(mozilla::dom::TabParent* aBrowser);
+  virtual void RemoveBrowser(mozilla::dom::TabParent* aBrowser);
+  virtual void EnumerateBrowsers(BrowserEnumerator aEnumFunc, void *aArg);
+
 protected:
   virtual ~nsWindowRoot();
 
@@ -84,6 +88,10 @@ protected:
   nsCOMPtr<nsIDOMNode> mPopupNode; // [OWNER]
 
   nsCOMPtr<mozilla::dom::EventTarget> mParent;
+
+  // The TabParents that are currently registered with this top-level window.
+  typedef nsTHashtable<nsRefPtrHashKey<nsIWeakReference>> WeakBrowserTable;
+  WeakBrowserTable mWeakBrowsers;
 };
 
 extern already_AddRefed<mozilla::dom::EventTarget>
diff --git a/dom/bindings/Bindings.conf b/dom/bindings/Bindings.conf
index a5113329db..f0affd086a 100644
--- a/dom/bindings/Bindings.conf
+++ b/dom/bindings/Bindings.conf
@@ -497,6 +497,10 @@ DOMInterfaces = {
     'wrapperCache': False,
 },
 
+'FontFaceSet': {
+    'implicitJSContext': [ 'load' ],
+},
+
 'FontFaceSetIterator': {
     'wrapperCache': False,
 },
diff --git a/dom/html/HTMLLinkElement.cpp b/dom/html/HTMLLinkElement.cpp
index 2b2422227d..d927b334cf 100644
--- a/dom/html/HTMLLinkElement.cpp
+++ b/dom/html/HTMLLinkElement.cpp
@@ -316,7 +316,7 @@ HTMLLinkElement::UpdatePreconnect()
   if (owner) {
     nsCOMPtr<nsIURI> uri = GetHrefURI();
     if (uri) {
-      owner->MaybePreconnect(uri);
+        owner->MaybePreconnect(uri, GetCORSMode());
     }
   }
 }
diff --git a/dom/ipc/TabParent.cpp b/dom/ipc/TabParent.cpp
index d21f5c81b7..236f28e6df 100644
--- a/dom/ipc/TabParent.cpp
+++ b/dom/ipc/TabParent.cpp
@@ -334,9 +334,27 @@ TabParent::SetOwnerElement(Element* aElement)
   // If we held previous content then unregister for its events.
   RemoveWindowListeners();
 
+  // If we change top-level documents then we need to change our
+  // registration with them.
+  nsRefPtr<nsPIWindowRoot> curTopLevelWin, newTopLevelWin;
+  if (mFrameElement) {
+    curTopLevelWin = nsContentUtils::GetWindowRoot(mFrameElement->OwnerDoc());
+  }
+  if (aElement) {
+    newTopLevelWin = nsContentUtils::GetWindowRoot(aElement->OwnerDoc());
+  }
+  bool isSameTopLevelWin = curTopLevelWin == newTopLevelWin;
+  if (curTopLevelWin && !isSameTopLevelWin) {
+    curTopLevelWin->RemoveBrowser(this);
+  }
+
   // Update to the new content, and register to listen for events from it.
   mFrameElement = aElement;
 
+  if (newTopLevelWin && !isSameTopLevelWin) {
+    newTopLevelWin->AddBrowser(this);
+  }
+
   AddWindowListeners();
   TryCacheDPIAndScale();
 }
@@ -1003,6 +1021,7 @@ TabParent::UIResolutionChanged()
     // TryCacheDPIAndScale()'s cache is keyed off of
     // mDPI being greater than 0, so this invalidates it.
     mDPI = -1;
+    TryCacheDPIAndScale();
     unused << SendUIResolutionChanged();
   }
 }
diff --git a/dom/media/MediaDecoderReader.cpp b/dom/media/MediaDecoderReader.cpp
index f5ba3bdccb..e918f93f78 100644
--- a/dom/media/MediaDecoderReader.cpp
+++ b/dom/media/MediaDecoderReader.cpp
@@ -60,14 +60,18 @@ public:
   size_t mSize;
 };
 
-MediaDecoderReader::MediaDecoderReader(AbstractMediaDecoder* aDecoder)
+MediaDecoderReader::MediaDecoderReader(AbstractMediaDecoder* aDecoder,
+                                       MediaTaskQueue* aBorrowedTaskQueue)
   : mAudioCompactor(mAudioQueue)
   , mDecoder(aDecoder)
+  , mTaskQueue(aBorrowedTaskQueue ? aBorrowedTaskQueue
+                                  : new MediaTaskQueue(GetMediaThreadPool(MediaThreadType::PLAYBACK),
+                                                       /* aSupportsTailDispatch = */ true))
   , mIgnoreAudioOutputFormat(false)
   , mStartTime(-1)
   , mHitAudioDecodeError(false)
   , mShutdown(false)
-  , mTaskQueueIsBorrowed(false)
+  , mTaskQueueIsBorrowed(!!aBorrowedTaskQueue)
   , mAudioDiscontinuity(false)
   , mVideoDiscontinuity(false)
 {
@@ -330,19 +334,6 @@ MediaDecoderReader::RequestAudioData()
   return p;
 }
 
-MediaTaskQueue*
-MediaDecoderReader::EnsureTaskQueue()
-{
-  if (!mTaskQueue) {
-    MOZ_ASSERT(!mTaskQueueIsBorrowed);
-    RefPtr<SharedThreadPool> pool(GetMediaThreadPool(MediaThreadType::PLAYBACK));
-    MOZ_DIAGNOSTIC_ASSERT(pool);
-    mTaskQueue = new MediaTaskQueue(pool.forget());
-  }
-
-  return mTaskQueue;
-}
-
 void
 MediaDecoderReader::BreakCycles()
 {
diff --git a/dom/media/MediaDecoderReader.h b/dom/media/MediaDecoderReader.h
index 1defdfd4f1..ef7bd661ba 100644
--- a/dom/media/MediaDecoderReader.h
+++ b/dom/media/MediaDecoderReader.h
@@ -79,7 +79,7 @@ public:
 
   // The caller must ensure that Shutdown() is called before aDecoder is
   // destroyed.
-  explicit MediaDecoderReader(AbstractMediaDecoder* aDecoder);
+  explicit MediaDecoderReader(AbstractMediaDecoder* aDecoder, MediaTaskQueue* aBorrowedTaskQueue = nullptr);
 
   // Initializes the reader, returns NS_OK on success, or NS_ERROR_FAILURE
   // on failure.
@@ -107,18 +107,9 @@ public:
   // thread.
   virtual nsRefPtr<ShutdownPromise> Shutdown();
 
-  MediaTaskQueue* EnsureTaskQueue();
-
   virtual bool OnTaskQueue()
   {
-    return !GetTaskQueue() || GetTaskQueue()->IsCurrentThreadIn();
-  }
-
-  void SetBorrowedTaskQueue(MediaTaskQueue* aTaskQueue)
-  {
-    MOZ_ASSERT(!mTaskQueue && aTaskQueue);
-    mTaskQueue = aTaskQueue;
-    mTaskQueueIsBorrowed = true;
+    return GetTaskQueue()->IsCurrentThreadIn();
   }
 
   // Resets all state related to decoding, emptying all buffers etc.
@@ -323,6 +314,9 @@ protected:
   // Reference to the owning decoder object.
   AbstractMediaDecoder* mDecoder;
 
+  // Decode task queue.
+  nsRefPtr<MediaTaskQueue> mTaskQueue;
+
   // Stores presentation info required for playback.
   MediaInfo mInfo;
 
@@ -356,7 +350,6 @@ private:
   MediaPromiseHolder<AudioDataPromise> mBaseAudioPromise;
   MediaPromiseHolder<VideoDataPromise> mBaseVideoPromise;
 
-  nsRefPtr<MediaTaskQueue> mTaskQueue;
   bool mTaskQueueIsBorrowed;
 
   // Flags whether a the next audio/video sample comes after a "gap" or
diff --git a/dom/media/MediaDecoderStateMachine.cpp b/dom/media/MediaDecoderStateMachine.cpp
index bd4f3a46c5..d04ce7f840 100644
--- a/dom/media/MediaDecoderStateMachine.cpp
+++ b/dom/media/MediaDecoderStateMachine.cpp
@@ -180,7 +180,7 @@ MediaDecoderStateMachine::MediaDecoderStateMachine(MediaDecoder* aDecoder,
                                                    bool aRealTime) :
   mDecoder(aDecoder),
   mTaskQueue(new MediaTaskQueue(GetMediaThreadPool(MediaThreadType::PLAYBACK),
-                                /* aAssertTailDispatch = */ true)),
+                                /* aSupportsTailDispatch = */ true)),
   mWatchManager(this, mTaskQueue),
   mRealTime(aRealTime),
   mDispatchedStateMachine(false),
@@ -284,8 +284,6 @@ MediaDecoderStateMachine::~MediaDecoderStateMachine()
 {
   MOZ_ASSERT(NS_IsMainThread(), "Should be on main thread.");
   MOZ_COUNT_DTOR(MediaDecoderStateMachine);
-  NS_ASSERTION(!mPendingWakeDecoder.get(),
-               "WakeDecoder should have been revoked already");
 
   mReader = nullptr;
 
@@ -461,8 +459,6 @@ void MediaDecoderStateMachine::SendStreamData()
         AudioSegment* audio = new AudioSegment();
         mediaStream->AddAudioTrack(audioTrackId, mInfo.mAudio.mRate, 0, audio,
                                    SourceMediaStream::ADDTRACK_QUEUED);
-        stream->mStream->DispatchWhenNotEnoughBuffered(audioTrackId,
-            TaskQueue(), GetWakeDecoderRunnable());
         stream->mNextAudioTime = mStreamStartTime;
       }
       if (mInfo.HasVideo()) {
@@ -470,9 +466,6 @@ void MediaDecoderStateMachine::SendStreamData()
         VideoSegment* video = new VideoSegment();
         mediaStream->AddTrack(videoTrackId, 0, video,
                               SourceMediaStream::ADDTRACK_QUEUED);
-        stream->mStream->DispatchWhenNotEnoughBuffered(videoTrackId,
-            TaskQueue(), GetWakeDecoderRunnable());
-
         stream->mNextVideoTime = mStreamStartTime;
       }
       mediaStream->FinishAddTracks();
@@ -601,18 +594,6 @@ void MediaDecoderStateMachine::SendStreamData()
   }
 }
 
-MediaDecoderStateMachine::WakeDecoderRunnable*
-MediaDecoderStateMachine::GetWakeDecoderRunnable()
-{
-  MOZ_ASSERT(OnTaskQueue());
-  AssertCurrentThreadInMonitor();
-
-  if (!mPendingWakeDecoder.get()) {
-    mPendingWakeDecoder = new WakeDecoderRunnable(this);
-  }
-  return mPendingWakeDecoder.get();
-}
-
 bool MediaDecoderStateMachine::HaveEnoughDecodedAudio(int64_t aAmpleAudioUSecs)
 {
   MOZ_ASSERT(OnTaskQueue());
@@ -634,8 +615,6 @@ bool MediaDecoderStateMachine::HaveEnoughDecodedAudio(int64_t aAmpleAudioUSecs)
     if (!stream->mStream->HaveEnoughBuffered(audioTrackId)) {
       return false;
     }
-    stream->mStream->DispatchWhenNotEnoughBuffered(audioTrackId,
-        TaskQueue(), GetWakeDecoderRunnable());
   }
 
   return true;
@@ -658,8 +637,6 @@ bool MediaDecoderStateMachine::HaveEnoughDecodedVideo()
     if (!stream->mStream->HaveEnoughBuffered(videoTrackId)) {
       return false;
     }
-    stream->mStream->DispatchWhenNotEnoughBuffered(videoTrackId,
-        TaskQueue(), GetWakeDecoderRunnable());
   }
 
   return true;
@@ -1256,10 +1233,6 @@ nsresult MediaDecoderStateMachine::Init(MediaDecoderStateMachine* aCloneDonor)
 {
   MOZ_ASSERT(NS_IsMainThread());
 
-  if (NS_WARN_IF(!mReader->EnsureTaskQueue())) {
-    return NS_ERROR_FAILURE;
-  }
-
   MediaDecoderReader* cloneReader = nullptr;
   if (aCloneDonor) {
     cloneReader = aCloneDonor->mReader;
@@ -1554,8 +1527,6 @@ void MediaDecoderStateMachine::SetDormant(bool aDormant)
     // it here as well.
     nsCOMPtr<nsIRunnable> r = NS_NewRunnableMethod(mReader, &MediaDecoderReader::ReleaseMediaResources);
     DecodeTaskQueue()->Dispatch(r.forget());
-    // There's now no possibility of mPendingWakeDecoder being needed again. Revoke it.
-    mPendingWakeDecoder = nullptr;
     mDecoder->GetReentrantMonitor().NotifyAll();
   } else if ((aDormant != true) && (mState == DECODER_STATE_DORMANT)) {
     mDecodingFrozenAtStateDecoding = true;
@@ -1880,7 +1851,7 @@ MediaDecoderStateMachine::InitiateSeek()
   seekTime = std::min(seekTime, end);
   seekTime = std::max(mStartTime, seekTime);
   NS_ASSERTION(seekTime >= mStartTime && seekTime <= end,
-  "Can only seek in range [0,duration]");
+               "Can only seek in range [0,duration]");
   mCurrentSeek.mTarget.mTime = seekTime;
 
   if (mAudioCaptured) {
@@ -2551,10 +2522,6 @@ MediaDecoderStateMachine::FinishShutdown()
   AudioQueue().ClearListeners();
   VideoQueue().ClearListeners();
 
-  // Now that those threads are stopped, there's no possibility of
-  // mPendingWakeDecoder being needed again. Revoke it.
-  mPendingWakeDecoder = nullptr;
-
   // Disconnect canonicals and mirrors before shutting down our task queue.
   mEstimatedDuration.DisconnectIfConnected();
   mExplicitDuration.DisconnectIfConnected();
@@ -3022,11 +2989,7 @@ void MediaDecoderStateMachine::AdvanceFrame()
     int64_t delta = currentFrame->mTime - clock_time;
     TimeStamp presTime = nowTime + TimeDuration::FromMicroseconds(delta / mPlaybackRate);
     NS_ASSERTION(currentFrame->mTime >= mStartTime, "Should have positive frame time");
-    // Filter out invalid frames by checking the frame time. FrameTime could be
-    // zero if it's a initial frame.
-    int64_t frameTime = currentFrame->mTime - mStartTime;
-    if (frameTime > 0  || (frameTime == 0 && mPlayDuration == 0) ||
-        IsRealTime()) {
+    {
       ReentrantMonitorAutoExit exitMon(mDecoder->GetReentrantMonitor());
       // If we have video, we want to increment the clock in steps of the frame
       // duration.
diff --git a/dom/media/MediaDecoderStateMachine.h b/dom/media/MediaDecoderStateMachine.h
index 200190f463..d05429c251 100644
--- a/dom/media/MediaDecoderStateMachine.h
+++ b/dom/media/MediaDecoderStateMachine.h
@@ -422,41 +422,6 @@ protected:
   void LogicalPlaybackRateChanged();
   void PreservesPitchChanged();
 
-  class WakeDecoderRunnable : public nsRunnable {
-  public:
-    explicit WakeDecoderRunnable(MediaDecoderStateMachine* aSM)
-      : mMutex("WakeDecoderRunnable"), mStateMachine(aSM) {}
-    NS_IMETHOD Run() override
-    {
-      nsRefPtr<MediaDecoderStateMachine> stateMachine;
-      {
-        // Don't let Run() (called by media stream graph thread) race with
-        // Revoke() (called by decoder state machine thread)
-        MutexAutoLock lock(mMutex);
-        if (!mStateMachine)
-          return NS_OK;
-        stateMachine = mStateMachine;
-      }
-      stateMachine->ScheduleStateMachineWithLockAndWakeDecoder();
-      return NS_OK;
-    }
-    void Revoke()
-    {
-      MutexAutoLock lock(mMutex);
-      mStateMachine = nullptr;
-    }
-
-    Mutex mMutex;
-    // Protected by mMutex.
-    // We don't use an owning pointer here, because keeping mStateMachine alive
-    // would mean in some cases we'd have to destroy mStateMachine from this
-    // object, which would be problematic since MediaDecoderStateMachine can
-    // only be destroyed on the main thread whereas this object can be destroyed
-    // on the media stream graph thread.
-    MediaDecoderStateMachine* mStateMachine;
-  };
-  WakeDecoderRunnable* GetWakeDecoderRunnable();
-
   MediaQueue<AudioData>& AudioQueue() { return mAudioQueue; }
   MediaQueue<VideoData>& VideoQueue() { return mVideoQueue; }
 
@@ -1098,13 +1063,6 @@ protected:
   // This is created in the state machine's constructor.
   nsRefPtr<MediaDecoderReader> mReader;
 
-  // Accessed only on the state machine thread.
-  // Not an nsRevocableEventPtr since we must Revoke() it well before
-  // this object is destroyed, anyway.
-  // Protected by decoder monitor except during the SHUTDOWN state after the
-  // decoder thread has been stopped.
-  nsRevocableEventPtr<WakeDecoderRunnable> mPendingWakeDecoder;
-
   // The time of the current frame in microseconds, corresponding to the "current
   // playback position" in HTML5. This is referenced from 0, which is the initial
   // playback position.
diff --git a/dom/media/MediaFormatReader.cpp b/dom/media/MediaFormatReader.cpp
index a4c1046def..bba142b990 100644
--- a/dom/media/MediaFormatReader.cpp
+++ b/dom/media/MediaFormatReader.cpp
@@ -64,8 +64,9 @@ TrackTypeToStr(TrackInfo::TrackType aTrack)
 #endif
 
 MediaFormatReader::MediaFormatReader(AbstractMediaDecoder* aDecoder,
-                                       MediaDataDemuxer* aDemuxer)
-  : MediaDecoderReader(aDecoder)
+                                     MediaDataDemuxer* aDemuxer,
+                                     MediaTaskQueue* aBorrowedTaskQueue)
+  : MediaDecoderReader(aDecoder, aBorrowedTaskQueue)
   , mDemuxer(aDemuxer)
   , mAudio(this, MediaData::AUDIO_DATA, Preferences::GetUint("media.audio-decode-ahead", 2))
   , mVideo(this, MediaData::VIDEO_DATA, Preferences::GetUint("media.video-decode-ahead", 2))
diff --git a/dom/media/MediaFormatReader.h b/dom/media/MediaFormatReader.h
index d54553adab..e0c0c3fc4e 100644
--- a/dom/media/MediaFormatReader.h
+++ b/dom/media/MediaFormatReader.h
@@ -30,7 +30,8 @@ class MediaFormatReader final : public MediaDecoderReader
 
 public:
   explicit MediaFormatReader(AbstractMediaDecoder* aDecoder,
-                               MediaDataDemuxer* aDemuxer);
+                             MediaDataDemuxer* aDemuxer,
+                             MediaTaskQueue* aBorrowedTaskQueue = nullptr);
 
   virtual ~MediaFormatReader();
 
diff --git a/dom/media/fmp4/MP4Reader.cpp b/dom/media/fmp4/MP4Reader.cpp
index 5a72908e46..7b7a27e448 100644
--- a/dom/media/fmp4/MP4Reader.cpp
+++ b/dom/media/fmp4/MP4Reader.cpp
@@ -141,8 +141,8 @@ InvokeAndRetry(ThisType* aThisVal, ReturnType(ThisType::*aMethod)(), MP4Stream*
   }
 }
 
-MP4Reader::MP4Reader(AbstractMediaDecoder* aDecoder)
-  : MediaDecoderReader(aDecoder)
+MP4Reader::MP4Reader(AbstractMediaDecoder* aDecoder, MediaTaskQueue* aBorrowedTaskQueue)
+  : MediaDecoderReader(aDecoder, aBorrowedTaskQueue)
   , mAudio(MediaData::AUDIO_DATA, Preferences::GetUint("media.mp4-audio-decode-ahead", 2))
   , mVideo(MediaData::VIDEO_DATA, Preferences::GetUint("media.mp4-video-decode-ahead", 2))
   , mLastReportedNumDecodedFrames(0)
diff --git a/dom/media/fmp4/MP4Reader.h b/dom/media/fmp4/MP4Reader.h
index c58ae055d9..4d1473997a 100644
--- a/dom/media/fmp4/MP4Reader.h
+++ b/dom/media/fmp4/MP4Reader.h
@@ -34,7 +34,7 @@ class MP4Reader final : public MediaDecoderReader
   typedef TrackInfo::TrackType TrackType;
 
 public:
-  explicit MP4Reader(AbstractMediaDecoder* aDecoder);
+  explicit MP4Reader(AbstractMediaDecoder* aDecoder, MediaTaskQueue* aBorrowedTaskQueue = nullptr);
 
   virtual ~MP4Reader();
 
diff --git a/dom/media/gtest/TestMP4Reader.cpp b/dom/media/gtest/TestMP4Reader.cpp
index a76e1f8a2d..617aa00f78 100644
--- a/dom/media/gtest/TestMP4Reader.cpp
+++ b/dom/media/gtest/TestMP4Reader.cpp
@@ -36,7 +36,6 @@ public:
     decoder->SetResource(resource);
 
     reader->Init(nullptr);
-    reader->EnsureTaskQueue();
     {
       // This needs to be done before invoking GetBuffered. This is normally
       // done by MediaDecoderStateMachine.
diff --git a/dom/media/mediasource/MediaSourceReader.cpp b/dom/media/mediasource/MediaSourceReader.cpp
index af9cfb50be..affae3b722 100644
--- a/dom/media/mediasource/MediaSourceReader.cpp
+++ b/dom/media/mediasource/MediaSourceReader.cpp
@@ -658,7 +658,8 @@ MediaSourceReader::ReleaseMediaResources()
 }
 
 MediaDecoderReader*
-CreateReaderForType(const nsACString& aType, AbstractMediaDecoder* aDecoder)
+CreateReaderForType(const nsACString& aType, AbstractMediaDecoder* aDecoder,
+                    MediaTaskQueue* aBorrowedTaskQueue)
 {
 #ifdef MOZ_FMP4
   // The MP4Reader that supports fragmented MP4 and uses
@@ -671,15 +672,15 @@ CreateReaderForType(const nsACString& aType, AbstractMediaDecoder* aDecoder)
     bool useFormatDecoder =
       Preferences::GetBool("media.mediasource.format-reader.mp4", true);
     MediaDecoderReader* reader = useFormatDecoder ?
-      static_cast<MediaDecoderReader*>(new MediaFormatReader(aDecoder, new MP4Demuxer(aDecoder->GetResource()))) :
-      static_cast<MediaDecoderReader*>(new MP4Reader(aDecoder));
+      static_cast<MediaDecoderReader*>(new MediaFormatReader(aDecoder, new MP4Demuxer(aDecoder->GetResource()), aBorrowedTaskQueue)) :
+      static_cast<MediaDecoderReader*>(new MP4Reader(aDecoder, aBorrowedTaskQueue));
     return reader;
   }
 #endif
 
 #ifdef MOZ_WEBM
   if (DecoderTraits::IsWebMType(aType)) {
-    return new WebMReader(aDecoder);
+    return new WebMReader(aDecoder, aBorrowedTaskQueue);
   }
 #endif
 
@@ -692,10 +693,17 @@ MediaSourceReader::CreateSubDecoder(const nsACString& aType, int64_t aTimestampO
   if (IsShutdown()) {
     return nullptr;
   }
-  MOZ_ASSERT(GetTaskQueue());
+
+  // The task queue borrowing is icky. It would be nicer to just give each subreader
+  // its own task queue. Unfortunately though, Request{Audio,Video}Data implementations
+  // currently assert that they're on "the decode thread", and so having
+  // separate task queues makes MediaSource stuff unnecessarily cumbersome. We
+  // should remove the need for these assertions (which probably involves making
+  // all Request*Data implementations fully async), and then get rid of the
+  // borrowing.
   nsRefPtr<SourceBufferDecoder> decoder =
     new SourceBufferDecoder(new SourceBufferResource(aType), mDecoder, aTimestampOffset);
-  nsRefPtr<MediaDecoderReader> reader(CreateReaderForType(aType, decoder));
+  nsRefPtr<MediaDecoderReader> reader(CreateReaderForType(aType, decoder, GetTaskQueue()));
   if (!reader) {
     return nullptr;
   }
@@ -708,15 +716,6 @@ MediaSourceReader::CreateSubDecoder(const nsACString& aType, int64_t aTimestampO
     reader->SetStartTime(0);
   }
 
-  // This part is icky. It would be nicer to just give each subreader its own
-  // task queue. Unfortunately though, Request{Audio,Video}Data implementations
-  // currently assert that they're on "the decode thread", and so having
-  // separate task queues makes MediaSource stuff unnecessarily cumbersome. We
-  // should remove the need for these assertions (which probably involves making
-  // all Request*Data implementations fully async), and then get rid of the
-  // borrowing.
-  reader->SetBorrowedTaskQueue(GetTaskQueue());
-
 #ifdef MOZ_FMP4
   reader->SetSharedDecoderManager(mSharedDecoderManager);
 #endif
diff --git a/dom/media/webaudio/MediaBufferDecoder.cpp b/dom/media/webaudio/MediaBufferDecoder.cpp
index 382af0e21d..769a22f61b 100644
--- a/dom/media/webaudio/MediaBufferDecoder.cpp
+++ b/dom/media/webaudio/MediaBufferDecoder.cpp
@@ -211,10 +211,6 @@ MediaDecodeTask::CreateReader()
     return false;
   }
 
-  if (!mDecoderReader->EnsureTaskQueue()) {
-    return false;
-  }
-
   return true;
 }
 
diff --git a/dom/media/webaudio/test/test_mediaElementAudioSourceNodeCrossOrigin.html b/dom/media/webaudio/test/test_mediaElementAudioSourceNodeCrossOrigin.html
index 3ffef389e1..7d5b4a206d 100644
--- a/dom/media/webaudio/test/test_mediaElementAudioSourceNodeCrossOrigin.html
+++ b/dom/media/webaudio/test/test_mediaElementAudioSourceNodeCrossOrigin.html
@@ -11,6 +11,9 @@
 <script class="testbody" type="text/javascript">
 SimpleTest.waitForExplicitFinish();
 
+// Turn off the authentication dialog blocking for this test.
+SpecialPowers.setIntPref("network.auth.allow-subresource-auth", 2)
+
 var tests = [
   // Not the same origin no CORS asked for, should have silence
   { url: "http://example.org:80/tests/dom/media/webaudio/test/small-shot.ogg",
diff --git a/dom/media/webm/WebMReader.cpp b/dom/media/webm/WebMReader.cpp
index e24a50a999..feea2faf6c 100644
--- a/dom/media/webm/WebMReader.cpp
+++ b/dom/media/webm/WebMReader.cpp
@@ -144,8 +144,8 @@ static void webm_log(nestegg * context,
 static bool sIsIntelDecoderEnabled = false;
 #endif
 
-WebMReader::WebMReader(AbstractMediaDecoder* aDecoder)
-  : MediaDecoderReader(aDecoder)
+WebMReader::WebMReader(AbstractMediaDecoder* aDecoder, MediaTaskQueue* aBorrowedTaskQueue)
+  : MediaDecoderReader(aDecoder, aBorrowedTaskQueue)
   , mContext(nullptr)
   , mVideoTrack(0)
   , mAudioTrack(0)
diff --git a/dom/media/webm/WebMReader.h b/dom/media/webm/WebMReader.h
index 71a8c89b3d..9c7de6bb8c 100644
--- a/dom/media/webm/WebMReader.h
+++ b/dom/media/webm/WebMReader.h
@@ -59,7 +59,7 @@ public:
 class WebMReader : public MediaDecoderReader
 {
 public:
-  explicit WebMReader(AbstractMediaDecoder* aDecoder);
+  explicit WebMReader(AbstractMediaDecoder* aDecoder, MediaTaskQueue* aBorrowedTaskQueue = nullptr);
 
 protected:
   ~WebMReader();
diff --git a/dom/webidl/FontFaceSet.webidl b/dom/webidl/FontFaceSet.webidl
index d1671efd6f..7f58fbe5e4 100644
--- a/dom/webidl/FontFaceSet.webidl
+++ b/dom/webidl/FontFaceSet.webidl
@@ -36,7 +36,7 @@ interface FontFaceSet : EventTarget {
   readonly attribute unsigned long size;
   [Throws] void add(FontFace font);
   boolean has(FontFace font);
-  [Throws] boolean delete(FontFace font);
+  boolean delete(FontFace font);
   void clear();
   [NewObject] FontFaceSetIterator entries();
   // Iterator keys();
@@ -50,13 +50,11 @@ interface FontFaceSet : EventTarget {
 
   // check and start loads if appropriate
   // and fulfill promise when all loads complete
-  // Not implemented yet: bug 1072102.
-  [Throws] Promise<sequence<FontFace>> load(DOMString font, optional DOMString text = " ");
+  [NewObject] Promise<sequence<FontFace>> load(DOMString font, optional DOMString text = " ");
 
   // return whether all fonts in the fontlist are loaded
   // (does not initiate load if not available)
-  // Not implemented yet: bug 1072102.
-  // [Throws] boolean check(DOMString font, optional DOMString text = " ");
+  [Throws] boolean check(DOMString font, optional DOMString text = " ");
 
   // async notification that font loading and layout operations are done
   [Throws] readonly attribute Promise<void> ready;
diff --git a/dom/webidl/FontFaceSource.webidl b/dom/webidl/FontFaceSource.webidl
index e16f943f5a..96e1c6d76d 100644
--- a/dom/webidl/FontFaceSource.webidl
+++ b/dom/webidl/FontFaceSource.webidl
@@ -13,6 +13,6 @@
 [NoInterfaceObject]
 interface FontFaceSource {
 
-  [Throws, Pref="layout.css.font-loading-api.enabled"]
+  [Pref="layout.css.font-loading-api.enabled"]
   readonly attribute FontFaceSet fonts;
 };
diff --git a/dom/workers/test/serviceworkers/fetch/context/index.html b/dom/workers/test/serviceworkers/fetch/context/index.html
index f9cd45da2a..b78569317b 100644
--- a/dom/workers/test/serviceworkers/fetch/context/index.html
+++ b/dom/workers/test/serviceworkers/fetch/context/index.html
@@ -11,6 +11,10 @@
     ok(a === b, msg + ", expected '" + b + "', got '" + a + "'");
   }
 
+  function todo(v, msg) {
+    window.parent.postMessage({status: "todo", result: !!v, message: msg}, "*");
+  }
+
   function finish() {
     window.parent.postMessage({status: "done"}, "*");
   }
@@ -114,6 +118,10 @@
   }
 
   function testEmbed() {
+    return Promise.resolve().then(function() {
+      todo(false, "<embed> tag is not currently intercepted. See Bug 1168676.");
+    });
+
     return new Promise(function(resolve, reject) {
       var embed = document.createElement("embed");
       embed.src = "embed";
@@ -130,6 +138,10 @@
   }
 
   function testObject() {
+    return Promise.resolve().then(function() {
+      todo(false, "<object> tag is not currently intercepted. See Bug 1168676");
+    });
+
     return new Promise(function(resolve, reject) {
       var object = document.createElement("object");
       object.data = "object";
@@ -223,11 +235,16 @@
   }
 
   function testPlugin() {
+    return Promise.resolve().then(function() {
+      todo(false, "plugins are not currently intercepted. See Bug 1168676.");
+    });
+
     var isMobile = /Mobile|Tablet/.test(navigator.userAgent);
-    if (isMobile) {
+    if (isMobile || parent.isMulet()) {
       // We can't use plugins on mobile, so skip this part of the test there.
       return Promise.resolve();
     }
+
     return new Promise(function(resolve, reject) {
       var embed = document.createElement("embed");
       embed.type = "application/x-test";
diff --git a/dom/workers/test/serviceworkers/test_request_context.html b/dom/workers/test/serviceworkers/test_request_context.html
index db7726e94c..904859b7f2 100644
--- a/dom/workers/test/serviceworkers/test_request_context.html
+++ b/dom/workers/test/serviceworkers/test_request_context.html
@@ -49,6 +49,14 @@
   }
   setTestPluginEnabledState(SpecialPowers.Ci.nsIPluginTag.STATE_ENABLED);
 
+  function isMulet() {
+    try {
+      return SpecialPowers.getBoolPref("b2g.is_mulet");
+    } catch(e) {
+      return false;
+    }
+  }
+
   var iframe;
   function runTest() {
     iframe = document.querySelector("iframe");
@@ -56,6 +64,8 @@
     window.onmessage = function(e) {
       if (e.data.status == "ok") {
         ok(e.data.result, e.data.message);
+      } else if (e.data.status == "todo") {
+        todo(e.data.result, e.data.message);
       } else if (e.data.status == "registrationdone") {
         iframe.src = "/tests/dom/workers/test/serviceworkers/fetch/context/index.html";
       } else if (e.data.status == "done") {
diff --git a/gfx/thebes/gfxFontConstants.h b/gfx/thebes/gfxFontConstants.h
index a995dd82ac..31d038ba69 100644
--- a/gfx/thebes/gfxFontConstants.h
+++ b/gfx/thebes/gfxFontConstants.h
@@ -19,6 +19,7 @@
 
 #define NS_FONT_WEIGHT_NORMAL           400
 #define NS_FONT_WEIGHT_BOLD             700
+#define NS_FONT_WEIGHT_THIN             100
 
 #define NS_FONT_STRETCH_ULTRA_CONDENSED (-4)
 #define NS_FONT_STRETCH_EXTRA_CONDENSED (-3)
diff --git a/layout/base/nsPresContext.cpp b/layout/base/nsPresContext.cpp
index 2da36181d0..9f08fafca8 100644
--- a/layout/base/nsPresContext.cpp
+++ b/layout/base/nsPresContext.cpp
@@ -248,7 +248,6 @@ nsPresContext::nsPresContext(nsIDocument* aDocument, nsPresContextType aType)
     mNeverAnimate = false;
   }
   NS_ASSERTION(mDocument, "Null document");
-  mFontFaceSetDirty = true;
 
   mCounterStylesDirty = true;
 
@@ -1117,11 +1116,6 @@ nsPresContext::Init(nsDeviceContext* aDeviceContext)
 void
 nsPresContext::SetShell(nsIPresShell* aShell)
 {
-  if (mFontFaceSet) {
-    // Clear out user font set if we have one
-    mFontFaceSet->DestroyUserFontSet();
-    mFontFaceSet = nullptr;
-  }
   if (mCounterStyleManager) {
     mCounterStyleManager->Disconnect();
     mCounterStyleManager = nullptr;
@@ -1659,7 +1653,7 @@ nsPresContext::SetBidi(uint32_t aSource, bool aForceRestyle)
   if (aForceRestyle && mShell) {
     // Reconstruct the root document element's frame and its children,
     // because we need to trigger frame reconstruction for direction change.
-    RebuildUserFontSet();
+    mDocument->RebuildUserFontSet();
     mShell->ReconstructFrames();
   }
 }
@@ -1833,9 +1827,24 @@ nsPresContext::UIResolutionChangedSubdocumentCallback(nsIDocument* aDocument,
 }
 
 static void
-NotifyUIResolutionChanged(TabParent* aTabParent, void* aArg)
+NotifyTabUIResolutionChanged(TabParent* aTab, void *aArg)
 {
-  aTabParent->UIResolutionChanged();
+  aTab->UIResolutionChanged();
+}
+
+static void
+NotifyChildrenUIResolutionChanged(nsIDOMWindow* aWindow)
+{
+  nsCOMPtr<nsPIDOMWindow> piWin = do_QueryInterface(aWindow);
+  if (!piWin) {
+    return;
+  }
+  nsCOMPtr<nsIDocument> doc = piWin->GetExtantDoc();
+  nsRefPtr<nsPIWindowRoot> topLevelWin = nsContentUtils::GetWindowRoot(doc);
+  if (!topLevelWin) {
+    return;
+  }
+  topLevelWin->EnumerateBrowsers(NotifyTabUIResolutionChanged, nullptr);
 }
 
 void
@@ -1848,10 +1857,8 @@ nsPresContext::UIResolutionChangedInternal()
     AppUnitsPerDevPixelChanged();
   }
 
-  // Recursively notify all remote leaf descendants that the
-  // resolution of the user interface has changed.
-  nsContentUtils::CallOnAllRemoteChildren(mDocument->GetWindow(),
-                                          NotifyUIResolutionChanged, nullptr);
+  // Recursively notify all remote leaf descendants of the change.
+  NotifyChildrenUIResolutionChanged(mDocument->GetWindow());
 
   mDocument->EnumerateSubDocuments(UIResolutionChangedSubdocumentCallback,
                                    nullptr);
@@ -1893,7 +1900,7 @@ nsPresContext::RebuildAllStyleData(nsChangeHint aExtraHint,
   mUsesRootEMUnits = false;
   mUsesExChUnits = false;
   mUsesViewportUnits = false;
-  RebuildUserFontSet();
+  mDocument->RebuildUserFontSet();
   RebuildCounterStyles();
 
   RestyleManager()->RebuildAllStyleData(aExtraHint, aRestyleHint);
@@ -2077,115 +2084,9 @@ nsPresContext::HasAuthorSpecifiedRules(nsIFrame *aFrame, uint32_t ruleTypeMask)
 }
 
 gfxUserFontSet*
-nsPresContext::GetUserFontSetInternal()
+nsPresContext::GetUserFontSet()
 {
-  // We want to initialize the user font set lazily the first time the
-  // user asks for it, rather than building it too early and forcing
-  // rule cascade creation.  Thus we try to enforce the invariant that
-  // we *never* build the user font set until the first call to
-  // GetUserFontSet.  However, once it's been requested, we can't wait
-  // for somebody to call GetUserFontSet in order to rebuild it (see
-  // comments below in RebuildUserFontSet for why).
-#ifdef DEBUG
-  bool userFontSetGottenBefore = mGetUserFontSetCalled;
-#endif
-  // Set mGetUserFontSetCalled up front, so that FlushUserFontSet will actually
-  // flush.
-  mGetUserFontSetCalled = true;
-  if (mFontFaceSetDirty) {
-    // If this assertion fails, and there have actually been changes to
-    // @font-face rules, then we will call StyleChangeReflow in
-    // FlushUserFontSet.  If we're in the middle of reflow,
-    // that's a bad thing to do, and the caller was responsible for
-    // flushing first.  If we're not (e.g., in frame construction), it's
-    // ok.
-    NS_ASSERTION(!userFontSetGottenBefore || !mShell->IsReflowLocked(),
-                 "FlushUserFontSet should have been called first");
-    FlushUserFontSet();
-  }
-
-  if (!mFontFaceSet) {
-    return nullptr;
-  }
-
-  return mFontFaceSet->GetUserFontSet();
-}
-
-gfxUserFontSet*
-nsPresContext::GetUserFontSetExternal()
-{
-  return GetUserFontSetInternal();
-}
-
-void
-nsPresContext::FlushUserFontSet()
-{
-  if (!mShell) {
-    return; // we've been torn down
-  }
-
-  if (!mGetUserFontSetCalled) {
-    return; // No one cares about this font set yet, but we want to be careful
-            // to not unset our mFontFaceSetDirty bit, so when someone really
-            // does we'll create it.
-  }
-
-  if (mFontFaceSetDirty) {
-    if (gfxPlatform::GetPlatform()->DownloadableFontsEnabled()) {
-      nsTArray<nsFontFaceRuleContainer> rules;
-      if (!mShell->StyleSet()->AppendFontFaceRules(rules)) {
-        return;
-      }
-
-      bool changed = false;
-
-      if (!mFontFaceSet && !rules.IsEmpty()) {
-        mFontFaceSet = new FontFaceSet(mDocument->GetInnerWindow(), this);
-      }
-      if (mFontFaceSet) {
-        changed = mFontFaceSet->UpdateRules(rules);
-      }
-
-      // We need to enqueue a style change reflow (for later) to
-      // reflect that we're modifying @font-face rules.  (However,
-      // without a reflow, nothing will happen to start any downloads
-      // that are needed.)
-      if (changed) {
-        UserFontSetUpdated();
-      }
-    }
-
-    mFontFaceSetDirty = false;
-  }
-}
-
-void
-nsPresContext::RebuildUserFontSet()
-{
-  if (!mGetUserFontSetCalled) {
-    // We want to lazily build the user font set the first time it's
-    // requested (so we don't force creation of rule cascades too
-    // early), so don't do anything now.
-    return;
-  }
-
-  mFontFaceSetDirty = true;
-  mDocument->SetNeedStyleFlush();
-
-  // Somebody has already asked for the user font set, so we need to
-  // post an event to rebuild it.  Setting the user font set to be dirty
-  // and lazily rebuilding it isn't sufficient, since it is only the act
-  // of rebuilding it that will trigger the style change reflow that
-  // calls GetUserFontSet.  (This reflow causes rebuilding of text runs,
-  // which starts font loads, whose completion causes another style
-  // change reflow).
-  if (!mPostedFlushUserFontSet) {
-    nsCOMPtr<nsIRunnable> ev =
-      NS_NewRunnableMethod(this, &nsPresContext::HandleRebuildUserFontSet);
-    if (NS_SUCCEEDED(NS_DispatchToCurrentThread(ev))) {
-      mPostedFlushUserFontSet = true;
-    }
-  }
+  return mDocument->GetUserFontSet();
 }
 
 void
@@ -2233,16 +2134,6 @@ nsPresContext::UserFontSetUpdated(gfxUserFontEntry* aUpdatedFont)
   }
 }
 
-FontFaceSet*
-nsPresContext::Fonts()
-{
-  if (!mFontFaceSet) {
-    mFontFaceSet = new FontFaceSet(mDocument->GetInnerWindow(), this);
-    GetUserFontSet();  // this will cause the user font set to be created/updated
-  }
-  return mFontFaceSet;
-}
-
 void
 nsPresContext::FlushCounterStyles()
 {
@@ -2712,8 +2603,9 @@ nsPresContext::HavePendingInputEvent()
 void
 nsPresContext::NotifyFontFaceSetOnRefresh()
 {
-  if (mFontFaceSet) {
-    mFontFaceSet->DidRefresh();
+  FontFaceSet* set = mDocument->GetFonts();
+  if (set) {
+    set->DidRefresh();
   }
 }
 
diff --git a/layout/base/nsPresContext.h b/layout/base/nsPresContext.h
index cc4841d0eb..478511baaf 100644
--- a/layout/base/nsPresContext.h
+++ b/layout/base/nsPresContext.h
@@ -67,9 +67,6 @@ namespace mozilla {
 class EventStateManager;
 class RestyleManager;
 class CounterStyleManager;
-namespace dom {
-class FontFaceSet;
-}
 namespace layers {
 class ContainerLayer;
 class LayerManager;
@@ -878,16 +875,7 @@ public:
 
   bool             SuppressingResizeReflow() const { return mSuppressResizeReflow; }
 
-  virtual gfxUserFontSet* GetUserFontSetExternal();
-  gfxUserFontSet* GetUserFontSetInternal();
-#ifdef MOZILLA_INTERNAL_API
-  gfxUserFontSet* GetUserFontSet() { return GetUserFontSetInternal(); }
-#else
-  gfxUserFontSet* GetUserFontSet() { return GetUserFontSetExternal(); }
-#endif
-
-  void FlushUserFontSet();
-  void RebuildUserFontSet(); // asynchronously
+  gfxUserFontSet* GetUserFontSet();
 
   // Should be called whenever the set of fonts available in the user
   // font set changes (e.g., because a new font loads, or because the
@@ -897,8 +885,6 @@ public:
   gfxMissingFontRecorder *MissingFontRecorder() { return mMissingFonts; }
   void NotifyMissingFonts();
 
-  mozilla::dom::FontFaceSet* Fonts();
-
   void FlushCounterStyles();
   void RebuildCounterStyles(); // asynchronously
 
@@ -1195,11 +1181,6 @@ protected:
 
   void AppUnitsPerDevPixelChanged();
 
-  void HandleRebuildUserFontSet() {
-    mPostedFlushUserFontSet = false;
-    FlushUserFontSet();
-  }
-
   void HandleRebuildCounterStyles() {
     mPostedFlushCounterStyles = false;
     FlushCounterStyles();
@@ -1275,9 +1256,6 @@ protected:
   nsInvalidateRequestList mInvalidateRequestsSinceLastPaint;
   nsInvalidateRequestList mUndeliveredInvalidateRequestsBeforeLastPaint;
 
-  // container for per-context fonts (downloadable, SVG, etc.)
-  nsRefPtr<mozilla::dom::FontFaceSet> mFontFaceSet;
-
   // text performance metrics
   nsAutoPtr<gfxTextPerfMetrics>   mTextPerf;
 
@@ -1366,13 +1344,6 @@ protected:
   // Has there been a change to the viewport's dimensions?
   unsigned              mPendingViewportChange : 1;
 
-  // Is the current mFontFaceSet valid?
-  unsigned              mFontFaceSetDirty : 1;
-  // Has GetUserFontSet() been called?
-  unsigned              mGetUserFontSetCalled : 1;
-  // Do we currently have an event posted to call FlushUserFontSet?
-  unsigned              mPostedFlushUserFontSet : 1;
-
   // Is the current mCounterStyleManager valid?
   unsigned              mCounterStylesDirty : 1;
   // Do we currently have an event posted to call FlushCounterStyles?
diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
index 381b7f649b..9a2ce8a5a3 100644
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -4003,7 +4003,7 @@ PresShell::FlushPendingNotifications(mozilla::ChangesToFlush aFlush)
       // Flush any pending update of the user font set, since that could
       // cause style changes (for updating ex/ch units, and to cause a
       // reflow).
-      mPresContext->FlushUserFontSet();
+      mDocument->FlushUserFontSet();
 
       mPresContext->FlushCounterStyles();
 
@@ -4418,8 +4418,9 @@ nsIPresShell::ReconstructStyleDataInternal()
     return;
   }
 
+  mDocument->RebuildUserFontSet();
+
   if (mPresContext) {
-    mPresContext->RebuildUserFontSet();
     mPresContext->RebuildCounterStyles();
   }
 
@@ -8804,7 +8805,7 @@ PresShell::DidCauseReflow()
 void
 PresShell::WillDoReflow()
 {
-  mPresContext->FlushUserFontSet();
+  mDocument->FlushUserFontSet();
 
   mPresContext->FlushCounterStyles();
 
diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list
index f9f3ae2e82..51019996f8 100644
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -578,8 +578,8 @@ load 1054010-1.html
 load 1058954-1.html
 load 1134531.html
 load 1134667.html
-asserts(3-4) load 1137723-1.html # bug 1019192, bug 1138133
-asserts(3-7) load 1137723-2.html # bug 1019192, bug 1138133
+load 1137723-1.html
+load 1137723-2.html
 # The tests for bug 1137723 above causes delayed assertions too,
 # the next 3 lines can be removed once that is fixed.
 asserts(0-3) load 1134667.html
diff --git a/layout/style/FontFace.cpp b/layout/style/FontFace.cpp
index a6a151e252..2ad6e5fe72 100644
--- a/layout/style/FontFace.cpp
+++ b/layout/style/FontFace.cpp
@@ -42,7 +42,7 @@ FontFaceBufferSource::TakeBuffer(uint8_t*& aBuffer, uint32_t& aLength)
   mFontFace->TakeBuffer(aBuffer, aLength);
 }
 
-// -- FontFaceInitializer ----------------------------------------------------
+// -- Utility functions ------------------------------------------------------
 
 template<typename T>
 static void
@@ -61,120 +61,6 @@ GetDataFrom(const T& aObject, uint8_t*& aBuffer, uint32_t& aLength)
   aLength = aObject.Length();
 }
 
-/**
- * A task that is dispatched to the event queue to call Initialize() on a
- * FontFace object with the source information that was passed to the JS
- * constructor.
- */
-class FontFaceInitializer : public nsIRunnable
-{
-public:
-  NS_DECL_ISUPPORTS
-
-  explicit FontFaceInitializer(FontFace* aFontFace)
-    : mFontFace(aFontFace)
-    , mSourceBuffer(nullptr)
-    , mSourceBufferLength(0) {}
-
-  void SetSource(const nsAString& aString);
-  void SetSource(const ArrayBuffer& aArrayBuffer);
-  void SetSource(const ArrayBufferView& aArrayBufferView);
-
-  NS_IMETHOD Run() override;
-  void TakeBuffer(uint8_t*& aBuffer, uint32_t& aLength);
-
-  nsRefPtr<FontFace> mFontFace;
-  FontFace::SourceType mSourceType;
-  nsString mSourceString;
-  uint8_t* mSourceBuffer;  // allocated with NS_Alloc
-  uint32_t mSourceBufferLength;
-
-protected:
-  virtual ~FontFaceInitializer();
-};
-
-NS_IMPL_ISUPPORTS(FontFaceInitializer, nsIRunnable)
-
-FontFaceInitializer::~FontFaceInitializer()
-{
-  if (mSourceBuffer) {
-    NS_Free(mSourceBuffer);
-  }
-}
-
-void
-FontFaceInitializer::SetSource(const nsAString& aString)
-{
-  mSourceType = FontFace::eSourceType_URLs;
-  mSourceString = aString;
-}
-
-void
-FontFaceInitializer::SetSource(const ArrayBuffer& aArrayBuffer)
-{
-  mSourceType = FontFace::eSourceType_Buffer;
-  GetDataFrom(aArrayBuffer, mSourceBuffer, mSourceBufferLength);
-}
-
-void
-FontFaceInitializer::SetSource(const ArrayBufferView& aArrayBufferView)
-{
-  mSourceType = FontFace::eSourceType_Buffer;
-  GetDataFrom(aArrayBufferView, mSourceBuffer, mSourceBufferLength);
-}
-
-NS_IMETHODIMP
-FontFaceInitializer::Run()
-{
-  mFontFace->Initialize(this);
-  return NS_OK;
-}
-
-void
-FontFaceInitializer::TakeBuffer(uint8_t*& aBuffer, uint32_t& aLength)
-{
-  aBuffer = mSourceBuffer;
-  aLength = mSourceBufferLength;
-
-  mSourceBuffer = nullptr;
-  mSourceBufferLength = 0;
-}
-
-// -- FontFaceStatusSetter ---------------------------------------------------
-
-/**
- * A task that is dispatched to the event queue to asynchronously call
- * SetStatus() on a FontFace object.
- */
-class FontFaceStatusSetter : public nsIRunnable
-{
-public:
-  NS_DECL_ISUPPORTS
-
-  FontFaceStatusSetter(FontFace* aFontFace,
-                       FontFaceLoadStatus aStatus)
-    : mFontFace(aFontFace)
-    , mStatus(aStatus) {}
-
-  NS_IMETHOD Run() override;
-
-protected:
-  virtual ~FontFaceStatusSetter() {}
-
-private:
-  nsRefPtr<FontFace> mFontFace;
-  FontFaceLoadStatus mStatus;
-};
-
-NS_IMPL_ISUPPORTS(FontFaceStatusSetter, nsIRunnable)
-
-NS_IMETHODIMP
-FontFaceStatusSetter::Run()
-{
-  mFontFace->SetStatus(mStatus);
-  return NS_OK;
-}
-
 // -- FontFace ---------------------------------------------------------------
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(FontFace)
@@ -188,9 +74,6 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(FontFace)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(FontFace)
-  if (!tmp->IsInFontFaceSet()) {
-    tmp->mFontFaceSet->RemoveUnavailableFontFace(tmp);
-  }
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mParent)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mLoaded)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mRule)
@@ -210,17 +93,14 @@ NS_INTERFACE_MAP_END
 NS_IMPL_CYCLE_COLLECTING_ADDREF(FontFace)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(FontFace)
 
-FontFace::FontFace(nsISupports* aParent, nsPresContext* aPresContext)
+FontFace::FontFace(nsISupports* aParent, FontFaceSet* aFontFaceSet)
   : mParent(aParent)
-  , mPresContext(aPresContext)
   , mStatus(FontFaceLoadStatus::Unloaded)
   , mSourceType(SourceType(0))
   , mSourceBuffer(nullptr)
   , mSourceBufferLength(0)
-  , mFontFaceSet(aPresContext->Fonts())
+  , mFontFaceSet(aFontFaceSet)
   , mInFontFaceSet(false)
-  , mInitialized(false)
-  , mLoadWhenInitialized(false)
 {
   MOZ_COUNT_CTOR(FontFace);
 
@@ -241,10 +121,6 @@ FontFace::~FontFace()
 
   SetUserFontEntry(nullptr);
 
-  if (mFontFaceSet && !IsInFontFaceSet()) {
-    mFontFaceSet->RemoveUnavailableFontFace(this);
-  }
-
   if (mSourceBuffer) {
     NS_Free(mSourceBuffer);
   }
@@ -275,13 +151,12 @@ LoadStateToStatus(gfxUserFontEntry::UserFontLoadState aLoadState)
 
 already_AddRefed<FontFace>
 FontFace::CreateForRule(nsISupports* aGlobal,
-                        nsPresContext* aPresContext,
+                        FontFaceSet* aFontFaceSet,
                         nsCSSFontFaceRule* aRule)
 {
   nsCOMPtr<nsIGlobalObject> globalObject = do_QueryInterface(aGlobal);
 
-  nsRefPtr<FontFace> obj = new FontFace(aGlobal, aPresContext);
-  obj->mInitialized = true;
+  nsRefPtr<FontFace> obj = new FontFace(aGlobal, aFontFaceSet);
   obj->mRule = aRule;
   obj->mSourceType = eSourceType_FontFaceRule;
   obj->mInFontFaceSet = true;
@@ -303,104 +178,68 @@ FontFace::Constructor(const GlobalObject& aGlobal,
     return nullptr;
   }
 
-  nsIPresShell* shell = doc->GetShell();
-  if (!shell) {
-    aRv.Throw(NS_ERROR_FAILURE);
-    return nullptr;
-  }
-
-  nsPresContext* presContext = shell->GetPresContext();
-  if (!presContext) {
-    aRv.Throw(NS_ERROR_FAILURE);
-    return nullptr;
-  }
-
-  nsRefPtr<FontFace> obj = new FontFace(global, presContext);
-  obj->mFontFaceSet->AddUnavailableFontFace(obj);
+  nsRefPtr<FontFace> obj = new FontFace(global, doc->Fonts());
   if (!obj->SetDescriptors(aFamily, aDescriptors)) {
     return obj.forget();
   }
 
-  nsRefPtr<FontFaceInitializer> task = new FontFaceInitializer(obj);
-
-  if (aSource.IsArrayBuffer()) {
-    task->SetSource(aSource.GetAsArrayBuffer());
-  } else if (aSource.IsArrayBufferView()) {
-    task->SetSource(aSource.GetAsArrayBufferView());
-  } else {
-    MOZ_ASSERT(aSource.IsString());
-    task->SetSource(aSource.GetAsString());
-  }
-
-  NS_DispatchToMainThread(task);
-
+  obj->InitializeSource(aSource);
   return obj.forget();
 }
 
 void
-FontFace::Initialize(FontFaceInitializer* aInitializer)
+FontFace::InitializeSource(const StringOrArrayBufferOrArrayBufferView& aSource)
 {
-  MOZ_ASSERT(!HasRule());
-  MOZ_ASSERT(mSourceType == SourceType(0));
-
-  if (aInitializer->mSourceType == eSourceType_URLs) {
+  if (aSource.IsString()) {
     if (!ParseDescriptor(eCSSFontDesc_Src,
-                         aInitializer->mSourceString,
+                         aSource.GetAsString(),
                          mDescriptors->mSrc)) {
       if (mLoaded) {
-        // The asynchronous SetStatus call we are about to do assumes that for
+        // The SetStatus call we are about to do assumes that for
         // FontFace objects with sources other than ArrayBuffer(View)s, that the
         // mLoaded Promise is rejected with a network error.  We get
         // in here beforehand to set it to the required syntax error.
         mLoaded->MaybeReject(NS_ERROR_DOM_SYNTAX_ERR);
       }
 
-      // Queue a task to set the status to "error".
-      nsCOMPtr<nsIRunnable> statusSetterTask =
-        new FontFaceStatusSetter(this, FontFaceLoadStatus::Error);
-      NS_DispatchToMainThread(statusSetterTask);
+      SetStatus(FontFaceLoadStatus::Error);
       return;
     }
 
     mSourceType = eSourceType_URLs;
-
-    // Now that we have parsed the src descriptor, we are initialized.
-    OnInitialized();
     return;
   }
 
-  // We've been given an ArrayBuffer or ArrayBufferView as the source.
-  MOZ_ASSERT(aInitializer->mSourceType == eSourceType_Buffer);
+  mSourceType = FontFace::eSourceType_Buffer;
 
-  mSourceType = aInitializer->mSourceType;
-  aInitializer->TakeBuffer(mSourceBuffer, mSourceBufferLength);
+  if (aSource.IsArrayBuffer()) {
+    GetDataFrom(aSource.GetAsArrayBuffer(),
+                mSourceBuffer, mSourceBufferLength);
+  } else {
+    MOZ_ASSERT(aSource.IsArrayBufferView());
+    GetDataFrom(aSource.GetAsArrayBufferView(),
+                mSourceBuffer, mSourceBufferLength);
+  }
 
-  // Queue a task to set the status to "loading".
-  nsCOMPtr<nsIRunnable> statusSetterTask =
-    new FontFaceStatusSetter(this, FontFaceLoadStatus::Loading);
-  NS_DispatchToMainThread(statusSetterTask);
-
-  // We are initialized.
-  OnInitialized();
-
-  // ArrayBuffer(View)-backed FontFace objects are loaded on construction,
-  // but we need to do this after going through the event loop so that the
-  // FontFaceStatusSetter runs before us.
-  nsCOMPtr<nsIRunnable> loaderTask =
-    NS_NewRunnableMethod(this, &FontFace::DoLoad);
-  NS_DispatchToMainThread(loaderTask);
+  SetStatus(FontFaceLoadStatus::Loading);
+  DoLoad();
 }
 
 void
 FontFace::GetFamily(nsString& aResult)
 {
-  mPresContext->FlushUserFontSet();
+  mFontFaceSet->FlushUserFontSet();
 
   // Serialize the same way as in nsCSSFontFaceStyleDecl::GetPropertyValue.
   nsCSSValue value;
   GetDesc(eCSSFontDesc_Family, value);
 
   aResult.Truncate();
+
+  if (value.GetUnit() == eCSSUnit_Null) {
+    return;
+  }
+
   nsDependentString family(value.GetStringBufferValue());
   if (!family.IsEmpty()) {
     // The string length can be zero when the author passed an invalid
@@ -412,75 +251,74 @@ FontFace::GetFamily(nsString& aResult)
 void
 FontFace::SetFamily(const nsAString& aValue, ErrorResult& aRv)
 {
-  mPresContext->FlushUserFontSet();
+  mFontFaceSet->FlushUserFontSet();
   SetDescriptor(eCSSFontDesc_Family, aValue, aRv);
 }
 
 void
 FontFace::GetStyle(nsString& aResult)
 {
-  mPresContext->FlushUserFontSet();
+  mFontFaceSet->FlushUserFontSet();
   GetDesc(eCSSFontDesc_Style, eCSSProperty_font_style, aResult);
 }
 
 void
 FontFace::SetStyle(const nsAString& aValue, ErrorResult& aRv)
 {
-  mPresContext->FlushUserFontSet();
+  mFontFaceSet->FlushUserFontSet();
   SetDescriptor(eCSSFontDesc_Style, aValue, aRv);
 }
 
 void
 FontFace::GetWeight(nsString& aResult)
 {
-  mPresContext->FlushUserFontSet();
+  mFontFaceSet->FlushUserFontSet();
   GetDesc(eCSSFontDesc_Weight, eCSSProperty_font_weight, aResult);
 }
 
 void
 FontFace::SetWeight(const nsAString& aValue, ErrorResult& aRv)
 {
-  mPresContext->FlushUserFontSet();
+  mFontFaceSet->FlushUserFontSet();
   SetDescriptor(eCSSFontDesc_Weight, aValue, aRv);
 }
 
 void
 FontFace::GetStretch(nsString& aResult)
 {
-  mPresContext->FlushUserFontSet();
+  mFontFaceSet->FlushUserFontSet();
   GetDesc(eCSSFontDesc_Stretch, eCSSProperty_font_stretch, aResult);
 }
 
 void
 FontFace::SetStretch(const nsAString& aValue, ErrorResult& aRv)
 {
-  mPresContext->FlushUserFontSet();
+  mFontFaceSet->FlushUserFontSet();
   SetDescriptor(eCSSFontDesc_Stretch, aValue, aRv);
 }
 
 void
 FontFace::GetUnicodeRange(nsString& aResult)
 {
-  mPresContext->FlushUserFontSet();
+  mFontFaceSet->FlushUserFontSet();
 
-  nsCSSValue value;
-  GetDesc(eCSSFontDesc_UnicodeRange, value);
-
-  aResult.Truncate();
-  nsStyleUtil::AppendUnicodeRange(value, aResult);
+  // There is no eCSSProperty_unicode_range for us to pass in to GetDesc
+  // to get a serialized (possibly defaulted) value, but that function
+  // doesn't use the property ID for this descriptor anyway.
+  GetDesc(eCSSFontDesc_UnicodeRange, eCSSProperty_UNKNOWN, aResult);
 }
 
 void
 FontFace::SetUnicodeRange(const nsAString& aValue, ErrorResult& aRv)
 {
-  mPresContext->FlushUserFontSet();
+  mFontFaceSet->FlushUserFontSet();
   SetDescriptor(eCSSFontDesc_UnicodeRange, aValue, aRv);
 }
 
 void
 FontFace::GetVariant(nsString& aResult)
 {
-  mPresContext->FlushUserFontSet();
+  mFontFaceSet->FlushUserFontSet();
 
   // XXX Just expose the font-variant descriptor as "normal" until we
   // support it properly (bug 1055385).
@@ -490,7 +328,7 @@ FontFace::GetVariant(nsString& aResult)
 void
 FontFace::SetVariant(const nsAString& aValue, ErrorResult& aRv)
 {
-  mPresContext->FlushUserFontSet();
+  mFontFaceSet->FlushUserFontSet();
 
   // XXX Ignore assignments to variant until we support font-variant
   // descriptors (bug 1055385).
@@ -499,19 +337,15 @@ FontFace::SetVariant(const nsAString& aValue, ErrorResult& aRv)
 void
 FontFace::GetFeatureSettings(nsString& aResult)
 {
-  mPresContext->FlushUserFontSet();
-
-  nsCSSValue value;
-  GetDesc(eCSSFontDesc_FontFeatureSettings, value);
-
-  aResult.Truncate();
-  nsStyleUtil::AppendFontFeatureSettings(value, aResult);
+  mFontFaceSet->FlushUserFontSet();
+  GetDesc(eCSSFontDesc_FontFeatureSettings, eCSSProperty_font_feature_settings,
+          aResult);
 }
 
 void
 FontFace::SetFeatureSettings(const nsAString& aValue, ErrorResult& aRv)
 {
-  mPresContext->FlushUserFontSet();
+  mFontFaceSet->FlushUserFontSet();
   SetDescriptor(eCSSFontDesc_FontFeatureSettings, aValue, aRv);
 }
 
@@ -524,7 +358,7 @@ FontFace::Status()
 Promise*
 FontFace::Load(ErrorResult& aRv)
 {
-  mPresContext->FlushUserFontSet();
+  mFontFaceSet->FlushUserFontSet();
 
   if (!mLoaded) {
     aRv.Throw(NS_ERROR_FAILURE);
@@ -544,22 +378,14 @@ FontFace::Load(ErrorResult& aRv)
   // here.
   SetStatus(FontFaceLoadStatus::Loading);
 
-  if (mInitialized) {
-    DoLoad();
-  } else {
-    // We can only load an initialized font; this will cause the font to be
-    // loaded once it has been initialized.
-    mLoadWhenInitialized = true;
-  }
+  DoLoad();
 
   return mLoaded;
 }
 
-void
-FontFace::DoLoad()
+gfxUserFontEntry*
+FontFace::CreateUserFontEntry()
 {
-  MOZ_ASSERT(mInitialized);
-
   if (!mUserFontEntry) {
     MOZ_ASSERT(!HasRule(),
                "Rule backed FontFace objects should already have a user font "
@@ -567,20 +393,27 @@ FontFace::DoLoad()
 
     nsRefPtr<gfxUserFontEntry> newEntry =
       mFontFaceSet->FindOrCreateUserFontEntryFromFontFace(this);
-    if (!newEntry) {
-      return;
+    if (newEntry) {
+      SetUserFontEntry(newEntry);
     }
-
-    SetUserFontEntry(newEntry);
   }
 
+  return mUserFontEntry;
+}
+
+void
+FontFace::DoLoad()
+{
+  if (!CreateUserFontEntry()) {
+    return;
+  }
   mUserFontEntry->Load();
 }
 
 Promise*
 FontFace::GetLoaded(ErrorResult& aRv)
 {
-  mPresContext->FlushUserFontSet();
+  mFontFaceSet->FlushUserFontSet();
 
   if (!mLoaded) {
     aRv.Throw(NS_ERROR_FAILURE);
@@ -722,25 +555,6 @@ FontFace::SetDescriptors(const nsAString& aFamily,
   return true;
 }
 
-void
-FontFace::OnInitialized()
-{
-  MOZ_ASSERT(!mInitialized);
-
-  mInitialized = true;
-
-  // For a FontFace that was created and immediately had Load() called on
-  // it, before it had a chance to be initialized, we kick off its load now.
-  if (mLoadWhenInitialized) {
-    mLoadWhenInitialized = false;
-    DoLoad();
-  }
-
-  if (mInFontFaceSet) {
-    mFontFaceSet->OnFontFaceInitialized(this);
-  }
-}
-
 void
 FontFace::GetDesc(nsCSSFontDesc aDescID, nsCSSValue& aResult) const
 {
@@ -758,6 +572,10 @@ FontFace::GetDesc(nsCSSFontDesc aDescID,
                   nsCSSProperty aPropID,
                   nsString& aResult) const
 {
+  MOZ_ASSERT(aDescID == eCSSFontDesc_UnicodeRange ||
+             aPropID != eCSSProperty_UNKNOWN,
+             "only pass eCSSProperty_UNKNOWN for eCSSFontDesc_UnicodeRange");
+
   nsCSSValue value;
   GetDesc(aDescID, value);
 
@@ -771,6 +589,13 @@ FontFace::GetDesc(nsCSSFontDesc aDescID,
                aDescID != eCSSFontDesc_Src) {
       aResult.AssignLiteral("normal");
     }
+    return;
+  }
+
+  if (aDescID == eCSSFontDesc_UnicodeRange) {
+    // Since there's no unicode-range property, we can't use
+    // nsCSSValue::AppendToString to serialize this descriptor.
+    nsStyleUtil::AppendUnicodeRange(value, aResult);
   } else {
     value.AppendToString(aPropID, aResult, nsCSSValue::eNormalized);
   }
diff --git a/layout/style/FontFace.h b/layout/style/FontFace.h
index e4835f4735..cc6600a0fb 100644
--- a/layout/style/FontFace.h
+++ b/layout/style/FontFace.h
@@ -14,7 +14,6 @@
 
 class gfxFontFaceBufferSource;
 class nsCSSFontFaceRule;
-class nsPresContext;
 
 namespace mozilla {
 struct CSSFontFaceDescriptors;
@@ -22,8 +21,6 @@ namespace dom {
 class FontFaceBufferSource;
 struct FontFaceDescriptors;
 class FontFaceSet;
-class FontFaceInitializer;
-class FontFaceStatusSetter;
 class Promise;
 class StringOrArrayBufferOrArrayBufferView;
 } // namespace dom
@@ -36,8 +33,6 @@ class FontFace final : public nsISupports,
                        public nsWrapperCache
 {
   friend class mozilla::dom::FontFaceBufferSource;
-  friend class mozilla::dom::FontFaceInitializer;
-  friend class mozilla::dom::FontFaceStatusSetter;
   friend class Entry;
 
 public:
@@ -58,6 +53,7 @@ public:
                          aUnicodeRanges) {}
 
     virtual void SetLoadState(UserFontLoadState aLoadState) override;
+    const nsAutoTArray<FontFace*,1>& GetFontFaces() { return mFontFaces; }
 
   protected:
     // The FontFace objects that use this user font entry.  We need to store
@@ -74,13 +70,14 @@ public:
   virtual JSObject* WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto) override;
 
   static already_AddRefed<FontFace>
-  CreateForRule(nsISupports* aGlobal, nsPresContext* aPresContext,
+  CreateForRule(nsISupports* aGlobal, FontFaceSet* aFontFaceSet,
                 nsCSSFontFaceRule* aRule);
 
   nsCSSFontFaceRule* GetRule() { return mRule; }
 
   void GetDesc(nsCSSFontDesc aDescID, nsCSSValue& aResult) const;
 
+  gfxUserFontEntry* CreateUserFontEntry();
   gfxUserFontEntry* GetUserFontEntry() const { return mUserFontEntry; }
   void SetUserFontEntry(gfxUserFontEntry* aEntry);
 
@@ -101,14 +98,6 @@ public:
     mInFontFaceSet = aInFontFaceSet;
   }
 
-  /**
-   * Returns whether this FontFace is initialized.  A rule backed
-   * FontFace is considered initialized at construction time.  For
-   * FontFace objects created using the FontFace JS constructor, it
-   * is once all the descriptors have been parsed.
-   */
-  bool IsInitialized() const { return mInitialized; }
-
   FontFaceSet* GetFontFaceSet() const { return mFontFaceSet; }
 
   /**
@@ -175,16 +164,10 @@ public:
   mozilla::dom::Promise* GetLoaded(mozilla::ErrorResult& aRv);
 
 private:
-  FontFace(nsISupports* aParent, nsPresContext* aPresContext);
+  FontFace(nsISupports* aParent, FontFaceSet* aFontFaceSet);
   ~FontFace();
 
-  /**
-   * Initializes the source and descriptors on this object based on values that
-   * were passed in to the JS constructor.  If the source was specified as
-   * an ArrayBuffer or ArrayBufferView, parsing of the font data in there
-   * will be started.
-   */
-  void Initialize(FontFaceInitializer* aInitializer);
+  void InitializeSource(const StringOrArrayBufferOrArrayBufferView& aSource);
 
   // Helper function for Load.
   void DoLoad();
@@ -208,12 +191,6 @@ private:
   bool SetDescriptors(const nsAString& aFamily,
                       const FontFaceDescriptors& aDescriptors);
 
-  /**
-   * Marks the FontFace as initialized and informs the FontFaceSet it is in,
-   * if any.
-   */
-  void OnInitialized();
-
   /**
    * Sets the current loading status.
    */
@@ -229,7 +206,6 @@ private:
   void TakeBuffer(uint8_t*& aBuffer, uint32_t& aLength);
 
   nsCOMPtr<nsISupports> mParent;
-  nsPresContext* mPresContext;
 
   // A Promise that is fulfilled once the font represented by this FontFace
   // is loaded, and is rejected if the load fails.
@@ -275,16 +251,6 @@ private:
 
   // Whether this FontFace appears in the FontFaceSet.
   bool mInFontFaceSet;
-
-  // Whether the FontFace has been fully initialized.  This takes at least one
-  // run around the event loop, as the parsing of the src descriptor is done
-  // off an event queue task.
-  bool mInitialized;
-
-  // Records whether Load() was called on this FontFace before it was
-  // initialized.  When the FontFace eventually does become initialized,
-  // mLoadPending is checked and Load() is called if needed.
-  bool mLoadWhenInitialized;
 };
 
 } // namespace dom
diff --git a/layout/style/FontFaceSet.cpp b/layout/style/FontFaceSet.cpp
index eb543066fa..069ddb6fac 100644
--- a/layout/style/FontFaceSet.cpp
+++ b/layout/style/FontFaceSet.cpp
@@ -6,8 +6,8 @@
 
 #include "FontFaceSet.h"
 
-#include "mozilla/Logging.h"
-
+#include "gfxFontConstants.h"
+#include "mozilla/css/Declaration.h"
 #include "mozilla/css/Loader.h"
 #include "mozilla/dom/CSSFontFaceLoadEvent.h"
 #include "mozilla/dom/CSSFontFaceLoadEventBinding.h"
@@ -15,9 +15,12 @@
 #include "mozilla/dom/FontFaceSetIterator.h"
 #include "mozilla/dom/Promise.h"
 #include "mozilla/AsyncEventDispatcher.h"
+#include "mozilla/Logging.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/Snprintf.h"
 #include "nsCORSListenerProxy.h"
+#include "nsCSSParser.h"
+#include "nsDeviceContext.h"
 #include "nsFontFaceLoader.h"
 #include "nsIConsoleService.h"
 #include "nsIContentPolicy.h"
@@ -33,8 +36,10 @@
 #include "nsPresContext.h"
 #include "nsPrintfCString.h"
 #include "nsStyleSet.h"
+#include "nsUTF8Utils.h"
 
 using namespace mozilla;
+using namespace mozilla::css;
 using namespace mozilla::dom;
 
 #define LOG(args) MOZ_LOG(gfxUserFontSet::GetUserFontsLog(), mozilla::LogLevel::Debug, args)
@@ -54,6 +59,9 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(FontFaceSet, DOMEventTargetHel
   for (size_t i = 0; i < tmp->mNonRuleFaces.Length(); i++) {
     NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mNonRuleFaces[i].mFontFace);
   }
+  if (tmp->mUserFontSet) {
+    NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mUserFontSet->mFontFaceSet);
+  }
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(FontFaceSet, DOMEventTargetHelper)
@@ -66,6 +74,10 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(FontFaceSet, DOMEventTargetHelpe
   for (size_t i = 0; i < tmp->mNonRuleFaces.Length(); i++) {
     NS_IMPL_CYCLE_COLLECTION_UNLINK(mNonRuleFaces[i].mFontFace);
   }
+  if (tmp->mUserFontSet) {
+    NS_IMPL_CYCLE_COLLECTION_UNLINK(mUserFontSet->mFontFaceSet);
+  }
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mUserFontSet);
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_IMPL_ADDREF_INHERITED(FontFaceSet, DOMEventTargetHelper)
@@ -76,10 +88,9 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(FontFaceSet)
   NS_INTERFACE_MAP_ENTRY(nsICSSLoaderObserver)
 NS_INTERFACE_MAP_END_INHERITING(DOMEventTargetHelper)
 
-FontFaceSet::FontFaceSet(nsPIDOMWindow* aWindow, nsPresContext* aPresContext)
+FontFaceSet::FontFaceSet(nsPIDOMWindow* aWindow, nsIDocument* aDocument)
   : DOMEventTargetHelper(aWindow)
-  , mPresContext(aPresContext)
-  , mDocument(aPresContext->Document())
+  , mDocument(aDocument)
   , mStatus(FontFaceSetLoadStatus::Loaded)
   , mNonRuleFacesDirty(false)
   , mHasLoadingFontFaces(false)
@@ -112,13 +123,19 @@ FontFaceSet::FontFaceSet(nsPIDOMWindow* aWindow, nsPresContext* aPresContext)
   mUserFontSet = new UserFontSet(this);
 }
 
+static PLDHashOperator DestroyIterator(nsPtrHashKey<nsFontFaceLoader>* aKey,
+                                       void* aUserArg)
+{
+  aKey->GetKey()->Cancel();
+  return PL_DHASH_REMOVE;
+}
+
 FontFaceSet::~FontFaceSet()
 {
   MOZ_COUNT_DTOR(FontFaceSet);
 
-  NS_ASSERTION(mLoaders.Count() == 0, "mLoaders should have been emptied");
-
   Disconnect();
+  mLoaders.EnumerateEntries(DestroyIterator, nullptr);
 }
 
 JSObject*
@@ -149,13 +166,181 @@ FontFaceSet::RemoveDOMContentLoadedListener()
   }
 }
 
+void
+FontFaceSet::ParseFontShorthandForMatching(
+                            const nsAString& aFont,
+                            nsRefPtr<FontFamilyListRefCnt>& aFamilyList,
+                            uint32_t& aWeight,
+                            int32_t& aStretch,
+                            uint32_t& aItalicStyle,
+                            ErrorResult& aRv)
+{
+  // Parse aFont as a 'font' property value.
+  Declaration declaration;
+  declaration.InitializeEmpty();
+
+  bool changed = false;
+  nsCSSParser parser;
+  parser.ParseProperty(eCSSProperty_font,
+                       aFont,
+                       mDocument->GetDocumentURI(),
+                       mDocument->GetDocumentURI(),
+                       mDocument->NodePrincipal(),
+                       &declaration,
+                       &changed,
+                       /* aIsImportant */ false);
+
+  // All of the properties we are interested in should have been set at once.
+  MOZ_ASSERT(changed == (declaration.HasProperty(eCSSProperty_font_family) &&
+                         declaration.HasProperty(eCSSProperty_font_style) &&
+                         declaration.HasProperty(eCSSProperty_font_weight) &&
+                         declaration.HasProperty(eCSSProperty_font_stretch)));
+
+  if (!changed) {
+    aRv.Throw(NS_ERROR_DOM_SYNTAX_ERR);
+    return;
+  }
+
+  nsCSSCompressedDataBlock* data = declaration.GetNormalBlock();
+  MOZ_ASSERT(!declaration.GetImportantBlock());
+
+  const nsCSSValue* family = data->ValueFor(eCSSProperty_font_family);
+  if (family->GetUnit() != eCSSUnit_FontFamilyList) {
+    // We got inherit, initial, unset, a system font, or a token stream.
+    aRv.Throw(NS_ERROR_DOM_SYNTAX_ERR);
+    return;
+  }
+
+  aFamilyList =
+    static_cast<FontFamilyListRefCnt*>(family->GetFontFamilyListValue());
+
+  int32_t weight = data->ValueFor(eCSSProperty_font_weight)->GetIntValue();
+
+  // Resolve relative font weights against the initial of font-weight
+  // (normal, which is equivalent to 400).
+  if (weight == NS_STYLE_FONT_WEIGHT_BOLDER) {
+    weight = NS_FONT_WEIGHT_BOLD;
+  } else if (weight == NS_STYLE_FONT_WEIGHT_LIGHTER) {
+    weight = NS_FONT_WEIGHT_THIN;
+  }
+
+  aWeight = weight;
+
+  aStretch = data->ValueFor(eCSSProperty_font_stretch)->GetIntValue();
+  aItalicStyle = data->ValueFor(eCSSProperty_font_style)->GetIntValue();
+}
+
+static bool
+HasAnyCharacterInUnicodeRange(gfxUserFontEntry* aEntry,
+                              const nsAString& aInput)
+{
+  const char16_t* p = aInput.Data();
+  const char16_t* end = p + aInput.Length();
+
+  while (p < end) {
+    uint32_t c = UTF16CharEnumerator::NextChar(&p, end);
+    if (aEntry->CharacterInUnicodeRange(c)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+void
+FontFaceSet::FindMatchingFontFaces(const nsAString& aFont,
+                                   const nsAString& aText,
+                                   nsTArray<FontFace*>& aFontFaces,
+                                   ErrorResult& aRv)
+{
+  nsRefPtr<FontFamilyListRefCnt> familyList;
+  uint32_t weight;
+  int32_t stretch;
+  uint32_t italicStyle;
+  ParseFontShorthandForMatching(aFont, familyList, weight, stretch, italicStyle,
+                                aRv);
+  if (aRv.Failed()) {
+    return;
+  }
+
+  gfxFontStyle style;
+  style.style = italicStyle;
+  style.weight = weight;
+  style.stretch = stretch;
+
+  nsTArray<FontFaceRecord>* arrays[2];
+  arrays[0] = &mNonRuleFaces;
+  arrays[1] = &mRuleFaces;
+
+  // Set of FontFaces that we want to return.
+  nsTHashtable<nsPtrHashKey<FontFace>> matchingFaces;
+
+  for (const FontFamilyName& fontFamilyName : familyList->GetFontlist()) {
+    nsRefPtr<gfxFontFamily> family =
+      mUserFontSet->LookupFamily(fontFamilyName.mName);
+
+    if (!family) {
+      continue;
+    }
+
+    nsAutoTArray<gfxFontEntry*,4> entries;
+    bool needsBold;
+    family->FindAllFontsForStyle(style, entries, needsBold);
+
+    for (gfxFontEntry* e : entries) {
+      FontFace::Entry* entry = static_cast<FontFace::Entry*>(e);
+      if (HasAnyCharacterInUnicodeRange(entry, aText)) {
+        for (FontFace* f : entry->GetFontFaces()) {
+          matchingFaces.PutEntry(f);
+        }
+      }
+    }
+  }
+
+  // Add all FontFaces in matchingFaces to aFontFaces, in the order
+  // they appear in the FontFaceSet.
+  for (nsTArray<FontFaceRecord>* array : arrays) {
+    for (FontFaceRecord& record : *array) {
+      FontFace* f = record.mFontFace;
+      if (matchingFaces.Contains(f)) {
+        aFontFaces.AppendElement(f);
+      }
+    }
+  }
+}
+
 already_AddRefed<Promise>
-FontFaceSet::Load(const nsAString& aFont,
+FontFaceSet::Load(JSContext* aCx,
+                  const nsAString& aFont,
                   const nsAString& aText,
                   ErrorResult& aRv)
 {
-  aRv.Throw(NS_ERROR_NOT_IMPLEMENTED);
-  return nullptr;
+  FlushUserFontSet();
+
+  nsTArray<nsRefPtr<Promise>> promises;
+
+  nsTArray<FontFace*> faces;
+  FindMatchingFontFaces(aFont, aText, faces, aRv);
+  if (aRv.Failed()) {
+    return nullptr;
+  }
+
+  for (FontFace* f : faces) {
+    nsRefPtr<Promise> promise = f->Load(aRv);
+    if (aRv.Failed()) {
+      return nullptr;
+    }
+    if (!promises.AppendElement(promise, fallible)) {
+      aRv.Throw(NS_ERROR_FAILURE);
+      return nullptr;
+    }
+  }
+
+  nsIGlobalObject* globalObject = GetParentObject();
+  JS::Rooted<JSObject*> jsGlobal(aCx, globalObject->GetGlobalJSObject());
+  GlobalObject global(aCx, jsGlobal);
+
+  nsRefPtr<Promise> result = Promise::All(global, promises, aRv);
+  return result.forget();
 }
 
 bool
@@ -163,8 +348,21 @@ FontFaceSet::Check(const nsAString& aFont,
                    const nsAString& aText,
                    ErrorResult& aRv)
 {
-  aRv.Throw(NS_ERROR_NOT_IMPLEMENTED);
-  return false;
+  FlushUserFontSet();
+
+  nsTArray<FontFace*> faces;
+  FindMatchingFontFaces(aFont, aText, faces, aRv);
+  if (aRv.Failed()) {
+    return false;
+  }
+
+  for (FontFace* f : faces) {
+    if (f->Status() != FontFaceLoadStatus::Loaded) {
+      return false;
+    }
+  }
+
+  return true;
 }
 
 Promise*
@@ -175,14 +373,14 @@ FontFaceSet::GetReady(ErrorResult& aRv)
     return nullptr;
   }
 
-  mPresContext->FlushUserFontSet();
+  FlushUserFontSet();
   return mReady;
 }
 
 FontFaceSetLoadStatus
 FontFaceSet::Status()
 {
-  mPresContext->FlushUserFontSet();
+  FlushUserFontSet();
   return mStatus;
 }
 
@@ -202,7 +400,7 @@ FontFaceSet::HasRuleFontFace(FontFace* aFontFace)
 FontFaceSet*
 FontFaceSet::Add(FontFace& aFontFace, ErrorResult& aRv)
 {
-  mPresContext->FlushUserFontSet();
+  FlushUserFontSet();
 
   // We currently only support FontFace objects being in a single FontFaceSet,
   // and we also restrict the FontFaceSet to contain only FontFaces created
@@ -213,20 +411,12 @@ FontFaceSet::Add(FontFace& aFontFace, ErrorResult& aRv)
     return nullptr;
   }
 
-  if (aFontFace.HasRule()) {
-    aRv.Throw(NS_ERROR_DOM_INVALID_MODIFICATION_ERR);
-    return nullptr;
-  }
-
   if (aFontFace.IsInFontFaceSet()) {
     return this;
   }
 
-  bool removed = mUnavailableFaces.RemoveElement(&aFontFace);
-  if (!removed) {
-    MOZ_ASSERT(false, "should have found aFontFace in mUnavailableFaces");
-    return this;
-  }
+  MOZ_ASSERT(!aFontFace.HasRule(),
+             "rule-backed FontFaces should always be in the FontFaceSet");
 
   aFontFace.SetIsInFontFaceSet(true);
 
@@ -245,7 +435,7 @@ FontFaceSet::Add(FontFace& aFontFace, ErrorResult& aRv)
     aFontFace.Status() == FontFaceLoadStatus::Loading;
 
   mNonRuleFacesDirty = true;
-  mPresContext->RebuildUserFontSet();
+  RebuildUserFontSet();
   mHasLoadingFontFacesIsDirty = true;
   CheckLoadingStarted();
   return this;
@@ -254,7 +444,7 @@ FontFaceSet::Add(FontFace& aFontFace, ErrorResult& aRv)
 void
 FontFaceSet::Clear()
 {
-  mPresContext->FlushUserFontSet();
+  FlushUserFontSet();
 
   if (mNonRuleFaces.IsEmpty()) {
     return;
@@ -263,27 +453,21 @@ FontFaceSet::Clear()
   for (size_t i = 0; i < mNonRuleFaces.Length(); i++) {
     FontFace* f = mNonRuleFaces[i].mFontFace;
     f->SetIsInFontFaceSet(false);
-
-    MOZ_ASSERT(!mUnavailableFaces.Contains(f),
-               "FontFace should not occur in mUnavailableFaces twice");
-
-    mUnavailableFaces.AppendElement(f);
   }
 
   mNonRuleFaces.Clear();
   mNonRuleFacesDirty = true;
-  mPresContext->RebuildUserFontSet();
+  RebuildUserFontSet();
   mHasLoadingFontFacesIsDirty = true;
   CheckLoadingFinished();
 }
 
 bool
-FontFaceSet::Delete(FontFace& aFontFace, ErrorResult& aRv)
+FontFaceSet::Delete(FontFace& aFontFace)
 {
-  mPresContext->FlushUserFontSet();
+  FlushUserFontSet();
 
   if (aFontFace.HasRule()) {
-    aRv.Throw(NS_ERROR_DOM_INVALID_MODIFICATION_ERR);
     return false;
   }
 
@@ -301,13 +485,8 @@ FontFaceSet::Delete(FontFace& aFontFace, ErrorResult& aRv)
 
   aFontFace.SetIsInFontFaceSet(false);
 
-  MOZ_ASSERT(!mUnavailableFaces.Contains(&aFontFace),
-             "FontFace should not occur in mUnavailableFaces twice");
-
-  mUnavailableFaces.AppendElement(&aFontFace);
-
   mNonRuleFacesDirty = true;
-  mPresContext->RebuildUserFontSet();
+  RebuildUserFontSet();
   mHasLoadingFontFacesIsDirty = true;
   CheckLoadingFinished();
   return true;
@@ -323,7 +502,7 @@ FontFaceSet::HasAvailableFontFace(FontFace* aFontFace)
 bool
 FontFaceSet::Has(FontFace& aFontFace)
 {
-  mPresContext->FlushUserFontSet();
+  FlushUserFontSet();
 
   return HasAvailableFontFace(&aFontFace);
 }
@@ -331,7 +510,7 @@ FontFaceSet::Has(FontFace& aFontFace)
 FontFace*
 FontFaceSet::GetFontFaceAt(uint32_t aIndex)
 {
-  mPresContext->FlushUserFontSet();
+  FlushUserFontSet();
 
   if (aIndex < mRuleFaces.Length()) {
     return mRuleFaces[aIndex].mFontFace;
@@ -348,7 +527,7 @@ FontFaceSet::GetFontFaceAt(uint32_t aIndex)
 uint32_t
 FontFaceSet::Size()
 {
-  mPresContext->FlushUserFontSet();
+  FlushUserFontSet();
 
   // Web IDL objects can only expose array index properties up to INT32_MAX.
 
@@ -384,37 +563,6 @@ FontFaceSet::ForEach(JSContext* aCx,
   }
 }
 
-static PLDHashOperator DestroyIterator(nsPtrHashKey<nsFontFaceLoader>* aKey,
-                                       void* aUserArg)
-{
-  aKey->GetKey()->Cancel();
-  return PL_DHASH_REMOVE;
-}
-
-void
-FontFaceSet::DestroyUserFontSet()
-{
-  Disconnect();
-  mDocument = nullptr;
-  mPresContext = nullptr;
-  mLoaders.EnumerateEntries(DestroyIterator, nullptr);
-  for (size_t i = 0; i < mRuleFaces.Length(); i++) {
-    mRuleFaces[i].mFontFace->DisconnectFromRule();
-    mRuleFaces[i].mFontFace->SetUserFontEntry(nullptr);
-  }
-  for (size_t i = 0; i < mNonRuleFaces.Length(); i++) {
-    mNonRuleFaces[i].mFontFace->SetUserFontEntry(nullptr);
-  }
-  for (size_t i = 0; i < mUnavailableFaces.Length(); i++) {
-    mUnavailableFaces[i]->SetUserFontEntry(nullptr);
-  }
-  mRuleFaces.Clear();
-  mNonRuleFaces.Clear();
-  mUnavailableFaces.Clear();
-  mReady = nullptr;
-  mUserFontSet = nullptr;
-}
-
 void
 FontFaceSet::RemoveLoader(nsFontFaceLoader* aLoader)
 {
@@ -427,12 +575,8 @@ FontFaceSet::StartLoad(gfxUserFontEntry* aUserFontEntry,
 {
   nsresult rv;
 
-  nsIPresShell* ps = mPresContext->PresShell();
-  if (!ps)
-    return NS_ERROR_FAILURE;
-
   nsCOMPtr<nsIStreamLoader> streamLoader;
-  nsCOMPtr<nsILoadGroup> loadGroup(ps->GetDocument()->GetDocumentLoadGroup());
+  nsCOMPtr<nsILoadGroup> loadGroup(mDocument->GetDocumentLoadGroup());
 
   nsCOMPtr<nsIChannel> channel;
   // Note we are calling NS_NewChannelWithTriggeringPrincipal() with both a
@@ -441,7 +585,7 @@ FontFaceSet::StartLoad(gfxUserFontEntry* aUserFontEntry,
   // stylesheet that initiated the font load.
   rv = NS_NewChannelWithTriggeringPrincipal(getter_AddRefs(channel),
                                             aFontFaceSrc->mURI,
-                                            ps->GetDocument(),
+                                            mDocument,
                                             aUserFontEntry->GetPrincipal(),
                                             nsILoadInfo::SEC_NORMAL,
                                             nsIContentPolicy::TYPE_FONT,
@@ -452,9 +596,6 @@ FontFaceSet::StartLoad(gfxUserFontEntry* aUserFontEntry,
   nsRefPtr<nsFontFaceLoader> fontLoader =
     new nsFontFaceLoader(aUserFontEntry, aFontFaceSrc->mURI, this, channel);
 
-  if (!fontLoader)
-    return NS_ERROR_OUT_OF_MEMORY;
-
   if (LOG_ENABLED()) {
     nsAutoCString fontURI, referrerURI;
     aFontFaceSrc->mURI->GetSpec(fontURI);
@@ -468,7 +609,7 @@ FontFaceSet::StartLoad(gfxUserFontEntry* aUserFontEntry,
   nsCOMPtr<nsIHttpChannel> httpChannel(do_QueryInterface(channel));
   if (httpChannel) {
     httpChannel->SetReferrerWithPolicy(aFontFaceSrc->mReferrer,
-                                       ps->GetDocument()->GetReferrerPolicy());
+                                       mDocument->GetReferrerPolicy());
     nsAutoCString accept("application/font-woff;q=0.9,*/*;q=0.8");
     if (Preferences::GetBool(GFX_PREF_WOFF2_ENABLED)) {
       accept.Insert(NS_LITERAL_CSTRING("application/font-woff2;q=1.0,"), 0);
@@ -491,8 +632,7 @@ FontFaceSet::StartLoad(gfxUserFontEntry* aUserFontEntry,
   rv = NS_NewStreamLoader(getter_AddRefs(streamLoader), fontLoader);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsIDocument *document = ps->GetDocument();
-  mozilla::net::PredictorLearn(aFontFaceSrc->mURI, document->GetDocumentURI(),
+  mozilla::net::PredictorLearn(aFontFaceSrc->mURI, mDocument->GetDocumentURI(),
                                nsINetworkPredictor::LEARN_LOAD_SUBRESOURCE,
                                loadGroup);
 
@@ -595,7 +735,7 @@ FontFaceSet::UpdateRules(const nsTArray<nsFontFaceRuleContainer>& aRules)
     nsCSSFontFaceRule* rule = aRules[i].mRule;
     nsRefPtr<FontFace> f = ruleFaceMap.Get(rule);
     if (!f.get()) {
-      f = FontFace::CreateForRule(GetParentObject(), mPresContext, rule);
+      f = FontFace::CreateForRule(GetParentObject(), this, rule);
     }
     InsertRuleFontFace(f, aRules[i].mSheetType, oldRecords, modified);
     handledRules.PutEntry(aRules[i].mRule);
@@ -637,10 +777,6 @@ FontFaceSet::UpdateRules(const nsTArray<nsFontFaceRuleContainer>& aRules)
       }
 
       // Any left over FontFace objects should also cease being rule backed.
-      MOZ_ASSERT(!mUnavailableFaces.Contains(f),
-                 "FontFace should not occur in mUnavailableFaces twice");
-
-      mUnavailableFaces.AppendElement(f);
       f->DisconnectFromRule();
     }
   }
@@ -688,14 +824,6 @@ void
 FontFaceSet::InsertNonRuleFontFace(FontFace* aFontFace,
                                    bool& aFontSetModified)
 {
-  if (!aFontFace->IsInitialized()) {
-    // The FontFace is still waiting to be initialized, so don't create a
-    // user font entry for it yet.  Once it has been initialized, it will
-    // call OnFontFaceInitialized on us, which will end rebuild the user
-    // font set and end up back in here.
-    return;
-  }
-
   nsAutoString fontfamily;
   if (!aFontFace->GetFamilyName(fontfamily)) {
     // If there is no family name, this rule cannot contribute a
@@ -843,7 +971,7 @@ FontFaceSet::FindOrCreateUserFontEntryFromFontFace(const nsAString& aFamilyName,
   FontFaceSet* set = aFontFace->GetPrimaryFontFaceSet();
 
   nsCSSValue val;
-  uint32_t unit;
+  nsCSSUnit unit;
 
   uint32_t weight = NS_STYLE_FONT_WEIGHT_NORMAL;
   int32_t stretch = NS_STYLE_FONT_STRETCH_NORMAL;
@@ -1154,7 +1282,7 @@ FontFaceSet::LogMessage(gfxUserFontEntry* aUserFontEntry,
     do_CreateInstance(NS_SCRIPTERROR_CONTRACTID, &rv);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  uint64_t innerWindowID = GetPresContext()->Document()->InnerWindowID();
+  uint64_t innerWindowID = mDocument->InnerWindowID();
   rv = scriptError->InitWithWindowID(NS_ConvertUTF8toUTF16(message),
                                      href,         // file
                                      text,         // src line
@@ -1175,14 +1303,12 @@ FontFaceSet::CheckFontLoad(const gfxFontFaceSrc* aFontFaceSrc,
                            nsIPrincipal** aPrincipal,
                            bool* aBypassCache)
 {
-  // check same-site origin
-  nsIPresShell* ps = mPresContext->PresShell();
-  if (!ps)
-    return NS_ERROR_FAILURE;
-
   NS_ASSERTION(aFontFaceSrc &&
                aFontFaceSrc->mSourceType == gfxFontFaceSrc::eSourceType_URL,
                "bad font face url passed to fontloader");
+
+  // check same-site origin
+
   NS_ASSERTION(aFontFaceSrc->mURI, "null font uri");
   if (!aFontFaceSrc->mURI)
     return NS_ERROR_FAILURE;
@@ -1190,7 +1316,7 @@ FontFaceSet::CheckFontLoad(const gfxFontFaceSrc* aFontFaceSrc,
   // use document principal, original principal if flag set
   // this enables user stylesheets to load font files via
   // @font-face rules
-  *aPrincipal = ps->GetDocument()->NodePrincipal();
+  *aPrincipal = mDocument->NodePrincipal();
 
   NS_ASSERTION(aFontFaceSrc->mOriginPrincipal,
                "null origin principal in @font-face rule");
@@ -1200,14 +1326,14 @@ FontFaceSet::CheckFontLoad(const gfxFontFaceSrc* aFontFaceSrc,
 
   nsresult rv = nsFontFaceLoader::CheckLoadAllowed(*aPrincipal,
                                                    aFontFaceSrc->mURI,
-                                                   ps->GetDocument());
+                                                   mDocument);
   if (NS_FAILED(rv)) {
     return rv;
   }
 
   *aBypassCache = false;
 
-  nsCOMPtr<nsIDocShell> docShell = ps->GetDocument()->GetDocShell();
+  nsCOMPtr<nsIDocShell> docShell = mDocument->GetDocShell();
   if (docShell) {
     uint32_t loadType;
     if (NS_SUCCEEDED(docShell->GetLoadType(&loadType))) {
@@ -1229,17 +1355,13 @@ FontFaceSet::SyncLoadFontData(gfxUserFontEntry* aFontToLoad,
   nsresult rv;
 
   nsCOMPtr<nsIChannel> channel;
-  nsIPresShell* ps = mPresContext->PresShell();
-  if (!ps) {
-    return NS_ERROR_FAILURE;
-  }
   // Note we are calling NS_NewChannelWithTriggeringPrincipal() with both a
   // node and a principal.  This is because the document where the font is
   // being loaded might have a different origin from the principal of the
   // stylesheet that initiated the font load.
   rv = NS_NewChannelWithTriggeringPrincipal(getter_AddRefs(channel),
                                             aFontFaceSrc->mURI,
-                                            ps->GetDocument(),
+                                            mDocument,
                                             aFontToLoad->GetPrincipal(),
                                             nsILoadInfo::SEC_NORMAL,
                                             nsIContentPolicy::TYPE_FONT);
@@ -1302,62 +1424,10 @@ FontFaceSet::SyncLoadFontData(gfxUserFontEntry* aFontToLoad,
 bool
 FontFaceSet::GetPrivateBrowsing()
 {
-  nsIPresShell* ps = mPresContext->PresShell();
-  if (!ps) {
-    return false;
-  }
-
-  nsCOMPtr<nsILoadContext> loadContext = ps->GetDocument()->GetLoadContext();
+  nsCOMPtr<nsILoadContext> loadContext = mDocument->GetLoadContext();
   return loadContext && loadContext->UsePrivateBrowsing();
 }
 
-void
-FontFaceSet::DoRebuildUserFontSet()
-{
-  if (!mPresContext) {
-    // AFAICS, this can only happen if someone has already called Destroy() on
-    // this font-set, which means it is in the process of being torn down --
-    // so there's no point trying to update its rules.
-    return;
-  }
-
-  mPresContext->RebuildUserFontSet();
-}
-
-void
-FontFaceSet::AddUnavailableFontFace(FontFace* aFontFace)
-{
-  MOZ_ASSERT(!aFontFace->HasRule());
-  MOZ_ASSERT(!aFontFace->IsInFontFaceSet());
-  MOZ_ASSERT(!mUnavailableFaces.Contains(aFontFace));
-
-  mUnavailableFaces.AppendElement(aFontFace);
-}
-
-void
-FontFaceSet::RemoveUnavailableFontFace(FontFace* aFontFace)
-{
-  MOZ_ASSERT(!aFontFace->HasRule());
-  MOZ_ASSERT(!aFontFace->IsInFontFaceSet());
-
-  // We might not actually find the FontFace in mUnavailableFaces, since we
-  // might be shutting down the document and had DestroyUserFontSet called
-  // on us, which clears out mUnavailableFaces.
-  mUnavailableFaces.RemoveElement(aFontFace);
-
-  MOZ_ASSERT(!mUnavailableFaces.Contains(aFontFace));
-}
-
-void
-FontFaceSet::OnFontFaceInitialized(FontFace* aFontFace)
-{
-  MOZ_ASSERT(HasAvailableFontFace(aFontFace));
-  MOZ_ASSERT(!aFontFace->HasRule());
-  MOZ_ASSERT(aFontFace->IsInitialized());
-
-  mPresContext->RebuildUserFontSet();
-}
-
 void
 FontFaceSet::OnFontFaceStatusChanged(FontFace* aFontFace)
 {
@@ -1468,7 +1538,8 @@ FontFaceSet::MightHavePendingFontLoads()
 
   // Check for pending restyles or reflows, as they might cause fonts to
   // load as new styles apply and text runs are rebuilt.
-  if (mPresContext && mPresContext->HasPendingRestyleOrReflow()) {
+  nsPresContext* presContext = GetPresContext();
+  if (presContext && presContext->HasPendingRestyleOrReflow()) {
     return true;
   }
 
@@ -1611,6 +1682,33 @@ FontFaceSet::StyleSheetLoaded(mozilla::CSSStyleSheet* aSheet,
   return NS_OK;
 }
 
+void
+FontFaceSet::FlushUserFontSet()
+{
+  if (mDocument) {
+    mDocument->FlushUserFontSet();
+  }
+}
+
+void
+FontFaceSet::RebuildUserFontSet()
+{
+  if (mDocument) {
+    mDocument->RebuildUserFontSet();
+  }
+}
+
+nsPresContext*
+FontFaceSet::GetPresContext()
+{
+  if (!mDocument) {
+    return nullptr;
+  }
+
+  nsIPresShell* shell = mDocument->GetShell();
+  return shell ? shell->GetPresContext() : nullptr;
+}
+
 // -- FontFaceSet::UserFontSet ------------------------------------------------
 
 /* virtual */ nsresult
@@ -1671,7 +1769,7 @@ FontFaceSet::UserFontSet::DoRebuildUserFontSet()
   if (!mFontFaceSet) {
     return;
   }
-  mFontFaceSet->DoRebuildUserFontSet();
+  mFontFaceSet->RebuildUserFontSet();
 }
 
 /* virtual */ already_AddRefed<gfxUserFontEntry>
@@ -1689,3 +1787,6 @@ FontFaceSet::UserFontSet::CreateUserFontEntry(
                         aFeatureSettings, aLanguageOverride, aUnicodeRanges);
   return entry.forget();
 }
+
+#undef LOG_ENABLED
+#undef LOG
diff --git a/layout/style/FontFaceSet.h b/layout/style/FontFaceSet.h
index 5aaa9fbcc0..04d9d248c0 100644
--- a/layout/style/FontFaceSet.h
+++ b/layout/style/FontFaceSet.h
@@ -21,6 +21,9 @@ class nsIPrincipal;
 class nsPIDOMWindow;
 
 namespace mozilla {
+namespace css {
+class FontFamilyListRefCnt;
+}
 namespace dom {
 class FontFace;
 class Promise;
@@ -93,40 +96,25 @@ public:
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(FontFaceSet, DOMEventTargetHelper)
   NS_DECL_NSIDOMEVENTLISTENER
 
-  FontFaceSet(nsPIDOMWindow* aWindow, nsPresContext* aPresContext);
+  FontFaceSet(nsPIDOMWindow* aWindow, nsIDocument* aDocument);
 
   virtual JSObject* WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto) override;
 
   UserFontSet* GetUserFontSet() { return mUserFontSet; }
 
-  // Called when this font set is no longer associated with a presentation.
-  void DestroyUserFontSet();
-
   // Called by nsFontFaceLoader when the loader has completed normally.
   // It's removed from the mLoaders set.
   void RemoveLoader(nsFontFaceLoader* aLoader);
 
   bool UpdateRules(const nsTArray<nsFontFaceRuleContainer>& aRules);
 
-  nsPresContext* GetPresContext() { return mPresContext; }
+  nsPresContext* GetPresContext();
 
   // search for @font-face rule that matches a platform font entry
   nsCSSFontFaceRule* FindRuleForEntry(gfxFontEntry* aFontEntry);
 
   void IncrementGeneration(bool aIsRebuild = false);
 
-  /**
-   * Adds the specified FontFace to the mUnavailableFaces array.  This is called
-   * when a new FontFace object has just been created in JS by the author.
-   */
-  void AddUnavailableFontFace(FontFace* aFontFace);
-
-  /**
-   * Removes the specified FontFace from the mUnavailableFaces array.  This
-   * is called when a FontFace object is about be destroyed.
-   */
-  void RemoveUnavailableFontFace(FontFace* aFontFace);
-
   /**
    * Finds an existing entry in the user font cache or creates a new user
    * font entry for the given FontFace object.
@@ -134,15 +122,6 @@ public:
   static already_AddRefed<gfxUserFontEntry>
     FindOrCreateUserFontEntryFromFontFace(FontFace* aFontFace);
 
-  /**
-   * Notification method called by a FontFace once it has been initialized.
-   *
-   * This is needed for the FontFaceSet to handle a FontFace that was created
-   * and inserted into the set immediately, before the event loop has spun and
-   * the FontFace's initialization tasks have run.
-   */
-  void OnFontFaceInitialized(FontFace* aFontFace);
-
   /**
    * Notification method called by a FontFace to indicate that its loading
    * status has changed.
@@ -168,12 +147,15 @@ public:
 
   FontFace* GetFontFaceAt(uint32_t aIndex);
 
+  void FlushUserFontSet();
+
   // -- Web IDL --------------------------------------------------------------
 
   IMPL_EVENT_HANDLER(loading)
   IMPL_EVENT_HANDLER(loadingdone)
   IMPL_EVENT_HANDLER(loadingerror)
-  already_AddRefed<mozilla::dom::Promise> Load(const nsAString& aFont,
+  already_AddRefed<mozilla::dom::Promise> Load(JSContext* aCx,
+                                               const nsAString& aFont,
                                                const nsAString& aText,
                                                mozilla::ErrorResult& aRv);
   bool Check(const nsAString& aFont,
@@ -184,7 +166,7 @@ public:
 
   FontFaceSet* Add(FontFace& aFontFace, mozilla::ErrorResult& aRv);
   void Clear();
-  bool Delete(FontFace& aFontFace, mozilla::ErrorResult& aRv);
+  bool Delete(FontFace& aFontFace);
   bool Has(FontFace& aFontFace);
   uint32_t Size();
   mozilla::dom::FontFaceSetIterator* Entries();
@@ -274,7 +256,7 @@ private:
                       const char* aMessage,
                       uint32_t aFlags,
                       nsresult aStatus);
-  void DoRebuildUserFontSet();
+  void RebuildUserFontSet();
 
   void InsertRuleFontFace(FontFace* aFontFace, uint8_t aSheetType,
                           nsTArray<FontFaceRecord>& aOldRecords,
@@ -293,8 +275,19 @@ private:
   // Helper function for HasLoadingFontFaces.
   void UpdateHasLoadingFontFaces();
 
+  void ParseFontShorthandForMatching(
+              const nsAString& aFont,
+              nsRefPtr<mozilla::css::FontFamilyListRefCnt>& aFamilyList,
+              uint32_t& aWeight,
+              int32_t& aStretch,
+              uint32_t& aItalicStyle,
+              ErrorResult& aRv);
+  void FindMatchingFontFaces(const nsAString& aFont,
+                             const nsAString& aText,
+                             nsTArray<FontFace*>& aFontFaces,
+                             mozilla::ErrorResult& aRv);
+
   nsRefPtr<UserFontSet> mUserFontSet;
-  nsPresContext* mPresContext;
 
   // The document this is a FontFaceSet for.
   nsCOMPtr<nsIDocument> mDocument;
@@ -319,10 +312,6 @@ private:
   // FontFaceSet.
   nsTArray<FontFaceRecord> mNonRuleFaces;
 
-  // The non rule backed FontFace objects that have not been added to
-  // this FontFaceSet.
-  nsTArray<FontFace*> mUnavailableFaces;
-
   // The overall status of the loading or loaded fonts in the FontFaceSet.
   mozilla::dom::FontFaceSetLoadStatus mStatus;
 
diff --git a/layout/style/moz.build b/layout/style/moz.build
index ba03113f9c..b539de5a73 100644
--- a/layout/style/moz.build
+++ b/layout/style/moz.build
@@ -126,6 +126,7 @@ UNIFIED_SOURCES += [
     'Declaration.cpp',
     'ErrorReporter.cpp',
     'FontFace.cpp',
+    'FontFaceSet.cpp',
     'FontFaceSetIterator.cpp',
     'ImageLoader.cpp',
     'IncrementalClearCOMRuleArray.cpp',
@@ -172,10 +173,8 @@ UNIFIED_SOURCES += [
     'SVGAttrAnimationRuleProcessor.cpp',
 ]
 
-# FontFaceSet.cpp needs to be built separately because it redefines LOG.
 # nsCSSRuleProcessor.cpp needs to be built separately because it uses plarena.h.
 SOURCES += [
-    'FontFaceSet.cpp',
     'nsCSSRuleProcessor.cpp',
 ]
 
diff --git a/layout/style/nsFontFaceLoader.cpp b/layout/style/nsFontFaceLoader.cpp
index c08517cbae..4e11026559 100644
--- a/layout/style/nsFontFaceLoader.cpp
+++ b/layout/style/nsFontFaceLoader.cpp
@@ -118,7 +118,6 @@ nsFontFaceLoader::LoadTimerCallback(nsITimer* aTimer, void* aClosure)
   if (updateUserFontSet) {
     ufe->mFontDataLoadingState = gfxUserFontEntry::LOADING_SLOWLY;
     nsPresContext* ctx = loader->mFontFaceSet->GetPresContext();
-    NS_ASSERTION(ctx, "userfontset doesn't have a presContext?");
     if (ctx) {
       loader->mFontFaceSet->IncrementGeneration();
       ctx->UserFontSetUpdated(loader->GetUserFontEntry());
@@ -155,10 +154,6 @@ nsFontFaceLoader::OnStreamComplete(nsIStreamLoader* aLoader,
     }
   }
 
-  nsPresContext* ctx = mFontFaceSet->GetPresContext();
-  NS_ASSERTION(ctx && !ctx->PresShell()->IsDestroying(),
-               "We should have been canceled already");
-
   if (NS_SUCCEEDED(aStatus)) {
     // for HTTP requests, check whether the request _actually_ succeeded;
     // the "request status" in aStatus does not necessarily indicate this,
@@ -184,11 +179,12 @@ nsFontFaceLoader::OnStreamComplete(nsIStreamLoader* aLoader,
   // This is called even in the case of a failed download (HTTP 404, etc),
   // as there may still be data to be freed (e.g. an error page),
   // and we need to load the next source.
+  nsPresContext* ctx = mFontFaceSet->GetPresContext();
   bool fontUpdate =
     mUserFontEntry->FontDataDownloadComplete(aString, aStringLen, aStatus);
 
   // when new font loaded, need to reflow
-  if (fontUpdate) {
+  if (fontUpdate && ctx) {
     // Update layout for the presence of the new font.  Since this is
     // asynchronous, reflows will coalesce.
     ctx->UserFontSetUpdated(mUserFontEntry);
diff --git a/layout/style/nsStyleUtil.cpp b/layout/style/nsStyleUtil.cpp
index 7be207edfa..cf7ee19b24 100644
--- a/layout/style/nsStyleUtil.cpp
+++ b/layout/style/nsStyleUtil.cpp
@@ -463,11 +463,10 @@ nsStyleUtil::ComputeFunctionalAlternates(const nsCSSValueList* aList,
   }
 }
 
-// print all characters with at least four hex digits
 static void
 AppendSerializedUnicodePoint(uint32_t aCode, nsACString& aBuf)
 {
-  aBuf.Append(nsPrintfCString("%04X", aCode));
+  aBuf.Append(nsPrintfCString("%0X", aCode));
 }
 
 // A unicode-range: descriptor is represented as an array of integers,
diff --git a/layout/style/test/test_font_face_parser.html b/layout/style/test/test_font_face_parser.html
index d968b3b087..82a8004b36 100644
--- a/layout/style/test/test_font_face_parser.html
+++ b/layout/style/test/test_font_face_parser.html
@@ -168,28 +168,28 @@
       noncanonical: true },
 
     // Correct unicode-range:
-    { rule: _("unicode-range: U+00A5;"), d: { "unicode-range" : "U+00A5" } },
-    { rule: _("unicode-range: U+A5;"),
-      d: { "unicode-range" : "U+00A5" }, noncanonical: true },
+    { rule: _("unicode-range: U+A5;"), d: { "unicode-range" : "U+A5" } },
+    { rule: _("unicode-range: U+00A5;"),
+      d: { "unicode-range" : "U+A5" }, noncanonical: true },
     { rule: _("unicode-range: U+00a5;"),
-      d: { "unicode-range" : "U+00A5" }, noncanonical: true },
+      d: { "unicode-range" : "U+A5" }, noncanonical: true },
     { rule: _("unicode-range: u+00a5;"),
-      d: { "unicode-range" : "U+00A5" }, noncanonical: true },
-    { rule: _("unicode-range: U+0000-00FF;"),
-      d: { "unicode-range" : "U+0000-00FF" } },
+      d: { "unicode-range" : "U+A5" }, noncanonical: true },
+    { rule: _("unicode-range: U+0-FF;"),
+      d: { "unicode-range" : "U+0-FF" } },
     { rule: _("unicode-range: U+00??;"),
-      d: { "unicode-range" : "U+0000-00FF" }, noncanonical: true },
+      d: { "unicode-range" : "U+0-FF" }, noncanonical: true },
     { rule: _("unicode-range: U+?"),
-      d: { "unicode-range" : "U+0000-000F" }, noncanonical: true },
+      d: { "unicode-range" : "U+0-F" }, noncanonical: true },
     { rule: _("unicode-range: U+??????"),
-      d: { "unicode-range" : "U+0000-10FFFF" }, noncanonical: true },
+      d: { "unicode-range" : "U+0-10FFFF" }, noncanonical: true },
     { rule: _("unicode-range: U+590-5ff;"),
-      d: { "unicode-range" : "U+0590-05FF" }, noncanonical: true },
+      d: { "unicode-range" : "U+590-5FF" }, noncanonical: true },
     { rule: _("unicode-range: U+A0000-12FFFF"),
       d: { "unicode-range" : "U+A0000-10FFFF" }, noncanonical: true },
 
     { rule: _("unicode-range: U+A5, U+4E00-9FFF, U+30??, U+FF00-FF9F;"),
-      d: { "unicode-range" : "U+00A5, U+4E00-9FFF, U+3000-30FF, U+FF00-FF9F" },
+      d: { "unicode-range" : "U+A5, U+4E00-9FFF, U+3000-30FF, U+FF00-FF9F" },
       noncanonical: true },
 
     { rule: _("unicode-range: U+104??;"),
@@ -200,9 +200,9 @@
     { rule: _("unicode-range: U+100000-10ABCD;"),
       d: { "unicode-range" : "U+100000-10ABCD" } },
     { rule: _("unicode-range: U+0121 , U+1023"),
-      d: { "unicode-range" : "U+0121, U+1023" }, noncanonical: true },
+      d: { "unicode-range" : "U+121, U+1023" }, noncanonical: true },
     { rule: _("unicode-range: U+0121/**/, U+1023"),
-      d: { "unicode-range" : "U+0121, U+1023" }, noncanonical: true },
+      d: { "unicode-range" : "U+121, U+1023" }, noncanonical: true },
 
     // Incorrect unicode-range:
     { rule: _("unicode-range:"), d: {} },
@@ -249,9 +249,9 @@
     // Descending ranges and ranges outside 0-10FFFF are ignored
     // but do not invalidate the descriptor
     { rule: _("unicode-range: U+A5, U+90-30"),
-      d: { "unicode-range" : "U+00A5" }, noncanonical: true },
+      d: { "unicode-range" : "U+A5" }, noncanonical: true },
     { rule: _("unicode-range: U+A5, U+220043"),
-      d: { "unicode-range" : "U+00A5" }, noncanonical: true },
+      d: { "unicode-range" : "U+A5" }, noncanonical: true },
 
     // font-feature-settings
     { rule: _("font-feature-settings: normal;"),
diff --git a/layout/style/test/test_font_loading_api.html b/layout/style/test/test_font_loading_api.html
index eef5f5f1d0..0ae3956e6b 100644
--- a/layout/style/test/test_font_loading_api.html
+++ b/layout/style/test/test_font_loading_api.html
@@ -6,6 +6,9 @@
 
 <script src=descriptor_database.js></script>
 
+<body onload="start()">
+<iframe style="display: none"></iframe>
+
 <script>
 // Map of FontFace descriptor attribute names to @font-face rule descriptor
 // names.
@@ -24,19 +27,19 @@ var defaultValues = {
   style: "normal",
   weight: "normal",
   stretch: "normal",
-  unicodeRange: "U+0000-10FFFF",
+  unicodeRange: "U+0-10FFFF",
   variant: "normal",
   featureSettings: "normal"
 };
 
 // Non-default values for the FontFace descriptor attributes other than family
 // along with how Gecko currently serializes them.  Each value is chosen to be
-// differeny from the default value and also has a different serialized form.
+// different from the default value and also has a different serialized form.
 var nonDefaultValues = {
   style: ["Italic", "italic"],
   weight: ["Bold", "bold"],
   stretch: ["Ultra-Condensed", "ultra-condensed"],
-  unicodeRange: ["U+3??", "U+0300-03FF"],
+  unicodeRange: ["U+3??", "U+300-3FF"],
   variant: ["Small-Caps", "small-caps"],
   featureSettings: ["'dlig' on", "\"dlig\""]
 };
@@ -53,9 +56,13 @@ var invalidValues = {
 
 // Invalid font family names.
 var invalidFontFamilyNames = [
-  "", "\"\"", "sans-serif", "A, B", "inherit"
+  "", "\"\"", "sans-serif", "A, B", "inherit", "a 1"
 ];
 
+// Font family list where at least one is likely to be available on
+// platforms we care about.
+var likelyPlatformFonts = "Helvetica Neue, Bitstream Vera Sans, Bitstream Vera Sans Roman, FreeSans, Free Sans, SwissA, DejaVu Sans, Arial";
+
 // Will hold an ArrayBuffer containing a valid font.
 var fontData;
 
@@ -153,6 +160,15 @@ function awaitRefresh() {
 function runTest() {
   SimpleTest.waitForExplicitFinish();
 
+  // Document and window from inside the display:none iframe.
+  var iframe = document.querySelector("iframe");
+  var fdocument = iframe.contentDocument;
+  var fwindow = iframe.contentWindow;
+
+  // For easier test assertion descriptions.
+  document.toString  = window.toString  = function() { return "visible document"; };
+  fdocument.toString = fwindow.toString = function() { return "display:none document"; };
+
   queue = queue.then(function() {
 
     // First, initialize fontData.
@@ -176,132 +192,183 @@ function runTest() {
 
     // (TEST 3) Test that document.fonts.ready starts out resolved with the
     // FontFaceSet.
-    return is_resolved_with(document.fonts.ready, document.fonts, "initial value of document.fonts", "(TEST 3)");
+    var p = Promise.resolve();
+    [document, fdocument].forEach(function(doc) {
+      p = p.then(function() {
+        return is_resolved_with(doc.fonts.ready, doc.fonts, "initial value of document.fonts", "(TEST 3) (" + doc + ")");
+      });
+    });
+    return p;
 
   }).then(function() {
 
     // (TEST 4) Test that document.fonts in this test document starts out with no
     // FontFace objects in it.
-    is(Array.from(document.fonts).length, 0, "initial number of FontFace objects in document.fonts (TEST 4)");
+    [document, fdocument].forEach(function(doc) {
+      is(Array.from(doc.fonts).length, 0, "initial number of FontFace objects in document.fonts (TEST 4) (" + doc + ")");
+    });
 
     // (TEST 5) Test that document.fonts.status starts off as loaded.
-    is(document.fonts.status, "loaded", "initial value of document.fonts.status (TEST 5)");
+    [document, fdocument].forEach(function(doc) {
+      is(doc.fonts.status, "loaded", "initial value of document.fonts.status (TEST 5) (" + doc + ")");
+    });
 
     // (TEST 6) Test initial value of FontFace.status when a url() source is
     // used.
-    is(new FontFace("test", "url(x)").status, "unloaded", "initial value of FontFace.status when a url() source is used (TEST 6)");
+    [window, fwindow].forEach(function(win) {
+      is(new win.FontFace("test", "url(x)").status, "unloaded", "initial value of FontFace.status from " + win + " when a url() source is used (TEST 6) (" + win + ")");
+    });
 
     // (TEST 7) Test initial value of FontFace.status when an invalid
-    // ArrayBuffer source is used.
-    is(new FontFace("test", new ArrayBuffer(0)).status, "unloaded", "initial value of FontFace.status when an invalid ArrayBuffer source is used (TEST 7)");
+    // ArrayBuffer source is used.  Because it has an implicit initial
+    // load() call, it should either be "loading" if the browser is
+    // asynchronously parsing the font data, or "error" if it parsed
+    // it immediately.
+    [window, fwindow].forEach(function(win) {
+      var status = new win.FontFace("test", new ArrayBuffer(0)).status;
+      ok(status == "loading" || status == "error", "initial value of FontFace.status from " + win + " when an invalid ArrayBuffer source is used (TEST 7) (" + win + ")");
+    });
 
     // (TEST 8) Test initial value of FontFace.status when a valid ArrayBuffer
-    // source is used.
-    is(new FontFace("test", fontData).status, "unloaded", "initial value of FontFace.status when a valid ArrayBuffer source is used (TEST 8)");
+    // source is used.  Because it has an implicit initial load() call, it
+    // should either be "loading" if the browser is asynchronously parsing the
+    // font data, or "loaded" if it parsed it immediately.
+    [window, fwindow].forEach(function(win) {
+      status = new win.FontFace("test", fontData).status;
+      ok(status == "loading" || status == "loaded", "initial value of FontFace.status from " + win + " when a valid ArrayBuffer source is used (TEST 8) (" + win + ")");
+    });
 
-    // (TEST 9) Test initial value of FontFace.loaded when an invalid url()
-    // source is used.
-    return is_pending(new FontFace("test", "").loaded, "initial value of FontFace.loaded when an invalid url() source is used", "(TEST 9)");
+    // (TEST 9) (old test became redundant with TEST 19)
 
   }).then(function() {
 
     // (TEST 10) Test initial value of FontFace.loaded when a valid url()
     // source is used.
-    return is_pending(new FontFace("test", "url(x)").loaded, "initial value of FontFace.loaded when a valid url() source is used", "(TEST 10)");
+    var p = Promise.resolve();
+    [window, fwindow].forEach(function(win) {
+      p = p.then(function() {
+        return is_pending(new win.FontFace("test", "url(x)").loaded, "initial value of FontFace.loaded from " + win + " when a valid url() source is used", "(TEST 10) (" + win + ")");
+      });
+    });
+    return p;
 
   }).then(function() {
 
-    // (TEST 11) Test initial value of FontFace.loaded when an invalid
-    // ArrayBuffer source is used.
-    return is_pending(new FontFace("test", new ArrayBuffer(0)).loaded, "initial value of FontFace.loaded when an invalid ArrayBuffer source is used", "(TEST 11)");
+    // (TEST 11) (old test became redundant with TEST 21)
 
   }).then(function() {
 
-    // (TEST 12) Test initial value of FontFace.loaded when a valid ArrayBuffer
-    // source is used.
-    return is_pending(new FontFace("test", fontData).loaded, "initial value of FontFace.loaded when a valid ArrayBuffer source is used", "(TEST 12)");
+    // (TEST 12) (old test became redundant with TEST 20)
 
   }).then(function() {
 
     // (TEST 13) Test initial values of the descriptor attributes on FontFace
     // objects.
-    var face = new FontFace("test", fontData);
-    // XXX Spec issue: what values do the descriptor attributes have before the
-    // constructor's dictionary argument is parsed?
-    for (var desc in defaultValues) {
-      is(face[desc], defaultValues[desc], "initial value of FontFace." + desc + " (TEST 13)");
-    }
+    [window, fwindow].forEach(function(win) {
+      var face = new win.FontFace("test", fontData);
+      // XXX Spec issue: what values do the descriptor attributes have before the
+      // constructor's dictionary argument is parsed?
+      for (var desc in defaultValues) {
+        is(face[desc], defaultValues[desc], "initial value of FontFace." + desc + " (TEST 13) (" + win + ")");
+      }
+    });
 
     // (TEST 14) Test default values of the FontFaceDescriptors dictionary.
-    return face.loaded.then(function() {
-      for (var desc in defaultValues) {
-        is(face[desc], defaultValues[desc], "default value of FontFace." + desc + " (TEST 14)");
-      }
-    }, function(aError) {
-      ok(false, "FontFace should have loaded succesfully (TEST 14)");
+    var p = Promise.resolve();
+    [window, fwindow].forEach(function(win) {
+      p = p.then(function() {
+        var face = new win.FontFace("test", fontData);
+        return face.loaded.then(function() {
+          for (var desc in defaultValues) {
+            is(face[desc], defaultValues[desc], "default value of FontFace." + desc + " (TEST 14) (" + win + ")");
+          }
+        }, function(aError) {
+          ok(false, "FontFace should have loaded succesfully (TEST 14) (" + win + ")");
+        });
+      });
     });
+    return p;
 
   }).then(function() {
 
     // (TEST 15) Test passing non-default descriptor values to the FontFace
     // constructor.
-    var descriptorTests = Promise.resolve();
-    Object.keys(nonDefaultValues).forEach(function(aDesc) {
-      descriptorTests = descriptorTests.then(function() {
-        var init = {};
-        init[aDesc] = nonDefaultValues[aDesc][0];
-        var face = new FontFace("test", fontData, init);
-        var ok_todo = aDesc == "variant" ? todo : ok;
-        ok_todo(face[aDesc] == nonDefaultValues[aDesc][1], "specified valid non-default value of FontFace." + aDesc + " immediately after construction (TEST 15)");
-        return face.loaded.then(function() {
-          ok_todo(face[aDesc] == nonDefaultValues[aDesc][1], "specified valid non-default value of FontFace." + aDesc + " (TEST 15)");
-        }, function(aError) {
-          ok(false, "FontFace should have loaded succesfully (TEST 15)");
+    var p = Promise.resolve();
+    [window, fwindow].forEach(function(win) {
+      p = p.then(function() {
+        var descriptorTests = Promise.resolve();
+        Object.keys(nonDefaultValues).forEach(function(aDesc) {
+          descriptorTests = descriptorTests.then(function() {
+            var init = {};
+            init[aDesc] = nonDefaultValues[aDesc][0];
+            var face = new win.FontFace("test", fontData, init);
+            var ok_todo = aDesc == "variant" ? todo : ok;
+            ok_todo(face[aDesc] == nonDefaultValues[aDesc][1], "specified valid non-default value of FontFace." + aDesc + " immediately after construction (TEST 15) (" + win + ")");
+            return face.loaded.then(function() {
+              ok_todo(face[aDesc] == nonDefaultValues[aDesc][1], "specified valid non-default value of FontFace." + aDesc + " (TEST 15) (" + win + ")");
+            }, function(aError) {
+              ok(false, "FontFace should have loaded succesfully (TEST 15) (" + win + ")");
+            });
+          });
         });
+        return descriptorTests;
       });
     });
-    return descriptorTests;
+    return p;
 
   }).then(function() {
 
     // (TEST 16) Test passing invalid descriptor values to the FontFace
     // constructor.
-    var descriptorTests = Promise.resolve();
-    Object.keys(invalidValues).forEach(function(aDesc) {
-      descriptorTests = descriptorTests.then(function() {
-        var init = {};
-        init[aDesc] = invalidValues[aDesc];
-        var face = new FontFace("test", fontData, init);
-        var ok_todo = aDesc == "variant" ? todo : ok;
-        ok_todo(face.status == "error", "FontFace should be error immediately after construction with invalid value of FontFace." + aDesc + " (TEST 16)");
-        return face.loaded.then(function() {
-          ok_todo(false, "FontFace should not load after invalid value of FontFace." + aDesc + " specified (TEST 16)");
-        }, function(aError) {
-          ok(true, "FontFace should not load after invalid value of FontFace." + aDesc + " specified (TEST 16)");
-          is(aError.name, "SyntaxError", "FontFace.loaded with invalid value of FontFace." + aDesc + " should be rejected with a SyntaxError (TEST 16)");
+    var p = Promise.resolve();
+    [window, fwindow].forEach(function(win) {
+      p = p.then(function() {
+        var descriptorTests = Promise.resolve();
+        Object.keys(invalidValues).forEach(function(aDesc) {
+          descriptorTests = descriptorTests.then(function() {
+            var init = {};
+            init[aDesc] = invalidValues[aDesc];
+            var face = new win.FontFace("test", fontData, init);
+            var ok_todo = aDesc == "variant" ? todo : ok;
+            ok_todo(face.status == "error", "FontFace should be error immediately after construction with invalid value of FontFace." + aDesc + " (TEST 16) (" + win + ")");
+            return face.loaded.then(function() {
+              ok_todo(false, "FontFace should not load after invalid value of FontFace." + aDesc + " specified (TEST 16) (" + win + ")");
+            }, function(aError) {
+              ok(true, "FontFace should not load after invalid value of FontFace." + aDesc + " specified (TEST 16) (" + win + ")");
+              is(aError.name, "SyntaxError", "FontFace.loaded with invalid value of FontFace." + aDesc + " should be rejected with a SyntaxError (TEST 16) (" + win + ")");
+            });
+          });
         });
+        return descriptorTests;
       });
     });
-    return descriptorTests;
+    return p;
 
   }).then(function() {
 
     // (TEST 17) Test passing an invalid font family name to the FontFace
     // constructor.
-    var familyTests = Promise.resolve();
-    invalidFontFamilyNames.forEach(function(aFamilyName) {
-      familyTests = familyTests.then(function() {
-        var face = new FontFace(aFamilyName, fontData);
-        is(face.status, "error", "FontFace should be error immediately after construction with invalid family name " + aFamilyName + " (TEST 17)");
-        return face.loaded.then(function() {
-          ok(false, "FontFace should not load after invalid family name " + aFamilyName + " specified (TEST 17)");
-        }, function(aError) {
-          ok(true, "FontFace should not load after invalid family name " + aFamilyName + " specified (TEST 17)");
-          is(aError.name, "SyntaxError", "FontFace.loaded with invalid family name " + aFamilyName + " should be rejected with a SyntaxError (TEST 17)");
+    var p = Promise.resolve();
+    [window, fwindow].forEach(function(win) {
+      p = p.then(function() {
+        var familyTests = Promise.resolve();
+        invalidFontFamilyNames.forEach(function(aFamilyName) {
+          familyTests = familyTests.then(function() {
+            var face = new win.FontFace(aFamilyName, fontData);
+            is(face.status, "error", "FontFace should be error immediately after construction with invalid family name " + aFamilyName + " (TEST 17) (" + win + ")");
+            is(face.family, "", "FontFace.family should be the empty string after construction with invalid family name " + aFamilyName + " (TEST 17) (" + win + ")");
+            return face.loaded.then(function() {
+              ok(false, "FontFace should not load after invalid family name " + aFamilyName + " specified (TEST 17) (" + win + ")");
+            }, function(aError) {
+              ok(true, "FontFace should not load after invalid family name " + aFamilyName + " specified (TEST 17) (" + win + ")");
+              is(aError.name, "SyntaxError", "FontFace.loaded with invalid family name " + aFamilyName + " should be rejected with a SyntaxError (TEST 17) (" + win + ")");
+            });
+          });
         });
+        return familyTests;
       });
     });
-    return familyTests;
+    return p;
 
   }).then(function() {
 
@@ -310,99 +377,137 @@ function runTest() {
 
     // (TEST 18) Test passing valid url() source strings to the FontFace
     // constructor.
-    var srcTests = Promise.resolve();
-    gCSSFontFaceDescriptors.src.values.forEach(function(aSrc) {
-      srcTests = srcTests.then(function() {
-        var face = new FontFace("test", aSrc);
-        return face.load().then(function() {
-          ok(true, "FontFace should load with valid url() src " + aSrc + " (TEST 18)");
-        }, function(aError) {
-          is(aError.name, "NetworkError", "FontFace had NetworkError when loading with valid url() src " + aSrc + " (TEST 18)");
+    var p = Promise.resolve();
+    [window, fwindow].forEach(function(win) {
+      p = p.then(function() {
+        var srcTests = Promise.resolve();
+        gCSSFontFaceDescriptors.src.values.forEach(function(aSrc) {
+          srcTests = srcTests.then(function() {
+            var face = new win.FontFace("test", aSrc);
+            return face.load().then(function() {
+              ok(true, "FontFace should load with valid url() src " + aSrc + " (TEST 18) (" + win + ")");
+            }, function(aError) {
+              is(aError.name, "NetworkError", "FontFace had NetworkError when loading with valid url() src " + aSrc + " (TEST 18) (" + win + ")");
+            });
+          });
         });
+        return srcTests;
       });
     });
-    return srcTests;
+    return p;
 
   }).then(function() {
 
     // (TEST 19) Test passing invalid url() source strings to the FontFace
     // constructor.
-    var srcTests = Promise.resolve();
-    gCSSFontFaceDescriptors.src.invalid_values.forEach(function(aSrc) {
-      srcTests = srcTests.then(function() {
-        var face = new FontFace("test", aSrc);
-        return face.load().then(function() {
-          ok(false, "FontFace should not load with invalid url() src " + aSrc + " (TEST 19)");
-        }, function(aError) {
-          is(aError.name, "SyntaxError", "FontFace.ready should have been rejected with a SyntaxError when loaded with an invalid url() src " + aSrc + " (TEST 19)");
+    var p = Promise.resolve();
+    [window, fwindow].forEach(function(win) {
+      p = p.then(function() {
+        var srcTests = Promise.resolve();
+        gCSSFontFaceDescriptors.src.invalid_values.forEach(function(aSrc) {
+          srcTests = srcTests.then(function() {
+            var face = new win.FontFace("test", aSrc);
+            is(face.status, "error", "FontFace.status should be \"error\" when constructed with an invalid url() src " + aSrc + " (TEST 19) (" + win + ")");
+            return face.loaded.then(function() {
+              ok(false, "FontFace should not load with invalid url() src " + aSrc + " (TEST 19) (" + win + ")");
+            }, function(aError) {
+              is(aError.name, "SyntaxError", "FontFace.ready should have been rejected with a SyntaxError when constructed with an invalid url() src " + aSrc + " (TEST 19) (" + win + ")");
+            });
+          });
         });
+        return srcTests;
       });
     });
-    return srcTests;
+    return p;
 
   }).then(function() {
 
     // (TEST 20) Test that the status of a FontFace constructed with a valid
     // ArrayBuffer source eventually becomes "loaded".
-    var face = new FontFace("test", fontData);
-    return face.loaded.then(function() {
-      is(face.status, "loaded", "status of FontFace constructed with a valid ArrayBuffer source should eventually be \"loaded\" (TEST 20)");
-    }, function(aError) {
-      ok(false, "FontFace constructed with a valid ArrayBuffer should eventually load (TEST 20)");
+    var p = Promise.resolve();
+    [window, fwindow].forEach(function(win) {
+      p = p.then(function() {
+        var face = new win.FontFace("test", fontData);
+        return face.loaded.then(function(aFace) {
+          is(face.status, "loaded", "status of FontFace constructed with a valid ArrayBuffer source should eventually be \"loaded\" (TEST 20) (" + win + ")");
+          is(face, aFace, "FontFace.loaded was resolved with the FontFace object once loaded (TEST 20) (" + win + ")");
+        }, function(aError) {
+          ok(false, "FontFace constructed with a valid ArrayBuffer should eventually load (TEST 20) (" + win + ")");
+        });
+      });
     });
+    return p;
 
   }).then(function() {
 
     // (TEST 21) Test that the status of a FontFace constructed with an invalid
     // ArrayBuffer source eventually becomes "error".
-    var face = new FontFace("test", new ArrayBuffer(0));
-    return face.loaded.then(function() {
-      ok(false, "FontFace constructed with an invalid ArrayBuffer should not load (TEST 21)");
-    }, function(aError) {
-      is(aError.name, "SyntaxError", "loaded of FontFace constructed with an invalid ArrayBuffer source should be rejected with TypeError (TEST 21)");
-      is(face.status, "error", "status of FontFace constructed with an invalid ArrayBuffer source should eventually be \"error\" (TEST 21)");
+    var p = Promise.resolve();
+    [window, fwindow].forEach(function(win) {
+      p = p.then(function() {
+        var face = new win.FontFace("test", new ArrayBuffer(0));
+        return face.loaded.then(function() {
+          ok(false, "FontFace constructed with an invalid ArrayBuffer should not load (TEST 21) (" + win + ")");
+        }, function(aError) {
+          is(aError.name, "SyntaxError", "loaded of FontFace constructed with an invalid ArrayBuffer source should be rejected with TypeError (TEST 21) (" + win + ")");
+          is(face.status, "error", "status of FontFace constructed with an invalid ArrayBuffer source should eventually be \"error\" (TEST 21) (" + win + ")");
+        });
+      });
     });
+    return p;
 
   }).then(function() {
 
     // (TEST 22) Test assigning non-default descriptor values on the FontFace.
-    var descriptorTests = Promise.resolve();
-    Object.keys(nonDefaultValues).forEach(function(aDesc) {
-      descriptorTests = descriptorTests.then(function() {
-        var face = new FontFace("test", fontData);
-        return face.loaded.then(function() {
-          var ok_todo = aDesc == "variant" ? todo : ok;
-          face[aDesc] = nonDefaultValues[aDesc][0];
-          ok_todo(face[aDesc] == nonDefaultValues[aDesc][1], "assigned valid non-default value to FontFace." + aDesc + " (TEST 22) ");
-        }, function(aError) {
-          ok(false, "FontFace should have loaded succesfully (TEST 22)");
+    var p = Promise.resolve();
+    [window, fwindow].forEach(function(win) {
+      p = p.then(function() {
+        var descriptorTests = Promise.resolve();
+        Object.keys(nonDefaultValues).forEach(function(aDesc) {
+          descriptorTests = descriptorTests.then(function() {
+            var face = new win.FontFace("test", fontData);
+            return face.loaded.then(function() {
+              var ok_todo = aDesc == "variant" ? todo : ok;
+              face[aDesc] = nonDefaultValues[aDesc][0];
+              ok_todo(face[aDesc] == nonDefaultValues[aDesc][1], "assigned valid non-default value to FontFace." + aDesc + " (TEST 22) (" + win + ")");
+            }, function(aError) {
+              ok(false, "FontFace should have loaded succesfully (TEST 22) (" + win + ")");
+            });
+          });
         });
+        return descriptorTests;
       });
     });
-    return descriptorTests;
+    return p;
 
   }).then(function() {
 
     // (TEST 23) Test assigning invalid descriptor values on the FontFace.
-    var descriptorTests = Promise.resolve();
-    Object.keys(invalidValues).forEach(function(aDesc) {
-      descriptorTests = descriptorTests.then(function() {
-        var face = new FontFace("test", fontData);
-        return face.loaded.then(function() {
-          var ok_todo = aDesc == "variant" ? todo : ok;
-          var exceptionName = "";
-          try {
-            face[aDesc] = invalidValues[aDesc];
-          } catch (ex) {
-            exceptionName = ex.name;
-          }
-          ok_todo(exceptionName == "SyntaxError", "assigning invalid value to FontFace." + aDesc + " should throw a SyntaxError (TEST 23)");
-        }, function(aError) {
-          ok(false, "FontFace should have loaded succesfully (TEST 23)");
+    var p = Promise.resolve();
+    [window, fwindow].forEach(function(win) {
+      p = p.then(function() {
+        var descriptorTests = Promise.resolve();
+        Object.keys(invalidValues).forEach(function(aDesc) {
+          descriptorTests = descriptorTests.then(function() {
+            var face = new win.FontFace("test", fontData);
+            return face.loaded.then(function() {
+              var ok_todo = aDesc == "variant" ? todo : ok;
+              var exceptionName = "";
+              try {
+                face[aDesc] = invalidValues[aDesc];
+              } catch (ex) {
+                exceptionName = ex.name;
+              }
+              ok_todo(exceptionName == "SyntaxError", "assigning invalid value to FontFace." + aDesc + " should throw a SyntaxError (TEST 23) (" + win + ")");
+            }, function(aError) {
+              ok(false, "FontFace should have loaded succesfully (TEST 23) (" + win + ")");
+            });
+          });
         });
+        return descriptorTests;
       });
     });
-    return descriptorTests;
+    return p;
 
   }).then(function() {
 
@@ -410,358 +515,413 @@ function runTest() {
     // source is set to "loading" right after load() is called, that its .loaded
     // Promise is returned, and that the Promise is eventually rejected with a
     // NetworkError and its status is set to "error".
-    var face = new FontFace("test", "url(x)");
-    var result = face.load();
-    is(face.status, "loading", "FontFace.status should be \"loading\" right after load() is called (TEST 24)");
-    is(result, face.loaded, "FontFace.load() should return the .loaded Promise (TEST 24)");
+    var p = Promise.resolve();
+    [window, fwindow].forEach(function(win) {
+      p = p.then(function() {
+        var face = new win.FontFace("test", "url(x)");
+        var result = face.load();
+        is(face.status, "loading", "FontFace.status should be \"loading\" right after load() is called (TEST 24) (" + win + ")");
+        is(result, face.loaded, "FontFace.load() should return the .loaded Promise (TEST 24) (" + win + ")");
 
-    return result.then(function() {
-      ok(false, "FontFace with a non-existing url() source should not load (TEST 24)");
-    }, function(aError) {
-      is(aError.name, "NetworkError", "FontFace with a non-existing url() source should result in its .loaded Promise being rejected with a NetworkError (TEST 24)");
-      is(face.status, "error", "FontFace with a non-existing url() source should result in its .status being set to \"error\" (TEST 24)");
+        return result.then(function() {
+          ok(false, "FontFace with a non-existing url() source should not load (TEST 24) (" + win + ")");
+        }, function(aError) {
+          is(aError.name, "NetworkError", "FontFace with a non-existing url() source should result in its .loaded Promise being rejected with a NetworkError (TEST 24) (" + win + ")");
+          is(face.status, "error", "FontFace with a non-existing url() source should result in its .status being set to \"error\" (TEST 24) (" + win + ")");
+        });
+      });
     });
+    return p;
 
   }).then(function() {
 
     // (TEST 25) Test simple manipulation of the FontFaceSet.
-    var face, face2, all;
-    face = new FontFace("test", "url(x)");
-    face2 = new FontFace("test2", "url(x)");
-    ok(!document.fonts.has(face), "newly created FontFace should not be in document.fonts (TEST 25)");
-    document.fonts.add(face);
-    ok(document.fonts.has(face), "should be able to add a FontFace to document.fonts (TEST 25)");
-    document.fonts.add(face);
-    ok(document.fonts.has(face), "should be able to repeatedly add a FontFace to document.fonts (TEST 25)");
-    ok(document.fonts.delete(face), "FontFaceSet.delete should return true when it succeeds (TEST 25)");
-    ok(!document.fonts.has(face), "FontFace should be gone from document.fonts after delete is called (TEST 25)");
-    ok(!document.fonts.delete(face), "FontFaceSet.delete should return false when it fails (TEST 25)");
-    document.fonts.add(face);
-    document.fonts.add(face2);
-    ok(document.fonts.has(face2), "should be able to add a second FontFace to document.fonts (TEST 25)");
-    document.fonts.clear();
-    ok(!document.fonts.has(face) && !document.fonts.has(face2), "FontFaces should be gone from document.fonts after clear is called (TEST 25)");
-    document.fonts.add(face);
-    document.fonts.add(face2);
-    all = Array.from(document.fonts);
-    is(all[0], face, "FontFaces should be returned in the same order as insertion (TEST 25)");
-    is(all[1], face2, "FontFaces should be returned in the same order as insertion (TEST 25)");
-    document.fonts.add(face);
-    all = Array.from(document.fonts);
-    is(all[0], face, "FontFaces should be not be reordered when a duplicate entry is added (TEST 25)");
-    is(all[1], face2, "FontFaces should be not be reordered when a duplicate entry is added (TEST 25)");
-    document.fonts.clear();
-    return document.fonts.ready;
+    var p = Promise.resolve();
+    [window, fwindow].forEach(function(win) {
+      var doc = win.document;
+      p = p.then(function() {
+        var face, face2, all;
+        face = new win.FontFace("test", "url(x)");
+        face2 = new win.FontFace("test2", "url(x)");
+        ok(!doc.fonts.has(face), "newly created FontFace should not be in document.fonts (TEST 25) (" + win + ")");
+        doc.fonts.add(face);
+        ok(doc.fonts.has(face), "should be able to add a FontFace to document.fonts (TEST 25) (" + win + ")");
+        doc.fonts.add(face);
+        ok(doc.fonts.has(face), "should be able to repeatedly add a FontFace to document.fonts (TEST 25) (" + win + ")");
+        ok(doc.fonts.delete(face), "FontFaceSet.delete should return true when it succeeds (TEST 25) (" + win + ")");
+        ok(!doc.fonts.has(face), "FontFace should be gone from document.fonts after delete is called (TEST 25) (" + win + ")");
+        ok(!doc.fonts.delete(face), "FontFaceSet.delete should return false when it fails (TEST 25) (" + win + ")");
+        doc.fonts.add(face);
+        doc.fonts.add(face2);
+        ok(doc.fonts.has(face2), "should be able to add a second FontFace to document.fonts (TEST 25) (" + win + ")");
+        doc.fonts.clear();
+        ok(!doc.fonts.has(face) && !doc.fonts.has(face2), "FontFaces should be gone from document.fonts after clear is called (TEST 25) (" + win + ")");
+        doc.fonts.add(face);
+        doc.fonts.add(face2);
+        all = Array.from(doc.fonts);
+        is(all[0], face, "FontFaces should be returned in the same order as insertion (TEST 25) (" + win + ")");
+        is(all[1], face2, "FontFaces should be returned in the same order as insertion (TEST 25) (" + win + ")");
+        doc.fonts.add(face);
+        all = Array.from(doc.fonts);
+        is(all[0], face, "FontFaces should be not be reordered when a duplicate entry is added (TEST 25) (" + win + ")");
+        is(all[1], face2, "FontFaces should be not be reordered when a duplicate entry is added (TEST 25) (" + win + ")");
+        doc.fonts.clear();
+        return doc.fonts.ready;
+      });
+    });
+    return p;
 
   }).then(function() {
 
     // (TEST 26) Test that FontFaceSet.ready is replaced, .status is set to
     // "loading", and a loading event is dispatched when a loading FontFace is
     // added to it.
-    var awaitEvents = new Promise(function(aResolve, aReject) {
+    var p = Promise.resolve();
+    [window, fwindow].forEach(function(win) {
+      var doc = win.document;
+      p = p.then(function() {
+        var awaitEvents = new Promise(function(aResolve, aReject) {
 
-      var onloadingTriggered = false, loadingDispatched = false;
+          var onloadingTriggered = false, loadingDispatched = false;
 
-      function check() {
-        if (onloadingTriggered && loadingDispatched) {
-          document.fonts.onloading = null;
-          document.fonts.removeEventListener("loading", listener);
-          aResolve();
-        }
-      }
+          function check() {
+            if (onloadingTriggered && loadingDispatched) {
+              doc.fonts.onloading = null;
+              doc.fonts.removeEventListener("loading", listener);
+              aResolve();
+            }
+          }
 
-      var listener = function(aEvent) {
-        is(Object.getPrototypeOf(aEvent), Event.prototype, "loading event should be a plain Event object (TEST 26)");
-        loadingDispatched = true;
-        check();
-      };
-      document.fonts.addEventListener("loading", listener);
-      document.fonts.onloading = function(aEvent) {
-        is(Object.getPrototypeOf(aEvent), Event.prototype, "loading event should be a plain Event object (TEST 26)");
-        onloadingTriggered = true;
-        check();
-      };
-    });
-
-    is(document.fonts.status, "loaded", "FontFaceSet.status initially (TEST 26)");
-
-    var oldReady = document.fonts.ready;
-    var face = new FontFace("test", "url(neverending_font_load.sjs)");
-    face.load();
-    document.fonts.add(face);
-
-    var newReady = document.fonts.ready;
-    isnot(newReady, oldReady, "FontFaceSet.ready should be replaced when a loading FontFace is added to it (TEST 26)");
-    is(document.fonts.status, "loading", "FontFaceSet.status should be set to \"loading\" when a loading FontFace is added to it (TEST 26)");
-
-    return awaitEvents
-        .then(function() {
-          return is_pending(newReady, "FontFaceSet.ready should be replaced with a fresh pending Promise when a loading FontFace is added to it", "(TEST 26)");
-        })
-        .then(function() {
-          document.fonts.clear();
-          return document.fonts.ready;
+          var listener = function(aEvent) {
+            is(Object.getPrototypeOf(aEvent), win.Event.prototype, "loading event should be a plain Event object (TEST 26) (" + win + ")");
+            loadingDispatched = true;
+            check();
+          };
+          doc.fonts.addEventListener("loading", listener);
+          doc.fonts.onloading = function(aEvent) {
+            is(Object.getPrototypeOf(aEvent), win.Event.prototype, "loading event should be a plain Event object (TEST 26) (" + win + ")");
+            onloadingTriggered = true;
+            check();
+          };
         });
 
+        is(doc.fonts.status, "loaded", "FontFaceSet.status initially (TEST 26) (" + win + ")");
+
+        var oldReady = doc.fonts.ready;
+        var face = new win.FontFace("test", "url(neverending_font_load.sjs)");
+        face.load();
+        doc.fonts.add(face);
+
+        var newReady = doc.fonts.ready;
+        isnot(newReady, oldReady, "FontFaceSet.ready should be replaced when a loading FontFace is added to it (TEST 26) (" + win + ")");
+        is(doc.fonts.status, "loading", "FontFaceSet.status should be set to \"loading\" when a loading FontFace is added to it (TEST 26) (" + win + ")");
+
+        return awaitEvents
+            .then(function() {
+              return is_pending(newReady, "FontFaceSet.ready should be replaced with a fresh pending Promise when a loading FontFace is added to it", "(TEST 26) (" + win + ")");
+            })
+            .then(function() {
+              doc.fonts.clear();
+              return doc.fonts.ready;
+            });
+      });
+    });
+    return p;
+
   }).then(function() {
 
     // (TEST 27) Test that FontFaceSet.ready is resolved, .status is set to
     // "loaded", and a loadingdone event (but no loadingerror event) is
     // dispatched when the only loading FontFace in it is removed.
-    var awaitEvents = new Promise(function(aResolve, aReject) {
+    var p = Promise.resolve();
+    [window, fwindow].forEach(function(win) {
+      var doc = win.document;
+      p = p.then(function() {
+        var awaitEvents = new Promise(function(aResolve, aReject) {
 
-      var onloadingdoneTriggered = false, loadingdoneDispatched = false;
-      var onloadingerrorTriggered = false, loadingerrorDispatched = false;
+          var onloadingdoneTriggered = false, loadingdoneDispatched = false;
+          var onloadingerrorTriggered = false, loadingerrorDispatched = false;
 
-      function check() {
-        document.fonts.onloadingdone = null;
-        document.fonts.onloadingerror = null;
-        document.fonts.removeEventListener("loadingdone", doneListener);
-        document.fonts.removeEventListener("loadingerror", errorListener);
-        aResolve();
-      }
+          function check() {
+            doc.fonts.onloadingdone = null;
+            doc.fonts.onloadingerror = null;
+            doc.fonts.removeEventListener("loadingdone", doneListener);
+            doc.fonts.removeEventListener("loadingerror", errorListener);
+            aResolve();
+          }
 
-      var doneListener = function(aEvent) {
-        is(Object.getPrototypeOf(aEvent), CSSFontFaceLoadEvent.prototype, "loadingdone event should be a CSSFontFaceLoadEvent object (TEST 27)");
-        is(aEvent.fontfaces.length, 0, "the CSSFontFaceLoadEvent should have an empty fontfaces array (TEST 27)");
-        loadingdoneDispatched = true;
-        check();
-      };
-      document.fonts.addEventListener("loadingdone", doneListener);
-      document.fonts.onloadingdone = function(aEvent) {
-        is(Object.getPrototypeOf(aEvent), CSSFontFaceLoadEvent.prototype, "loadingdone event should be a CSSFontFaceLoadEvent object (TEST 27)");
-        is(aEvent.fontfaces.length, 0, "the CSSFontFaceLoadEvent should have an empty fontfaces array (TEST 27)");
-        onloadingdoneTriggered = true;
-        check();
-      };
-      var errorListener = function(aEvent) {
-        loadingerrorDispatched = true;
-        check();
-      }
-      document.fonts.addEventListener("loadingerror", errorListener);
-      document.fonts.onloadingerror = function(aEvent) {
-        onloadingdoneTriggered = true;
-        check();
-      };
-    });
-
-    is(document.fonts.status, "loaded", "FontFaceSet.status should be \"loaded\" initially (TEST 27)");
-
-    var f = new FontFace("test", "url(neverending_font_load.sjs)");
-    f.load();
-    document.fonts.add(f);
-
-    is(document.fonts.status, "loading", "FontFaceSet.status should be \"loading\" when a loading FontFace is in it (TEST 27)");
-
-    document.fonts.clear();
-
-    return awaitEvents
-        .then(function() {
-          return is_resolved_with(document.fonts.ready, document.fonts, "FontFaceSet.ready when the FontFaceSet is cleared", "(TEST 27)");
-        })
-        .then(function() {
-          is(document.fonts.status, "loaded", "FontFaceSet.status should be set to \"loaded\" when it is cleared (TEST 27)");
-          return document.fonts.ready;
+          var doneListener = function(aEvent) {
+            is(Object.getPrototypeOf(aEvent), win.CSSFontFaceLoadEvent.prototype, "loadingdone event should be a CSSFontFaceLoadEvent object (TEST 27) (" + win + ")");
+            is(aEvent.fontfaces.length, 0, "the CSSFontFaceLoadEvent should have an empty fontfaces array (TEST 27) (" + win + ")");
+            loadingdoneDispatched = true;
+            check();
+          };
+          doc.fonts.addEventListener("loadingdone", doneListener);
+          doc.fonts.onloadingdone = function(aEvent) {
+            is(Object.getPrototypeOf(aEvent), win.CSSFontFaceLoadEvent.prototype, "loadingdone event should be a CSSFontFaceLoadEvent object (TEST 27) (" + win + ")");
+            is(aEvent.fontfaces.length, 0, "the CSSFontFaceLoadEvent should have an empty fontfaces array (TEST 27) (" + win + ")");
+            onloadingdoneTriggered = true;
+            check();
+          };
+          var errorListener = function(aEvent) {
+            loadingerrorDispatched = true;
+            check();
+          }
+          doc.fonts.addEventListener("loadingerror", errorListener);
+          doc.fonts.onloadingerror = function(aEvent) {
+            onloadingdoneTriggered = true;
+            check();
+          };
         });
 
+        is(doc.fonts.status, "loaded", "FontFaceSet.status should be \"loaded\" initially (TEST 27) (" + win + ")");
+
+        var f = new win.FontFace("test", "url(neverending_font_load.sjs)");
+        f.load();
+        doc.fonts.add(f);
+
+        is(doc.fonts.status, "loading", "FontFaceSet.status should be \"loading\" when a loading FontFace is in it (TEST 27) (" + win + ")");
+
+        doc.fonts.clear();
+
+        return awaitEvents
+            .then(function() {
+              return is_resolved_with(doc.fonts.ready, doc.fonts, "FontFaceSet.ready when the FontFaceSet is cleared", "(TEST 27) (" + win + ")");
+            })
+            .then(function() {
+              is(doc.fonts.status, "loaded", "FontFaceSet.status should be set to \"loaded\" when it is cleared (TEST 27) (" + win + ")");
+              return doc.fonts.ready;
+            });
+      });
+    });
+    return p;
+
   }).then(function() {
 
     // (TEST 28) Test that FontFaceSet.ready is replaced, .status is set to
     // "loading", and a loading event is dispatched when a FontFace in it
     // starts loading.
-    var awaitEvents = new Promise(function(aResolve, aReject) {
+    var p = Promise.resolve();
+    [window, fwindow].forEach(function(win) {
+      var doc = win.document;
+      p = p.then(function() {
+        var awaitEvents = new Promise(function(aResolve, aReject) {
 
-      var onloadingTriggered = false, loadingDispatched = false;
+          var onloadingTriggered = false, loadingDispatched = false;
 
-      function check() {
-        if (onloadingTriggered && loadingDispatched) {
-          document.fonts.onloading = null;
-          document.fonts.removeEventListener("loading", listener);
-          aResolve();
-        }
-      }
+          function check() {
+            if (onloadingTriggered && loadingDispatched) {
+              doc.fonts.onloading = null;
+              doc.fonts.removeEventListener("loading", listener);
+              aResolve();
+            }
+          }
 
-      var listener = function(aEvent) {
-        is(Object.getPrototypeOf(aEvent), Event.prototype, "loading event should be a plain Event object (TEST 28)");
-        loadingDispatched = true;
-        check();
-      };
-      document.fonts.addEventListener("loading", listener);
-      document.fonts.onloading = function(aEvent) {
-        is(Object.getPrototypeOf(aEvent), Event.prototype, "loading event should be a plain Event object (TEST 28)");
-        onloadingTriggered = true;
-        check();
-      };
-    });
-
-    var oldReady = document.fonts.ready;
-    var face = new FontFace("test", "url(neverending_font_load.sjs)");
-    document.fonts.add(face);
-    face.load();
-
-    var newReady = document.fonts.ready;
-    isnot(newReady, oldReady, "FontFaceSet.ready should be replaced when its only FontFace starts loading (TEST 28)");
-    is(document.fonts.status, "loading", "FontFaceSet.status should be set to \"loading\" when its only FontFace starts loading (TEST 28)");
-
-    return awaitEvents
-        .then(function() {
-          return is_pending(newReady, "FontFaceSet.ready when the FontFaceSet's only FontFace starts loading", "(TEST 28)");
-        })
-        .then(function() {
-          document.fonts.clear();
-          return document.fonts.ready;
+          var listener = function(aEvent) {
+            is(Object.getPrototypeOf(aEvent), win.Event.prototype, "loading event should be a plain Event object (TEST 28) (" + win + ")");
+            loadingDispatched = true;
+            check();
+          };
+          doc.fonts.addEventListener("loading", listener);
+          doc.fonts.onloading = function(aEvent) {
+            is(Object.getPrototypeOf(aEvent), win.Event.prototype, "loading event should be a plain Event object (TEST 28) (" + win + ")");
+            onloadingTriggered = true;
+            check();
+          };
         });
 
+        var oldReady = doc.fonts.ready;
+        var face = new win.FontFace("test", "url(neverending_font_load.sjs)");
+        doc.fonts.add(face);
+        face.load();
+
+        var newReady = doc.fonts.ready;
+        isnot(newReady, oldReady, "FontFaceSet.ready should be replaced when its only FontFace starts loading (TEST 28) (" + win + ")");
+        is(doc.fonts.status, "loading", "FontFaceSet.status should be set to \"loading\" when its only FontFace starts loading (TEST 28) (" + win + ")");
+
+        return awaitEvents
+            .then(function() {
+              return is_pending(newReady, "FontFaceSet.ready when the FontFaceSet's only FontFace starts loading", "(TEST 28) (" + win + ")");
+            })
+            .then(function() {
+              doc.fonts.clear();
+              return doc.fonts.ready;
+            });
+      });
+    });
+    return p;
+
   }).then(function() {
 
     // (TEST 29) Test that a loadingdone and a loadingerror event is dispatched
     // when a FontFace that eventually becomes status "error" is added to the
     // FontFaceSet.
-    var face;
-    var awaitEvents = new Promise(function(aResolve, aReject) {
+    var p = Promise.resolve();
+    [window, fwindow].forEach(function(win) {
+      var doc = win.document;
+      p = p.then(function() {
+        var face;
+        var awaitEvents = new Promise(function(aResolve, aReject) {
 
-      var onloadingdoneTriggered = false, loadingdoneDispatched = false;
-      var onloadingerrorTriggered = false, loadingerrorDispatched = false;
+          var onloadingdoneTriggered = false, loadingdoneDispatched = false;
+          var onloadingerrorTriggered = false, loadingerrorDispatched = false;
 
-      function check() {
-        if (onloadingdoneTriggered && loadingdoneDispatched &&
-            onloadingerrorTriggered && loadingerrorDispatched) {
-          document.fonts.onloadingdone = null;
-          document.fonts.onloadingerror = null;
-          document.fonts.removeEventListener("loadingdone", doneListener);
-          document.fonts.removeEventListener("loadingerror", errorListener);
-          aResolve();
-        }
-      }
+          function check() {
+            if (onloadingdoneTriggered && loadingdoneDispatched &&
+                onloadingerrorTriggered && loadingerrorDispatched) {
+              doc.fonts.onloadingdone = null;
+              doc.fonts.onloadingerror = null;
+              doc.fonts.removeEventListener("loadingdone", doneListener);
+              doc.fonts.removeEventListener("loadingerror", errorListener);
+              aResolve();
+            }
+          }
 
-      var doneListener = function(aEvent) {
-        loadingdoneDispatched = true;
-        check();
-      };
-      document.fonts.addEventListener("loadingdone", doneListener);
-      document.fonts.onloadingdone = function(aEvent) {
-        is(Object.getPrototypeOf(aEvent), CSSFontFaceLoadEvent.prototype, "loadingdone event should be a CSSFontFaceLoadEvent object (TEST 29)");
-        is(aEvent.fontfaces.length, 0, "the CSSFontFaceLoadEvent should have an empty fontfaces array (TEST 29)");
-        onloadingdoneTriggered = true;
-        check();
-      };
-      var errorListener = function(aEvent) {
-        is(Object.getPrototypeOf(aEvent), CSSFontFaceLoadEvent.prototype, "loadingerror event should be a CSSFontFaceLoadEvent object (TEST 29)");
-        is(aEvent.fontfaces[0], face, "the CSSFontFaceLoadEvent should have a fontfaces array with the FontFace in it (TEST 29)");
-        loadingerrorDispatched = true;
-        check();
-      }
-      document.fonts.addEventListener("loadingerror", errorListener);
-      document.fonts.onloadingerror = function(aEvent) {
-        onloadingerrorTriggered = true;
-        check();
-      };
-    });
+          var doneListener = function(aEvent) {
+            loadingdoneDispatched = true;
+            check();
+          };
+          doc.fonts.addEventListener("loadingdone", doneListener);
+          doc.fonts.onloadingdone = function(aEvent) {
+            is(Object.getPrototypeOf(aEvent), win.CSSFontFaceLoadEvent.prototype, "loadingdone event should be a CSSFontFaceLoadEvent object (TEST 29) (" + win + ")");
+            is(aEvent.fontfaces.length, 0, "the CSSFontFaceLoadEvent should have an empty fontfaces array (TEST 29) (" + win + ")");
+            onloadingdoneTriggered = true;
+            check();
+          };
+          var errorListener = function(aEvent) {
+            is(Object.getPrototypeOf(aEvent), win.CSSFontFaceLoadEvent.prototype, "loadingerror event should be a CSSFontFaceLoadEvent object (TEST 29) (" + win + ")");
+            is(aEvent.fontfaces[0], face, "the CSSFontFaceLoadEvent should have a fontfaces array with the FontFace in it (TEST 29) (" + win + ")");
+            loadingerrorDispatched = true;
+            check();
+          }
+          doc.fonts.addEventListener("loadingerror", errorListener);
+          doc.fonts.onloadingerror = function(aEvent) {
+            onloadingerrorTriggered = true;
+            check();
+          };
+        });
 
-    face = new FontFace("test", "url(x)");
-    face.load();
-    is(face.status, "loading", "FontFace should have status \"loading\" (TEST 29)");
-    document.fonts.add(face);
+        face = new win.FontFace("test", "url(x)");
+        face.load();
+        is(face.status, "loading", "FontFace should have status \"loading\" (TEST 29) (" + win + ")");
+        doc.fonts.add(face);
 
-    return face.loaded
-      .then(function() {
-        ok(false, "the FontFace should not load (TEST 29)");
-      }, function(aError) {
-        is(face.status, "error", "FontFace should have status \"error\" (TEST 29)");
-        return awaitEvents;
-      })
-      .then(function() {
-        document.fonts.clear();
-        return document.fonts.ready;
+        return face.loaded
+          .then(function() {
+            ok(false, "the FontFace should not load (TEST 29) (" + win + ")");
+          }, function(aError) {
+            is(face.status, "error", "FontFace should have status \"error\" (TEST 29) (" + win + ")");
+            return awaitEvents;
+          })
+          .then(function() {
+            doc.fonts.clear();
+            return doc.fonts.ready;
+          });
       });
+    });
+    return p;
 
   }).then(function() {
 
     // (TEST 30) Test that a loadingdone event is dispatched when a FontFace
     // that eventually becomes status "loaded" is added to the FontFaceSet.
-    var face;
-    var awaitEvents = new Promise(function(aResolve, aReject) {
+    var p = Promise.resolve();
+    [window, fwindow].forEach(function(win, i) {
+      var doc = win.document;
+      p = p.then(function() {
+        var face;
+        var awaitEvents = new Promise(function(aResolve, aReject) {
 
-      var onloadingdoneTriggered = false, loadingdoneDispatched = false;
+          var onloadingdoneTriggered = false, loadingdoneDispatched = false;
 
-      function check() {
-        if (onloadingdoneTriggered && loadingdoneDispatched) {
-          document.fonts.onloadingdone = null;
-          document.fonts.removeEventListener("loadingdone", doneListener);
-          aResolve();
-        }
-      }
+          function check() {
+            if (onloadingdoneTriggered && loadingdoneDispatched) {
+              doc.fonts.onloadingdone = null;
+              doc.fonts.removeEventListener("loadingdone", doneListener);
+              aResolve();
+            }
+          }
 
-      var doneListener = function(aEvent) {
-        loadingdoneDispatched = true;
-        check();
-      };
-      document.fonts.addEventListener("loadingdone", doneListener);
-      document.fonts.onloadingdone = function(aEvent) {
-        is(aEvent.fontfaces[0], face, "the CSSFontFaceLoadEvent should have a fontfaces array with the FontFace in it (TEST 30)");
-        onloadingdoneTriggered = true;
-        check();
-      };
-    });
+          var doneListener = function(aEvent) {
+            loadingdoneDispatched = true;
+            check();
+          };
+          doc.fonts.addEventListener("loadingdone", doneListener);
+          doc.fonts.onloadingdone = function(aEvent) {
+            is(aEvent.fontfaces[0], face, "the CSSFontFaceLoadEvent should have a fontfaces array with the FontFace in it (TEST 30) (" + win + ")");
+            onloadingdoneTriggered = true;
+            check();
+          };
+        });
 
-    face = new FontFace("test", "url(BitPattern.woff)");
-    face.load();
-    is(face.status, "loading", "FontFace should have status \"loading\" (TEST 30)");
-    document.fonts.add(face);
+        face = new win.FontFace("test", "url(BitPattern.woff?test30." + i + ")");
+        face.load();
+        is(face.status, "loading", "FontFace should have status \"loading\" (TEST 30) (" + win + ")");
+        doc.fonts.add(face);
 
-    return face.loaded
-      .then(function() {
-        is(face.status, "loaded", "FontFace should have status \"loaded\" (TEST 30)");
-        return awaitEvents;
-      })
-      .then(function() {
-        document.fonts.clear();
+        return face.loaded
+          .then(function() {
+            is(face.status, "loaded", "FontFace should have status \"loaded\" (TEST 30) (" + win + ")");
+            return awaitEvents;
+          })
+          .then(function() {
+            doc.fonts.clear();
+          });
       });
+    });
+    return p;
 
   }).then(function() {
 
     // (TEST 31) Test that a loadingdone event is dispatched when a FontFace
     // with status "unloaded" is added to the FontFaceSet and load() is called
     // on it.
-    var face;
-    var awaitEvents = new Promise(function(aResolve, aReject) {
+    var p = Promise.resolve();
+    [window, fwindow].forEach(function(win, i) {
+      var doc = win.document;
+      p = p.then(function() {
+        var face;
+        var awaitEvents = new Promise(function(aResolve, aReject) {
 
-      var onloadingdoneTriggered = false, loadingdoneDispatched = false;
+          var onloadingdoneTriggered = false, loadingdoneDispatched = false;
 
-      function check() {
-        if (onloadingdoneTriggered && loadingdoneDispatched) {
-          document.fonts.onloadingdone = null;
-          document.fonts.removeEventListener("loadingdone", doneListener);
-          aResolve();
-        }
-      }
+          function check() {
+            if (onloadingdoneTriggered && loadingdoneDispatched) {
+              doc.fonts.onloadingdone = null;
+              doc.fonts.removeEventListener("loadingdone", doneListener);
+              aResolve();
+            }
+          }
 
-      var doneListener = function(aEvent) {
-        loadingdoneDispatched = true;
-        check();
-      };
-      document.fonts.addEventListener("loadingdone", doneListener);
-      document.fonts.onloadingdone = function(aEvent) {
-        is(aEvent.fontfaces[0], face, "the CSSFontFaceLoadEvent should have a fontfaces array with the FontFace in it (TEST 31)");
-        onloadingdoneTriggered = true;
-        check();
-      };
-    });
-
-    face = new FontFace("test", "url(BitPattern.woff)");
-    is(face.status, "unloaded", "FontFace should have status \"unloaded\" (TEST 31)");
-    document.fonts.add(face);
-
-    return face.load()
-        .then(function() {
-          return awaitEvents;
-        })
-        .then(function() {
-          is(face.status, "loaded", "FontFace should have status \"loaded\" (TEST 31)");
-          document.fonts.clear();
-          return document.fonts.ready;
+          var doneListener = function(aEvent) {
+            loadingdoneDispatched = true;
+            check();
+          };
+          doc.fonts.addEventListener("loadingdone", doneListener);
+          doc.fonts.onloadingdone = function(aEvent) {
+            is(aEvent.fontfaces[0], face, "the CSSFontFaceLoadEvent should have a fontfaces array with the FontFace in it (TEST 31) (" + win + ")");
+            onloadingdoneTriggered = true;
+            check();
+          };
         });
 
+        face = new win.FontFace("test", "url(BitPattern.woff?test31." + i + ")");
+        is(face.status, "unloaded", "FontFace should have status \"unloaded\" (TEST 31) (" + win + ")");
+        doc.fonts.add(face);
+
+        return face.load()
+            .then(function() {
+              return awaitEvents;
+            })
+            .then(function() {
+              is(face.status, "loaded", "FontFace should have status \"loaded\" (TEST 31) (" + win + ")");
+              doc.fonts.clear();
+              return doc.fonts.ready;
+            });
+      });
+    });
+    return p;
+
   }).then(function() {
 
     // (TEST 32) Test that pending restyles prevent document.fonts.status
@@ -796,6 +956,9 @@ function runTest() {
 
     // (TEST 33) Test that CSS-connected FontFace objects are created
     // for @font-face rules in the document.
+
+    is(document.fonts.status, "loaded", "document.fonts.status should initially be loaded (TEST 33)");
+
     var style = document.querySelector("style");
     var ruleText = "@font-face { font-family: something; src: url(x); ";
     Object.keys(nonDefaultValues).forEach(function(aDesc) {
@@ -808,44 +971,83 @@ function runTest() {
     var rule = style.sheet.cssRules[0];
 
     var all = Array.from(document.fonts);
-    is(all.length, 1, "document.fonts should contain one FontFace (TEST 34)");
+    is(all.length, 1, "document.fonts should contain one FontFace (TEST 33)");
 
     var face = all[0];
-    is(face.family, "\"something\"", "FontFace should have correct family value (TEST 34)");
+    is(face.family, "\"something\"", "FontFace should have correct family value (TEST 33)");
     Object.keys(nonDefaultValues).forEach(function(aDesc) {
       var ok_todo = aDesc == "variant" ? todo : ok;
-      ok_todo(face[aDesc] == nonDefaultValues[aDesc][1], "FontFace should have correct " + aDesc + " value (TEST 34)");
+      ok_todo(face[aDesc] == nonDefaultValues[aDesc][1], "FontFace should have correct " + aDesc + " value (TEST 33)");
     });
 
-    document.fonts.clear();
-    ok(document.fonts.has(face), "CSS-connected FontFace should not be removed from document.fonts when clear is called (TEST 34)");
+    is(document.fonts.status, "loaded", "document.fonts.status should still be loaded (TEST 33)");
+    is(face.status, "unloaded", "FontFace.status should be unloaded (TEST 33)");
 
-    var exceptionName = "";
-    try {
-      document.fonts.delete(face);
-    } catch (ex) {
-      exceptionName = ex.name;
-    }
-    ok(exceptionName == "InvalidModificationError", "attempting to remove CSS-connected FontFace from document.fonts should throw an InvalidModificationError (TEST 34)");
-    ok(document.fonts.has(face), "CSS-connected FontFace should not be removed from document.fonts when delete is called (TEST 34)");
+    document.fonts.clear();
+    ok(document.fonts.has(face), "CSS-connected FontFace should not be removed from document.fonts when clear is called (TEST 33)");
+
+    is(document.fonts.delete(face), false, "attempting to remove CSS-connected FontFace from document.fonts should return false (TEST 33)");
+    ok(document.fonts.has(face), "CSS-connected FontFace should not be removed from document.fonts when delete is called (TEST 33)");
 
     style.textContent = "";
 
-    ok(!document.fonts.has(face), "CSS-connected FontFace should be removed from document.fonts once the rule has been removed (TEST 34)");
+    ok(!document.fonts.has(face), "CSS-connected FontFace should be removed from document.fonts once the rule has been removed (TEST 33)");
+
+    is(document.fonts.status, "loaded", "document.fonts.status should still be loaded after rule is removed (TEST 33)");
+    is(face.status, "unloaded", "FontFace.status should still be unloaded after rule is removed (TEST 33)");
 
     document.fonts.add(face);
-    ok(document.fonts.has(face), "previously CSS-connected FontFace should be able to be added to document.fonts (TEST 34)");
+    ok(document.fonts.has(face), "previously CSS-connected FontFace should be able to be added to document.fonts (TEST 33)");
+
+    is(document.fonts.status, "loaded", "document.fonts.status should still be loaded after now disconnected FontFace is added (TEST 33)");
+    is(face.status, "unloaded", "FontFace.status should still be unloaded after now disconnected FontFace is added (TEST 33)");
 
     document.fonts.delete(face);
-    ok(!document.fonts.has(face), "previously CSS-connected FontFace should be able to be removed from document.fonts (TEST 34)");
+    ok(!document.fonts.has(face), "previously CSS-connected FontFace should be able to be removed from document.fonts (TEST 33)");
 
   }).then(function() {
 
-    // (TEST 34) Test that a pending style sheet load prevents
+    // (TEST 34) Test that descriptor getters for unspecified descriptors on
+    // CSS-connected FontFace objects return their default values.
+    var style = document.querySelector("style");
+    var ruleText = "@font-face { font-family: something; src: url(x); }";
+
+    style.textContent = ruleText;
+
+    var all = Array.from(document.fonts);
+    var face = all[0];
+
+    Object.keys(defaultValues).forEach(function(aDesc) {
+      is(face[aDesc], defaultValues[aDesc], "FontFace should return default value for " + aDesc + " (TEST 34)");
+    });
+
+    style.textContent = "";
+
+  }).then(function() {
+
+    // (TEST 34) Test that descriptor getters for unspecified descriptors on
+    // CSS-connected FontFace objects return their default values.
+    var style = document.querySelector("style");
+    var ruleText = "@font-face { font-family: something; src: url(x); }";
+
+    style.textContent = ruleText;
+
+    var all = Array.from(document.fonts);
+    var face = all[0];
+
+    Object.keys(defaultValues).forEach(function(aDesc) {
+      is(face[aDesc], defaultValues[aDesc], "FontFace should return default value for " + aDesc + " (TEST 34)");
+    });
+
+    style.textContent = "";
+
+  }).then(function() {
+
+    // (TEST LAST) Test that a pending style sheet load prevents
     // document.fonts.status from being set to "loaded".
 
     // First, add a FontFace to document.fonts that will load soon.
-    var face = new FontFace("test", "url(BitPattern.woff)");
+    var face = new FontFace("test", "url(BitPattern.woff?testlast)");
     face.load();
     document.fonts.add(face);
 
@@ -859,7 +1061,7 @@ function runTest() {
     return setTimeoutZero()  // wait for the style sheet to start loading
         .then(function() {
           document.fonts.clear();
-          is(document.fonts.status, "loading", "FontFaceSet.status when the FontFaceSet has been cleared of loading FontFaces but there is a pending style sheet load (TEST 33)");
+          is(document.fonts.status, "loading", "FontFaceSet.status when the FontFaceSet has been cleared of loading FontFaces but there is a pending style sheet load (TEST LAST)");
           document.head.removeChild(link);
           // XXX Removing the <link> element won't cancel the load of the
           // style sheet, so we can't do that to test that
@@ -875,168 +1077,196 @@ function runTest() {
 
     // (TEST 35) Test that no loadingdone event is dispatched when a FontFace
     // with "loaded" status is added to a "loaded" FontFaceSet.
-    var gotLoadingDone = false;
-    document.fonts.onloadingdone = function(aEvent) {
-      gotLoadingDone = true;
-    };
+    var p = Promise.resolve();
+    [window, fwindow].forEach(function(win) {
+      var doc = win.document;
+      p = p.then(function() {
+        var gotLoadingDone = false;
+        doc.fonts.onloadingdone = function(aEvent) {
+          gotLoadingDone = true;
+        };
 
-    is(document.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" (TEST 35)");
-    var face = new FontFace("test", fontData);
+        is(doc.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" (TEST 35) (" + win + ")");
+        var face = new win.FontFace("test", fontData);
 
-    return face.loaded
-      .then(function() {
-        is(face.status, "loaded", "FontFace should have status \"loaded\" (TEST 35)");
-        document.fonts.add(face);
-        is(document.fonts.status, "loaded", "document.fonts.status should still have status \"loaded\" (TEST 35)");
-        return document.fonts.ready;
-      })
-      .then(function() {
-        ok(!gotLoadingDone, "loadingdone event should not be dispatched (TEST 35)");
-        document.fonts.onloadingdone = null;
-        document.fonts.clear();
+        return face.loaded
+          .then(function() {
+            is(face.status, "loaded", "FontFace should have status \"loaded\" (TEST 35) (" + win + ")");
+            doc.fonts.add(face);
+            is(doc.fonts.status, "loaded", "document.fonts.status should still have status \"loaded\" (TEST 35) (" + win + ")");
+            return doc.fonts.ready;
+          })
+          .then(function() {
+            ok(!gotLoadingDone, "loadingdone event should not be dispatched (TEST 35) (" + win + ")");
+            doc.fonts.onloadingdone = null;
+            doc.fonts.clear();
+          });
       });
+    });
+    return p;
 
   }).then(function() {
 
     // (TEST 36) Test that no loadingdone or loadingerror event is dispatched
     // when a FontFace with "error" status is added to a "loaded" FontFaceSet.
-    var gotLoadingDone = false, gotLoadingError = false;
-    document.fonts.onloadingdone = function(aEvent) {
-      gotLoadingDone = true;
-    };
-    document.fonts.onloadingerror = function(aEvent) {
-      gotLoadingError = true;
-    };
+    var p = Promise.resolve();
+    [window, fwindow].forEach(function(win) {
+      var doc = win.document;
+      p = p.then(function() {
+        var gotLoadingDone = false, gotLoadingError = false;
+        doc.fonts.onloadingdone = function(aEvent) {
+          gotLoadingDone = true;
+        };
+        doc.fonts.onloadingerror = function(aEvent) {
+          gotLoadingError = true;
+        };
 
-    is(document.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" (TEST 36)");
-    var face = new FontFace("test", new ArrayBuffer(0));
+        is(doc.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" (TEST 36) (" + win + ")");
+        var face = new win.FontFace("test", new ArrayBuffer(0));
 
-    return face.loaded
-      .then(function() {
-        ok(false, "FontFace should not have loaded (TEST 36)");
-      }, function() {
-        is(face.status, "error", "FontFace should have status \"error\" (TEST 36)");
-        document.fonts.add(face);
-        is(document.fonts.status, "loaded", "document.fonts.status should still have status \"loaded\" (TEST 36)");
-        return document.fonts.ready;
-      })
-      .then(function() {
-        ok(!gotLoadingDone, "loadingdone event should not be dispatched (TEST 36)");
-        ok(!gotLoadingError, "loadingerror event should not be dispatched (TEST 36)");
-        document.fonts.onloadingdone = null;
-        document.fonts.onloadingerror = null;
-        document.fonts.clear();
+        return face.loaded
+          .then(function() {
+            ok(false, "FontFace should not have loaded (TEST 36) (" + win + ")");
+          }, function() {
+            is(face.status, "error", "FontFace should have status \"error\" (TEST 36) (" + win + ")");
+            doc.fonts.add(face);
+            is(doc.fonts.status, "loaded", "document.fonts.status should still have status \"loaded\" (TEST 36) (" + win + ")");
+            return doc.fonts.ready;
+          })
+          .then(function() {
+            ok(!gotLoadingDone, "loadingdone event should not be dispatched (TEST 36) (" + win + ")");
+            ok(!gotLoadingError, "loadingerror event should not be dispatched (TEST 36) (" + win + ")");
+            doc.fonts.onloadingdone = null;
+            doc.fonts.onloadingerror = null;
+            doc.fonts.clear();
+          });
       });
+    });
+    return p;
 
   }).then(function() {
 
     // (TEST 37) Test that a FontFace only has one loadingdone event dispatched
     // at the FontFaceSet containing it.
 
-    var events = [], face, face2;
+    var p = Promise.resolve();
+    [window, fwindow].forEach(function(win, i) {
+      var doc = win.document;
+      p = p.then(function() {
+        var events = [], face, face2;
 
-    document.fonts.onloadingdone = function(e) {
-      events.push(e);
-    };
-    document.fonts.onloadingerror = function(e) {
-      events.push(e);
-    };
+        doc.fonts.onloadingdone = function(e) {
+          events.push(e);
+        };
+        doc.fonts.onloadingerror = function(e) {
+          events.push(e);
+        };
 
-    is(document.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" (TEST 37)");
+        is(doc.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" (TEST 37) (" + win + ")");
 
-    face = new FontFace("test", "url(BitPattern.woff)");
-    face.load();
-    document.fonts.add(face);
-    is(document.fonts.status, "loading", "document.fonts.status should have status \"loading\" after first font added (TEST 37)");
+        face = new win.FontFace("test", "url(BitPattern.woff?test37." + i + "a)");
+        face.load();
+        doc.fonts.add(face);
+        is(doc.fonts.status, "loading", "document.fonts.status should have status \"loading\" after first font added (TEST 37) (" + win + ")");
 
-    return document.fonts.ready
-      .then(function() {
-        is(document.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" after first font loaded (TEST 37)");
-        is(face.status, "loaded", "first FontFace should have status \"loaded\" (TEST 37)");
+        return doc.fonts.ready
+          .then(function() {
+            is(doc.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" after first font loaded (TEST 37) (" + win + ")");
+            is(face.status, "loaded", "first FontFace should have status \"loaded\" (TEST 37) (" + win + ")");
 
-        face2 = new FontFace("test2", "url(BitPattern.woff)");
-        face2.load();
-        document.fonts.add(face2);
-        is(document.fonts.status, "loading", "document.fonts.status should have status \"loading\" after second font added (TEST 37)");
+            face2 = new win.FontFace("test2", "url(BitPattern.woff?test37." + i + "b)");
+            face2.load();
+            doc.fonts.add(face2);
+            is(doc.fonts.status, "loading", "document.fonts.status should have status \"loading\" after second font added (TEST 37) (" + win + ")");
 
-        return document.fonts.ready;
-      }).then(function() {
-        is(document.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" after second font loaded (TEST 37)");
-        is(face2.status, "loaded", "second FontFace should have status \"loaded\" (TEST 37)");
+            return doc.fonts.ready;
+          }).then(function() {
+            is(doc.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" after second font loaded (TEST 37) (" + win + ")");
+            is(face2.status, "loaded", "second FontFace should have status \"loaded\" (TEST 37) (" + win + ")");
 
-        is(events.length, 2, "should receive two events (TEST 37)");
+            is(events.length, 2, "should receive two events (TEST 37) (" + win + ")");
 
-        is(events[0].type, "loadingdone", "first event should be \"loadingdone\" (TEST 37)");
-        is(events[0].fontfaces.length, 1, "first event should have 1 FontFace (TEST 37)");
-        is(events[0].fontfaces[0], face, "first event should have the first FontFace");
+            is(events[0].type, "loadingdone", "first event should be \"loadingdone\" (TEST 37) (" + win + ")");
+            is(events[0].fontfaces.length, 1, "first event should have 1 FontFace (TEST 37) (" + win + ")");
+            is(events[0].fontfaces[0], face, "first event should have the first FontFace");
 
-        is(events[1].type, "loadingdone", "second event should be \"loadingdone\" (TEST 37)");
-        is(events[1].fontfaces.length, 1, "second event should only have 1 FontFace (TEST 37)");
-        is(events[1].fontfaces[0], face2, "second event should have the second FontFace (TEST 37)");
+            is(events[1].type, "loadingdone", "second event should be \"loadingdone\" (TEST 37) (" + win + ")");
+            is(events[1].fontfaces.length, 1, "second event should only have 1 FontFace (TEST 37) (" + win + ")");
+            is(events[1].fontfaces[0], face2, "second event should have the second FontFace (TEST 37) (" + win + ")");
 
-        document.fonts.onloadingdone = null;
-        document.fonts.onloadingerror = null;
-        document.fonts.clear();
-        return document.fonts.ready;
+            doc.fonts.onloadingdone = null;
+            doc.fonts.onloadingerror = null;
+            doc.fonts.clear();
+            return doc.fonts.ready;
+          });
       });
+    });
+    return p;
 
   }).then(function() {
 
     // (TEST 38) Test that a FontFace only has one loadingerror event dispatched
     // at the FontFaceSet containing it.
 
-    var events = [], face, face2;
+    var p = Promise.resolve();
+    [window, fwindow].forEach(function(win) {
+      var doc = win.document;
+      p = p.then(function() {
+        var events = [], face, face2;
 
-    document.fonts.onloadingdone = function(e) {
-      events.push(e);
-    };
-    document.fonts.onloadingerror = function(e) {
-      events.push(e);
-    };
+        doc.fonts.onloadingdone = function(e) {
+          events.push(e);
+        };
+        doc.fonts.onloadingerror = function(e) {
+          events.push(e);
+        };
 
-    is(document.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" (TEST 38)");
+        is(doc.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" (TEST 38) (" + win + ")");
 
-    face = new FontFace("test", "url(x)");
-    face.load();
-    document.fonts.add(face);
-    is(document.fonts.status, "loading", "document.fonts.status should have status \"loading\" after first font added (TEST 38)");
+        face = new win.FontFace("test", "url(x)");
+        face.load();
+        doc.fonts.add(face);
+        is(doc.fonts.status, "loading", "document.fonts.status should have status \"loading\" after first font added (TEST 38) (" + win + ")");
 
-    return document.fonts.ready
-      .then(function() {
-        is(document.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" after first font failed to load (TEST 38)");
-        is(face.status, "error", "first FontFace should have status \"error\" (TEST 38)");
+        return doc.fonts.ready
+          .then(function() {
+            is(doc.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" after first font failed to load (TEST 38) (" + win + ")");
+            is(face.status, "error", "first FontFace should have status \"error\" (TEST 38) (" + win + ")");
 
-        face2 = new FontFace("test2", "url(x)");
-        face2.load();
-        document.fonts.add(face2);
-        is(document.fonts.status, "loading", "document.fonts.status should have status \"loading\" after second font added (TEST 38)");
+            face2 = new win.FontFace("test2", "url(x)");
+            face2.load();
+            doc.fonts.add(face2);
+            is(doc.fonts.status, "loading", "document.fonts.status should have status \"loading\" after second font added (TEST 38) (" + win + ")");
 
-        return document.fonts.ready;
-      }).then(function() {
-        is(document.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" after second font failed to load (TEST 38)");
-        is(face2.status, "error", "second FontFace should have status \"error\" (TEST 38)");
+            return doc.fonts.ready;
+          }).then(function() {
+            is(doc.fonts.status, "loaded", "document.fonts.status should have status \"loaded\" after second font failed to load (TEST 38) (" + win + ")");
+            is(face2.status, "error", "second FontFace should have status \"error\" (TEST 38) (" + win + ")");
 
-        is(events.length, 4, "should receive four events (TEST 38)");
+            is(events.length, 4, "should receive four events (TEST 38) (" + win + ")");
 
-        is(events[0].type, "loadingdone", "first event should be \"loadingdone\" (TEST 38)");
-        is(events[0].fontfaces.length, 0, "first event should have no FontFaces (TEST 38)");
+            is(events[0].type, "loadingdone", "first event should be \"loadingdone\" (TEST 38) (" + win + ")");
+            is(events[0].fontfaces.length, 0, "first event should have no FontFaces (TEST 38) (" + win + ")");
 
-        is(events[1].type, "loadingerror", "second event should be \"loadingerror\" (TEST 38)");
-        is(events[1].fontfaces.length, 1, "second event should have 1 FontFace (TEST 38)");
-        is(events[1].fontfaces[0], face, "second event should have the first FontFace");
+            is(events[1].type, "loadingerror", "second event should be \"loadingerror\" (TEST 38) (" + win + ")");
+            is(events[1].fontfaces.length, 1, "second event should have 1 FontFace (TEST 38) (" + win + ")");
+            is(events[1].fontfaces[0], face, "second event should have the first FontFace");
 
-        is(events[2].type, "loadingdone", "third event should be \"loadingdone\" (TEST 38)");
-        is(events[2].fontfaces.length, 0, "third event should have no FontFaces (TEST 38)");
+            is(events[2].type, "loadingdone", "third event should be \"loadingdone\" (TEST 38) (" + win + ")");
+            is(events[2].fontfaces.length, 0, "third event should have no FontFaces (TEST 38) (" + win + ")");
 
-        is(events[3].type, "loadingerror", "third event should be \"loadingerror\" (TEST 38)");
-        is(events[3].fontfaces.length, 1, "third event should only have 1 FontFace (TEST 38)");
-        is(events[3].fontfaces[0], face2, "third event should have the second FontFace");
+            is(events[3].type, "loadingerror", "third event should be \"loadingerror\" (TEST 38) (" + win + ")");
+            is(events[3].fontfaces.length, 1, "third event should only have 1 FontFace (TEST 38) (" + win + ")");
+            is(events[3].fontfaces[0], face2, "third event should have the second FontFace");
 
-        document.fonts.onloadingdone = null;
-        document.fonts.onloadingerror = null;
-        document.fonts.clear();
-        return document.fonts.ready;
+            doc.fonts.onloadingdone = null;
+            doc.fonts.onloadingerror = null;
+            doc.fonts.clear();
+            return doc.fonts.ready;
+          });
       });
+    });
+    return p;
 
   }).then(function() {
 
@@ -1044,8 +1274,8 @@ function runTest() {
     // loadingdone event dispatched at the FontFaceSet containing it.
 
     var style = document.querySelector("style");
-    var ruleText = "@font-face { font-family: test; src: url(BitPattern.woff); } " +
-                   "@font-face { font-family: test2; src: url(BitPattern.woff?2); }";
+    var ruleText = "@font-face { font-family: test; src: url(BitPattern.woff?test39a); } " +
+                   "@font-face { font-family: test2; src: url(BitPattern.woff?test39b); }";
 
     style.textContent = ruleText;
 
@@ -1088,12 +1318,406 @@ function runTest() {
         is(events[1].fontfaces.length, 1, "second event should only have 1 FontFace (TEST 39)");
         is(events[1].fontfaces[0], all[1], "second event should have the second FontFace (TEST 39)");
 
+        style.textContent = "";
+
         document.fonts.onloadingdone = null;
         document.fonts.onloadingerror = null;
         document.fonts.clear();
         return document.fonts.ready;
       });
 
+  }).then(function() {
+
+    // (TEST 40) Test that an attempt to add the same FontFace object a second
+    // time to a FontFaceSet (where one of the FontFace objects is reflecting
+    // an @font-face rule) will be ignored.
+
+    // First set up a @font-face rule.
+    var style = document.querySelector("style");
+    style.textContent = "@font-face { font-family: something; src: url(x); }";
+
+    // Then add a couple of non-connected FontFace objects.
+    var f1 = new FontFace("test1", "url(x)");
+    var f2 = new FontFace("test2", "url(x)");
+
+    document.fonts.add(f1);
+    document.fonts.add(f2);
+
+    var all = Array.from(document.fonts);
+    var ruleFontFace = all[0];
+
+    is(all.length, 3, "number of FontFace objects in the FontFaceSet before duplicate add (TEST 40)");
+    is(all[1], f1, "first non-connected FontFace object in the FontFaceSet before duplicate add (TEST 40)");
+    is(all[2], f2, "second non-connected FontFace object in the FontFaceSet before duplicate add (TEST 40)");
+
+    document.fonts.add(f1);
+
+    all = Array.from(document.fonts);
+    is(all.length, 3, "number of FontFace objects in the FontFaceSet after duplicate add #1 (TEST 40)");
+    is(all[0], ruleFontFace, "rule-based FontFace object in the FontFaceSEt after duplicate add #1 (TEST 40)");
+    is(all[1], f1, "first non-connected FontFace object in the FontFaceSet after duplicate add #1 (TEST 40)");
+    is(all[2], f2, "second non-connected FontFace object in the FontFaceSet after duplicate add #1 (TEST 40)");
+
+    document.fonts.add(ruleFontFace);
+
+    all = Array.from(document.fonts);
+    is(all.length, 3, "number of FontFace objects in the FontFaceSet after duplicate add #2 (TEST 40)");
+    is(all[0], ruleFontFace, "rule-based FontFace object in the FontFaceSEt after duplicate add #2 (TEST 40)");
+    is(all[1], f1, "first non-connected FontFace object in the FontFaceSet after duplicate add #2 (TEST 40)");
+    is(all[2], f2, "second non-connected FontFace object in the FontFaceSet after duplicate add #2 (TEST 40)");
+
+    style.textContent = "";
+
+    document.fonts.clear();
+
+  }).then(function() {
+
+    // (TEST 41) Test that an attempt to add the same FontFace object a second
+    // time to a FontFaceSet (where none of the FontFace objects are reflecting
+    // an @font-face rule) will be ignored.
+
+    [window, fwindow].forEach(function(win) {
+      var doc = win.document;
+
+      // Add a couple of non-connected FontFace objects.
+      var f1 = new win.FontFace("test1", "url(x)");
+      var f2 = new win.FontFace("test2", "url(x)");
+
+      doc.fonts.add(f1);
+      doc.fonts.add(f2);
+
+      var all = Array.from(doc.fonts);
+
+      is(all.length, 2, "number of FontFace objects in the FontFaceSet before duplicate add (TEST 41) (" + win + ")");
+      is(all[0], f1, "first non-connected FontFace object in the FontFaceSet before duplicate add (TEST 41) (" + win + ")");
+      is(all[1], f2, "second non-connected FontFace object in the FontFaceSet before duplicate add (TEST 41) (" + win + ")");
+
+      doc.fonts.add(f1);
+
+      all = Array.from(doc.fonts);
+      is(all.length, 2, "number of FontFace objects in the FontFaceSet after duplicate add (TEST 41) (" + win + ")");
+      is(all[0], f1, "first non-connected FontFace object in the FontFaceSet after duplicate add (TEST 41) (" + win + ")");
+      is(all[1], f2, "second non-connected FontFace object in the FontFaceSet after duplicate add (TEST 41) (" + win + ")");
+
+      doc.fonts.clear();
+    });
+
+  }).then(function() {
+
+    // (TEST 43) Test the check method with platform fonts and some
+    // degenerate cases.
+
+    [window, fwindow].forEach(function(win) {
+      var doc = win.document;
+
+      // Invalid font shorthands should throw a SyntaxError.
+      try {
+        doc.fonts.check("Helvetica");
+        ok(false, "check should throw when a syntactically invalid font shorthand is given (TEST 43) (" + win + ")");
+      } catch (ex) {
+        is(ex.name, "SyntaxError", "exception name when check is called with a syntactically invalid font shorthand (TEST 43) (" + win + ")");
+      }
+
+      // System fonts should throw a SyntaxError.
+      try {
+        doc.fonts.check("caption");
+        ok(false, "check should throw when a system font value is given (TEST 43) (" + win + ")");
+      } catch (ex) {
+        is(ex.name, "SyntaxError", "exception name when check is called with a system font value (TEST 43) (" + win + ")");
+      }
+
+      // CSS-wide keywords should throw a SyntaxError.
+      try {
+        doc.fonts.check("inherit");
+        ok(false, "check should throw when a CSS-wide keyword is given (TEST 43) (" + win + ")");
+      } catch (ex) {
+        is(ex.name, "SyntaxError", "exception name when check is called with a CSS-wide keyword (TEST 43) (" + win + ")");
+      }
+
+      // CSS variables should throw a SyntaxError.
+      try {
+        doc.fonts.check("16px var(--family)");
+        ok(false, "check should throw when CSS variables are used (TEST 43) (" + win + ")");
+      } catch (ex) {
+        is(ex.name, "SyntaxError", "exception name when check is called with CSS variables (TEST 43) (" + win + ")");
+      }
+
+      // No matching font family names => return true.
+      is(doc.fonts.check("16px NonExistentFont1, NonExistentFont2"), true, "check return value when no matching font family names are used (TEST 43) (" + win + ")");
+
+      // Matching platform font family name => return true.
+      is(doc.fonts.check("16px NonExistentFont, " + likelyPlatformFonts), true, "check return value when a matching platform font family name is used (TEST 43) (" + win + ")");
+
+      // Matching platform font family name, but using a different test
+      // strings.  (Platform fonts always return true from check, regardless
+      // of the actual glyphs present.)
+      [
+        { test: "\0",  desc: "a single non-matching glyph" },
+        { test: "A\0", desc: "a matching and a non-matching glyph" },
+        { test: "A",   desc: "a matching glyph" },
+        { test: "AB",  desc: "multiple matching glyphs" }
+      ].forEach(function({ test, desc }) {
+        is(doc.fonts.check("16px " + likelyPlatformFonts, test), true, "check return value when a matching platform font family name is used but with " + desc + " (TEST 43) (" + win + ")");
+      });
+
+      // No matching font family name, but an empty test string.
+      is(doc.fonts.check("16px NonExistentFont", ""), true, "check return value with a non-matching font family name and an empty test string (TEST 43) (" + win + ")");
+
+      // Matching platform font family name, but empty test string.
+      is(doc.fonts.check("16px " + likelyPlatformFonts, ""), true, "check return value with an empty test string (TEST 43) (" + win + ")");
+    });
+
+  }).then(function() {
+
+    // (TEST 44) Test the check method with script-created FontFaces.
+
+    var tests = [
+      // at least one matching FontFace is not loaded ==> false
+      { result: false, font: "16px Test", faces: [{ family: "Test", status: "unloaded" }] },
+      { result: false, font: "16px Test", faces: [{ family: "SecondTest", status: "loaded" }, { family: "Test", status: "unloaded" }] },
+      { result: false, font: "16px Test", faces: [{ family: "Test", status: "unloaded" }, { family: "Test", status: "loaded" }] },
+      { result: false, font: "16px Test", faces: [{ family: "Test", status: "loading" }] },
+      { result: false, font: "16px Test", faces: [{ family: "Test", status: "error" }] },
+      { result: false, font: "16px Test", faces: [{ family: "Test", status: "unloaded", style: "italic" }] },
+      { result: false, font: "bold 16px Test", faces: [{ family: "Test", status: "loaded", weight: "600" }, { family: "Test", status: "unloaded", weight: "bold" }] },
+      { result: false, font: "16px Test, SecondTest", faces: [{ family: "Test", status: "loaded" }, { family: "SecondTest", status: "unloaded" }] },
+      { result: false, font: "16px Test, " + likelyPlatformFonts + ", SecondTest, sans-serif", faces: [{ family: "Test", status: "loaded" }, { family: "SecondTest", status: "unloaded" }] },
+
+      // all matching FontFaces are loaded ==> true
+      { result: true,  font: "16px Test", faces: [{ family: "Test", status: "loaded" }] },
+      { result: true,  font: "16px Test", faces: [{ family: "Test", status: "loaded" }, { family: "Test", status: "loaded" }] },
+      { result: true,  font: "16px Test", faces: [{ family: "Test", status: "loaded" }, { family: "Test", status: "unloaded", unicodeRange: "U+4E0A" }] },
+      { result: true,  font: "16px Test", faces: [{ family: "Test", status: "loaded" }, { family: "Test", status: "error", unicodeRange: "U+4E0A" }] },
+      { result: true,  font: "16px Test", faces: [{ family: "Test", status: "loaded" }, { family: "Irrelevant", status: "unloaded" }] },
+      { result: true,  font: "16px Test", faces: [{ family: "Test", status: "loaded", style: "italic" }] },
+      { result: true,  font: "16px Test", faces: [{ family: "Test", status: "loaded", weight: "bold" }] },
+      { result: true,  font: "16px Test", faces: [{ family: "Test", status: "loaded", stretch: "condensed" }] },
+      { result: true,  font: "bold 16px Test", faces: [{ family: "Test", status: "loaded", weight: "bold" }, { family: "Test", status: "unloaded", weight: "600" }] },
+      { result: true,  font: "16px Test, " + likelyPlatformFonts + ", SecondTest, sans-serif", faces: [{ family: "Test", status: "loaded" }, { family: "SecondTest", status: "loaded" }] },
+
+      // no matching FontFaces at all ==> true
+      { result: true,  font: "16px Test", faces: [] },
+      { result: true,  font: "16px Test", faces: [{ family: "Irrelevant", status: "unloaded" }] },
+      { result: true,  font: "16px Test", faces: [{ family: "Test", status: "unloaded", unicodeRange: "U+4E0A" }] },
+      { result: true,  font: "16px Test, " + likelyPlatformFonts + ", SecondTest, sans-serif", faces: [{ family: "ThirdTest", status: "loaded" }] },
+
+      // matching FontFace for one sample text character is loaded but
+      // not the other ==> false
+      { result: false, font: "16px Test", faces: [{ family: "Test", status: "loaded", unicodeRange: "U+61" }, { family: "Test", status: "unloaded", unicodeRange: "U+62" }] },
+
+      // matching FontFaces for separate sample text characters are all
+      // loaded ==> true
+      { result: true,  font: "16px Test", faces: [{ family: "Test", status: "loaded", unicodeRange: "U+61" }, { family: "Test", status: "loaded", unicodeRange: "U+62" }] },
+    ];
+
+    [window, fwindow].forEach(function(win, i) {
+      var doc = win.document;
+
+      tests.forEach(function({ result, font, faces }, j) {
+        faces.forEach(function(f, k) {
+          var fontFace;
+          if (f.status == "loaded") {
+            fontFace = new win.FontFace(f.family, fontData, f);
+          } else if (f.status == "error") {
+            fontFace = new win.FontFace(f.family, new ArrayBuffer(0), f);
+          } else {
+            fontFace = new win.FontFace(f.family, "url(BitPattern.woff?test44." + [i, j, k] + ")", f);
+            if (f.status == "loading") {
+              fontFace.load();
+            }
+          }
+          is(fontFace.status, f.status, "status of newly created FontFace " + [j, k] + " (TEST 44) (" + win + ")");
+          doc.fonts.add(fontFace);
+        });
+        is(doc.fonts.check(font, "ab"), result, "check return value for subtest " + j + " (TEST 44) (" + win + ")");
+        doc.fonts.clear();
+      });
+    });
+
+  }).then(function() {
+
+    // (TEST 45) Test the load method with platform fonts and some
+    // degenerate cases.
+
+    var p = Promise.resolve();
+    [window, fwindow].forEach(function(win, i) {
+      var doc = win.document;
+
+      p = p.then(function() {
+        // Invalid font shorthands should reject the promise with a SyntaxError.
+        return doc.fonts.load("Helvetica").then(function() {
+          ok(false, "load should reject when a syntactically invalid font shorthand is given (TEST 45) (" + win + ")");
+        }, function(ex) {
+          is(ex.name, "SyntaxError", "exception name when load is called with a syntactically invalid font shorthand (TEST 45) (" + win + ")");
+        });
+      });
+
+      p = p.then(function() {
+        // System fonts should reject with a SyntaxError.
+        return doc.fonts.load("caption").then(function() {
+          ok(false, "load should throw when a system font value is given (TEST 45) (" + win + ")");
+        }, function(ex) {
+          is(ex.name, "SyntaxError", "exception name when load is called with a system font value (TEST 45) (" + win + ")");
+        });
+      });
+
+      p = p.then(function() {
+        // CSS-wide keywords should reject with a SyntaxError.
+        return doc.fonts.load("inherit").then(function() {
+          ok(false, "load should throw when a CSS-wide keyword is given (TEST 45) (" + win + ")");
+        }, function(ex) {
+          is(ex.name, "SyntaxError", "exception name when load is called with a CSS-wide keyword (TEST 45) (" + win + ")");
+        });
+      });
+
+      p = p.then(function() {
+        // CSS variables should throw a SyntaxError.
+        return doc.fonts.load("16px var(--family)").then(function() {
+          ok(false, "load should throw when CSS variables are used (TEST 45) (" + win + ")");
+        }, function(ex) {
+          is(ex.name, "SyntaxError", "exception name when load is called with CSS variables (TEST 45) (" + win + ")");
+        });
+      });
+
+      p = p.then(function() {
+        // No matching font family names => return true.
+        return doc.fonts.load("16px NonExistentFont1, NonExistentFont2").then(function(result) {
+          is(result.length, 0, "load resolves with an emtpy array when no matching font family names are used (TEST 45) (" + win + ")");
+        });
+      });
+
+      p = p.then(function() {
+        // Matching platform font family name => return true.
+        return doc.fonts.load("16px NonExistentFont1, " + likelyPlatformFonts).then(function(result) {
+          is(result.length, 0, "load resolves with an emtpy array when no matching font family names are used (TEST 45) (" + win + ")");
+        });
+      });
+
+      // Matching platform font family name, but using a different test
+      // strings.  (Platform fonts always return true from load, regardless
+      // of the actual glyphs present.)
+      [
+        { sample: "\0",  desc: "a single non-matching glyph" },
+        { sample: "A\0", desc: "a matching and a non-matching glyph" },
+        { sample: "A",   desc: "a matching glyph" },
+        { sample: "AB",  desc: "multiple matching glyphs" }
+      ].forEach(function({ sample, desc }) {
+        p = p.then(function() {
+          return doc.fonts.load("16px " + likelyPlatformFonts, sample).then(function(result) {
+            is(result.length, 0, "load resolves with an empty array when a matching platform font family name is used but with " + desc + " (TEST 45) (" + win + ")");
+          });
+        });
+      });
+
+      p = p.then(function() {
+        // No matching font family name, but an empty test string.
+        return doc.fonts.load("16px NonExistentFont", "").then(function(result) {
+          is(result.length, 0, "load resolves with an empty array when a non-matching platform font family name and an empty test string is used (TEST 45) (" + win + ")");
+        });
+      });
+
+      p = p.then(function() {
+        // Matching font family name, but an empty test string.
+        return doc.fonts.load("16px " + likelyPlatformFonts, "").then(function(result) {
+          is(result.length, 0, "load resolves with an empty array when a matching platform font family name and an empty test string is used (TEST 45) (" + win + ")");
+        });
+      });
+    });
+    return p;
+
+  }).then(function() {
+
+    // (TEST 46) Test the load method with script-created FontFaces.
+
+    var tests = [
+      // at least one matching FontFace is not yet loaded, but will load ==> resolve
+      { result: true, font: "16px Test", faces: [{ family: "Test", status: "unloaded", included: true }] },
+      { result: true, font: "16px Test", faces: [{ family: "SecondTest", status: "loaded" }, { family: "Test", status: "unloaded", included: true }] },
+      { result: true, font: "16px Test", faces: [{ family: "Test", status: "unloaded", included: true }, { family: "Test", status: "loaded", included: true }] },
+      { result: true, font: "16px Test", faces: [{ family: "Test", status: "loading", included: true }] },
+      { result: true, font: "16px Test", faces: [{ family: "Test", status: "unloaded", style: "italic", included: true }] },
+      { result: true, font: "bold 16px Test", faces: [{ family: "Test", status: "unloaded", weight: "600", included: true }] },
+      { result: true, font: "bold 16px Test", faces: [{ family: "Test", status: "unloaded", weight: "600" }, { family: "Test", status: "unloaded", weight: "bold", included: true }] },
+      { result: true, font: "16px Test, SecondTest", faces: [{ family: "Test", status: "loaded", included: true }, { family: "SecondTest", status: "unloaded", included: true }] },
+      { result: true, font: "16px Test, " + likelyPlatformFonts + ", SecondTest, sans-serif", faces: [{ family: "Test", status: "loaded", included: true }, { family: "SecondTest", status: "unloaded", included: true }] },
+
+      // at least one matching FontFace is in an error state ==> reject
+      { result: false, font: "16px Test", faces: [{ family: "Test", status: "unloaded" }, { family: "Test", status: "error" }] },
+
+      // all matching FontFaces are already loaded ==> resolve
+      { result: true,  font: "16px Test", faces: [{ family: "Test", status: "loaded", included: true }] },
+      { result: true,  font: "16px Test", faces: [{ family: "Test", status: "loaded", included: true }, { family: "Test", status: "loaded", included: true }] },
+      { result: true,  font: "16px Test", faces: [{ family: "Test", status: "loaded", included: true }, { family: "Test", status: "unloaded", unicodeRange: "U+4E0A" }] },
+      { result: true,  font: "16px Test", faces: [{ family: "Test", status: "loaded", included: true }, { family: "Test", status: "error", unicodeRange: "U+4E0A" }] },
+      { result: true,  font: "16px Test", faces: [{ family: "Test", status: "loaded", included: true }, { family: "Irrelevant", status: "unloaded" }] },
+      { result: true,  font: "16px Test", faces: [{ family: "Test", status: "loaded", style: "italic", included: true }] },
+      { result: true,  font: "16px Test", faces: [{ family: "Test", status: "loaded", weight: "bold", included: true }] },
+      { result: true,  font: "16px Test", faces: [{ family: "Test", status: "loaded", stretch: "condensed", included: true }] },
+      { result: true,  font: "bold 16px Test", faces: [{ family: "Test", status: "loaded", weight: "bold", included: true }, { family: "Test", status: "loaded", weight: "600" }] },
+      { result: true,  font: "bold 16px Test", faces: [{ family: "Test", status: "loaded", weight: "600" }, { family: "Test", status: "loaded", weight: "bold", included: true }] },
+      { result: true,  font: "16px Test, " + likelyPlatformFonts + ", SecondTest, sans-serif", faces: [{ family: "Test", status: "loaded", included: true }, { family: "SecondTest", status: "loaded", included: true }] },
+
+      // no matching FontFaces at all ==> resolve
+      { result: true,  font: "16px Test", faces: [] },
+      { result: true,  font: "16px Test", faces: [{ family: "Irrelevant", status: "unloaded" }] },
+      { result: true,  font: "16px Test", faces: [{ family: "Test", status: "unloaded", unicodeRange: "U+4E0A" }] },
+      { result: true,  font: "16px Test, " + likelyPlatformFonts + ", SecondTest, sans-serif", faces: [{ family: "ThirdTest", status: "loaded" }] },
+
+      // matching FontFace for one sample text character is already loaded but
+      // the other is not (but will) ==> resolve
+      { result: true, font: "16px Test", faces: [{ family: "Test", status: "loaded", unicodeRange: "U+61", included: true }, { family: "Test", status: "unloaded", unicodeRange: "U+62", included: true }] },
+
+      // matching FontFaces for separate sample text characters are all
+      // loaded ==> resolve
+      { result: true,  font: "16px Test", faces: [{ family: "Test", status: "loaded", unicodeRange: "U+61", included: true }, { family: "Test", status: "loaded", unicodeRange: "U+62", included: true }] },
+    ];
+
+    var p = Promise.resolve();
+    [window, fwindow].forEach(function(win, i) {
+      var doc = win.document;
+
+      tests.forEach(function({ result, font, faces }, j) {
+        p = p.then(function() {
+          var fontFaces = [];
+          faces.forEach(function(f, k) {
+            var fontFace;
+            if (f.status == "loaded") {
+              fontFace = new win.FontFace(f.family, fontData, f);
+            } else if (f.status == "error") {
+              fontFace = new win.FontFace(f.family, new ArrayBuffer(0), f);
+            } else {
+              fontFace = new win.FontFace(f.family, "url(BitPattern.woff?test46." + [i, j, k] + ")", f);
+              if (f.status == "loading") {
+                fontFace.load();
+              }
+            }
+            is(fontFace.status, f.status, "status of newly created FontFace " + [j, k] + " (TEST 46) (" + win + ")");
+            doc.fonts.add(fontFace);
+            fontFaces.push(fontFace);
+          });
+          return doc.fonts.load(font, "ab").then(function(array) {
+            ok(result, "load should resolve for subtest " + j + " (TEST 46) (" + win + ")");
+            var expected = [];
+            for (var k = 0; k < faces.length; k++) {
+              if (faces[k].included) {
+                expected.push(fontFaces[k]);
+              }
+            }
+            is(array.length, expected.length, "length of array load resolves with for subtest " + j + " (TEST 46) (" + win + ")");
+            for (var k = 0; k < array.length; k++) {
+              is(array[k], expected[k], "value in array[" + k + "] load resolves with for subtest " + j + " (TEST 46) (" + win + ")");
+            }
+          }, function(ex) {
+            ok(!result, "load should not resolve for subtest " + j + " (TEST 46) (" + win + ")");
+            is(ex.name, "SyntaxError", "exception load's return value is rejected with for subtest " + j + " (TEST 46) (" + win + ")");
+          }).then(function() {
+            doc.fonts.clear();
+          });
+        });
+      });
+    });
+    return p;
+
   }).then(function() {
 
     // End of the tests.
@@ -1108,10 +1732,12 @@ function runTest() {
   });
 }
 
-if (SpecialPowers.getBoolPref("layout.css.font-loading-api.enabled")) {
-  runTest();
-} else {
-  ok(true, "CSS Font Loading API is not enabled.");
+function start() {
+  if (SpecialPowers.getBoolPref("layout.css.font-loading-api.enabled")) {
+    runTest();
+  } else {
+    ok(true, "CSS Font Loading API is not enabled.");
+  }
 }
 </script>
 
diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index 1428b0be9b..1a63dd9cbc 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -2021,6 +2021,14 @@ pref("network.automatic-ntlm-auth.allow-proxies", true);
 pref("network.automatic-ntlm-auth.allow-non-fqdn", false);
 pref("network.automatic-ntlm-auth.trusted-uris", "");
 
+// Sub-resources HTTP-authentication:
+//   0 - don't allow sub-resources to open HTTP authentication credentials
+//       dialogs
+//   1 - allow sub-resources to open HTTP authentication credentials dialogs,
+//       but don't allow it for cross-origin sub-resources
+//   2 - allow the cross-origin authentication as well.
+pref("network.auth.allow-subresource-auth", 1);
+
 pref("permissions.default.image",           1); // 1-Accept, 2-Deny, 3-dontAcceptForeign
 
 pref("network.proxy.type",                  5);
diff --git a/netwerk/base/NetUtil.jsm b/netwerk/base/NetUtil.jsm
index 06feb7a16d..c3e343e3f5 100644
--- a/netwerk/base/NetUtil.jsm
+++ b/netwerk/base/NetUtil.jsm
@@ -320,11 +320,12 @@ this.NetUtil = {
      *            The loadingPrincipal of the channel.
      *            The principal of the document where the result of this request
      *            will be used.
-     *            This is generally the principal of the loadingNode.  However
-     *            for loads where loadingNode is omitted this argument still
-     *            needs to be passed.  For example for loads from a WebWorker,
-     *            pass the principal of that worker.  For loads from an addon or
-     *            from internal browser features, pass the system principal.
+     *            This defaults to the principal of aLoadingNode, so when
+     *            aLoadingNode is passed this can be left as null. However for
+     *            loads where aLoadingNode is null this argument must be passed.
+     *            For example for loads from a WebWorker, pass the principal of
+     *            that worker.  For loads from an addon or from internal browser
+     *            features, pass the system principal.
      *            This principal should almost always be the system principal if
      *            loadingNode is omitted, in which case you can use the
      *            useSystemPrincipal property.  The only exception to this is
diff --git a/netwerk/base/nsIIOService.idl b/netwerk/base/nsIIOService.idl
index c21e082335..4e386b1b3d 100644
--- a/netwerk/base/nsIIOService.idl
+++ b/netwerk/base/nsIIOService.idl
@@ -88,9 +88,10 @@ interface nsIIOService : nsISupports
      *        The loadingPrincipal of the channel.
      *        The principal of the document where the result of this request will
      *        be used.
-     *        This is generally the principal of the aLoadingNode. However for
-     *        loads where aLoadingNode is null this argument still needs to be
-     *        passed. For example for loads from a WebWorker, pass the principal
+     *        This defaults to the principal of aLoadingNode, so when aLoadingNode
+     *        is passed this can be left as null. However for loads where
+     *        aLoadingNode is null this argument must be passed.
+     *        For example for loads from a WebWorker, pass the principal
      *        of that worker. For loads from an addon or from internal browser
      *        features, pass the system principal.
      *        This principal should almost always be the system principal if
diff --git a/netwerk/base/nsIIOService2.idl b/netwerk/base/nsIIOService2.idl
index cde09d4876..0f66e34d0a 100644
--- a/netwerk/base/nsIIOService2.idl
+++ b/netwerk/base/nsIIOService2.idl
@@ -58,9 +58,10 @@ interface nsIIOService2 : nsIIOService
    *        The loadingPrincipal of the channel.
    *        The principal of the document where the result of this request will
    *        be used.
-   *        This is generally the principal of the aLoadingNode. However for
-   *        loads where aLoadingNode is null this argument still needs to be
-   *        passed. For example for loads from a WebWorker, pass the principal
+   *        This defaults to the principal of aLoadingNode, so when aLoadingNode
+   *        is passed this can be left as null. However for loads where
+   *        aLoadingNode is null this argument must be passed.
+   *        For example for loads from a WebWorker, pass the principal
    *        of that worker. For loads from an addon or from internal browser
    *        features, pass the system principal.
    *        This principal should almost always be the system principal if
diff --git a/netwerk/base/nsIOService.cpp b/netwerk/base/nsIOService.cpp
index 65950ff326..745edd6dc4 100644
--- a/netwerk/base/nsIOService.cpp
+++ b/netwerk/base/nsIOService.cpp
@@ -582,9 +582,20 @@ nsIOService::NewChannelFromURIWithLoadInfo(nsIURI* aURI,
                                                  result);
 }
 
+/*  ***** DEPRECATED *****
+ * please use NewChannelFromURI2 providing the right arguments for:
+ *        * aLoadingNode
+ *        * aLoadingPrincipal
+ *        * aTriggeringPrincipal
+ *        * aSecurityFlags
+ *        * aContentPolicyType
+ *
+ * See nsIIoService.idl for a detailed description of those arguments
+ */
 NS_IMETHODIMP
 nsIOService::NewChannelFromURI(nsIURI *aURI, nsIChannel **result)
 {
+  NS_WARNING("Deprecated, use NewChannelFromURI2 providing loadInfo arguments!");
   return NewChannelFromURI2(aURI,
                             nullptr, // aLoadingNode
                             nullptr, // aLoadingPrincipal
@@ -738,12 +749,23 @@ nsIOService::NewChannelFromURIWithProxyFlags2(nsIURI* aURI,
                                                    result);
 }
 
+/*  ***** DEPRECATED *****
+ * please use NewChannelFromURIWithProxyFlags2 providing the right arguments for:
+ *        * aLoadingNode
+ *        * aLoadingPrincipal
+ *        * aTriggeringPrincipal
+ *        * aSecurityFlags
+ *        * aContentPolicyType
+ *
+ * See nsIIoService.idl for a detailed description of those arguments
+ */
 NS_IMETHODIMP
 nsIOService::NewChannelFromURIWithProxyFlags(nsIURI *aURI,
                                              nsIURI *aProxyURI,
                                              uint32_t aProxyFlags,
                                              nsIChannel **result)
 {
+  NS_WARNING("Deprecated, use NewChannelFromURIWithProxyFlags2 providing loadInfo arguments!");
   return NewChannelFromURIWithProxyFlags2(aURI,
                                           aProxyURI,
                                           aProxyFlags,
@@ -780,9 +802,20 @@ nsIOService::NewChannel2(const nsACString& aSpec,
                               result);
 }
 
+/*  ***** DEPRECATED *****
+ * please use NewChannel2 providing the right arguments for:
+ *        * aLoadingNode
+ *        * aLoadingPrincipal
+ *        * aTriggeringPrincipal
+ *        * aSecurityFlags
+ *        * aContentPolicyType
+ *
+ * See nsIIoService.idl for a detailed description of those arguments
+ */
 NS_IMETHODIMP
 nsIOService::NewChannel(const nsACString &aSpec, const char *aCharset, nsIURI *aBaseURI, nsIChannel **result)
 {
+  NS_WARNING("Deprecated, use NewChannel2 providing loadInfo arguments!");
   return NewChannel2(aSpec,
                      aCharset,
                      aBaseURI,
@@ -1589,14 +1622,21 @@ IOServiceProxyCallback::OnProxyAvailable(nsICancelable *request, nsIChannel *cha
     if (!speculativeHandler)
         return NS_OK;
 
-    speculativeHandler->SpeculativeConnect(uri,
-                                           mCallbacks);
+    nsLoadFlags loadFlags = 0;
+    channel->GetLoadFlags(&loadFlags);
+    if (loadFlags & nsIRequest::LOAD_ANONYMOUS) {
+        speculativeHandler->SpeculativeAnonymousConnect(uri, mCallbacks);
+    } else {
+        speculativeHandler->SpeculativeConnect(uri, mCallbacks);
+    }
+
     return NS_OK;
 }
 
-NS_IMETHODIMP
-nsIOService::SpeculativeConnect(nsIURI *aURI,
-                                nsIInterfaceRequestor *aCallbacks)
+nsresult
+nsIOService::SpeculativeConnectInternal(nsIURI *aURI,
+                                        nsIInterfaceRequestor *aCallbacks,
+                                        bool aAnonymous)
 {
     // Check for proxy information. If there is a proxy configured then a
     // speculative connect should not be performed because the potential
@@ -1627,9 +1667,15 @@ nsIOService::SpeculativeConnect(nsIURI *aURI,
                             nsILoadInfo::SEC_NORMAL,
                             nsIContentPolicy::TYPE_OTHER,
                             getter_AddRefs(channel));
-
     NS_ENSURE_SUCCESS(rv, rv);
 
+    if (aAnonymous) {
+        nsLoadFlags loadFlags = 0;
+        channel->GetLoadFlags(&loadFlags);
+        loadFlags |= nsIRequest::LOAD_ANONYMOUS;
+        channel->SetLoadFlags(loadFlags);
+    }
+
     nsCOMPtr<nsICancelable> cancelable;
     nsRefPtr<IOServiceProxyCallback> callback =
         new IOServiceProxyCallback(aCallbacks, this);
@@ -1640,6 +1686,20 @@ nsIOService::SpeculativeConnect(nsIURI *aURI,
     return pps->AsyncResolve(channel, 0, callback, getter_AddRefs(cancelable));
 }
 
+NS_IMETHODIMP
+nsIOService::SpeculativeConnect(nsIURI *aURI,
+                                nsIInterfaceRequestor *aCallbacks)
+{
+    return SpeculativeConnectInternal(aURI, aCallbacks, false);
+}
+
+NS_IMETHODIMP
+nsIOService::SpeculativeAnonymousConnect(nsIURI *aURI,
+                                         nsIInterfaceRequestor *aCallbacks)
+{
+    return SpeculativeConnectInternal(aURI, aCallbacks, true);
+}
+
 void
 nsIOService::NotifyAppOfflineStatus(uint32_t appId, int32_t state)
 {
diff --git a/netwerk/base/nsIOService.h b/netwerk/base/nsIOService.h
index d29a34261b..efb0218804 100644
--- a/netwerk/base/nsIOService.h
+++ b/netwerk/base/nsIOService.h
@@ -125,6 +125,11 @@ private:
                                                      uint32_t aProxyFlags,
                                                      nsILoadInfo* aLoadInfo,
                                                      nsIChannel** result);
+
+    nsresult SpeculativeConnectInternal(nsIURI *aURI,
+                                        nsIInterfaceRequestor *aCallbacks,
+                                        bool aAnonymous);
+
 private:
     bool                                 mOffline;
     bool                                 mOfflineForProfileChange;
diff --git a/netwerk/base/nsISpeculativeConnect.idl b/netwerk/base/nsISpeculativeConnect.idl
index 4ef559d633..15d63e1071 100644
--- a/netwerk/base/nsISpeculativeConnect.idl
+++ b/netwerk/base/nsISpeculativeConnect.idl
@@ -8,7 +8,7 @@
 interface nsIURI;
 interface nsIInterfaceRequestor;
 
-[scriptable, uuid(fa580a8d-f4a4-47c5-8ade-4f9786e8d1de)]
+[scriptable, uuid(d74a17ac-5b8a-4824-a309-b1f04a3c4aed)]
 interface nsISpeculativeConnect : nsISupports
 {
     /**
@@ -28,6 +28,8 @@ interface nsISpeculativeConnect : nsISupports
     void speculativeConnect(in nsIURI aURI,
                             in nsIInterfaceRequestor aCallbacks);
 
+    void speculativeAnonymousConnect(in nsIURI aURI,
+                                     in nsIInterfaceRequestor aCallbacks);
 };
 
 /**
diff --git a/netwerk/base/nsNetUtil.h b/netwerk/base/nsNetUtil.h
index c477d796f0..30a56f1160 100644
--- a/netwerk/base/nsNetUtil.h
+++ b/netwerk/base/nsNetUtil.h
@@ -225,9 +225,10 @@ NS_NewFileURI(nsIURI* *result,
 *        The loadingPrincipal of the channel.
 *        The principal of the document where the result of this request will
 *        be used.
-*        This is generally the principal of the aLoadingNode. However for
-*        loads where aLoadingNode is null this argument still needs to be
-*        passed. For example for loads from a WebWorker, pass the principal
+*        This defaults to the principal of aLoadingNode, so when aLoadingNode
+*        is passed this can be left as null. However for loads where
+*        aLoadingNode is null this argument must be passed.
+*        For example for loads from a WebWorker, pass the principal
 *        of that worker. For loads from an addon or from internal browser
 *        features, pass the system principal.
 *        This principal should almost always be the system principal if
diff --git a/netwerk/ipc/NeckoParent.cpp b/netwerk/ipc/NeckoParent.cpp
index e7f3a4950a..20c01e8650 100644
--- a/netwerk/ipc/NeckoParent.cpp
+++ b/netwerk/ipc/NeckoParent.cpp
@@ -696,12 +696,17 @@ NeckoParent::DeallocPRemoteOpenFileParent(PRemoteOpenFileParent* actor)
 }
 
 bool
-NeckoParent::RecvSpeculativeConnect(const URIParams &aURI)
+NeckoParent::RecvSpeculativeConnect(const URIParams& aURI, const bool& aAnonymous)
 {
   nsCOMPtr<nsISpeculativeConnect> speculator(gIOService);
   nsCOMPtr<nsIURI> uri = DeserializeURI(aURI);
   if (uri && speculator) {
-    speculator->SpeculativeConnect(uri, nullptr);
+    if (aAnonymous) {
+      speculator->SpeculativeAnonymousConnect(uri, nullptr);
+    } else {
+      speculator->SpeculativeConnect(uri, nullptr);
+    }
+
   }
   return true;
 }
diff --git a/netwerk/ipc/NeckoParent.h b/netwerk/ipc/NeckoParent.h
index 7cac382147..7e029e14bc 100644
--- a/netwerk/ipc/NeckoParent.h
+++ b/netwerk/ipc/NeckoParent.h
@@ -163,7 +163,7 @@ protected:
                                           const uint32_t& flags,
                                           const nsCString& aNetworkInterface) override;
   virtual bool DeallocPDNSRequestParent(PDNSRequestParent*) override;
-  virtual bool RecvSpeculativeConnect(const URIParams& aURI) override;
+  virtual bool RecvSpeculativeConnect(const URIParams& aURI, const bool& aAnonymous) override;
   virtual bool RecvHTMLDNSPrefetch(const nsString& hostname,
                                    const uint16_t& flags) override;
   virtual bool RecvCancelHTMLDNSPrefetch(const nsString& hostname,
diff --git a/netwerk/ipc/PNecko.ipdl b/netwerk/ipc/PNecko.ipdl
index 91beece5cf..7a4ab90836 100644
--- a/netwerk/ipc/PNecko.ipdl
+++ b/netwerk/ipc/PNecko.ipdl
@@ -76,7 +76,7 @@ parent:
                   URIParams fileuri,
                   OptionalURIParams appuri);
 
-  SpeculativeConnect(URIParams uri);
+  SpeculativeConnect(URIParams uri, bool anonymous);
   HTMLDNSPrefetch(nsString hostname, uint16_t flags);
   CancelHTMLDNSPrefetch(nsString hostname, uint16_t flags, nsresult reason);
 
diff --git a/netwerk/protocol/http/nsHttpChannelAuthProvider.cpp b/netwerk/protocol/http/nsHttpChannelAuthProvider.cpp
index 6111742b85..3d6bb14c6d 100644
--- a/netwerk/protocol/http/nsHttpChannelAuthProvider.cpp
+++ b/netwerk/protocol/http/nsHttpChannelAuthProvider.cpp
@@ -7,6 +7,7 @@
 // HttpLog.h should generally be included first
 #include "HttpLog.h"
 
+#include "mozilla/Preferences.h"
 #include "nsHttpChannelAuthProvider.h"
 #include "nsNetUtil.h"
 #include "nsHttpHandler.h"
@@ -27,6 +28,10 @@
 namespace mozilla {
 namespace net {
 
+#define SUBRESOURCE_AUTH_DIALOG_DISALLOW_ALL 0
+#define SUBRESOURCE_AUTH_DIALOG_DISALLOW_CROSS_ORIGIN 1
+#define SUBRESOURCE_AUTH_DIALOG_ALLOW_ALL 2
+
 #define MAX_DISPLAYED_USER_LENGTH 64
 #define MAX_DISPLAYED_HOST_LENGTH 64
 
@@ -64,6 +69,18 @@ nsHttpChannelAuthProvider::~nsHttpChannelAuthProvider()
     MOZ_ASSERT(!mAuthChannel, "Disconnect wasn't called");
 }
 
+uint32_t nsHttpChannelAuthProvider::sAuthAllowPref =
+    SUBRESOURCE_AUTH_DIALOG_DISALLOW_CROSS_ORIGIN;
+
+void
+nsHttpChannelAuthProvider::InitializePrefs()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  mozilla::Preferences::AddUintVarCache(&sAuthAllowPref,
+                                        "network.auth.allow-subresource-auth",
+                                        SUBRESOURCE_AUTH_DIALOG_DISALLOW_CROSS_ORIGIN);
+}
+
 NS_IMETHODIMP
 nsHttpChannelAuthProvider::Init(nsIHttpAuthenticableChannel *channel)
 {
@@ -738,6 +755,14 @@ nsHttpChannelAuthProvider::GetCredentialsForChallenge(const char *challenge,
             else if (authFlags & nsIHttpAuthenticator::IDENTITY_ENCRYPTED)
                 level = nsIAuthPrompt2::LEVEL_PW_ENCRYPTED;
 
+            // Depending on the pref setting, the authentication dialog may be
+            // blocked for all sub-resources, blocked for cross-origin
+            // sub-resources, or always allowed for sub-resources.
+            // For more details look at the bug 647010.
+            if (BlockPrompt()) {
+              return NS_ERROR_ABORT;
+            }
+
             // at this point we are forced to interact with the user to get
             // their username and password for this domain.
             rv = PromptForIdentity(level, proxyAuth, realm.get(),
@@ -781,6 +806,53 @@ nsHttpChannelAuthProvider::GetCredentialsForChallenge(const char *challenge,
     return rv;
 }
 
+bool
+nsHttpChannelAuthProvider::BlockPrompt()
+{
+    nsCOMPtr<nsIChannel> chan = do_QueryInterface(mAuthChannel);
+    nsCOMPtr<nsILoadInfo> loadInfo;
+    chan->GetLoadInfo(getter_AddRefs(loadInfo));
+    if (!loadInfo) {
+        return false;
+    }
+
+    // Allow if it is the top-level document or xhr.
+    if ((loadInfo->InternalContentPolicyType() == nsIContentPolicy::TYPE_DOCUMENT) ||
+        (loadInfo->InternalContentPolicyType() == nsIContentPolicy::TYPE_XMLHTTPREQUEST)) {
+        return false;
+    }
+
+    switch (sAuthAllowPref) {
+    case SUBRESOURCE_AUTH_DIALOG_DISALLOW_ALL:
+        // Do not open the http-authentication credentials dialog for
+        // the sub-resources.
+        return true;
+        break;
+    case SUBRESOURCE_AUTH_DIALOG_DISALLOW_CROSS_ORIGIN:
+        // Do not open the http-authentication credentials dialog for
+        // the sub-resources only if they are not cross-origin.
+        {
+            nsCOMPtr<nsIPrincipal> loadingPrincipal =
+                loadInfo->LoadingPrincipal();
+            if (!loadingPrincipal) {
+                return false;
+            }
+
+            if (NS_FAILED(loadingPrincipal->CheckMayLoad(mURI, false, false))) {
+                return true;
+            }
+        }
+        break;
+    case SUBRESOURCE_AUTH_DIALOG_ALLOW_ALL:
+        // Allow the http-authentication dialog.
+        return false;
+    default:
+        // This is an invalid value.
+        MOZ_ASSERT(false, "A non valid value!");
+    }
+    return false;
+}
+
 inline void
 GetAuthType(const char *challenge, nsCString &authType)
 {
diff --git a/netwerk/protocol/http/nsHttpChannelAuthProvider.h b/netwerk/protocol/http/nsHttpChannelAuthProvider.h
index f9a42d115e..05b18162dd 100644
--- a/netwerk/protocol/http/nsHttpChannelAuthProvider.h
+++ b/netwerk/protocol/http/nsHttpChannelAuthProvider.h
@@ -33,7 +33,7 @@ public:
     NS_DECL_NSIAUTHPROMPTCALLBACK
 
     nsHttpChannelAuthProvider();
-
+    static void InitializePrefs();
 private:
     virtual ~nsHttpChannelAuthProvider();
 
@@ -111,6 +111,12 @@ private:
      */
     nsresult ProcessSTSHeader();
 
+    // Depending on the pref setting, the authentication dialog may be blocked
+    // for all sub-resources, blocked for cross-origin sub-resources, or
+    // always allowed for sub-resources.
+    // For more details look at the bug 647010.
+    bool BlockPrompt();
+
 private:
     nsIHttpAuthenticableChannel      *mAuthChannel;  // weak ref
 
@@ -149,6 +155,11 @@ private:
     uint32_t                          mSuppressDefensiveAuth    : 1;
 
     nsRefPtr<nsHttpHandler>           mHttpHandler;  // keep gHttpHandler alive
+
+    // A variable holding the preference settings to whether to open HTTP
+    // authentication credentials dialogs for sub-resources and cross-origin
+    // sub-resources.
+    static uint32_t                   sAuthAllowPref;
 };
 
 } // namespace net
diff --git a/netwerk/protocol/http/nsHttpHandler.cpp b/netwerk/protocol/http/nsHttpHandler.cpp
index 17d8a8171a..d4d1b457c8 100644
--- a/netwerk/protocol/http/nsHttpHandler.cpp
+++ b/netwerk/protocol/http/nsHttpHandler.cpp
@@ -48,6 +48,7 @@
 #include "nsIMemoryReporter.h"
 #include "nsIParentalControlsService.h"
 #include "nsINetworkLinkService.h"
+#include "nsHttpChannelAuthProvider.h"
 
 #include "mozilla/net/NeckoChild.h"
 #include "mozilla/ipc/URIUtils.h"
@@ -277,6 +278,8 @@ nsHttpHandler::Init()
         PrefsChanged(prefBranch, nullptr);
     }
 
+    nsHttpChannelAuthProvider::InitializePrefs();
+
     if (mCompatFirefoxEnabled) {
       mMisc.AssignLiteral("rv:" MOZILLA_COMPATVERSION);
     } else {
@@ -2004,14 +2007,15 @@ nsHttpHandler::Observe(nsISupports *subject,
 
 // nsISpeculativeConnect
 
-NS_IMETHODIMP
-nsHttpHandler::SpeculativeConnect(nsIURI *aURI,
-                                  nsIInterfaceRequestor *aCallbacks)
+nsresult
+nsHttpHandler::SpeculativeConnectInternal(nsIURI *aURI,
+                                          nsIInterfaceRequestor *aCallbacks,
+                                          bool anonymous)
 {
     if (IsNeckoChild()) {
         ipc::URIParams params;
         SerializeURI(aURI, params);
-        gNeckoChild->SendSpeculativeConnect(params);
+        gNeckoChild->SendSpeculativeConnect(params, anonymous);
         return NS_OK;
     }
 
@@ -2074,10 +2078,25 @@ nsHttpHandler::SpeculativeConnect(nsIURI *aURI,
 
     nsHttpConnectionInfo *ci =
         new nsHttpConnectionInfo(host, port, EmptyCString(), username, nullptr, usingSSL);
+    ci->SetAnonymous(anonymous);
 
     return SpeculativeConnect(ci, aCallbacks);
 }
 
+NS_IMETHODIMP
+nsHttpHandler::SpeculativeConnect(nsIURI *aURI,
+                                  nsIInterfaceRequestor *aCallbacks)
+{
+    return SpeculativeConnectInternal(aURI, aCallbacks, false);
+}
+
+NS_IMETHODIMP
+nsHttpHandler::SpeculativeAnonymousConnect(nsIURI *aURI,
+                                           nsIInterfaceRequestor *aCallbacks)
+{
+    return SpeculativeConnectInternal(aURI, aCallbacks, true);
+}
+
 void
 nsHttpHandler::TickleWifi(nsIInterfaceRequestor *cb)
 {
diff --git a/netwerk/protocol/http/nsHttpHandler.h b/netwerk/protocol/http/nsHttpHandler.h
index c97d53431a..e2a287e9f4 100644
--- a/netwerk/protocol/http/nsHttpHandler.h
+++ b/netwerk/protocol/http/nsHttpHandler.h
@@ -560,6 +560,11 @@ public:
 private:
     nsRefPtr<Tickler> mWifiTickler;
     void TickleWifi(nsIInterfaceRequestor *cb);
+
+private:
+    nsresult SpeculativeConnectInternal(nsIURI *aURI,
+                                        nsIInterfaceRequestor *aCallbacks,
+                                        bool anonymous);
 };
 
 extern nsHttpHandler *gHttpHandler;
diff --git a/netwerk/test/mochitests/rel_preconnect.sjs b/netwerk/test/mochitests/rel_preconnect.sjs
index d373f28460..7c1dc2dd90 100644
--- a/netwerk/test/mochitests/rel_preconnect.sjs
+++ b/netwerk/test/mochitests/rel_preconnect.sjs
@@ -6,7 +6,10 @@ function handleRequest(request, response)
     response.setHeader("Cache-Control", "no-cache", false);
     response.setHeader("Link", "<" + 
                        request.getHeader('X-Link') +
-                       ">; rel=preconnect");
+                       ">; rel=preconnect" + ", " +
+                        "<" + 
+                       request.getHeader('X-Link') +
+                       ">; rel=preconnect; crossOrigin=anonymous");
     response.write("check that header");
 }
 
diff --git a/netwerk/test/mochitests/test_rel_preconnect.html b/netwerk/test/mochitests/test_rel_preconnect.html
index 490594f303..5a08ab1971 100644
--- a/netwerk/test/mochitests/test_rel_preconnect.html
+++ b/netwerk/test/mochitests/test_rel_preconnect.html
@@ -11,9 +11,9 @@
 SimpleTest.waitForExplicitFinish();
 
 const Cc = SpecialPowers.Cc, Ci = SpecialPowers.Ci, Cr = SpecialPowers.Cr;
-var srv;
+var srv1, srv2;
 
-function TestServer(nextTest) {
+function TestServer1(nextTest) {
     this.listener= Cc["@mozilla.org/network/server-socket;1"]
                    .createInstance(Ci.nsIServerSocket);
     this.listener.init(-1, true, -1);
@@ -21,7 +21,9 @@ function TestServer(nextTest) {
     this.nextTest = nextTest;
 }
 
-TestServer.prototype = {
+TestServer1.prototype = {
+    remainder : 2,
+
     QueryInterface: function(iid) {
       iid = SpecialPowers.wrap(iid);
         if (iid.equals(Ci.nsIServerSocketListener) ||
@@ -32,8 +34,43 @@ TestServer.prototype = {
     onSocketAccepted: function(socket, trans) {
         try { socket.close(); } catch(e) {}
         try { trans.close(); } catch(e) {}
-        ok(true, "received connect");
-        setTimeout(srv.nextTest, 0);
+        this.remainder--;
+        ok(true, "received connect remainder = " + this.remainder);
+        if (!this.remainder) {
+          srv1.listener.close();
+          setTimeout(srv1.nextTest, 0);
+        }
+    },
+    onStopListening: function(socket) {}
+};
+
+function TestServer2(nextTest) {
+    this.listener= Cc["@mozilla.org/network/server-socket;1"]
+                   .createInstance(Ci.nsIServerSocket);
+    this.listener.init(-1, true, -1);
+    this.listener.asyncListen(SpecialPowers.wrapCallbackObject(this));
+    this.nextTest = nextTest;
+}
+
+TestServer2.prototype = {
+    remainder : 2,
+
+    QueryInterface: function(iid) {
+      iid = SpecialPowers.wrap(iid);
+        if (iid.equals(Ci.nsIServerSocketListener) ||
+            iid.equals(Ci.nsISupports))
+            return this;
+        throw Cr.NS_ERROR_NO_INTERFACE;
+    },
+    onSocketAccepted: function(socket, trans) {
+        try { socket.close(); } catch(e) {}
+        try { trans.close(); } catch(e) {}
+        this.remainder--;
+        ok(true, "received connect srv2 remainder = " + this.remainder);
+        if (!this.remainder) {
+          srv2.listener.close();
+          setTimeout(srv2.nextTest, 0);
+        }
     },
     onStopListening: function(socket) {}
 };
@@ -42,23 +79,29 @@ var originalLimit = SpecialPowers.getIntPref("network.http.speculative-parallel-
 
 function testElement()
 {
-  // test the link rel=preconnect element in the head
-  srv = new TestServer(testHeader);
-  SpecialPowers.setIntPref("network.http.speculative-parallel-limit", 1);
+  // test the link rel=preconnect element in the head for both normal
+  // and crossOrigin=anonymous
+  srv1 = new TestServer1(testHeader);
+  SpecialPowers.setIntPref("network.http.speculative-parallel-limit", 2);
   var link = document.createElement("link");
   link.rel = "preconnect";
-  link.href = "//localhost:" +  srv.listener.port;
+  link.href = "//localhost:" +  srv1.listener.port;
+  document.head.appendChild(link);
+  link = document.createElement("link");
+  link.rel = "preconnect";
+  link.href = "//localhost:" +  srv1.listener.port;
+  link.crossOrigin = "anonymous";
   document.head.appendChild(link);
 }
 
 function testHeader()
 {
-  // test the http link response header
-  srv.listener.close();
-  srv = new TestServer(testDone);
+  // test the http link response header - the test contains both a
+  // normal and anonymous preconnect link header
+  srv2 = new TestServer2(testDone);
   var xhr = new XMLHttpRequest();
   xhr.open("GET", 'rel_preconnect.sjs', false);
-  xhr.setRequestHeader("X-Link", "//localhost:" + srv.listener.port);
+  xhr.setRequestHeader("X-Link", "//localhost:" + srv2.listener.port);
   xhr.send();
   is(xhr.status, 200, 'xhr cool');
 }
@@ -67,7 +110,6 @@ function testDone()
 {
   SpecialPowers.setIntPref("network.http.speculative-parallel-limit",
                             originalLimit);
-  srv.listener.close();
   SimpleTest.finish();
 }
 
diff --git a/netwerk/test/unit/test_auth_dialog_permission.js b/netwerk/test/unit/test_auth_dialog_permission.js
new file mode 100644
index 0000000000..5bfe985372
--- /dev/null
+++ b/netwerk/test/unit/test_auth_dialog_permission.js
@@ -0,0 +1,256 @@
+// This file tests authentication prompt depending on pref
+// network.auth.allow-subresource-auth:
+//   0 - don't allow sub-resources to open HTTP authentication credentials
+//       dialogs
+//   1 - allow sub-resources to open HTTP authentication credentials dialogs,
+//       but don't allow it for cross-origin sub-resources
+//   2 - allow the cross-origin authentication as well.
+
+Cu.import("resource://testing-common/httpd.js");
+
+var prefs = Cc["@mozilla.org/preferences-service;1"].
+              getService(Ci.nsIPrefBranch);
+
+function authHandler(metadata, response) {
+  // btoa("guest:guest"), but that function is not available here
+  var expectedHeader = "Basic Z3Vlc3Q6Z3Vlc3Q=";
+
+  var body;
+  if (metadata.hasHeader("Authorization") &&
+      metadata.getHeader("Authorization") == expectedHeader) {
+
+    response.setStatusLine(metadata.httpVersion, 200, "OK, authorized");
+    response.setHeader("WWW-Authenticate", 'Basic realm="secret"', false);
+
+    body = "success";
+  } else {
+    // didn't know guest:guest, failure
+    response.setStatusLine(metadata.httpVersion, 401, "Unauthorized");
+    response.setHeader("WWW-Authenticate", 'Basic realm="secret"', false);
+
+    body = "failed";
+  }
+
+  response.bodyOutputStream.write(body, body.length);
+}
+
+var httpserv = new HttpServer();
+httpserv.registerPathHandler("/auth", authHandler);
+httpserv.start(-1);
+
+XPCOMUtils.defineLazyGetter(this, "URL", function() {
+  return "http://localhost:" + httpserv.identity.primaryPort;
+});
+
+XPCOMUtils.defineLazyGetter(this, "PORT", function() {
+  return httpserv.identity.primaryPort;
+});
+
+function AuthPrompt(promptExpected) {
+  this.promptExpected = promptExpected;
+}
+
+AuthPrompt.prototype = {
+  user: "guest",
+  pass: "guest",
+
+  QueryInterface: function authprompt_qi(iid) {
+    if (iid.equals(Components.interfaces.nsISupports) ||
+        iid.equals(Components.interfaces.nsIAuthPrompt))
+      return this;
+    throw Components.results.NS_ERROR_NO_INTERFACE;
+  },
+
+  prompt: function(title, text, realm, save, defaultText, result) {
+    do_throw("unexpected prompt call");
+  },
+
+  promptUsernameAndPassword: function(title, text, realm, savePW, user, pw) {
+    do_check_true(this.promptExpected,
+                  "Not expected the authentication prompt.");
+
+    user.value = this.user;
+    pw.value = this.pass;
+    return true;
+  },
+
+  promptPassword: function(title, text, realm, save, pwd) {
+    do_throw("unexpected promptPassword call");
+  }
+
+};
+
+function Requestor(promptExpected) {
+  this.promptExpected = promptExpected;
+}
+
+Requestor.prototype = {
+  QueryInterface: function(iid) {
+    if (iid.equals(Components.interfaces.nsISupports) ||
+        iid.equals(Components.interfaces.nsIInterfaceRequestor))
+      return this;
+    throw Components.results.NS_ERROR_NO_INTERFACE;
+  },
+
+  getInterface: function(iid) {
+    if (iid.equals(Components.interfaces.nsIAuthPrompt)) {
+      this.prompter = new AuthPrompt(this.promptExpected);
+      return this.prompter;
+    }
+
+    throw Components.results.NS_ERROR_NO_INTERFACE;
+  },
+
+  prompter: null
+};
+
+function make_uri(url) {
+  var ios = Cc["@mozilla.org/network/io-service;1"].
+              getService(Ci.nsIIOService);
+  return ios.newURI(url, null, null);
+}
+
+function makeChan(loadingUrl, url, contentPolicy) {
+  var loadingUri = make_uri(loadingUrl);
+  var principal = Components.classes["@mozilla.org/scriptsecuritymanager;1"]
+                    .getService(Ci.nsIScriptSecurityManager)
+                    .getNoAppCodebasePrincipal(loadingUri);
+
+  var ios = Components.classes["@mozilla.org/network/io-service;1"]
+                      .getService(Components.interfaces.nsIIOService);
+  var chan = ios.newChannel2(url,
+                             null,
+                             null,
+                             null,
+                             principal,
+                             null,
+                             Ci.nsILoadInfo.SEC_NORMAL,
+                             contentPolicy)
+                .QueryInterface(Components.interfaces.nsIHttpChannel);
+
+  return chan;
+}
+
+function Test(allow_subresource_auth_pref, loadingUri, uri, contentPolicy,
+              expectedCode) {
+  this._allow_subresource_auth_pref = allow_subresource_auth_pref;
+  this._loadingUri = loadingUri;
+  this._uri = uri;
+  this._contentPolicy = contentPolicy;
+  this._expectedCode = expectedCode;
+}
+
+Test.prototype = {
+  _allow_subresource_auth_pref: 1,
+  _loadingUri: null,
+  _uri: null,
+  _contentPolicy: Ci.nsIContentPolicy.TYPE_OTHER,
+  _expectedCode: 200,
+
+  onStartRequest: function(request, ctx) {
+    try {
+      if (!Components.isSuccessCode(request.status)) {
+        do_throw("Channel should have a success code!");
+      }
+
+      if (!(request instanceof Components.interfaces.nsIHttpChannel)) {
+        do_throw("Expecting an HTTP channel");
+      }
+
+      do_check_eq(request.responseStatus, this._expectedCode);
+      // The request should be succeeded iff we expect 200
+      do_check_eq(request.requestSucceeded, this._expectedCode == 200);
+
+    } catch (e) {
+      do_throw("Unexpected exception: " + e);
+    }
+
+    throw Components.results.NS_ERROR_ABORT;
+  },
+
+  onDataAvailable: function(request, context, stream, offset, count) {
+    do_throw("Should not get any data!");
+  },
+
+  onStopRequest: function(request, ctx, status) {
+    do_check_eq(status, Components.results.NS_ERROR_ABORT);
+
+    // Clear the auth cache.
+    Components.classes["@mozilla.org/network/http-auth-manager;1"]
+              .getService(Components.interfaces.nsIHttpAuthManager)
+              .clearAll();
+
+    do_timeout(0, run_next_test);
+  },
+
+  run: function() {
+    dump("Run test: " + this._allow_subresource_auth_pref
+                      + this._loadingUri
+                      + this._uri
+                      + this._contentPolicy
+                      + this._expectedCode + " \n");
+
+    prefs.setIntPref("network.auth.allow-subresource-auth",
+                     this._allow_subresource_auth_pref);
+    let chan = makeChan(this._loadingUri, this._uri, this._contentPolicy);
+    chan.notificationCallbacks = new Requestor(this._expectedCode == 200);
+    chan.asyncOpen(this, null);
+  }
+};
+
+var tests = [
+  // For the next 3 tests the preference is set to 2 - allow the cross-origin
+  // authentication as well.
+
+  // A cross-origin request.
+  new Test(2, "https://example.com", URL + "/auth",
+           Ci.nsIContentPolicy.TYPE_OTHER, 200),
+  // A non cross-origin sub-resource request.
+  new Test(2, URL + "/", URL + "/auth",
+           Ci.nsIContentPolicy.TYPE_OTHER, 200),
+  // A top level document.
+  new Test(2, URL + "/auth", URL + "/auth",
+           Ci.nsIContentPolicy.TYPE_DOCUMENT, 200),
+
+  // For the next 3 tests the preference is set to 1 - allow sub-resources to
+  // open HTTP authentication credentials dialogs, but don't allow it for
+  // cross-origin sub-resources
+
+  // A cross-origin request.
+  new Test(1, "https://example.com", URL + "/auth",
+           Ci.nsIContentPolicy.TYPE_OTHER, 401),
+  // A non cross-origin sub-resource request.
+  new Test(1, URL + "/", URL + "/auth",
+           Ci.nsIContentPolicy.TYPE_OTHER, 200),
+  // A top level document.
+  new Test(1, URL + "/auth", URL + "/auth",
+           Ci.nsIContentPolicy.TYPE_DOCUMENT, 200),
+
+  // For the next 3 tests the preference is set to 0 - don't allow sub-resources
+  // to open HTTP authentication credentials dialogs.
+
+  // A cross-origin request.
+  new Test(0, "https://example.com", URL + "/auth",
+           Ci.nsIContentPolicy.TYPE_OTHER, 401),
+  // A sub-resource request.
+  new Test(0, URL + "/", URL + "/auth",
+           Ci.nsIContentPolicy.TYPE_OTHER, 401),
+  // A top level request.
+  new Test(0, URL + "/auth", URL + "/auth",
+           Ci.nsIContentPolicy.TYPE_DOCUMENT, 200),
+];
+
+function run_next_test() {
+  var nextTest = tests.shift();
+  if (!nextTest) {
+    httpserv.stop(do_test_finished);
+    return;
+  }
+
+  nextTest.run();
+}
+
+function run_test() {
+  do_test_pending();
+  run_next_test();
+}
diff --git a/netwerk/test/unit/test_auth_proxy.js b/netwerk/test/unit/test_auth_proxy.js
index bdaa0566f7..4b252dcf50 100644
--- a/netwerk/test/unit/test_auth_proxy.js
+++ b/netwerk/test/unit/test_auth_proxy.js
@@ -244,6 +244,9 @@ function run_test() {
   prefs.setCharPref("network.proxy.no_proxies_on", "");
   prefs.setIntPref("network.proxy.type", 1);
 
+  // Turn off the authentication dialog blocking for this test.
+  prefs.setIntPref("network.auth.allow-subresource-auth", 2);
+
   tests[current_test]();
 }
 
diff --git a/netwerk/test/unit/test_authentication.js b/netwerk/test/unit/test_authentication.js
index ea29430070..8fbbf31ebb 100644
--- a/netwerk/test/unit/test_authentication.js
+++ b/netwerk/test/unit/test_authentication.js
@@ -4,6 +4,11 @@
 Cu.import("resource://testing-common/httpd.js");
 Cu.import("resource://gre/modules/Services.jsm");
 
+// Turn off the authentication dialog blocking for this test.
+var prefs = Cc["@mozilla.org/preferences-service;1"].
+              getService(Ci.nsIPrefBranch);
+prefs.setIntPref("network.auth.allow-subresource-auth", 2);
+
 XPCOMUtils.defineLazyGetter(this, "URL", function() {
   return "http://localhost:" + httpserv.identity.primaryPort;
 });
diff --git a/netwerk/test/unit/xpcshell.ini b/netwerk/test/unit/xpcshell.ini
index 3c53f58164..c516d0dabf 100644
--- a/netwerk/test/unit/xpcshell.ini
+++ b/netwerk/test/unit/xpcshell.ini
@@ -81,6 +81,7 @@ skip-if = true
 [test_auth_proxy.js]
 [test_authentication.js]
 [test_authpromptwrapper.js]
+[test_auth_dialog_permission.js]
 [test_backgroundfilesaver.js]
 [test_bug203271.js]
 [test_bug248970_cache.js]
diff --git a/parser/html/nsHtml5SpeculativeLoad.cpp b/parser/html/nsHtml5SpeculativeLoad.cpp
index ee15804a95..137ca45b13 100644
--- a/parser/html/nsHtml5SpeculativeLoad.cpp
+++ b/parser/html/nsHtml5SpeculativeLoad.cpp
@@ -68,7 +68,7 @@ nsHtml5SpeculativeLoad::Perform(nsHtml5TreeOpExecutor* aExecutor)
       }
       break;
     case eSpeculativeLoadPreconnect:
-      aExecutor->Preconnect(mUrl);
+      aExecutor->Preconnect(mUrl, mCrossOrigin);
       break;
     default:
       NS_NOTREACHED("Bogus speculative load.");
diff --git a/parser/html/nsHtml5SpeculativeLoad.h b/parser/html/nsHtml5SpeculativeLoad.h
index 70ac54ebc5..db42719901 100644
--- a/parser/html/nsHtml5SpeculativeLoad.h
+++ b/parser/html/nsHtml5SpeculativeLoad.h
@@ -164,12 +164,14 @@ class nsHtml5SpeculativeLoad {
       mTypeOrCharsetSource.Assign((char16_t)aCharsetSource);
     }
 
-    inline void InitPreconnect(const nsAString& aUrl)
+    inline void InitPreconnect(const nsAString& aUrl,
+                               const nsAString& aCrossOrigin)
     {
       NS_PRECONDITION(mOpCode == eSpeculativeLoadUninitialized,
                       "Trying to reinitialize a speculative load!");
       mOpCode = eSpeculativeLoadPreconnect;
       mUrl.Assign(aUrl);
+      mCrossOrigin.Assign(aCrossOrigin);
     }
 
     void Perform(nsHtml5TreeOpExecutor* aExecutor);
@@ -193,9 +195,9 @@ class nsHtml5SpeculativeLoad {
      */
     nsString mTypeOrCharsetSource;
     /**
-     * If mOpCode is eSpeculativeLoadImage or eSpeculativeLoadScript[FromHead],
-     * this is the value of the "crossorigin" attribute.  If the
-     * attribute is not set, this will be a void string.
+     * If mOpCode is eSpeculativeLoadImage or eSpeculativeLoadScript[FromHead]
+     * or eSpeculativeLoadPreconnect this is the value of the "crossorigin"
+     * attribute.  If the attribute is not set, this will be a void string.
      */
     nsString mCrossOrigin;
     /**
diff --git a/parser/html/nsHtml5TreeBuilderCppSupplement.h b/parser/html/nsHtml5TreeBuilderCppSupplement.h
index c044b16483..b9462886e4 100644
--- a/parser/html/nsHtml5TreeBuilderCppSupplement.h
+++ b/parser/html/nsHtml5TreeBuilderCppSupplement.h
@@ -191,8 +191,10 @@ nsHtml5TreeBuilder::createElement(int32_t aNamespace, nsIAtom* aName,
             } else if (rel->LowerCaseEqualsASCII("preconnect")) {
               nsString* url = aAttributes->getValue(nsHtml5AttributeName::ATTR_HREF);
               if (url) {
+                nsString* crossOrigin =
+                  aAttributes->getValue(nsHtml5AttributeName::ATTR_CROSSORIGIN);
                 mSpeculativeLoadQueue.AppendElement()->
-                  InitPreconnect(*url);
+                  InitPreconnect(*url, (crossOrigin) ? *crossOrigin : NullString());
               }
             }
           }
diff --git a/toolkit/components/passwordmgr/test/test_prompt_async.html b/toolkit/components/passwordmgr/test/test_prompt_async.html
index 4afe7de579..a202861889 100644
--- a/toolkit/components/passwordmgr/test/test_prompt_async.html
+++ b/toolkit/components/passwordmgr/test/test_prompt_async.html
@@ -11,6 +11,9 @@
         SimpleTest.waitForExplicitFinish();
         SimpleTest.requestFlakyTimeout("untriaged");
 
+        var prefs = Cc["@mozilla.org/preferences-service;1"].
+                        getService(Ci.nsIPrefBranch);
+        prefs.setIntPref("network.auth.allow-subresource-auth", 2);
         // Class monitoring number of open dialog windows
         // It checks there is always open just a single dialog per application
         function dialogMonitor() {
diff --git a/toolkit/mozapps/extensions/test/xpinstall/browser_auth.js b/toolkit/mozapps/extensions/test/xpinstall/browser_auth.js
index ee29138271..c41cb995fd 100644
--- a/toolkit/mozapps/extensions/test/xpinstall/browser_auth.js
+++ b/toolkit/mozapps/extensions/test/xpinstall/browser_auth.js
@@ -8,6 +8,10 @@ function test() {
   Harness.installsCompletedCallback = finish_test;
   Harness.setup();
 
+  var prefs = Cc["@mozilla.org/preferences-service;1"].
+                        getService(Ci.nsIPrefBranch);
+  prefs.setIntPref("network.auth.allow-subresource-auth", 2);
+
   var pm = Services.perms;
   pm.add(makeURI("http://example.com/"), "install", pm.ALLOW_ACTION);