import changes from `dev' branch of rmottola/Arctic-Fox:

- Bug 1267186 - Split lookup of WebIDL DOM class names from lookup of DOMCI DOM class names. r=bz. (1cb4c3698e) - Bug 1206637: P1. Add MediaPrefs convenience class. r=cpearce (d352b9ca0b) - Bug 1254378 - Make new 'speech-synth-started' component service category. r=smaug (ece851540b) - Bug 1206637: P2. Replace all cached preferences with MediaPrefs ones. r=cpearce (1492083f62) - Bug 1216407 - Use mozilla/Endian.h for NfcService. r=yoshi (b2a508186d) - Bug 1237493 - [NFC] Separate Gecko and Gonk layers for accessing Androids properties. r=yoshi (062e468bed) - Bug 1272135, part 1 - Fix leading tab usage in ipc/chromium. r=billm (cf29df6977) - Bug 1272135, part 2 - Delete two weird modelines in ipc/chromium. r=billm (da4cdafc7c) - Bug 1272135, part 3 - Fix mode lines in ipc/chromium/. r=billm (040b11738e) - Bug 1273307 - Remove copy constructor/assignment operator for Message/Pickle (r=froydnj) (b53e6d3470) - Bug 1262671 - Remove unused TrimWriteData (r=froydnj) (8fbcefde63) - Bug 1267438 - Group ScrollMetadata's optional clip rect and mask layer index into a LayerClip structure. r=mstange (dcd01e3bce) - Bug 1267438 - Use IntersectMaybeRects() in Layer::GetCombinedClipRect(). r=mstange (5ec2d68aac) - Bug 1262937 - part 1 - don't include the protocol name in Clone error messages; r=jld (3e23610fb1) - Bug 1191452 - Limit IPDL-generated Move()s to Recv methods. r=billm (991cc733b6) - Bug 1262937 - part 2 - don't include the message name when complaining about handler failure; r=jld (b8abbc5c8b) - Bug 1262937 - part 3 - move quoting out of checkedRead; r=jld (16d36ae02a) - Bug 1262937 - part 4 - publically inherit from MessageListener in IProtocol; r=jld (b89aaa7347) - Bug 1262937 - part 5 - factor out actor reading code to a common base class; r=jld (702388bce7) - Bug 1262937 - part 7 - factor out union type deserialization errors; r=jld (dcdf428efc) - Bug 1262937 - part 6 - enable custom error message for ipdl.py's checkedRead; r=jld (5cf11d5d24) - Bug 1262937 - part 8 - factor out array length deserialization errors; r=jld (d1149cc120) - Bug 1271601: If a child process fails to duplicate a TransportDescriptor pipe handle then send it anyway and get the target to duplicate. r=gabor (d578cd0c85) - Bug 1270247 - Crash in ParamTraits<mozilla::net::NetAddr>::Write if the family is unknown. r=hurley (3ed49495c0) - Bug 1267474 - cache-control: immutable tests 3/3 r=mayhemer (ba0bc6e71a) - bug 1188100 - fold PSM's test_client_cert.js into necko's test_tls_server.js r=mcmanus (a2b93abbbb) - Bug 669259 - Expose original header received from a peer. r=mcmanus (cf53cad7ac) - Bug 386743 - Set default event bubbling/cancelable flags in the WidgetEvent constructor. r=smaug (1c68cfffd2) - Bug 1259661 part.1 Rename WidgetMouseEvent::reasonType to WidgetMouseEvent::Reason r=smaug (0edd107b56) - Bug 1259661 part.2 Rename WidgetMouseEvent::context to WidgetMouseEvent::ContextMenuTrigger r=smaug (0049757099) - Bug 1259661 part.3 Rename WidgetMouseEvent::exitType to WidgetMouseEvent::ExitFrom r=smaug (5ffd3f41b1) - Bug 1259661 part.4 Rename WidgetMouseEvent::reason to WidgetMouseEvent::mReason r=smaug (5605ce8fd0) - Bug 1259661 part.5 Rename WidgetMouseEvent::context to WidgetMouseEvent::mContextMenuTrigger r=smaug (4dd92f0066) - Bug 1259661 part.6 Rename WidgetMouseEvent::exit to WidgetMouseEvent::mExitFrom r=smaug (c46f5fe1bc) - Bug 1259661 part.7 Get rid of WidgetMouseEvent::acceptActivation because of unused r=smaug (4867aaf1a7) - Bug 1259661 part.8 Rename WidgetMouseEvent::ignoreRootScrollFrame to WidgetMouseEvent::mIgnoreRootScrollFrame r=smaug (c829c446fd) - Bug 1259661 part.9 Rename WidgetMouseEvent::clickCount to WidgetMouseEvent::mClickCount r=smaug (2fa015c006) - Bug 1259661 part.10 Clean up some nits of WidgetMouseEvent definition r=smaug (58d3a0cb2c) - Bug 1179346 - Add strings and accesskeys for Microsoft Edge. r=mak (b97f5e7ab4) - Bug 931445 part 1 - Remove unused code from pointerlock_utils.js. r=smaug (e1b9c15569) - Bug 931445 part 2 - Use util code from fullscreen tests to improve robustness of pointerlock tests. r=smaug (3c7b47751e) - Bug 931445 part 3 - Reset synth centering pointer when unlocking pointer. r=smaug (e272fec9c7) - Bug 1263389 NativeKey should initialize WidgetKeyboardEvent::mKeyValue of WM_KEYDOWN of VK_PACKET with following char message r=m_kato (e56a31bd4b) - Bug 1261880 NativeKey should decide printable KeyboardEvent.key value of keydown and keypress events with following WM_CHAR message of WM_KEYDOWN r=m_kato (7208001852) - Bug 1254755 part.1 Rename WidgetKeyboardEvent::keyCode to WidgetKeyboardEvent::mKeyCode r=smaug (97ebefa314) - put back some XP/2003 code, as well as crash/debug (73b3147e58) - Bug 1259679 - Space key shouldn't work as a space key if it's assigned to a function key. r=masayuki (db422c248b) - Bug 1101975, handle access keys in content process before menus, r=masayuki (760213b62e) - Bug 1254755 part.2 Rename WidgetKeyboardEvent::charCode to WidgetKeyboardEvent::mCharCode r=smaug (6cef6114a5) - Bug 1254755 part.3 Rename WidgetKeyboardEvent::alternativeCharCodes to WidgetKeyboardEvent::mAlternativeCharCodes r=smaug (9d23a113fd) - Bug 1254755 part.4 Rename WidgetKeyboardEvent::location to WidgetKeyboardEvent::mLocation r=smaug (f44e0212a6) - Bug 1254755 part.5 Rename WidgetKeyboardEvent::isChar to WidgetKeyboardEvent::mIsChar r=smaug (a713d9903c) - Bug 1254755 part.6 Reorder the members of WidgetKeyboardEvent for reducing its instance size r=smaug (39a14a7d4f) - Bug 1262671 - void** -> PickleIterator (r=froydnj) (716a88b499)
2026-05-26 05:11:03 +00:00 · 2024-10-08 21:42:19 +08:00
parent b564bd67d3
commit f632bc6ab3
416 changed files with 4071 additions and 2264 deletions
@@ -140,7 +140,7 @@ nsCoreUtils::DispatchMouseEvent(EventMessage aMessage, int32_t aX, int32_t aY,

  event.mRefPoint = LayoutDeviceIntPoint(aX, aY);

-  event.clickCount = 1;
+  event.mClickCount = 1;
  event.button = WidgetMouseEvent::eLeftButton;
  event.mTime = PR_IntervalNow();
  event.inputSource = nsIDOMMouseEvent::MOZ_SOURCE_UNKNOWN;
@@ -10,6 +10,8 @@

 <!ENTITY importFromIE.label             "Microsoft Internet Explorer">
 <!ENTITY importFromIE.accesskey         "M">
+<!ENTITY importFromEdge.label           "Microsoft Edge">
+<!ENTITY importFromEdge.accesskey       "E">
 <!ENTITY importFromNothing.label        "Don't import anything">
 <!ENTITY importFromNothing.accesskey    "D">
 <!ENTITY importFromSafari.label         "Safari">
@@ -78,7 +78,7 @@ struct ParamTraits<SerializedURI>
    WriteParam(aMsg, aParam.charset);
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    nsCString spec, charset;
    if (ReadParam(aMsg, aIter, &spec) &&
@@ -105,7 +105,7 @@ struct ParamTraits<ChromePackage>
    WriteParam(aMsg, aParam.flags);
  }
  
-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    nsCString package;
    SerializedURI contentBaseURI, localeBaseURI, skinBaseURI;
@@ -147,7 +147,7 @@ struct ParamTraits<SubstitutionMapping>
    WriteParam(aMsg, aParam.resolvedURI);
  }
  
-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    nsCString scheme, path;
    SerializedURI resolvedURI;
@@ -183,7 +183,7 @@ struct ParamTraits<OverrideMapping>
    WriteParam(aMsg, aParam.overrideURI);
  }
  
-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    SerializedURI originalURI;
    SerializedURI overrideURI;
@@ -76,7 +76,7 @@ struct ParamTraits<SerializedLoadContext>
    WriteParam(aMsg, suffix);
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    nsAutoCString suffix;
    if (!ReadParam(aMsg, aIter, &aResult->mIsNotNull) ||
@@ -1842,7 +1842,7 @@ ParamTraits<Metadata>::Write(Message* aMsg, const paramType& aParam)
 }

 bool
-ParamTraits<Metadata>::Read(const Message* aMsg, void** aIter,
+ParamTraits<Metadata>::Read(const Message* aMsg, PickleIterator* aIter,
                            paramType* aResult)
 {
  for (unsigned i = 0; i < Metadata::kNumEntries; i++) {
@@ -1881,7 +1881,7 @@ ParamTraits<WriteParams>::Write(Message* aMsg, const paramType& aParam)
 }

 bool
-ParamTraits<WriteParams>::Read(const Message* aMsg, void** aIter,
+ParamTraits<WriteParams>::Read(const Message* aMsg, PickleIterator* aIter,
                               paramType* aResult)
 {
  return ReadParam(aMsg, aIter, &aResult->mSize) &&
@@ -169,7 +169,7 @@ struct ParamTraits<mozilla::dom::asmjscache::Metadata>
 {
  typedef mozilla::dom::asmjscache::Metadata paramType;
  static void Write(Message* aMsg, const paramType& aParam);
-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult);
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult);
  static void Log(const paramType& aParam, std::wstring* aLog);
 };

@@ -178,7 +178,7 @@ struct ParamTraits<mozilla::dom::asmjscache::WriteParams>
 {
  typedef mozilla::dom::asmjscache::WriteParams paramType;
  static void Write(Message* aMsg, const paramType& aParam);
-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult);
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult);
  static void Log(const paramType& aParam, std::wstring* aLog);
 };

@@ -2125,14 +2125,14 @@ Element::DispatchClickEvent(nsPresContext* aPresContext,
  uint16_t inputSource = 0;
  WidgetMouseEvent* sourceMouseEvent = aSourceEvent->AsMouseEvent();
  if (sourceMouseEvent) {
-    clickCount = sourceMouseEvent->clickCount;
+    clickCount = sourceMouseEvent->mClickCount;
    pressure = sourceMouseEvent->pressure;
    inputSource = sourceMouseEvent->inputSource;
  } else if (aSourceEvent->mClass == eKeyboardEventClass) {
    inputSource = nsIDOMMouseEvent::MOZ_SOURCE_KEYBOARD;
  }
  event.pressure = pressure;
-  event.clickCount = clickCount;
+  event.mClickCount = clickCount;
  event.inputSource = inputSource;
  event.mModifiers = aSourceEvent->mModifiers;
  if (aExtraEventFlags) {
@@ -3094,7 +3094,7 @@ Element::PostHandleEventForLinks(EventChainPostVisitor& aVisitor)
  case eKeyPress:
    {
      WidgetKeyboardEvent* keyEvent = aVisitor.mEvent->AsKeyboardEvent();
-      if (keyEvent && keyEvent->keyCode == NS_VK_RETURN) {
+      if (keyEvent && keyEvent->mKeyCode == NS_VK_RETURN) {
        nsEventStatus status = nsEventStatus_eIgnore;
        rv = DispatchClickEvent(aVisitor.mPresContext, keyEvent, this,
                                false, nullptr, &status);
@@ -738,13 +738,13 @@ TextInputProcessor::PrepareKeyboardEventToDispatch(
    // If .location is initialized with specific value, using
    // KEY_KEEP_KEY_LOCATION_STANDARD must be a bug of the caller.
    // Let's throw an exception for notifying the developer of this bug.
-    if (NS_WARN_IF(aKeyboardEvent.location)) {
+    if (NS_WARN_IF(aKeyboardEvent.mLocation)) {
      return NS_ERROR_INVALID_ARG;
    }
-  } else if (!aKeyboardEvent.location) {
-    // If KeyboardEvent.location is 0, it may be uninitialized.  If so, we
-    // should compute proper location value from its .code value.
-    aKeyboardEvent.location =
+  } else if (!aKeyboardEvent.mLocation) {
+    // If KeyboardEvent.mLocation is 0, it may be uninitialized.  If so, we
+    // should compute proper mLocation value from its .code value.
+    aKeyboardEvent.mLocation =
      WidgetKeyboardEvent::ComputeLocationFromCodeValue(
        aKeyboardEvent.mCodeNameIndex);
  }
@@ -753,16 +753,16 @@ TextInputProcessor::PrepareKeyboardEventToDispatch(
    // If .keyCode is initialized with specific value, using
    // KEY_KEEP_KEYCODE_ZERO must be a bug of the caller.  Let's throw an
    // exception for notifying the developer of such bug.
-    if (NS_WARN_IF(aKeyboardEvent.keyCode)) {
+    if (NS_WARN_IF(aKeyboardEvent.mKeyCode)) {
      return NS_ERROR_INVALID_ARG;
    }
-  } else if (!aKeyboardEvent.keyCode &&
+  } else if (!aKeyboardEvent.mKeyCode &&
             aKeyboardEvent.mKeyNameIndex > KEY_NAME_INDEX_Unidentified &&
             aKeyboardEvent.mKeyNameIndex < KEY_NAME_INDEX_USE_STRING) {
    // If KeyboardEvent.keyCode is 0, it may be uninitialized.  If so, we may
    // be able to decide a good .keyCode value if the .key value is a
    // non-printable key.
-    aKeyboardEvent.keyCode =
+    aKeyboardEvent.mKeyCode =
      WidgetKeyboardEvent::ComputeKeyCodeFromKeyNameIndex(
        aKeyboardEvent.mKeyNameIndex);
  }
@@ -7168,7 +7168,7 @@ nsContentUtils::GetHostOrIPv6WithBrackets(nsIURI* aURI, nsAString& aHost)
  return NS_OK;
 }

-void
+bool
 nsContentUtils::CallOnAllRemoteChildren(nsIMessageBroadcaster* aManager,
                                        CallOnRemoteChildFunction aCallback,
                                        void* aArg)
@@ -7184,7 +7184,9 @@ nsContentUtils::CallOnAllRemoteChildren(nsIMessageBroadcaster* aManager,

    nsCOMPtr<nsIMessageBroadcaster> nonLeafMM = do_QueryInterface(childMM);
    if (nonLeafMM) {
-      CallOnAllRemoteChildren(nonLeafMM, aCallback, aArg);
+      if (CallOnAllRemoteChildren(nonLeafMM, aCallback, aArg)) {
+        return true;
+      }
      continue;
    }

@@ -7196,10 +7198,14 @@ nsContentUtils::CallOnAllRemoteChildren(nsIMessageBroadcaster* aManager,
      nsFrameLoader* fl = static_cast<nsFrameLoader*>(cb);
      TabParent* remote = TabParent::GetFrom(fl);
      if (remote && aCallback) {
-        aCallback(remote, aArg);
+        if (aCallback(remote, aArg)) {
+          return true;
+        }
      }
    }
  }
+
+  return false;
 }

 void
@@ -7686,11 +7692,11 @@ nsContentUtils::SendKeyEvent(nsIWidget* aWidget,
  event.mModifiers = GetWidgetModifiers(aModifiers);

  if (msg == eKeyPress) {
-    event.keyCode = aCharCode ? 0 : aKeyCode;
-    event.charCode = aCharCode;
+    event.mKeyCode = aCharCode ? 0 : aKeyCode;
+    event.mCharCode = aCharCode;
  } else {
-    event.keyCode = aKeyCode;
-    event.charCode = 0;
+    event.mKeyCode = aKeyCode;
+    event.mCharCode = 0;
  }

  uint32_t locationFlag = (aAdditionalFlags &
@@ -7698,16 +7704,16 @@ nsContentUtils::SendKeyEvent(nsIWidget* aWidget,
     nsIDOMWindowUtils::KEY_FLAG_LOCATION_RIGHT | nsIDOMWindowUtils::KEY_FLAG_LOCATION_NUMPAD));
  switch (locationFlag) {
    case nsIDOMWindowUtils::KEY_FLAG_LOCATION_STANDARD:
-      event.location = nsIDOMKeyEvent::DOM_KEY_LOCATION_STANDARD;
+      event.mLocation = nsIDOMKeyEvent::DOM_KEY_LOCATION_STANDARD;
      break;
    case nsIDOMWindowUtils::KEY_FLAG_LOCATION_LEFT:
-      event.location = nsIDOMKeyEvent::DOM_KEY_LOCATION_LEFT;
+      event.mLocation = nsIDOMKeyEvent::DOM_KEY_LOCATION_LEFT;
      break;
    case nsIDOMWindowUtils::KEY_FLAG_LOCATION_RIGHT:
-      event.location = nsIDOMKeyEvent::DOM_KEY_LOCATION_RIGHT;
+      event.mLocation = nsIDOMKeyEvent::DOM_KEY_LOCATION_RIGHT;
      break;
    case nsIDOMWindowUtils::KEY_FLAG_LOCATION_NUMPAD:
-      event.location = nsIDOMKeyEvent::DOM_KEY_LOCATION_NUMPAD;
+      event.mLocation = nsIDOMKeyEvent::DOM_KEY_LOCATION_NUMPAD;
      break;
    default:
      if (locationFlag != 0) {
@@ -7731,16 +7737,16 @@ nsContentUtils::SendKeyEvent(nsIWidget* aWidget,
        case nsIDOMKeyEvent::DOM_VK_SUBTRACT:
        case nsIDOMKeyEvent::DOM_VK_DECIMAL:
        case nsIDOMKeyEvent::DOM_VK_DIVIDE:
-          event.location = nsIDOMKeyEvent::DOM_KEY_LOCATION_NUMPAD;
+          event.mLocation = nsIDOMKeyEvent::DOM_KEY_LOCATION_NUMPAD;
          break;
        case nsIDOMKeyEvent::DOM_VK_SHIFT:
        case nsIDOMKeyEvent::DOM_VK_CONTROL:
        case nsIDOMKeyEvent::DOM_VK_ALT:
        case nsIDOMKeyEvent::DOM_VK_META:
-          event.location = nsIDOMKeyEvent::DOM_KEY_LOCATION_LEFT;
+          event.mLocation = nsIDOMKeyEvent::DOM_KEY_LOCATION_LEFT;
          break;
        default:
-          event.location = nsIDOMKeyEvent::DOM_KEY_LOCATION_STANDARD;
+          event.mLocation = nsIDOMKeyEvent::DOM_KEY_LOCATION_STANDARD;
          break;
      }
      break;
@@ -7820,7 +7826,7 @@ nsContentUtils::SendMouseEvent(nsCOMPtr<nsIPresShell> aPresShell,
  event.buttons = GetButtonsFlagForButton(aButton);
  event.pressure = aPressure;
  event.inputSource = aInputSourceArg;
-  event.clickCount = aClickCount;
+  event.mClickCount = aClickCount;
  event.mTime = PR_IntervalNow();
  event.mFlags.mIsSynthesizedForTests = aIsSynthesized;

@@ -7829,7 +7835,7 @@ nsContentUtils::SendMouseEvent(nsCOMPtr<nsIPresShell> aPresShell,
    return NS_ERROR_FAILURE;

  event.mRefPoint = ToWidgetPoint(CSSPoint(aX, aY), offset, presContext);
-  event.ignoreRootScrollFrame = aIgnoreRootScrollFrame;
+  event.mIgnoreRootScrollFrame = aIgnoreRootScrollFrame;

  nsEventStatus status = nsEventStatus_eIgnore;
  if (aToWindow) {
@@ -172,7 +172,7 @@ struct EventNameMapping
  mozilla::EventClassID mEventClassID;
 };

-typedef void (*CallOnRemoteChildFunction) (mozilla::dom::TabParent* aTabParent,
+typedef bool (*CallOnRemoteChildFunction) (mozilla::dom::TabParent* aTabParent,
                                           void* aArg);

 class nsContentUtils
@@ -2386,7 +2386,7 @@ public:

  /*
   * Call the given callback on all remote children of the given top-level
-   * window.
+   * window. Return true from the callback to stop calling further children.
   */
  static void CallOnAllRemoteChildren(nsIDOMWindow* aWindow,
                                      CallOnRemoteChildFunction aCallback,
@@ -2606,7 +2606,7 @@ private:
  static AutocompleteAttrState InternalSerializeAutocompleteAttribute(const nsAttrValue* aAttrVal,
                                                                      mozilla::dom::AutocompleteInfo& aInfo);

-  static void CallOnAllRemoteChildren(nsIMessageBroadcaster* aManager,
+  static bool CallOnAllRemoteChildren(nsIMessageBroadcaster* aManager,
                                      CallOnRemoteChildFunction aCallback,
                                      void* aArg);

@@ -1784,98 +1784,6 @@ nsWindowSH::GlobalResolve(nsGlobalWindow *aWin, JSContext *cx,

  nsresult rv = NS_OK;

-  if (name_struct->mType == nsGlobalNameStruct::eTypeNewDOMBinding ||
-      name_struct->mType == nsGlobalNameStruct::eTypeClassProto ||
-      name_struct->mType == nsGlobalNameStruct::eTypeClassConstructor) {
-    // Lookup new DOM bindings.
-    DefineInterface getOrCreateInterfaceObject =
-      name_struct->mDefineDOMInterface;
-    if (getOrCreateInterfaceObject) {
-      if (name_struct->mType == nsGlobalNameStruct::eTypeClassConstructor &&
-          !OldBindingConstructorEnabled(name_struct, aWin, cx)) {
-        return NS_OK;
-      }
-
-      ConstructorEnabled* checkEnabledForScope = name_struct->mConstructorEnabled;
-      // We do the enabled check on the current compartment of cx, but for the
-      // actual object we pass in the underlying object in the Xray case.  That
-      // way the callee can decide whether to allow access based on the caller
-      // or the window being touched.
-      JS::Rooted<JSObject*> global(cx,
-        js::CheckedUnwrap(obj, /* stopAtWindowProxy = */ false));
-      if (!global) {
-        return NS_ERROR_DOM_SECURITY_ERR;
-      }
-      if (checkEnabledForScope && !checkEnabledForScope(cx, global)) {
-        return NS_OK;
-      }
-
-      // The DOM constructor resolve machinery interacts with Xrays in tricky
-      // ways, and there are some asymmetries that are important to understand.
-      //
-      // In the regular (non-Xray) case, we only want to resolve constructors
-      // once (so that if they're deleted, they don't reappear). We do this by
-      // stashing the constructor in a slot on the global, such that we can see
-      // during resolve whether we've created it already. This is rather
-      // memory-intensive, so we don't try to maintain these semantics when
-      // manipulating a global over Xray (so the properties just re-resolve if
-      // they've been deleted).
-      //
-      // Unfortunately, there's a bit of an impedance-mismatch between the Xray
-      // and non-Xray machinery. The Xray machinery wants an API that returns a
-      // JS::PropertyDescriptor, so that the resolve hook doesn't have to get
-      // snared up with trying to define a property on the Xray holder. At the
-      // same time, the DefineInterface callbacks are set up to define things
-      // directly on the global.  And re-jiggering them to return property
-      // descriptors is tricky, because some DefineInterface callbacks define
-      // multiple things (like the Image() alias for HTMLImageElement).
-      //
-      // So the setup is as-follows:
-      //
-      // * The resolve function takes a JS::PropertyDescriptor, but in the
-      //   non-Xray case, callees may define things directly on the global, and
-      //   set the value on the property descriptor to |undefined| to indicate
-      //   that there's nothing more for the caller to do. We assert against
-      //   this behavior in the Xray case.
-      //
-      // * We make sure that we do a non-Xray resolve first, so that all the
-      //   slots are set up. In the Xray case, this means unwrapping and doing
-      //   a non-Xray resolve before doing the Xray resolve.
-      //
-      // This all could use some grand refactoring, but for now we just limp
-      // along.
-      if (xpc::WrapperFactory::IsXrayWrapper(obj)) {
-        JS::Rooted<JSObject*> interfaceObject(cx);
-        {
-          JSAutoCompartment ac(cx, global);
-          interfaceObject = getOrCreateInterfaceObject(cx, global, id, false);
-        }
-        if (NS_WARN_IF(!interfaceObject)) {
-          return NS_ERROR_FAILURE;
-        }
-        if (!JS_WrapObject(cx, &interfaceObject)) {
-          return NS_ERROR_FAILURE;
-        }
-
-        FillPropertyDescriptor(desc, obj, 0, JS::ObjectValue(*interfaceObject));
-      } else {
-        JS::Rooted<JSObject*> interfaceObject(cx,
-          getOrCreateInterfaceObject(cx, obj, id, true));
-        if (NS_WARN_IF(!interfaceObject)) {
-          return NS_ERROR_FAILURE;
-        }
-        // We've already defined the property.  We indicate this to the caller
-        // by filling a property descriptor with JS::UndefinedValue() as the
-        // value.  We still have to fill in a property descriptor, though, so
-        // that the caller knows the property is in fact on this object.  It
-        // doesn't matter what we pass for the "readonly" argument here.
-        FillPropertyDescriptor(desc, obj, JS::UndefinedValue(), false);
-      }
-
-      return NS_OK;
-    }
-  }
-
  if (name_struct->mType == nsGlobalNameStruct::eTypeClassConstructor) {
    if (!OldBindingConstructorEnabled(name_struct, aWin, cx)) {
      return NS_OK;
@@ -711,7 +711,7 @@ nsDOMWindowUtils::SendPointerEventCommon(const nsAString& aType,
  event.tiltX = aTiltX;
  event.tiltY = aTiltY;
  event.isPrimary = (nsIDOMMouseEvent::MOZ_SOURCE_MOUSE == aInputSourceArg) ? true : aIsPrimary;
-  event.clickCount = aClickCount;
+  event.mClickCount = aClickCount;
  event.mTime = PR_IntervalNow();
  event.mFlags.mIsSynthesizedForTests = aOptionalArgCount >= 10 ? aIsSynthesized : true;

@@ -722,7 +722,7 @@ nsDOMWindowUtils::SendPointerEventCommon(const nsAString& aType,

  event.mRefPoint =
    nsContentUtils::ToWidgetPoint(CSSPoint(aX, aY), offset, presContext);
-  event.ignoreRootScrollFrame = aIgnoreRootScrollFrame;
+  event.mIgnoreRootScrollFrame = aIgnoreRootScrollFrame;

  nsEventStatus status;
  if (aToWindow) {
@@ -1125,11 +1125,12 @@ nsFocusManager::EnsureCurrentWidgetFocused()
  }
 }

-void
+bool
 ActivateOrDeactivateChild(TabParent* aParent, void* aArg)
 {
  bool active = static_cast<bool>(aArg);
  Unused << aParent->SendParentActivated(active);
+  return false;
 }

 void
@@ -677,6 +677,7 @@ GK_ATOM(ol, "ol")
 GK_ATOM(omitXmlDeclaration, "omit-xml-declaration")
 GK_ATOM(ona2dpstatuschanged, "ona2dpstatuschanged")
 GK_ATOM(onabort, "onabort")
+GK_ATOM(onmozaccesskeynotfound, "onmozaccesskeynotfound")
 GK_ATOM(onactivate, "onactivate")
 GK_ATOM(onadapteradded, "onadapteradded")
 GK_ATOM(onadapterremoved, "onadapterremoved")
@@ -230,6 +230,7 @@
 #include "mozilla/dom/ImageBitmap.h"
 #include "mozilla/dom/ServiceWorkerRegistration.h"
 #include "mozilla/dom/U2F.h"
+#include "mozilla/dom/WebIDLGlobalNameHash.h"
 #ifdef HAVE_SIDEBAR
 #include "mozilla/dom/ExternalBinding.h"
 #endif
@@ -4602,6 +4603,15 @@ nsGlobalWindow::DoResolve(JSContext* aCx, JS::Handle<JSObject*> aObj,
    return true;
  }

+  bool found;
+  if (!WebIDLGlobalNameHash::DefineIfEnabled(aCx, aObj, aId, aDesc, &found)) {
+    return false;
+  }
+
+  if (found) {
+    return true;
+  }
+
  nsresult rv = nsWindowSH::GlobalResolve(this, aCx, aObj, aId, aDesc);
  if (NS_FAILED(rv)) {
    return Throw(aCx, rv);
@@ -4630,6 +4640,10 @@ nsGlobalWindow::MayResolve(jsid aId)
    return true;
  }

+  if (WebIDLGlobalNameHash::MayResolve(aId)) {
+    return true;
+  }
+
  nsScriptNameSpaceManager *nameSpaceManager = PeekNameSpaceManager();
  if (!nameSpaceManager) {
    // Really shouldn't happen.  Fail safe.
@@ -4653,12 +4667,13 @@ nsGlobalWindow::GetOwnPropertyNames(JSContext* aCx, nsTArray<nsString>& aNames,
  nsScriptNameSpaceManager* nameSpaceManager = GetNameSpaceManager();
  if (nameSpaceManager) {
    JS::Rooted<JSObject*> wrapper(aCx, GetWrapper());
+
+    WebIDLGlobalNameHash::GetNames(aCx, wrapper, aNames);
+
    for (auto i = nameSpaceManager->GlobalNameIter(); !i.Done(); i.Next()) {
      const GlobalNameMapEntry* entry = i.Get();
      if (nsWindowSH::NameStructEnabled(aCx, this, entry->mKey,
-                                        entry->mGlobalName) &&
-          (!entry->mGlobalName.mConstructorEnabled ||
-           entry->mGlobalName.mConstructorEnabled(aCx, wrapper))) {
+                                        entry->mGlobalName)) {
        aNames.AppendElement(entry->mKey);
      }
    }
@@ -25,7 +25,8 @@
 #include "nsCRT.h"
 #include "nsIObserverService.h"
 #include "nsISimpleEnumerator.h"
-
+#include "mozilla/dom/BindingUtils.h"
+#include "mozilla/dom/WebIDLGlobalNameHash.h"
 #include "mozilla/MemoryReporting.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/Services.h"
@@ -34,6 +35,7 @@
 #define NS_DOM_INTERFACE_PREFIX "nsIDOM"

 using namespace mozilla;
+using namespace mozilla::dom;

 static PLDHashNumber
 GlobalNameHashHashKey(const void *key)
@@ -95,7 +97,7 @@ static const PLDHashTableOps hash_table_ops =
  GlobalNameHashInitEntry
 };

-#define GLOBALNAME_HASHTABLE_INITIAL_LENGTH   512
+#define GLOBALNAME_HASHTABLE_INITIAL_LENGTH          32

 nsScriptNameSpaceManager::nsScriptNameSpaceManager()
  : mGlobalNames(&hash_table_ops, sizeof(GlobalNameMapEntry),
@@ -111,14 +113,17 @@ nsScriptNameSpaceManager::~nsScriptNameSpaceManager()
 }

 nsGlobalNameStruct *
-nsScriptNameSpaceManager::AddToHash(const nsAString *aKey,
+nsScriptNameSpaceManager::AddToHash(const char *aKey,
                                    const char16_t **aClassName)
 {
-  auto entry = static_cast<GlobalNameMapEntry*>(mGlobalNames.Add(aKey, fallible));
+  NS_ConvertASCIItoUTF16 key(aKey);
+  auto entry = static_cast<GlobalNameMapEntry*>(mGlobalNames.Add(&key, fallible));
  if (!entry) {
    return nullptr;
  }

+  WebIDLGlobalNameHash::Remove(aKey, key.Length());
+
  if (aClassName) {
    *aClassName = entry->mKey.get();
  }
@@ -230,8 +235,7 @@ nsScriptNameSpaceManager::RegisterClassName(const char *aClassName,
    return NS_OK;
  }

-  NS_ASSERTION(s->mType == nsGlobalNameStruct::eTypeNotInitialized ||
-               s->mType == nsGlobalNameStruct::eTypeNewDOMBinding,
+  NS_ASSERTION(s->mType == nsGlobalNameStruct::eTypeNotInitialized,
               "Whaaa, JS environment name clash!");

  s->mType = nsGlobalNameStruct::eTypeClassConstructor;
@@ -254,8 +258,7 @@ nsScriptNameSpaceManager::RegisterClassProto(const char *aClassName,
  nsGlobalNameStruct *s = AddToHash(aClassName);
  NS_ENSURE_TRUE(s, NS_ERROR_OUT_OF_MEMORY);

-  if (s->mType != nsGlobalNameStruct::eTypeNotInitialized &&
-      s->mType != nsGlobalNameStruct::eTypeNewDOMBinding) {
+  if (s->mType != nsGlobalNameStruct::eTypeNotInitialized) {
    *aFoundOld = true;

    return NS_OK;
@@ -349,8 +352,7 @@ nsScriptNameSpaceManager::OperateCategoryEntryHash(nsICategoryManager* aCategory
  nsGlobalNameStruct *s = AddToHash(categoryEntry.get());
  NS_ENSURE_TRUE(s, NS_ERROR_OUT_OF_MEMORY);

-  if (s->mType == nsGlobalNameStruct::eTypeNotInitialized ||
-      s->mType == nsGlobalNameStruct::eTypeNewDOMBinding) {
+  if (s->mType == nsGlobalNameStruct::eTypeNotInitialized) {
    s->mType = type;
    s->mCID = cid;
    s->mChromeOnly =
@@ -414,21 +416,6 @@ nsScriptNameSpaceManager::Observe(nsISupports* aSubject, const char* aTopic,
  return NS_OK;
 }

-void
-nsScriptNameSpaceManager::RegisterDefineDOMInterface(const nsAFlatString& aName,
-    mozilla::dom::DefineInterface aDefineDOMInterface,
-    mozilla::dom::ConstructorEnabled* aConstructorEnabled)
-{
-  nsGlobalNameStruct *s = AddToHash(&aName);
-  if (s) {
-    if (s->mType == nsGlobalNameStruct::eTypeNotInitialized) {
-      s->mType = nsGlobalNameStruct::eTypeNewDOMBinding;
-    }
-    s->mDefineDOMInterface = aDefineDOMInterface;
-    s->mConstructorEnabled = aConstructorEnabled;
-  }
-}
-
 MOZ_DEFINE_MALLOC_SIZE_OF(ScriptNameSpaceManagerMallocSizeOf)

 NS_IMETHODIMP
@@ -33,35 +33,24 @@
 #include "nsWeakReference.h"
 #include "xpcpublic.h"

-
 struct nsGlobalNameStruct
 {
  enum nametype {
    eTypeNotInitialized,
-    eTypeNewDOMBinding,
    eTypeProperty,
    eTypeExternalConstructor,
    eTypeClassConstructor,
    eTypeClassProto,
  } mType;

-  // mChromeOnly is only used for structs that define non-WebIDL things
-  // (possibly in addition to WebIDL ones).  In particular, it's not even
-  // initialized for eTypeNewDOMBinding structs.
  bool mChromeOnly : 1;
  bool mAllowXBL : 1;

  union {
    int32_t mDOMClassInfoID; // eTypeClassConstructor
    nsIID mIID; // eTypeClassProto
-    nsCID mCID; // All other types except eTypeNewDOMBinding
+    nsCID mCID; // All other types
  };
-
-  // For new style DOM bindings.
-  mozilla::dom::DefineInterface mDefineDOMInterface;
-
-  // May be null if enabled unconditionally
-  mozilla::dom::ConstructorEnabled* mConstructorEnabled;
 };

 class GlobalNameMapEntry : public PLDHashEntryHdr
@@ -112,19 +101,6 @@ public:
                              const nsIID *aConstructorProtoIID,
                              bool *aFoundOld);

-  void RegisterDefineDOMInterface(const nsAFlatString& aName,
-    mozilla::dom::DefineInterface aDefineDOMInterface,
-    mozilla::dom::ConstructorEnabled* aConstructorEnabled);
-  template<size_t N>
-  void RegisterDefineDOMInterface(const char16_t (&aKey)[N],
-    mozilla::dom::DefineInterface aDefineDOMInterface,
-    mozilla::dom::ConstructorEnabled* aConstructorEnabled)
-  {
-    nsLiteralString key(aKey);
-    return RegisterDefineDOMInterface(key, aDefineDOMInterface,
-                                      aConstructorEnabled);
-  }
-
  class NameIterator : public PLDHashTable::Iterator
  {
  public:
@@ -155,22 +131,14 @@ private:
  // that aKey will be mapped to. If mType in the returned
  // nsGlobalNameStruct is != eTypeNotInitialized, an entry for aKey
  // already existed.
-  nsGlobalNameStruct *AddToHash(const nsAString *aKey,
-                                const char16_t **aClassName = nullptr);
  nsGlobalNameStruct *AddToHash(const char *aKey,
-                                const char16_t **aClassName = nullptr)
-  {
-    NS_ConvertASCIItoUTF16 key(aKey);
-    return AddToHash(&key, aClassName);
-  }
+                                const char16_t **aClassName = nullptr);
+
  // Removes an existing entry from the hash.
  void RemoveFromHash(const nsAString *aKey);

  nsresult FillHash(nsICategoryManager *aCategoryManager,
                    const char *aCategory);
-  nsresult RegisterInterface(const char* aIfName,
-                             const nsIID *aIfIID,
-                             bool* aFoundOld);

  /**
   * Add a new category entry into the hash table.
@@ -45,6 +45,7 @@
 #include "mozilla/dom/HTMLAppletElementBinding.h"
 #include "mozilla/dom/Promise.h"
 #include "mozilla/dom/ResolveSystemBinding.h"
+#include "mozilla/dom/WebIDLGlobalNameHash.h"
 #include "mozilla/dom/WorkerPrivate.h"
 #include "mozilla/dom/WorkerScope.h"
 #include "mozilla/jsipc/CrossProcessObjectWrappers.h"
@@ -172,7 +173,7 @@ ErrorResult::SerializeMessage(IPC::Message* aMsg) const
 }

 bool
-ErrorResult::DeserializeMessage(const IPC::Message* aMsg, void** aIter)
+ErrorResult::DeserializeMessage(const IPC::Message* aMsg, PickleIterator* aIter)
 {
  using namespace IPC;
  nsAutoPtr<Message> readMessage(new Message());
@@ -294,7 +295,7 @@ ErrorResult::SerializeDOMExceptionInfo(IPC::Message* aMsg) const
 }

 bool
-ErrorResult::DeserializeDOMExceptionInfo(const IPC::Message* aMsg, void** aIter)
+ErrorResult::DeserializeDOMExceptionInfo(const IPC::Message* aMsg, PickleIterator* aIter)
 {
  using namespace IPC;
  nsCString message;
@@ -2941,20 +2942,15 @@ RegisterDOMNames()
    return NS_OK;
  }

+  // Register new DOM bindings
+  WebIDLGlobalNameHash::Init();
+
  nsresult rv = nsDOMClassInfo::Init();
  if (NS_FAILED(rv)) {
    NS_ERROR("Could not initialize nsDOMClassInfo");
    return rv;
  }

-  // Register new DOM bindings
-  nsScriptNameSpaceManager* nameSpaceManager = GetNameSpaceManager();
-  if (!nameSpaceManager) {
-    NS_ERROR("Could not initialize nsScriptNameSpaceManager");
-    return NS_ERROR_FAILURE;
-  }
-  mozilla::dom::Register(nameSpaceManager);
-
  sRegisteredDOMNames = true;

  return NS_OK;
@@ -12056,14 +12056,14 @@ class CGDescriptor(CGThing):
        if descriptor.interface.hasInterfacePrototypeObject():
            cgThings.append(CGPrototypeJSClass(descriptor, properties))

-        if descriptor.interface.hasInterfaceObject():
-            cgThings.append(CGDefineDOMInterfaceMethod(descriptor))
-
        if ((descriptor.interface.hasInterfaceObject() or descriptor.interface.isNavigatorProperty()) and
            not descriptor.interface.isExternal() and
            descriptor.isExposedConditionally()):
            cgThings.append(CGConstructorEnabled(descriptor))

+        if descriptor.registersGlobalNamesOnWindow:
+            cgThings.append(CGDefineDOMInterfaceMethod(descriptor))
+
        if (descriptor.interface.hasMembersInSlots() and
            descriptor.interface.hasChildInterfaces()):
            raise TypeError("We don't support members in slots on "
@@ -13056,48 +13056,53 @@ class CGResolveSystemBinding(CGAbstractMethod):
                      "\n").define()


-class CGRegisterProtos(CGAbstractMethod):
+def getGlobalNames(config):
+    names = []
+    for desc in config.getDescriptors(registersGlobalNamesOnWindow=True):
+        names.append((desc.name, desc))
+        names.extend((n.identifier.name, desc) for n in desc.interface.namedConstructors)
+    return names
+
+class CGGlobalNamesString(CGGeneric):
    def __init__(self, config):
-        CGAbstractMethod.__init__(self, None, 'Register', 'void',
-                                  [Argument('nsScriptNameSpaceManager*', 'aNameSpaceManager')])
+        globalNames = getGlobalNames(config)
+        currentOffset = 0
+        strings = []
+        for (name, _) in globalNames:
+            strings.append('/* %i */ "%s\\0"' % (currentOffset, name))
+            currentOffset += len(name) + 1 # Add trailing null.
+        define = fill("""
+            const uint32_t WebIDLGlobalNameHash::sCount = ${count};
+
+            const char WebIDLGlobalNameHash::sNames[] =
+              $*{strings}
+
+            """,
+            count=len(globalNames),
+            strings="\n".join(strings) + ";\n")
+
+        CGGeneric.__init__(self, define=define)
+
+
+class CGRegisterGlobalNames(CGAbstractMethod):
+    def __init__(self, config):
+        CGAbstractMethod.__init__(self, None, 'RegisterWebIDLGlobalNames',
+                                  'void', [])
        self.config = config

-    def _defineMacro(self):
-        return dedent("""
-            #define REGISTER_PROTO(_dom_class, _ctor_check) \\
-              aNameSpaceManager->RegisterDefineDOMInterface(MOZ_UTF16(#_dom_class), _dom_class##Binding::DefineDOMInterface, _ctor_check);
-            #define REGISTER_CONSTRUCTOR(_dom_constructor, _dom_class, _ctor_check) \\
-              aNameSpaceManager->RegisterDefineDOMInterface(MOZ_UTF16(#_dom_constructor), _dom_class##Binding::DefineDOMInterface, _ctor_check);
-            """)
-
-    def _undefineMacro(self):
-        return dedent("""
-            #undef REGISTER_CONSTRUCTOR
-            #undef REGISTER_PROTO
-            """)
-
-    def _registerProtos(self):
+    def definition_body(self):
        def getCheck(desc):
            if not desc.isExposedConditionally():
                return "nullptr"
            return "%sBinding::ConstructorEnabled" % desc.name
-        lines = []
-        for desc in self.config.getDescriptors(hasInterfaceObject=True,
-                                               isExternal=False,
-                                               workers=False,
-                                               isExposedInWindow=True,
-                                               register=True):
-            lines.append("REGISTER_PROTO(%s, %s);\n" % (desc.name, getCheck(desc)))
-            lines.extend("REGISTER_CONSTRUCTOR(%s, %s, %s);\n" % (n.identifier.name, desc.name, getCheck(desc))
-                         for n in desc.interface.namedConstructors)
-        return ''.join(lines)

-    def indent_body(self, body):
-        # Don't indent the body of this method, as it's all preprocessor gunk.
-        return body
-
-    def definition_body(self):
-        return "\n" + self._defineMacro() + "\n" + self._registerProtos() + "\n" + self._undefineMacro()
+        define = ""
+        currentOffset = 0
+        for (name, desc) in getGlobalNames(self.config):
+            length = len(name)
+            define += "WebIDLGlobalNameHash::Register(%i, %i, %sBinding::DefineDOMInterface, %s);\n" % (currentOffset, length, desc.name, getCheck(desc))
+            currentOffset += length + 1 # Add trailing null.
+        return define


 def dependencySortObjects(objects, dependencyGetter, nameGetter):
@@ -16194,7 +16199,7 @@ class GlobalGenRoots():
    @staticmethod
    def RegisterBindings(config):

-        curr = CGRegisterProtos(config)
+        curr = CGList([CGGlobalNamesString(config), CGRegisterGlobalNames(config)])

        # Wrap all of that in our namespaces.
        curr = CGNamespace.build(['mozilla', 'dom'],
@@ -16207,7 +16212,7 @@ class GlobalGenRoots():
                                                            workers=False,
                                                            isExposedInWindow=True,
                                                            register=True)]
-        defineIncludes.append('nsScriptNameSpaceManager.h')
+        defineIncludes.append('mozilla/dom/WebIDLGlobalNameHash.h')
        defineIncludes.extend([CGHeaders.getDeclarationFilename(desc.interface)
                               for desc in config.getDescriptors(isNavigatorProperty=True,
                                                                 workers=False,
@@ -824,6 +824,14 @@ class Descriptor(DescriptorProvider):
            iface = iface.parent
        return True

+    @property
+    def registersGlobalNamesOnWindow(self):
+        return (not self.interface.isExternal() and
+                self.interface.hasInterfaceObject() and
+                not self.workers and
+                self.interface.isExposedInWindow() and
+                self.register)
+

 # Some utility methods
 def getTypesFromDescriptor(descriptor):
@@ -50,7 +50,7 @@ struct ParamTraits<mozilla::ErrorResult>
    }
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    paramType readValue;
    if (!ReadParam(aMsg, aIter, &readValue.mResult)) {
@@ -36,6 +36,7 @@ namespace IPC {
 class Message;
 template <typename> struct ParamTraits;
 } // namespace IPC
+class PickleIterator;

 namespace mozilla {

@@ -307,10 +308,10 @@ private:

  friend struct IPC::ParamTraits<ErrorResult>;
  void SerializeMessage(IPC::Message* aMsg) const;
-  bool DeserializeMessage(const IPC::Message* aMsg, void** aIter);
+  bool DeserializeMessage(const IPC::Message* aMsg, PickleIterator* aIter);

  void SerializeDOMExceptionInfo(IPC::Message* aMsg) const;
-  bool DeserializeDOMExceptionInfo(const IPC::Message* aMsg, void** aIter);
+  bool DeserializeDOMExceptionInfo(const IPC::Message* aMsg, PickleIterator* aIter);

  // Helper method that creates a new Message for this ErrorResult,
  // and returns the arguments array from that Message.
@@ -0,0 +1,313 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "WebIDLGlobalNameHash.h"
+#include "js/GCAPI.h"
+#include "mozilla/HashFunctions.h"
+#include "mozilla/Maybe.h"
+#include "mozilla/dom/DOMJSProxyHandler.h"
+#include "mozilla/dom/RegisterBindings.h"
+#include "nsIMemoryReporter.h"
+#include "nsTHashtable.h"
+
+namespace mozilla {
+namespace dom {
+
+struct MOZ_STACK_CLASS WebIDLNameTableKey
+{
+  explicit WebIDLNameTableKey(JSFlatString* aJSString)
+    : mLength(js::GetFlatStringLength(aJSString))
+  {
+    mNogc.emplace();
+    JSLinearString* jsString = js::FlatStringToLinearString(aJSString);
+    if (js::LinearStringHasLatin1Chars(jsString)) {
+      mLatin1String = reinterpret_cast<const char*>(
+        js::GetLatin1LinearStringChars(*mNogc, jsString));
+      mTwoBytesString = nullptr;
+      mHash = mLatin1String ? HashString(mLatin1String, mLength) : 0;
+    } else {
+      mLatin1String = nullptr;
+      mTwoBytesString = js::GetTwoByteLinearStringChars(*mNogc, jsString);
+      mHash = mTwoBytesString ? HashString(mTwoBytesString, mLength) : 0;
+    }
+  }
+  explicit WebIDLNameTableKey(const char* aString, size_t aLength)
+    : mLatin1String(aString),
+      mTwoBytesString(nullptr),
+      mLength(aLength),
+      mHash(HashString(aString, aLength))
+  {
+    MOZ_ASSERT(aString[aLength] == '\0');
+  }
+
+  Maybe<JS::AutoCheckCannotGC> mNogc;
+  const char* mLatin1String;
+  const char16_t* mTwoBytesString;
+  size_t mLength;
+  uint32_t mHash;
+};
+
+struct WebIDLNameTableEntry : public PLDHashEntryHdr
+{
+  typedef const WebIDLNameTableKey& KeyType;
+  typedef const WebIDLNameTableKey* KeyTypePointer;
+
+  explicit WebIDLNameTableEntry(KeyTypePointer aKey)
+  {}
+  WebIDLNameTableEntry(WebIDLNameTableEntry&& aEntry)
+    : mNameOffset(aEntry.mNameOffset),
+      mNameLength(aEntry.mNameLength),
+      mDefine(aEntry.mDefine),
+      mEnabled(aEntry.mEnabled)
+  {}
+  ~WebIDLNameTableEntry()
+  {}
+
+  bool KeyEquals(KeyTypePointer aKey) const
+  {
+    if (mNameLength != aKey->mLength) {
+      return false;
+    }
+
+    const char* name = WebIDLGlobalNameHash::sNames + mNameOffset;
+
+    if (aKey->mLatin1String) {
+      return PodEqual(aKey->mLatin1String, name, aKey->mLength);
+    }
+
+    return nsCharTraits<char16_t>::compareASCII(aKey->mTwoBytesString, name,
+                                                aKey->mLength) == 0;
+  }
+
+  static KeyTypePointer KeyToPointer(KeyType aKey)
+  {
+    return &aKey;
+  }
+
+  static PLDHashNumber HashKey(KeyTypePointer aKey)
+  {
+    return aKey->mHash;
+  }
+
+  enum { ALLOW_MEMMOVE = true };
+
+  uint16_t mNameOffset;
+  uint16_t mNameLength;
+  WebIDLGlobalNameHash::DefineGlobalName mDefine;
+  // May be null if enabled unconditionally
+  WebIDLGlobalNameHash::ConstructorEnabled* mEnabled;
+};
+
+static nsTHashtable<WebIDLNameTableEntry>* sWebIDLGlobalNames;
+
+class WebIDLGlobalNamesHashReporter final : public nsIMemoryReporter
+{
+  MOZ_DEFINE_MALLOC_SIZE_OF(MallocSizeOf)
+
+  ~WebIDLGlobalNamesHashReporter() {}
+
+public:
+  NS_DECL_ISUPPORTS
+
+  NS_IMETHOD CollectReports(nsIHandleReportCallback* aHandleReport,
+                            nsISupports* aData, bool aAnonymize) override
+  {
+    int64_t amount =
+      sWebIDLGlobalNames ?
+      sWebIDLGlobalNames->ShallowSizeOfIncludingThis(MallocSizeOf) : 0;
+
+    return MOZ_COLLECT_REPORT("explicit/dom/webidl-globalnames", KIND_HEAP,
+                              UNITS_BYTES, amount,
+                              "Memory used by the hash table for WebIDL's "
+                              "global names.");
+  }
+};
+
+NS_IMPL_ISUPPORTS(WebIDLGlobalNamesHashReporter, nsIMemoryReporter)
+
+/* static */
+void
+WebIDLGlobalNameHash::Init()
+{
+  sWebIDLGlobalNames = new nsTHashtable<WebIDLNameTableEntry>(sCount);
+  RegisterWebIDLGlobalNames();
+
+  RegisterStrongMemoryReporter(new WebIDLGlobalNamesHashReporter());
+}
+
+/* static */
+void
+WebIDLGlobalNameHash::Shutdown()
+{
+  delete sWebIDLGlobalNames;
+}
+
+/* static */
+void
+WebIDLGlobalNameHash::Register(uint16_t aNameOffset, uint16_t aNameLength,
+                               DefineGlobalName aDefine,
+                               ConstructorEnabled* aEnabled)
+{
+  const char* name = sNames + aNameOffset;
+  WebIDLNameTableKey key(name, aNameLength);
+  WebIDLNameTableEntry* entry = sWebIDLGlobalNames->PutEntry(key);
+  entry->mNameOffset = aNameOffset;
+  entry->mNameLength = aNameLength;
+  entry->mDefine = aDefine;
+  entry->mEnabled = aEnabled;
+}
+
+/* static */
+void
+WebIDLGlobalNameHash::Remove(const char* aName, uint32_t aLength)
+{
+  WebIDLNameTableKey key(aName, aLength);
+  sWebIDLGlobalNames->RemoveEntry(key);
+}
+
+/* static */
+bool
+WebIDLGlobalNameHash::DefineIfEnabled(JSContext* aCx,
+                                      JS::Handle<JSObject*> aObj,
+                                      JS::Handle<jsid> aId,
+                                      JS::MutableHandle<JS::PropertyDescriptor> aDesc,
+                                      bool* aFound)
+{
+  MOZ_ASSERT(JSID_IS_STRING(aId), "Check for string id before calling this!");
+
+  const WebIDLNameTableEntry* entry;
+  {
+    WebIDLNameTableKey key(JSID_TO_FLAT_STRING(aId));
+    // Rooting analysis thinks nsTHashtable<...>::GetEntry may GC because it
+    // ends up calling through PLDHashTableOps' matchEntry function pointer, but
+    // we know WebIDLNameTableEntry::KeyEquals can't cause a GC.
+    JS::AutoSuppressGCAnalysis suppress;
+    entry = sWebIDLGlobalNames->GetEntry(key);
+  }
+
+  if (!entry) {
+    *aFound = false;
+    return true;
+  }
+
+  *aFound = true;
+
+  ConstructorEnabled* checkEnabledForScope = entry->mEnabled;
+  // We do the enabled check on the current compartment of aCx, but for the
+  // actual object we pass in the underlying object in the Xray case.  That
+  // way the callee can decide whether to allow access based on the caller
+  // or the window being touched.
+  JS::Rooted<JSObject*> global(aCx,
+    js::CheckedUnwrap(aObj, /* stopAtWindowProxy = */ false));
+  if (!global) {
+    return Throw(aCx, NS_ERROR_DOM_SECURITY_ERR);
+  }
+
+  {
+    DebugOnly<nsGlobalWindow*> win;
+    MOZ_ASSERT(NS_SUCCEEDED(UNWRAP_OBJECT(Window, global, win)));
+  }
+
+  if (checkEnabledForScope && !checkEnabledForScope(aCx, global)) {
+    return true;
+  }
+
+  // The DOM constructor resolve machinery interacts with Xrays in tricky
+  // ways, and there are some asymmetries that are important to understand.
+  //
+  // In the regular (non-Xray) case, we only want to resolve constructors
+  // once (so that if they're deleted, they don't reappear). We do this by
+  // stashing the constructor in a slot on the global, such that we can see
+  // during resolve whether we've created it already. This is rather
+  // memory-intensive, so we don't try to maintain these semantics when
+  // manipulating a global over Xray (so the properties just re-resolve if
+  // they've been deleted).
+  //
+  // Unfortunately, there's a bit of an impedance-mismatch between the Xray
+  // and non-Xray machinery. The Xray machinery wants an API that returns a
+  // JS::PropertyDescriptor, so that the resolve hook doesn't have to get
+  // snared up with trying to define a property on the Xray holder. At the
+  // same time, the DefineInterface callbacks are set up to define things
+  // directly on the global.  And re-jiggering them to return property
+  // descriptors is tricky, because some DefineInterface callbacks define
+  // multiple things (like the Image() alias for HTMLImageElement).
+  //
+  // So the setup is as-follows:
+  //
+  // * The resolve function takes a JS::PropertyDescriptor, but in the
+  //   non-Xray case, callees may define things directly on the global, and
+  //   set the value on the property descriptor to |undefined| to indicate
+  //   that there's nothing more for the caller to do. We assert against
+  //   this behavior in the Xray case.
+  //
+  // * We make sure that we do a non-Xray resolve first, so that all the
+  //   slots are set up. In the Xray case, this means unwrapping and doing
+  //   a non-Xray resolve before doing the Xray resolve.
+  //
+  // This all could use some grand refactoring, but for now we just limp
+  // along.
+  if (xpc::WrapperFactory::IsXrayWrapper(aObj)) {
+    JS::Rooted<JSObject*> interfaceObject(aCx);
+    {
+      JSAutoCompartment ac(aCx, global);
+      interfaceObject = entry->mDefine(aCx, global, aId, false);
+    }
+    if (NS_WARN_IF(!interfaceObject)) {
+      return Throw(aCx, NS_ERROR_FAILURE);
+    }
+    if (!JS_WrapObject(aCx, &interfaceObject)) {
+      return Throw(aCx, NS_ERROR_FAILURE);
+    }
+
+    FillPropertyDescriptor(aDesc, aObj, 0, JS::ObjectValue(*interfaceObject));
+    return true;
+  }
+
+  JS::Rooted<JSObject*> interfaceObject(aCx,
+                                        entry->mDefine(aCx, aObj, aId, true));
+  if (NS_WARN_IF(!interfaceObject)) {
+    return Throw(aCx, NS_ERROR_FAILURE);
+  }
+
+  // We've already defined the property.  We indicate this to the caller
+  // by filling a property descriptor with JS::UndefinedValue() as the
+  // value.  We still have to fill in a property descriptor, though, so
+  // that the caller knows the property is in fact on this object.  It
+  // doesn't matter what we pass for the "readonly" argument here.
+  FillPropertyDescriptor(aDesc, aObj, JS::UndefinedValue(), false);
+
+  return true;
+}
+
+/* static */
+bool
+WebIDLGlobalNameHash::MayResolve(jsid aId)
+{
+  WebIDLNameTableKey key(JSID_TO_FLAT_STRING(aId));
+  // Rooting analysis thinks nsTHashtable<...>::Contains may GC because it ends
+  // up calling through PLDHashTableOps' matchEntry function pointer, but we
+  // know WebIDLNameTableEntry::KeyEquals can't cause a GC.
+  JS::AutoSuppressGCAnalysis suppress;
+  return sWebIDLGlobalNames->Contains(key);
+}
+
+/* static */
+void
+WebIDLGlobalNameHash::GetNames(JSContext* aCx, JS::Handle<JSObject*> aObj,
+                               nsTArray<nsString>& aNames)
+{
+  for (auto iter = sWebIDLGlobalNames->Iter(); !iter.Done(); iter.Next()) {
+    const WebIDLNameTableEntry* entry = iter.Get();
+    if (!entry->mEnabled || entry->mEnabled(aCx, aObj)) {
+      AppendASCIItoUTF16(nsDependentCString(sNames + entry->mNameOffset,
+                                            entry->mNameLength),
+                         *aNames.AppendElement());
+    }
+  }
+}
+
+} // namespace dom
+} // namespace mozilla
@@ -0,0 +1,70 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_WebIDLGlobalNameHash_h__
+#define mozilla_dom_WebIDLGlobalNameHash_h__
+
+#include "js/RootingAPI.h"
+#include "nsTArray.h"
+
+namespace mozilla {
+namespace dom {
+
+struct WebIDLNameTableEntry;
+
+class WebIDLGlobalNameHash
+{
+public:
+  static void Init();
+  static void Shutdown();
+
+  typedef JSObject*
+  (*DefineGlobalName)(JSContext* cx, JS::Handle<JSObject*> global,
+                      JS::Handle<jsid> id, bool defineOnGlobal);
+
+  // Check whether a constructor should be enabled for the given object.
+  // Note that the object should NOT be an Xray, since Xrays will end up
+  // defining constructors on the underlying object.
+  // This is a typedef for the function type itself, not the function
+  // pointer, so it's more obvious that pointers to a ConstructorEnabled
+  // can be null.
+  typedef bool
+  (ConstructorEnabled)(JSContext* cx, JS::Handle<JSObject*> obj);
+
+  static void Register(uint16_t aNameOffset, uint16_t aNameLength,
+                       DefineGlobalName aDefine, ConstructorEnabled* aEnabled);
+
+  static void Remove(const char* aName, uint32_t aLength);
+
+  // Returns false if something failed. aFound is set to true if the name is in
+  // the hash, whether it's enabled or not.
+  static bool DefineIfEnabled(JSContext* aCx, JS::Handle<JSObject*> aObj,
+                              JS::Handle<jsid> aId,
+                              JS::MutableHandle<JS::PropertyDescriptor> aDesc,
+                              bool* aFound);
+
+  static bool MayResolve(jsid aId);
+
+  static void GetNames(JSContext* aCx, JS::Handle<JSObject*> aObj,
+                       nsTArray<nsString>& aNames);
+
+private:
+  friend struct WebIDLNameTableEntry;
+
+  // The total number of names that we will add to the hash.
+  // The value of sCount is generated by Codegen.py in RegisterBindings.cpp.
+  static const uint32_t sCount;
+
+  // The names that will be registered in the hash, concatenated as one big
+  // string with \0 as a separator between names.
+  // The value of sNames is generated by Codegen.py in RegisterBindings.cpp.
+  static const char sNames[];
+};
+
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_WebIDLGlobalNameHash_h__
@@ -39,6 +39,7 @@ EXPORTS.mozilla.dom += [
    'ToJSValue.h',
    'TypedArray.h',
    'UnionMember.h',
+    'WebIDLGlobalNameHash.h',
 ]

 # Generated bindings reference *Binding.h, not mozilla/dom/*Binding.h. And,
@@ -89,6 +90,7 @@ UNIFIED_SOURCES += [
    'IterableIterator.cpp',
    'SimpleGlobalObject.cpp',
    'ToJSValue.cpp',
+    'WebIDLGlobalNameHash.cpp',
 ]

 SOURCES += [
@@ -24,7 +24,7 @@ struct ParamTraits<mozilla::dom::bluetooth::BluetoothAddress>
    }
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    for (size_t i = 0; i < MOZ_ARRAY_LENGTH(aResult->mAddr); ++i) {
      if (!ReadParam(aMsg, aIter, aResult->mAddr + i)) {
@@ -61,7 +61,7 @@ struct ParamTraits<mozilla::dom::bluetooth::BluetoothPinCode>
    }
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    if (!ReadParam(aMsg, aIter, &aResult->mLength)) {
      return false;
@@ -97,7 +97,7 @@ struct ParamTraits<mozilla::dom::bluetooth::BluetoothRemoteName>
    }
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    if (!ReadParam(aMsg, aIter, &aResult->mLength)) {
      return false;
@@ -158,7 +158,7 @@ struct ParamTraits<mozilla::dom::bluetooth::BluetoothUuid>
    }
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    for (uint8_t i = 0; i < 16; i++) {
      if (!ReadParam(aMsg, aIter, &(aResult->mUuid[i]))) {
@@ -181,7 +181,7 @@ struct ParamTraits<mozilla::dom::bluetooth::BluetoothGattId>
    WriteParam(aMsg, aParam.mInstanceId);
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    if (!ReadParam(aMsg, aIter, &(aResult->mUuid)) ||
        !ReadParam(aMsg, aIter, &(aResult->mInstanceId))) {
@@ -203,7 +203,7 @@ struct ParamTraits<mozilla::dom::bluetooth::BluetoothGattServiceId>
    WriteParam(aMsg, aParam.mIsPrimary);
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    if (!ReadParam(aMsg, aIter, &(aResult->mId)) ||
        !ReadParam(aMsg, aIter, &(aResult->mIsPrimary))) {
@@ -226,7 +226,7 @@ struct ParamTraits<mozilla::dom::bluetooth::BluetoothGattCharAttribute>
    WriteParam(aMsg, aParam.mWriteType);
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    if (!ReadParam(aMsg, aIter, &(aResult->mId)) ||
        !ReadParam(aMsg, aIter, &(aResult->mProperties)) ||
@@ -248,7 +248,7 @@ struct ParamTraits<mozilla::dom::bluetooth::BluetoothAttributeHandle>
    WriteParam(aMsg, aParam.mHandle);
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    if (!ReadParam(aMsg, aIter, &(aResult->mHandle))) {
      return false;
@@ -279,7 +279,7 @@ struct ParamTraits<mozilla::dom::bluetooth::BluetoothGattResponse>
    }
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    if (!ReadParam(aMsg, aIter, &(aResult->mHandle)) ||
        !ReadParam(aMsg, aIter, &(aResult->mOffset)) ||
@@ -312,7 +312,7 @@ struct ParamTraits<mozilla::dom::bluetooth::ControlPlayStatus>
    WriteParam(aMsg, static_cast<uint8_t>(aParam));
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    uint8_t value;
    if (!ReadParam(aMsg, aIter, &value)) {
@@ -352,7 +352,7 @@ struct ParamTraits<mozilla::dom::bluetooth::BluetoothGattAdvertisingData>
    WriteParam(aMsg, aParam.mServiceUuids);
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    if (!ReadParam(aMsg, aIter, &(aResult->mAppearance)) ||
        !ReadParam(aMsg, aIter, &(aResult->mIncludeDevName)) ||
@@ -755,11 +755,11 @@ Event::GetEventPopupControlState(WidgetEvent* aEvent, nsIDOMEvent* aDOMEvent)
    break;
  case eKeyboardEventClass:
    if (aEvent->IsTrusted()) {
-      uint32_t key = aEvent->AsKeyboardEvent()->keyCode;
+      uint32_t key = aEvent->AsKeyboardEvent()->mKeyCode;
      switch(aEvent->mMessage) {
      case eKeyPress:
        // return key on focused button. see note at eMouseClick.
-        if (key == nsIDOMKeyEvent::DOM_VK_RETURN) {
+        if (key == NS_VK_RETURN) {
          abuse = openAllowed;
        } else if (PopupAllowedForEvent("keypress")) {
          abuse = openControlled;
@@ -767,7 +767,7 @@ Event::GetEventPopupControlState(WidgetEvent* aEvent, nsIDOMEvent* aDOMEvent)
        break;
      case eKeyUp:
        // space key on focused button. see note at eMouseClick.
-        if (key == nsIDOMKeyEvent::DOM_VK_SPACE) {
+        if (key == NS_VK_SPACE) {
          abuse = openAllowed;
        } else if (PopupAllowedForEvent("keyup")) {
          abuse = openControlled;
@@ -1164,7 +1164,7 @@ Event::Serialize(IPC::Message* aMsg, bool aSerializeInterfaceType)
 }

 NS_IMETHODIMP_(bool)
-Event::Deserialize(const IPC::Message* aMsg, void** aIter)
+Event::Deserialize(const IPC::Message* aMsg, PickleIterator* aIter)
 {
  nsString type;
  NS_ENSURE_TRUE(IPC::ReadParam(aMsg, aIter, &type), false);
@@ -262,6 +262,10 @@ NON_IDL_EVENT(mozbrowserafterkeyup,
              eAfterKeyUp,
              EventNameType_None,
              eBeforeAfterKeyboardEventClass)
+NON_IDL_EVENT(mozaccesskeynotfound,
+              eAccessKeyNotFound,
+              EventNameType_None,
+              eKeyboardEventClass)
 EVENT(loadeddata,
      eLoadedData,
      EventNameType_HTML,
@@ -615,16 +615,16 @@ EventStateManager::PreHandleEvent(nsPresContext* aPresContext,
    switch (mouseEvent->button) {
    case WidgetMouseEvent::eLeftButton:
      BeginTrackingDragGesture(aPresContext, mouseEvent, aTargetFrame);
-      mLClickCount = mouseEvent->clickCount;
+      mLClickCount = mouseEvent->mClickCount;
      SetClickCount(mouseEvent, aStatus);
      sNormalLMouseEventInProcess = true;
      break;
    case WidgetMouseEvent::eMiddleButton:
-      mMClickCount = mouseEvent->clickCount;
+      mMClickCount = mouseEvent->mClickCount;
      SetClickCount(mouseEvent, aStatus);
      break;
    case WidgetMouseEvent::eRightButton:
-      mRClickCount = mouseEvent->clickCount;
+      mRClickCount = mouseEvent->mClickCount;
      SetClickCount(mouseEvent, aStatus);
      break;
    }
@@ -676,12 +676,12 @@ EventStateManager::PreHandleEvent(nsPresContext* aPresContext,
    // If the event is not a top-level window exit, then it's not
    // really an exit --- we may have traversed widget boundaries but
    // we're still in our toplevel window.
-    if (mouseEvent->exit != WidgetMouseEvent::eTopLevel) {
+    if (mouseEvent->mExitFrom != WidgetMouseEvent::eTopLevel) {
      // Treat it as a synthetic move so we don't generate spurious
      // "exit" or "move" events.  Any necessary "out" or "over" events
      // will be generated by GenerateMouseEnterExit
      mouseEvent->mMessage = eMouseMove;
-      mouseEvent->reason = WidgetMouseEvent::eSynthesized;
+      mouseEvent->mReason = WidgetMouseEvent::eSynthesized;
      // then fall through...
    } else {
      if (sPointerEventEnabled) {
@@ -741,15 +741,18 @@ EventStateManager::PreHandleEvent(nsPresContext* aPresContext,
        modifierMask |= NS_MODIFIER_OS;

      // Prevent keyboard scrolling while an accesskey modifier is in use.
-      if (modifierMask &&
-          (modifierMask == Prefs::ChromeAccessModifierMask() ||
-           modifierMask == Prefs::ContentAccessModifierMask())) {
-        AutoTArray<uint32_t, 10> accessCharCodes;
-        keyEvent->GetAccessKeyCandidates(accessCharCodes);
+      if (modifierMask) {
+        bool matchesContentAccessKey = (modifierMask == Prefs::ContentAccessModifierMask());
+        
+        if (modifierMask == Prefs::ChromeAccessModifierMask() ||
+            matchesContentAccessKey) {
+          AutoTArray<uint32_t, 10> accessCharCodes;
+          keyEvent->GetAccessKeyCandidates(accessCharCodes);

-        if (HandleAccessKey(aPresContext, accessCharCodes,
-                            keyEvent->IsTrusted(), modifierMask)) {
-          *aStatus = nsEventStatus_eConsumeNoDefault;
+          if (HandleAccessKey(keyEvent, aPresContext, accessCharCodes,
+                              modifierMask, matchesContentAccessKey)) {
+            *aStatus = nsEventStatus_eConsumeNoDefault;
+          }
        }
      }
    }
@@ -1043,21 +1046,21 @@ EventStateManager::GetAccessKeyLabelPrefix(Element* aElement, nsAString& aPrefix
  }
 }

-struct AccessKeyInfo
+struct MOZ_STACK_CLASS AccessKeyInfo
 {
+  WidgetKeyboardEvent* event;
  nsTArray<uint32_t>& charCodes;
-  bool isTrusted;
  int32_t modifierMask;

-  AccessKeyInfo(nsTArray<uint32_t>& aCharCodes, bool aIsTrusted, int32_t aModifierMask)
-    : charCodes(aCharCodes)
-    , isTrusted(aIsTrusted)
+  AccessKeyInfo(WidgetKeyboardEvent* aEvent, nsTArray<uint32_t>& aCharCodes, int32_t aModifierMask)
+    : event(aEvent)
+    , charCodes(aCharCodes)
    , modifierMask(aModifierMask)
  {
  }
 };

-static void
+static bool
 HandleAccessKeyInRemoteChild(TabParent* aTabParent, void* aArg)
 {
  AccessKeyInfo* accessKeyInfo = static_cast<AccessKeyInfo*>(aArg);
@@ -1066,15 +1069,21 @@ HandleAccessKeyInRemoteChild(TabParent* aTabParent, void* aArg)
  bool active;
  aTabParent->GetDocShellIsActive(&active);
  if (active) {
-    aTabParent->HandleAccessKey(accessKeyInfo->charCodes, accessKeyInfo->isTrusted,
+    accessKeyInfo->event->mAccessKeyForwardedToChild = true;
+    aTabParent->HandleAccessKey(*accessKeyInfo->event,
+                                accessKeyInfo->charCodes,
                                accessKeyInfo->modifierMask);
+    return true;
  }
+
+  return false;
 }

 bool
-EventStateManager::HandleAccessKey(nsPresContext* aPresContext,
+EventStateManager::HandleAccessKey(WidgetKeyboardEvent* aEvent,
+                                   nsPresContext* aPresContext,
                                   nsTArray<uint32_t>& aAccessCharCodes,
-                                   bool aIsTrusted,
+                                   bool aMatchesContentAccessKey,
                                   nsIDocShellTreeItem* aBubbledFrom,
                                   ProcessingAccessKeyState aAccessKeyState,
                                   int32_t aModifierMask)
@@ -1089,7 +1098,7 @@ EventStateManager::HandleAccessKey(nsPresContext* aPresContext,
  if (mAccessKeys.Count() > 0 &&
      aModifierMask == GetAccessModifierMaskFor(docShell)) {
    // Someone registered an accesskey.  Find and activate it.
-    if (ExecuteAccessKey(aAccessCharCodes, aIsTrusted)) {
+    if (ExecuteAccessKey(aAccessCharCodes, aEvent->IsTrusted())) {
      return true;
    }
  }
@@ -1122,7 +1131,8 @@ EventStateManager::HandleAccessKey(nsPresContext* aPresContext,
        static_cast<EventStateManager*>(subPC->EventStateManager());

      if (esm &&
-          esm->HandleAccessKey(subPC, aAccessCharCodes, aIsTrusted, nullptr,
+          esm->HandleAccessKey(aEvent, subPC, aAccessCharCodes,
+                               aMatchesContentAccessKey, nullptr,
                               eAccessKeyProcessingDown, aModifierMask)) {
        return true;
      }
@@ -1144,22 +1154,27 @@ EventStateManager::HandleAccessKey(nsPresContext* aPresContext,
      EventStateManager* esm =
        static_cast<EventStateManager*>(parentPC->EventStateManager());
      if (esm &&
-          esm->HandleAccessKey(parentPC, aAccessCharCodes, aIsTrusted, docShell,
-                               eAccessKeyProcessingUp, aModifierMask)) {
+          esm->HandleAccessKey(aEvent, parentPC, aAccessCharCodes,
+                               aMatchesContentAccessKey, docShell,
+                               eAccessKeyProcessingDown, aModifierMask)) {
        return true;
      }
    }
  }// if end. bubble up process

-  // Now try remote children
-  if (mDocument && mDocument->GetWindow()) {
+  // If the content access key modifier is pressed, try remote children
+  if (aMatchesContentAccessKey && mDocument && mDocument->GetWindow()) {
    // If the focus is currently on a node with a TabParent, the key event will
    // get forwarded to the child process and HandleAccessKey called from there.
    // If focus is somewhere else, then we need to check the remote children.
    nsFocusManager* fm = nsFocusManager::GetFocusManager();
    nsIContent* focusedContent = fm ? fm->GetFocusedContent() : nullptr;
-    if (!TabParent::GetFrom(focusedContent)) {
-      AccessKeyInfo accessKeyInfo(aAccessCharCodes, aIsTrusted, aModifierMask);
+    if (TabParent::GetFrom(focusedContent)) {
+      // A remote child process is focused. The key event should get sent to
+      // the child process.
+      aEvent->mAccessKeyForwardedToChild = true;
+    } else {
+      AccessKeyInfo accessKeyInfo(aEvent, aAccessCharCodes, aModifierMask);
      nsContentUtils::CallOnAllRemoteChildren(mDocument->GetWindow(),
                                              HandleAccessKeyInRemoteChild, &accessKeyInfo);
    }
@@ -1537,7 +1552,7 @@ EventStateManager::FireContextClick()
      // init the event while mCurrentTarget is still good
      WidgetMouseEvent event(true, eContextMenu, targetWidget,
                             WidgetMouseEvent::eReal);
-      event.clickCount = 1;
+      event.mClickCount = 1;
      FillInEventFromGestureDown(&event);
        
      // stop selection tracking, we're in control now
@@ -2833,7 +2848,7 @@ EventStateManager::PostHandleKeyboardEvent(WidgetKeyboardEvent* aKeyboardEvent,

  // XXX Currently, our automated tests don't support mKeyNameIndex.
  //     Therefore, we still need to handle this with keyCode.
-  switch(aKeyboardEvent->keyCode) {
+  switch(aKeyboardEvent->mKeyCode) {
    case NS_VK_TAB:
    case NS_VK_F6:
      // This is to prevent keyboard scrolling while alt modifier in use.
@@ -2852,7 +2867,7 @@ EventStateManager::PostHandleKeyboardEvent(WidgetKeyboardEvent* aKeyboardEvent,
        if (fm && mDocument) {
          // Shift focus forward or back depending on shift key
          bool isDocMove =
-            aKeyboardEvent->IsControl() || aKeyboardEvent->keyCode == NS_VK_F6;
+            aKeyboardEvent->IsControl() || aKeyboardEvent->mKeyCode == NS_VK_F6;
          uint32_t dir = aKeyboardEvent->IsShift() ?
            (isDocMove ? static_cast<uint32_t>(nsIFocusManager::MOVEFOCUS_BACKWARDDOC) :
                         static_cast<uint32_t>(nsIFocusManager::MOVEFOCUS_BACKWARD)) :
@@ -3950,7 +3965,7 @@ EventStateManager::DispatchMouseOrPointerEvent(WidgetMouseEvent* aMouseEvent,
        nsAutoPtr<WidgetMouseEvent> remoteEvent;
        CreateMouseOrPointerWidgetEvent(aMouseEvent, eMouseExitFromWidget,
                                        aRelatedContent, remoteEvent);
-        remoteEvent->exit = WidgetMouseEvent::eTopLevel;
+        remoteEvent->mExitFrom = WidgetMouseEvent::eTopLevel;

        // mCurrentTarget is set to the new target, so we must reset it to the
        // old target and then dispatch a cross-process event. (mCurrentTarget
@@ -4388,6 +4403,9 @@ EventStateManager::SetPointerLock(nsIWidget* aWidget,
    // pre-pointerlock position, so that the synthetic mouse event reports
    // no movement.
    sLastRefPoint = mPreLockPoint;
+    // Reset SynthCenteringPoint to invalid so that next time we start
+    // locking pointer, it has its initial value.
+    sSynthCenteringPoint = kInvalidRefPoint;
    if (aWidget) {
      aWidget->SynthesizeNativeMouseMove(
        mPreLockPoint + aWidget->WidgetToScreenOffset(), nullptr);
@@ -4581,10 +4599,10 @@ EventStateManager::SetClickCount(WidgetMouseEvent* aEvent,
      if (mLastLeftMouseDownContent == mouseContent ||
          mLastLeftMouseDownContentParent == mouseContent ||
          mLastLeftMouseDownContent == mouseContentParent) {
-        aEvent->clickCount = mLClickCount;
+        aEvent->mClickCount = mLClickCount;
        mLClickCount = 0;
      } else {
-        aEvent->clickCount = 0;
+        aEvent->mClickCount = 0;
      }
      mLastLeftMouseDownContent = nullptr;
      mLastLeftMouseDownContentParent = nullptr;
@@ -4599,10 +4617,10 @@ EventStateManager::SetClickCount(WidgetMouseEvent* aEvent,
      if (mLastMiddleMouseDownContent == mouseContent ||
          mLastMiddleMouseDownContentParent == mouseContent ||
          mLastMiddleMouseDownContent == mouseContentParent) {
-        aEvent->clickCount = mMClickCount;
+        aEvent->mClickCount = mMClickCount;
        mMClickCount = 0;
      } else {
-        aEvent->clickCount = 0;
+        aEvent->mClickCount = 0;
      }
      mLastMiddleMouseDownContent = nullptr;
      mLastMiddleMouseDownContentParent = nullptr;
@@ -4617,10 +4635,10 @@ EventStateManager::SetClickCount(WidgetMouseEvent* aEvent,
      if (mLastRightMouseDownContent == mouseContent ||
          mLastRightMouseDownContentParent == mouseContent ||
          mLastRightMouseDownContent == mouseContentParent) {
-        aEvent->clickCount = mRClickCount;
+        aEvent->mClickCount = mRClickCount;
        mRClickCount = 0;
      } else {
-        aEvent->clickCount = 0;
+        aEvent->mClickCount = 0;
      }
      mLastRightMouseDownContent = nullptr;
      mLastRightMouseDownContentParent = nullptr;
@@ -4644,7 +4662,7 @@ EventStateManager::InitAndDispatchClickEvent(WidgetMouseEvent* aEvent,
                         aEvent->mWidget, WidgetMouseEvent::eReal);

  event.mRefPoint = aEvent->mRefPoint;
-  event.clickCount = aEvent->clickCount;
+  event.mClickCount = aEvent->mClickCount;
  event.mModifiers = aEvent->mModifiers;
  event.buttons = aEvent->buttons;
  event.mTime = aEvent->mTime;
@@ -4665,7 +4683,7 @@ EventStateManager::CheckForAndDispatchClick(WidgetMouseEvent* aEvent,

  //If mouse is still over same element, clickcount will be > 1.
  //If it has moved it will be zero, so no click.
-  if (0 != aEvent->clickCount) {
+  if (aEvent->mClickCount) {
    //Check that the window isn't disabled before firing a click
    //(see bug 366544).
    if (aEvent->mWidget && !aEvent->mWidget->IsEnabled()) {
@@ -4699,7 +4717,7 @@ EventStateManager::CheckForAndDispatchClick(WidgetMouseEvent* aEvent,
                                      presShell, mouseContent, currentTarget,
                                      notDispatchToContents);

-      if (NS_SUCCEEDED(ret) && aEvent->clickCount == 2 &&
+      if (NS_SUCCEEDED(ret) && aEvent->mClickCount == 2 &&
          mouseContent && mouseContent->IsInComposedDoc()) {
        // fire double click
        ret = InitAndDispatchClickEvent(aEvent, aStatus, eMouseDoubleClick,
@@ -183,13 +183,15 @@ public:

  static void GetAccessKeyLabelPrefix(dom::Element* aElement, nsAString& aPrefix);

-  bool HandleAccessKey(nsPresContext* aPresContext,
+  bool HandleAccessKey(WidgetKeyboardEvent* aEvent,
+                       nsPresContext* aPresContext,
                       nsTArray<uint32_t>& aAccessCharCodes,
-                       bool aIsTrusted,
-                       int32_t aModifierMask)
+                       int32_t aModifierMask,
+                       bool aMatchesContentAccessKey)
  {
-    return HandleAccessKey(aPresContext, aAccessCharCodes, aIsTrusted,
-                           nullptr, eAccessKeyProcessingNormal, aModifierMask);
+    return HandleAccessKey(aEvent, aPresContext, aAccessCharCodes,
+                           aMatchesContentAccessKey, nullptr,
+                           eAccessKeyProcessingNormal, aModifierMask);
  }

  nsresult SetCursor(int32_t aCursor, imgIContainer* aContainer,
@@ -442,9 +444,10 @@ protected:
   * on descendant docshells first, then on the ancestor (with |aBubbledFrom|
   * set to the docshell associated with |this|), until something matches.
   *
+   * @param aEvent the keyboard event triggering the acccess key
   * @param aPresContext the presentation context
   * @param aAccessCharCodes list of charcode candidates
-   * @param aIsTrusted true if triggered by a trusted key event
+   * @param aMatchesContentAccessKey true if the content accesskey modifier is pressed
   * @param aBubbledFrom is used by an ancestor to avoid calling HandleAccessKey()
   *        on the child the call originally came from, i.e. this is the child
   *        that recursively called us in its Up phase. The initial caller
@@ -454,15 +457,16 @@ protected:
   *        processing children and Up when recursively calling its ancestor.
   * @param aModifierMask modifier mask for the key event
   */
-  bool HandleAccessKey(nsPresContext* aPresContext,
-                     nsTArray<uint32_t>& aAccessCharCodes,
-                     bool aIsTrusted,
-                     nsIDocShellTreeItem* aBubbledFrom,
-                     ProcessingAccessKeyState aAccessKeyState,
-                     int32_t aModifierMask);
+  bool HandleAccessKey(WidgetKeyboardEvent* aEvent,
+                       nsPresContext* aPresContext,
+                       nsTArray<uint32_t>& aAccessCharCodes,
+                       bool aMatchesContentAccessKey,
+                       nsIDocShellTreeItem* aBubbledFrom,
+                       ProcessingAccessKeyState aAccessKeyState,
+                       int32_t aModifierMask);

  bool ExecuteAccessKey(nsTArray<uint32_t>& aAccessCharCodes,
-                          bool aIsTrustedEvent);
+                        bool aIsTrustedEvent);

  //---------------------------------------------
  // DocShell Focus Traversal Methods
@@ -184,7 +184,7 @@ KeyboardEvent::CharCode()
 {
  // If this event is initialized with ctor, we shouldn't check event type.
  if (mInitializedByCtor) {
-    return mEvent->AsKeyboardEvent()->charCode;
+    return mEvent->AsKeyboardEvent()->mCharCode;
  }

  switch (mEvent->mMessage) {
@@ -198,7 +198,8 @@ KeyboardEvent::CharCode()
  case eAfterKeyUp:
    return 0;
  case eKeyPress:
-    return mEvent->AsKeyboardEvent()->charCode;
+  case eAccessKeyNotFound:
+    return mEvent->AsKeyboardEvent()->mCharCode;
  default:
    break;
  }
@@ -218,11 +219,11 @@ KeyboardEvent::KeyCode()
 {
  // If this event is initialized with ctor, we shouldn't check event type.
  if (mInitializedByCtor) {
-    return mEvent->AsKeyboardEvent()->keyCode;
+    return mEvent->AsKeyboardEvent()->mKeyCode;
  }

  if (mEvent->HasKeyEventMessage()) {
-    return mEvent->AsKeyboardEvent()->keyCode;
+    return mEvent->AsKeyboardEvent()->mKeyCode;
  }
  return 0;
 }
@@ -249,7 +250,7 @@ KeyboardEvent::Which()
      //Special case for 4xp bug 62878.  Try to make value of which
      //more closely mirror the values that 4.x gave for RETURN and BACKSPACE
      {
-        uint32_t keyCode = mEvent->AsKeyboardEvent()->keyCode;
+        uint32_t keyCode = mEvent->AsKeyboardEvent()->mKeyCode;
        if (keyCode == NS_VK_RETURN || keyCode == NS_VK_BACK) {
          return keyCode;
        }
@@ -274,7 +275,7 @@ KeyboardEvent::GetLocation(uint32_t* aLocation)
 uint32_t
 KeyboardEvent::Location()
 {
-  return mEvent->AsKeyboardEvent()->location;
+  return mEvent->AsKeyboardEvent()->mLocation;
 }

 // static
@@ -309,7 +310,7 @@ KeyboardEvent::InitWithKeyboardEventInit(EventTarget* aOwner,
  mInitializedWhichValue = aParam.mWhich;

  WidgetKeyboardEvent* internalEvent = mEvent->AsKeyboardEvent();
-  internalEvent->location = aParam.mLocation;
+  internalEvent->mLocation = aParam.mLocation;
  internalEvent->mIsRepeat = aParam.mRepeat;
  internalEvent->mIsComposing = aParam.mIsComposing;
  internalEvent->mKeyNameIndex =
@@ -341,8 +342,8 @@ KeyboardEvent::InitKeyEvent(const nsAString& aType,

  WidgetKeyboardEvent* keyEvent = mEvent->AsKeyboardEvent();
  keyEvent->InitBasicModifiers(aCtrlKey, aAltKey, aShiftKey, aMetaKey);
-  keyEvent->keyCode = aKeyCode;
-  keyEvent->charCode = aCharCode;
+  keyEvent->mKeyCode = aKeyCode;
+  keyEvent->mCharCode = aCharCode;

  return NS_OK;
 }
@@ -37,9 +37,9 @@ MouseEvent::MouseEvent(EventTarget* aOwner,
  }

  if (mouseEvent) {
-    MOZ_ASSERT(mouseEvent->reason != WidgetMouseEvent::eSynthesized,
+    MOZ_ASSERT(mouseEvent->mReason != WidgetMouseEvent::eSynthesized,
               "Don't dispatch DOM events from synthesized mouse events");
-    mDetail = mouseEvent->clickCount;
+    mDetail = mouseEvent->mClickCount;
  }
 }

@@ -89,7 +89,7 @@ MouseEvent::InitMouseEvent(const nsAString& aType,

      WidgetMouseEvent* mouseEvent = mEvent->AsMouseEvent();
      if (mouseEvent) {
-        mouseEvent->clickCount = aDetail;
+        mouseEvent->mClickCount = aDetail;
      }
      break;
    }
@@ -140,7 +140,7 @@ NotifyPaintEvent::Serialize(IPC::Message* aMsg,
 }

 NS_IMETHODIMP_(bool)
-NotifyPaintEvent::Deserialize(const IPC::Message* aMsg, void** aIter)
+NotifyPaintEvent::Deserialize(const IPC::Message* aMsg, PickleIterator* aIter)
 {
  NS_ENSURE_TRUE(Event::Deserialize(aMsg, aIter), false);

@@ -43,7 +43,7 @@ public:
    return Event::DuplicatePrivateData();
  }
  NS_IMETHOD_(void) Serialize(IPC::Message* aMsg, bool aSerializeInterfaceType) override;
-  NS_IMETHOD_(bool) Deserialize(const IPC::Message* aMsg, void** aIter) override;
+  NS_IMETHOD_(bool) Deserialize(const IPC::Message* aMsg, PickleIterator* aIter) override;

  virtual JSObject* WrapObjectInternal(JSContext* aCx, JS::Handle<JSObject*> aGivenProto) override
  {
@@ -80,7 +80,7 @@ ScrollAreaEvent::Serialize(IPC::Message* aMsg,
 }

 NS_IMETHODIMP_(bool)
-ScrollAreaEvent::Deserialize(const IPC::Message* aMsg, void** aIter)
+ScrollAreaEvent::Deserialize(const IPC::Message* aMsg, PickleIterator* aIter)
 {
  NS_ENSURE_TRUE(Event::Deserialize(aMsg, aIter), false);

@@ -37,7 +37,7 @@ public:
    return Event::DuplicatePrivateData();
  }
  NS_IMETHOD_(void) Serialize(IPC::Message* aMsg, bool aSerializeInterfaceType) override;
-  NS_IMETHOD_(bool) Deserialize(const IPC::Message* aMsg, void** aIter) override;
+  NS_IMETHOD_(bool) Deserialize(const IPC::Message* aMsg, PickleIterator* aIter) override;

  virtual JSObject* WrapObjectInternal(JSContext* aCx, JS::Handle<JSObject*> aGivenProto) override
  {
@@ -343,7 +343,7 @@ bool
 UIEvent::IsChar() const
 {
  WidgetKeyboardEvent* keyEvent = mEvent->AsKeyboardEvent();
-  return keyEvent ? keyEvent->isChar : false;
+  return keyEvent ? keyEvent->mIsChar : false;
 }

 mozilla::dom::Event*
@@ -389,7 +389,7 @@ UIEvent::Serialize(IPC::Message* aMsg, bool aSerializeInterfaceType)
 }

 NS_IMETHODIMP_(bool)
-UIEvent::Deserialize(const IPC::Message* aMsg, void** aIter)
+UIEvent::Deserialize(const IPC::Message* aMsg, PickleIterator* aIter)
 {
  NS_ENSURE_TRUE(Event::Deserialize(aMsg, aIter), false);
  NS_ENSURE_TRUE(IPC::ReadParam(aMsg, aIter, &mDetail), false);
@@ -38,7 +38,7 @@ public:
  NS_FORWARD_TO_EVENT_NO_SERIALIZATION_NO_DUPLICATION
  NS_IMETHOD DuplicatePrivateData() override;
  NS_IMETHOD_(void) Serialize(IPC::Message* aMsg, bool aSerializeInterfaceType) override;
-  NS_IMETHOD_(bool) Deserialize(const IPC::Message* aMsg, void** aIter) override;
+  NS_IMETHOD_(bool) Deserialize(const IPC::Message* aMsg, PickleIterator* aIter) override;


  static already_AddRefed<UIEvent> Constructor(const GlobalObject& aGlobal,
@@ -133,7 +133,7 @@ protected:
    UIEvent::Serialize(aMsg, aSerializeInterfaceType);      \
  }                                                         \
  NS_IMETHOD_(bool) Deserialize(const IPC::Message* aMsg,   \
-                                void** aIter) override      \
+                                PickleIterator* aIter) override \
  {                                                         \
    return UIEvent::Deserialize(aMsg, aIter);               \
  }
@@ -53,7 +53,7 @@ struct ParamTraits<nsIDOMGeoPositionCoords*>
  }

  // Function to de-serialize a geoposition
-  static bool Read(const Message* aMsg, void **aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    // Check if it is the null pointer we have transfered
    bool isNull;
@@ -119,7 +119,7 @@ struct ParamTraits<nsIDOMGeoPosition*>
  }

  // Function to de-serialize a geoposition
-  static bool Read(const Message* aMsg, void **aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    // Check if it is the null pointer we have transfered
    bool isNull;
@@ -293,9 +293,9 @@ HTMLButtonElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
          // For backwards compat, trigger buttons with space or enter
          // (bug 25300)
          WidgetKeyboardEvent* keyEvent = aVisitor.mEvent->AsKeyboardEvent();
-          if ((keyEvent->keyCode == NS_VK_RETURN &&
+          if ((keyEvent->mKeyCode == NS_VK_RETURN &&
               eKeyPress == aVisitor.mEvent->mMessage) ||
-              (keyEvent->keyCode == NS_VK_SPACE &&
+              (keyEvent->mKeyCode == NS_VK_SPACE &&
               eKeyUp == aVisitor.mEvent->mMessage)) {
            DispatchSimulatedClick(this, aVisitor.mEvent->IsTrusted(),
                                   aVisitor.mPresContext);
@@ -3423,7 +3423,8 @@ HTMLInputElement::PreHandleEvent(EventChainPreVisitor& aVisitor)
      }
    } else if (aVisitor.mEvent->mMessage == eKeyUp) {
      WidgetKeyboardEvent* keyEvent = aVisitor.mEvent->AsKeyboardEvent();
-      if ((keyEvent->keyCode == NS_VK_UP || keyEvent->keyCode == NS_VK_DOWN) &&
+      if ((keyEvent->mKeyCode == NS_VK_UP ||
+           keyEvent->mKeyCode == NS_VK_DOWN) &&
          !(keyEvent->IsShift() || keyEvent->IsControl() ||
            keyEvent->IsAlt() || keyEvent->IsMeta() ||
            keyEvent->IsAltGraph() || keyEvent->IsFn() ||
@@ -3893,7 +3894,7 @@ HTMLInputElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
    if (mType ==  NS_FORM_INPUT_NUMBER &&
        keyEvent && keyEvent->mMessage == eKeyPress &&
        aVisitor.mEvent->IsTrusted() &&
-        (keyEvent->keyCode == NS_VK_UP || keyEvent->keyCode == NS_VK_DOWN) &&
+        (keyEvent->mKeyCode == NS_VK_UP || keyEvent->mKeyCode == NS_VK_DOWN) &&
        !(keyEvent->IsShift() || keyEvent->IsControl() ||
          keyEvent->IsAlt() || keyEvent->IsMeta() ||
          keyEvent->IsAltGraph() || keyEvent->IsFn() ||
@@ -3910,7 +3911,7 @@ HTMLInputElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
      // just ignore aVisitor.mEventStatus here and go ahead and handle the
      // event to increase/decrease the value of the number control.
      if (!aVisitor.mEvent->DefaultPreventedByContent() && IsMutable()) {
-        StepNumberControlForUserEvent(keyEvent->keyCode == NS_VK_UP ? 1 : -1);
+        StepNumberControlForUserEvent(keyEvent->mKeyCode == NS_VK_UP ? 1 : -1);
        aVisitor.mEventStatus = nsEventStatus_eConsumeNoDefault;
      }
    } else if (nsEventStatus_eIgnore == aVisitor.mEventStatus) {
@@ -3948,15 +3949,15 @@ HTMLInputElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
          // space or enter (bug 25300)
          WidgetKeyboardEvent* keyEvent = aVisitor.mEvent->AsKeyboardEvent();
          if ((aVisitor.mEvent->mMessage == eKeyPress &&
-               keyEvent->keyCode == NS_VK_RETURN) ||
+               keyEvent->mKeyCode == NS_VK_RETURN) ||
              (aVisitor.mEvent->mMessage == eKeyUp &&
-               keyEvent->keyCode == NS_VK_SPACE)) {
+               keyEvent->mKeyCode == NS_VK_SPACE)) {
            switch(mType) {
              case NS_FORM_INPUT_CHECKBOX:
              case NS_FORM_INPUT_RADIO:
              {
                // Checkbox and Radio try to submit on Enter press
-                if (keyEvent->keyCode != NS_VK_SPACE) {
+                if (keyEvent->mKeyCode != NS_VK_SPACE) {
                  MaybeSubmitForm(aVisitor.mPresContext);

                  break;  // If we are submitting, do not send click event
@@ -3980,7 +3981,7 @@ HTMLInputElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
              mType == NS_FORM_INPUT_RADIO && !keyEvent->IsAlt() &&
              !keyEvent->IsControl() && !keyEvent->IsMeta()) {
            bool isMovingBack = false;
-            switch (keyEvent->keyCode) {
+            switch (keyEvent->mKeyCode) {
              case NS_VK_UP:
              case NS_VK_LEFT:
                isMovingBack = true;
@@ -4023,7 +4024,7 @@ HTMLInputElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
           */

          if (aVisitor.mEvent->mMessage == eKeyPress &&
-              keyEvent->keyCode == NS_VK_RETURN &&
+              keyEvent->mKeyCode == NS_VK_RETURN &&
               (IsSingleLineTextControl(false, mType) ||
                mType == NS_FORM_INPUT_NUMBER ||
                IsExperimentalMobileType(mType))) {
@@ -4035,14 +4036,14 @@ HTMLInputElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
          if (aVisitor.mEvent->mMessage == eKeyPress &&
              mType == NS_FORM_INPUT_RANGE && !keyEvent->IsAlt() &&
              !keyEvent->IsControl() && !keyEvent->IsMeta() &&
-              (keyEvent->keyCode == NS_VK_LEFT ||
-               keyEvent->keyCode == NS_VK_RIGHT ||
-               keyEvent->keyCode == NS_VK_UP ||
-               keyEvent->keyCode == NS_VK_DOWN ||
-               keyEvent->keyCode == NS_VK_PAGE_UP ||
-               keyEvent->keyCode == NS_VK_PAGE_DOWN ||
-               keyEvent->keyCode == NS_VK_HOME ||
-               keyEvent->keyCode == NS_VK_END)) {
+              (keyEvent->mKeyCode == NS_VK_LEFT ||
+               keyEvent->mKeyCode == NS_VK_RIGHT ||
+               keyEvent->mKeyCode == NS_VK_UP ||
+               keyEvent->mKeyCode == NS_VK_DOWN ||
+               keyEvent->mKeyCode == NS_VK_PAGE_UP ||
+               keyEvent->mKeyCode == NS_VK_PAGE_DOWN ||
+               keyEvent->mKeyCode == NS_VK_HOME ||
+               keyEvent->mKeyCode == NS_VK_END)) {
            Decimal minimum = GetMinimum();
            Decimal maximum = GetMaximum();
            MOZ_ASSERT(minimum.isFinite() && maximum.isFinite());
@@ -4054,7 +4055,7 @@ HTMLInputElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
              }
              MOZ_ASSERT(value.isFinite() && step.isFinite());
              Decimal newValue;
-              switch (keyEvent->keyCode) {
+              switch (keyEvent->mKeyCode) {
                case  NS_VK_LEFT:
                  newValue = value + (GetComputedDirectionality() == eDir_RTL
                                        ? step : -step);
@@ -4301,7 +4302,7 @@ HTMLInputElement::PostHandleEventForRangeThumb(EventChainPostVisitor& aVisitor)

    case eKeyPress:
      if (mIsDraggingRange &&
-          aVisitor.mEvent->AsKeyboardEvent()->keyCode == NS_VK_ESCAPE) {
+          aVisitor.mEvent->AsKeyboardEvent()->mKeyCode == NS_VK_ESCAPE) {
        CancelRangeThumbDrag();
      }
      break;
@@ -161,7 +161,7 @@ HTMLLabelElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
          }
          // Only set focus on the first click of multiple clicks to prevent
          // to prevent immediate de-focus.
-          if (mouseEvent->clickCount <= 1) {
+          if (mouseEvent->mClickCount <= 1) {
            nsIFocusManager* fm = nsFocusManager::GetFocusManager();
            if (fm) {
              // Use FLAG_BYMOVEFOCUS here so that the label is scrolled to.
@@ -77,16 +77,16 @@ HTMLSummaryElement::PostHandleEvent(EventChainPostVisitor& aVisitor)

    switch (event->mMessage) {
      case eKeyPress:
-        if (keyboardEvent->charCode == nsIDOMKeyEvent::DOM_VK_SPACE) {
+        if (keyboardEvent->mCharCode == ' ') {
          // Consume 'space' key to prevent scrolling the page down.
          aVisitor.mEventStatus = nsEventStatus_eConsumeNoDefault;
        }

-        dispatchClick = keyboardEvent->keyCode == nsIDOMKeyEvent::DOM_VK_RETURN;
+        dispatchClick = keyboardEvent->mKeyCode == NS_VK_RETURN;
        break;

      case eKeyUp:
-        dispatchClick = keyboardEvent->keyCode == nsIDOMKeyEvent::DOM_VK_SPACE;
+        dispatchClick = keyboardEvent->mKeyCode == NS_VK_SPACE;
        break;

      default:
@@ -26,7 +26,7 @@ struct ParamTraits<mozilla::dom::indexedDB::Key>
    WriteParam(aMsg, aParam.mBuffer);
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    return ReadParam(aMsg, aIter, &aResult->mBuffer);
  }
@@ -55,7 +55,7 @@ struct ParamTraits<mozilla::dom::indexedDB::KeyPath>
    WriteParam(aMsg, aParam.mStrings);
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    return ReadParam(aMsg, aIter, &aResult->mType) &&
           ReadParam(aMsg, aIter, &aResult->mStrings);
@@ -11,6 +11,7 @@ interface nsIDOMEventTarget;
 [ptr] native DOMEventPtr(mozilla::dom::Event);
 [ptr] native IPCMessagePtr(IPC::Message);
 [ptr] native ConstIPCMessagePtr(const IPC::Message);
+[ptr] native PickleIterator(PickleIterator);
 [ptr] native EventTargetPtr(mozilla::dom::EventTarget);
 %{C++
 #ifdef ERROR
@@ -23,6 +24,7 @@ class nsInvalidateRequestList;
 namespace IPC {
 class Message;
 }
+class PickleIterator;
 namespace mozilla {
 namespace dom {
 class Event;
@@ -211,7 +213,7 @@ interface nsIDOMEvent : nsISupports
  [noscript,notxpcom] void SetTrusted(in boolean aTrusted);
  [notxpcom] void Serialize(in IPCMessagePtr aMsg,
                            in boolean aSerializeInterfaceType);
-  [notxpcom] boolean Deserialize(in ConstIPCMessagePtr aMsg, out voidPtr aIter);
+  [notxpcom] boolean Deserialize(in ConstIPCMessagePtr aMsg, in PickleIterator aIter);
  [noscript,notxpcom] void SetOwner(in EventTargetPtr aOwner);
  [notxpcom] DOMEventPtr InternalDOMEvent();
  [noscript] void stopCrossProcessForwarding();
@@ -62,7 +62,7 @@ struct ParamTraits<mozilla::dom::IdType<T>>
    WriteParam(aMsg, aParam.mId);
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    return ReadParam(aMsg, aIter, &aResult->mId);
  }
@@ -491,6 +491,8 @@ parent:
     */
    sync GetTabCount() returns (uint32_t value);

+    async AccessKeyNotHandled(WidgetKeyboardEvent event);
+
 child:
    async NativeSynthesisResponse(uint64_t aObserverId, nsCString aResponse);

@@ -721,11 +723,12 @@ child:
     * A potential accesskey was just pressed. Look for accesskey targets
     * using the list of provided charCodes.
     *
-     * @param charCode array of potential character codes
+     * @param event keyboard event
     * @param isTrusted true if triggered by a trusted key event
     * @param modifierMask indicates which accesskey modifiers are pressed
     */
-    async HandleAccessKey(uint32_t[] charCodes, bool isTrusted, int32_t modifierMask);
+    async HandleAccessKey(WidgetKeyboardEvent event,
+                          uint32_t[] charCodes, int32_t modifierMask);

    /**
     * Propagate a refresh to the child process
@@ -37,7 +37,7 @@ ParamTraits<Principal>::Write(Message* aMsg, const paramType& aParam) {
 }

 bool
-ParamTraits<Principal>::Read(const Message* aMsg, void** aIter, paramType* aResult)
+ParamTraits<Principal>::Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
 {
  bool isNull;
  if (!ReadParam(aMsg, aIter, &isNull)) {
@@ -39,7 +39,7 @@ struct ParamTraits<Principal>
 {
  typedef Principal paramType;
  static void Write(Message* aMsg, const paramType& aParam);
-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult);
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult);
 };

 } // namespace IPC
@@ -105,7 +105,7 @@ StructuredCloneData::WriteIPCParams(IPC::Message* aMsg) const

 bool
 StructuredCloneData::ReadIPCParams(const IPC::Message* aMsg,
-                                   void** aIter)
+                                   PickleIterator* aIter)
 {
  MOZ_ASSERT(!Data());

@@ -15,6 +15,7 @@
 namespace IPC {
 class Message;
 }
+class PickleIterator;

 namespace mozilla {
 namespace dom {
@@ -137,7 +138,7 @@ public:

  // For IPC serialization
  void WriteIPCParams(IPC::Message* aMessage) const;
-  bool ReadIPCParams(const IPC::Message* aMessage, void** aIter);
+  bool ReadIPCParams(const IPC::Message* aMessage, PickleIterator* aIter);

 private:
  uint64_t* MOZ_NON_OWNING_REF mExternalData;
@@ -2078,10 +2078,17 @@ TabChild::RecvRealKeyEvent(const WidgetKeyboardEvent& event,
    mIgnoreKeyPressEvent = status == nsEventStatus_eConsumeNoDefault;
  }

+  // If a response is desired from the content process, resend the key event.
+  // If mAccessKeyForwardedToChild is set, then don't resend the key event yet
+  // as RecvHandleAccessKey will do this.
  if (localEvent.mFlags.mWantReplyFromContentProcess) {
    SendReplyKeyEvent(localEvent);
  }

+  if (localEvent.mAccessKeyForwardedToChild) {
+    SendAccessKeyNotHandled(localEvent);
+  }
+
  if (PresShell::BeforeAfterKeyboardEventEnabled()) {
    SendDispatchAfterKeyboardEvent(localEvent);
  }
@@ -2344,8 +2351,8 @@ TabChild::RecvSwappedWithOtherRemoteLoader(const IPCTabContext& aContext)
 }

 bool
-TabChild::RecvHandleAccessKey(nsTArray<uint32_t>&& aCharCodes,
-                              const bool& aIsTrusted,
+TabChild::RecvHandleAccessKey(const WidgetKeyboardEvent& aEvent,
+                              nsTArray<uint32_t>&& aCharCodes,
                              const int32_t& aModifierMask)
 {
  nsCOMPtr<nsIDocument> document(GetDocument());
@@ -2353,7 +2360,16 @@ TabChild::RecvHandleAccessKey(nsTArray<uint32_t>&& aCharCodes,
  if (presShell) {
    nsPresContext* pc = presShell->GetPresContext();
    if (pc) {
-      pc->EventStateManager()->HandleAccessKey(pc, aCharCodes, aIsTrusted, aModifierMask);
+      if (!pc->EventStateManager()->
+                 HandleAccessKey(&(const_cast<WidgetKeyboardEvent&>(aEvent)),
+                                 pc, aCharCodes,
+                                 aModifierMask, true)) {
+        // If no accesskey was found, inform the parent so that accesskeys on
+        // menus can be handled.
+        WidgetKeyboardEvent localEvent(aEvent);
+        localEvent.mWidget = mPuppetWidget;
+        SendAccessKeyNotHandled(localEvent);
+      }
    }
  }

@@ -536,8 +536,8 @@ public:
  virtual bool
  RecvThemeChanged(nsTArray<LookAndFeelInt>&& aLookAndFeelIntCache) override;

-  virtual bool RecvHandleAccessKey(nsTArray<uint32_t>&& aCharCodes,
-                                   const bool& aIsTrusted,
+  virtual bool RecvHandleAccessKey(const WidgetKeyboardEvent& aEvent,
+                                   nsTArray<uint32_t>&& aCharCodes,
                                   const int32_t& aModifierMask) override;

  virtual bool RecvAudioChannelChangeNotification(const uint32_t& aAudioChannel,
@@ -13,7 +13,7 @@ namespace mozilla {
 namespace dom {

 bool
-ReadRemoteEvent(const IPC::Message* aMsg, void** aIter,
+ReadRemoteEvent(const IPC::Message* aMsg, PickleIterator* aIter,
                RemoteDOMEvent* aResult)
 {
  aResult->mEvent = nullptr;
@@ -24,7 +24,7 @@ struct RemoteDOMEvent
  nsCOMPtr<nsIDOMEvent> mEvent;
 };

-bool ReadRemoteEvent(const IPC::Message* aMsg, void** aIter,
+bool ReadRemoteEvent(const IPC::Message* aMsg, PickleIterator* aIter,
                     mozilla::dom::RemoteDOMEvent* aResult);

 #ifdef MOZ_CRASHREPORTER
@@ -49,7 +49,7 @@ struct ParamTraits<mozilla::dom::RemoteDOMEvent>
    aParam.mEvent->Serialize(aMsg, true);
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    return mozilla::dom::ReadRemoteEvent(aMsg, aIter, aResult);
  }
@@ -75,7 +75,7 @@ struct ParamTraits<mozilla::dom::AudioChannel>
    WriteParam(aMsg, (uint32_t)aValue);
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    uint32_t value;
    if(!ReadParam(aMsg, aIter, &value) ||
@@ -927,12 +927,12 @@ TabParent::ThemeChanged()
 }

 void
-TabParent::HandleAccessKey(nsTArray<uint32_t>& aCharCodes,
-                           const bool& aIsTrusted,
+TabParent::HandleAccessKey(const WidgetKeyboardEvent& aEvent,
+                           nsTArray<uint32_t>& aCharCodes,
                           const int32_t& aModifierMask)
 {
  if (!mIsDestroyed) {
-    Unused << SendHandleAccessKey(aCharCodes, aIsTrusted, aModifierMask);
+    Unused << SendHandleAccessKey(aEvent, aCharCodes, aModifierMask);
  }
 }

@@ -1186,7 +1186,7 @@ bool TabParent::SendRealMouseEvent(WidgetMouseEvent& event)
  ApzAwareEventRoutingToChild(&guid, &blockId, nullptr);

  if (eMouseMove == event.mMessage) {
-    if (event.reason == WidgetMouseEvent::eSynthesized) {
+    if (event.mReason == WidgetMouseEvent::eSynthesized) {
      return SendSynthMouseMoveEvent(event, guid, blockId);
    } else {
      return SendRealMouseMoveEvent(event, guid, blockId);
@@ -2069,6 +2069,31 @@ TabParent::RecvDispatchAfterKeyboardEvent(const WidgetKeyboardEvent& aEvent)
  return true;
 }

+bool
+TabParent::RecvAccessKeyNotHandled(const WidgetKeyboardEvent& aEvent)
+{
+  NS_ENSURE_TRUE(mFrameElement, true);
+
+  WidgetKeyboardEvent localEvent(aEvent);
+  localEvent.mMessage = eAccessKeyNotFound;
+  localEvent.mAccessKeyForwardedToChild = false;
+
+  // Here we convert the WidgetEvent that we received to an nsIDOMEvent
+  // to be able to dispatch it to the <browser> element as the target element.
+  nsIDocument* doc = mFrameElement->OwnerDoc();
+  nsIPresShell* presShell = doc->GetShell();
+  NS_ENSURE_TRUE(presShell, true);
+
+  if (presShell->CanDispatchEvent()) {
+    nsPresContext* presContext = presShell->GetPresContext();
+    NS_ENSURE_TRUE(presContext, true);
+
+    EventDispatcher::Dispatch(mFrameElement, presContext, &localEvent);
+  }
+
+  return true;
+}
+
 bool
 TabParent::HandleQueryContentEvent(WidgetQueryContentEvent& aEvent)
 {
@@ -164,6 +164,9 @@ public:
  virtual bool
  RecvDispatchAfterKeyboardEvent(const WidgetKeyboardEvent& aEvent) override;

+  virtual bool
+  RecvAccessKeyNotHandled(const WidgetKeyboardEvent& aEvent) override;
+
  virtual bool RecvBrowserFrameOpenWindow(PBrowserParent* aOpener,
                                          PRenderFrameParent* aRenderFrame,
                                          const nsString& aURL,
@@ -357,8 +360,8 @@ public:

  void ThemeChanged();

-  void HandleAccessKey(nsTArray<uint32_t>& aCharCodes,
-                       const bool& aIsTrusted,
+  void HandleAccessKey(const WidgetKeyboardEvent& aEvent,
+                       nsTArray<uint32_t>& aCharCodes,
                       const int32_t& aModifierMask);

  void Activate();
@@ -9,7 +9,6 @@
 #include "MediaDecoderStateMachine.h"
 #include "MediaFormatReader.h"
 #include "MP3Demuxer.h"
-#include "mozilla/Preferences.h"
 #include "PDMFactory.h"

 namespace mozilla {
@@ -168,8 +168,6 @@ MediaFormatReader::InitLayersBackendType()
  mLayersBackendType = layerManager->GetCompositorBackendType();
 }

-static bool sIsEMEEnabled = false;
-
 nsresult
 MediaFormatReader::Init()
 {
@@ -183,12 +181,6 @@ MediaFormatReader::Init()
  mVideo.mTaskQueue =
    new FlushableTaskQueue(GetMediaThreadPool(MediaThreadType::PLATFORM_DECODER));

-  static bool sSetupPrefCache = false;
-  if (!sSetupPrefCache) {
-    sSetupPrefCache = true;
-    Preferences::AddBoolVarCache(&sIsEMEEnabled, "media.eme.enabled", false);
-  }
-
  return NS_OK;
 }

@@ -43,7 +43,6 @@
 #include "mozilla/dom/MediaStreamTrackBinding.h"
 #include "mozilla/dom/GetUserMediaRequestBinding.h"
 #include "mozilla/dom/Promise.h"
-#include "mozilla/Preferences.h"
 #include "mozilla/Base64.h"
 #include "mozilla/ipc/BackgroundChild.h"
 #include "mozilla/media/MediaChild.h"
@@ -0,0 +1,72 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "MediaPrefs.h"
+
+#include "mozilla/ClearOnShutdown.h"
+#include "mozilla/Preferences.h"
+#include "mozilla/StaticPtr.h"
+#include "MainThreadUtils.h"
+
+namespace mozilla {
+
+StaticAutoPtr<MediaPrefs> MediaPrefs::sInstance;
+
+MediaPrefs&
+MediaPrefs::GetSingleton()
+{
+  if (!sInstance) {
+    sInstance = new MediaPrefs;
+    ClearOnShutdown(&sInstance);
+  }
+  MOZ_ASSERT(SingletonExists());
+  return *sInstance;
+}
+
+bool
+MediaPrefs::SingletonExists()
+{
+  return sInstance != nullptr;
+}
+
+MediaPrefs::MediaPrefs()
+{
+  MediaPrefs::AssertMainThread();
+}
+
+void MediaPrefs::AssertMainThread()
+{
+  MOZ_ASSERT(NS_IsMainThread(), "this code must be run on the main thread");
+}
+
+void MediaPrefs::PrefAddVarCache(bool* aVariable,
+                                 const char* aPref,
+                                 bool aDefault)
+{
+  Preferences::AddBoolVarCache(aVariable, aPref, aDefault);
+}
+
+void MediaPrefs::PrefAddVarCache(int32_t* aVariable,
+                                 const char* aPref,
+                                 int32_t aDefault)
+{
+  Preferences::AddIntVarCache(aVariable, aPref, aDefault);
+}
+
+void MediaPrefs::PrefAddVarCache(uint32_t* aVariable,
+                                 const char* aPref,
+                                 uint32_t aDefault)
+{
+  Preferences::AddUintVarCache(aVariable, aPref, aDefault);
+}
+
+void MediaPrefs::PrefAddVarCache(float* aVariable,
+                                 const char* aPref,
+                                 float aDefault)
+{
+  Preferences::AddFloatVarCache(aVariable, aPref, aDefault);
+}
+
+} // namespace mozilla
@@ -0,0 +1,140 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef MEDIA_PREFS_H
+#define MEDIA_PREFS_H
+
+// First time MediaPrefs::GetSingleton() needs to be called on the main thread,
+// before any of the methods accessing the values are used, but after
+// the Preferences system has been initialized.
+
+// The static methods to access the preference value are safe to call
+// from any thread after that first call.
+
+// To register a preference, you need to add a line in this file using
+// the DECL_MEDIA_PREF macro.
+//
+// For example this line in the .h:
+//   DECL_MEDIA_PREF("media.resampling.enabled",AudioSinkResampling,bool,false);
+// means that you can call
+//   const bool& var = MediaPrefs::AudioSinkResampling();
+// from any thread, you will get the most up to date preference value of
+// "media.resampling.enabled".  If the value is not set, the default would be
+// false.
+
+#define DECL_MEDIA_PREF(Pref, Name, Type, Default)                            \
+public:                                                                       \
+static const Type& Name() { MOZ_ASSERT(SingletonExists()); return GetSingleton().mPref##Name.mValue; } \
+private:                                                                      \
+static const char* Get##Name##PrefName() { return Pref; }                     \
+static Type Get##Name##PrefDefault() { return Default; }                      \
+PrefTemplate<Type, Get##Name##PrefDefault, Get##Name##PrefName> mPref##Name
+
+// Custom Definitions.
+#define GMP_DEFAULT_ASYNC_SHUTDOWN_TIMEOUT 3000
+#define TEST_PREFERENCE_FAKE_RECOGNITION_SERVICE "media.webspeech.test.fake_recognition_service"
+
+namespace mozilla {
+
+template<class T> class StaticAutoPtr;
+
+class MediaPrefs final
+{
+
+private:
+  // Since we cannot use const char*, use a function that returns it.
+  template <class T, T Default(), const char* Pref()>
+  class PrefTemplate
+  {
+  public:
+    PrefTemplate()
+    : mValue(Default())
+    {
+      Register(Pref());
+    }
+    T mValue;
+  private:
+    void Register(const char* aPreference)
+    {
+      AssertMainThread();
+      PrefAddVarCache(&mValue, aPreference, mValue);
+    }
+  };
+
+  // This is where DECL_MEDIA_PREF for each of the preferences should go.
+
+  // AudioSink
+  DECL_MEDIA_PREF("accessibility.monoaudio.enable",           MonoAudio, bool, false);
+  DECL_MEDIA_PREF("media.resampling.enabled",                 AudioSinkResampling, bool, false);
+  DECL_MEDIA_PREF("media.resampling.rate",                    AudioSinkResampleRate, uint32_t, 48000);
+  DECL_MEDIA_PREF("media.forcestereo.enabled",                AudioSinkForceStereo, bool, true);
+
+  // PlatformDecoderModule
+  DECL_MEDIA_PREF("media.apple.forcevda",                     AppleForceVDA, bool, false);
+  DECL_MEDIA_PREF("media.gmp.insecure.allow",                 GMPAllowInsecure, bool, false);
+  DECL_MEDIA_PREF("media.gmp.async-shutdown-timeout",         GMPAsyncShutdownTimeout, uint32_t, GMP_DEFAULT_ASYNC_SHUTDOWN_TIMEOUT);
+  DECL_MEDIA_PREF("media.eme.enabled",                        EMEEnabled, bool, false);
+  DECL_MEDIA_PREF("media.use-blank-decoder",                  PDMUseBlankDecoder, bool, false);
+#ifdef MOZ_GONK_MEDIACODEC
+  DECL_MEDIA_PREF("media.gonk.enabled",                       PDMGonkDecoderEnabled, bool, true);
+#endif
+#ifdef MOZ_WIDGET_ANDROID
+  DECL_MEDIA_PREF("media.android-media-codec.enabled",        PDMAndroidMediaCodecEnabled, bool, false);
+  DECL_MEDIA_PREF("media.android-media-codec.preferred",      PDMAndroidMediaCodecPreferred, bool, false);
+#endif
+#ifdef MOZ_FFMPEG
+  DECL_MEDIA_PREF("media.ffmpeg.enabled",                     PDMFFmpegEnabled, bool, true);
+#endif
+#ifdef MOZ_FFVPX
+  DECL_MEDIA_PREF("media.ffvpx.enabled",                      PDMFFVPXEnabled, bool, true);
+#endif
+#ifdef XP_WIN
+  DECL_MEDIA_PREF("media.wmf.enabled",                        PDMWMFEnabled, bool, true);
+  DECL_MEDIA_PREF("media.webm.intel_decoder.enabled",         PDMWMFIntelDecoderEnabled, bool, false);
+  DECL_MEDIA_PREF("media.wmf.low-latency.enabled",            PDMWMFLowLatencyEnabled, bool, false);
+  DECL_MEDIA_PREF("media.wmf.decoder.thread-count",           PDMWMFThreadCount, int32_t, -1);
+#endif
+  DECL_MEDIA_PREF("media.decoder.fuzzing.enabled",            PDMFuzzingEnabled, bool, false);
+  DECL_MEDIA_PREF("media.decoder.fuzzing.video-output-minimum-interval-ms", PDMFuzzingInterval, uint32_t, 0);
+  DECL_MEDIA_PREF("media.decoder.fuzzing.dont-delay-inputexhausted", PDMFuzzingDelayInputExhausted, bool, true);
+  DECL_MEDIA_PREF("media.gmp.decoder.enabled",                PDMGMPEnabled, bool, true);
+  DECL_MEDIA_PREF("media.gmp.decoder.aac",                    GMPAACPreferred, uint32_t, 0);
+  DECL_MEDIA_PREF("media.gmp.decoder.h264",                   GMPH264Preferred, uint32_t, 0);
+
+  // WebSpeech
+  DECL_MEDIA_PREF("media.webspeech.synth.force_global_queue", WebSpeechForceGlobal, bool, false);
+  DECL_MEDIA_PREF("media.webspeech.test.enable",              WebSpeechTestEnabled, bool, false);
+  DECL_MEDIA_PREF("media.webspeech.test.fake_fsm_events",     WebSpeechFakeFSMEvents, bool, false);
+  DECL_MEDIA_PREF(TEST_PREFERENCE_FAKE_RECOGNITION_SERVICE,   WebSpeechFakeRecognitionService, bool, false);
+  DECL_MEDIA_PREF("media.webspeech.recognition.enable",       WebSpeechRecognitionEnabled, bool, false);
+  DECL_MEDIA_PREF("media.webspeech.recognition.force_enable", WebSpeechRecognitionForceEnabled, bool, false);
+
+public:
+  // Manage the singleton:
+  static MediaPrefs& GetSingleton();
+  static bool SingletonExists();
+
+private:
+  template<class T> friend class StaticAutoPtr;
+  static StaticAutoPtr<MediaPrefs> sInstance;
+
+  // Creating these to avoid having to include Preferences.h in the .h
+  static void PrefAddVarCache(bool*, const char*, bool);
+  static void PrefAddVarCache(int32_t*, const char*, int32_t);
+  static void PrefAddVarCache(uint32_t*, const char*, uint32_t);
+  static void PrefAddVarCache(float*, const char*, float);
+
+  static void AssertMainThread();
+
+  MediaPrefs();
+  MediaPrefs(const MediaPrefs&) = delete;
+  MediaPrefs& operator=(const MediaPrefs&) = delete;
+};
+
+#undef DECL_MEDIA_PREF /* Don't need it outside of this file */
+
+} // namespace mozilla
+
+#endif /* MEDIA_PREFS_H */
@@ -132,7 +132,7 @@ struct ParamTraits<GMPSimulcastStream>
    WriteParam(aMsg, aParam.mQPMax);
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    if (ReadParam(aMsg, aIter, &(aResult->mWidth)) &&
        ReadParam(aMsg, aIter, &(aResult->mHeight)) &&
@@ -181,7 +181,7 @@ struct ParamTraits<GMPVideoCodec>
    WriteParam(aMsg, aParam.mMode);
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    // NOTE: make sure this matches any versions supported
    if (!ReadParam(aMsg, aIter, &(aResult->mGMPApiVersion)) ||
@@ -22,6 +22,7 @@
 #include "mozilla/SandboxInfo.h"
 #endif
 #include "GMPContentParent.h"
+#include "MediaPrefs.h"

 #ifdef XP_WIN
 #include "WMFDecoderModule.h"
@@ -257,7 +258,7 @@ GMPParent::EnsureAsyncShutdownTimeoutSet()
   return rv;
  }

-  int32_t timeout = GMP_DEFAULT_ASYNC_SHUTDONW_TIMEOUT;
+  int32_t timeout = MediaPrefs::GMPAsyncShutdownTimeout();
  RefPtr<GeckoMediaPluginServiceParent> service =
    GeckoMediaPluginServiceParent::GetSingleton();
  if (service) {
@@ -13,7 +13,6 @@
 #include "GMPVideoDecoderParent.h"
 #include "nsIObserverService.h"
 #include "GeckoChildProcessHost.h"
-#include "mozilla/Preferences.h"
 #include "mozilla/ClearOnShutdown.h"
 #include "mozilla/SyncRunnable.h"
 #include "nsXPCOMPrivate.h"
@@ -24,7 +23,6 @@
 #include "GMPDecryptorParent.h"
 #include "GMPAudioDecoderParent.h"
 #include "nsComponentManagerUtils.h"
-#include "mozilla/Preferences.h"
 #include "runnable_utils.h"
 #include "VideoUtils.h"
 #if defined(XP_LINUX) && defined(MOZ_GMP_SANDBOX)
@@ -31,8 +31,6 @@ namespace gmp {

 class GetGMPContentParentCallback;

-#define GMP_DEFAULT_ASYNC_SHUTDONW_TIMEOUT 3000
-
 class GeckoMediaPluginService : public mozIGeckoMediaPluginService
                              , public nsIObserver
 {
@@ -15,8 +15,6 @@
 namespace mozilla {
 namespace gmp {

-#define GMP_DEFAULT_ASYNC_SHUTDONW_TIMEOUT 3000
-
 class GMPContentParent;
 class GMPServiceChild;

@@ -22,7 +22,6 @@
 #include "GMPDecryptorParent.h"
 #include "GMPAudioDecoderParent.h"
 #include "nsComponentManagerUtils.h"
-#include "mozilla/Preferences.h"
 #include "runnable_utils.h"
 #include "VideoUtils.h"
 #if defined(XP_LINUX) && defined(MOZ_GMP_SANDBOX)
@@ -41,6 +40,7 @@
 #include "nsIXULRuntime.h"
 #include "GMPDecoderModule.h"
 #include <limits>
+#include "MediaPrefs.h"

 namespace mozilla {

@@ -80,10 +80,6 @@ NS_IMPL_ISUPPORTS_INHERITED(GeckoMediaPluginServiceParent,
                            GeckoMediaPluginService,
                            mozIGeckoMediaPluginChromeService)

-static int32_t sMaxAsyncShutdownWaitMs = 0;
-static bool sAllowInsecureGMP = false;
-static bool sHaveSetGMPServiceParentPrefCaches = false;
-
 GeckoMediaPluginServiceParent::GeckoMediaPluginServiceParent()
  : mShuttingDown(false)
 #ifdef MOZ_CRASHREPORTER
@@ -95,14 +91,6 @@ GeckoMediaPluginServiceParent::GeckoMediaPluginServiceParent()
  , mLoadPluginsFromDiskComplete(false)
 {
  MOZ_ASSERT(NS_IsMainThread());
-  if (!sHaveSetGMPServiceParentPrefCaches) {
-    sHaveSetGMPServiceParentPrefCaches = true;
-    Preferences::AddIntVarCache(&sMaxAsyncShutdownWaitMs,
-                                "media.gmp.async-shutdown-timeout",
-                                GMP_DEFAULT_ASYNC_SHUTDONW_TIMEOUT);
-    Preferences::AddBoolVarCache(&sAllowInsecureGMP,
-                                 "media.gmp.insecure.allow", false);
-  }
  mInitPromise.SetMonitor(&mInitPromiseMonitor);
 }

@@ -115,8 +103,7 @@ GeckoMediaPluginServiceParent::~GeckoMediaPluginServiceParent()
 int32_t
 GeckoMediaPluginServiceParent::AsyncShutdownTimeoutMs()
 {
-  MOZ_ASSERT(sHaveSetGMPServiceParentPrefCaches);
-  return sMaxAsyncShutdownWaitMs;
+  return MediaPrefs::GMPAsyncShutdownTimeout();
 }

 nsresult
@@ -1029,7 +1016,7 @@ CreateGMPParent()
 {
 #if defined(XP_LINUX) && defined(MOZ_GMP_SANDBOX)
  if (!SandboxInfo::Get().CanSandboxMedia()) {
-    if (!sAllowInsecureGMP) {
+    if (!MediaPrefs::GMPAllowInsecure()) {
      NS_WARNING("Denying media plugin load due to lack of sandboxing.");
      return nullptr;
    }
@@ -23,8 +23,6 @@ namespace gmp {

 class GMPParent;

-#define GMP_DEFAULT_ASYNC_SHUTDONW_TIMEOUT 3000
-
 class GeckoMediaPluginServiceParent final : public GeckoMediaPluginService
                                          , public mozIGeckoMediaPluginChromeService
 {
@@ -13,6 +13,7 @@
 #include "GMPVideoEncoderProxy.h"
 #include "GMPDecryptorProxy.h"
 #include "GMPServiceParent.h"
+#include "MediaPrefs.h"
 #include "nsAppDirectoryServiceDefs.h"
 #include "nsIFile.h"
 #include "nsISimpleEnumerator.h"
@@ -33,6 +34,7 @@ struct GMPTestRunner
 {
  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(GMPTestRunner)

+  GMPTestRunner() { MediaPrefs::GetSingleton(); }
  void DoTest(void (GMPTestRunner::*aTestMethod)(GMPTestMonitor&));
  void RunTestGMPTestCodec1(GMPTestMonitor& aMonitor);
  void RunTestGMPTestCodec2(GMPTestMonitor& aMonitor);
@@ -16,6 +16,7 @@
 #include "GMPService.h"
 #include "GMPUtils.h"
 #include "mozilla/StaticPtr.h"
+#include "MediaPrefs.h"

 #define GMP_DIR_NAME NS_LITERAL_STRING("gmp-fakeopenh264")
 #define GMP_OLD_VERSION NS_LITERAL_STRING("1.0")
@@ -227,6 +228,8 @@ GMPRemoveTest::~GMPRemoveTest()
 void
 GMPRemoveTest::Setup()
 {
+  // Initialize media preferences.
+  MediaPrefs::GetSingleton();
  GeneratePlugin();
  GetService()->GetThread(getter_AddRefs(mGMPThread));

@@ -7,6 +7,7 @@
 #include "gtest/gtest.h"
 #include "GMPUtils.h"
 #include "nsString.h"
+#include "MediaPrefs.h"

 #include <string>
 #include <vector>
@@ -19,6 +20,8 @@ void TestSplitAt(const char* aInput,
                 size_t aNumExpectedTokens,
                 const char* aExpectedTokens[])
 {
+  // Initialize media preferences.
+  MediaPrefs::GetSingleton();
  nsCString input(aInput);
  nsTArray<nsCString> tokens;
  SplitAt(aDelims, input, tokens);
@@ -12,7 +12,7 @@

 #include "mozilla/CheckedInt.h"
 #include "mozilla/DebugOnly.h"
-#include "gfxPrefs.h"
+#include "MediaPrefs.h"

 namespace mozilla {

@@ -53,10 +53,10 @@ DecodedAudioDataSink::DecodedAudioDataSink(AbstractThread* aThread,
  , mLastEndTime(0)
  , mIsAudioDataAudible(false)
 {
-  bool resampling = gfxPrefs::AudioSinkResampling();
+  bool resampling = MediaPrefs::AudioSinkResampling();

  if (resampling) {
-    mOutputRate = gfxPrefs::AudioSinkResampleRate();
+    mOutputRate = MediaPrefs::AudioSinkResampleRate();
  } else if (mInfo.mRate == 44100 || mInfo.mRate == 48000) {
    // The original rate is of good quality and we want to minimize unecessary
    // resampling. The common scenario being that the sampling rate is one or
@@ -69,10 +69,10 @@ DecodedAudioDataSink::DecodedAudioDataSink(AbstractThread* aThread,
  }
  MOZ_DIAGNOSTIC_ASSERT(mOutputRate, "output rate can't be 0.");

-  bool monoAudioEnabled = gfxPrefs::MonoAudio();
+  bool monoAudioEnabled = MediaPrefs::MonoAudio();

  mOutputChannels = monoAudioEnabled
-    ? 1 : (gfxPrefs::AudioSinkForceStereo() ? 2 : mInfo.mChannels);
+    ? 1 : (MediaPrefs::AudioSinkForceStereo() ? 2 : mInfo.mChannels);
 }

 DecodedAudioDataSink::~DecodedAudioDataSink()
@@ -7,7 +7,6 @@

 #include "mozilla/Logging.h"
 #include "mozilla/dom/HTMLMediaElement.h"
-#include "mozilla/Preferences.h"
 #include "MediaDecoderStateMachine.h"
 #include "MediaSource.h"
 #include "MediaSourceResource.h"
@@ -115,6 +115,7 @@ EXPORTS += [
    'MediaFormatReader.h',
    'MediaInfo.h',
    'MediaMetadataManager.h',
+    'MediaPrefs.h',
    'MediaQueue.h',
    'MediaRecorder.h',
    'MediaResource.h',
@@ -224,6 +225,7 @@ UNIFIED_SOURCES += [
    'MediaFormatReader.cpp',
    'MediaInfo.cpp',
    'MediaManager.cpp',
+    'MediaPrefs.cpp',
    'MediaRecorder.cpp',
    'MediaResource.cpp',
    'MediaShutdownManager.cpp',
@@ -27,7 +27,6 @@

 #include "mozilla/layers/GrallocTextureClient.h"
 #include "mozilla/layers/TextureClient.h"
-#include "mozilla/Preferences.h"
 #include "mozilla/Types.h"
 #include "mozilla/Monitor.h"
 #include "nsMimeTypes.h"
@@ -23,12 +23,12 @@
 #endif
 #include "GMPDecoderModule.h"

-#include "mozilla/Preferences.h"
 #include "mozilla/TaskQueue.h"

 #include "mozilla/SharedThreadPool.h"

 #include "MediaInfo.h"
+#include "MediaPrefs.h"
 #include "FuzzingWrapper.h"
 #include "H264Converter.h"

@@ -46,26 +46,6 @@ namespace mozilla {
 extern already_AddRefed<PlatformDecoderModule> CreateAgnosticDecoderModule();
 extern already_AddRefed<PlatformDecoderModule> CreateBlankDecoderModule();

-bool PDMFactory::sUseBlankDecoder = false;
-#ifdef MOZ_GONK_MEDIACODEC
-bool PDMFactory::sGonkDecoderEnabled = false;
-#endif
-#ifdef MOZ_WIDGET_ANDROID
-bool PDMFactory::sAndroidMCDecoderEnabled = false;
-bool PDMFactory::sAndroidMCDecoderPreferred = false;
-#endif
-bool PDMFactory::sGMPDecoderEnabled = false;
-#ifdef MOZ_FFMPEG
-bool PDMFactory::sFFmpegDecoderEnabled = false;
-#endif
-#ifdef XP_WIN
-bool PDMFactory::sWMFDecoderEnabled = false;
-#endif
-
-bool PDMFactory::sEnableFuzzingWrapper = false;
-uint32_t PDMFactory::sVideoOutputMinimumInterval_ms = 0;
-bool PDMFactory::sDontDelayInputExhausted = false;
-
 /* static */
 void
 PDMFactory::Init()
@@ -77,36 +57,8 @@ PDMFactory::Init()
  }
  alreadyInitialized = true;

-  Preferences::AddBoolVarCache(&sUseBlankDecoder,
-                               "media.use-blank-decoder", false);
-#ifdef MOZ_GONK_MEDIACODEC
-  Preferences::AddBoolVarCache(&sGonkDecoderEnabled,
-                               "media.gonk.enabled", true);
-#endif
-#ifdef MOZ_WIDGET_ANDROID
-  Preferences::AddBoolVarCache(&sAndroidMCDecoderEnabled,
-                               "media.android-media-codec.enabled", false);
-  Preferences::AddBoolVarCache(&sAndroidMCDecoderPreferred,
-                               "media.android-media-codec.preferred", false);
-#endif
-
-  Preferences::AddBoolVarCache(&sGMPDecoderEnabled,
-                               "media.gmp.decoder.enabled", true);
-#ifdef MOZ_FFMPEG
-  Preferences::AddBoolVarCache(&sFFmpegDecoderEnabled,
-                               "media.ffmpeg.enabled", true);
-#endif
-#ifdef XP_WIN
-  Preferences::AddBoolVarCache(&sWMFDecoderEnabled,
-                               "media.wmf.enabled", true);
-#endif
-
-  Preferences::AddBoolVarCache(&sEnableFuzzingWrapper,
-                               "media.decoder.fuzzing.enabled", false);
-  Preferences::AddUintVarCache(&sVideoOutputMinimumInterval_ms,
-                               "media.decoder.fuzzing.video-output-minimum-interval-ms", 0);
-  Preferences::AddBoolVarCache(&sDontDelayInputExhausted,
-                               "media.decoder.fuzzing.dont-delay-inputexhausted", false);
+  // Ensure MediaPrefs are initialized.
+  MediaPrefs::GetSingleton();

 #ifdef XP_WIN
  WMFDecoderModule::Init();
@@ -209,11 +161,11 @@ PDMFactory::CreateDecoderWithPDM(PlatformDecoderModule* aPDM,

  MediaDataDecoderCallback* callback = aCallback;
  RefPtr<DecoderCallbackFuzzingWrapper> callbackWrapper;
-  if (sEnableFuzzingWrapper) {
+  if (MediaPrefs::PDMFuzzingEnabled()) {
    callbackWrapper = new DecoderCallbackFuzzingWrapper(aCallback);
    callbackWrapper->SetVideoOutputMinimumInterval(
-      TimeDuration::FromMilliseconds(sVideoOutputMinimumInterval_ms));
-    callbackWrapper->SetDontDelayInputExhausted(sDontDelayInputExhausted);
+      TimeDuration::FromMilliseconds(MediaPrefs::PDMFuzzingInterval()));
+    callbackWrapper->SetDontDelayInputExhausted(!MediaPrefs::PDMFuzzingDelayInputExhausted());
    callback = callbackWrapper.get();
  }

@@ -265,7 +217,7 @@ PDMFactory::CreatePDMs()
 {
  RefPtr<PlatformDecoderModule> m;

-  if (sUseBlankDecoder) {
+  if (MediaPrefs::PDMUseBlankDecoder()) {
    m = CreateBlankDecoderModule();
    StartupPDM(m);
    // The Blank PDM SupportsMimeType reports true for all codecs; the creation
@@ -275,13 +227,14 @@ PDMFactory::CreatePDMs()
  }

 #ifdef MOZ_WIDGET_ANDROID
-  if(sAndroidMCDecoderPreferred && sAndroidMCDecoderEnabled) {
+  if(MediaPrefs::PDMAndroidMediaCodecPreferred() &&
+     MediaPrefs::PDMAndroidMediaCodecEnabled()) {
    m = new AndroidDecoderModule();
    StartupPDM(m);
  }
 #endif
 #ifdef XP_WIN
-  if (sWMFDecoderEnabled) {
+  if (MediaPrefs::PDMWMFEnabled()) {
    m = new WMFDecoderModule();
    if (!StartupPDM(m)) {
      mWMFFailedToLoad = true;
@@ -289,7 +242,7 @@ PDMFactory::CreatePDMs()
  }
 #endif
 #ifdef MOZ_FFMPEG
-  if (sFFmpegDecoderEnabled) {
+  if (MediaPrefs::PDMFFmpegEnabled()) {
    m = FFmpegRuntimeLinker::CreateDecoderModule();
    if (!StartupPDM(m)) {
      mFFmpegFailedToLoad = true;
@@ -301,13 +254,13 @@ PDMFactory::CreatePDMs()
  StartupPDM(m);
 #endif
 #ifdef MOZ_GONK_MEDIACODEC
-  if (sGonkDecoderEnabled) {
+  if (MediaPrefs::PDMGonkDecoderEnabled()) {
    m = new GonkDecoderModule();
    StartupPDM(m);
  }
 #endif
 #ifdef MOZ_WIDGET_ANDROID
-  if(sAndroidMCDecoderEnabled){
+  if(MediaPrefs::PDMAndroidMediaCodecEnabled()){
    m = new AndroidDecoderModule();
    StartupPDM(m);
  }
@@ -316,7 +269,7 @@ PDMFactory::CreatePDMs()
  m = new AgnosticDecoderModule();
  StartupPDM(m);

-  if (sGMPDecoderEnabled) {
+  if (MediaPrefs::PDMGMPEnabled()) {
    m = new GMPDecoderModule();
    if (!StartupPDM(m)) {
      mGMPPDMFailedToStartup = true;
@@ -69,26 +69,6 @@ private:
                       layers::LayersBackend aLayersBackend,
                       layers::ImageContainer* aImageContainer);

-  // PDM pref caches...
-  static bool sUseBlankDecoder;
-#ifdef MOZ_GONK_MEDIACODEC
-  static bool sGonkDecoderEnabled;
-#endif
-#ifdef MOZ_WIDGET_ANDROID
-  static bool sAndroidMCDecoderPreferred;
-  static bool sAndroidMCDecoderEnabled;
-#endif
-  static bool sGMPDecoderEnabled;
-#ifdef MOZ_FFMPEG
-  static bool sFFmpegDecoderEnabled;
-#endif
-#ifdef XP_WIN
-  static bool sWMFDecoderEnabled;
-#endif
-  static bool sEnableFuzzingWrapper;
-  static uint32_t sVideoOutputMinimumInterval_ms;
-  static bool sDontDelayInputExhausted;
-
  nsTArray<RefPtr<PlatformDecoderModule>> mCurrentPDMs;
  RefPtr<PlatformDecoderModule> mEMEPDM;

@@ -9,9 +9,9 @@
 #include "GMPAudioDecoder.h"
 #include "GMPVideoDecoder.h"
 #include "MediaDataDecoderProxy.h"
+#include "MediaPrefs.h"
 #include "mozIGeckoMediaPluginService.h"
 #include "nsServiceManagerUtils.h"
-#include "mozilla/Preferences.h"
 #include "mozilla/StaticMutex.h"
 #include "gmp-audio-decode.h"
 #include "gmp-video-decode.h"
@@ -174,9 +174,6 @@ GMPDecoderModule::UpdateUsableCodecs()
  }
 }

-static uint32_t sPreferredAacGmp = 0;
-static uint32_t sPreferredH264Gmp = 0;
-
 /* static */
 void
 GMPDecoderModule::Init()
@@ -187,11 +184,6 @@ GMPDecoderModule::Init()
  // SupportsMimeType() we build a table of the codecs which each whitelisted
  // GMP has and update it when any GMPs are removed or added at runtime.
  UpdateUsableCodecs();
-
-  Preferences::AddUintVarCache(&sPreferredAacGmp,
-                               "media.gmp.decoder.aac", 0);
-  Preferences::AddUintVarCache(&sPreferredH264Gmp,
-                               "media.gmp.decoder.h264", 0);
 }

 /* static */
@@ -200,7 +192,7 @@ GMPDecoderModule::PreferredGMP(const nsACString& aMimeType)
 {
  Maybe<nsCString> rv;
  if (aMimeType.EqualsLiteral("audio/mp4a-latm")) {
-    switch (sPreferredAacGmp) {
+    switch (MediaPrefs::GMPAACPreferred()) {
      case 1: rv.emplace(NS_LITERAL_CSTRING("org.w3.clearkey")); break;
      case 2: rv.emplace(NS_LITERAL_CSTRING("com.adobe.primetime")); break;
      default: break;
@@ -209,7 +201,7 @@ GMPDecoderModule::PreferredGMP(const nsACString& aMimeType)

  if (aMimeType.EqualsLiteral("video/avc") ||
      aMimeType.EqualsLiteral("video/mp4")) {
-    switch (sPreferredH264Gmp) {
+    switch (MediaPrefs::GMPH264Preferred()) {
      case 1: rv.emplace(NS_LITERAL_CSTRING("org.w3.clearkey")); break;
      case 2: rv.emplace(NS_LITERAL_CSTRING("com.adobe.primetime")); break;
      default: break;
@@ -12,7 +12,7 @@
 #include "AppleVTDecoder.h"
 #include "AppleVTLinker.h"
 #include "MacIOSurfaceImage.h"
-#include "mozilla/Preferences.h"
+#include "MediaPrefs.h"
 #include "mozilla/DebugOnly.h"
 #include "mozilla/Logging.h"

@@ -23,7 +23,6 @@ bool AppleDecoderModule::sIsCoreMediaAvailable = false;
 bool AppleDecoderModule::sIsVTAvailable = false;
 bool AppleDecoderModule::sIsVTHWAvailable = false;
 bool AppleDecoderModule::sIsVDAAvailable = false;
-bool AppleDecoderModule::sForceVDA = false;
 bool AppleDecoderModule::sCanUseHardwareVideoDecoder = true;

 AppleDecoderModule::AppleDecoderModule()
@@ -44,8 +43,6 @@ AppleDecoderModule::Init()
    return;
  }

-  Preferences::AddBoolVarCache(&sForceVDA, "media.apple.forcevda", false);
-
  // Ensure IOSurface framework is loaded.
  MacIOSurfaceLib::LoadLibrary();
  const bool loaded = MacIOSurfaceLib::isInit();
@@ -88,7 +85,7 @@ AppleDecoderModule::CreateVideoDecoder(const VideoInfo& aConfig,
 {
  RefPtr<MediaDataDecoder> decoder;

-  if (sIsVDAAvailable && (!sIsVTHWAvailable || sForceVDA)) {
+  if (sIsVDAAvailable && (!sIsVTHWAvailable || MediaPrefs::AppleForceVDA())) {
    decoder =
      AppleVDADecoder::CreateVDADecoder(aConfig,
                                        aVideoTaskQueue,
@@ -50,7 +50,6 @@ private:
  static bool sIsVTAvailable;
  static bool sIsVTHWAvailable;
  static bool sIsVDAAvailable;
-  static bool sForceVDA;
 };

 } // namespace mozilla
@@ -6,7 +6,6 @@
 #include "GonkDecoderModule.h"
 #include "GonkVideoDecoderManager.h"
 #include "GonkAudioDecoderManager.h"
-#include "mozilla/Preferences.h"
 #include "mozilla/DebugOnly.h"
 #include "GonkMediaDataDecoder.h"

@@ -9,7 +9,6 @@
 #include "WMFVideoMFTManager.h"
 #include "WMFAudioMFTManager.h"
 #include "MFTDecoder.h"
-#include "mozilla/Preferences.h"
 #include "mozilla/DebugOnly.h"
 #include "mozilla/Services.h"
 #include "WMFMediaDataDecoder.h"
@@ -21,6 +20,7 @@
 #include "GfxDriverInfo.h"
 #include "gfxWindowsPlatform.h"
 #include "MediaInfo.h"
+#include "MediaPrefs.h"
 #include "prsystem.h"
 #include "mozilla/Maybe.h"
 #include "mozilla/StaticMutex.h"
@@ -28,9 +28,6 @@
 namespace mozilla {

 static bool sDXVAEnabled = false;
-static int  sNumDecoderThreads = -1;
-static bool sIsIntelDecoderEnabled = false;
-static bool sLowLatencyMFTEnabled = false;

 WMFDecoderModule::WMFDecoderModule()
  : mWMFInitialized(false)
@@ -45,49 +42,30 @@ WMFDecoderModule::~WMFDecoderModule()
  }
 }

-static void
-SetNumOfDecoderThreads()
-{
-  MOZ_ASSERT(NS_IsMainThread(), "Preferences can only be read on main thread");
-  int32_t numCores = PR_GetNumberOfProcessors();
-
-  // If we have more than 4 cores, let the decoder decide how many threads.
-  // On an 8 core machine, WMF chooses 4 decoder threads
-  const int WMF_DECODER_DEFAULT = -1;
-  int32_t prefThreadCount = Preferences::GetInt("media.wmf.decoder.thread-count", -1);
-  if (prefThreadCount != WMF_DECODER_DEFAULT) {
-    sNumDecoderThreads = std::max(prefThreadCount, 1);
-  } else if (numCores > 4) {
-    sNumDecoderThreads = WMF_DECODER_DEFAULT;
-  } else {
-    sNumDecoderThreads = std::max(numCores - 1, 1);
-  }
-}
-
 /* static */
 void
 WMFDecoderModule::Init()
 {
  MOZ_ASSERT(NS_IsMainThread(), "Must be on main thread.");
  sDXVAEnabled = gfxPlatform::GetPlatform()->CanUseHardwareVideoDecoding();
-  Preferences::AddBoolVarCache(&sIsIntelDecoderEnabled,
-                               "media.webm.intel_decoder.enabled");
-  sLowLatencyMFTEnabled = Preferences::GetBool("media.wmf.low-latency.enabled", false);
-  SetNumOfDecoderThreads();
 }

 /* static */
 int
 WMFDecoderModule::GetNumDecoderThreads()
 {
-  return sNumDecoderThreads;
-}
+  int32_t numCores = PR_GetNumberOfProcessors();

-/* static */
-bool
-WMFDecoderModule::LowLatencyMFTEnabled()
-{
-  return sLowLatencyMFTEnabled;
+  // If we have more than 4 cores, let the decoder decide how many threads.
+  // On an 8 core machine, WMF chooses 4 decoder threads
+  const int WMF_DECODER_DEFAULT = -1;
+  int32_t prefThreadCount = MediaPrefs::PDMWMFThreadCount();
+  if (prefThreadCount != WMF_DECODER_DEFAULT) {
+    return std::max(prefThreadCount, 1);
+  } else if (numCores > 4) {
+    return WMF_DECODER_DEFAULT;
+  }
+  return std::max(numCores - 1, 1);
 }

 nsresult
@@ -232,7 +210,7 @@ WMFDecoderModule::SupportsMimeType(const nsACString& aMimeType,
      CanCreateWMFDecoder<CLSID_CMP3DecMediaObject>()) {
    return true;
  }
-  if (sIsIntelDecoderEnabled && sDXVAEnabled) {
+  if (MediaPrefs::PDMWMFIntelDecoderEnabled() && sDXVAEnabled) {
    if (aMimeType.EqualsLiteral("video/webm; codecs=vp8") &&
        CanCreateWMFDecoder<CLSID_WebmMfVp8Dec>()) {
      return true;
@@ -44,7 +44,6 @@ public:

  // Called from any thread, must call init first
  static int GetNumDecoderThreads();
-  static bool LowLatencyMFTEnabled();

  // Accessors that report whether we have the required MFTs available
  // on the system to play various codecs. Windows Vista doesn't have the
@@ -7,6 +7,7 @@
 #include <algorithm>
 #include "WMFVideoMFTManager.h"
 #include "MediaDecoderReader.h"
+#include "MediaPrefs.h"
 #include "WMFUtils.h"
 #include "ImageContainer.h"
 #include "VideoUtils.h"
@@ -249,7 +250,7 @@ WMFVideoMFTManager::InitInternal(bool aForceD3D9)
    attr->GetUINT32(MF_SA_D3D_AWARE, &aware);
    attr->SetUINT32(CODECAPI_AVDecNumWorkerThreads,
      WMFDecoderModule::GetNumDecoderThreads());
-    if (WMFDecoderModule::LowLatencyMFTEnabled()) {
+    if (MediaPrefs::PDMWMFLowLatencyEnabled()) {
      hr = attr->SetUINT32(CODECAPI_AVLowLatencyMode, TRUE);
      if (SUCCEEDED(hr)) {
        LOG("Enabling Low Latency Mode");
@@ -9,7 +9,6 @@
 #include "AudioContext.h"
 #include "mozilla/dom/AudioDestinationNodeBinding.h"
 #include "mozilla/dom/ScriptSettings.h"
-#include "mozilla/Preferences.h"
 #include "mozilla/Services.h"
 #include "AudioChannelAgent.h"
 #include "AudioChannelService.h"
@@ -12,7 +12,6 @@
 #include "PlayingRefChangeHandler.h"
 #include "WebAudioUtils.h"
 #include "blink/Biquad.h"
-#include "mozilla/Preferences.h"
 #include "mozilla/UniquePtr.h"
 #include "AudioParamTimeline.h"

@@ -11,7 +11,6 @@
 #include "AudioParam.h"
 #include "PeriodicWave.h"
 #include "mozilla/dom/OscillatorNodeBinding.h"
-#include "mozilla/Preferences.h"

 namespace mozilla {
 namespace dom {
@@ -11,7 +11,6 @@
 #include "mozilla/dom/PannerNodeBinding.h"
 #include "ThreeDPoint.h"
 #include "mozilla/WeakPtr.h"
-#include "mozilla/Preferences.h"
 #include "WebAudioUtils.h"
 #include <set>

@@ -13,7 +13,6 @@
 #include "gfx2DGlue.h"
 #include "mozilla/Atomics.h"
 #include "mozilla/Endian.h"
-#include "mozilla/Preferences.h"
 #include "mozilla/SharedThreadPool.h"
 #include "MediaDataDemuxer.h"
 #include "nsAutoRef.h"
@@ -31,7 +31,7 @@ struct ParamTraits<mozilla::dom::Optional<T>>
    WriteParam(aMsg, false);
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    bool was_passed = false;

@@ -61,7 +61,7 @@ struct ParamTraits<mozilla::dom::Sequence<T>>
    WriteParam(aMsg, static_cast<const FallibleTArray<T>&>(aParam));
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    return ReadParam(aMsg, aIter, dynamic_cast<FallibleTArray<T>*>(aResult));
  }
@@ -114,7 +114,7 @@ struct ParamTraits<mozilla::dom::RTCStatsReportInternal>
    WriteParam(aMsg, aParam.mTransportStats);
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    if (!ReadParam(aMsg, aIter, &(aResult->mClosed)) ||
        !ReadParam(aMsg, aIter, &(aResult->mCodecStats)) ||
@@ -147,7 +147,7 @@ static void WriteRTCStats(Message* aMsg, const RTCStats& aParam)
  WriteParam(aMsg, aParam.mType);
 }

-static bool ReadRTCStats(const Message* aMsg, void** aIter, RTCStats* aResult)
+static bool ReadRTCStats(const Message* aMsg, PickleIterator* aIter, RTCStats* aResult)
 {
  // RTCStats base class
  if (!ReadParam(aMsg, aIter, &(aResult->mId)) ||
@@ -174,7 +174,7 @@ struct ParamTraits<mozilla::dom::RTCCodecStats>
    WriteRTCStats(aMsg, aParam);
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    if (!ReadParam(aMsg, aIter, &(aResult->mChannels)) ||
        !ReadParam(aMsg, aIter, &(aResult->mClockRate)) ||
@@ -207,7 +207,7 @@ struct ParamTraits<mozilla::dom::RTCIceCandidatePairStats>
    WriteRTCStats(aMsg, aParam);
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    if (!ReadParam(aMsg, aIter, &(aResult->mComponentId)) ||
        !ReadParam(aMsg, aIter, &(aResult->mLocalCandidateId)) ||
@@ -242,7 +242,7 @@ struct ParamTraits<mozilla::dom::RTCIceCandidateStats>
    WriteRTCStats(aMsg, aParam);
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    if (!ReadParam(aMsg, aIter, &(aResult->mCandidateId)) ||
        !ReadParam(aMsg, aIter, &(aResult->mCandidateType)) ||
@@ -274,7 +274,7 @@ struct ParamTraits<mozilla::dom::RTCIceComponentStats>
    WriteRTCStats(aMsg, aParam);
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    if (!ReadParam(aMsg, aIter, &(aResult->mActiveConnection)) ||
        !ReadParam(aMsg, aIter, &(aResult->mBytesReceived)) ||
@@ -307,7 +307,7 @@ static void WriteRTCRTPStreamStats(
 }

 static bool ReadRTCRTPStreamStats(
-              const Message* aMsg, void** aIter,
+              const Message* aMsg, PickleIterator* aIter,
              mozilla::dom::RTCRTPStreamStats* aResult)
 {
  if (!ReadParam(aMsg, aIter, &(aResult->mBitrateMean)) ||
@@ -346,7 +346,7 @@ struct ParamTraits<mozilla::dom::RTCInboundRTPStreamStats>
    WriteRTCStats(aMsg, aParam);
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    if (!ReadParam(aMsg, aIter, &(aResult->mBytesReceived)) ||
        !ReadParam(aMsg, aIter, &(aResult->mDiscardedPackets)) ||
@@ -380,7 +380,7 @@ struct ParamTraits<mozilla::dom::RTCOutboundRTPStreamStats>
    WriteRTCStats(aMsg, aParam);
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    if (!ReadParam(aMsg, aIter, &(aResult->mBytesSent)) ||
        !ReadParam(aMsg, aIter, &(aResult->mDroppedFrames)) ||
@@ -407,7 +407,7 @@ struct ParamTraits<mozilla::dom::RTCMediaStreamStats>
    WriteRTCStats(aMsg, aParam);
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    if (!ReadParam(aMsg, aIter, &(aResult->mStreamIdentifier)) ||
        !ReadParam(aMsg, aIter, &(aResult->mTrackIds)) ||
@@ -431,7 +431,7 @@ struct ParamTraits<mozilla::dom::RTCTransportStats>
    WriteRTCStats(aMsg, aParam);
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    if (!ReadParam(aMsg, aIter, &(aResult->mBytesReceived)) ||
        !ReadParam(aMsg, aIter, &(aResult->mBytesSent)) ||
@@ -467,7 +467,7 @@ struct ParamTraits<mozilla::dom::RTCMediaStreamTrackStats>
    WriteRTCStats(aMsg, aParam);
  }

-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
  {
    if (!ReadParam(aMsg, aIter, &(aResult->mAudioLevel)) ||
        !ReadParam(aMsg, aIter, &(aResult->mEchoReturnLoss)) ||
@@ -6,7 +6,6 @@

 #include "SpeechGrammar.h"

-#include "mozilla/Preferences.h"
 #include "mozilla/dom/SpeechGrammarBinding.h"

 namespace mozilla {
@@ -15,6 +15,8 @@
 #include "mozilla/dom/MediaStreamTrackBinding.h"
 #include "mozilla/dom/MediaStreamError.h"
 #include "mozilla/MediaManager.h"
+#include "mozilla/Preferences.h"
+#include "MediaPrefs.h"
 #include "mozilla/Services.h"

 #include "AudioSegment.h"
@@ -70,7 +72,7 @@ GetSpeechRecognitionService(const nsAString& aLang)
  nsAutoCString speechRecognitionServiceCID;

  nsAdoptingCString prefValue =
-  Preferences::GetCString(PREFERENCE_DEFAULT_RECOGNITION_SERVICE);
+    Preferences::GetCString(PREFERENCE_DEFAULT_RECOGNITION_SERVICE);
  nsAutoCString speechRecognitionService;

  if (!aLang.IsEmpty()) {
@@ -83,7 +85,7 @@ GetSpeechRecognitionService(const nsAString& aLang)
    speechRecognitionService = DEFAULT_RECOGNITION_SERVICE;
  }

-  if (SpeechRecognition::mTestConfig.mFakeRecognitionService) {
+  if (MediaPrefs::WebSpeechFakeRecognitionService()) {
    speechRecognitionServiceCID =
      NS_SPEECH_RECOGNITION_SERVICE_CONTRACTID_PREFIX "fake";
  } else {
@@ -107,8 +109,6 @@ NS_INTERFACE_MAP_END_INHERITING(DOMEventTargetHelper)
 NS_IMPL_ADDREF_INHERITED(SpeechRecognition, DOMEventTargetHelper)
 NS_IMPL_RELEASE_INHERITED(SpeechRecognition, DOMEventTargetHelper)

-struct SpeechRecognition::TestConfig SpeechRecognition::mTestConfig;
-
 SpeechRecognition::SpeechRecognition(nsPIDOMWindow* aOwnerWindow)
  : DOMEventTargetHelper(aOwnerWindow)
  , mEndpointer(kSAMPLE_RATE)
@@ -120,8 +120,7 @@ SpeechRecognition::SpeechRecognition(nsPIDOMWindow* aOwnerWindow)
 {
  SR_LOG("created SpeechRecognition");

-  mTestConfig.Init();
-  if (mTestConfig.mEnableTests) {
+  if (MediaPrefs::WebSpeechTestEnabled()) {
    nsCOMPtr<nsIObserverService> obs = services::GetObserverService();
    obs->AddObserver(this, SPEECH_RECOGNITION_TEST_EVENT_REQUEST_TOPIC, false);
    obs->AddObserver(this, SPEECH_RECOGNITION_TEST_END_TOPIC, false);
@@ -175,10 +174,9 @@ SpeechRecognition::IsAuthorized(JSContext* aCx, JSObject* aGlobal)

  bool hasPermission = (speechRecognition == nsIPermissionManager::ALLOW_ACTION);

-  bool enableTests = Preferences::GetBool(TEST_PREFERENCE_ENABLE);
-  bool enableRecognitionEnable = Preferences::GetBool(TEST_PREFERENCE_RECOGNITION_ENABLE);
-  bool enableRecognitionForceEnable = Preferences::GetBool(TEST_PREFERENCE_RECOGNITION_FORCE_ENABLE);
-  return (hasPermission || enableRecognitionForceEnable || enableTests) && enableRecognitionEnable;
+  return (hasPermission || MediaPrefs::WebSpeechRecognitionForceEnabled()
+          || MediaPrefs::WebSpeechTestEnabled())
+         && MediaPrefs::WebSpeechRecognitionEnabled();
 }

 already_AddRefed<SpeechRecognition>
@@ -617,7 +615,7 @@ SpeechRecognition::Observe(nsISupports* aSubject, const char* aTopic,
    nsCOMPtr<nsIObserverService> obs = services::GetObserverService();
    obs->RemoveObserver(this, SPEECH_RECOGNITION_TEST_EVENT_REQUEST_TOPIC);
    obs->RemoveObserver(this, SPEECH_RECOGNITION_TEST_END_TOPIC);
-  } else if (mTestConfig.mFakeFSMEvents &&
+  } else if (MediaPrefs::WebSpeechFakeFSMEvents() &&
             !strcmp(aTopic, SPEECH_RECOGNITION_TEST_EVENT_REQUEST_TOPIC)) {
    ProcessTestEventRequest(aSubject, nsDependentString(aData));
  }
@@ -635,7 +633,7 @@ SpeechRecognition::ProcessTestEventRequest(nsISupports* aSubject, const nsAStrin
                  SpeechRecognitionErrorCode::Audio_capture, // TODO different codes?
                  NS_LITERAL_STRING("AUDIO_ERROR test event"));
  } else {
-    NS_ASSERTION(mTestConfig.mFakeRecognitionService,
+    NS_ASSERTION(MediaPrefs::WebSpeechFakeRecognitionService(),
                 "Got request for fake recognition service event, but "
                 TEST_PREFERENCE_FAKE_RECOGNITION_SERVICE " is unset");

@@ -21,7 +21,6 @@
 #include "MediaStreamGraph.h"
 #include "AudioSegment.h"
 #include "mozilla/WeakPtr.h"
-#include "mozilla/Preferences.h"

 #include "SpeechGrammarList.h"
 #include "SpeechRecognitionResultList.h"
@@ -35,11 +34,6 @@ namespace mozilla {

 namespace dom {

-#define TEST_PREFERENCE_ENABLE "media.webspeech.test.enable"
-#define TEST_PREFERENCE_FAKE_FSM_EVENTS "media.webspeech.test.fake_fsm_events"
-#define TEST_PREFERENCE_FAKE_RECOGNITION_SERVICE "media.webspeech.test.fake_recognition_service"
-#define TEST_PREFERENCE_RECOGNITION_ENABLE "media.webspeech.recognition.enable"
-#define TEST_PREFERENCE_RECOGNITION_FORCE_ENABLE "media.webspeech.recognition.force_enable"
 #define SPEECH_RECOGNITION_TEST_EVENT_REQUEST_TOPIC "SpeechRecognitionTest:RequestEvent"
 #define SPEECH_RECOGNITION_TEST_END_TOPIC "SpeechRecognitionTest:End"

@@ -131,33 +125,6 @@ public:
  AudioSegment* CreateAudioSegment(nsTArray<RefPtr<SharedBuffer>>& aChunks);
  void FeedAudioData(already_AddRefed<SharedBuffer> aSamples, uint32_t aDuration, MediaStreamListener* aProvider, TrackRate aTrackRate);

-  static struct TestConfig
-  {
-  public:
-    bool mEnableTests;
-    bool mFakeFSMEvents;
-    bool mFakeRecognitionService;
-
-    void Init()
-    {
-      if (mInitialized) {
-        return;
-      }
-
-      Preferences::AddBoolVarCache(&mEnableTests, TEST_PREFERENCE_ENABLE);
-
-      if (mEnableTests) {
-        Preferences::AddBoolVarCache(&mFakeFSMEvents, TEST_PREFERENCE_FAKE_FSM_EVENTS);
-        Preferences::AddBoolVarCache(&mFakeRecognitionService, TEST_PREFERENCE_FAKE_RECOGNITION_SERVICE);
-      }
-
-      mInitialized = true;
-    }
-  private:
-    bool mInitialized;
-  } mTestConfig;
-
-
  friend class SpeechEvent;
 private:
  virtual ~SpeechRecognition() {};
@@ -7,6 +7,7 @@
 #include "nsThreadUtils.h"

 #include "FakeSpeechRecognitionService.h"
+#include "MediaPrefs.h"

 #include "SpeechRecognition.h"
 #include "SpeechRecognitionAlternative.h"
@@ -66,7 +67,7 @@ FakeSpeechRecognitionService::Abort()
 NS_IMETHODIMP
 FakeSpeechRecognitionService::Observe(nsISupports* aSubject, const char* aTopic, const char16_t* aData)
 {
-  MOZ_ASSERT(mRecognition->mTestConfig.mFakeRecognitionService,
+  MOZ_ASSERT(MediaPrefs::WebSpeechFakeRecognitionService(),
             "Got request to fake recognition service event, but "
             TEST_PREFERENCE_FAKE_RECOGNITION_SERVICE " is not set");

@@ -20,7 +20,7 @@ using namespace mozilla::dom;
 NS_GENERIC_FACTORY_SINGLETON_CONSTRUCTOR(OSXSpeechSynthesizerService,
                                         OSXSpeechSynthesizerService::GetInstanceForService)

-// Defines kSAPISERVICE_CID
+// Defines kOSXSERVICE_CID
 NS_DEFINE_NAMED_CID(OSXSPEECHSYNTHESIZERSERVICE_CID);

 static const mozilla::Module::CIDEntry kCIDs[] = {
@@ -34,7 +34,7 @@ static const mozilla::Module::ContractIDEntry kContracts[] = {
 };

 static const mozilla::Module::CategoryEntry kCategories[] = {
-  { "profile-after-change", "Sapi Speech Synth", OSXSPEECHSYNTHESIZERSERVICE_CONTRACTID },
+  { "speech-synth-started", "OSX Speech Synth", OSXSPEECHSYNTHESIZERSERVICE_CONTRACTID },
  { nullptr }
 };

@@ -165,3 +165,9 @@ interface nsISpeechService : nsISupports

  readonly attribute SpeechServiceType serviceType;
 };
+
+%{C++
+// This is the service category speech services could use to start up as
+// a component.
+#define NS_SPEECH_SYNTH_STARTED "speech-synth-started"
+%}
@@ -7,7 +7,9 @@
 #include "nsILocaleService.h"
 #include "nsISpeechService.h"
 #include "nsServiceManagerUtils.h"
+#include "nsCategoryManagerUtils.h"

+#include "MediaPrefs.h"
 #include "SpeechSynthesisUtterance.h"
 #include "SpeechSynthesisVoice.h"
 #include "nsSynthVoiceRegistry.h"
@@ -18,7 +20,6 @@
 #include "mozilla/StaticPtr.h"
 #include "mozilla/dom/ContentChild.h"
 #include "mozilla/dom/ContentParent.h"
-#include "mozilla/Preferences.h"
 #include "mozilla/unused.h"

 #include "SpeechSynthesisChild.h"
@@ -136,7 +137,6 @@ public:
 // nsSynthVoiceRegistry

 static StaticRefPtr<nsSynthVoiceRegistry> gSynthVoiceRegistry;
-static bool sForceGlobalQueue = false;

 NS_IMPL_ISUPPORTS(nsSynthVoiceRegistry, nsISynthVoiceRegistry)

@@ -188,8 +188,11 @@ nsSynthVoiceRegistry::GetInstance()

  if (!gSynthVoiceRegistry) {
    gSynthVoiceRegistry = new nsSynthVoiceRegistry();
-    Preferences::AddBoolVarCache(&sForceGlobalQueue,
-                                 "media.webspeech.synth.force_global_queue");
+    if (XRE_IsParentProcess()) {
+      // Start up all speech synth services.
+      NS_CreateServicesFromCategory(NS_SPEECH_SYNTH_STARTED, nullptr,
+        NS_SPEECH_SYNTH_STARTED);
+    }
  }

  return gSynthVoiceRegistry;
@@ -336,7 +339,7 @@ nsSynthVoiceRegistry::RemoveVoice(nsISpeechService* aService,
  mDefaultVoices.RemoveElement(retval);
  mUriVoiceMap.Remove(aUri);

-  if (retval->mIsQueued && !sForceGlobalQueue) {
+  if (retval->mIsQueued && !MediaPrefs::WebSpeechForceGlobal()) {
    // Check if this is the last queued voice, and disable the global queue if
    // it is.
    bool queued = false;
@@ -709,7 +712,7 @@ nsSynthVoiceRegistry::Speak(const nsAString& aText,

  aTask->SetChosenVoiceURI(voice->mUri);

-  if (mUseGlobalQueue || sForceGlobalQueue) {
+  if (mUseGlobalQueue || MediaPrefs::WebSpeechForceGlobal()) {
    LOG(LogLevel::Debug,
        ("nsSynthVoiceRegistry::Speak queueing text='%s' lang='%s' uri='%s' rate=%f pitch=%f",
         NS_ConvertUTF16toUTF8(aText).get(), NS_ConvertUTF16toUTF8(aLang).get(),
@@ -787,7 +790,8 @@ nsSynthVoiceRegistry::SetIsSpeaking(bool aIsSpeaking)
  MOZ_ASSERT(XRE_IsParentProcess());

  // Only set to 'true' if global queue is enabled.
-  mIsSpeaking = aIsSpeaking && (mUseGlobalQueue || sForceGlobalQueue);
+  mIsSpeaking =
+    aIsSpeaking && (mUseGlobalQueue || MediaPrefs::WebSpeechForceGlobal());

  nsTArray<SpeechSynthesisParent*> ssplist;
  GetAllSpeechSynthActors(ssplist);
@@ -33,7 +33,7 @@ static const mozilla::Module::ContractIDEntry kContracts[] = {
 };

 static const mozilla::Module::CategoryEntry kCategories[] = {
-  { "profile-after-change", "SpeechDispatcher Speech Synth", SPEECHDISPATCHERSERVICE_CONTRACTID },
+  { "speech-synth-started", "SpeechDispatcher Speech Synth", SPEECHDISPATCHERSERVICE_CONTRACTID },
  { nullptr }
 };

@@ -34,7 +34,7 @@ static const mozilla::Module::ContractIDEntry kContracts[] = {
 };

 static const mozilla::Module::CategoryEntry kCategories[] = {
-  { "profile-after-change", "Sapi Speech Synth", SAPISERVICE_CONTRACTID },
+  { "speech-synth-started", "Sapi Speech Synth", SAPISERVICE_CONTRACTID },
  { nullptr }
 };

--- a/Show More
+++ b/Show More