Merge branch 'master' into certexception-work

57 files changed, 457 insertions, 452 deletions

diff --git a/dom/base/nsContentUtils.h b/dom/base/nsContentUtils.h
index 299a8e859..606d67de9 100644
--- a/dom/base/nsContentUtils.h
+++ b/dom/base/nsContentUtils.h
@@ -9,10 +9,14 @@
 #ifndef nsContentUtils_h___
 #define nsContentUtils_h___
 
-#if defined(XP_WIN)
+#ifdef XP_WIN
 #include <float.h>
 #endif
 
+#ifdef XP_SOLARIS
+#include <ieeefp.h>
+#endif	
+
 #include "js/TypeDecls.h"
 #include "js/Value.h"
 #include "js/RootingAPI.h"
diff --git a/dom/base/nsDocumentEncoder.cpp b/dom/base/nsDocumentEncoder.cpp
index 84b128b15..34eb6ed38 100644
--- a/dom/base/nsDocumentEncoder.cpp
+++ b/dom/base/nsDocumentEncoder.cpp
@@ -82,7 +82,9 @@ protected:
                                       nsAString& aStr,
                                       bool aDontSerializeRoot,
                                       uint32_t aMaxLength = 0);
-  nsresult SerializeNodeEnd(nsINode* aNode, nsAString& aStr);
+  nsresult SerializeNodeEnd(nsINode* aOriginalNode,
+                            nsAString& aStr,
+                            nsINode* aFixupNode = nullptr);
   // This serializes the content of aNode.
   nsresult SerializeToStringIterative(nsINode* aNode,
                                       nsAString& aStr);
@@ -405,14 +407,37 @@ nsDocumentEncoder::SerializeNodeStart(nsINode* aNode,
 }
 
 nsresult
-nsDocumentEncoder::SerializeNodeEnd(nsINode* aNode,
-                                    nsAString& aStr)
+nsDocumentEncoder::SerializeNodeEnd(nsINode* aOriginalNode,
+                                    nsAString& aStr,
+                                    nsINode* aFixupNode)
 {
-  if (!IsVisibleNode(aNode))
+  if (!IsVisibleNode(aOriginalNode))
     return NS_OK;
 
-  if (aNode->IsElement()) {
-    mSerializer->AppendElementEnd(aNode->AsElement(), aStr);
+  nsINode* node = nullptr;
+  nsCOMPtr<nsINode> fixedNodeKungfuDeathGrip;
+
+  // Caller didn't do fixup, so we'll do it ourselves
+  if (!aFixupNode) {
+    aFixupNode = aOriginalNode;
+    if (mNodeFixup) {
+      bool dummy;
+      nsCOMPtr<nsIDOMNode> domNodeIn = do_QueryInterface(aOriginalNode);
+      nsCOMPtr<nsIDOMNode> domNodeOut;
+      mNodeFixup->FixupNode(domNodeIn, &dummy, getter_AddRefs(domNodeOut));
+      fixedNodeKungfuDeathGrip = do_QueryInterface(domNodeOut);
+      node = fixedNodeKungfuDeathGrip;
+    }
+  }
+
+  // Fall back to original node if needed.
+  if (!node)
+    node = aOriginalNode;
+
+  if (node->IsElement()) {
+    mSerializer->AppendElementEnd(node->AsElement(),
+                                  aOriginalNode->AsElement(),
+                                  aStr);
   }
   return NS_OK;
 }
@@ -481,7 +506,7 @@ nsDocumentEncoder::SerializeToStringRecursive(nsINode* aNode,
   }
 
   if (!aDontSerializeRoot) {
-    rv = SerializeNodeEnd(maybeFixedNode, aStr);
+    rv = SerializeNodeEnd(aNode, aStr, maybeFixedNode);
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index afaa24f09..1288b3435 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -1026,11 +1026,6 @@ public:
     return false;
   }
 
-  virtual bool watch(JSContext *cx, JS::Handle<JSObject*> proxy,
-                     JS::Handle<jsid> id, JS::Handle<JSObject*> callable) const override;
-  virtual bool unwatch(JSContext *cx, JS::Handle<JSObject*> proxy,
-                       JS::Handle<jsid> id) const override;
-
   static void ObjectMoved(JSObject *obj, const JSObject *old);
 
   static const nsOuterWindowProxy singleton;
@@ -1398,20 +1393,6 @@ nsOuterWindowProxy::AppendIndexedPropertyNames(JSContext *cx, JSObject *proxy,
   return true;
 }
 
-bool
-nsOuterWindowProxy::watch(JSContext *cx, JS::Handle<JSObject*> proxy,
-                          JS::Handle<jsid> id, JS::Handle<JSObject*> callable) const
-{
-  return js::WatchGuts(cx, proxy, id, callable);
-}
-
-bool
-nsOuterWindowProxy::unwatch(JSContext *cx, JS::Handle<JSObject*> proxy,
-                            JS::Handle<jsid> id) const
-{
-  return js::UnwatchGuts(cx, proxy, id);
-}
-
 void
 nsOuterWindowProxy::ObjectMoved(JSObject *obj, const JSObject *old)
 {
@@ -3224,6 +3205,12 @@ nsGlobalWindow::SetNewDocument(nsIDocument* aDocument,
         newInnerWindow->mLocalStorage = nullptr;
         newInnerWindow->mSessionStorage = nullptr;
 
+        newInnerWindow->mPerformance = nullptr;
+
+        // This must be called after nulling the internal objects because
+        // we might recreate them here by calling the getter methods, and
+        // store them into the JS slots. If we null them after, the slot
+        // values and the objects will be out of sync.
         newInnerWindow->ClearDocumentDependentSlots(cx);
       }
     } else {
@@ -3364,10 +3351,16 @@ nsGlobalWindow::InnerSetNewDocument(JSContext* aCx, nsIDocument* aDocument)
   }
 
   mDoc = aDocument;
-  ClearDocumentDependentSlots(aCx);
   mFocusedNode = nullptr;
   mLocalStorage = nullptr;
   mSessionStorage = nullptr;
+  mPerformance = nullptr;
+
+  // This must be called after nulling the internal objects because we might
+  // recreate them here by calling the getter methods, and store them into the JS
+  // slots. If we null them after, the slot values and the objects will be
+  // out of sync.
+  ClearDocumentDependentSlots(aCx);
 
 #ifdef DEBUG
   mLastOpenedURI = aDocument->GetDocumentURI();
diff --git a/dom/base/nsHTMLContentSerializer.cpp b/dom/base/nsHTMLContentSerializer.cpp
index ab8b4f2b2..c135c4cf8 100644
--- a/dom/base/nsHTMLContentSerializer.cpp
+++ b/dom/base/nsHTMLContentSerializer.cpp
@@ -301,6 +301,7 @@ nsHTMLContentSerializer::AppendElementStart(Element* aElement,
   
 NS_IMETHODIMP 
 nsHTMLContentSerializer::AppendElementEnd(Element* aElement,
+                                          Element* aOriginalElement /* unused */,
                                           nsAString& aStr)
 {
   NS_ENSURE_ARG(aElement);
diff --git a/dom/base/nsHTMLContentSerializer.h b/dom/base/nsHTMLContentSerializer.h
index 6f3500e01..8e23d54ca 100644
--- a/dom/base/nsHTMLContentSerializer.h
+++ b/dom/base/nsHTMLContentSerializer.h
@@ -31,6 +31,7 @@ class nsHTMLContentSerializer final : public nsXHTMLContentSerializer {
                                 nsAString& aStr) override;
 
   NS_IMETHOD AppendElementEnd(mozilla::dom::Element* aElement,
+                              mozilla::dom::Element* aOriginalElement,
                               nsAString& aStr) override;
 
   NS_IMETHOD AppendDocumentStart(nsIDocument *aDocument,
diff --git a/dom/base/nsIContentSerializer.h b/dom/base/nsIContentSerializer.h
index f023cbc90..35014bd2c 100644
--- a/dom/base/nsIContentSerializer.h
+++ b/dom/base/nsIContentSerializer.h
@@ -55,6 +55,7 @@ class nsIContentSerializer : public nsISupports {
                                 nsAString& aStr) = 0;
 
   NS_IMETHOD AppendElementEnd(mozilla::dom::Element* aElement,
+                              mozilla::dom::Element* aOriginalElement,
                               nsAString& aStr) = 0;
 
   NS_IMETHOD Flush(nsAString& aStr) = 0;
diff --git a/dom/base/nsObjectLoadingContent.cpp b/dom/base/nsObjectLoadingContent.cpp
index 3c850c4cd..4978744e8 100644
--- a/dom/base/nsObjectLoadingContent.cpp
+++ b/dom/base/nsObjectLoadingContent.cpp
@@ -718,9 +718,9 @@ nsObjectLoadingContent::UnbindFromTree(bool aDeep, bool aNullParent)
   if (mType == eType_Plugin) {
     nsIDocument* doc = thisContent->GetComposedDoc();
     if (doc && doc->IsActive()) {
-    nsCOMPtr<nsIRunnable> ev = new nsSimplePluginEvent(doc,
-                                                       NS_LITERAL_STRING("PluginRemoved"));
-    NS_DispatchToCurrentThread(ev);
+      nsCOMPtr<nsIRunnable> ev = new nsSimplePluginEvent(doc,
+                                                         NS_LITERAL_STRING("PluginRemoved"));
+      NS_DispatchToCurrentThread(ev);
     }
   }
 }
@@ -3628,6 +3628,14 @@ nsObjectLoadingContent::HasGoodFallback() {
       }
     }
 
+    // RULE "nosrc":
+    // Use fallback content if the object has not specified a src URI.
+    if (rulesList[i].EqualsLiteral("nosrc")) {
+      if (!mOriginalURI) {
+        return true;
+      }
+    }
+
     // RULE "adobelink":
     // Don't use fallback content when it has a link to adobe's website.
     if (rulesList[i].EqualsLiteral("adobelink")) {
diff --git a/dom/base/nsPlainTextSerializer.cpp b/dom/base/nsPlainTextSerializer.cpp
index ef6bdcac7..8097c4ec8 100644
--- a/dom/base/nsPlainTextSerializer.cpp
+++ b/dom/base/nsPlainTextSerializer.cpp
@@ -390,6 +390,7 @@ nsPlainTextSerializer::AppendElementStart(Element* aElement,
  
 NS_IMETHODIMP 
 nsPlainTextSerializer::AppendElementEnd(Element* aElement,
+                                        Element* aOriginalElement /* unused */,
                                         nsAString& aStr)
 {
   NS_ENSURE_ARG(aElement);
diff --git a/dom/base/nsPlainTextSerializer.h b/dom/base/nsPlainTextSerializer.h
index 95cf5590c..5055c75a0 100644
--- a/dom/base/nsPlainTextSerializer.h
+++ b/dom/base/nsPlainTextSerializer.h
@@ -61,6 +61,7 @@ public:
                                 mozilla::dom::Element* aOriginalElement,
                                 nsAString& aStr) override; 
   NS_IMETHOD AppendElementEnd(mozilla::dom::Element* aElement,
+                              mozilla::dom::Element* aOriginalElement,
                               nsAString& aStr) override;
   NS_IMETHOD Flush(nsAString& aStr) override;
 
diff --git a/dom/base/nsXHTMLContentSerializer.cpp b/dom/base/nsXHTMLContentSerializer.cpp
index 111ed46c7..0a39ef663 100755
--- a/dom/base/nsXHTMLContentSerializer.cpp
+++ b/dom/base/nsXHTMLContentSerializer.cpp
@@ -514,6 +514,7 @@ nsXHTMLContentSerializer::CheckElementStart(nsIContent * aContent,
 
 bool
 nsXHTMLContentSerializer::CheckElementEnd(mozilla::dom::Element* aElement,
+                                          mozilla::dom::Element* aOriginalElement,
                                           bool& aForceFormat,
                                           nsAString& aStr)
 {
@@ -532,7 +533,7 @@ nsXHTMLContentSerializer::CheckElementEnd(mozilla::dom::Element* aElement,
   }
 
   bool dummyFormat;
-  return nsXMLContentSerializer::CheckElementEnd(aElement, dummyFormat, aStr);
+  return nsXMLContentSerializer::CheckElementEnd(aElement, aOriginalElement, dummyFormat, aStr);
 }
 
 bool
diff --git a/dom/base/nsXHTMLContentSerializer.h b/dom/base/nsXHTMLContentSerializer.h
index 7473ba074..79ecf28f1 100644
--- a/dom/base/nsXHTMLContentSerializer.h
+++ b/dom/base/nsXHTMLContentSerializer.h
@@ -53,6 +53,7 @@ class nsXHTMLContentSerializer : public nsXMLContentSerializer {
                                  nsAString& aStr) override;
 
   virtual bool CheckElementEnd(mozilla::dom::Element* aContent,
+                               mozilla::dom::Element* aOriginalElement,
                                bool& aForceFormat,
                                nsAString& aStr) override;
 
diff --git a/dom/base/nsXMLContentSerializer.cpp b/dom/base/nsXMLContentSerializer.cpp
index 54fadaa94..f12bb8fdc 100644
--- a/dom/base/nsXMLContentSerializer.cpp
+++ b/dom/base/nsXMLContentSerializer.cpp
@@ -1028,6 +1028,7 @@ nsXMLContentSerializer::AppendEndOfElementStart(Element* aElement,
 
 NS_IMETHODIMP
 nsXMLContentSerializer::AppendElementEnd(Element* aElement,
+                                         Element* aOriginalElement,
                                          nsAString& aStr)
 {
   NS_ENSURE_ARG(aElement);
@@ -1035,7 +1036,7 @@ nsXMLContentSerializer::AppendElementEnd(Element* aElement,
   nsIContent* content = aElement;
 
   bool forceFormat = false, outputElementEnd;
-  outputElementEnd = CheckElementEnd(aElement, forceFormat, aStr);
+  outputElementEnd = CheckElementEnd(aElement, aOriginalElement, forceFormat, aStr);
 
   nsIAtom *name = content->NodeInfo()->NameAtom();
 
@@ -1161,16 +1162,14 @@ nsXMLContentSerializer::CheckElementStart(nsIContent * aContent,
 
 bool
 nsXMLContentSerializer::CheckElementEnd(Element* aElement,
+                                        Element* aOriginalElement,
                                         bool& aForceFormat,
                                         nsAString& aStr)
 {
   // We don't output a separate end tag for empty element
   aForceFormat = false;
 
-  // XXXbz this is a bit messed up, but by now we don't have our fixed-up
-  // version of aElement anymore.  Let's hope fixup never changes the localName
-  // or namespace...
-  return ElementNeedsSeparateEndTag(aElement, aElement);
+  return ElementNeedsSeparateEndTag(aElement, aOriginalElement);
 }
 
 bool
diff --git a/dom/base/nsXMLContentSerializer.h b/dom/base/nsXMLContentSerializer.h
index 941acb179..2f76b0892 100644
--- a/dom/base/nsXMLContentSerializer.h
+++ b/dom/base/nsXMLContentSerializer.h
@@ -59,6 +59,7 @@ class nsXMLContentSerializer : public nsIContentSerializer {
                                 nsAString& aStr) override;
 
   NS_IMETHOD AppendElementEnd(mozilla::dom::Element* aElement,
+                              mozilla::dom::Element* aOriginalElement,
                               nsAString& aStr) override;
 
   NS_IMETHOD Flush(nsAString& aStr) override { return NS_OK; }
@@ -263,6 +264,7 @@ class nsXMLContentSerializer : public nsIContentSerializer {
    * @return boolean  true if the element can be output
    */
   virtual bool CheckElementEnd(mozilla::dom::Element* aElement,
+                               mozilla::dom::Element* aOriginalElement,
                                bool& aForceFormat,
                                nsAString& aStr);
 
diff --git a/dom/bindings/BindingUtils.cpp b/dom/bindings/BindingUtils.cpp
index a26fc4422..6e0db29b1 100644
--- a/dom/bindings/BindingUtils.cpp
+++ b/dom/bindings/BindingUtils.cpp
@@ -1968,8 +1968,6 @@ const js::ObjectOps sInterfaceObjectClassObjectOps = {
   nullptr, /* setProperty */
   nullptr, /* getOwnPropertyDescriptor */
   nullptr, /* deleteProperty */
-  nullptr, /* watch */
-  nullptr, /* unwatch */
   nullptr, /* getElements */
   nullptr, /* enumerate */
   InterfaceObjectToString, /* funToString */
diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index d7d700a96..924241aa0 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -13169,9 +13169,9 @@ class CGDictionary(CGThing):
         # continues to match the list in test_Object.prototype_props.html
         if (member.identifier.name in
             ["constructor", "toSource", "toString", "toLocaleString", "valueOf",
-             "watch", "unwatch", "hasOwnProperty", "isPrototypeOf",
-             "propertyIsEnumerable", "__defineGetter__", "__defineSetter__",
-             "__lookupGetter__", "__lookupSetter__", "__proto__"]):
+             "hasOwnProperty", "isPrototypeOf", "propertyIsEnumerable",
+             "__defineGetter__", "__defineSetter__", "__lookupGetter__",
+             "__lookupSetter__", "__proto__"]):
             raise TypeError("'%s' member of %s dictionary shadows "
                             "a property of Object.prototype, and Xrays to "
                             "Object can't handle that.\n"
diff --git a/dom/bindings/DOMJSProxyHandler.cpp b/dom/bindings/DOMJSProxyHandler.cpp
index 23f0abd88..49281c1c2 100644
--- a/dom/bindings/DOMJSProxyHandler.cpp
+++ b/dom/bindings/DOMJSProxyHandler.cpp
@@ -275,19 +275,6 @@ DOMProxyHandler::delete_(JSContext* cx, JS::Handle<JSObject*> proxy,
 }
 
 bool
-BaseDOMProxyHandler::watch(JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id,
-                           JS::Handle<JSObject*> callable) const
-{
-  return js::WatchGuts(cx, proxy, id, callable);
-}
-
-bool
-BaseDOMProxyHandler::unwatch(JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id) const
-{
-  return js::UnwatchGuts(cx, proxy, id);
-}
-
-bool
 BaseDOMProxyHandler::ownPropertyKeys(JSContext* cx,
                                      JS::Handle<JSObject*> proxy,
                                      JS::AutoIdVector& props) const
diff --git a/dom/bindings/DOMJSProxyHandler.h b/dom/bindings/DOMJSProxyHandler.h
index 1781649cc..e3e151b7a 100644
--- a/dom/bindings/DOMJSProxyHandler.h
+++ b/dom/bindings/DOMJSProxyHandler.h
@@ -72,11 +72,6 @@ public:
   virtual bool getOwnEnumerablePropertyKeys(JSContext* cx, JS::Handle<JSObject*> proxy,
                                             JS::AutoIdVector &props) const override;
 
-  bool watch(JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id,
-             JS::Handle<JSObject*> callable) const override;
-  bool unwatch(JSContext* cx, JS::Handle<JSObject*> proxy,
-               JS::Handle<jsid> id) const override;
-
 protected:
   // Hook for subclasses to implement shared ownPropertyKeys()/keys()
   // functionality.  The "flags" argument is either JSITER_OWNONLY (for keys())
diff --git a/dom/bindings/test/test_Object.prototype_props.html b/dom/bindings/test/test_Object.prototype_props.html
index 03147eb03..3ab27c5e4 100644
--- a/dom/bindings/test/test_Object.prototype_props.html
+++ b/dom/bindings/test/test_Object.prototype_props.html
@@ -11,9 +11,9 @@ test(function() {
   // Codegen.py's CGDictionary.getMemberDefinition method.
   var expected = [
       "constructor", "toSource", "toString", "toLocaleString", "valueOf",
-      "watch", "unwatch", "hasOwnProperty", "isPrototypeOf",
-      "propertyIsEnumerable", "__defineGetter__", "__defineSetter__",
-      "__lookupGetter__", "__lookupSetter__", "__proto__"
+      "hasOwnProperty", "isPrototypeOf", "propertyIsEnumerable",
+      "__defineGetter__", "__defineSetter__", "__lookupGetter__",
+      "__lookupSetter__", "__proto__"
     ];
   assert_array_equals(props.sort(), expected.sort());
 }, "Own properties of Object.prototype");
diff --git a/dom/canvas/WebGLContextBuffers.cpp b/dom/canvas/WebGLContextBuffers.cpp
index af506c01c..f53f9d7d7 100644
--- a/dom/canvas/WebGLContextBuffers.cpp
+++ b/dom/canvas/WebGLContextBuffers.cpp
@@ -9,6 +9,8 @@
 #include "WebGLBuffer.h"
 #include "WebGLVertexArray.h"
 
+#include "mozilla/CheckedInt.h"
+
 namespace mozilla {
 
 WebGLRefPtr<WebGLBuffer>*
@@ -345,6 +347,16 @@ WebGLContext::BufferData(GLenum target, WebGLsizeiptr size, GLenum usage)
 
     ////
 
+    const auto checkedSize = CheckedInt<size_t>(size);
+    if (!checkedSize.isValid())
+      return ErrorOutOfMemory("%s: Size too large for platform.", funcName);
+     
+#if defined(XP_MACOSX)
+    if (gl->WorkAroundDriverBugs() && size > 1200000000) {
+      return ErrorOutOfMemory("Allocations larger than 1200000000 fail on MacOS.");
+    }
+#endif
+
     const UniqueBuffer zeroBuffer(calloc(size, 1));
     if (!zeroBuffer)
         return ErrorOutOfMemory("%s: Failed to allocate zeros.", funcName);
diff --git a/dom/grid/GridLines.cpp b/dom/grid/GridLines.cpp
index fac645c64..898885346 100644
--- a/dom/grid/GridLines.cpp
+++ b/dom/grid/GridLines.cpp
@@ -90,7 +90,9 @@ GridLines::SetLineInfo(const ComputedGridTrackInfo* aTrackInfo,
     for (uint32_t i = aTrackInfo->mStartFragmentTrack;
          i < aTrackInfo->mEndFragmentTrack + 1;
          i++) {
-      uint32_t line1Index = i + 1;
+      // Since line indexes are 1-based, calculate a 1-based value
+      // for this track to simplify some calculations.
+      const uint32_t line1Index = i + 1;
 
       startOfNextTrack = (i < aTrackInfo->mEndFragmentTrack) ?
                          aTrackInfo->mPositions[i] :
@@ -127,7 +129,8 @@ GridLines::SetLineInfo(const ComputedGridTrackInfo* aTrackInfo,
         }
       }
 
-      if (i >= aTrackInfo->mRepeatFirstTrack &&
+      if (i >= (aTrackInfo->mRepeatFirstTrack +
+                aTrackInfo->mNumLeadingImplicitTracks) &&
           repeatIndex < numRepeatTracks) {
         numAddedLines += AppendRemovedAutoFits(aTrackInfo,
                                                aLineInfo,
@@ -139,23 +142,30 @@ GridLines::SetLineInfo(const ComputedGridTrackInfo* aTrackInfo,
 
       RefPtr<GridLine> line = new GridLine(this);
       mLines.AppendElement(line);
+      MOZ_ASSERT(line1Index > 0, "line1Index must be positive.");
+      bool isBeforeFirstExplicit =
+        (line1Index <= aTrackInfo->mNumLeadingImplicitTracks);
+      // Calculate an actionable line number for this line, that could be used
+      // in a css grid property to align a grid item or area at that line.
+      // For implicit lines that appear before line 1, report a number of 0.
+      // We can't report negative indexes, because those have a different
+      // meaning in the css grid spec (negative indexes are negative-1-based
+      // from the end of the grid decreasing towards the front).
+      uint32_t lineNumber = isBeforeFirstExplicit ? 0 :
+        (line1Index - aTrackInfo->mNumLeadingImplicitTracks + numAddedLines);
+      GridDeclaration lineType =
+        (isBeforeFirstExplicit ||
+         line1Index > (aTrackInfo->mNumLeadingImplicitTracks +
+                       aTrackInfo->mNumExplicitTracks + 1))
+         ? GridDeclaration::Implicit
+         : GridDeclaration::Explicit;
       line->SetLineValues(
         lineNames,
         nsPresContext::AppUnitsToDoubleCSSPixels(lastTrackEdge),
         nsPresContext::AppUnitsToDoubleCSSPixels(startOfNextTrack -
                                                  lastTrackEdge),
-        line1Index + numAddedLines,
-        (
-          // Implicit if there are no explicit tracks, or if the index
-          // is before the first explicit track, or after
-          // a track beyond the last explicit track.
-          (aTrackInfo->mNumExplicitTracks == 0) ||
-          (i < aTrackInfo->mNumLeadingImplicitTracks) ||
-          (i > aTrackInfo->mNumLeadingImplicitTracks +
-               aTrackInfo->mNumExplicitTracks) ?
-            GridDeclaration::Implicit :
-            GridDeclaration::Explicit
-        )
+        lineNumber,
+        lineType
       );
 
       if (i < aTrackInfo->mEndFragmentTrack) {
@@ -215,11 +225,13 @@ GridLines::AppendRemovedAutoFits(const ComputedGridTrackInfo* aTrackInfo,
 
     RefPtr<GridLine> line = new GridLine(this);
     mLines.AppendElement(line);
+    uint32_t lineNumber = aTrackInfo->mRepeatFirstTrack +
+                          aRepeatIndex + 1;
     line->SetLineValues(
       aLineNames,
       nsPresContext::AppUnitsToDoubleCSSPixels(aLastTrackEdge),
       nsPresContext::AppUnitsToDoubleCSSPixels(0),
-      aTrackInfo->mRepeatFirstTrack + aRepeatIndex + 1,
+      lineNumber,
       GridDeclaration::Explicit
     );
 
diff --git a/dom/grid/test/chrome.ini b/dom/grid/test/chrome.ini
index 2241cf9eb..169fa9b89 100644
--- a/dom/grid/test/chrome.ini
+++ b/dom/grid/test/chrome.ini
@@ -2,6 +2,7 @@
 [chrome/test_grid_fragmentation.html]
 [chrome/test_grid_implicit.html]
 [chrome/test_grid_lines.html]
+[chrome/test_grid_line_numbers.html]
 [chrome/test_grid_object.html]
 [chrome/test_grid_repeats.html]
 [chrome/test_grid_tracks.html]
diff --git a/dom/grid/test/chrome/test_grid_implicit.html b/dom/grid/test/chrome/test_grid_implicit.html
index c7782e0e5..1f7142658 100644
--- a/dom/grid/test/chrome/test_grid_implicit.html
+++ b/dom/grid/test/chrome/test_grid_implicit.html
@@ -33,6 +33,11 @@ body {
 	grid-template-rows: [areaA-end areaB-start areaC-end] 50px [areaA-start areaB-end areaC-start];
 }
 
+.template4 {
+	grid-template-columns: 100px 50px 100px;
+	grid-template-rows: 50px;
+}
+
 .box {
 	background-color: #444;
 	color: #fff;
@@ -50,6 +55,9 @@ body {
 .d {
 	grid-area: areaD;
 }
+.e {
+	grid-column: -7 / 5;
+}
 </style>
 
 <script>
@@ -78,9 +86,12 @@ function runTests() {
 		is(grid.cols.lines[4].type, "implicit", "Grid column line 5 is implicit.");
 		is(grid.cols.lines[5].type, "implicit", "Grid column line 6 is implicit.");
 		
-		is(grid.rows.lines[0].type, "implicit", "Grid row line 1 is implicit.");
-		is(grid.rows.lines[1].type, "explicit", "Grid row line 2 is explicit.");
-		is(grid.rows.lines[3].type, "explicit", "Grid row line 4 is explicit.");
+		is(grid.rows.lines[0].type, "implicit", "Grid row line 0 is implicit.");
+		is(grid.rows.lines[0].number, 0, "Grid row line 0 has correct number.");
+		is(grid.rows.lines[1].type, "explicit", "Grid row line 1 is explicit.");
+		is(grid.rows.lines[1].number, 1, "Grid row line 1 has correct number.");
+		is(grid.rows.lines[3].type, "explicit", "Grid row line 3 is explicit.");
+		is(grid.rows.lines[3].number, 3, "Grid row line 3 has correct number.");
 		
 		// test that row line 1 gets the name forced on it by placement of item B
 		todo_isnot(grid.rows.lines[0].names.indexOf("got-this-name-implicitly"), -1,
@@ -221,6 +232,48 @@ function runTests() {
 		}
 	}
 
+	// test the fourth grid wrapper
+	wrapper = document.getElementById("wrapper4");
+	grid = wrapper.getGridFragments()[0];
+
+	// test column and row line counts
+	is(grid.cols.lines.length, 8,
+	"Grid.cols.lines property expands properly with implicit columns on both sides."
+	);
+	is(grid.rows.lines.length, 2,
+	"Grid.rows.lines property is as expected"
+	);
+
+	if (grid.cols.lines.length == 8) {
+	// check that all the lines get correct implict/explicit type and number
+	let expectedType = [
+		"implicit",
+		"implicit",
+		"implicit",
+		"explicit",
+		"explicit",
+		"explicit",
+		"explicit",
+		"implicit",
+		];
+	let expectedNumber = [
+		0,
+		0,
+		0,
+		1,
+		2,
+		3,
+		4,
+		5,
+		];
+
+	for (let i = 0; i < grid.cols.lines.length; i++) {
+		let line = grid.cols.lines[i];
+		is(line.type, expectedType[i], "Line index " + i + " has expected type.");
+		is(line.number, expectedNumber[i], "Line index " + i + " has expected number.");
+	}
+	}
+
 	SimpleTest.finish();
 }
 </script>
@@ -246,5 +299,9 @@ function runTests() {
 		<div id="boxC" class="box c">C</div>
 	</div>
 
+	<div id="wrapper4" class="wrapper template4">
+		<div id="boxE" class="box e">E</div>
+	</div>
+
 </body>
 </html>
diff --git a/dom/grid/test/chrome/test_grid_line_numbers.html b/dom/grid/test/chrome/test_grid_line_numbers.html
new file mode 100644
index 000000000..c8e5226b6
--- /dev/null
+++ b/dom/grid/test/chrome/test_grid_line_numbers.html
@@ -0,0 +1,101 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script type="text/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+<link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css" />
+<style>
+body {
+  margin: 40px;
+}
+.wrapper {
+  display: grid;
+  grid-gap: 0px;
+  background-color: #f00;
+}
+.wrapper > div {
+  background-color: #444;
+  color: #fff;
+}
+.repeatColumns {
+  width: 600px;
+  grid-auto-columns: 50px;
+  grid-template-columns: repeat(auto-fit, 100px);
+}
+.repeatRows {
+  height: 600px;
+  grid-auto-rows: 50px;
+  grid-template-rows: repeat(auto-fit, 100px);
+}
+</style>
+
+<script>
+'use strict';
+
+SimpleTest.waitForExplicitFinish();
+
+function testLines(elementName, lines, expectedValues) {
+  is(lines.count, expectedValues.count, elementName + " has expected number of lines.");
+  for (let i = 0; i < lines.length; i++) {
+    is(lines[i].number, expectedValues[i].number, elementName + " line index " + i + " has expected number.");
+  }
+}
+
+function runTests() {
+  let grid;
+  let lines;
+  let expectedValues;
+
+  grid = document.getElementById("gridWithColumns").getGridFragments()[0];
+  lines = grid.cols.lines;
+  expectedValues = [
+    { "number": 0 },
+    { "number": 0 },
+    { "number": 1 },
+    { "number": 2 },
+    { "number": 3 },
+    { "number": 4 },
+    { "number": 5 },
+    { "number": 6 },
+    { "number": 7 },
+    { "number": 8 },
+  ];
+  testLines("gridWithColumns", lines, expectedValues);
+
+  grid = document.getElementById("gridWithRows").getGridFragments()[0];
+  lines = grid.rows.lines;
+  expectedValues = [
+    { "number": 0 },
+    { "number": 0 },
+    { "number": 1 },
+    { "number": 2 },
+    { "number": 3 },
+    { "number": 4 },
+    { "number": 5 },
+    { "number": 6 },
+    { "number": 7 },
+    { "number": 8 },
+  ];
+  testLines("gridWithRows", lines, expectedValues);
+
+  SimpleTest.finish();
+}
+</script>
+</head>
+<body onLoad="runTests();">
+
+<div id="gridWithColumns" class="wrapper repeatColumns">
+<div style="grid-column: -9">A</div>
+<div style="grid-column: 4">B</div>
+<div style="grid-column: 7">C</div>
+</div>
+
+<div id="gridWithRows" class="wrapper repeatRows">
+<div style="grid-row: span 3 / 2">A</div>
+<div style="grid-row: 4">B</div>
+<div style="grid-row: 5">C</div>
+<div style="grid-row: span 2 / 8">D</div>
+</div>
+
+</body>
+</html>
diff --git a/dom/html/ImageDocument.cpp b/dom/html/ImageDocument.cpp
index f83a804be..451d989c3 100644
--- a/dom/html/ImageDocument.cpp
+++ b/dom/html/ImageDocument.cpp
@@ -659,7 +659,7 @@ ImageDocument::CreateSyntheticDocument()
   NS_ENSURE_SUCCESS(rv, rv);
 
   // Add the image element
-  Element* body = GetBodyElement();
+  RefPtr<Element> body = GetBodyElement();
   if (!body) {
     NS_WARNING("no body on image document!");
     return NS_ERROR_FAILURE;
diff --git a/dom/html/PluginDocument.cpp b/dom/html/PluginDocument.cpp
index 1c923ecc6..f6be8a915 100644
--- a/dom/html/PluginDocument.cpp
+++ b/dom/html/PluginDocument.cpp
@@ -206,7 +206,7 @@ PluginDocument::CreateSyntheticPluginDocument()
   NS_ENSURE_SUCCESS(rv, rv);
   // then attach our plugin
 
-  Element* body = GetBodyElement();
+  RefPtr<Element> body = GetBodyElement();
   if (!body) {
     NS_WARNING("no body on plugin document!");
     return NS_ERROR_FAILURE;
diff --git a/dom/html/VideoDocument.cpp b/dom/html/VideoDocument.cpp
index 1bd898564..76b2e326f 100644
--- a/dom/html/VideoDocument.cpp
+++ b/dom/html/VideoDocument.cpp
@@ -90,7 +90,7 @@ VideoDocument::CreateSyntheticVideoDocument(nsIChannel* aChannel,
   nsresult rv = MediaDocument::CreateSyntheticDocument();
   NS_ENSURE_SUCCESS(rv, rv);
 
-  Element* body = GetBodyElement();
+  RefPtr<Element> body = GetBodyElement();
   if (!body) {
     NS_WARNING("no body on video document!");
     return NS_ERROR_FAILURE;
diff --git a/dom/html/test/mochitest.ini b/dom/html/test/mochitest.ini
index 99b425df8..f619be5df 100644
--- a/dom/html/test/mochitest.ini
+++ b/dom/html/test/mochitest.ini
@@ -553,7 +553,6 @@ skip-if = true # Disabled for timeouts.
 [test_viewport.html]
 [test_documentAll.html]
 [test_document-element-inserted.html]
-[test_document.watch.html]
 [test_bug445004.html]
 skip-if = true || toolkit == 'android' # Disabled permanently (bug 559932).
 [test_bug446483.html]
diff --git a/dom/html/test/test_document.watch.html b/dom/html/test/test_document.watch.html
deleted file mode 100644
index 54509823b..000000000
--- a/dom/html/test/test_document.watch.html
+++ /dev/null
@@ -1,129 +0,0 @@
-<!DOCTYPE html>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=903332
--->
-<head>
-  <meta charset="utf-8">
-  <title>Test for Bug 903332</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-  <script type="application/javascript">
-
-  /** Test for Bug 903332 **/
-
-  var watch1Called;
-  function watch1(prop, oldValue, newValue)
-  {
-    is(watch1Called, false, "watch1Called not reset properly?");
-    watch1Called = true;
-
-    is(prop, "cookie", "wrong property name passed to watch1");
-    return newValue;
-  }
-
-  var watch2Called;
-  function watch2(prop, oldValue, newValue)
-  {
-    is(watch2Called, false, "watch2Called not reset properly?");
-    watch2Called = true;
-
-    is(prop, "cookie", "wrong property name passed to watch2");
-    return newValue;
-  }
-
-  // Just in case subsequent tests depend on a particular value...
-  var originalValue = document.cookie;
-  ok(true, "originalValue: " + originalValue);
-
-  var originalPrefix = originalValue.length > 0 ? originalValue + "; " : "";
-
-  try
-  {
-    // trial set (no watch) to verify things work
-    document.cookie = "first=set";
-    is(document.cookie, originalPrefix + "first=set",
-       "first value correct");
-
-    // add a watch
-    document.watch("cookie", watch1);
-
-    // set, check for watch invoked
-    watch1Called = false;
-    document.cookie = "second=set";
-    is(watch1Called, true, "watch1 function should be called");
-    is(document.cookie, originalPrefix + "first=set; second=set",
-       "second value correct");
-
-    // and a second time, just in case
-    watch1Called = false;
-    document.cookie = "third=set";
-    is(watch1Called, true, "watch1 function should be called");
-    is(document.cookie, originalPrefix + "first=set; second=set; third=set",
-       "third value correct");
-
-    // overwrite the current watch with a new one
-    document.watch("cookie", watch2);
-
-    // set, check for watch invoked
-    watch1Called = false;
-    watch2Called = false;
-    document.cookie = "fourth=set";
-    is(watch1Called, false, "watch1 invoked erroneously");
-    is(watch2Called, true, "watch2 function should be called");
-    is(document.cookie, originalPrefix + "first=set; second=set; third=set; fourth=set",
-       "fourth value correct");
-
-    // and a second time, just in case
-    watch1Called = false;
-    watch2Called = false;
-    document.cookie = "fifth=set";
-    is(watch1Called, false, "watch1 invoked erroneously");
-    is(watch2Called, true, "watch2 function should be called");
-    is(document.cookie, originalPrefix + "first=set; second=set; third=set; fourth=set; fifth=set",
-       "fifth value correct");
-
-    // remove the watch
-    document.unwatch("cookie");
-
-    // check for non-invocation now
-    watch1Called = false;
-    watch2Called = false;
-    document.cookie = "sixth=set";
-    is(watch1Called, false, "watch1 shouldn't be called");
-    is(watch2Called, false, "watch2 shouldn't be called");
-    is(document.cookie, originalPrefix + "first=set; second=set; third=set; fourth=set; fifth=set; sixth=set",
-       "sixth value correct");
-  }
-  finally
-  {
-    // reset
-    document.unwatch("cookie"); // harmless, should be no-op except if bugs
-
-    var d = new Date();
-    d.setTime(0);
-    var suffix = "=; expires=" + d.toGMTString();
-
-    document.cookie = "first" + suffix;
-    document.cookie = "second" + suffix;
-    document.cookie = "third" + suffix;
-    document.cookie = "fourth" + suffix;
-    document.cookie = "fifth" + suffix;
-    document.cookie = "sixth" + suffix;
-  }
-
-  is(document.cookie, originalValue,
-     "document.cookie isn't what it was initially!  expect bustage further " +
-     "down the line");
-  </script>
-</head>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=903332">Mozilla Bug 903332</a>
-<p id="display"></p>
-<div id="content" style="display: none">
-
-</div>
-<pre id="test">
-</pre>
-</body>
-</html>
diff --git a/dom/indexedDB/IDBCursor.cpp b/dom/indexedDB/IDBCursor.cpp
index af88742f0..be0295dc7 100644
--- a/dom/indexedDB/IDBCursor.cpp
+++ b/dom/indexedDB/IDBCursor.cpp
@@ -430,7 +430,7 @@ IDBCursor::Continue(JSContext* aCx,
   }
 
   Key key;
-  aRv = key.SetFromJSVal(aCx, aKey);
+  aRv = key.SetFromJSVal(aCx, aKey, /* aCallGetters */ true);
   if (aRv.Failed()) {
     return;
   }
@@ -536,7 +536,7 @@ IDBCursor::ContinuePrimaryKey(JSContext* aCx,
   }
 
   Key key;
-  aRv = key.SetFromJSVal(aCx, aKey);
+  aRv = key.SetFromJSVal(aCx, aKey, /* aCallGetters */ true);
   if (aRv.Failed()) {
     return;
   }
@@ -558,7 +558,7 @@ IDBCursor::ContinuePrimaryKey(JSContext* aCx,
   }
 
   Key primaryKey;
-  aRv = primaryKey.SetFromJSVal(aCx, aPrimaryKey);
+  aRv = primaryKey.SetFromJSVal(aCx, aPrimaryKey, /* aCallGetters */ true);
   if (aRv.Failed()) {
     return;
   }
@@ -718,7 +718,7 @@ IDBCursor::Update(JSContext* aCx, JS::Handle<JS::Value> aValue,
     const KeyPath& keyPath = objectStore->GetKeyPath();
     Key key;
 
-    aRv = keyPath.ExtractKey(aCx, aValue, key);
+    aRv = keyPath.ExtractKey(aCx, aValue, key, /* aCallGetters */ false);
     if (aRv.Failed()) {
       return nullptr;
     }
diff --git a/dom/indexedDB/IDBDatabase.cpp b/dom/indexedDB/IDBDatabase.cpp
index 5592e7f93..6ef352801 100644
--- a/dom/indexedDB/IDBDatabase.cpp
+++ b/dom/indexedDB/IDBDatabase.cpp
@@ -1257,6 +1257,9 @@ IDBDatabase::LastRelease()
   AssertIsOnOwningThread();
 
   CloseInternal();
+  
+  // Make sure that file actors created after the database was closed are expired.
+  ExpireFileActors(/* aExpireAll */ true);
 
   if (mBackgroundActor) {
     mBackgroundActor->SendDeleteMeInternal();
diff --git a/dom/indexedDB/IDBFactory.cpp b/dom/indexedDB/IDBFactory.cpp
index c1ef6353d..66471fe24 100644
--- a/dom/indexedDB/IDBFactory.cpp
+++ b/dom/indexedDB/IDBFactory.cpp
@@ -482,13 +482,13 @@ IDBFactory::Cmp(JSContext* aCx, JS::Handle<JS::Value> aFirst,
                 JS::Handle<JS::Value> aSecond, ErrorResult& aRv)
 {
   Key first, second;
-  nsresult rv = first.SetFromJSVal(aCx, aFirst);
+  nsresult rv = first.SetFromJSVal(aCx, aFirst, /* aCallGetters */ true);
   if (NS_FAILED(rv)) {
     aRv.Throw(rv);
     return 0;
   }
 
-  rv = second.SetFromJSVal(aCx, aSecond);
+  rv = second.SetFromJSVal(aCx, aSecond, /* aCallGetters */ true);
   if (NS_FAILED(rv)) {
     aRv.Throw(rv);
     return 0;
diff --git a/dom/indexedDB/IDBKeyRange.cpp b/dom/indexedDB/IDBKeyRange.cpp
index e61c80617..168fb4a5a 100644
--- a/dom/indexedDB/IDBKeyRange.cpp
+++ b/dom/indexedDB/IDBKeyRange.cpp
@@ -24,7 +24,7 @@ GetKeyFromJSVal(JSContext* aCx,
                 JS::Handle<JS::Value> aVal,
                 Key& aKey)
 {
-  nsresult rv = aKey.SetFromJSVal(aCx, aVal);
+  nsresult rv = aKey.SetFromJSVal(aCx, aVal, /* aCallGetters */ true);
   if (NS_FAILED(rv)) {
     MOZ_ASSERT(NS_ERROR_GET_MODULE(rv) == NS_ERROR_MODULE_DOM_INDEXEDDB);
     return rv;
diff --git a/dom/indexedDB/IDBObjectStore.cpp b/dom/indexedDB/IDBObjectStore.cpp
index 756792741..cbac30894 100644
--- a/dom/indexedDB/IDBObjectStore.cpp
+++ b/dom/indexedDB/IDBObjectStore.cpp
@@ -1084,7 +1084,7 @@ IDBObjectStore::AppendIndexUpdateInfo(
 
   if (!aMultiEntry) {
     Key key;
-    rv = aKeyPath.ExtractKey(aCx, aVal, key);
+    rv = aKeyPath.ExtractKey(aCx, aVal, key, /* aCallGetters */ false);
 
     // If an index's keyPath doesn't match an object, we ignore that object.
     if (rv == NS_ERROR_DOM_INDEXEDDB_DATA_ERR || key.IsUnset()) {
@@ -1114,7 +1114,7 @@ IDBObjectStore::AppendIndexUpdateInfo(
   }
 
   bool isArray;
-  if (!JS_IsArrayObject(aCx, val, &isArray)) {
+  if (NS_WARN_IF(!JS_IsArrayObject(aCx, val, &isArray))) {
     IDB_REPORT_INTERNAL_ERR();
     return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;
   }
@@ -1127,14 +1127,31 @@ IDBObjectStore::AppendIndexUpdateInfo(
     }
 
     for (uint32_t arrayIndex = 0; arrayIndex < arrayLength; arrayIndex++) {
-      JS::Rooted<JS::Value> arrayItem(aCx);
-      if (NS_WARN_IF(!JS_GetElement(aCx, array, arrayIndex, &arrayItem))) {
+      JS::RootedId indexId(aCx);

+      if (NS_WARN_IF(!JS_IndexToId(aCx, arrayIndex, &indexId))) {

+        IDB_REPORT_INTERNAL_ERR();

+        return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;

+      }

+

+      bool hasOwnProperty;

+      if (NS_WARN_IF(

+              !JS_HasOwnPropertyById(aCx, array, indexId, &hasOwnProperty))) {

+        IDB_REPORT_INTERNAL_ERR();

+        return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;

+      }

+

+      if (!hasOwnProperty) {

+        continue;

+      }

+

+      JS::RootedValue arrayItem(aCx);

+      if (NS_WARN_IF(!JS_GetPropertyById(aCx, array, indexId, &arrayItem))) {      
         IDB_REPORT_INTERNAL_ERR();
         return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;
       }
 
       Key value;
-      if (NS_FAILED(value.SetFromJSVal(aCx, arrayItem)) ||
+      if (NS_FAILED(value.SetFromJSVal(aCx, arrayItem, /* aCallGetters */ false)) ||
           value.IsUnset()) {
         // Not a value we can do anything with, ignore it.
         continue;
@@ -1153,7 +1170,7 @@ IDBObjectStore::AppendIndexUpdateInfo(
   }
   else {
     Key value;
-    if (NS_FAILED(value.SetFromJSVal(aCx, val)) ||
+    if (NS_FAILED(value.SetFromJSVal(aCx, val, /* aCallGetters */ false)) ||
         value.IsUnset()) {
       // Not a value we can do anything with, ignore it.
       return NS_OK;
@@ -1324,12 +1341,12 @@ IDBObjectStore::GetAddInfo(JSContext* aCx,
 
   if (!HasValidKeyPath()) {
     // Out-of-line keys must be passed in.
-    rv = aKey.SetFromJSVal(aCx, aKeyVal);
+    rv = aKey.SetFromJSVal(aCx, aKeyVal, /* aCallGetters */ true);
     if (NS_FAILED(rv)) {
       return rv;
     }
   } else if (!isAutoIncrement) {
-    rv = GetKeyPath().ExtractKey(aCx, aValue, aKey);
+    rv = GetKeyPath().ExtractKey(aCx, aValue, aKey, /* aCallGetters */ false);
     if (NS_FAILED(rv)) {
       return rv;
     }
@@ -1368,7 +1385,8 @@ IDBObjectStore::GetAddInfo(JSContext* aCx,
                                          aValue,
                                          aKey,
                                          &GetAddInfoCallback,
-                                         &data);
+                                         &data,
+                                         /* aCallGetters */ false);
   } else {
     rv = GetAddInfoCallback(aCx, &data);
   }
diff --git a/dom/indexedDB/Key.cpp b/dom/indexedDB/Key.cpp
index 0f693b2c6..575734af2 100644
--- a/dom/indexedDB/Key.cpp
+++ b/dom/indexedDB/Key.cpp
@@ -201,8 +201,11 @@ Key::ToLocaleBasedKey(Key& aTarget, const nsCString& aLocale) const
 }
 
 nsresult
-Key::EncodeJSValInternal(JSContext* aCx, JS::Handle<JS::Value> aVal,
-                         uint8_t aTypeOffset, uint16_t aRecursionDepth)
+Key::EncodeJSValInternal(JSContext* aCx,
+                         JS::Handle<JS::Value> aVal,
+                         uint8_t aTypeOffset,
+                         uint16_t aRecursionDepth,
+                         bool aCallGetters)
 {
   static_assert(eMaxType * kMaxArrayCollapse < 256,
                 "Unable to encode jsvals.");
@@ -257,13 +260,18 @@ Key::EncodeJSValInternal(JSContext* aCx, JS::Handle<JS::Value> aVal,
 
       for (uint32_t index = 0; index < length; index++) {
         JS::Rooted<JS::Value> val(aCx);
-        if (!JS_GetElement(aCx, obj, index, &val)) {
+        bool ok = aCallGetters ? JS_GetElement(aCx, obj, index, &val)
+                               : JS_GetOwnElement(aCx, obj, index, &val);
+        if (!ok) {
           IDB_REPORT_INTERNAL_ERR();
           return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;
         }
 
-        nsresult rv = EncodeJSValInternal(aCx, val, aTypeOffset,
-                                          aRecursionDepth + 1);
+        nsresult rv = EncodeJSValInternal(aCx,
+                                          val,
+                                          aTypeOffset,
+                                          aRecursionDepth + 1,
+                                          aCallGetters);
         if (NS_FAILED(rv)) {
           return rv;
         }
@@ -406,9 +414,10 @@ Key::DecodeJSValInternal(const unsigned char*& aPos, const unsigned char* aEnd,
 nsresult
 Key::EncodeJSVal(JSContext* aCx,
                  JS::Handle<JS::Value> aVal,
-                 uint8_t aTypeOffset)
+                 uint8_t aTypeOffset,
+                 bool aCallGetters)
 {
-  return EncodeJSValInternal(aCx, aVal, aTypeOffset, 0);
+  return EncodeJSValInternal(aCx, aVal, aTypeOffset, 0, aCallGetters);
 }
 
 void
@@ -741,7 +750,8 @@ Key::SetFromValueArray(mozIStorageValueArray* aValues,
 
 nsresult
 Key::SetFromJSVal(JSContext* aCx,
-                  JS::Handle<JS::Value> aVal)
+                  JS::Handle<JS::Value> aVal,
+                  bool aCallGetters)
 {
   mBuffer.Truncate();
 
@@ -750,7 +760,7 @@ Key::SetFromJSVal(JSContext* aCx,
     return NS_OK;
   }
 
-  nsresult rv = EncodeJSVal(aCx, aVal, 0);
+  nsresult rv = EncodeJSVal(aCx, aVal, 0, aCallGetters);
   if (NS_FAILED(rv)) {
     Unset();
     return rv;
@@ -793,9 +803,15 @@ Key::ToJSVal(JSContext* aCx,
 }
 
 nsresult
-Key::AppendItem(JSContext* aCx, bool aFirstOfArray, JS::Handle<JS::Value> aVal)
+Key::AppendItem(JSContext* aCx,
+                bool aFirstOfArray,
+                JS::Handle<JS::Value> aVal,
+                bool aCallGetters)
 {
-  nsresult rv = EncodeJSVal(aCx, aVal, aFirstOfArray ? eMaxType : 0);
+  nsresult rv = EncodeJSVal(aCx,
+                            aVal,
+                            aFirstOfArray ? eMaxType : 0,
+                            aCallGetters);
   if (NS_FAILED(rv)) {
     Unset();
     return rv;
diff --git a/dom/indexedDB/Key.h b/dom/indexedDB/Key.h
index 9d70ce6ad..a4fb65b48 100644
--- a/dom/indexedDB/Key.h
+++ b/dom/indexedDB/Key.h
@@ -203,7 +203,7 @@ public:
   }
 
   nsresult
-  SetFromJSVal(JSContext* aCx, JS::Handle<JS::Value> aVal);
+  SetFromJSVal(JSContext* aCx, JS::Handle<JS::Value> aVal, bool aCallGetters);
 
   nsresult
   ToJSVal(JSContext* aCx, JS::MutableHandle<JS::Value> aVal) const;
@@ -212,7 +212,10 @@ public:
   ToJSVal(JSContext* aCx, JS::Heap<JS::Value>& aVal) const;
 
   nsresult
-  AppendItem(JSContext* aCx, bool aFirstOfArray, JS::Handle<JS::Value> aVal);
+  AppendItem(JSContext* aCx,
+             bool aFirstOfArray,
+             JS::Handle<JS::Value> aVal,
+             bool aCallGetters);
 
   nsresult
   ToLocaleBasedKey(Key& aTarget, const nsCString& aLocale) const;
@@ -283,7 +286,10 @@ private:
 
   // Encoding functions. These append the encoded value to the end of mBuffer
   nsresult
-  EncodeJSVal(JSContext* aCx, JS::Handle<JS::Value> aVal, uint8_t aTypeOffset);
+  EncodeJSVal(JSContext* aCx,
+              JS::Handle<JS::Value> aVal,
+              uint8_t aTypeOffset,
+              bool aCallGetters);
 
   void
   EncodeString(const nsAString& aString, uint8_t aTypeOffset);
@@ -331,7 +337,8 @@ private:
   EncodeJSValInternal(JSContext* aCx,
                       JS::Handle<JS::Value> aVal,
                       uint8_t aTypeOffset,
-                      uint16_t aRecursionDepth);
+                      uint16_t aRecursionDepth,
+                      bool aCallGetters);
 
   static nsresult
   DecodeJSValInternal(const unsigned char*& aPos,
diff --git a/dom/indexedDB/KeyPath.cpp b/dom/indexedDB/KeyPath.cpp
index 30edd8cd7..0221c9450 100644
--- a/dom/indexedDB/KeyPath.cpp
+++ b/dom/indexedDB/KeyPath.cpp
@@ -372,11 +372,13 @@ KeyPath::AppendStringWithValidation(const nsAString& aString)
 }
 
 nsresult
-KeyPath::ExtractKey(JSContext* aCx, const JS::Value& aValue, Key& aKey) const
+KeyPath::ExtractKey(JSContext* aCx,
+                    const JS::Value& aValue,
+                    Key& aKey,
+                    bool aCallGetters) const
 {
   uint32_t len = mStrings.Length();
   JS::Rooted<JS::Value> value(aCx);
-
   aKey.Unset();
 
   for (uint32_t i = 0; i < len; ++i) {
@@ -388,7 +390,10 @@ KeyPath::ExtractKey(JSContext* aCx, const JS::Value& aValue, Key& aKey) const
       return rv;
     }
 
-    if (NS_FAILED(aKey.AppendItem(aCx, IsArray() && i == 0, value))) {
+    if (NS_FAILED(aKey.AppendItem(aCx,
+                                  IsArray() && i == 0,
+                                  value,
+                                  aCallGetters))) {
       NS_ASSERTION(aKey.IsUnset(), "Encoding error should unset");
       return NS_ERROR_DOM_INDEXEDDB_DATA_ERR;
     }
@@ -437,9 +442,12 @@ KeyPath::ExtractKeyAsJSVal(JSContext* aCx, const JS::Value& aValue,
 }
 
 nsresult
-KeyPath::ExtractOrCreateKey(JSContext* aCx, const JS::Value& aValue,
-                            Key& aKey, ExtractOrCreateKeyCallback aCallback,
-                            void* aClosure) const
+KeyPath::ExtractOrCreateKey(JSContext* aCx,
+                            const JS::Value& aValue,
+                            Key& aKey,
+                            ExtractOrCreateKeyCallback aCallback,
+                            void* aClosure,
+                            bool aCallGetters) const
 {
   NS_ASSERTION(IsString(), "This doesn't make sense!");
 
@@ -455,7 +463,7 @@ KeyPath::ExtractOrCreateKey(JSContext* aCx, const JS::Value& aValue,
     return rv;
   }
 
-  if (NS_FAILED(aKey.AppendItem(aCx, false, value))) {
+  if (NS_FAILED(aKey.AppendItem(aCx, false, value, aCallGetters))) {
     NS_ASSERTION(aKey.IsUnset(), "Should be unset");
     return value.isUndefined() ? NS_OK : NS_ERROR_DOM_INDEXEDDB_DATA_ERR;
   }
diff --git a/dom/indexedDB/KeyPath.h b/dom/indexedDB/KeyPath.h
index c133cdc4a..e6e5f57d4 100644
--- a/dom/indexedDB/KeyPath.h
+++ b/dom/indexedDB/KeyPath.h
@@ -72,7 +72,10 @@ public:
   Parse(const Nullable<OwningStringOrStringSequence>& aValue, KeyPath* aKeyPath);
 
   nsresult
-  ExtractKey(JSContext* aCx, const JS::Value& aValue, Key& aKey) const;
+  ExtractKey(JSContext* aCx,
+             const JS::Value& aValue,
+             Key& aKey,
+             bool aCallGetters) const;
 
   nsresult
   ExtractKeyAsJSVal(JSContext* aCx, const JS::Value& aValue,
@@ -82,9 +85,12 @@ public:
   (*ExtractOrCreateKeyCallback)(JSContext* aCx, void* aClosure);
 
   nsresult
-  ExtractOrCreateKey(JSContext* aCx, const JS::Value& aValue, Key& aKey,
+  ExtractOrCreateKey(JSContext* aCx,
+                     const JS::Value& aValue,
+                     Key& aKey,
                      ExtractOrCreateKeyCallback aCallback,
-                     void* aClosure) const;
+                     void* aClosure,
+                     bool aCallGetters) const;
 
   inline bool IsValid() const {
     return mType != NONEXISTENT;
diff --git a/dom/media/AudioStream.h b/dom/media/AudioStream.h
index acc38b93d..199314d4b 100644
--- a/dom/media/AudioStream.h
+++ b/dom/media/AudioStream.h
@@ -17,6 +17,10 @@
 #include "mozilla/UniquePtr.h"
 #include "CubebUtils.h"
 #include "soundtouch/SoundTouchFactory.h"
+#ifdef XP_SOLARIS
+#include "soundtouch/SoundTouch.h"
+#endif
+
 
 namespace mozilla {
 
diff --git a/dom/plugins/base/npapi.h b/dom/plugins/base/npapi.h
index 12ac635c7..e554aaabc 100644
--- a/dom/plugins/base/npapi.h
+++ b/dom/plugins/base/npapi.h
@@ -327,9 +327,12 @@ typedef enum {
 #define NP_ABI_GCC3_MASK  0x10000000
 /*
  *   gcc 3.x generated vtables on UNIX and OSX are incompatible with
- *   previous compilers.
+ *   previous compilers. Flash plugin binaries for Solaris were compiled
+ *   with Sun Studio, so this has to be false to make things work. This may
+ *   become a problem in the future when/if new plugins are compiled with 
+ *   GCC, however.
  */
-#if (defined(XP_UNIX) && defined(__GNUC__) && (__GNUC__ >= 3))
+#if (defined(XP_UNIX) && defined(__GNUC__) && (__GNUC__ >= 3) && !defined(XP_SOLARIS))
 #define _NP_ABI_MIXIN_FOR_GCC3 NP_ABI_GCC3_MASK
 #else
 #define _NP_ABI_MIXIN_FOR_GCC3 0
diff --git a/dom/plugins/base/nptypes.h b/dom/plugins/base/nptypes.h
index c36532472..d0cef6540 100644
--- a/dom/plugins/base/nptypes.h
+++ b/dom/plugins/base/nptypes.h
@@ -22,6 +22,19 @@
   typedef unsigned int uint32_t;
   typedef long long int64_t;
   typedef unsigned long long uint64_t;
+#elif defined(__sun)
+  /*
+   * SunOS ships an inttypes.h header that defines [u]int32_t,
+   * but not bool for C.
+   */
+  #include <inttypes.h>
+
+
+  #ifndef __cplusplus
+    typedef int bool;
+    #define true   1
+    #define false  0
+  #endif  
 #elif defined(bsdi) || defined(FREEBSD) || defined(OPENBSD)
   /*
    * BSD/OS, FreeBSD, and OpenBSD ship sys/types.h that define int32_t and
diff --git a/dom/plugins/base/nsJSNPRuntime.cpp b/dom/plugins/base/nsJSNPRuntime.cpp
index 05e0ec4ba..1d42c18d6 100644
--- a/dom/plugins/base/nsJSNPRuntime.cpp
+++ b/dom/plugins/base/nsJSNPRuntime.cpp
@@ -248,7 +248,6 @@ const static js::ObjectOps sNPObjectJSWrapperObjectOps = {
     nullptr, // setProperty
     nullptr, // getOwnPropertyDescriptor
     nullptr, // deleteProperty
-    nullptr, nullptr, // watch/unwatch
     nullptr, // getElements
     NPObjWrapper_Enumerate,
     nullptr,
diff --git a/dom/plugins/base/nsPluginsDirUnix.cpp b/dom/plugins/base/nsPluginsDirUnix.cpp
index e6956c34c..de3b7a2d1 100644
--- a/dom/plugins/base/nsPluginsDirUnix.cpp
+++ b/dom/plugins/base/nsPluginsDirUnix.cpp
@@ -19,7 +19,9 @@
 #include "nsIPrefService.h"
 
 #define LOCAL_PLUGIN_DLL_SUFFIX ".so"
-#if defined(LINUX)
+#ifdef XP_SOLARIS
+#define DEFAULT_X11_PATH "/usr/openwin/lib"
+#elif defined(LINUX)
 #define DEFAULT_X11_PATH "/usr/X11R6/lib/"
 #elif defined(__APPLE__)
 #define DEFAULT_X11_PATH "/usr/X11R6/lib"
@@ -92,7 +94,11 @@ static bool LoadExtraSharedLib(const char *name, char **soname, bool tryToGetSon
 
 #define PLUGIN_MAX_NUMBER_OF_EXTRA_LIBS 32
 #define PREF_PLUGINS_SONAME "plugin.soname.list"
+#ifdef XP_SOLARIS
+#define DEFAULT_EXTRA_LIBS_LIST "libXt" LOCAL_PLUGIN_DLL_SUFFIX ":libXext" LOCAL_PLUGIN_DLL_SUFFIX ":libXm" LOCAL_PLUGIN_DLL_SUFFIX
+#else
 #define DEFAULT_EXTRA_LIBS_LIST "libXt" LOCAL_PLUGIN_DLL_SUFFIX ":libXext" LOCAL_PLUGIN_DLL_SUFFIX
+#endif
 /*
  this function looks for
  user_pref("plugin.soname.list", "/usr/X11R6/lib/libXt.so.6:libXext.so");
@@ -264,11 +270,15 @@ nsresult nsPluginFile::LoadPlugin(PRLibrary **outLibrary)
     // at runtime.  Explicitly opening Xt/Xext into the global
     // namespace before attempting to load the plug-in seems to
     // work fine.
-
-
+#if defined(XP_SOLARIS)
+    // Acrobat/libXm: Lazy resolving might cause crash later (bug 211587)
+    *outLibrary = PR_LoadLibraryWithFlags(libSpec, PR_LD_NOW);
+    pLibrary = *outLibrary;
+#else
     // Some dlopen() doesn't recover from a failed PR_LD_NOW (bug 223744)
     *outLibrary = PR_LoadLibraryWithFlags(libSpec, 0);
     pLibrary = *outLibrary;
+#endif    
     if (!pLibrary) {
         LoadExtraSharedLibs();
         // try reload plugin once more
diff --git a/dom/plugins/ipc/PluginMessageUtils.cpp b/dom/plugins/ipc/PluginMessageUtils.cpp
index 47653fe6e..5b1d1667f 100644
--- a/dom/plugins/ipc/PluginMessageUtils.cpp
+++ b/dom/plugins/ipc/PluginMessageUtils.cpp
@@ -82,7 +82,7 @@ MediateRace(const MessageChannel::MessageInfo& parent,
   }
 }
 
-#if defined(OS_LINUX)
+#if defined(OS_LINUX) || defined(OS_SOLARIS)
 static string
 ReplaceAll(const string& haystack, const string& needle, const string& with)
 {
@@ -101,7 +101,7 @@ ReplaceAll(const string& haystack, const string& needle, const string& with)
 string
 MungePluginDsoPath(const string& path)
 {
-#if defined(OS_LINUX)
+#if defined(OS_LINUX) || defined(OS_SOLARIS)
   // https://bugzilla.mozilla.org/show_bug.cgi?id=519601
   return ReplaceAll(path, "netscape", "netsc@pe");
 #else
@@ -112,7 +112,7 @@ MungePluginDsoPath(const string& path)
 string
 UnmungePluginDsoPath(const string& munged)
 {
-#if defined(OS_LINUX)
+#if defined(OS_LINUX) || defined(OS_SOLARIS)
   return ReplaceAll(munged, "netsc@pe", "netscape");
 #else
   return munged;
diff --git a/dom/plugins/ipc/PluginModuleChild.cpp b/dom/plugins/ipc/PluginModuleChild.cpp
index cbf6e509f..f943dfc42 100644
--- a/dom/plugins/ipc/PluginModuleChild.cpp
+++ b/dom/plugins/ipc/PluginModuleChild.cpp
@@ -286,7 +286,7 @@ PluginModuleChild::InitForChrome(const std::string& aPluginFilename,
 
     // TODO: use PluginPRLibrary here
 
-#if defined(OS_LINUX) || defined(OS_BSD)
+#if defined(OS_LINUX) || defined(OS_BSD) || defined(OS_SOLARIS)
     mShutdownFunc =
         (NP_PLUGINSHUTDOWN) PR_FindFunctionSymbol(mLibrary, "NP_Shutdown");
 
@@ -1821,7 +1821,7 @@ PluginModuleChild::AnswerNP_GetEntryPoints(NPError* _retval)
     AssertPluginThread();
     MOZ_ASSERT(mIsChrome);
 
-#if defined(OS_LINUX) || defined(OS_BSD)
+#if defined(OS_LINUX) || defined(OS_BSD) || defined(OS_SOLARIS)
     return true;
 #elif defined(OS_WIN) || defined(OS_MACOSX)
     *_retval = mGetEntryPointsFunc(&mFunctions);
@@ -1866,7 +1866,7 @@ PluginModuleChild::DoNP_Initialize(const PluginSettings& aSettings)
 #endif
 
     NPError result;
-#if defined(OS_LINUX) || defined(OS_BSD)
+#if defined(OS_LINUX) || defined(OS_BSD) || defined(OS_SOLARIS)
     result = mInitializeFunc(&sBrowserFuncs, &mFunctions);
 #elif defined(OS_WIN) || defined(OS_MACOSX)
     result = mInitializeFunc(&sBrowserFuncs);
diff --git a/dom/plugins/ipc/PluginModuleChild.h b/dom/plugins/ipc/PluginModuleChild.h
index 681743582..5e4fa7d20 100644
--- a/dom/plugins/ipc/PluginModuleChild.h
+++ b/dom/plugins/ipc/PluginModuleChild.h
@@ -258,7 +258,7 @@ private:
 
     // we get this from the plugin
     NP_PLUGINSHUTDOWN mShutdownFunc;
-#if defined(OS_LINUX) || defined(OS_BSD)
+#if defined(OS_LINUX) || defined(OS_BSD) || defined(OS_SOLARIS)
     NP_PLUGINUNIXINIT mInitializeFunc;
 #elif defined(OS_WIN) || defined(OS_MACOSX)
     NP_PLUGININIT mInitializeFunc;
diff --git a/dom/security/nsCSPContext.cpp b/dom/security/nsCSPContext.cpp
index 65be02809..56a119e1a 100644
--- a/dom/security/nsCSPContext.cpp
+++ b/dom/security/nsCSPContext.cpp
@@ -513,8 +513,19 @@ nsCSPContext::GetAllowsInline(nsContentPolicyType aContentType,
   for (uint32_t i = 0; i < mPolicies.Length(); i++) {
     bool allowed =
       mPolicies[i]->allows(aContentType, CSP_UNSAFE_INLINE, EmptyString(), aParserCreated) ||
-      mPolicies[i]->allows(aContentType, CSP_NONCE, aNonce, aParserCreated) ||
-      mPolicies[i]->allows(aContentType, CSP_HASH, aContent, aParserCreated);
+      mPolicies[i]->allows(aContentType, CSP_NONCE, aNonce, aParserCreated);
+      
+    // If the inlined script or style is allowed by either unsafe-inline or the
+    // nonce, go ahead and shortcut this loop.
+    if (allowed) {
+      continue;
+    }
+    
+    // Check if the csp-hash matches against the hash of the script.
+    // If we don't have any content to check, block the script.
+    if (!aContent.IsEmpty()) {
+      allowed = mPolicies[i]->allows(aContentType, CSP_HASH, aContent, aParserCreated);
+    }
 
     if (!allowed) {
       // policy is violoated: deny the load unless policy is report only and
diff --git a/dom/security/nsCSPUtils.cpp b/dom/security/nsCSPUtils.cpp
index 71c8e3433..d07ad7945 100644
--- a/dom/security/nsCSPUtils.cpp
+++ b/dom/security/nsCSPUtils.cpp
@@ -641,13 +641,22 @@ nsCSPHostSrc::permits(nsIURI* aUri, const nsAString& aNonce, bool aWasRedirected
   // just a specific scheme, the parser should generate a nsCSPSchemeSource.
   NS_ASSERTION((!mHost.IsEmpty()), "host can not be the empty string");
 
+  // Before we can check if the host matches, we have to
+  // extract the host part from aUri.
+  nsAutoCString uriHost;
+  nsresult rv = aUri->GetAsciiHost(uriHost);
+  NS_ENSURE_SUCCESS(rv, false);
+
+  nsString decodedUriHost;
+  CSP_PercentDecodeStr(NS_ConvertUTF8toUTF16(uriHost), decodedUriHost);
+
   // 2) host matching: Enforce a single *
   if (mHost.EqualsASCII("*")) {
     // The single ASTERISK character (*) does not match a URI's scheme of a type
     // designating a globally unique identifier (such as blob:, data:, or filesystem:)
-    // At the moment firefox does not support filesystem; but for future compatibility
+    // At the moment UXP does not support "filesystem:" but for future compatibility
     // we support it in CSP according to the spec, see: 4.2.2 Matching Source Expressions
-    // Note, that whitelisting any of these schemes would call nsCSPSchemeSrc::permits().
+    // Note: whitelisting any of these schemes would call nsCSPSchemeSrc::permits().
     bool isBlobScheme =
       (NS_SUCCEEDED(aUri->SchemeIs("blob", &isBlobScheme)) && isBlobScheme);
     bool isDataScheme =
@@ -658,20 +667,15 @@ nsCSPHostSrc::permits(nsIURI* aUri, const nsAString& aNonce, bool aWasRedirected
     if (isBlobScheme || isDataScheme || isFileScheme) {
       return false;
     }
-    return true;
-  }
-
-  // Before we can check if the host matches, we have to
-  // extract the host part from aUri.
-  nsAutoCString uriHost;
-  nsresult rv = aUri->GetAsciiHost(uriHost);
-  NS_ENSURE_SUCCESS(rv, false);
-
-  nsString decodedUriHost;
-  CSP_PercentDecodeStr(NS_ConvertUTF8toUTF16(uriHost), decodedUriHost);
 
+    // If no scheme is present there also won't be a port and folder to check
+    // which means we can return early.
+    if (mScheme.IsEmpty()) {
+      return true;
+    }
+  }
   // 4.5) host matching: Check if the allowed host starts with a wilcard.
-  if (mHost.First() == '*') {
+  else if (mHost.First() == '*') {
     NS_ASSERTION(mHost[1] == '.', "Second character needs to be '.' whenever host starts with '*'");
 
     // Eliminate leading "*", but keeping the FULL STOP (.) thereafter before checking
diff --git a/dom/svg/crashtests/880544-1.svg b/dom/svg/crashtests/880544-1.svg
deleted file mode 100644
index 9052d2396..000000000
--- a/dom/svg/crashtests/880544-1.svg
+++ /dev/null
@@ -1,15 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg">

-  <script>//<![CDATA[

-

-function add_watch()

-{

-  document.getElementById("p").transform.baseVal.watch("0", function(){});

-}

-

-window.addEventListener("load", add_watch, false);

-

-  //]]></script>

-

-  <path id="p" transform="scale(1)" />

-

-</svg>

diff --git a/dom/svg/crashtests/880544-2.svg b/dom/svg/crashtests/880544-2.svg
deleted file mode 100644
index 7570c7cbf..000000000
--- a/dom/svg/crashtests/880544-2.svg
+++ /dev/null
@@ -1,15 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg">

-  <script>//<![CDATA[

-

-function add_watch()

-{

-  document.getElementById("e").x.baseVal.watch("0", function(){});

-}

-

-window.addEventListener("load", add_watch, false);

-

-  //]]></script>

-

-  <text id="e" x="10">foo</text>

-

-</svg>

diff --git a/dom/svg/crashtests/880544-3.svg b/dom/svg/crashtests/880544-3.svg
deleted file mode 100644
index 5791b8ec6..000000000
--- a/dom/svg/crashtests/880544-3.svg
+++ /dev/null
@@ -1,15 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg">

-  <script>//<![CDATA[

-

-function add_watch()

-{

-  document.getElementById("e").rotate.baseVal.watch("0", function(){});

-}

-

-window.addEventListener("load", add_watch, false);

-

-  //]]></script>

-

-  <text id="e" rotate="10">foo</text>

-

-</svg>

diff --git a/dom/svg/crashtests/880544-4.svg b/dom/svg/crashtests/880544-4.svg
deleted file mode 100644
index 7bdb80f47..000000000
--- a/dom/svg/crashtests/880544-4.svg
+++ /dev/null
@@ -1,15 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg">

-  <script>//<![CDATA[

-

-function add_watch()

-{

-  document.getElementById("e").pathSegList.watch("0", function(){});

-}

-

-window.addEventListener("load", add_watch, false);

-

-  //]]></script>

-

-  <path id="e" d="M0,0"/>

-

-</svg>

diff --git a/dom/svg/crashtests/880544-5.svg b/dom/svg/crashtests/880544-5.svg
deleted file mode 100644
index ef7f468f8..000000000
--- a/dom/svg/crashtests/880544-5.svg
+++ /dev/null
@@ -1,15 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg">

-  <script>//<![CDATA[

-

-function add_watch()

-{

-  document.getElementById("e").points.watch("0", function(){});

-}

-

-window.addEventListener("load", add_watch, false);

-

-  //]]></script>

-

-  <polygon id="e" points="0,0"/>

-

-</svg>

diff --git a/dom/svg/crashtests/crashtests.list b/dom/svg/crashtests/crashtests.list
index 147838bbe..b2e920152 100644
--- a/dom/svg/crashtests/crashtests.list
+++ b/dom/svg/crashtests/crashtests.list
@@ -66,11 +66,6 @@ load 837450-1.svg
 load 842463-1.html
 load 847138-1.svg
 load 864509.svg
-load 880544-1.svg
-load 880544-2.svg
-load 880544-3.svg
-load 880544-4.svg
-load 880544-5.svg
 load 898915-1.svg
 load 1035248-1.svg
 load 1035248-2.svg
diff --git a/dom/tests/mochitest/bugs/iframe_bug38959-1.html b/dom/tests/mochitest/bugs/iframe_bug38959-1.html
deleted file mode 100644
index d4c16c47a..000000000
--- a/dom/tests/mochitest/bugs/iframe_bug38959-1.html
+++ /dev/null
@@ -1,14 +0,0 @@
-<html>
-<head>
-	<title>Iframe test for bug 38959</title>
-</head>
-<body">
-<script>
-
-x = false;
-window.opener.postMessage(1, "http://mochi.test:8888");
-window.close();
-
-</script>
-</body>
-</html>
diff --git a/dom/tests/mochitest/bugs/iframe_bug38959-2.html b/dom/tests/mochitest/bugs/iframe_bug38959-2.html
deleted file mode 100644
index 36cd0c156..000000000
--- a/dom/tests/mochitest/bugs/iframe_bug38959-2.html
+++ /dev/null
@@ -1,14 +0,0 @@
-<html>
-<head>
-	<title>Iframe test for bug 38959</title>
-</head>
-<body">
-<script>
-
-x = true;
-window.opener.postMessage(2, "http://mochi.test:8888");
-window.close();
-
-</script>
-</body>
-</html>
diff --git a/dom/tests/mochitest/bugs/mochitest.ini b/dom/tests/mochitest/bugs/mochitest.ini
index e0c71f857..309aab6e0 100644
--- a/dom/tests/mochitest/bugs/mochitest.ini
+++ b/dom/tests/mochitest/bugs/mochitest.ini
@@ -23,8 +23,6 @@ support-files =
   grandchild_bug260264.html
   iframe_bug304459-1.html
   iframe_bug304459-2.html
-  iframe_bug38959-1.html
-  iframe_bug38959-2.html
   iframe_bug430276-2.html
   iframe_bug430276.html
   iframe_bug440572.html
@@ -64,7 +62,6 @@ skip-if = toolkit == 'android' #TIMED_OUT
 [test_bug377539.html]
 [test_bug384122.html]
 [test_bug389366.html]
-[test_bug38959.html]
 [test_bug393974.html]
 [test_bug394769.html]
 [test_bug396843.html]
diff --git a/dom/tests/mochitest/bugs/test_bug38959.html b/dom/tests/mochitest/bugs/test_bug38959.html
deleted file mode 100644
index a8d07d1a6..000000000
--- a/dom/tests/mochitest/bugs/test_bug38959.html
+++ /dev/null
@@ -1,57 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=38959
--->
-<head>
-  <title>Test for Bug 38959</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=38959">Mozilla Bug 38959</a>
-<p id="display"></p>
-<div id="content" style="display: none">
-  <iframe id="frame"></iframe>
-</div>
-<pre id="test">
-<script type="application/javascript">
-
-/** Test for Bug 38959 **/
-
-var newValue;
-
-function watcher(id, ol, ne)
-{
-  newValue = ne;
-  return ne;
-}
-
-function openWindow(url, crossOrigin)
-{
-  newValue = true;
-  var w = window.open(url);
-  w.watch("x", watcher);
-}
-
-function receiveMessage(evt)
-{
-  ok(newValue, "Watchpoints only allowed same-origin.");
-  if (evt.data == 1) {
-    openWindow("/tests/dom/tests/mochitest/bugs/iframe_bug38959-2.html");
-  }
-  else {
-    SimpleTest.finish();
-  }
-}
-
-SimpleTest.waitForExplicitFinish();
-
-window.addEventListener("message", receiveMessage, false);
-
-openWindow("http://example.org/tests/dom/tests/mochitest/bugs/iframe_bug38959-1.html");
-
-</script>
-</pre>
-</body>
-</html>