Merge remote-tracking branch 'origin/master' into custom

2026-09-07 00:08:39 +09:00 · 2020-01-24 09:39:16 +08:00 · 2020-01-24 09:39:16 +08:00 · 678ad26488
commit 678ad26488
parent ac0a9f144e 0d69766fb3
87 changed files with 492 additions and 1892 deletions
--- a/application/basilisk/installer/package-manifest.in
+++ b/application/basilisk/installer/package-manifest.in
@ -638,7 +638,7 @@
 ; All the pref files must be part of base to prevent migration bugs
@RESPATH@/browser/@PREF_DIR@/basilisk.js
@RESPATH@/browser/@PREF_DIR@/basilisk-branding.js
-@RESPATH@/greprefs.js
+@RESPATH@/goanna.js
@RESPATH@/defaults/autoconfig/prefcalls.js
@RESPATH@/browser/defaults/permissions

--- a/application/palemoon/branding/shared/pref/uaoverrides.inc
+++ b/application/palemoon/branding/shared/pref/uaoverrides.inc
@ -67,6 +67,7 @@ pref("@GUAO_PREF@.altibox.no","Mozilla/5.0 (@OS_SLICE@ rv:@GRE_VERSION@) @GRE_DA
 pref("@GUAO_PREF@.firefox.com","Mozilla/5.0 (@OS_SLICE@ rv:@GRE_VERSION@) @GRE_DATE_SLICE@ @PM_SLICE@");
 pref("@GUAO_PREF@.mozilla.org","Mozilla/5.0 (@OS_SLICE@ rv:@GRE_VERSION@) @GRE_DATE_SLICE@ @PM_SLICE@");
 pref("@GUAO_PREF@.mozilla.com","Mozilla/5.0 (@OS_SLICE@ rv:@GRE_VERSION@) @GRE_DATE_SLICE@ @PM_SLICE@");
+pref("@GUAO_PREF@.github.com","Mozilla/5.0 (@OS_SLICE@ rv:@GRE_VERSION@) @GRE_DATE_SLICE@ @PM_SLICE@");

 // UA-Sniffing domains below have indicated no interest in supporting Pale Moon (BOO!)
 pref("@GUAO_PREF@.humblebundle.com","Mozilla/5.0 (@OS_SLICE@ rv:@GK_VERSION@) @GK_SLICE@ @FX_SLICE@ (Pale Moon)");
--- a/application/palemoon/installer/package-manifest.in
+++ b/application/palemoon/installer/package-manifest.in
@ -234,7 +234,7 @@
@RESPATH@/browser/defaults/permissions
@RESPATH@/browser/@PREF_DIR@/palemoon.js
@RESPATH@/browser/@PREF_DIR@/palemoon-branding.js
-@RESPATH@/greprefs.js
+@RESPATH@/goanna.js
@RESPATH@/defaults/autoconfig/prefcalls.js

 ; Warning: changing the path to channel-prefs.js can cause bugs (Bug 756325)
--- a/build/directive4.py
+++ b/build/directive4.py
@ -33,7 +33,6 @@ if ('MOZ_OFFICIAL_BRANDING' in listConfig) or (strBrandingDirectory.endswith("br
    # Applies to Pale Moon and Basilisk
    if ('MC_BASILISK' in listConfig) or ('MC_PALEMOON' in listConfig):
        listViolations += [
-            'MOZ_SYSTEM_LIBEVENT',
            'MOZ_SYSTEM_NSS',
            'MOZ_SYSTEM_NSPR',
            'MOZ_SYSTEM_JPEG',
--- a/config/Makefile.in
+++ b/config/Makefile.in
@ -46,7 +46,6 @@ export:: $(export-preqs)
 		-DMOZ_SYSTEM_ZLIB=$(MOZ_SYSTEM_ZLIB) \
 		-DMOZ_SYSTEM_PNG=$(MOZ_SYSTEM_PNG) \
 		-DMOZ_SYSTEM_JPEG=$(MOZ_SYSTEM_JPEG) \
-		-DMOZ_SYSTEM_LIBEVENT=$(MOZ_SYSTEM_LIBEVENT) \
 		-DMOZ_SYSTEM_LIBVPX=$(MOZ_SYSTEM_LIBVPX) \
 		-DMOZ_SYSTEM_ICU=$(MOZ_SYSTEM_ICU) \
 		$(srcdir)/system-headers $(srcdir)/stl-headers | $(PERL) $(topsrcdir)/nsprpub/config/make-system-wrappers.pl system_wrappers
--- a/config/system-headers
+++ b/config/system-headers
@ -1276,11 +1276,7 @@ bzlib.h
 #ifdef MOZ_ENABLE_GIO
 gio/gio.h
 #endif
-#if MOZ_SYSTEM_LIBEVENT==1
-event.h
-#else
 sys/event.h
-#endif
 #ifdef MOZ_ENABLE_LIBPROXY
 proxy.h
 #endif
--- a/docs/Component
+++ b/docs/Component
@ -0,0 +1,63 @@
+# Updating HTML5 parser code
+
+Our html5 parser is based on the java html5 parser from [Validator.nu](http://about.validator.nu/htmlparser/) by Henri Sivonen. It has been adopted by Mozilla and further updated, and has been imported as a whole into the UXP tree to have an independent and maintainable source of it that doesn't rely on external sources.
+
+## Stages
+Updating the parser code consists of 3 stages:
+- Make updates to the html parser source in java
+- Let the java parser regenerate part of its own code after the change
+- Translate the java source to C++
+
+This process was best explained in the [following Bugzilla comment](https://bugzilla.mozilla.org/show_bug.cgi?id=1378079#c6), which explain how to add a new attribute name ("is") to html5, inserted in this document for convenience:
+
+>> Is
+>> there any documentation on how to add a new nsHtml5AttributeName?
+>
+> I don't recall. I should get around to writing it.
+>
+>> Looks like
+>> I need to clone hg.mozilla.org/projects/htmlparser/ and generate a hash with
+>> it?
+>
+> Yes. Here's how:
+>
+> `cd parser/html/java/`
+> `make sync`
+>
+> Now you have a clone of [https://hg.mozilla.org/projects/htmlparser/](https://hg.mozilla.org/projects/htmlparser/) in > parser/html/java/htmlparser/
+>
+> `cd htmlparser/src/`
+> `$EDITOR nu/validator/htmlparser/impl/AttributeName.java`
+>
+> Search for the word "uncomment" and uncomment stuff according to the two comments that talk about uncommenting
+> Duplicate the declaration a normal attribute (nothings special in SVG mode, etc.). Let's use "alt", since it's the first one.
+> In the duplicate, replace ALT with IS and "alt" with "is".
+> Search for "ALT,", duplicate that line and change the duplicate to say "IS,"
+> Save.
+>
+> `javac nu/validator/htmlparser/impl/AttributeName.java`
+> `java nu.validator.htmlparser.impl.AttributeName`
+>
+> Copy and paste the output into nu/validator/htmlparser/impl/AttributeName.java replacing the text below the comment "START GENERATED CODE" and above the very last "}".
+> Recomment the bits that you uncommented earlier.
+> Save.
+>
+> `cd ../..` - Back to parser/html/java/
+> `make translate`
+
+## Organizing commits
+
+**The html5 parser code is fragile due to its generation and translation before being used as C++ in our tree. Do not touch or commit anything without a code peer nearby with knowledge of the parser and the commit process (at this moment that means Gaming4JC (@g4jc)), and communicate the changes thoroughly.**
+
+To organize this properly in our repo, commits should be split up when making these kinds of changes:
+1. Commit your code edits to the html parser
+2. Regenerate java into a translation-ready source
+3. Commit
+4. Translate and regenerate C++ code
+5. Check a build to make sure the changes have the intended result
+6. Commit
+
+This is needed because the source edit will sometimes be in parts that are self-generated and may otherwise be lost in generation noise, and because we want to keep a strict separation between commits resulting from developer work and those resulting from running scripts/automated processes.
+
+
+
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@ -13356,24 +13356,9 @@ nsDocShell::EnsureScriptEnvironment()
  uint32_t chromeFlags;
  browserChrome->GetChromeFlags(&chromeFlags);

-  bool isModalContentWindow =
-    (mItemType == typeContent) &&
-    (chromeFlags & nsIWebBrowserChrome::CHROME_MODAL_CONTENT_WINDOW);
-  // There can be various other content docshells associated with the
-  // top-level window, like sidebars. Make sure that we only create an
-  // nsGlobalModalWindow for the primary content shell.
-  if (isModalContentWindow) {
-    nsCOMPtr<nsIDocShellTreeItem> primaryItem;
-    nsresult rv =
-      mTreeOwner->GetPrimaryContentShell(getter_AddRefs(primaryItem));
-    NS_ENSURE_SUCCESS(rv, rv);
-    isModalContentWindow = (primaryItem == this);
-  }
-
  // If our window is modal and we're not opened as chrome, make
  // this window a modal content window.
-  mScriptGlobal =
-    NS_NewScriptGlobalObject(mItemType == typeChrome, isModalContentWindow);
+  mScriptGlobal = NS_NewScriptGlobalObject(mItemType == typeChrome);
  MOZ_ASSERT(mScriptGlobal);

  mScriptGlobal->SetDocShell(this);
--- a/dom/base/nsDeprecatedOperationList.h
+++ b/dom/base/nsDeprecatedOperationList.h
@ -34,7 +34,6 @@ DEPRECATED_OPERATION(UseOfCaptureEvents)
 DEPRECATED_OPERATION(UseOfReleaseEvents)
 DEPRECATED_OPERATION(UseOfDOM3LoadMethod)
 DEPRECATED_OPERATION(ChromeUseOfDOM3LoadMethod)
-DEPRECATED_OPERATION(ShowModalDialog)
 DEPRECATED_OPERATION(Window_Content)
 DEPRECATED_OPERATION(SyncXMLHttpRequest)
 DEPRECATED_OPERATION(DataContainerEvent)
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@ -909,7 +909,6 @@ nsPIDOMWindow<T>::nsPIDOMWindow(nsPIDOMWindowOuter *aOuterWindow)
  mMayHaveMouseEnterLeaveEventListener(false),
  mMayHavePointerEnterLeaveEventListener(false),
  mInnerObjectsFreed(false),
-  mIsModalContentWindow(false),
  mIsActive(false), mIsBackground(false),
  mMediaSuspend(Preferences::GetBool("media.block-autoplay-until-in-foreground", true) ?
    nsISuspendedTypes::SUSPENDED_BLOCK : nsISuspendedTypes::NONE_SUSPENDED),
@ -1957,7 +1956,6 @@ nsGlobalWindow::CleanUp()
  }

  mArguments = nullptr;
-  mDialogArguments = nullptr;

  CleanupCachedXBLHandlers(this);

@ -2195,7 +2193,6 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INTERNAL(nsGlobalWindow)

  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mControllers)
  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mArguments)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mDialogArguments)
  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mReturnValue)
  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mNavigator)

@ -2274,7 +2271,6 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsGlobalWindow)

  NS_IMPL_CYCLE_COLLECTION_UNLINK(mControllers)
  NS_IMPL_CYCLE_COLLECTION_UNLINK(mArguments)
-  NS_IMPL_CYCLE_COLLECTION_UNLINK(mDialogArguments)
  NS_IMPL_CYCLE_COLLECTION_UNLINK(mReturnValue)
  NS_IMPL_CYCLE_COLLECTION_UNLINK(mNavigator)

@ -3019,8 +3015,6 @@ nsGlobalWindow::SetNewDocument(nsIDocument* aDocument,
    } else {
      if (thisChrome) {
        newInnerWindow = nsGlobalChromeWindow::Create(this);
-      } else if (mIsModalContentWindow) {
-        newInnerWindow = nsGlobalModalWindow::Create(this);
      } else {
        newInnerWindow = nsGlobalWindow::Create(this);
      }
@ -3871,31 +3865,16 @@ nsGlobalWindow::SetArguments(nsIArray *aArguments)
  MOZ_ASSERT(IsOuterWindow());
  nsresult rv;

-  // Historically, we've used the same machinery to handle openDialog arguments
-  // (exposed via window.arguments) and showModalDialog arguments (exposed via
-  // window.dialogArguments), even though the former is XUL-only and uses an XPCOM
-  // array while the latter is web-exposed and uses an arbitrary JS value.
-  // Moreover, per-spec |dialogArguments| is a property of the browsing context
-  // (outer), whereas |arguments| lives on the inner.
-  //
  // We've now mostly separated them, but the difference is still opaque to
  // nsWindowWatcher (the caller of SetArguments in this little back-and-forth
  // embedding waltz we do here).
  //
  // So we need to demultiplex the two cases here.
  nsGlobalWindow *currentInner = GetCurrentInnerWindowInternal();
-  if (mIsModalContentWindow) {
-    // nsWindowWatcher blindly converts the original nsISupports into an array
-    // of length 1. We need to recover it, and then cast it back to the concrete
-    // object we know it to be.
-    nsCOMPtr<nsISupports> supports = do_QueryElementAt(aArguments, 0, &rv);
-    NS_ENSURE_SUCCESS(rv, rv);
-    mDialogArguments = static_cast<DialogValueHolder*>(supports.get());
-  } else {
-    mArguments = aArguments;
-    rv = currentInner->DefineArgumentsProperty(aArguments);
-    NS_ENSURE_SUCCESS(rv, rv);
-  }
+
+  mArguments = aArguments;
+  rv = currentInner->DefineArgumentsProperty(aArguments);
+  NS_ENSURE_SUCCESS(rv, rv);

  return NS_OK;
 }
@ -3904,7 +3883,6 @@ nsresult
 nsGlobalWindow::DefineArgumentsProperty(nsIArray *aArguments)
 {
  MOZ_ASSERT(IsInnerWindow());
-  MOZ_ASSERT(!mIsModalContentWindow); // Handled separately.

  nsIScriptContext *ctx = GetOuterWindowInternal()->mContext;
  NS_ENSURE_TRUE(aArguments && ctx, NS_ERROR_NOT_INITIALIZED);
@ -5040,21 +5018,6 @@ nsGlobalWindow::IsPrivilegedChromeWindow(JSContext* aCx, JSObject* aObj)
         nsContentUtils::ObjectPrincipal(aObj) == nsContentUtils::GetSystemPrincipal();
 }

-/* static */ bool
-nsGlobalWindow::IsShowModalDialogEnabled(JSContext*, JSObject*)
-{
-  static bool sAddedPrefCache = false;
-  static bool sIsDisabled;
-  static const char sShowModalDialogPref[] = "dom.disable_window_showModalDialog";
-
-  if (!sAddedPrefCache) {
-    Preferences::AddBoolVarCache(&sIsDisabled, sShowModalDialogPref, false);
-    sAddedPrefCache = true;
-  }
-
-  return !sIsDisabled && !XRE_IsContentProcess();
-}
-
 nsIDOMOfflineResourceList*
 nsGlobalWindow::GetApplicationCache(ErrorResult& aError)
 {
@ -9741,126 +9704,6 @@ nsGlobalWindow::ConvertDialogOptions(const nsAString& aOptions,
  }
 }

-already_AddRefed<nsIVariant>
-nsGlobalWindow::ShowModalDialogOuter(const nsAString& aUrl,
-                                     nsIVariant* aArgument,
-                                     const nsAString& aOptions,
-                                     nsIPrincipal& aSubjectPrincipal,
-                                     ErrorResult& aError)
-{
-  MOZ_RELEASE_ASSERT(IsOuterWindow());
-
-  if (mDoc) {
-    mDoc->WarnOnceAbout(nsIDocument::eShowModalDialog);
-  }
-
-  if (!IsShowModalDialogEnabled()) {
-    aError.Throw(NS_ERROR_NOT_AVAILABLE);
-    return nullptr;
-  }
-
-  RefPtr<DialogValueHolder> argHolder =
-    new DialogValueHolder(&aSubjectPrincipal, aArgument);
-
-  // Before bringing up the window/dialog, unsuppress painting and flush
-  // pending reflows.
-  EnsureReflowFlushAndPaint();
-
-  if (!AreDialogsEnabled()) {
-    // We probably want to keep throwing here; silently doing nothing is a bit
-    // weird given the typical use cases of showModalDialog().
-    aError.Throw(NS_ERROR_NOT_AVAILABLE);
-    return nullptr;
-  }
-
-  if (ShouldPromptToBlockDialogs() && !ConfirmDialogIfNeeded()) {
-    aError.Throw(NS_ERROR_NOT_AVAILABLE);
-    return nullptr;
-  }
-
-  nsCOMPtr<nsPIDOMWindowOuter> dlgWin;
-  nsAutoString options(NS_LITERAL_STRING("-moz-internal-modal=1,status=1"));
-
-  ConvertDialogOptions(aOptions, options);
-
-  options.AppendLiteral(",scrollbars=1,centerscreen=1,resizable=0");
-
-  EnterModalState();
-  uint32_t oldMicroTaskLevel = nsContentUtils::MicroTaskLevel();
-  nsContentUtils::SetMicroTaskLevel(0);
-  aError = OpenInternal(aUrl, EmptyString(), options,
-                        false,          // aDialog
-                        true,           // aContentModal
-                        true,           // aCalledNoScript
-                        true,           // aDoJSFixups
-                        true,           // aNavigate
-                        nullptr, argHolder, // args
-                        nullptr,        // aLoadInfo
-                        false,          // aForceNoOpener
-                        getter_AddRefs(dlgWin));
-  nsContentUtils::SetMicroTaskLevel(oldMicroTaskLevel);
-  LeaveModalState();
-  if (aError.Failed()) {
-    return nullptr;
-  }
-
-  nsCOMPtr<nsIDOMModalContentWindow> dialog = do_QueryInterface(dlgWin);
-  if (!dialog) {
-    return nullptr;
-  }
-
-  nsCOMPtr<nsIVariant> retVal;
-  aError = dialog->GetReturnValue(getter_AddRefs(retVal));
-  MOZ_ASSERT(!aError.Failed());
-
-  return retVal.forget();
-}
-
-already_AddRefed<nsIVariant>
-nsGlobalWindow::ShowModalDialog(const nsAString& aUrl, nsIVariant* aArgument,
-                                const nsAString& aOptions,
-                                nsIPrincipal& aSubjectPrincipal,
-                                ErrorResult& aError)
-{
-  FORWARD_TO_OUTER_OR_THROW(ShowModalDialogOuter,
-                            (aUrl, aArgument, aOptions, aSubjectPrincipal,
-                             aError), aError, nullptr);
-}
-
-void
-nsGlobalWindow::ShowModalDialog(JSContext* aCx, const nsAString& aUrl,
-                                JS::Handle<JS::Value> aArgument,
-                                const nsAString& aOptions,
-                                JS::MutableHandle<JS::Value> aRetval,
-                                nsIPrincipal& aSubjectPrincipal,
-                                ErrorResult& aError)
-{
-  MOZ_ASSERT(IsInnerWindow());
-
-  nsCOMPtr<nsIVariant> args;
-  aError = nsContentUtils::XPConnect()->JSToVariant(aCx,
-                                                    aArgument,
-                                                    getter_AddRefs(args));
-  if (aError.Failed()) {
-    return;
-  }
-
-  nsCOMPtr<nsIVariant> retVal =
-    ShowModalDialog(aUrl, args, aOptions, aSubjectPrincipal, aError);
-  if (aError.Failed()) {
-    return;
-  }
-
-  JS::Rooted<JS::Value> result(aCx);
-  if (retVal) {
-    aError = nsContentUtils::XPConnect()->VariantToJS(aCx,
-                                                      FastGetGlobalJSObject(),
-                                                      retVal, aRetval);
-  } else {
-    aRetval.setNull();
-  }
-}
-
 class ChildCommandDispatcher : public Runnable
 {
 public:
@ -14613,70 +14456,6 @@ nsGlobalChromeWindow::TakeOpenerForInitialContentBrowser(mozIDOMWindowProxy** aO
  return NS_OK;
 }

-// nsGlobalModalWindow implementation
-
-// QueryInterface implementation for nsGlobalModalWindow
-NS_INTERFACE_MAP_BEGIN(nsGlobalModalWindow)
-  NS_INTERFACE_MAP_ENTRY(nsIDOMModalContentWindow)
-NS_INTERFACE_MAP_END_INHERITING(nsGlobalWindow)
-
-NS_IMPL_ADDREF_INHERITED(nsGlobalModalWindow, nsGlobalWindow)
-NS_IMPL_RELEASE_INHERITED(nsGlobalModalWindow, nsGlobalWindow)
-
-
-void
-nsGlobalWindow::GetDialogArgumentsOuter(JSContext* aCx,
-                                        JS::MutableHandle<JS::Value> aRetval,
-                                        nsIPrincipal& aSubjectPrincipal,
-                                        ErrorResult& aError)
-{
-  MOZ_RELEASE_ASSERT(IsOuterWindow());
-  MOZ_ASSERT(IsModalContentWindow(),
-             "This should only be called on modal windows!");
-
-  if (!mDialogArguments) {
-    MOZ_ASSERT(mIsClosed, "This window should be closed!");
-    aRetval.setUndefined();
-    return;
-  }
-
-  // This does an internal origin check, and returns undefined if the subject
-  // does not subsumes the origin of the arguments.
-  JS::Rooted<JSObject*> wrapper(aCx, GetWrapper());
-  JSAutoCompartment ac(aCx, wrapper);
-  mDialogArguments->Get(aCx, wrapper, &aSubjectPrincipal, aRetval, aError);
-}
-
-void
-nsGlobalWindow::GetDialogArguments(JSContext* aCx,
-                                   JS::MutableHandle<JS::Value> aRetval,
-                                   nsIPrincipal& aSubjectPrincipal,
-                                   ErrorResult& aError)
-{
-  FORWARD_TO_OUTER_OR_THROW(GetDialogArgumentsOuter,
-                            (aCx, aRetval, aSubjectPrincipal, aError),
-                            aError, );
-}
-
-/* static */ already_AddRefed<nsGlobalModalWindow>
-nsGlobalModalWindow::Create(nsGlobalWindow *aOuterWindow)
-{
-  RefPtr<nsGlobalModalWindow> window = new nsGlobalModalWindow(aOuterWindow);
-  window->InitWasOffline();
-  return window.forget();
-}
-
-NS_IMETHODIMP
-nsGlobalModalWindow::GetDialogArguments(nsIVariant **aArguments)
-{
-  FORWARD_TO_OUTER_MODAL_CONTENT_WINDOW(GetDialogArguments, (aArguments),
-                                        NS_ERROR_NOT_INITIALIZED);
-
-  // This does an internal origin check, and returns undefined if the subject
-  // does not subsumes the origin of the arguments.
-  return mDialogArguments->Get(nsContentUtils::SubjectPrincipal(), aArguments);
-}
-
 /* static */ already_AddRefed<nsGlobalWindow>
 nsGlobalWindow::Create(nsGlobalWindow *aOuterWindow)
 {
@ -14691,96 +14470,6 @@ nsGlobalWindow::InitWasOffline()
  mWasOffline = NS_IsOffline();
 }

-void
-nsGlobalWindow::GetReturnValueOuter(JSContext* aCx,
-                                    JS::MutableHandle<JS::Value> aReturnValue,
-                                    nsIPrincipal& aSubjectPrincipal,
-                                    ErrorResult& aError)
-{
-  MOZ_RELEASE_ASSERT(IsOuterWindow());
-  MOZ_ASSERT(IsModalContentWindow(),
-             "This should only be called on modal windows!");
-
-  if (mReturnValue) {
-    JS::Rooted<JSObject*> wrapper(aCx, GetWrapper());
-    JSAutoCompartment ac(aCx, wrapper);
-    mReturnValue->Get(aCx, wrapper, &aSubjectPrincipal, aReturnValue, aError);
-  } else {
-    aReturnValue.setUndefined();
-  }
-}
-
-void
-nsGlobalWindow::GetReturnValue(JSContext* aCx,
-                               JS::MutableHandle<JS::Value> aReturnValue,
-                               nsIPrincipal& aSubjectPrincipal,
-                               ErrorResult& aError)
-{
-  FORWARD_TO_OUTER_OR_THROW(GetReturnValueOuter,
-                            (aCx, aReturnValue, aSubjectPrincipal, aError),
-                            aError, );
-}
-
-NS_IMETHODIMP
-nsGlobalModalWindow::GetReturnValue(nsIVariant **aRetVal)
-{
-  FORWARD_TO_OUTER_MODAL_CONTENT_WINDOW(GetReturnValue, (aRetVal), NS_OK);
-
-  if (!mReturnValue) {
-    nsCOMPtr<nsIVariant> variant = CreateVoidVariant();
-    variant.forget(aRetVal);
-    return NS_OK;
-  }
-  return mReturnValue->Get(nsContentUtils::SubjectPrincipal(), aRetVal);
-}
-
-void
-nsGlobalWindow::SetReturnValueOuter(JSContext* aCx,
-                                    JS::Handle<JS::Value> aReturnValue,
-                                    nsIPrincipal& aSubjectPrincipal,
-                                    ErrorResult& aError)
-{
-  MOZ_RELEASE_ASSERT(IsOuterWindow());
-  MOZ_ASSERT(IsModalContentWindow(),
-             "This should only be called on modal windows!");
-
-  nsCOMPtr<nsIVariant> returnValue;
-  aError =
-    nsContentUtils::XPConnect()->JSToVariant(aCx, aReturnValue,
-                                             getter_AddRefs(returnValue));
-  if (!aError.Failed()) {
-    mReturnValue = new DialogValueHolder(&aSubjectPrincipal, returnValue);
-  }
-}
-
-void
-nsGlobalWindow::SetReturnValue(JSContext* aCx,
-                               JS::Handle<JS::Value> aReturnValue,
-                               nsIPrincipal& aSubjectPrincipal,
-                               ErrorResult& aError)
-{
-  FORWARD_TO_OUTER_OR_THROW(SetReturnValueOuter,
-                            (aCx, aReturnValue, aSubjectPrincipal, aError),
-                            aError, );
-}
-
-NS_IMETHODIMP
-nsGlobalModalWindow::SetReturnValue(nsIVariant *aRetVal)
-{
-  FORWARD_TO_OUTER_MODAL_CONTENT_WINDOW(SetReturnValue, (aRetVal), NS_OK);
-
-  mReturnValue = new DialogValueHolder(nsContentUtils::SubjectPrincipal(),
-                                       aRetVal);
-  return NS_OK;
-}
-
-/* static */
-bool
-nsGlobalWindow::IsModalContentWindow(JSContext* aCx, JSObject* aGlobal)
-{
-  return xpc::WindowOrNull(aGlobal)->IsModalContentWindow();
-}
-
 #if defined(MOZ_WIDGET_ANDROID)
 int16_t
 nsGlobalWindow::Orientation(CallerType aCallerType) const
--- a/dom/base/nsGlobalWindow.h
+++ b/dom/base/nsGlobalWindow.h
@ -458,9 +458,6 @@ public:

  static bool IsPrivilegedChromeWindow(JSContext* /* unused */, JSObject* aObj);

-  static bool IsShowModalDialogEnabled(JSContext* /* unused */ = nullptr,
-                                       JSObject* /* unused */ = nullptr);
-
  bool DoResolve(JSContext* aCx, JS::Handle<JSObject*> aObj,
                 JS::Handle<jsid> aId,
                 JS::MutableHandle<JS::PropertyDescriptor> aDesc);
@ -583,9 +580,6 @@ public:
    return mIsChrome;
  }

-  using nsPIDOMWindow::IsModalContentWindow;
-  static bool IsModalContentWindow(JSContext* aCx, JSObject* aGlobal);
-
  // GetScrollFrame does not flush.  Callers should do it themselves as needed,
  // depending on which info they actually want off the scrollable frame.
  nsIScrollableFrame *GetScrollFrame();
@ -950,12 +944,6 @@ public:
                                                mozilla::ErrorResult& aRv);
  void PrintOuter(mozilla::ErrorResult& aError);
  void Print(mozilla::ErrorResult& aError);
-  void ShowModalDialog(JSContext* aCx, const nsAString& aUrl,
-                       JS::Handle<JS::Value> aArgument,
-                       const nsAString& aOptions,
-                       JS::MutableHandle<JS::Value> aRetval,
-                       nsIPrincipal& aSubjectPrincipal,
-                       mozilla::ErrorResult& aError);
  void PostMessageMoz(JSContext* aCx, JS::Handle<JS::Value> aMessage,
                      const nsAString& aTargetOrigin,
                      const mozilla::dom::Optional<mozilla::dom::Sequence<JS::Value > >& aTransfer,
@ -1227,12 +1215,6 @@ public:
                       mozilla::dom::Element* aPanel,
                       mozilla::ErrorResult& aError);

-  void GetDialogArgumentsOuter(JSContext* aCx, JS::MutableHandle<JS::Value> aRetval,
-                               nsIPrincipal& aSubjectPrincipal,
-                               mozilla::ErrorResult& aError);
-  void GetDialogArguments(JSContext* aCx, JS::MutableHandle<JS::Value> aRetval,
-                          nsIPrincipal& aSubjectPrincipal,
-                          mozilla::ErrorResult& aError);
  void GetReturnValueOuter(JSContext* aCx, JS::MutableHandle<JS::Value> aReturnValue,
                           nsIPrincipal& aSubjectPrincipal,
                           mozilla::ErrorResult& aError);
@ -1681,18 +1663,6 @@ protected:
                      nsIPrincipal& aSubjectPrincipal,
                      mozilla::ErrorResult& aError);

-  already_AddRefed<nsIVariant>
-    ShowModalDialogOuter(const nsAString& aUrl, nsIVariant* aArgument,
-                         const nsAString& aOptions,
-                         nsIPrincipal& aSubjectPrincipal,
-                         mozilla::ErrorResult& aError);
-
-  already_AddRefed<nsIVariant>
-    ShowModalDialog(const nsAString& aUrl, nsIVariant* aArgument,
-                    const nsAString& aOptions,
-                    nsIPrincipal& aSubjectPrincipal,
-                    mozilla::ErrorResult& aError);
-
  // Ask the user if further dialogs should be blocked, if dialogs are currently
  // being abused. This is used in the cases where we have no modifiable UI to
  // show, in that case we show a separate dialog to ask this question.
@ -1832,9 +1802,6 @@ protected:
  // For |window.arguments|, via |openDialog|.
  nsCOMPtr<nsIArray>            mArguments;

-  // For |window.dialogArguments|, via |showModalDialog|.
-  RefPtr<DialogValueHolder> mDialogArguments;
-
  // Only used in the outer.
  RefPtr<DialogValueHolder> mReturnValue;

@ -2067,40 +2034,14 @@ public:
  nsCOMPtr<mozIDOMWindowProxy> mOpenerForInitialContentBrowser;
 };

-/*
- * nsGlobalModalWindow inherits from nsGlobalWindow. It is the global
- * object created for a modal content windows only (i.e. not modal
- * chrome dialogs).
- */
-class nsGlobalModalWindow : public nsGlobalWindow,
-                            public nsIDOMModalContentWindow
-{
-public:
-  NS_DECL_ISUPPORTS_INHERITED
-  NS_DECL_NSIDOMMODALCONTENTWINDOW
-
-  static already_AddRefed<nsGlobalModalWindow> Create(nsGlobalWindow *aOuterWindow);
-
-protected:
-  explicit nsGlobalModalWindow(nsGlobalWindow *aOuterWindow)
-    : nsGlobalWindow(aOuterWindow)
-  {
-    mIsModalContentWindow = true;
-  }
-
-  ~nsGlobalModalWindow() {}
-};
-
 /* factory function */
 inline already_AddRefed<nsGlobalWindow>
-NS_NewScriptGlobalObject(bool aIsChrome, bool aIsModalContentWindow)
+NS_NewScriptGlobalObject(bool aIsChrome)
 {
  RefPtr<nsGlobalWindow> global;

  if (aIsChrome) {
    global = nsGlobalChromeWindow::Create(nullptr);
-  } else if (aIsModalContentWindow) {
-    global = nsGlobalModalWindow::Create(nullptr);
  } else {
    global = nsGlobalWindow::Create(nullptr);
  }
--- a/dom/base/nsPIDOMWindow.h
+++ b/dom/base/nsPIDOMWindow.h
@ -303,11 +303,6 @@ public:
  virtual bool CanClose() = 0;
  virtual void ForceClose() = 0;

-  bool IsModalContentWindow() const
-  {
-    return mIsModalContentWindow;
-  }
-
  /**
   * Call this to indicate that some node (this window, its document,
   * or content in that document) has a paint event listener.
@ -629,11 +624,6 @@ protected:
  // This member is only used by inner windows.
  bool                   mInnerObjectsFreed;

-
-  // This variable is used on both inner and outer windows (and they
-  // should match).
-  bool                   mIsModalContentWindow;
-
  // Tracks activation state that's used for :-moz-window-inactive.
  // Only used on outer windows.
  bool                   mIsActive;
--- a/dom/base/nsSandboxFlags.h
+++ b/dom/base/nsSandboxFlags.h
@ -29,8 +29,7 @@ const unsigned long SANDBOXED_NAVIGATION  = 0x1;

 /**
 * This flag prevents content from creating new auxiliary browsing contexts,
- * e.g. using the target attribute, the window.open() method, or the
- * showModalDialog() method.
+ * e.g. using the target attribute, or the window.open() method.
 */
 const unsigned long SANDBOXED_AUXILIARY_NAVIGATION = 0x2;

--- a/dom/base/test/mochitest.ini
+++ b/dom/base/test/mochitest.ini
@ -196,7 +196,6 @@ support-files =
  formReset.html
  invalid_accesscontrol.resource
  invalid_accesscontrol.resource^headers^
-  mutationobserver_dialog.html
  orientationcommon.js
  script-1_bug597345.sjs
  script-2_bug597345.js
@ -627,9 +626,6 @@ subsuite = clipboard
 skip-if = toolkit == 'android' #bug 904183
 [test_createHTMLDocument.html]
 [test_declare_stylesheet_obsolete.html]
-[test_dialogArguments.html]
-tags = openwindow
-skip-if = toolkit == 'android' || e10s # showmodaldialog
 [test_document.all_iteration.html]
 [test_document.all_unqualified.html]
 [test_document_constructor.html]
--- a/dom/base/test/mutationobserver_dialog.html
+++ b/dom/base/test/mutationobserver_dialog.html
@ -1,62 +0,0 @@
-<html>
-  <head>
-    <title></title>
-    <script>
-
-    var div = document.createElement("div");
-
-    var M;
-    if ("MozMutationObserver" in window) {
-      M = window.MozMutationObserver;
-    } else if ("WebKitMutationObserver" in window) {
-      M = window.WebKitMutationObserver;
-    } else {
-      M = window.MutationObserver;
-    }
-
-    var didCall1 = false;
-    var didCall2 = false;
-    function testMutationObserverInDialog() {
-      div.innerHTML = "<span>1</span><span>2</span>";
-      m = new M(function(records, observer) {
-          opener.is(records[0].type, "childList", "Should have got childList");
-          opener.is(records[0].removedNodes.length, 2, "Should have got removedNodes");
-          opener.is(records[0].addedNodes.length, 1, "Should have got addedNodes");
-          observer.disconnect();
-          m = null;
-          didCall1 = true;
-        });
-      m.observe(div, { childList: true });
-      div.innerHTML = "<span><span>foo</span></span>";
-    }
-
-    function testMutationObserverInDialog2() {
-      div.innerHTML = "<span>1</span><span>2</span>";
-      m = new M(function(records, observer) {
-          opener.is(records[0].type, "childList", "Should have got childList");
-          opener.is(records[0].removedNodes.length, 2, "Should have got removedNodes");
-          opener.is(records[0].addedNodes.length, 1, "Should have got addedNodes");
-          observer.disconnect();
-          m = null;
-          didCall2 = true;
-        });
-      m.observe(div, { childList: true });
-      div.innerHTML = "<span><span>foo</span></span>";
-    }
-
-    window.addEventListener("load", testMutationObserverInDialog);
-    window.addEventListener("load", testMutationObserverInDialog2);
-    window.addEventListener("load",
-      function() {
-        opener.ok(didCall1, "Should have called 1st mutation callback");
-        opener.ok(didCall2, "Should have called 2nd mutation callback");
-        window.close();
-      });
-    </script>
-    <style>
-    </style>
-  </head>
-  <body>
-    <input type="button" onclick="window.close()" value="close">
-  </body>
-</html>
--- a/dom/base/test/test_dialogArguments.html
+++ b/dom/base/test/test_dialogArguments.html
@ -1,31 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-	<title>Test for Bug 1019761</title>
-	<script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-	<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-
-	<meta http-equiv="content-type" content="text/html; charset=utf-8">
-</head>
-<body>
-<script type="application/javascript">
-
-/*
-	Tests whether Firefox crashes when accessing the dialogArguments property
-	of a modal window that has been closed.
-*/
-SimpleTest.waitForExplicitFinish();
-
-function openModal() {
-	showModalDialog("javascript:opener.winRef = window; \
-		window.opener.setTimeout(\'winRef.dialogArguments;\', 0);\
-		window.close();");
-
-	ok(true, "dialogArguments did not cause a crash.");
-	SimpleTest.finish();
-}
-
-window.onload = openModal;
-</script>
-</body>
-</html>
--- a/dom/base/test/test_mutationobservers.html
+++ b/dom/base/test/test_mutationobservers.html
@ -484,28 +484,6 @@ function testSyncXHR() {

 function testSyncXHR2() {
  ok(callbackHandled, "Should have called the mutation callback!");
-  then(testModalDialog);
-}
-
-function testModalDialog() {
-  var didHandleCallback = false;
-  div.innerHTML = "<span>1</span><span>2</span>";
-  m = new M(function(records, observer) {
-      is(records[0].type, "childList", "Should have got childList");
-      is(records[0].removedNodes.length, 2, "Should have got removedNodes");
-      is(records[0].addedNodes.length, 1, "Should have got addedNodes");
-      observer.disconnect();
-      m = null;
-      didHandleCallback = true;
-    });
-  m.observe(div, { childList: true });
-  div.innerHTML = "<span><span>foo</span></span>";
-  try {
-    window.showModalDialog("mutationobserver_dialog.html");
-    ok(didHandleCallback, "Should have called the callback while showing modal dialog!");
-  } catch(e) {
-    todo(false, "showModalDialog not implemented on this platform");
-  }
  then(testTakeRecords);
 }

--- a/dom/canvas/WebGLContextValidate.cpp
+++ b/dom/canvas/WebGLContextValidate.cpp
@ -440,6 +440,13 @@ WebGLContext::InitAndValidateGL(FailureReason* const out_failReason)
 {
    MOZ_RELEASE_ASSERT(gl, "GFX: GL not initialized");

+    if (!gl->MakeCurrent(true)) {
+        MOZ_ASSERT(false);
+        *out_failReason = { "FEATURE_FAILURE_WEBGL_MAKECURRENT",
+                            "Failed to MakeCurrent for init." };
+        return false;
+    }
+
    // Unconditionally create a new format usage authority. This is
    // important when restoring contexts and extensions need to add
    // formats back into the authority.
--- a/dom/html/test/file_iframe_sandbox_c_if4.html
+++ b/dom/html/test/file_iframe_sandbox_c_if4.html
@ -12,7 +12,7 @@
  }

  function doStuff() {
-    // try to open a new window via target="_blank", target="BC341604", window.open(), and showModalDialog()
+    // try to open a new window via target="_blank", target="BC341604", and window.open()
    // the window we try to open closes itself once it opens
    sendMouseEvent({type:'click'}, 'target_blank');
    sendMouseEvent({type:'click'}, 'target_BC341604');
@ -25,15 +25,6 @@
    }

    ok(threw, "window.open threw a JS exception and was not allowed");
-
-    threw = false;
-    try {
-      window.showModalDialog("about:blank");
-    } catch(error) {
-      threw = true;
-    }
-
-    ok(threw, "window.showModalDialog threw a JS exception and was not allowed");
  }
 </script>
 <body onLoad="doStuff()">
--- a/dom/html/test/file_iframe_sandbox_j_if1.html
+++ b/dom/html/test/file_iframe_sandbox_j_if1.html
@ -1,30 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-  <meta charset="utf-8">
-  <title>Test for Bug 766282</title>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-
-<script type="text/javascript">
-  function doStuff() {
-    // Open a new window via showModalDialog().
-    try {
-      window.showModalDialog("file_iframe_sandbox_k_if5.html");
-    } catch(e) {
-      window.parent.ok_wrapper(false, "iframes sandboxed with allow-popups and allow-modals should be able to open a modal dialog");
-    }
-
-    // Open a new window via showModalDialog().
-    try {
-      window.showModalDialog("file_iframe_sandbox_k_if7.html");
-    } catch(e) {
-      window.parent.ok_wrapper(false, "iframes sandboxed with allow-popups and allow-modals should be able to open a modal dialog");
-    }
-  }
-</script>
-
-<body onLoad="doStuff()">
-  I am sandboxed with "allow-scripts allow-popups allow-same-origin allow-forms allow-top-navigation".
-</body>
-</html>
--- a/dom/html/test/file_iframe_sandbox_j_if2.html
+++ b/dom/html/test/file_iframe_sandbox_j_if2.html
@ -1,28 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-  <meta charset="utf-8">
-  <title>Test for Bug 766282</title>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-
-<script type="text/javascript">
-  function doSubOpens() {
-    // Open a new window showModalDialog().
-    try {
-      window.showModalDialog("file_iframe_sandbox_k_if9.html");
-    } catch(e) {
-      window.parent.ok_wrapper(false, "iframes sandboxed with allow-popups and allow-modals should be able to open a modal dialog");
-    }
-  }
-
-  window.doSubOpens = doSubOpens;
-</script>
-
-<body>
-  I am sandboxed but with "allow-scripts allow-popups allow-same-origin".
-  After my initial load, "allow-same-origin" is removed and then I open file_iframe_sandbox_k_if9.html,
-  which attemps to call a function in my parent.
-  This should succeed since the new sandbox flags shouldn't have taken affect on me until I'm reloaded.
-</body>
-</html>
--- a/dom/html/test/file_iframe_sandbox_j_if3.html
+++ b/dom/html/test/file_iframe_sandbox_j_if3.html
@ -1,27 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-  <meta charset="utf-8">
-  <title>Tests for Bug 766282</title>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-
-</head>
-<script type="text/javascript">
-  function ok(result, desc) {
-    window.parent.ok_wrapper(result, desc);
-  }
-
-  function doStuff() {
-    // Try to open a new window via showModalDialog().
-    // The window we try to open closes itself once it opens.
-    try {
-      window.showModalDialog("file_iframe_sandbox_open_window_pass.html");
-    } catch(e) {
-      ok(false, "iframes sandboxed with allow-popups and allow-modals should be able to open a modal dialog");
-    }
-  }
-</script>
-<body onLoad="doStuff()">
-  I am sandboxed but with "allow-popups allow-scripts allow-same-origin"
-</body>
-</html>
--- a/dom/html/test/mochitest.ini
+++ b/dom/html/test/mochitest.ini
@ -154,9 +154,6 @@ support-files =
  file_iframe_sandbox_form_pass.html
  file_iframe_sandbox_g_if1.html
  file_iframe_sandbox_h_if1.html
-  file_iframe_sandbox_j_if1.html
-  file_iframe_sandbox_j_if2.html
-  file_iframe_sandbox_j_if3.html
  file_iframe_sandbox_k_if1.html
  file_iframe_sandbox_k_if2.html
  file_iframe_sandbox_k_if3.html
@ -471,9 +468,6 @@ skip-if = toolkit == 'android' # just copy the conditions from the test above
 tags = openwindow
 [test_iframe_sandbox_inheritance.html]
 tags = openwindow
-[test_iframe_sandbox_modal.html]
-tags = openwindow
-skip-if = toolkit == 'android' || e10s #modal tests fail on android
 [test_iframe_sandbox_navigation.html]
 tags = openwindow
 [test_iframe_sandbox_navigation2.html]
@ -540,8 +534,6 @@ skip-if = toolkit == 'android' #bug 811644
 [test_bug369370.html]
 skip-if = toolkit == "android" || toolkit == "windows" # disabled on Windows because of bug 1234520
 [test_bug380383.html]
-[test_bug391777.html]
-skip-if = toolkit == 'android' || e10s
 [test_bug402680.html]
 [test_bug403868.html]
 [test_bug403868.xhtml]
@ -607,4 +599,4 @@ skip-if = os == "android" # up/down arrow keys not supported on android
 [test_script_module.html]
 support-files =
  file_script_module.html
-  file_script_nomodule.html
+  file_script_nomodule.html
--- a/dom/html/test/test_bug391777.html
+++ b/dom/html/test/test_bug391777.html
@ -1,25 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=391777
-->
-<head>
-  <title>Test for Bug 391777</title>
-  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>        
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
-</head>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=391777">Mozilla Bug 391777</a>
-<p id="display"></p>
-<script class="testbody" type="text/javascript">
-
-/** Test for Bug 391777 **/
-var arg = {};
-arg.testVal = "foo";
-var result = window.showModalDialog("javascript:window.returnValue = window.dialogArguments.testVal; window.close(); 'This window should close on its own.';", arg);
-ok(true, "We should get here without user interaction");
-is(result, "foo", "Unexpected result from showModalDialog");
-
-</script>
-</body>
-</html>
--- a/dom/html/test/test_iframe_sandbox_general.html
+++ b/dom/html/test/test_iframe_sandbox_general.html
@ -41,7 +41,7 @@ function ok_wrapper(result, desc) {
    passedTests++;
  }

-  if (completedTests == 33) {
+  if (completedTests == 32) {
    is(passedTests, completedTests, "There are " + completedTests + " general tests that should pass");
    SimpleTest.finish();
  }
--- a/dom/html/test/test_iframe_sandbox_modal.html
+++ b/dom/html/test/test_iframe_sandbox_modal.html
@ -1,122 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=766282
-implement allow-popups directive for iframe sandbox
-->
-<head>
-  <meta charset="utf-8">
-  <title>Tests for Bug 766282</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-
-<script>
-
-SimpleTest.waitForExplicitFinish();
-SimpleTest.requestFlakyTimeout("untriaged");
-
-// A postMessage handler that is used by sandboxed iframes without
-// 'allow-same-origin' to communicate pass/fail back to this main page.
-window.addEventListener("message", receiveMessage, false);
-
-function receiveMessage(event) {
-  switch (event.data.type) {
-    case "attempted":
-      testAttempted();
-      break;
-    case "ok":
-      ok_wrapper(event.data.ok, event.data.desc, event.data.addToAttempted);
-      break;
-    default:
-      // allow for old style message
-      if (event.data.ok != undefined) {
-        ok_wrapper(event.data.ok, event.data.desc, event.data.addToAttempted);
-      }
-  }
-}
-
-var attemptedTests = 0;
-var passedTests = 0;
-var totalTestsToPass = 5;
-var totalTestsToAttempt = 5;
-
-function ok_wrapper(result, desc, addToAttempted = true) {
-  ok(result, desc);
-
-  if (result) {
-    passedTests++;
-  }
-
-  if (addToAttempted) {
-    testAttempted();
-  }
-}
-
-// Added so that tests that don't register unless they fail,
-// can at least notify that they've attempted to run.
-function testAttempted() {
-  attemptedTests++;
-  if (attemptedTests == totalTestsToAttempt) {
-    // Make sure all tests have had a chance to complete.
-    setTimeout(function() {finish();}, 1000);
-  }
-}
-
-var finishCalled = false;
-
-function finish() {
-  if (!finishCalled) {
-    finishCalled = true;
-    is(passedTests, totalTestsToPass, "There are " + totalTestsToPass + " modal tests that should pass");
-
-    SimpleTest.finish();
-  }
-}
-
-function doTest() {
-  // passes if good and fails if bad
-  // 1) A window opened from inside an iframe that has sandbox = "allow-scripts allow-popups
-  // allow-same-origin" should not have its origin sandbox flag set and be able to access
-  // document.cookie. (Done by file_iframe_sandbox_k_if5.html opened from
-  // file_iframe_sandbox_j_if1.html) using showModalDialog.)
-
-  // passes if good
-  // 2) A window opened from inside an iframe that has sandbox = "allow-scripts allow-popups
-  // allow-top-navigation" should not have its top-level navigation sandbox flag set and be able to
-  // navigate top. (Done by file_iframe_sandbox_k_if5.html (and if6) opened from
-  // file_iframe_sandbox_j_if1.html) using showModalDialog.)
-
-  // passes if good
-  // 3) A window opened from inside an iframe that has sandbox = "allow-scripts allow-popups
-  // all-forms" should not have its forms sandbox flag set and be able to submit forms.
-  // (Done by file_iframe_sandbox_k_if7.html opened from
-  // file_iframe_sandbox_j_if1.html) using showModalDialog.)
-
-  // passes if good
-  // 4) Make sure that the sandbox flags copied to a new browsing context are taken from the
-  // current active document not the browsing context (iframe / docShell).
-  // This is done by removing allow-same-origin and calling doSubOpens from file_iframe_sandbox_j_if2.html,
-  // which opens file_iframe_sandbox_k_if9.html using showModalDialog.
-  var if_2 = document.getElementById('if_2');
-  if_2.sandbox = 'allow-scripts allow-popups';
-  if_2.contentWindow.doSubOpens();
-
-  // passes if good
-  // 5) Test that a sandboxed iframe with "allow-popups" can open a new window using window.ShowModalDialog.
-  // This is done via file_iframe_sandbox_j_if3.html which is sandboxed with "allow-popups allow-scripts
-  // allow-same-origin". The window it attempts to open calls window.opener.ok(true, ...) and
-  // file_iframe_j_if3.html has an ok() function that calls window.parent.ok_wrapper.
-}
-
-addLoadEvent(doTest);
-</script>
-
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=766282">Mozilla Bug 766282</a> - implement allow-popups directive for iframe sandbox
-<p id="display"></p>
-<div id="content">
-<iframe sandbox="allow-scripts allow-popups allow-modals allow-same-origin allow-forms allow-top-navigation" id="if_1" src="file_iframe_sandbox_j_if1.html" height="10" width="10"></iframe>
-<iframe sandbox="allow-scripts allow-popups allow-modals allow-same-origin" id="if_2" src="file_iframe_sandbox_j_if2.html" height="10" width="10"></iframe>
-<iframe sandbox="allow-popups allow-modals allow-same-origin allow-scripts" id="if_3" src="file_iframe_sandbox_j_if3.html" height="10" width="10"></iframe>
-</div>
--- a/dom/locales/en-US/chrome/dom/dom.properties
+++ b/dom/locales/en-US/chrome/dom/dom.properties
@ -174,8 +174,6 @@ UseOfCaptureEventsWarning=Use of captureEvents() is deprecated. To upgrade your
 UseOfReleaseEventsWarning=Use of releaseEvents() is deprecated. To upgrade your code, use the DOM 2 removeEventListener() method. For more help http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
 # LOCALIZATION NOTE: Do not translate "document.load()" or "XMLHttpRequest"
 UseOfDOM3LoadMethodWarning=Use of document.load() is deprecated. To upgrade your code, use the DOM XMLHttpRequest object. For more help https://developer.mozilla.org/en/XMLHttpRequest
-# LOCALIZATION NOTE: Do not translate "window.showModalDialog()" or "window.open()"
-ShowModalDialogWarning=Use of window.showModalDialog() is deprecated. Use window.open() instead. For more help https://developer.mozilla.org/en-US/docs/Web/API/Window.open
 # LOCALIZATION NOTE: Do not translate "window._content" or "window.content"
 Window_ContentWarning=window._content is deprecated.  Please use window.content instead.
 # LOCALIZATION NOTE: Do not translate "XMLHttpRequest"
--- a/dom/media/webspeech/recognition/test/test_nested_eventloop.html
+++ b/dom/media/webspeech/recognition/test/test_nested_eventloop.html
@ -21,7 +21,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=650295
  SimpleTest.waitForExplicitFinish();

  /*
-   * window.showModalDialog() can be used to spin the event loop, causing
+   * SpecialPowers.spinEventLoop can be used to spin the event loop, causing
   * queued SpeechEvents (such as those created by calls to start(), stop()
   * or abort()) to be processed immediately.
   * When this is done from inside DOM event handlers, it is possible to
@ -33,7 +33,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=650295
  }
  function doneFunc() {
    // Trigger gc now and wait some time to make sure this test gets the blame
-    // for any assertions caused by showModalDialog
+    // for any assertions caused by spinning the event loop.
    //
    // NB - The assertions should be gone, but this looks too scary to touch
    // during batch cleanup.
--- a/dom/tests/mochitest/bugs/file_bug291653.html
+++ b/dom/tests/mochitest/bugs/file_bug291653.html
@ -1,28 +0,0 @@
-<html>
-  <head>
-    <script>
-    <!--
-    function listener1() {
-      window.showModalDialog("data:text/html,<script>var maintest = opener.opener; opener.location = 'data:text/html,test'; maintest.end(); window.close();</script>");
-    }
-
-    function listener2() {
-      opener.secondListenerDidRun = true;
-    }
-    
-    window.addEventListener("foo", listener1);
-    window.addEventListener("foo", listener2);
-    
-    
-    function fireFoo() {
-      var e = document.createEvent("Events");
-      e.initEvent("foo", true, true);
-      window.dispatchEvent(e);
-    }
-    //-->
-    </script>
-  </head>
-  <body onload="setTimeout(fireFoo, 0)">
-  Test for bug 291653
-  </body>
-</html>
--- a/dom/tests/mochitest/bugs/file_bug504862.html
+++ b/dom/tests/mochitest/bugs/file_bug504862.html
@ -1,22 +0,0 @@
-<html>
-<body>
-<script>
-window.returnValue = 3;
-
-if (location.toString().match(/^http:\/\/mochi.test:8888/)) {
-  // Test that we got the right arguments.
-  opener.is(window.dialogArguments, "my args",
-            "dialog did not get the right arguments.");
-
-  // Load a different url, and test that it sees the arguments (since it's same origin).
-  window.location="data:text/html,<html><body onload=\"opener.is(window.dialogArguments, 'my args', 'subsequent dialog document did not get the right arguments.'); close();\">';";
-} else {
-  // Post a message containing our arguments to the opener to test
-  // that this cross origing dialog does *not* see the passed in
-  // arguments.
-  opener.postMessage("args: " + window.dialogArguments,
-                     "http://mochi.test:8888");
-
-  close();
-}
-</script>
--- a/dom/tests/mochitest/bugs/mochitest.ini
+++ b/dom/tests/mochitest/bugs/mochitest.ini
@ -10,9 +10,6 @@ support-files =
  child_bug260264.html
  devicemotion_inner.html
  devicemotion_outer.html
-  file_bug291653.html
-  file_bug406375.html
-  file_bug504862.html
  file_bug593174_1.html
  file_bug593174_2.html
  file_bug809290_b1.html
@ -45,7 +42,6 @@ skip-if = toolkit == 'android'
 [test_bug260264_nested.html]
 [test_bug265203.html]
 [test_bug291377.html]
-[test_bug291653.html]
 skip-if = toolkit == 'android' #TIMED_OUT
 [test_bug304459.html]
 [test_bug308856.html]
@ -67,28 +63,21 @@ skip-if = toolkit == 'android' #TIMED_OUT
 [test_bug396843.html]
 [test_bug400204.html]
 [test_bug404748.html]
-[test_bug406375.html]
-skip-if = toolkit == 'android'
-[test_bug414291.html]
-tags = openwindow
 [test_bug427744.html]
 skip-if = toolkit == 'android'
 [test_bug42976.html]
 [test_bug430276.html]
-[test_bug437361.html]
 skip-if = toolkit == 'android'
 [test_bug440572.html]
 [test_bug456151.html]
 [test_bug458091.html]
 [test_bug459848.html]
 [test_bug465263.html]
-[test_bug479143.html]
 skip-if = toolkit == 'android'
 [test_bug484775.html]
 [test_bug492925.html]
 [test_bug49312.html]
 [test_bug495219.html]
-[test_bug504862.html]
 skip-if = toolkit == 'android' #RANDOM
 [test_bug529328.html]
 [test_bug531176.html]
@ -126,7 +115,6 @@ skip-if = toolkit == 'android'
 [test_bug698061.html]
 [test_bug698551.html]
 [test_bug707749.html]
-[test_bug735237.html]
 [test_bug739038.html]
 [test_bug740811.html]
 [test_bug743615.html]
--- a/dom/tests/mochitest/bugs/test_bug291653.html
+++ b/dom/tests/mochitest/bugs/test_bug291653.html
@ -1,56 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=291653
-->
-<head>
-  <title>Test for Bug 291653</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=291653">Mozilla Bug 291653</a>
-<p id="display"></p>
-<div id="content" style="display: none">
-  
-</div>
-<pre id="test">
-<script type="application/javascript">
-
-/** Test for Bug 291653 **/
-SimpleTest.waitForExplicitFinish();
-SimpleTest.requestFlakyTimeout("untriaged");
-
-var secondListenerDidRun = false;
-
-var w;
-function start() {
-  if ("showModalDialog" in window) {
-    w = window.open("file_bug291653.html", "foo", "width=300,height=300");
-  } else {
-    // window.showModalDialog doesn't exist in e10s mode, nothing to do in this test.
-    ok(true, "nothing to do in e10s mode");
-    SimpleTest.finish();
-  }
-}
-
-function closeTest() {
-  w.setTimeout("close()", 0);
-  setTimeout("finish()", 500);
-}
-
-function finish() {
-  ok(!secondListenerDidRun, "Shouldn't have run second listener!");
-  SimpleTest.finish();
-}
-
-function end() {
-  setTimeout("closeTest()", 500);
-}
-
-start();
-
-</script>
-</pre>
-</body>
-</html>
--- a/dom/tests/mochitest/bugs/test_bug406375.html
+++ b/dom/tests/mochitest/bugs/test_bug406375.html
@ -1,37 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=406375
-->
-<head>
-  <title>Test for Bug 406375</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<body onload="runTest()">
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=406375">Mozilla Bug 406375</a>
-<p id="display"></p>
-<div id="content" style="display: none">
-  
-</div>
-<pre id="test">
-<script type="application/javascript">
-
-/** Test for Bug 406375 **/
-
-
-SimpleTest.waitForExplicitFinish();
-
-function runTest() {
-  if ("showModalDialog" in window) {
-    window.showModalDialog("file_bug406375.html");
-  }
-  ok(true, "This test should not hang");
-
-  SimpleTest.finish();
-}
-
-</script>
-</pre>
-</body>
-</html>
--- a/dom/tests/mochitest/bugs/test_bug414291.html
+++ b/dom/tests/mochitest/bugs/test_bug414291.html
@ -16,7 +16,6 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=414291

 var result1 = 0;
 var result2 = 0;
-var result3 = 0;

 window.open("data:text/html,<html><body onload='close(); opener.result1 = 1;'>", "w1");
 is(result1, 0, "window should not be opened either as modal or loaded synchronously.");
@ -24,11 +23,6 @@ is(result1, 0, "window should not be opened either as modal or loaded synchronou
 window.open("data:text/html,<html><body onload='close(); opener.result2 = 2;'>", "w2", "modal=yes");
 is(result2, 0, "window should not be opened either as modal or data loaded synchronously.");

-if (window.showModalDialog) {
-  result3 = window.showModalDialog("data:text/html,<html><body onload='close(); returnValue = 3;'>");
-  is(result3, 3, "window should be opened as modal.");
-}
-
 </script>
 </pre>
 </body>
--- a/dom/tests/mochitest/bugs/test_bug437361.html
+++ b/dom/tests/mochitest/bugs/test_bug437361.html
@ -1,72 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=437361
-->
-<head>
-  <title>Test for Bug 437361</title>
-  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
-  
-  <script class="testbody" type="text/javascript">
-
-  /** Test for Bug 437361 **/
-
-  function testModalDialogBlockedCleanly() {
-    is(true, SpecialPowers.getBoolPref("dom.disable_open_during_load"), "mozprefs sanity check");
-    var rv = window.showModalDialog( // should be blocked without exception
-      "data:text/html,<html><body onload='close(); returnValue = 1;' /></html>");
-    is(rv, null, "Modal dialog opened unexpectedly.");
-  }
-  
-  function testModalDialogAllowed() {
-    is(false, SpecialPowers.getBoolPref("dom.disable_open_during_load"), "mozprefs sanity check");
-    var rv = window.showModalDialog( // should not be blocked this time
-      "data:text/html,<html><body onload='close(); returnValue = 1;' /></html>");
-    is(rv, 1, "Problem with modal dialog returnValue.");
-  }
-
-  function testOtherExceptionsNotTrapped() {
-    is(false, SpecialPowers.getBoolPref("dom.disable_open_during_load"), "mozprefs sanity check");
-    window.showModalDialog('about:config'); // forbidden by SecurityCheckURL
-  }
-
-  function test(disableOpen, exceptionExpected, testFn, errorMsg) {
-    if ("showModalDialog" in window) {
-      var oldPrefVal = SpecialPowers.getBoolPref("dom.disable_open_during_load");
-      try {
-        SpecialPowers.setBoolPref("dom.disable_open_during_load", disableOpen);
-        testFn();
-        ok(!exceptionExpected, errorMsg);
-      } catch (_) {
-        ok(exceptionExpected, errorMsg);
-      }
-      finally {
-        SpecialPowers.setBoolPref("dom.disable_open_during_load", oldPrefVal);
-      }
-    } else {
-      ok(true, "nothing to do in e10s mode");
-    }
-  }
-
-  test(true, false, testModalDialogBlockedCleanly,
-       "Blocked showModalDialog caused an exception.");
-       
-  test(false, false, testModalDialogAllowed,
-       "showModalDialog was blocked even though dom.disable_open_during_load was false.");
-
-  test(false, true, testOtherExceptionsNotTrapped,
-       "Incorrectly suppressed insecure showModalDialog exception.");
-
-  </script>
-</head>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=437361">Mozilla Bug 437361</a>
-<p id="display"></p>
-<div id="content" style="display: none"> 
-</div>
-<pre id="test">
-</pre>
-</body>
-</html>
-
--- a/dom/tests/mochitest/bugs/test_bug479143.html
+++ b/dom/tests/mochitest/bugs/test_bug479143.html
@ -1,44 +0,0 @@
-<!DOCTYPE html>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=479143
-->
-<head>
-  <title>Test for Bug 411103</title>
-  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
-</head>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=479143">Mozilla Bug 479143</a>
-<p id="display"></p>
-<div id="content" style="display: none"></div>
-
-<pre id="test">
-<script class="testbody" type="text/javascript">
-
-  SimpleTest.waitForExplicitFinish();
-
-  setTimeout(function() {
-    if ("showModalDialog" in window) {
-      var interval = setInterval(function() { var i = 0; i++; }, 10);
-
-      var xhr = new XMLHttpRequest();
-      xhr.open("GET", "test_bug479143.html", false);
-      xhr.send(null);
-
-      window.showModalDialog("javascript:" +
-                             "setTimeout(function() { window.close(); }, 1000);",
-                             null);
-
-      clearInterval(interval);
-    }
-
-    ok(true, "did not crash");
-
-    SimpleTest.finish();
-  }, 0);
-
-</script>
-</pre>
-</body>
-</html>
--- a/dom/tests/mochitest/bugs/test_bug504862.html
+++ b/dom/tests/mochitest/bugs/test_bug504862.html
@ -1,45 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=504862
-->
-<head>
-  <title>Test for Bug 504862</title>
-  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
-</head>
-<body onload="runTest()">
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=504862">Mozilla Bug 504862</a>
-<script class="testbody" type="text/javascript">
-
-/** Test for Bug 504862 **/
-SimpleTest.waitForExplicitFinish();
-function onMsgRcv(event)
-{
-  is(event.data, "args: undefined", "Unexpected cross origin dialog arguments.");
-}
-
-function runTest() {
-  if ("showModalDialog" in window) {
-    window.addEventListener("message", onMsgRcv, false);
-
-    var result = window.showModalDialog("file_bug504862.html", "my args");
-    // NB: We used to clear returnValue on each navigation, but now we do a
-    // security check on access, so we can safely make returnValue live on
-    // the browsing context, per spec.
-    is(result, 3, "window sees previous dialog documents return value.");
-
-    result = window.showModalDialog("http://test1.example.com/tests/dom/tests/mochitest/bugs/file_bug504862.html", "my args");
-
-    is(result, undefined, "Able to see return value from cross origin dialog.");
-  } else {
-    ok(true, "nothing to do in e10s mode");
-  }
-
-  SimpleTest.finish();
-}
-
-</script>
-</pre>
-</body>
-</html>
--- a/dom/tests/mochitest/bugs/test_bug61098.html
+++ b/dom/tests/mochitest/bugs/test_bug61098.html
@ -306,28 +306,6 @@ function runtestsInner()

  w.close();

-  // Test that showModalDialog() works normally and then gets blocked
-  // on the second call.
-  if (window.showModalDialog) {
-    w = window.open();
-    w.showModalDialog("data:text/html,%3Cscript>window.close();%3C/script>")
-    is (promptState, void(0), "Wrong prompt state");
-
-    try {
-      w.showModalDialog("data:text/html,%3Cscript>window.close();%3C/script>")
-      ok(false, "showModalDialog call should throw an exception");
-    } catch(e) {
-      is(e.name, "NS_ERROR_NOT_AVAILABLE", "Wrong exception");
-    }
-    is (promptState.method, "confirm", "Wrong prompt method called");
-    is (promptState.parent, w, "Wrong confirm parent");
-    is (promptState.msg, "Prevent this page from creating additional dialogs",
-        "Wrong confirm message");
-    promptState = void(0);
-
-    w.close();
-  }
-
  mockPromptFactoryRegisterer.unregister();
  mockPromptServiceRegisterer.unregister();

--- a/dom/tests/mochitest/bugs/test_bug735237.html
+++ b/dom/tests/mochitest/bugs/test_bug735237.html
@ -1,38 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=735237
-->
-<head>
-  <title>Test for Bug 735237</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=735237">Mozilla Bug 735237</a>
-<p id="display"></p>
-<div id="content" style="display: none">
-
-</div>
-<pre id="test">
-<script class="testbody" type="text/javascript">
-
-/** Test for Bug 735237 **/
-
-SimpleTest.waitForExplicitFinish();
-
-SpecialPowers.pushPrefEnv({"set": [["dom.disable_window_showModalDialog", true]]}, function() {
-  var caughtException = false;
-  try {
-    window.showModalDialog("http://example.com/");
-  } catch (e) {
-    caughtException = true;
-  }
-  ok(caughtException, "showModalDialog should throw an exception");
-  SimpleTest.finish();
-});
-
-</script>
-</pre>
-</body>
-</html>
--- a/dom/tests/mochitest/general/file_showModalDialog.html
+++ b/dom/tests/mochitest/general/file_showModalDialog.html
@ -1,35 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<script>
-  function go() {
-    is(SpecialPowers.wrap(window).location.toString(), location.toString(), "sanity");
-    ok("returnValue" in window && "dialogArguments" in window, "We are modal");
-    var iwin = document.getElementById('ifr').contentWindow;
-    is(SpecialPowers.Cu.getClassName(iwin, /* aUnwrap = */ true), "Window", "Descendant frames should not be modal");
-
-    if (location.origin != "http://mochi.test:8888") {
-      is(window.dialogArguments, undefined,
-        "dialogArguments should be undefined cross-origin: " + location.origin);
-    }
-
-    window.returnValue = "rv: " + window.dialogArguments;
-
-    // Allow for testing navigations in series.
-    if (location.search == "") {
-      window.close();
-    } else {
-      var origins = location.search.split('?')[1].split(',');
-      var newsearch = '?' + origins.splice(1).join(',');
-      var newurl = location.toString().replace(location.origin, origins[0])
-                                      .replace(location.search, newsearch);
-      location = newurl;
-    }
-
-  }
-</script>
-</head>
-<body onload="opener.postMessage('dosetup', '*');">
-<iframe id="ifr"></iframe>
-</body>
-</html>
--- a/dom/tests/mochitest/general/mochitest.ini
+++ b/dom/tests/mochitest/general/mochitest.ini
@ -9,7 +9,6 @@ support-files =
  file_interfaces.xml
  file_moving_nodeList.html
  file_moving_xhr.html
-  file_showModalDialog.html
  historyframes.html
  image_50.png
  image_100.png
@ -116,8 +115,6 @@ support-files = test_offsets.js
 [test_resource_timing_frameset.html]
 [test_selectevents.html]
 skip-if = toolkit == 'android' # bug 1230232 - Mouse doesn't select in the same way
-[test_showModalDialog.html]
-skip-if = e10s || toolkit == 'android' #Don't run modal tests on Android
 [test_showModalDialog_e10s.html]
 run-if = e10s
 [test_storagePermissionsAccept.html]
--- a/dom/tests/mochitest/general/test_showModalDialog.html
+++ b/dom/tests/mochitest/general/test_showModalDialog.html
@ -1,60 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=862918
-->
-<head>
-  <meta charset="utf-8">
-  <title>Test for Bug 862918</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-  <script type="application/javascript">
-
-  /** Test for window.showModalDialog. **/
-
-  // The modal window needs to touch Cu, which means that it needs
-  // SpecialPowers. But given the semantics of modal windows, we have to
-  // do some funny stuff with postMessage to set this up.
-  window.onmessage = function(evt) {
-    is(evt.data, 'dosetup', "message from modal window is correct");
-    var win = SpecialPowers.wrap(evt.source);
-    win.wrappedJSObject.SpecialPowers = SpecialPowers;
-    SpecialPowers.setWrapped(win.wrappedJSObject, 'is', SpecialPowers.wrap(is));
-    SpecialPowers.setWrapped(win.wrappedJSObject, 'ok', SpecialPowers.wrap(ok));
-    win.wrappedJSObject.go();
-  };
-
-  var someObj = { foo: 42, bar: "hi"};
-  var xurl = location.toString()
-                     .replace('mochi.test:8888', 'example.org')
-                     .replace('test_showModal', 'file_showModal');
-  if (xurl.indexOf('?') != -1)
-    xurl = xurl.substring(0, xurl.indexOf('?'));
-  is(showModalDialog('file_showModalDialog.html'), "rv: undefined");
-  is(showModalDialog(xurl), undefined);
-  is(showModalDialog('file_showModalDialog.html', 3), "rv: 3");
-  is(showModalDialog(xurl, 3), undefined);
-  is(showModalDialog('file_showModalDialog.html', someObj), "rv: " + someObj);
-  is(showModalDialog(xurl, someObj), undefined);
-
-  // Test sequential navigations.
-  is(showModalDialog('file_showModalDialog.html?http://mochi.test:8888', 4),
-                     'rv: 4');
-  is(showModalDialog('file_showModalDialog.html?http://example.com', 4), undefined);
-  is(showModalDialog('file_showModalDialog.html?http://example.com,http://mochi.test:8888', 4), 'rv: 4');
-
-  // This test used to assert after gc. Make sure it doesn't.
-  SpecialPowers.gc();
-
-  </script>
-</head>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=862918">Mozilla Bug 862918</a>
-<p id="display"></p>
-<div id="content" style="display: none">
-
-</div>
-<pre id="test">
-</pre>
-</body>
-</html>
--- a/dom/webidl/Window.webidl
+++ b/dom/webidl/Window.webidl
@ -78,9 +78,6 @@ typedef any Transferable;
  [Throws, UnsafeInPrerendering, NeedsSubjectPrincipal] boolean confirm(optional DOMString message = "");
  [Throws, UnsafeInPrerendering, NeedsSubjectPrincipal] DOMString? prompt(optional DOMString message = "", optional DOMString default = "");
  [Throws, UnsafeInPrerendering] void print();
-  //[Throws] any showModalDialog(DOMString url, optional any argument);
-  [Throws, Func="nsGlobalWindow::IsShowModalDialogEnabled", UnsafeInPrerendering, NeedsSubjectPrincipal]
-  any showModalDialog(DOMString url, optional any argument, optional DOMString options = "");

  [Throws, CrossOriginCallable, NeedsSubjectPrincipal]
  void postMessage(any message, DOMString targetOrigin, optional sequence<Transferable> transfer);
@ -240,17 +237,6 @@ interface SpeechSynthesisGetter {
 Window implements SpeechSynthesisGetter;
 #endif

-// http://www.whatwg.org/specs/web-apps/current-work/
-[NoInterfaceObject]
-interface WindowModal {
-  [Throws, Func="nsGlobalWindow::IsModalContentWindow", NeedsSubjectPrincipal]
-  readonly attribute any dialogArguments;
-
-  [Throws, Func="nsGlobalWindow::IsModalContentWindow", NeedsSubjectPrincipal]
-  attribute any returnValue;
-};
-Window implements WindowModal;
-
 // Mozilla-specific stuff
 partial interface Window {
  //[NewObject, Throws] CSSStyleDeclaration getDefaultComputedStyle(Element elt, optional DOMString pseudoElt = "");
--- a/embedding/browser/nsIWebBrowserChrome.idl
+++ b/embedding/browser/nsIWebBrowserChrome.idl
@ -77,9 +77,6 @@ interface nsIWebBrowserChrome : nsISupports
    const unsigned long CHROME_NON_PRIVATE_WINDOW     = 0x00020000;
    const unsigned long CHROME_PRIVATE_LIFETIME       = 0x00040000;

-    // Whether this was opened by nsGlobalWindow::ShowModalDialog.
-    const unsigned long CHROME_MODAL_CONTENT_WINDOW   = 0x00080000;
-
    // Whether this window should use remote (out-of-process) tabs.
    const unsigned long CHROME_REMOTE_WINDOW          = 0x00100000;

--- a/embedding/components/windowwatcher/nsWindowWatcher.cpp
+++ b/embedding/components/windowwatcher/nsWindowWatcher.cpp
@ -683,7 +683,6 @@ nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy* aParent,
  bool windowNeedsName = false;
  bool windowIsModal = false;
  bool uriToLoadIsChrome = false;
-  bool windowIsModalContentDialog = false;

  uint32_t chromeFlags;
  nsAutoString name;          // string version of aName
@ -775,30 +774,12 @@ nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy* aParent,
  } else {
    chromeFlags = CalculateChromeFlagsForChild(features);

-    // Until ShowModalDialog is removed, it's still possible for content to
-    // request dialogs, but only in single-process mode.
    if (aDialog) {
      MOZ_ASSERT(XRE_IsParentProcess());
      chromeFlags |= nsIWebBrowserChrome::CHROME_OPENAS_DIALOG;
    }
  }

-  // If we're not called through our JS version of the API, and we got
-  // our internal modal option, treat the window we're opening as a
-  // modal content window (and set the modal chrome flag).
-  if (!aCalledFromJS && aArgv &&
-      WinHasOption(features, "-moz-internal-modal", 0, nullptr)) {
-    windowIsModalContentDialog = true;
-
-    // CHROME_MODAL gets inherited by dependent windows, which affects various
-    // platform-specific window state (especially on OSX). So we need some way
-    // to determine that this window was actually opened by nsGlobalWindow::
-    // ShowModalDialog(), and that somebody is actually going to be watching
-    // for return values and all that.
-    chromeFlags |= nsIWebBrowserChrome::CHROME_MODAL_CONTENT_WINDOW;
-    chromeFlags |= nsIWebBrowserChrome::CHROME_MODAL;
-  }
-
  SizeSpec sizeSpec;
  CalcSizeSpec(features, sizeSpec);

@ -1079,7 +1060,7 @@ nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy* aParent,
    MaybeDisablePersistence(features, newTreeOwner);
  }

-  if ((aDialog || windowIsModalContentDialog) && aArgv) {
+  if (aDialog && aArgv) {
    // Set the args on the new window.
    nsCOMPtr<nsPIDOMWindowOuter> piwin(do_QueryInterface(*aResult));
    NS_ENSURE_TRUE(piwin, NS_ERROR_UNEXPECTED);
@ -1268,8 +1249,7 @@ nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy* aParent,
    SizeOpenedWindow(newTreeOwner, aParent, isCallerChrome, sizeSpec);
  }

-  // XXXbz isn't windowIsModal always true when windowIsModalContentDialog?
-  if (windowIsModal || windowIsModalContentDialog) {
+  if (windowIsModal) {
    nsCOMPtr<nsIDocShellTreeOwner> newTreeOwner;
    newDocShellItem->GetTreeOwner(getter_AddRefs(newTreeOwner));
    nsCOMPtr<nsIWebBrowserChrome> newChrome(do_GetInterface(newTreeOwner));
--- a/gfx/gl/GLContext.cpp
+++ b/gfx/gl/GLContext.cpp
@ -578,6 +578,10 @@ GLContext::LoadFeatureSymbols(const char* prefix, bool trygl, const SymLoadStruc
 bool
 GLContext::InitWithPrefixImpl(const char* prefix, bool trygl)
 {
+    // wglGetProcAddress requires a current context.
+    if (!MakeCurrent(true))
+        return false;
+
    mWorkAroundDriverBugs = gfxPrefs::WorkAroundDriverBugs();

    const SymLoadStruct coreSymbols[] = {
@ -714,7 +718,6 @@ GLContext::InitWithPrefixImpl(const char* prefix, bool trygl)

    ////////////////

-    MakeCurrent();
    MOZ_ASSERT(mProfile != ContextProfile::Unknown);

    uint32_t version = 0;
@ -2253,13 +2256,11 @@ GLContext::MarkDestroyed()
    mBlitHelper = nullptr;
    mReadTexImageHelper = nullptr;

-    if (MakeCurrent()) {
-        mTexGarbageBin->GLContextTeardown();
-    } else {
-        NS_WARNING("MakeCurrent() failed during MarkDestroyed! Skipping GL object teardown.");
-    }
-
+    mIsDestroyed = true;
    mSymbols.Zero();
+    if (MakeCurrent(true)) {
+        mTexGarbageBin->GLContextTeardown();
+    }
 }

 #ifdef MOZ_GL_DEBUG
--- a/gfx/gl/GLContext.h
+++ b/gfx/gl/GLContext.h
@ -353,6 +353,7 @@ public:
 protected:
    bool mIsOffscreen;
    bool mContextLost;
+    bool mIsDestroyed = false;

    /**
     * mVersion store the OpenGL's version, multiplied by 100. For example, if
@ -3265,7 +3266,7 @@ public:
 #endif
        return MakeCurrentImpl(aForce);
    }
-
+    
    virtual bool Init() = 0;

    virtual bool SetupLookupFunction() = 0;
@ -3273,8 +3274,7 @@ public:
    virtual void ReleaseSurface() {}

    bool IsDestroyed() {
-        // MarkDestroyed will mark all these as null.
-        return mSymbols.fUseProgram == nullptr;
+        return mIsDestroyed;
    }

    GLContext* GetSharedContext() { return mSharedContext; }
--- a/gfx/gl/GLContextCGL.h
+++ b/gfx/gl/GLContextCGL.h
@ -24,7 +24,7 @@ class GLContextCGL : public GLContext
 {
    friend class GLContextProviderCGL;

-    NSOpenGLContext* mContext;
+    NSOpenGLContext* const mContext;

 public:
    MOZ_DECLARE_REFCOUNTED_VIRTUAL_TYPENAME(GLContextCGL, override)
--- a/gfx/gl/GLContextGLX.h
+++ b/gfx/gl/GLContextGLX.h
@ -86,6 +86,7 @@ private:
    GLXContext mContext;
    Display* mDisplay;
    GLXDrawable mDrawable;
+    Maybe<GLXDrawable> mOverrideDrawable;
    bool mDeleteDrawable;
    bool mDoubleBuffered;

--- a/gfx/gl/GLContextProviderCGL.mm
+++ b/gfx/gl/GLContextProviderCGL.mm
@ -83,26 +83,13 @@ GLContextCGL::GLContextCGL(CreateContextFlags flags, const SurfaceCaps& caps,
 GLContextCGL::~GLContextCGL()
 {
    MarkDestroyed();
-
-    if (mContext) {
-        if ([NSOpenGLContext currentContext] == mContext) {
-            // Clear the current context before releasing. If we don't do
-            // this, the next time we call [NSOpenGLContext currentContext],
-            // "invalid context" will be printed to the console.
-            [NSOpenGLContext clearCurrentContext];
-        }
-        [mContext release];
-    }
-
+    [mContext release];
 }

 bool
 GLContextCGL::Init()
 {
-    if (!InitWithPrefix("gl", true))
-        return false;
-
-    return true;
+    return InitWithPrefix("gl", true);
 }

 CGLContextObj
@ -114,6 +101,11 @@ GLContextCGL::GetCGLContext() const
 bool
 GLContextCGL::MakeCurrentImpl(bool aForce)
 {
+    if (IsDestroyed()) {
+        [NSOpenGLContext clearCurrentContext];
+        return false;
+    }
+
    if (!aForce && [NSOpenGLContext currentContext] == mContext) {
        return true;
    }
--- a/gfx/gl/GLContextProviderEAGL.mm
+++ b/gfx/gl/GLContextProviderEAGL.mm
@ -36,35 +36,24 @@ GLContextEAGL::GLContextEAGL(CreateContextFlags flags, const SurfaceCaps& caps,

 GLContextEAGL::~GLContextEAGL()
 {
-    MakeCurrent();
-
-    if (mBackbufferFB) {
-        fDeleteFramebuffers(1, &mBackbufferFB);
-    }
-
-    if (mBackbufferRB) {
-        fDeleteRenderbuffers(1, &mBackbufferRB);
+    if (MakeCurrent()) {
+        if (mBackbufferFB) {
+            fDeleteFramebuffers(1, &mBackbufferFB);
+        }
+        if (mBackbufferRB) {
+            fDeleteRenderbuffers(1, &mBackbufferRB);
+        }
    }

+    mLayer = nil;
    MarkDestroyed();
-
-    if (mLayer) {
-      mLayer = nil;
-    }
-
-    if (mContext) {
-      [EAGLContext setCurrentContext:nil];
-      [mContext release];
-    }
+    [mContext release];
 }

 bool
 GLContextEAGL::Init()
 {
-    if (!InitWithPrefix("gl", true))
-        return false;
-
-    return true;
+    return InitWithPrefix("gl", true);
 }

 bool
@ -120,12 +109,12 @@ GLContextEAGL::MakeCurrentImpl(bool aForce)
        return true;
    }

-    if (mContext) {
-        if(![EAGLContext setCurrentContext:mContext]) {
-            return false;
-        }
+    if (IsDestroyed()) {
+        [EAGLContext setCurrentContext:nil];
+        return false;
    }
-    return true;
+    
+    return [EAGLContext setCurrentContext:mContext];
 }

 bool
--- a/gfx/gl/GLContextProviderEGL.cpp
+++ b/gfx/gl/GLContextProviderEGL.cpp
@ -150,13 +150,12 @@ is_power_of_two(int v)
 }

 static void
-DestroySurface(EGLSurface oldSurface) {
-    if (oldSurface != EGL_NO_SURFACE) {
-        sEGLLibrary.fMakeCurrent(EGL_DISPLAY(),
-                                 EGL_NO_SURFACE, EGL_NO_SURFACE,
-                                 EGL_NO_CONTEXT);
-        sEGLLibrary.fDestroySurface(EGL_DISPLAY(), oldSurface);
+DestroySurface(const EGLSurface surf) {
+    if (!surf) {
+        // Nothing to do.
+        return;
    }
+    sEGLLibrary.fDestroySurface(EGL_DISPLAY(), surf);
 }

 static EGLSurface
@ -223,7 +222,7 @@ GLContextEGL::~GLContextEGL()
    sEGLLibrary.fDestroyContext(EGL_DISPLAY(), mContext);
    sEGLLibrary.UnsetCachedCurrentContext();

-    mozilla::gl::DestroySurface(mSurface);
+    DestroySurface(mSurface);
 }

 bool
@ -247,12 +246,7 @@ GLContextEGL::Init()
    if (!InitWithPrefix("gl", true))
        return false;

-    bool current = MakeCurrent();
-    if (!current) {
-        gfx::LogFailure(NS_LITERAL_CSTRING(
-            "Couldn't get device attachments for device."));
-        return false;
-    }
+    MOZ_ASSERT(IsCurrent());

    static_assert(sizeof(GLint) >= sizeof(int32_t), "GLint is smaller than int32_t");
    mMaxTextureImageSize = INT32_MAX;
@ -303,7 +297,10 @@ GLContextEGL::ReleaseTexImage()
 }

 void
-GLContextEGL::SetEGLSurfaceOverride(EGLSurface surf) {
+GLContextEGL::SetEGLSurfaceOverride(const EGLSurface surf) {
+
+    MOZ_ASSERT(!surf || surf != mSurface);
+
    if (Screen()) {
        /* Blit `draw` to `read` if we need to, before we potentially juggle
          * `read` around. If we don't, we might attach a different `read`,
@ -314,12 +311,17 @@ GLContextEGL::SetEGLSurfaceOverride(EGLSurface surf) {
    }

    mSurfaceOverride = surf;
-    DebugOnly<bool> ok = MakeCurrent(true);
-    MOZ_ASSERT(ok);
+    MOZ_ALWAYS_TRUE(MakeCurrent(true));
 }

 bool
 GLContextEGL::MakeCurrentImpl(bool aForce) {
+    if (IsDestroyed()) {
+        //Clear and exit
+        sEGLLibrary.fMakeCurrent(EGL_DISPLAY(), nullptr, nullptr, nullptr);
+        return false;
+    }
+    
    bool succeeded = true;

    // Assume that EGL has the same problem as WGL does,
@ -373,7 +375,7 @@ GLContextEGL::IsCurrent() {
 }

 bool
-GLContextEGL::RenewSurface(nsIWidget* aWidget) {
+GLContextEGL::RenewSurface(nsIWidget* const aWidget) {
    if (!mOwnsContext) {
        return false;
    }
@ -389,13 +391,12 @@ GLContextEGL::RenewSurface(nsIWidget* aWidget) {

 void
 GLContextEGL::ReleaseSurface() {
-    if (mOwnsContext) {
-        mozilla::gl::DestroySurface(mSurface);
+    if (!mOwnsContext) {
+        return;
    }
-    if (mSurface == mSurfaceOverride) {
-        mSurfaceOverride = EGL_NO_SURFACE;
-    }
-    mSurface = EGL_NO_SURFACE;
+    
+    DestroySurface(mSurface);
+    mSurface = nullptr;
 }

 bool
--- a/gfx/gl/GLContextProviderGLX.cpp
+++ b/gfx/gl/GLContextProviderGLX.cpp
@ -894,20 +894,12 @@ GLContextGLX::~GLContextGLX()
        return;
    }

-    // see bug 659842 comment 76
-#ifdef DEBUG
-    bool success =
-#endif
-    mGLX->xMakeCurrent(mDisplay, X11None, nullptr);
-    MOZ_ASSERT(success,
-               "glXMakeCurrent failed to release GL context before we call "
-               "glXDestroyContext!");
-
    mGLX->xDestroyContext(mDisplay, mContext);

    if (mDeleteDrawable) {
        mGLX->xDestroyPixmap(mDisplay, mDrawable);
    }
+    MOZ_ASSERT(!mOverrideDrawable);
 }


@ -944,6 +936,10 @@ GLContextGLX::MakeCurrentImpl(bool aForce)
          // DRI2InvalidateBuffers event before drawing. See bug 1280653.
          Unused << XPending(mDisplay);
        }
+        if (IsDestroyed()) {
+            MOZ_ALWAYS_TRUE(mGLX->xMakeCurrent(mDisplay, X11None, nullptr));
+            return false; // We did not MakeCurrent mContext, but that's what we wanted!
+        }

        succeeded = mGLX->xMakeCurrent(mDisplay, mDrawable, mContext);
        NS_ASSERTION(succeeded, "Failed to make GL context current!");
@ -1017,16 +1013,18 @@ GLContextGLX::GetWSIInfo(nsCString* const out) const
 bool
 GLContextGLX::OverrideDrawable(GLXDrawable drawable)
 {
-    if (Screen())
+    if (Screen()) {
        Screen()->AssureBlitted();
-    Bool result = mGLX->xMakeCurrent(mDisplay, drawable, mContext);
-    return result;
+    }
+    mOverrideDrawable = Some(drawable);
+    return MakeCurrent(true);
 }

 bool
 GLContextGLX::RestoreDrawable()
 {
-    return mGLX->xMakeCurrent(mDisplay, mDrawable, mContext);
+    mOverrideDrawable = Nothing();
+    return MakeCurrent(true);
 }

 GLContextGLX::GLContextGLX(
--- a/gfx/gl/GLContextProviderWGL.cpp
+++ b/gfx/gl/GLContextProviderWGL.cpp
@ -314,20 +314,17 @@ GLContextWGL::Init()
    if (!mDC || !mContext)
        return false;

-    // see bug 929506 comment 29. wglGetProcAddress requires a current context.
-    if (!sWGLLib.fMakeCurrent(mDC, mContext))
-        return false;
-
    SetupLookupFunction();
-    if (!InitWithPrefix("gl", true))
-        return false;
-
-    return true;
+    return InitWithPrefix("gl", true);
 }

 bool
 GLContextWGL::MakeCurrentImpl(bool aForce)
 {
+    if (IsDestroyed()) {
+        MOZ_ALWAYS_TRUE(sWGLLib.fMakeCurrent(0, 0));
+    }
+    
    BOOL succeeded = true;

    // wglGetCurrentContext seems to just pull the HGLRC out
--- a/ipc/chromium/moz.build
+++ b/ipc/chromium/moz.build
@ -58,7 +58,7 @@ if os_win:
        'src/chrome/common/process_watcher_win.cc',
        'src/chrome/common/transport_dib_win.cc',
    ]
-elif not CONFIG['MOZ_SYSTEM_LIBEVENT']:
+else:
    DIRS += ['src/third_party']

 if os_posix:
@ -143,9 +143,9 @@ if os_solaris:
       'src/base/atomicops_internals_x86_gcc.cc',
       'src/base/process_util_linux.cc',
       'src/base/time_posix.cc',
-]
+    ]
    
-elif not CONFIG['MOZ_SYSTEM_LIBEVENT']:
+else:
    LOCAL_INCLUDES += ['src/third_party/libevent/linux']

 ost = CONFIG['OS_TEST']
--- a/ipc/chromium/src/third_party/libeventcommon.mozbuild
+++ b/ipc/chromium/src/third_party/libeventcommon.mozbuild
@ -32,7 +32,7 @@ else:
        else:
            libevent_include_suffix = 'linux'

-if os_posix and not CONFIG['MOZ_SYSTEM_LIBEVENT']:
+if os_posix:
    DEFINES['HAVE_CONFIG_H'] = True
    LOCAL_INCLUDES += sorted([
        'libevent',
--- a/ipc/chromium/src/third_party/moz.build
+++ b/ipc/chromium/src/third_party/moz.build
@ -10,9 +10,6 @@ include(libevent_path_prefix + '/libeventcommon.mozbuild')
 if os_win:
    error('should not reach here on Windows')

-if CONFIG['MOZ_SYSTEM_LIBEVENT']:
-    error('should not reach here if we are using a native libevent')
-
 UNIFIED_SOURCES += [
    'libevent/buffer.c',
    'libevent/bufferevent.c',
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@ -3862,10 +3862,10 @@ ConvertRegExpTreeToObject(JSContext* cx, irregexp::RegExpTree* tree)
            return nullptr;
        return obj;
    }
-    if (tree->IsLookaround()) {
-        if (!StringProp(cx, obj, "type", "Lookaround"))
+    if (tree->IsLookahead()) {
+        if (!StringProp(cx, obj, "type", "Lookahead"))
            return nullptr;
-        irregexp::RegExpLookaround* t = tree->AsLookaround();
+        irregexp::RegExpLookahead* t = tree->AsLookahead();
        if (!BooleanProp(cx, obj, "is_positive", t->is_positive()))
            return nullptr;
        if (!TreeProp(cx, obj, "body", t->body()))
--- a/js/src/irregexp/NativeRegExpMacroAssembler.cpp
+++ b/js/src/irregexp/NativeRegExpMacroAssembler.cpp
@ -582,7 +582,7 @@ NativeRegExpMacroAssembler::CheckAtStart(Label* on_at_start)
 }

 void
-NativeRegExpMacroAssembler::CheckNotAtStart(int cp_offset, Label* on_not_at_start)
+NativeRegExpMacroAssembler::CheckNotAtStart(Label* on_not_at_start)
 {
    JitSpew(SPEW_PREFIX "CheckNotAtStart");

@ -673,7 +673,7 @@ NativeRegExpMacroAssembler::CheckGreedyLoop(Label* on_tos_equals_current_positio
 }

 void
-NativeRegExpMacroAssembler::CheckNotBackReference(int start_reg, bool read_backward, Label* on_no_match)
+NativeRegExpMacroAssembler::CheckNotBackReference(int start_reg, Label* on_no_match)
 {
    JitSpew(SPEW_PREFIX "CheckNotBackReference(%d)", start_reg);

@ -744,8 +744,8 @@ NativeRegExpMacroAssembler::CheckNotBackReference(int start_reg, bool read_backw
 }

 void
-NativeRegExpMacroAssembler::CheckNotBackReferenceIgnoreCase(int start_reg, bool read_backward,
-                                                            Label* on_no_match, bool unicode)
+NativeRegExpMacroAssembler::CheckNotBackReferenceIgnoreCase(int start_reg, Label* on_no_match,
+                                                            bool unicode)
 {
    JitSpew(SPEW_PREFIX "CheckNotBackReferenceIgnoreCase(%d, %d)", start_reg, unicode);

--- a/js/src/irregexp/NativeRegExpMacroAssembler.h
+++ b/js/src/irregexp/NativeRegExpMacroAssembler.h
@ -105,10 +105,9 @@ class MOZ_STACK_CLASS NativeRegExpMacroAssembler final : public RegExpMacroAssem
    void CheckCharacterGT(char16_t limit, jit::Label* on_greater);
    void CheckCharacterLT(char16_t limit, jit::Label* on_less);
    void CheckGreedyLoop(jit::Label* on_tos_equals_current_position);
-    void CheckNotAtStart(int cp_offset, jit::Label* on_not_at_start);
-    void CheckNotBackReference(int start_reg, bool read_backward, jit::Label* on_no_match);
-    void CheckNotBackReferenceIgnoreCase(int start_reg, bool read_backward,
-                                         jit::Label* on_no_match, bool unicode);
+    void CheckNotAtStart(jit::Label* on_not_at_start);
+    void CheckNotBackReference(int start_reg, jit::Label* on_no_match);
+    void CheckNotBackReferenceIgnoreCase(int start_reg, jit::Label* on_no_match, bool unicode);
    void CheckNotCharacter(unsigned c, jit::Label* on_not_equal);
    void CheckNotCharacterAfterAnd(unsigned c, unsigned and_with, jit::Label* on_not_equal);
    void CheckNotCharacterAfterMinusAnd(char16_t c, char16_t minus, char16_t and_with,
--- a/js/src/irregexp/RegExpAST.cpp
+++ b/js/src/irregexp/RegExpAST.cpp
@ -250,16 +250,16 @@ RegExpCapture::CaptureRegisters()
 }

 // ----------------------------------------------------------------------------
-// RegExpLookaround
+// RegExpLookahead

 Interval
-RegExpLookaround::CaptureRegisters()
+RegExpLookahead::CaptureRegisters()
 {
    return body()->CaptureRegisters();
 }

 bool
-RegExpLookaround::IsAnchoredAtStart()
+RegExpLookahead::IsAnchoredAtStart()
 {
-    return is_positive() && type() == LOOKAHEAD && body()->IsAnchoredAtStart();
+    return is_positive() && body()->IsAnchoredAtStart();
 }
--- a/js/src/irregexp/RegExpAST.h
+++ b/js/src/irregexp/RegExpAST.h
@ -360,7 +360,6 @@ class RegExpCapture : public RegExpTree
    virtual int min_match() { return body_->min_match(); }
    virtual int max_match() { return body_->max_match(); }
    RegExpTree* body() { return body_; }
-    void set_body(RegExpTree* body) { body_ = body; }
    int index() { return index_; }
    static int StartRegister(int index) { return index * 2; }
    static int EndRegister(int index) { return index * 2 + 1; }
@ -370,29 +369,25 @@ class RegExpCapture : public RegExpTree
    int index_;
 };

-class RegExpLookaround : public RegExpTree
+class RegExpLookahead : public RegExpTree
 {
  public:
-    enum Type { LOOKAHEAD, LOOKBEHIND };
-
-    RegExpLookaround(RegExpTree* body,
-                     bool is_positive,
-                     int capture_count,
-                     int capture_from,
-                     Type type)
+    RegExpLookahead(RegExpTree* body,
+                    bool is_positive,
+                    int capture_count,
+                    int capture_from)
      : body_(body),
        is_positive_(is_positive),
        capture_count_(capture_count),
-        capture_from_(capture_from),
-        type_(type)
+        capture_from_(capture_from)
    {}

    virtual void* Accept(RegExpVisitor* visitor, void* data);
    virtual RegExpNode* ToNode(RegExpCompiler* compiler,
                               RegExpNode* on_success);
-    virtual RegExpLookaround* AsLookaround();
+    virtual RegExpLookahead* AsLookahead();
    virtual Interval CaptureRegisters();
-    virtual bool IsLookaround();
+    virtual bool IsLookahead();
    virtual bool IsAnchoredAtStart();
    virtual int min_match() { return 0; }
    virtual int max_match() { return 0; }
@ -400,14 +395,12 @@ class RegExpLookaround : public RegExpTree
    bool is_positive() { return is_positive_; }
    int capture_count() { return capture_count_; }
    int capture_from() { return capture_from_; }
-    Type type() { return type_; }

  private:
    RegExpTree* body_;
    bool is_positive_;
    int capture_count_;
    int capture_from_;
-    Type type_;
 };

 typedef InfallibleVector<RegExpCapture*, 1> RegExpCaptureVector;
@ -424,14 +417,8 @@ class RegExpBackReference : public RegExpTree
                               RegExpNode* on_success);
    virtual RegExpBackReference* AsBackReference();
    virtual bool IsBackReference();
-    virtual int min_match() override { return 0; }
-    // The capture may not be completely parsed yet, if the reference occurs
-    // before the capture. In the ordinary case, nothing has been captured yet,
-    // so the back reference must have the length 0. If the back reference is
-    // inside a lookbehind, effectively making it a forward reference, we return
-    virtual int max_match() override {
-      return capture_->body() ? capture_->max_match() : 0;
-    }
+    virtual int min_match() { return 0; }
+    virtual int max_match() { return capture_->max_match(); }
    int index() { return capture_->index(); }
    RegExpCapture* capture() { return capture_; }
  private:
--- a/js/src/irregexp/RegExpBytecode.h
+++ b/js/src/irregexp/RegExpBytecode.h
@ -82,19 +82,16 @@ V(CHECK_LT,          35, 8)   /* bc8 pad8 uc16 addr32                       */ \
 V(CHECK_GT,          36, 8)   /* bc8 pad8 uc16 addr32                       */ \
 V(CHECK_NOT_BACK_REF, 37, 8)  /* bc8 reg_idx24 addr32                       */ \
 V(CHECK_NOT_BACK_REF_NO_CASE, 38, 8) /* bc8 reg_idx24 addr32                */ \
-V(CHECK_NOT_BACK_REF_BACKWARD, 39, 8)         /* bc8 reg_idx24 addr32       */ \
-V(CHECK_NOT_BACK_REF_NO_CASE_BACKWARD, 40, 8) /* bc8 reg_idx24 addr32       */ \
-V(CHECK_NOT_REGS_EQUAL, 41, 12) /* bc8 regidx24 reg_idx32 addr32            */ \
-V(CHECK_REGISTER_LT, 42, 12)  /* bc8 reg_idx24 value32 addr32               */ \
-V(CHECK_REGISTER_GE, 43, 12)  /* bc8 reg_idx24 value32 addr32               */ \
-V(CHECK_REGISTER_EQ_POS, 44, 8) /* bc8 reg_idx24 addr32                     */ \
-V(CHECK_AT_START,    45, 8)   /* bc8 pad24 addr32                           */ \
-V(CHECK_NOT_AT_START, 46, 8)  /* bc8 pad24 addr32                           */ \
-V(CHECK_GREEDY,      47, 8)   /* bc8 pad24 addr32                           */ \
-V(ADVANCE_CP_AND_GOTO, 48, 8) /* bc8 offset24 addr32                        */ \
-V(SET_CURRENT_POSITION_FROM_END, 49, 4) /* bc8 idx24                        */ \
-V(CHECK_NOT_BACK_REF_NO_CASE_UNICODE, 50, 8) /* bc8 reg_idx24 addr32        */ \
-V(CHECK_NOT_BACK_REF_NO_CASE_BACKWARD_UNICODE, 51, 8) /* bc8 reg_idx24 addr32 */
+V(CHECK_NOT_REGS_EQUAL, 39, 12) /* bc8 regidx24 reg_idx32 addr32            */ \
+V(CHECK_REGISTER_LT, 40, 12)  /* bc8 reg_idx24 value32 addr32               */ \
+V(CHECK_REGISTER_GE, 41, 12)  /* bc8 reg_idx24 value32 addr32               */ \
+V(CHECK_REGISTER_EQ_POS, 42, 8) /* bc8 reg_idx24 addr32                     */ \
+V(CHECK_AT_START,    43, 8)   /* bc8 pad24 addr32                           */ \
+V(CHECK_NOT_AT_START, 44, 8)  /* bc8 pad24 addr32                           */ \
+V(CHECK_GREEDY,      45, 8)   /* bc8 pad24 addr32                           */ \
+V(ADVANCE_CP_AND_GOTO, 46, 8) /* bc8 offset24 addr32                        */ \
+V(SET_CURRENT_POSITION_FROM_END, 47, 4) /* bc8 idx24                        */ \
+V(CHECK_NOT_BACK_REF_NO_CASE_UNICODE, 48, 8) /* bc8 reg_idx24 addr32        */

 #define DECLARE_BYTECODES(name, code, length) \
  static const int BC_##name = code;
--- a/js/src/irregexp/RegExpEngine.cpp
+++ b/js/src/irregexp/RegExpEngine.cpp
@ -721,8 +721,6 @@ ActionNode::EmptyMatchCheck(int start_register,
 int
 TextNode::EatsAtLeast(int still_to_find, int budget, bool not_at_start)
 {
-    if (read_backward())
-        return 0;
    int answer = Length();
    if (answer >= still_to_find)
        return answer;
@ -738,7 +736,8 @@ TextNode::EatsAtLeast(int still_to_find, int budget, bool not_at_start)
 int
 TextNode::GreedyLoopTextLength()
 {
-    return Length();
+    TextElement elm = elements()[elements().length() - 1];
+    return elm.cp_offset() + elm.length();
 }

 RegExpNode*
@ -888,8 +887,6 @@ AssertionNode::FillInBMInfo(int offset, int budget, BoyerMooreLookahead* bm, boo
 int
 BackReferenceNode::EatsAtLeast(int still_to_find, int budget, bool not_at_start)
 {
-    if (read_backward())
-        return 0;
    if (budget <= 0)
        return 0;
    return on_success()->EatsAtLeast(still_to_find, budget - 1, not_at_start);
@ -1581,9 +1578,6 @@ class irregexp::RegExpCompiler
        current_expansion_factor_ = value;
    }

-    bool read_backward() { return read_backward_; }
-    void set_read_backward(bool value) { read_backward_ = value; }
-
    JSContext* cx() const { return cx_; }
    LifoAlloc* alloc() const { return alloc_; }

@ -1601,7 +1595,6 @@ class irregexp::RegExpCompiler
    bool unicode_;
    bool reg_exp_too_big_;
    int current_expansion_factor_;
-    bool read_backward_;
    FrequencyCollator frequency_collator_;
    JSContext* cx_;
    LifoAlloc* alloc_;
@ -1631,7 +1624,6 @@ RegExpCompiler::RegExpCompiler(JSContext* cx, LifoAlloc* alloc, int capture_coun
    unicode_(unicode),
    reg_exp_too_big_(false),
    current_expansion_factor_(1),
-    read_backward_(false),
    frequency_collator_(),
    cx_(cx),
    alloc_(alloc)
@ -1755,7 +1747,7 @@ irregexp::CompilePattern(JSContext* cx, RegExpShared* shared, RegExpCompileData*
            // at the start of input.
            ChoiceNode* first_step_node = alloc.newInfallible<ChoiceNode>(&alloc, 2);
            RegExpNode* char_class =
-                alloc.newInfallible<TextNode>(alloc.newInfallible<RegExpCharacterClass>('*'), false, loop_node);
+                alloc.newInfallible<TextNode>(alloc.newInfallible<RegExpCharacterClass>('*'), loop_node);
            first_step_node->AddAlternative(GuardedAlternative(captured_body));
            first_step_node->AddAlternative(GuardedAlternative(char_class));
            node = first_step_node;
@ -1858,19 +1850,19 @@ RegExpAtom::ToNode(RegExpCompiler* compiler, RegExpNode* on_success)
    TextElementVector* elms =
        compiler->alloc()->newInfallible<TextElementVector>(*compiler->alloc());
    elms->append(TextElement::Atom(this));
-    return compiler->alloc()->newInfallible<TextNode>(elms, compiler->read_backward(), on_success);
+    return compiler->alloc()->newInfallible<TextNode>(elms, on_success);
 }

 RegExpNode*
 RegExpText::ToNode(RegExpCompiler* compiler, RegExpNode* on_success)
 {
-    return compiler->alloc()->newInfallible<TextNode>(&elements_, compiler->read_backward(), on_success);
+    return compiler->alloc()->newInfallible<TextNode>(&elements_, on_success);
 }

 RegExpNode*
 RegExpCharacterClass::ToNode(RegExpCompiler* compiler, RegExpNode* on_success)
 {
-    return compiler->alloc()->newInfallible<TextNode>(this, compiler->read_backward(), on_success);
+    return compiler->alloc()->newInfallible<TextNode>(this, on_success);
 }

 RegExpNode*
@ -2011,8 +2003,7 @@ RegExpQuantifier::ToNode(int min,
                        alternation->AddAlternative(GuardedAlternative(body->ToNode(compiler, answer)));
                    }
                    answer = alternation;
-                    if (not_at_start && !compiler->read_backward())
-                        alternation->set_not_at_start();
+                    if (not_at_start) alternation->set_not_at_start();
                }
                return answer;
            }
@ -2024,9 +2015,8 @@ RegExpQuantifier::ToNode(int min,
    int reg_ctr = needs_counter
        ? compiler->AllocateRegister()
        : RegExpCompiler::kNoRegister;
-    LoopChoiceNode* center = alloc->newInfallible<LoopChoiceNode>(alloc, body->min_match() == 0,
-                                                                  compiler->read_backward());
-    if (not_at_start && !compiler->read_backward())
+    LoopChoiceNode* center = alloc->newInfallible<LoopChoiceNode>(alloc, body->min_match() == 0);
+    if (not_at_start)
        center->set_not_at_start();
    RegExpNode* loop_return = needs_counter
        ? static_cast<RegExpNode*>(ActionNode::IncrementRegister(reg_ctr, center))
@ -2102,7 +2092,7 @@ RegExpAssertion::ToNode(RegExpCompiler* compiler,
        CharacterRange::AddClassEscape(alloc, 'n', newline_ranges);
        RegExpCharacterClass* newline_atom = alloc->newInfallible<RegExpCharacterClass>('n');
        TextNode* newline_matcher =
-            alloc->newInfallible<TextNode>(newline_atom, false,
+            alloc->newInfallible<TextNode>(newline_atom,
                ActionNode::PositiveSubmatchSuccess(stack_pointer_register,
                                                    position_register,
                                                    0,  // No captures inside.
@ -2134,7 +2124,6 @@ RegExpBackReference::ToNode(RegExpCompiler* compiler, RegExpNode* on_success)
 {
    return compiler->alloc()->newInfallible<BackReferenceNode>(RegExpCapture::StartRegister(index()),
                                                               RegExpCapture::EndRegister(index()),
-                                                               compiler->read_backward(),
                                                               on_success);
 }

@ -2145,7 +2134,7 @@ RegExpEmpty::ToNode(RegExpCompiler* compiler, RegExpNode* on_success)
 }

 RegExpNode*
-RegExpLookaround::ToNode(RegExpCompiler* compiler, RegExpNode* on_success)
+RegExpLookahead::ToNode(RegExpCompiler* compiler, RegExpNode* on_success)
 {
    int stack_pointer_register = compiler->AllocateRegister();
    int position_register = compiler->AllocateRegister();
@ -2156,10 +2145,6 @@ RegExpLookaround::ToNode(RegExpCompiler* compiler, RegExpNode* on_success)
    int register_start =
        register_of_first_capture + capture_from_ * registers_per_capture;

-    RegExpNode* result;
-    bool was_reading_backward = compiler->read_backward();
-    compiler->set_read_backward(type() == LOOKBEHIND);
-
    if (is_positive()) {
        RegExpNode* bodyNode =
            body()->ToNode(compiler,
@ -2168,39 +2153,37 @@ RegExpLookaround::ToNode(RegExpCompiler* compiler, RegExpNode* on_success)
                                                               register_count,
                                                               register_start,
                                                               on_success));
-        result = ActionNode::BeginSubmatch(stack_pointer_register,
-                                           position_register,
-                                           bodyNode);
-    } else {
-        // We use a ChoiceNode for a negative lookahead because it has most of
-        // the characteristics we need. It has the body of the lookahead as its
-        // first alternative and the expression after the lookahead of the second
-        // alternative. If the first alternative succeeds then the
-        // NegativeSubmatchSuccess will unwind the stack including everything the
-        // choice node set up and backtrack. If the first alternative fails then
-        // the second alternative is tried, which is exactly the desired result
-        // for a negative lookahead. The NegativeLookaheadChoiceNode is a special
-        // ChoiceNode that knows to ignore the first exit when calculating quick
-        // checks.
-        LifoAlloc* alloc = compiler->alloc();
-
-        RegExpNode* success =
-            alloc->newInfallible<NegativeSubmatchSuccess>(alloc,
-                                                          stack_pointer_register,
-                                                          position_register,
-                                                          register_count,
-                                                          register_start);
-        GuardedAlternative body_alt(body()->ToNode(compiler, success));
-
-        ChoiceNode* choice_node =
-            alloc->newInfallible<NegativeLookaheadChoiceNode>(alloc, body_alt, GuardedAlternative(on_success));
-
-        result = ActionNode::BeginSubmatch(stack_pointer_register,
+        return ActionNode::BeginSubmatch(stack_pointer_register,
                                         position_register,
-                                         choice_node);
+                                         bodyNode);
    }
-    compiler->set_read_backward(was_reading_backward);
-    return result;
+
+    // We use a ChoiceNode for a negative lookahead because it has most of
+    // the characteristics we need.  It has the body of the lookahead as its
+    // first alternative and the expression after the lookahead of the second
+    // alternative.  If the first alternative succeeds then the
+    // NegativeSubmatchSuccess will unwind the stack including everything the
+    // choice node set up and backtrack.  If the first alternative fails then
+    // the second alternative is tried, which is exactly the desired result
+    // for a negative lookahead.  The NegativeLookaheadChoiceNode is a special
+    // ChoiceNode that knows to ignore the first exit when calculating quick
+    // checks.
+    LifoAlloc* alloc = compiler->alloc();
+
+    RegExpNode* success =
+        alloc->newInfallible<NegativeSubmatchSuccess>(alloc,
+                                                      stack_pointer_register,
+                                                      position_register,
+                                                      register_count,
+                                                      register_start);
+    GuardedAlternative body_alt(body()->ToNode(compiler, success));
+
+    ChoiceNode* choice_node =
+        alloc->newInfallible<NegativeLookaheadChoiceNode>(alloc, body_alt, GuardedAlternative(on_success));
+
+    return ActionNode::BeginSubmatch(stack_pointer_register,
+                                     position_register,
+                                     choice_node);
 }

 RegExpNode*
@ -2215,14 +2198,8 @@ RegExpCapture::ToNode(RegExpTree* body,
                      RegExpCompiler* compiler,
                      RegExpNode* on_success)
 {
-    MOZ_ASSERT(body);
    int start_reg = RegExpCapture::StartRegister(index);
    int end_reg = RegExpCapture::EndRegister(index);
-    if (compiler->read_backward()) {
-        // std::swap(start_reg, end_reg);
-        start_reg = RegExpCapture::EndRegister(index);
-        end_reg = RegExpCapture::StartRegister(index);
-    }
    RegExpNode* store_end = ActionNode::StorePosition(end_reg, true, on_success);
    RegExpNode* body_node = body->ToNode(compiler, store_end);
    return ActionNode::StorePosition(start_reg, true, body_node);
@ -2233,15 +2210,8 @@ RegExpAlternative::ToNode(RegExpCompiler* compiler, RegExpNode* on_success)
 {
    const RegExpTreeVector& children = nodes();
    RegExpNode* current = on_success;
-    if (compiler->read_backward()) {
-        for (int i = 0; i < children.length(); i++) {
-            current = children[i]->ToNode(compiler, current);
-        }
-    } else {
-        for (int i = children.length() - 1; i >= 0; i--) {
-            current = children[i]->ToNode(compiler, current);
-        }
-    }
+    for (int i = children.length() - 1; i >= 0; i--)
+        current = children[i]->ToNode(compiler, current);
    return current;
 }

@ -2794,6 +2764,7 @@ Trace::InvalidateCurrentCharacter()
 void
 Trace::AdvanceCurrentPositionInTrace(int by, RegExpCompiler* compiler)
 {
+    MOZ_ASSERT(by > 0);
    // We don't have an instruction for shifting the current character register
    // down or for using a shifted value for anything so lets just forget that
    // we preloaded any characters into it.
@ -3138,9 +3109,9 @@ AssertionNode::Emit(RegExpCompiler* compiler, Trace* trace)
            return;
        }
        if (trace->at_start() == Trace::UNKNOWN) {
-            assembler->CheckNotAtStart(trace->cp_offset(), trace->backtrack());
+            assembler->CheckNotAtStart(trace->backtrack());
            Trace at_start_trace = *trace;
-            at_start_trace.set_at_start(Trace::TRUE_VALUE);
+            at_start_trace.set_at_start(true);
            on_success()->Emit(compiler, &at_start_trace);
            return;
        }
@ -3843,10 +3814,9 @@ TextNode::TextEmitPass(RegExpCompiler* compiler,
    jit::Label* backtrack = trace->backtrack();
    QuickCheckDetails* quick_check = trace->quick_check_performed();
    int element_count = elements().length();
-    int backward_offset = read_backward() ? -Length() : 0;
    for (int i = preloaded ? 0 : element_count - 1; i >= 0; i--) {
        TextElement elm = elements()[i];
-        int cp_offset = trace->cp_offset() + elm.cp_offset() + backward_offset;
+        int cp_offset = trace->cp_offset() + elm.cp_offset();
        if (elm.text_type() == TextElement::ATOM) {
            const CharacterVector& quarks = elm.atom()->data();
            for (int j = preloaded ? 0 : quarks.length() - 1; j >= 0; j--) {
@ -3874,12 +3844,11 @@ TextNode::TextEmitPass(RegExpCompiler* compiler,
                    break;
                }
                if (emit_function != nullptr) {
-                    bool bounds_check = *checked_up_to < cp_offset + j || read_backward();
                    bool bound_checked = emit_function(compiler,
                                                       quarks[j],
                                                       backtrack,
                                                       cp_offset + j,
-                                                       bounds_check,
+                                                       *checked_up_to < cp_offset + j,
                                                       preloaded);
                    if (bound_checked) UpdateBoundsCheck(cp_offset + j, checked_up_to);
                }
@ -3890,14 +3859,13 @@ TextNode::TextEmitPass(RegExpCompiler* compiler,
                if (first_element_checked && i == 0) continue;
                if (DeterminedAlready(quick_check, elm.cp_offset())) continue;
                RegExpCharacterClass* cc = elm.char_class();
-                bool bounds_check = *checked_up_to < cp_offset || read_backward();
                EmitCharClass(alloc(),
                              assembler,
                              cc,
                              ascii,
                              backtrack,
                              cp_offset,
-                              bounds_check,
+                              *checked_up_to < cp_offset,
                              preloaded);
                UpdateBoundsCheck(cp_offset, checked_up_to);
            }
@ -3977,11 +3945,8 @@ TextNode::Emit(RegExpCompiler* compiler, Trace* trace)
    }

    Trace successor_trace(*trace);
-    // If we advance backward, we may end up at the start.
-    successor_trace.AdvanceCurrentPositionInTrace(
-        read_backward() ? -Length() : Length(), compiler);
-    successor_trace.set_at_start(read_backward() ? Trace::UNKNOWN
-                                                 : Trace::FALSE_VALUE);
+    successor_trace.set_at_start(false);
+    successor_trace.AdvanceCurrentPositionInTrace(Length(), compiler);
    RecursionCheck rc(compiler);
    on_success()->Emit(compiler, &successor_trace);
 }
@ -4153,8 +4118,6 @@ ChoiceNode::CalculatePreloadCharacters(RegExpCompiler* compiler, int eats_at_lea
 RegExpNode*
 TextNode::GetSuccessorOfOmnivorousTextNode(RegExpCompiler* compiler)
 {
-    if (read_backward()) return NULL;
-
    if (elements().length() != 1)
        return nullptr;

@ -4202,7 +4165,7 @@ ChoiceNode::GreedyLoopTextLengthForAlternative(GuardedAlternative* alternative)
        SeqRegExpNode* seq_node = static_cast<SeqRegExpNode*>(node);
        node = seq_node->on_success();
    }
-    return read_backward() ? -length : length;
+    return length;
 }

 // Creates a list of AlternativeGenerations.  If the list has a reasonable
@ -4277,7 +4240,7 @@ ChoiceNode::Emit(RegExpCompiler* compiler, Trace* trace)
    jit::Label greedy_loop_label;
    Trace counter_backtrack_trace;
    counter_backtrack_trace.set_backtrack(&greedy_loop_label);
-    if (not_at_start()) counter_backtrack_trace.set_at_start(Trace::FALSE_VALUE);
+    if (not_at_start()) counter_backtrack_trace.set_at_start(false);

    if (choice_count > 1 && text_length != kNodeIsTooComplexForGreedyLoops) {
        // Here we have special handling for greedy loops containing only text nodes
@ -4293,7 +4256,7 @@ ChoiceNode::Emit(RegExpCompiler* compiler, Trace* trace)
        current_trace = &counter_backtrack_trace;
        jit::Label greedy_match_failed;
        Trace greedy_match_trace;
-        if (not_at_start()) greedy_match_trace.set_at_start(Trace::FALSE_VALUE);
+        if (not_at_start()) greedy_match_trace.set_at_start(false);
        greedy_match_trace.set_backtrack(&greedy_match_failed);
        jit::Label loop_label;
        macro_assembler->Bind(&loop_label);
@ -4642,14 +4605,11 @@ BackReferenceNode::Emit(RegExpCompiler* compiler, Trace* trace)
    MOZ_ASSERT(start_reg_ + 1 == end_reg_);
    if (compiler->ignore_case()) {
        assembler->CheckNotBackReferenceIgnoreCase(start_reg_,
-                                                   read_backward(),
                                                   trace->backtrack(),
                                                   compiler->unicode());
    } else {
-        assembler->CheckNotBackReference(start_reg_, read_backward(), trace->backtrack());
+        assembler->CheckNotBackReference(start_reg_, trace->backtrack());
    }
-    // We are going to advance backward, so we may end up at the start.
-    if (read_backward()) trace->set_at_start(Trace::UNKNOWN);
    on_success()->Emit(compiler, trace);
 }

@ -5017,6 +4977,7 @@ QuickCheckDetails::Clear()
 void
 QuickCheckDetails::Advance(int by, bool ascii)
 {
+    MOZ_ASSERT(by >= 0);
    if (by >= characters_) {
        Clear();
        return;
--- a/js/src/irregexp/RegExpEngine.h
+++ b/js/src/irregexp/RegExpEngine.h
@ -119,7 +119,7 @@ InterpretCode(JSContext* cx, const uint8_t* byteCode, const CharT* chars, size_t
  VISIT(Atom)                                                        \
  VISIT(Quantifier)                                                  \
  VISIT(Capture)                                                     \
-  VISIT(Lookaround)                                                  \
+  VISIT(Lookahead)                                                   \
  VISIT(BackReference)                                               \
  VISIT(Empty)                                                       \
  VISIT(Text)
@ -763,19 +763,15 @@ class TextNode : public SeqRegExpNode
 {
  public:
    TextNode(TextElementVector* elements,
-             bool read_backward,
             RegExpNode* on_success)
      : SeqRegExpNode(on_success),
-        elements_(elements),
-        read_backward_(read_backward)
+        elements_(elements)
    {}

    TextNode(RegExpCharacterClass* that,
-             bool read_backward,
             RegExpNode* on_success)
      : SeqRegExpNode(on_success),
-        elements_(alloc()->newInfallible<TextElementVector>(*alloc())),
-        read_backward_(read_backward)
+        elements_(alloc()->newInfallible<TextElementVector>(*alloc()))
    {
        elements_->append(TextElement::CharClass(that));
    }
@ -788,7 +784,6 @@ class TextNode : public SeqRegExpNode
                                      int characters_filled_in,
                                      bool not_at_start);
    TextElementVector& elements() { return *elements_; }
-    bool read_backward() { return read_backward_; }
    void MakeCaseIndependent(bool is_ascii, bool unicode);
    virtual int GreedyLoopTextLength();
    virtual RegExpNode* GetSuccessorOfOmnivorousTextNode(
@ -819,7 +814,6 @@ class TextNode : public SeqRegExpNode
                      int* checked_up_to);
    int Length();
    TextElementVector* elements_;
-    bool read_backward_;
 };

 class AssertionNode : public SeqRegExpNode
@ -888,18 +882,15 @@ class BackReferenceNode : public SeqRegExpNode
  public:
    BackReferenceNode(int start_reg,
                      int end_reg,
-                      bool read_backward,
                      RegExpNode* on_success)
      : SeqRegExpNode(on_success),
        start_reg_(start_reg),
-        end_reg_(end_reg),
-        read_backward_(read_backward)
+        end_reg_(end_reg)
    {}

    virtual void Accept(NodeVisitor* visitor);
    int start_register() { return start_reg_; }
    int end_register() { return end_reg_; }
-    bool read_backward() { return read_backward_; }
    virtual void Emit(RegExpCompiler* compiler, Trace* trace);
    virtual int EatsAtLeast(int still_to_find,
                            int recursion_depth,
@ -918,7 +909,6 @@ class BackReferenceNode : public SeqRegExpNode
  private:
    int start_reg_;
    int end_reg_;
-    bool read_backward_;
 };

 class EndNode : public RegExpNode
@ -1063,7 +1053,6 @@ class ChoiceNode : public RegExpNode
    void set_being_calculated(bool b) { being_calculated_ = b; }
    virtual bool try_to_emit_quick_check_for_alternative(int i) { return true; }
    virtual RegExpNode* FilterASCII(int depth, bool ignore_case, bool unicode);
-    virtual bool read_backward() { return false; }

  protected:
    int GreedyLoopTextLengthForAlternative(GuardedAlternative* alternative);
@ -1122,13 +1111,11 @@ class NegativeLookaheadChoiceNode : public ChoiceNode
 class LoopChoiceNode : public ChoiceNode
 {
  public:
-    explicit LoopChoiceNode(LifoAlloc* alloc, bool body_can_be_zero_length,
-                            bool read_backward)
+    explicit LoopChoiceNode(LifoAlloc* alloc, bool body_can_be_zero_length)
      : ChoiceNode(alloc, 2),
        loop_node_(nullptr),
        continue_node_(nullptr),
-        body_can_be_zero_length_(body_can_be_zero_length),
-        read_backward_(read_backward)
+        body_can_be_zero_length_(body_can_be_zero_length)
    {}

    void AddLoopAlternative(GuardedAlternative alt);
@ -1146,7 +1133,6 @@ class LoopChoiceNode : public ChoiceNode
    RegExpNode* loop_node() { return loop_node_; }
    RegExpNode* continue_node() { return continue_node_; }
    bool body_can_be_zero_length() { return body_can_be_zero_length_; }
-    virtual bool read_backward() { return read_backward_; }
    virtual void Accept(NodeVisitor* visitor);
    virtual RegExpNode* FilterASCII(int depth, bool ignore_case, bool unicode);

@ -1161,7 +1147,6 @@ class LoopChoiceNode : public ChoiceNode
    RegExpNode* loop_node_;
    RegExpNode* continue_node_;
    bool body_can_be_zero_length_;
-    bool read_backward_;
 };

 // Improve the speed that we scan for an initial point where a non-anchored
@ -1437,8 +1422,8 @@ class Trace
    }

    TriBool at_start() { return at_start_; }
-    void set_at_start(TriBool at_start) {
-        at_start_ = at_start;
+    void set_at_start(bool at_start) {
+        at_start_ = at_start ? TRUE_VALUE : FALSE_VALUE;
    }
    jit::Label* backtrack() { return backtrack_; }
    jit::Label* loop_label() { return loop_label_; }
--- a/js/src/irregexp/RegExpInterpreter.cpp
+++ b/js/src/irregexp/RegExpInterpreter.cpp
@ -222,8 +222,8 @@ irregexp::InterpretCode(JSContext* cx, const uint8_t* byteCode, const CharT* cha
            }
            break;
          BYTECODE(LOAD_CURRENT_CHAR) {
-            int pos = current + (insn >> BYTECODE_SHIFT);
-            if (pos >= (int)length || pos < 0) {
+            size_t pos = current + (insn >> BYTECODE_SHIFT);
+            if (pos >= length) {
                pc = byteCode + Load32Aligned(pc + 4);
            } else {
                current_char = chars[pos];
@ -238,8 +238,8 @@ irregexp::InterpretCode(JSContext* cx, const uint8_t* byteCode, const CharT* cha
            break;
          }
          BYTECODE(LOAD_2_CURRENT_CHARS) {
-            int pos = current + (insn >> BYTECODE_SHIFT);
-            if (pos + 2 > (int)length || pos < 0) {
+            size_t pos = current + (insn >> BYTECODE_SHIFT);
+            if (pos + 2 > length) {
                pc = byteCode + Load32Aligned(pc + 4);
            } else {
                CharT next = chars[pos + 1];
@ -425,30 +425,6 @@ irregexp::InterpretCode(JSContext* cx, const uint8_t* byteCode, const CharT* cha
            pc += BC_CHECK_NOT_BACK_REF_LENGTH;
            break;
          }
-          BYTECODE(CHECK_NOT_BACK_REF_BACKWARD) {
-            int from = registers[insn >> BYTECODE_SHIFT];
-            int len = registers[(insn >> BYTECODE_SHIFT) + 1] - from;
-            if (from < 0 || len <= 0) {
-                pc += BC_CHECK_NOT_BACK_REF_BACKWARD_LENGTH;
-                break;
-            }
-            if (int(current) - len < 0) {
-                pc = byteCode + Load32Aligned(pc + 4);
-                break;
-            } else {
-                int i;
-                for (i = 0; i < len; i++) {
-                    if (chars[from + i] != chars[int(current) - len + i]) {
-                        pc = byteCode + Load32Aligned(pc + 4);
-                        break;
-                    }
-                }
-                if (i < len) break;
-                current -= len;
-            }
-            pc += BC_CHECK_NOT_BACK_REF_BACKWARD_LENGTH;
-            break;
-          }
          BYTECODE(CHECK_NOT_BACK_REF_NO_CASE) {
            int from = registers[insn >> BYTECODE_SHIFT];
            int len = registers[(insn >> BYTECODE_SHIFT) + 1] - from;
@ -489,46 +465,6 @@ irregexp::InterpretCode(JSContext* cx, const uint8_t* byteCode, const CharT* cha
            }
            break;
          }
-          BYTECODE(CHECK_NOT_BACK_REF_NO_CASE_BACKWARD) {
-            int from = registers[insn >> BYTECODE_SHIFT];
-            int len = registers[(insn >> BYTECODE_SHIFT) + 1] - from;
-            if (from < 0 || len <= 0) {
-                pc += BC_CHECK_NOT_BACK_REF_NO_CASE_BACKWARD_LENGTH;
-                break;
-            }
-            if (int(current) - len < 0) {
-                pc = byteCode + Load32Aligned(pc + 4);
-                break;
-            }
-            if (CaseInsensitiveCompareStrings(chars + from, chars + int(current) - len, len * sizeof(CharT))) {
-                current -= len;
-                pc += BC_CHECK_NOT_BACK_REF_NO_CASE_BACKWARD_LENGTH;
-            } else {
-                pc = byteCode + Load32Aligned(pc + 4);
-            }
-            break;
-
-          }
-          BYTECODE(CHECK_NOT_BACK_REF_NO_CASE_BACKWARD_UNICODE) {
-            int from = registers[insn >> BYTECODE_SHIFT];
-            int len = registers[(insn >> BYTECODE_SHIFT) + 1] - from;
-            if (from < 0 || len <= 0) {
-                pc += BC_CHECK_NOT_BACK_REF_NO_CASE_BACKWARD_LENGTH;
-                break;
-            }
-            if (int(current) - len < 0) {
-                pc = byteCode + Load32Aligned(pc + 4);
-                break;
-            }
-            if (CaseInsensitiveCompareUCStrings(chars + from, chars + int(current) - len, len * sizeof(CharT))) {
-                current -= len;
-                pc += BC_CHECK_NOT_BACK_REF_NO_CASE_BACKWARD_LENGTH;
-            } else {
-                pc = byteCode + Load32Aligned(pc + 4);
-            }
-            break;
-
-          }
          BYTECODE(CHECK_AT_START)
            if (current == 0)
                pc = byteCode + Load32Aligned(pc + 4);
@ -536,7 +472,7 @@ irregexp::InterpretCode(JSContext* cx, const uint8_t* byteCode, const CharT* cha
                pc += BC_CHECK_AT_START_LENGTH;
            break;
          BYTECODE(CHECK_NOT_AT_START)
-            if (current + (insn >> BYTECODE_SHIFT) == 0)
+            if (current == 0)
                pc += BC_CHECK_NOT_AT_START_LENGTH;
            else
                pc = byteCode + Load32Aligned(pc + 4);
--- a/js/src/irregexp/RegExpMacroAssembler.cpp
+++ b/js/src/irregexp/RegExpMacroAssembler.cpp
@ -226,37 +226,32 @@ InterpretedRegExpMacroAssembler::CheckGreedyLoop(jit::Label* on_tos_equals_curre
 }

 void
-InterpretedRegExpMacroAssembler::CheckNotAtStart(int cp_offset, jit::Label* on_not_at_start)
+InterpretedRegExpMacroAssembler::CheckNotAtStart(jit::Label* on_not_at_start)
 {
-    Emit(BC_CHECK_NOT_AT_START, cp_offset);
+    Emit(BC_CHECK_NOT_AT_START, 0);
    EmitOrLink(on_not_at_start);
 }

 void
-InterpretedRegExpMacroAssembler::CheckNotBackReference(int start_reg, bool read_backward,
-                                                       jit::Label* on_no_match)
+InterpretedRegExpMacroAssembler::CheckNotBackReference(int start_reg, jit::Label* on_no_match)
 {
    MOZ_ASSERT(start_reg >= 0);
    MOZ_ASSERT(start_reg <= kMaxRegister);
-    Emit(read_backward ? BC_CHECK_NOT_BACK_REF_BACKWARD : BC_CHECK_NOT_BACK_REF,
-         start_reg);
+    Emit(BC_CHECK_NOT_BACK_REF, start_reg);
    EmitOrLink(on_no_match);
 }

 void
 InterpretedRegExpMacroAssembler::CheckNotBackReferenceIgnoreCase(int start_reg,
-                                                                 bool read_backward,
                                                                 jit::Label* on_no_match,
                                                                 bool unicode)
 {
    MOZ_ASSERT(start_reg >= 0);
    MOZ_ASSERT(start_reg <= kMaxRegister);
    if (unicode)
-        Emit(read_backward ? BC_CHECK_NOT_BACK_REF_NO_CASE_BACKWARD_UNICODE : BC_CHECK_NOT_BACK_REF_NO_CASE_UNICODE,
-             start_reg);
+        Emit(BC_CHECK_NOT_BACK_REF_NO_CASE_UNICODE, start_reg);
    else
-        Emit(read_backward ? BC_CHECK_NOT_BACK_REF_NO_CASE_BACKWARD : BC_CHECK_NOT_BACK_REF_NO_CASE,
-             start_reg);
+        Emit(BC_CHECK_NOT_BACK_REF_NO_CASE, start_reg);
    EmitOrLink(on_no_match);
 }

--- a/js/src/irregexp/RegExpMacroAssembler.h
+++ b/js/src/irregexp/RegExpMacroAssembler.h
@ -110,10 +110,10 @@ class MOZ_STACK_CLASS RegExpMacroAssembler
    virtual void CheckCharacterGT(char16_t limit, jit::Label* on_greater) = 0;
    virtual void CheckCharacterLT(char16_t limit, jit::Label* on_less) = 0;
    virtual void CheckGreedyLoop(jit::Label* on_tos_equals_current_position) = 0;
-    virtual void CheckNotAtStart(int cp_offset, jit::Label* on_not_at_start) = 0;
-    virtual void CheckNotBackReference(int start_reg, bool read_backward, jit::Label* on_no_match) = 0;
-    virtual void CheckNotBackReferenceIgnoreCase(int start_reg, bool read_backward,
-                                                 jit::Label* on_no_match, bool unicode) = 0;
+    virtual void CheckNotAtStart(jit::Label* on_not_at_start) = 0;
+    virtual void CheckNotBackReference(int start_reg, jit::Label* on_no_match) = 0;
+    virtual void CheckNotBackReferenceIgnoreCase(int start_reg, jit::Label* on_no_match,
+                                                 bool unicode) = 0;

    // Check the current character for a match with a literal character.  If we
    // fail to match then goto the on_failure label.  End of input always
@ -245,10 +245,9 @@ class MOZ_STACK_CLASS InterpretedRegExpMacroAssembler final : public RegExpMacro
    void CheckCharacterGT(char16_t limit, jit::Label* on_greater);
    void CheckCharacterLT(char16_t limit, jit::Label* on_less);
    void CheckGreedyLoop(jit::Label* on_tos_equals_current_position);
-    void CheckNotAtStart(int cp_offset, jit::Label* on_not_at_start);
-    void CheckNotBackReference(int start_reg, bool read_backward, jit::Label* on_no_match);
-    void CheckNotBackReferenceIgnoreCase(int start_reg, bool read_backward,
-                                         jit::Label* on_no_match, bool unicode);
+    void CheckNotAtStart(jit::Label* on_not_at_start);
+    void CheckNotBackReference(int start_reg, jit::Label* on_no_match);
+    void CheckNotBackReferenceIgnoreCase(int start_reg, jit::Label* on_no_match, bool unicode);
    void CheckNotCharacter(unsigned c, jit::Label* on_not_equal);
    void CheckNotCharacterAfterAnd(unsigned c, unsigned and_with, jit::Label* on_not_equal);
    void CheckNotCharacterAfterMinusAnd(char16_t c, char16_t minus, char16_t and_with,
--- a/js/src/irregexp/RegExpParser.cpp
+++ b/js/src/irregexp/RegExpParser.cpp
@ -227,7 +227,6 @@ RegExpParser<CharT>::RegExpParser(frontend::TokenStream& ts, LifoAlloc* alloc,
    alloc(alloc),
    captures_(nullptr),
    next_pos_(chars),
-    captures_started_(0),
    end_(end),
    current_(kEndMarker),
    capture_count_(0),
@ -420,8 +419,7 @@ RangeAtom(LifoAlloc* alloc, char16_t from, char16_t to)
 static inline RegExpTree*
 NegativeLookahead(LifoAlloc* alloc, char16_t from, char16_t to)
 {
-    return alloc->newInfallible<RegExpLookaround>(RangeAtom(alloc, from, to), false,
-                                                  0, 0, RegExpLookaround::LOOKAHEAD);
+    return alloc->newInfallible<RegExpLookahead>(RangeAtom(alloc, from, to), false, 0, 0);
 }

 static bool
@ -1216,38 +1214,6 @@ RegExpParser<CharT>::ParseBackReferenceIndex(int* index_out)
    return true;
 }

-template <typename CharT>
-RegExpCapture*
-RegExpParser<CharT>::GetCapture(int index) {
-  // The index for the capture groups are one-based. Its index in the list is
-  // zero-based.
-  int known_captures =
-      is_scanned_for_captures_ ? capture_count_ : captures_started_;
-  MOZ_ASSERT(index <= known_captures);
-  if (captures_ == NULL) {
-    captures_ = alloc->newInfallible<RegExpCaptureVector>(*alloc);
-  }
-  while ((int)captures_->length() < known_captures) {
-    RegExpCapture* capture = alloc->newInfallible<RegExpCapture>(nullptr, captures_->length() + 1);
-    captures_->append(capture);
-  }
-  return (*captures_)[index - 1];
-}
-
-
-template <typename CharT>
-bool
-RegExpParser<CharT>::RegExpParserState::IsInsideCaptureGroup(int index) {
-  for (RegExpParserState* s = this; s != NULL; s = s->previous_state()) {
-    if (s->group_type() != CAPTURE) continue;
-    // Return true if we found the matching capture index.
-    if (index == s->capture_index()) return true;
-    // Abort if index is larger than what has been parsed up till this state.
-    if (index > s->capture_index()) return false;
-  }
-  return false;
-}
-
 // QuantifierPrefix ::
 //   { DecimalDigits }
 //   { DecimalDigits , }
@ -1490,24 +1456,24 @@ RegExpTree*
 RegExpParser<CharT>::ParseDisjunction()
 {
    // Used to store current state while parsing subexpressions.
-    RegExpParserState initial_state(alloc, nullptr, INITIAL, RegExpLookaround::LOOKAHEAD, 0);
-    RegExpParserState* state = &initial_state;
+    RegExpParserState initial_state(alloc, nullptr, INITIAL, 0);
+    RegExpParserState* stored_state = &initial_state;
    // Cache the builder in a local variable for quick access.
    RegExpBuilder* builder = initial_state.builder();
    while (true) {
        switch (current()) {
          case kEndMarker:
-            if (state->IsSubexpression()) {
+            if (stored_state->IsSubexpression()) {
                // Inside a parenthesized group when hitting end of input.
                return ReportError(JSMSG_MISSING_PAREN);
            }
-            MOZ_ASSERT(INITIAL == state->group_type());
+            MOZ_ASSERT(INITIAL == stored_state->group_type());
            // Parsing completed successfully.
            return builder->ToRegExp();
          case ')': {
-            if (!state->IsSubexpression())
+            if (!stored_state->IsSubexpression())
                return ReportError(JSMSG_UNMATCHED_RIGHT_PAREN);
-            MOZ_ASSERT(INITIAL != state->group_type());
+            MOZ_ASSERT(INITIAL != stored_state->group_type());

            Advance();
            // End disjunction parsing and convert builder content to new single
@ -1516,30 +1482,29 @@ RegExpParser<CharT>::ParseDisjunction()

            int end_capture_index = captures_started();

-            int capture_index = state->capture_index();
-            SubexpressionType group_type = state->group_type();
+            int capture_index = stored_state->capture_index();
+            SubexpressionType group_type = stored_state->group_type();
+
+            // Restore previous state.
+            stored_state = stored_state->previous_state();
+            builder = stored_state->builder();

            // Build result of subexpression.
            if (group_type == CAPTURE) {
-                RegExpCapture* capture = GetCapture(capture_index);
-                capture->set_body(body);
+                RegExpCapture* capture = alloc->newInfallible<RegExpCapture>(body, capture_index);
+                (*captures_)[capture_index - 1] = capture;
                body = capture;
            } else if (group_type != GROUPING) {
-                MOZ_ASSERT(group_type == POSITIVE_LOOKAROUND ||
-                           group_type == NEGATIVE_LOOKAROUND);
-                bool is_positive = (group_type == POSITIVE_LOOKAROUND);
-                body = alloc->newInfallible<RegExpLookaround>(body,
+                MOZ_ASSERT(group_type == POSITIVE_LOOKAHEAD ||
+                           group_type == NEGATIVE_LOOKAHEAD);
+                bool is_positive = (group_type == POSITIVE_LOOKAHEAD);
+                body = alloc->newInfallible<RegExpLookahead>(body,
                                                   is_positive,
                                                   end_capture_index - capture_index,
-                                                   capture_index,
-                                                   state->lookaround_type());
+                                                   capture_index);
            }
-
-            // Restore previous state.
-            state = state->previous_state();
-            builder = state->builder();
            builder->AddAtom(body);
-            if (unicode_ && (group_type == POSITIVE_LOOKAROUND || group_type == NEGATIVE_LOOKAROUND))
+            if (unicode_ && (group_type == POSITIVE_LOOKAHEAD || group_type == NEGATIVE_LOOKAHEAD))
                continue;
            // For compatability with JSC and ES3, we allow quantifiers after
            // lookaheads, and break in all cases.
@ -1599,7 +1564,6 @@ RegExpParser<CharT>::ParseDisjunction()
          }
          case '(': {
            SubexpressionType subexpr_type = CAPTURE;
-            RegExpLookaround::Type lookaround_type = state->lookaround_type();
            Advance();
            if (current() == '?') {
                switch (Next()) {
@ -1607,39 +1571,26 @@ RegExpParser<CharT>::ParseDisjunction()
                    subexpr_type = GROUPING;
                    break;
                  case '=':
-                    lookaround_type = RegExpLookaround::LOOKAHEAD;
-                    subexpr_type = POSITIVE_LOOKAROUND;
+                    subexpr_type = POSITIVE_LOOKAHEAD;
                    break;
                  case '!':
-                    lookaround_type = RegExpLookaround::LOOKAHEAD;
-                    subexpr_type = NEGATIVE_LOOKAROUND;
+                    subexpr_type = NEGATIVE_LOOKAHEAD;
                    break;
-                  case '<':
-                    Advance();
-                    lookaround_type = RegExpLookaround::LOOKBEHIND;
-                    if (Next() == '=') {
-                      subexpr_type = POSITIVE_LOOKAROUND;
-                      break;
-                    } else if (Next() == '!') {
-                      subexpr_type = NEGATIVE_LOOKAROUND;
-                      break;
-                    }
-                    // We didn't get a positive or negative after '<'.
-                    // That's an error.
-                    return ReportError(JSMSG_INVALID_GROUP);
                  default:
                    return ReportError(JSMSG_INVALID_GROUP);
                }
                Advance(2);
            } else {
+                if (captures_ == nullptr)
+                    captures_ = alloc->newInfallible<RegExpCaptureVector>(*alloc);
                if (captures_started() >= kMaxCaptures)
                    return ReportError(JSMSG_TOO_MANY_PARENS);
-                captures_started_++;
+                captures_->append((RegExpCapture*) nullptr);
            }
            // Store current state and begin new disjunction parsing.
-            state = alloc->newInfallible<RegExpParserState>(alloc, state, subexpr_type,
-                                                            lookaround_type, captures_started_);
-            builder = state->builder();
+            stored_state = alloc->newInfallible<RegExpParserState>(alloc, stored_state, subexpr_type,
+                                                                   captures_started());
+            builder = stored_state->builder();
            continue;
          }
          case '[': {
@ -1694,18 +1645,19 @@ RegExpParser<CharT>::ParseDisjunction()
              case '7': case '8': case '9': {
                int index = 0;
                if (ParseBackReferenceIndex(&index)) {
-                    if (state->IsInsideCaptureGroup(index)) {
-                      // The backreference is inside the capture group it refers to.
-                      // Nothing can possibly have been captured yet.
-                      builder->AddEmpty();
-                    } else {
-                      RegExpCapture* capture = GetCapture(index);
-                      RegExpTree* atom = alloc->newInfallible<RegExpBackReference>(capture);
-                      if (unicode_)
-                          builder->AddAtom(UnicodeBackReferenceAtom(alloc, atom));
-                      else
-                          builder->AddAtom(atom);
+                    RegExpCapture* capture = nullptr;
+                    if (captures_ != nullptr && index <= (int) captures_->length()) {
+                        capture = (*captures_)[index - 1];
                    }
+                    if (capture == nullptr) {
+                        builder->AddEmpty();
+                        break;
+                    }
+                    RegExpTree* atom = alloc->newInfallible<RegExpBackReference>(capture);
+                    if (unicode_)
+                        builder->AddAtom(UnicodeBackReferenceAtom(alloc, atom));
+                    else
+                        builder->AddAtom(atom);
                    break;
                }
                if (unicode_)
--- a/js/src/irregexp/RegExpParser.h
+++ b/js/src/irregexp/RegExpParser.h
@ -229,7 +229,7 @@ class RegExpParser
    bool simple() { return simple_; }
    bool contains_anchor() { return contains_anchor_; }
    void set_contains_anchor() { contains_anchor_ = true; }
-    int captures_started() { return captures_started_; }
+    int captures_started() { return captures_ == nullptr ? 0 : captures_->length(); }
    const CharT* position() { return next_pos_ - 1; }

    static const int kMaxCaptures = 1 << 16;
@ -239,8 +239,8 @@ class RegExpParser
    enum SubexpressionType {
        INITIAL,
        CAPTURE,  // All positive values represent captures.
-        POSITIVE_LOOKAROUND,
-        NEGATIVE_LOOKAROUND,
+        POSITIVE_LOOKAHEAD,
+        NEGATIVE_LOOKAHEAD,
        GROUPING
    };

@ -249,12 +249,10 @@ class RegExpParser
        RegExpParserState(LifoAlloc* alloc,
                          RegExpParserState* previous_state,
                          SubexpressionType group_type,
-                          RegExpLookaround::Type lookaround_type,
                          int disjunction_capture_index)
            : previous_state_(previous_state),
              builder_(alloc->newInfallible<RegExpBuilder>(alloc)),
              group_type_(group_type),
-              lookaround_type_(lookaround_type),
              disjunction_capture_index_(disjunction_capture_index)
        {}
        // Parser state of containing expression, if any.
@ -264,16 +262,11 @@ class RegExpParser
        RegExpBuilder* builder() { return builder_; }
        // Type of regexp being parsed (parenthesized group or entire regexp).
        SubexpressionType group_type() { return group_type_; }
-        // Lookahead or Lookbehind.
-        RegExpLookaround::Type lookaround_type() { return lookaround_type_; }
        // Index in captures array of first capture in this sub-expression, if any.
        // Also the capture index of this sub-expression itself, if group_type
        // is CAPTURE.
        int capture_index() { return disjunction_capture_index_; }

-        // Check whether the parser is inside a capture group with the given index.
-        bool IsInsideCaptureGroup(int index);
-
      private:
        // Linked list implementation of stack of states.
        RegExpParserState* previous_state_;
@ -281,15 +274,10 @@ class RegExpParser
        RegExpBuilder* builder_;
        // Stored disjunction type (capture, look-ahead or grouping), if any.
        SubexpressionType group_type_;
-        // Stored read direction.
-        RegExpLookaround::Type lookaround_type_;
        // Stored disjunction's capture index (if any).
        int disjunction_capture_index_;
    };

-    // Return the 1-indexed RegExpCapture object, allocate if necessary.
-    RegExpCapture* GetCapture(int index);
-
    widechar current() { return current_; }
    bool has_more() { return has_more_; }
    bool has_next() { return next_pos_ < end_; }
@ -306,7 +294,6 @@ class RegExpParser
    const CharT* next_pos_;
    const CharT* end_;
    widechar current_;
-    int captures_started_;
    // The capture count is only valid after we have scanned for captures.
    int capture_count_;
    bool has_more_;
--- a/mailnews/base/prefs/content/aw-incoming.js
+++ b/mailnews/base/prefs/content/aw-incoming.js
@ -158,7 +158,10 @@ function setServerType()
  var serverType = document.getElementById("servertype").value;
  var deferStorageBox = document.getElementById("deferStorageBox");
  var leaveMessages = document.getElementById("leaveMsgsOnSrvrBox");
-  var port = serverType == "pop3" ? 110 : 143;
+
+  // pop3 110 (unsecure) 995 (SSL)
+  // imap 143 (unsecure) 993 (SSL)
+  var port = serverType == "pop3" ? 995 : 993;

  document.getElementById("serverPort").value = port;
  document.getElementById("defaultPortValue").value = port;
--- a/mailnews/mailnews.js
+++ b/mailnews/mailnews.js
@ -450,7 +450,7 @@ pref("mail.server.default.valid", true);
 pref("mail.server.default.abbreviate", true);
 pref("mail.server.default.isSecure", false);
 pref("mail.server.default.authMethod", 3); // cleartext password. @see nsIMsgIncomingServer.authMethod.
-pref("mail.server.default.socketType", 0); // @see nsIMsgIncomingServer.socketType
+pref("mail.server.default.socketType", 3); // SSL/TLS. @see nsIMsgIncomingServer.socketType
 pref("mail.server.default.override_namespaces", true);
 pref("mail.server.default.deferred_to_account", "");

@ -579,7 +579,7 @@ pref("mail.smtp.useMatchingDomainServer", false);
 pref("mail.smtp.useMatchingHostNameServer", false);

 pref("mail.smtpserver.default.authMethod", 3); // cleartext password. @see nsIMsgIncomingServer.authMethod.
-pref("mail.smtpserver.default.try_ssl", 0); // @see nsISmtpServer.socketType
+pref("mail.smtpserver.default.try_ssl", 3); // SSL/TLS. @see nsISmtpServer.socketType

 // For the next 3 prefs, see <http://www.bucksch.org/1/projects/mozilla/16507>
 pref("mail.display_glyph", true);   // TXT->HTML :-) etc. in viewer
--- a/modules/libpref/Preferences.cpp
+++ b/modules/libpref/Preferences.cpp
@ -1229,10 +1229,10 @@ static nsresult pref_InitInitialObjects()
  nsresult rv;

  // In omni.jar case, we load the following prefs:
-  // - jar:$gre/omni.jar!/greprefs.js
+  // - jar:$gre/omni.jar!/goanna.js
  // - jar:$gre/omni.jar!/defaults/pref/*.js
  // In non omni.jar case, we load:
-  // - $gre/greprefs.js
+  // - $gre/goanna.js
  //
  // In both cases, we also load:
  // - $gre/defaults/pref/*.js
@ -1259,8 +1259,8 @@ static nsresult pref_InitInitialObjects()

  RefPtr<nsZipArchive> jarReader = mozilla::Omnijar::GetReader(mozilla::Omnijar::GRE);
  if (jarReader) {
-    // Load jar:$gre/omni.jar!/greprefs.js
-    rv = pref_ReadPrefFromJar(jarReader, "greprefs.js");
+    // Load jar:$gre/omni.jar!/goanna.js
+    rv = pref_ReadPrefFromJar(jarReader, "goanna.js");
    NS_ENSURE_SUCCESS(rv, rv);

    // Load jar:$gre/omni.jar!/defaults/pref/*.js
@ -1279,12 +1279,12 @@ static nsresult pref_InitInitialObjects()
        NS_WARNING("Error parsing preferences.");
    }
  } else {
-    // Load $gre/greprefs.js
+    // Load $gre/goanna.js
    nsCOMPtr<nsIFile> greprefsFile;
    rv = NS_GetSpecialDirectory(NS_GRE_DIR, getter_AddRefs(greprefsFile));
    NS_ENSURE_SUCCESS(rv, rv);

-    rv = greprefsFile->AppendNative(NS_LITERAL_CSTRING("greprefs.js"));
+    rv = greprefsFile->AppendNative(NS_LITERAL_CSTRING("goanna.js"));
    NS_ENSURE_SUCCESS(rv, rv);

    rv = openPrefFile(greprefsFile);
--- a/modules/libpref/greprefs.js
+++ b/modules/libpref/greprefs.js
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@ -1166,7 +1166,6 @@ pref("dom.disable_window_open_feature.menubar",     false);
 pref("dom.disable_window_open_feature.resizable",   true);
 pref("dom.disable_window_open_feature.minimizable", false);
 pref("dom.disable_window_open_feature.status",      true);
-pref("dom.disable_window_showModalDialog",          true);

 pref("dom.allow_scripts_to_close_windows",          false);

--- a/modules/libpref/moz.build
+++ b/modules/libpref/moz.build
@ -43,6 +43,4 @@ FINAL_LIBRARY = 'xul'
 DEFINES['OS_ARCH'] = CONFIG['OS_ARCH']
 DEFINES['MOZ_WIDGET_TOOLKIT'] = CONFIG['MOZ_WIDGET_TOOLKIT']

-FINAL_TARGET_PP_FILES += [
-    'greprefs.js',
-]
+FINAL_TARGET_PP_FILES += ['goanna.js']
--- a/netwerk/protocol/http/Http2Stream.cpp
+++ b/netwerk/protocol/http/Http2Stream.cpp
@ -1478,8 +1478,12 @@ bool
 Http2Stream::Do0RTT()
 {
  MOZ_ASSERT(mTransaction);
-  mAttempting0RTT = true;
-  return mTransaction->Do0RTT();
+  if (mTransaction->Do0RTT()) {
+    mAttempting0RTT = true;
+  } else {
+    mAttempting0RTT = false;
+  }
+  return mAttempting0RTT;
 }

 nsresult
--- a/old-configure.in
+++ b/old-configure.in
@ -2014,44 +2014,6 @@ esac

 MOZ_CONFIG_NSPR()

-dnl ========================================================
-dnl system libevent Support
-dnl ========================================================
-MOZ_ARG_WITH_STRING(system-libevent,
-[  --with-system-libevent[=PFX]
-                          Use system libevent [installed at prefix PFX]],
-    LIBEVENT_DIR=$withval)
-
-_SAVE_CFLAGS=$CFLAGS
-_SAVE_LDFLAGS=$LDFLAGS
-_SAVE_LIBS=$LIBS
-if test "$LIBEVENT_DIR" = yes; then
-    PKG_CHECK_MODULES(MOZ_LIBEVENT, libevent,
-        MOZ_SYSTEM_LIBEVENT=1,
-        LIBEVENT_DIR=/usr)
-fi
-if test -z "$LIBEVENT_DIR" -o "$LIBEVENT_DIR" = no; then
-    MOZ_SYSTEM_LIBEVENT=
-elif test -z "$MOZ_SYSTEM_LIBEVENT"; then
-    CFLAGS="-I${LIBEVENT_DIR}/include $CFLAGS"
-    LDFLAGS="-L${LIBEVENT_DIR}/lib $LDFLAGS"
-    MOZ_CHECK_HEADER(event.h,
-        [if test ! -f "${LIBEVENT_DIR}/include/event.h"; then
-             AC_MSG_ERROR([event.h found, but is not in ${LIBEVENT_DIR}/include])
-         fi],
-        AC_MSG_ERROR([--with-system-libevent requested but event.h not found]))
-    AC_CHECK_LIB(event, event_init,
-                 [MOZ_SYSTEM_LIBEVENT=1
-                  MOZ_LIBEVENT_CFLAGS="-I${LIBEVENT_DIR}/include"
-                  MOZ_LIBEVENT_LIBS="-L${LIBEVENT_DIR}/lib -levent"],
-                 [MOZ_SYSTEM_LIBEVENT= MOZ_LIBEVENT_CFLAGS= MOZ_LIBEVENT_LIBS=])
-fi
-CFLAGS=$_SAVE_CFLAGS
-LDFLAGS=$_SAVE_LDFLAGS
-LIBS=$_SAVE_LIBS
-
-AC_SUBST(MOZ_SYSTEM_LIBEVENT)
-
 dnl ========================================================
 dnl = If NSS was not detected in the system,
 dnl = use the one in the source tree (mozilla/security/nss)
@ -5710,7 +5672,6 @@ MC_BASILISK=$MC_BASILISK
 MC_PALEMOON=$MC_PALEMOON
 MOZ_EME=$MOZ_EME
 MOZ_WEBRTC=$MOZ_WEBRTC
-MOZ_SYSTEM_LIBEVENT=$MOZ_SYSTEM_LIBEVENT
 MOZ_SYSTEM_NSS=$MOZ_SYSTEM_NSS
 MOZ_SYSTEM_NSPR=$MOZ_SYSTEM_NSPR
 MOZ_SYSTEM_JPEG=$MOZ_SYSTEM_JPEG
--- a/python/mozbuild/mozpack/packager/formats.py
+++ b/python/mozbuild/mozpack/packager/formats.py
@ -318,7 +318,7 @@ class OmniJarSubFormatter(PiecemealFormatter):
                     path[1] in ['pref', 'preferences'])
        return path[0] in [
            'modules',
-            'greprefs.js',
+            'goanna.js',
            'hyphenation',
            'update.locale',
        ] or path[0] in STARTUP_CACHE_PATHS
--- a/python/mozbuild/mozpack/test/test_packager_formats.py
+++ b/python/mozbuild/mozpack/test/test_packager_formats.py
@ -405,13 +405,13 @@ class TestFormatters(unittest.TestCase):
            self.assertFalse(
                is_resource(base, 'defaults/preferences/channel-prefs.js'))
            self.assertTrue(is_resource(base, 'modules/foo.jsm'))
-            self.assertTrue(is_resource(base, 'greprefs.js'))
+            self.assertTrue(is_resource(base, 'goanna.js'))
            self.assertTrue(is_resource(base, 'hyphenation/foo'))
            self.assertTrue(is_resource(base, 'update.locale'))
            self.assertTrue(
                is_resource(base, 'jsloader/resource/gre/modules/foo.jsm'))
            self.assertFalse(is_resource(base, 'foo'))
-            self.assertFalse(is_resource(base, 'foo/bar/greprefs.js'))
+            self.assertFalse(is_resource(base, 'foo/bar/goanna.js'))
            self.assertTrue(is_resource(base, 'defaults/messenger/foo.dat'))
            self.assertFalse(
                is_resource(base, 'defaults/messenger/mailViews.dat'))
--- a/security/nss/lib/nss/nss.h
+++ b/security/nss/lib/nss/nss.h
@ -25,7 +25,7 @@
 #define NSS_VERSION "3.48" _NSS_CUSTOMIZED
 #define NSS_VMAJOR 3
 #define NSS_VMINOR 48
-#define NSS_VPATCH 0
+#define NSS_VPATCH 1
 #define NSS_VBUILD 0
 #define NSS_BETA PR_FALSE

--- a/security/nss/lib/softoken/lowpbe.c
+++ b/security/nss/lib/softoken/lowpbe.c
@ -554,50 +554,160 @@ loser:
    return A;
 }

+struct KDFCacheItemStr {
+    SECItem *hash;
+    SECItem *salt;
+    SECItem *pwItem;
+    HASH_HashType hashType;
+    int iterations;
+    int keyLen;
+};
+typedef struct KDFCacheItemStr KDFCacheItem;
+
 /* Bug 1606992 - Cache the hash result for the common case that we're
 * asked to repeatedly compute the key for the same password item,
 * hash, iterations and salt. */
-static PZLock *PBE_cache_lock = NULL;
-static SECItem *cached_PBKDF2_item = NULL;
-static HASH_HashType cached_hashType;
-static int cached_iterations;
-static int cached_keyLen;
-static SECItem *cached_salt = NULL;
-static SECItem *cached_pwitem = NULL;
+static struct {
+    PZLock *lock;
+    struct {
+        KDFCacheItem common;
+        int ivLen;
+        PRBool faulty3DES;
+    } cacheKDF1;
+    struct {
+        KDFCacheItem common;
+    } cacheKDF2;
+} PBECache;

 void
 sftk_PBELockInit(void)
 {
-    if (!PBE_cache_lock) {
-        PBE_cache_lock = PZ_NewLock(nssIPBECacheLock);
+    if (!PBECache.lock) {
+        PBECache.lock = PZ_NewLock(nssIPBECacheLock);
    }
 }

 static void
-sftk_clearPBECacheItems(void)
+sftk_clearPBECommonCacheItemsLocked(KDFCacheItem *item)
 {
-    if (cached_PBKDF2_item) {
-        SECITEM_FreeItem(cached_PBKDF2_item, PR_TRUE);
-        cached_PBKDF2_item = NULL;
+    if (item->hash) {
+        SECITEM_ZfreeItem(item->hash, PR_TRUE);
+        item->hash = NULL;
    }
-    if (cached_salt) {
-        SECITEM_FreeItem(cached_salt, PR_TRUE);
-        cached_salt = NULL;
+    if (item->salt) {
+        SECITEM_FreeItem(item->salt, PR_TRUE);
+        item->salt = NULL;
    }
-    if (cached_pwitem) {
-        SECITEM_FreeItem(cached_pwitem, PR_TRUE);
-        cached_pwitem = NULL;
+    if (item->pwItem) {
+        SECITEM_ZfreeItem(item->pwItem, PR_TRUE);
+        item->pwItem = NULL;
    }
 }

+sftk_setPBECommonCacheItemsKDFLocked(KDFCacheItem *cacheItem,
+                                     const SECItem *hash,
+                                     const NSSPKCS5PBEParameter *pbe_param,
+                                     const SECItem *pwItem)
+{
+    cacheItem->hash = SECITEM_DupItem(hash);
+    cacheItem->hashType = pbe_param->hashType;
+    cacheItem->iterations = pbe_param->iter;
+    cacheItem->keyLen = pbe_param->keyLen;
+    cacheItem->salt = SECITEM_DupItem(&pbe_param->salt);
+    cacheItem->pwItem = SECITEM_DupItem(pwItem);
+}
+
+static void
+sftk_setPBECacheKDF2(const SECItem *hash,
+                     const NSSPKCS5PBEParameter *pbe_param,
+                     const SECItem *pwItem)
+{
+    PZ_Lock(PBECache.lock);
+    sftk_clearPBECommonCacheItemsLocked(&PBECache.cacheKDF2.common);
+    sftk_setPBECommonCacheItemsKDFLocked(&PBECache.cacheKDF2.common,
+                                         hash, pbe_param, pwItem);
+
+    PZ_Unlock(PBECache.lock);
+} 
+
+static void
+sftk_setPBECacheKDF1(const SECItem *hash,
+                     const NSSPKCS5PBEParameter *pbe_param,
+                     const SECItem *pwItem,
+                     PRBool faulty3DES)
+{
+    PZ_Lock(PBECache.lock);
+
+    sftk_clearPBECommonCacheItemsLocked(&PBECache.cacheKDF1.common);
+
+    sftk_setPBECommonCacheItemsKDFLocked(&PBECache.cacheKDF1.common,
+                                         hash, pbe_param, pwItem);
+    PBECache.cacheKDF1.faulty3DES = faulty3DES;
+    PBECache.cacheKDF1.ivLen = pbe_param->ivLen;
+
+    PZ_Unlock(PBECache.lock);
+}
+
+static PRBool
+sftk_comparePBECommonCacheItemLocked(const KDFCacheItem *cacheItem,
+                                     const NSSPKCS5PBEParameter *pbe_param,
+                                     const SECItem *pwItem)
+{
+    return (cacheItem->hash &&
+            cacheItem->salt &&
+            cacheItem->pwItem &&
+            pbe_param->hashType == cacheItem->hashType &&
+            pbe_param->iter == cacheItem->iterations &&
+            pbe_param->keyLen == cacheItem->keyLen &&
+            SECITEM_ItemsAreEqual(&pbe_param->salt, cacheItem->salt) &&
+            SECITEM_ItemsAreEqual(pwItem, cacheItem->pwItem));
+}
+
+static SECItem *
+sftk_getPBECacheKDF2(const NSSPKCS5PBEParameter *pbe_param,
+                     const SECItem *pwItem)
+{
+    SECItem *result = NULL;
+    const KDFCacheItem *cacheItem = &PBECache.cacheKDF2.common;
+
+    PZ_Lock(PBECache.lock);
+    if (sftk_comparePBECommonCacheItemLocked(cacheItem, pbe_param, pwItem)) {
+        result = SECITEM_DupItem(cacheItem->hash);
+    }
+    PZ_Unlock(PBECache.lock);
+
+    return result;
+}
+
+static SECItem *
+sftk_getPBECacheKDF1(const NSSPKCS5PBEParameter *pbe_param,
+                     const SECItem *pwItem,
+                     PRBool faulty3DES)
+{
+    SECItem *result = NULL;
+    const KDFCacheItem *cacheItem = &PBECache.cacheKDF1.common;
+
+    PZ_Lock(PBECache.lock);
+    if (sftk_comparePBECommonCacheItemLocked(cacheItem, pbe_param, pwItem) &&
+        PBECache.cacheKDF1.faulty3DES == faulty3DES &&
+        PBECache.cacheKDF1.ivLen == pbe_param->ivLen) {
+        result = SECITEM_DupItem(cacheItem->hash);
+    }
+    PZ_Unlock(PBECache.lock);
+
+    return result;
+}
+
+
 void
 sftk_PBELockShutdown(void)
 {
-    if (PBE_cache_lock) {
-        PZ_DestroyLock(PBE_cache_lock);
-        PBE_cache_lock = 0;
+    if (PBECache.lock) {
+        PZ_DestroyLock(PBECache.lock);
+        PBECache.lock = 0;
    }
-    sftk_clearPBECacheItems();
+    sftk_clearPBECommonCacheItemsLocked(&PBECache.cacheKDF1.common);
+    sftk_clearPBECommonCacheItemsLocked(&PBECache.cacheKDF2.common);
 }

 /*
@ -632,7 +742,11 @@ nsspkcs5_ComputeKeyAndIV(NSSPKCS5PBEParameter *pbe_param, SECItem *pwitem,
    hashObj = HASH_GetRawHashObject(pbe_param->hashType);
    switch (pbe_param->pbeType) {
        case NSSPKCS5_PBKDF1:
-            hash = nsspkcs5_PBKDF1Extended(hashObj, pbe_param, pwitem, faulty3DES);
+            hash = sftk_getPBECacheKDF1(pbe_param, pwitem, faulty3DES);
+            if (!hash) {
+                hash = nsspkcs5_PBKDF1Extended(hashObj, pbe_param, pwitem, faulty3DES);
+                sftk_setPBECacheKDF1(hash, pbe_param, pwitem, faulty3DES);
+            }
            if (hash == NULL) {
                goto loser;
            }
@ -643,34 +757,10 @@ nsspkcs5_ComputeKeyAndIV(NSSPKCS5PBEParameter *pbe_param, SECItem *pwitem,

            break;
        case NSSPKCS5_PBKDF2:
-            PZ_Lock(PBE_cache_lock);
-            if (cached_PBKDF2_item) {
-                if (pbe_param->hashType == cached_hashType &&
-                    pbe_param->iter == cached_iterations &&
-                    pbe_param->keyLen == cached_keyLen &&
-                    cached_salt &&
-                    SECITEM_ItemsAreEqual(&pbe_param->salt, cached_salt) &&
-                    cached_pwitem &&
-                    SECITEM_ItemsAreEqual(pwitem, cached_pwitem)) {
-                    hash = SECITEM_DupItem(cached_PBKDF2_item);
-                } else {
-                    sftk_clearPBECacheItems();
-                }
-            }
-            PZ_Unlock(PBE_cache_lock);
+            hash = sftk_getPBECacheKDF2(pbe_param, pwitem);
            if (!hash) {
                hash = nsspkcs5_PBKDF2(hashObj, pbe_param, pwitem);
-                PZ_Lock(PBE_cache_lock);
-                /* ensure no other thread was quicker than us setting the cache */
-                if (!cached_PBKDF2_item) {
-                    cached_PBKDF2_item = SECITEM_DupItem(hash);
-                    cached_hashType = pbe_param->hashType;
-                    cached_iterations = pbe_param->iter;
-                    cached_keyLen = pbe_param->keyLen;
-                    cached_salt = SECITEM_DupItem(&pbe_param->salt);
-                    cached_pwitem = SECITEM_DupItem(pwitem);
-                }
-                PZ_Unlock(PBE_cache_lock);
+                sftk_setPBECacheKDF2(hash, pbe_param, pwitem);
            }
            if (getIV) {
                PORT_Memcpy(iv->data, pbe_param->ivData, iv->len);
--- a/security/nss/lib/softoken/softkver.h
+++ b/security/nss/lib/softoken/softkver.h
@ -20,7 +20,7 @@
 #define SOFTOKEN_VERSION "3.48" SOFTOKEN_ECC_STRING
 #define SOFTOKEN_VMAJOR 3
 #define SOFTOKEN_VMINOR 48
-#define SOFTOKEN_VPATCH 0
+#define SOFTOKEN_VPATCH 1
 #define SOFTOKEN_VBUILD 0
 #define SOFTOKEN_BETA PR_FALSE

--- a/security/nss/lib/util/nssutil.h
+++ b/security/nss/lib/util/nssutil.h
@ -22,7 +22,7 @@
 #define NSSUTIL_VERSION "3.48"
 #define NSSUTIL_VMAJOR 3
 #define NSSUTIL_VMINOR 48
-#define NSSUTIL_VPATCH 0
+#define NSSUTIL_VPATCH 1
 #define NSSUTIL_VBUILD 0
 #define NSSUTIL_BETA PR_FALSE

--- a/storage/moz.build
+++ b/storage/moz.build
@ -88,17 +88,10 @@ FINAL_LIBRARY = 'xul'
 # Don't use the jemalloc allocator on Android, because we can't guarantee
 # that Gecko will configure sqlite before it is first used (bug 730495).
 #
-# Don't use the jemalloc allocator when using system sqlite. Linked in libraries
-# (such as NSS) might trigger an initialization of sqlite and allocation
-# of memory using the default allocator, prior to the storage service
-# registering its allocator, causing memory management failures (bug 938730).
-# However, this is not an issue if both the jemalloc allocator and the default
-# allocator are the same thing.
-#
 # Note: On Windows our sqlite build assumes we use jemalloc.  If you disable
 # MOZ_STORAGE_MEMORY on Windows, you will also need to change the "ifdef
 # MOZ_MEMORY" options in db/sqlite3/src/Makefile.in.
-if CONFIG['MOZ_MEMORY'] and not CONFIG['MOZ_SYSTEM_SQLITE']:
+if CONFIG['MOZ_MEMORY']:
    if CONFIG['OS_TARGET'] != 'Android':
        DEFINES['MOZ_STORAGE_MEMORY'] = True

--- a/toolkit/library/moz.build
+++ b/toolkit/library/moz.build
@ -201,9 +201,6 @@ if CONFIG['MOZ_SYSTEM_PNG']:
 if CONFIG['MOZ_SYSTEM_HUNSPELL']:
    OS_LIBS += CONFIG['MOZ_HUNSPELL_LIBS']

-if CONFIG['MOZ_SYSTEM_LIBEVENT']:
-    OS_LIBS += CONFIG['MOZ_LIBEVENT_LIBS']
-
 if CONFIG['MOZ_SYSTEM_LIBVPX']:
    OS_LIBS += CONFIG['MOZ_LIBVPX_LIBS']

--- a/toolkit/mozapps/update/tests/data/xpcshellUtilsAUS.js
+++ b/toolkit/mozapps/update/tests/data/xpcshellUtilsAUS.js
@ -839,7 +839,7 @@ function setupTestCommon() {
  if (!grePrefsFile.exists()) {
    grePrefsFile.create(Ci.nsIFile.DIRECTORY_TYPE, PERMS_DIRECTORY);
  }
-  grePrefsFile.append("greprefs.js");
+  grePrefsFile.append("goanna.js");
  if (!grePrefsFile.exists()) {
    grePrefsFile.create(Ci.nsILocalFile.NORMAL_FILE_TYPE, PERMS_FILE);
  }