--- xulrunner-1.9.0.19.orig/configure
+++ xulrunner-1.9.0.19/configure
@@ -279,6 +279,11 @@
 ac_help="$ac_help
   --enable-js-ultrasparc  Use UltraSPARC optimizations in JS"
 ac_help="$ac_help
+  --enable-js-binary      Build the standalone JS program"
+ac_help="$ac_help
+  --with-readline[=PFX]
+                              Use libreadline [installed at prefix PFX]"
+ac_help="$ac_help
   --enable-debug[=DBG]    Enable building with developer debug info
                           (Using compiler flags DBG)"
 ac_help="$ac_help
@@ -998,7 +1003,7 @@
 fi
 
 echo $ac_n "checking host system type""... $ac_c" 1>&6
-echo "configure:1002: checking host system type" >&5
+echo "configure:1007: checking host system type" >&5
 
 host_alias=$host
 case "$host_alias" in
@@ -1019,7 +1024,7 @@
 echo "$ac_t""$host" 1>&6
 
 echo $ac_n "checking target system type""... $ac_c" 1>&6
-echo "configure:1023: checking target system type" >&5
+echo "configure:1028: checking target system type" >&5
 
 target_alias=$target
 case "$target_alias" in
@@ -1037,7 +1042,7 @@
 echo "$ac_t""$target" 1>&6
 
 echo $ac_n "checking build system type""... $ac_c" 1>&6
-echo "configure:1041: checking build system type" >&5
+echo "configure:1046: checking build system type" >&5
 
 build_alias=$build
 case "$build_alias" in
@@ -1112,12 +1117,12 @@
 MSMANIFEST_TOOL=
 
 MISSING_X=
-for ac_prog in gawk mawk nawk awk
+for ac_prog in mawk gawk nawk awk
 do
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:1121: checking for $ac_word" >&5
+echo "configure:1126: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_AWK'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -1258,13 +1263,13 @@
     _SAVE_LDFLAGS="$LDFLAGS"
 
     echo $ac_n "checking for host c compiler""... $ac_c" 1>&6
-echo "configure:1262: checking for host c compiler" >&5
+echo "configure:1267: checking for host c compiler" >&5
     for ac_prog in $HOST_CC gcc cc /usr/ucb/cc cl icc
 do
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:1268: checking for $ac_word" >&5
+echo "configure:1273: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_HOST_CC'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -1299,13 +1304,13 @@
     fi
     echo "$ac_t""$HOST_CC" 1>&6
     echo $ac_n "checking for host c++ compiler""... $ac_c" 1>&6
-echo "configure:1303: checking for host c++ compiler" >&5
+echo "configure:1308: checking for host c++ compiler" >&5
     for ac_prog in $HOST_CXX $CCC c++ g++ gcc CC cxx cc++ cl icc
 do
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:1309: checking for $ac_word" >&5
+echo "configure:1314: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_HOST_CXX'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -1354,7 +1359,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:1358: checking for $ac_word" >&5
+echo "configure:1363: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_HOST_RANLIB'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -1389,7 +1394,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:1393: checking for $ac_word" >&5
+echo "configure:1398: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_HOST_AR'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -1424,16 +1429,16 @@
     LDFLAGS="$HOST_LDFLAGS"
 
     echo $ac_n "checking whether the host c compiler ($HOST_CC $HOST_CFLAGS $HOST_LDFLAGS) works""... $ac_c" 1>&6
-echo "configure:1428: checking whether the host c compiler ($HOST_CC $HOST_CFLAGS $HOST_LDFLAGS) works" >&5
+echo "configure:1433: checking whether the host c compiler ($HOST_CC $HOST_CFLAGS $HOST_LDFLAGS) works" >&5
     cat > conftest.$ac_ext <<EOF
-#line 1430 "configure"
+#line 1435 "configure"
 #include "confdefs.h"
 
 int main() {
 return(0);
 ; return 0; }
 EOF
-if { (eval echo configure:1437: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:1442: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_prog_hostcc_works=1 echo "$ac_t""yes" 1>&6
 else
@@ -1448,16 +1453,16 @@
     CFLAGS="$HOST_CXXFLAGS"
 
     echo $ac_n "checking whether the host c++ compiler ($HOST_CXX $HOST_CXXFLAGS $HOST_LDFLAGS) works""... $ac_c" 1>&6
-echo "configure:1452: checking whether the host c++ compiler ($HOST_CXX $HOST_CXXFLAGS $HOST_LDFLAGS) works" >&5
+echo "configure:1457: checking whether the host c++ compiler ($HOST_CXX $HOST_CXXFLAGS $HOST_LDFLAGS) works" >&5
     cat > conftest.$ac_ext <<EOF
-#line 1454 "configure"
+#line 1459 "configure"
 #include "confdefs.h"
 
 int main() {
 return(0);
 ; return 0; }
 EOF
-if { (eval echo configure:1461: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:1466: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_prog_hostcxx_works=1 echo "$ac_t""yes" 1>&6
 else
@@ -1486,7 +1491,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:1490: checking for $ac_word" >&5
+echo "configure:1495: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_CC'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -1520,7 +1525,7 @@
     # Extract the first word of "gcc", so it can be a program name with args.
 set dummy gcc; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:1524: checking for $ac_word" >&5
+echo "configure:1529: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_CC'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -1550,7 +1555,7 @@
   # Extract the first word of "cc", so it can be a program name with args.
 set dummy cc; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:1554: checking for $ac_word" >&5
+echo "configure:1559: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_CC'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -1601,7 +1606,7 @@
       # Extract the first word of "cl", so it can be a program name with args.
 set dummy cl; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:1605: checking for $ac_word" >&5
+echo "configure:1610: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_CC'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -1633,7 +1638,7 @@
 fi
 
 echo $ac_n "checking whether the C compiler ($CC $CFLAGS $LDFLAGS) works""... $ac_c" 1>&6
-echo "configure:1637: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) works" >&5
+echo "configure:1642: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) works" >&5
 
 ac_ext=c
 # CFLAGS is not in ac_cpp because -g, -O, etc. are not valid cpp options.
@@ -1644,12 +1649,12 @@
 
 cat > conftest.$ac_ext << EOF
 
-#line 1648 "configure"
+#line 1653 "configure"
 #include "confdefs.h"
 
 main(){return(0);}
 EOF
-if { (eval echo configure:1653: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1658: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   ac_cv_prog_cc_works=yes
   # If we can't run a trivial program, we are probably using a cross compiler.
   if (./conftest; exit) 2>/dev/null; then
@@ -1675,12 +1680,12 @@
   { echo "configure: error: installation or configuration problem: C compiler cannot create executables." 1>&2; exit 1; }
 fi
 echo $ac_n "checking whether the C compiler ($CC $CFLAGS $LDFLAGS) is a cross-compiler""... $ac_c" 1>&6
-echo "configure:1679: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) is a cross-compiler" >&5
+echo "configure:1684: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) is a cross-compiler" >&5
 echo "$ac_t""$ac_cv_prog_cc_cross" 1>&6
 cross_compiling=$ac_cv_prog_cc_cross
 
 echo $ac_n "checking whether we are using GNU C""... $ac_c" 1>&6
-echo "configure:1684: checking whether we are using GNU C" >&5
+echo "configure:1689: checking whether we are using GNU C" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_gcc'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -1689,7 +1694,7 @@
   yes;
 #endif
 EOF
-if { ac_try='${CC-cc} -E conftest.c'; { (eval echo configure:1693: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }; } | egrep yes >/dev/null 2>&1; then
+if { ac_try='${CC-cc} -E conftest.c'; { (eval echo configure:1698: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }; } | egrep yes >/dev/null 2>&1; then
   ac_cv_prog_gcc=yes
 else
   ac_cv_prog_gcc=no
@@ -1708,7 +1713,7 @@
 ac_save_CFLAGS="$CFLAGS"
 CFLAGS=
 echo $ac_n "checking whether ${CC-cc} accepts -g""... $ac_c" 1>&6
-echo "configure:1712: checking whether ${CC-cc} accepts -g" >&5
+echo "configure:1717: checking whether ${CC-cc} accepts -g" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_cc_g'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -1744,7 +1749,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:1748: checking for $ac_word" >&5
+echo "configure:1753: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_CXX'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -1780,7 +1785,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:1784: checking for $ac_word" >&5
+echo "configure:1789: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_CXX'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -1812,7 +1817,7 @@
 
 
 echo $ac_n "checking whether the C++ compiler ($CXX $CXXFLAGS $LDFLAGS) works""... $ac_c" 1>&6
-echo "configure:1816: checking whether the C++ compiler ($CXX $CXXFLAGS $LDFLAGS) works" >&5
+echo "configure:1821: checking whether the C++ compiler ($CXX $CXXFLAGS $LDFLAGS) works" >&5
 
 ac_ext=C
 # CXXFLAGS is not in ac_cpp because -g, -O, etc. are not valid cpp options.
@@ -1823,12 +1828,12 @@
 
 cat > conftest.$ac_ext << EOF
 
-#line 1827 "configure"
+#line 1832 "configure"
 #include "confdefs.h"
 
 int main(){return(0);}
 EOF
-if { (eval echo configure:1832: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:1837: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   ac_cv_prog_cxx_works=yes
   # If we can't run a trivial program, we are probably using a cross compiler.
   if (./conftest; exit) 2>/dev/null; then
@@ -1854,12 +1859,12 @@
   { echo "configure: error: installation or configuration problem: C++ compiler cannot create executables." 1>&2; exit 1; }
 fi
 echo $ac_n "checking whether the C++ compiler ($CXX $CXXFLAGS $LDFLAGS) is a cross-compiler""... $ac_c" 1>&6
-echo "configure:1858: checking whether the C++ compiler ($CXX $CXXFLAGS $LDFLAGS) is a cross-compiler" >&5
+echo "configure:1863: checking whether the C++ compiler ($CXX $CXXFLAGS $LDFLAGS) is a cross-compiler" >&5
 echo "$ac_t""$ac_cv_prog_cxx_cross" 1>&6
 cross_compiling=$ac_cv_prog_cxx_cross
 
 echo $ac_n "checking whether we are using GNU C++""... $ac_c" 1>&6
-echo "configure:1863: checking whether we are using GNU C++" >&5
+echo "configure:1868: checking whether we are using GNU C++" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_gxx'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -1868,7 +1873,7 @@
   yes;
 #endif
 EOF
-if { ac_try='${CXX-g++} -E conftest.C'; { (eval echo configure:1872: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }; } | egrep yes >/dev/null 2>&1; then
+if { ac_try='${CXX-g++} -E conftest.C'; { (eval echo configure:1877: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }; } | egrep yes >/dev/null 2>&1; then
   ac_cv_prog_gxx=yes
 else
   ac_cv_prog_gxx=no
@@ -1887,7 +1892,7 @@
 ac_save_CXXFLAGS="$CXXFLAGS"
 CXXFLAGS=
 echo $ac_n "checking whether ${CXX-g++} accepts -g""... $ac_c" 1>&6
-echo "configure:1891: checking whether ${CXX-g++} accepts -g" >&5
+echo "configure:1896: checking whether ${CXX-g++} accepts -g" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_cxx_g'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -1918,57 +1923,6 @@
   fi
 fi
 
-for ac_declaration in \
-   ''\
-   '#include <stdlib.h>' \
-   'extern "C" void std::exit (int) throw (); using std::exit;' \
-   'extern "C" void std::exit (int); using std::exit;' \
-   'extern "C" void exit (int) throw ();' \
-   'extern "C" void exit (int);' \
-   'void exit (int);'
-do
-  cat > conftest.$ac_ext <<EOF
-#line 1932 "configure"
-#include "confdefs.h"
-#include <stdlib.h>
-$ac_declaration
-int main() {
-exit (42);
-; return 0; }
-EOF
-if { (eval echo configure:1940: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
-  :
-else
-  echo "configure: failed program was:" >&5
-  cat conftest.$ac_ext >&5
-  rm -rf conftest*
-  continue
-fi
-rm -f conftest*
-  cat > conftest.$ac_ext <<EOF
-#line 1950 "configure"
-#include "confdefs.h"
-$ac_declaration
-int main() {
-exit (42);
-; return 0; }
-EOF
-if { (eval echo configure:1957: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
-  rm -rf conftest*
-  break
-else
-  echo "configure: failed program was:" >&5
-  cat conftest.$ac_ext >&5
-fi
-rm -f conftest*
-done
-if test -n "$ac_declaration"; then
-  echo '#ifdef __cplusplus' >>confdefs.h
-  echo $ac_declaration      >>confdefs.h
-  echo '#endif'             >>confdefs.h
-fi
-
-
 
     case "$build:$target" in
       powerpc-apple-darwin8*:i?86-apple-darwin*)
@@ -1982,7 +1936,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:1986: checking for $ac_word" >&5
+echo "configure:1940: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_RANLIB'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2017,7 +1971,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:2021: checking for $ac_word" >&5
+echo "configure:1975: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_AR'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2052,7 +2006,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:2056: checking for $ac_word" >&5
+echo "configure:2010: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_AS'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2093,7 +2047,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:2097: checking for $ac_word" >&5
+echo "configure:2051: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_LD'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2128,7 +2082,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:2132: checking for $ac_word" >&5
+echo "configure:2086: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_STRIP'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2163,7 +2117,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:2167: checking for $ac_word" >&5
+echo "configure:2121: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_WINDRES'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2201,7 +2155,7 @@
     # Extract the first word of "gcc", so it can be a program name with args.
 set dummy gcc; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:2205: checking for $ac_word" >&5
+echo "configure:2159: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_CC'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2231,7 +2185,7 @@
   # Extract the first word of "cc", so it can be a program name with args.
 set dummy cc; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:2235: checking for $ac_word" >&5
+echo "configure:2189: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_CC'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2282,7 +2236,7 @@
       # Extract the first word of "cl", so it can be a program name with args.
 set dummy cl; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:2286: checking for $ac_word" >&5
+echo "configure:2240: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_CC'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2314,7 +2268,7 @@
 fi
 
 echo $ac_n "checking whether the C compiler ($CC $CFLAGS $LDFLAGS) works""... $ac_c" 1>&6
-echo "configure:2318: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) works" >&5
+echo "configure:2272: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) works" >&5
 
 ac_ext=c
 # CFLAGS is not in ac_cpp because -g, -O, etc. are not valid cpp options.
@@ -2325,12 +2279,12 @@
 
 cat > conftest.$ac_ext << EOF
 
-#line 2329 "configure"
+#line 2283 "configure"
 #include "confdefs.h"
 
 main(){return(0);}
 EOF
-if { (eval echo configure:2334: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:2288: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   ac_cv_prog_cc_works=yes
   # If we can't run a trivial program, we are probably using a cross compiler.
   if (./conftest; exit) 2>/dev/null; then
@@ -2356,12 +2310,12 @@
   { echo "configure: error: installation or configuration problem: C compiler cannot create executables." 1>&2; exit 1; }
 fi
 echo $ac_n "checking whether the C compiler ($CC $CFLAGS $LDFLAGS) is a cross-compiler""... $ac_c" 1>&6
-echo "configure:2360: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) is a cross-compiler" >&5
+echo "configure:2314: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) is a cross-compiler" >&5
 echo "$ac_t""$ac_cv_prog_cc_cross" 1>&6
 cross_compiling=$ac_cv_prog_cc_cross
 
 echo $ac_n "checking whether we are using GNU C""... $ac_c" 1>&6
-echo "configure:2365: checking whether we are using GNU C" >&5
+echo "configure:2319: checking whether we are using GNU C" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_gcc'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2370,7 +2324,7 @@
   yes;
 #endif
 EOF
-if { ac_try='${CC-cc} -E conftest.c'; { (eval echo configure:2374: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }; } | egrep yes >/dev/null 2>&1; then
+if { ac_try='${CC-cc} -E conftest.c'; { (eval echo configure:2328: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }; } | egrep yes >/dev/null 2>&1; then
   ac_cv_prog_gcc=yes
 else
   ac_cv_prog_gcc=no
@@ -2389,7 +2343,7 @@
 ac_save_CFLAGS="$CFLAGS"
 CFLAGS=
 echo $ac_n "checking whether ${CC-cc} accepts -g""... $ac_c" 1>&6
-echo "configure:2393: checking whether ${CC-cc} accepts -g" >&5
+echo "configure:2347: checking whether ${CC-cc} accepts -g" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_cc_g'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2425,7 +2379,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:2429: checking for $ac_word" >&5
+echo "configure:2383: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_CXX'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2457,7 +2411,7 @@
 
 
 echo $ac_n "checking whether the C++ compiler ($CXX $CXXFLAGS $LDFLAGS) works""... $ac_c" 1>&6
-echo "configure:2461: checking whether the C++ compiler ($CXX $CXXFLAGS $LDFLAGS) works" >&5
+echo "configure:2415: checking whether the C++ compiler ($CXX $CXXFLAGS $LDFLAGS) works" >&5
 
 ac_ext=C
 # CXXFLAGS is not in ac_cpp because -g, -O, etc. are not valid cpp options.
@@ -2468,12 +2422,12 @@
 
 cat > conftest.$ac_ext << EOF
 
-#line 2472 "configure"
+#line 2426 "configure"
 #include "confdefs.h"
 
 int main(){return(0);}
 EOF
-if { (eval echo configure:2477: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:2431: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   ac_cv_prog_cxx_works=yes
   # If we can't run a trivial program, we are probably using a cross compiler.
   if (./conftest; exit) 2>/dev/null; then
@@ -2499,12 +2453,12 @@
   { echo "configure: error: installation or configuration problem: C++ compiler cannot create executables." 1>&2; exit 1; }
 fi
 echo $ac_n "checking whether the C++ compiler ($CXX $CXXFLAGS $LDFLAGS) is a cross-compiler""... $ac_c" 1>&6
-echo "configure:2503: checking whether the C++ compiler ($CXX $CXXFLAGS $LDFLAGS) is a cross-compiler" >&5
+echo "configure:2457: checking whether the C++ compiler ($CXX $CXXFLAGS $LDFLAGS) is a cross-compiler" >&5
 echo "$ac_t""$ac_cv_prog_cxx_cross" 1>&6
 cross_compiling=$ac_cv_prog_cxx_cross
 
 echo $ac_n "checking whether we are using GNU C++""... $ac_c" 1>&6
-echo "configure:2508: checking whether we are using GNU C++" >&5
+echo "configure:2462: checking whether we are using GNU C++" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_gxx'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2513,7 +2467,7 @@
   yes;
 #endif
 EOF
-if { ac_try='${CXX-g++} -E conftest.C'; { (eval echo configure:2517: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }; } | egrep yes >/dev/null 2>&1; then
+if { ac_try='${CXX-g++} -E conftest.C'; { (eval echo configure:2471: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }; } | egrep yes >/dev/null 2>&1; then
   ac_cv_prog_gxx=yes
 else
   ac_cv_prog_gxx=no
@@ -2532,7 +2486,7 @@
 ac_save_CXXFLAGS="$CXXFLAGS"
 CXXFLAGS=
 echo $ac_n "checking whether ${CXX-g++} accepts -g""... $ac_c" 1>&6
-echo "configure:2536: checking whether ${CXX-g++} accepts -g" >&5
+echo "configure:2490: checking whether ${CXX-g++} accepts -g" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_cxx_g'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2563,61 +2517,10 @@
   fi
 fi
 
-for ac_declaration in \
-   ''\
-   '#include <stdlib.h>' \
-   'extern "C" void std::exit (int) throw (); using std::exit;' \
-   'extern "C" void std::exit (int); using std::exit;' \
-   'extern "C" void exit (int) throw ();' \
-   'extern "C" void exit (int);' \
-   'void exit (int);'
-do
-  cat > conftest.$ac_ext <<EOF
-#line 2577 "configure"
-#include "confdefs.h"
-#include <stdlib.h>
-$ac_declaration
-int main() {
-exit (42);
-; return 0; }
-EOF
-if { (eval echo configure:2585: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
-  :
-else
-  echo "configure: failed program was:" >&5
-  cat conftest.$ac_ext >&5
-  rm -rf conftest*
-  continue
-fi
-rm -f conftest*
-  cat > conftest.$ac_ext <<EOF
-#line 2595 "configure"
-#include "confdefs.h"
-$ac_declaration
-int main() {
-exit (42);
-; return 0; }
-EOF
-if { (eval echo configure:2602: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
-  rm -rf conftest*
-  break
-else
-  echo "configure: failed program was:" >&5
-  cat conftest.$ac_ext >&5
-fi
-rm -f conftest*
-done
-if test -n "$ac_declaration"; then
-  echo '#ifdef __cplusplus' >>confdefs.h
-  echo $ac_declaration      >>confdefs.h
-  echo '#endif'             >>confdefs.h
-fi
-
-
     # Extract the first word of "ranlib", so it can be a program name with args.
 set dummy ranlib; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:2621: checking for $ac_word" >&5
+echo "configure:2524: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_RANLIB'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2649,7 +2552,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:2653: checking for $ac_word" >&5
+echo "configure:2556: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_AS'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2690,7 +2593,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:2694: checking for $ac_word" >&5
+echo "configure:2597: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_AR'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2725,7 +2628,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:2729: checking for $ac_word" >&5
+echo "configure:2632: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_LD'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2760,7 +2663,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:2764: checking for $ac_word" >&5
+echo "configure:2667: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_STRIP'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2795,7 +2698,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:2799: checking for $ac_word" >&5
+echo "configure:2702: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_WINDRES'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2928,7 +2831,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:2932: checking for $ac_word" >&5
+echo "configure:2835: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_MIDL'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -2970,14 +2873,14 @@
 cross_compiling=$ac_cv_prog_cc_cross
 
         cat > conftest.$ac_ext <<EOF
-#line 2974 "configure"
+#line 2877 "configure"
 #include "confdefs.h"
 #include <stdio.h>
 int main() {
  printf("Hello World\n"); 
 ; return 0; }
 EOF
-if { (eval echo configure:2981: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:2884: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   :
 else
   echo "configure: failed program was:" >&5
@@ -2995,14 +2898,14 @@
 cross_compiling=$ac_cv_prog_cxx_cross
 
         cat > conftest.$ac_ext <<EOF
-#line 2999 "configure"
+#line 2902 "configure"
 #include "confdefs.h"
 #include <new.h>
 int main() {
  unsigned *test = new unsigned(42); 
 ; return 0; }
 EOF
-if { (eval echo configure:3006: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:2909: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   :
 else
   echo "configure: failed program was:" >&5
@@ -3118,7 +3021,7 @@
         _MIDL_REV_VERSION=`echo ${_MIDL_FULL_VERSION} | $AWK -F\. '{ print $3 }'`
          # Add flags if necessary
          echo $ac_n "checking for midl flags""... $ac_c" 1>&6
-echo "configure:3122: checking for midl flags" >&5
+echo "configure:3025: checking for midl flags" >&5
          if test \( "$_MIDL_MAJOR_VERSION" -gt "6" \) -o \( "$_MIDL_MAJOR_VERSION" = "6" -a "$_MIDL_MINOR_VERSION" -gt "0" \) -o \( "$_MIDL_MAJOR_VERSION" = "6" -a "$_MIDL_MINOR_VERSION" = "00" -a "$_MIDL_REV_VERSION" -gt "359" \); then
              # Starting with MIDL version 6.0.359, the MIDL compiler
              # generates /Oicf /robust stubs by default, which is not
@@ -3140,9 +3043,9 @@
         _W32API_MAJOR_VERSION=`echo $W32API_VERSION | $AWK -F\. '{ print $1 }'`
         _W32API_MINOR_VERSION=`echo $W32API_VERSION | $AWK -F\. '{ print $2 }'`
         echo $ac_n "checking for w32api version >= $W32API_VERSION""... $ac_c" 1>&6
-echo "configure:3144: checking for w32api version >= $W32API_VERSION" >&5
+echo "configure:3047: checking for w32api version >= $W32API_VERSION" >&5
         cat > conftest.$ac_ext <<EOF
-#line 3146 "configure"
+#line 3049 "configure"
 #include "confdefs.h"
 #include <w32api.h>
 int main() {
@@ -3154,7 +3057,7 @@
             
 ; return 0; }
 EOF
-if { (eval echo configure:3158: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:3061: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
    res=yes 
 else
@@ -3170,7 +3073,7 @@
         fi
         # Check windres version
         echo $ac_n "checking for windres version >= $WINDRES_VERSION""... $ac_c" 1>&6
-echo "configure:3174: checking for windres version >= $WINDRES_VERSION" >&5
+echo "configure:3077: checking for windres version >= $WINDRES_VERSION" >&5
         _WINDRES_VERSION=`${WINDRES} --version 2>&1 | grep -i windres 2>/dev/null | $AWK '{ print $3 }'`
         echo "$ac_t""$_WINDRES_VERSION" 1>&6
         _WINDRES_MAJOR_VERSION=`echo $_WINDRES_VERSION | $AWK -F\. '{ print $1 }'`
@@ -3209,10 +3112,10 @@
 if test "$CC" != "icc" -a -z "$_WIN32_MSVC"; then
     if test "x$CC" != xcc; then
   echo $ac_n "checking whether $CC and cc understand -c and -o together""... $ac_c" 1>&6
-echo "configure:3213: checking whether $CC and cc understand -c and -o together" >&5
+echo "configure:3116: checking whether $CC and cc understand -c and -o together" >&5
 else
   echo $ac_n "checking whether cc understands -c and -o together""... $ac_c" 1>&6
-echo "configure:3216: checking whether cc understands -c and -o together" >&5
+echo "configure:3119: checking whether cc understands -c and -o together" >&5
 fi
 set dummy $CC; ac_cc="`echo $2 |
 		       sed -e 's/[^a-zA-Z0-9_]/_/g' -e 's/^[0-9]/_/'`"
@@ -3224,16 +3127,16 @@
 # We do the test twice because some compilers refuse to overwrite an
 # existing .o file with -o, though they will create one.
 ac_try='${CC-cc} -c conftest.c -o conftest.o 1>&5'
-if { (eval echo configure:3228: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; } &&
-   test -f conftest.o && { (eval echo configure:3229: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; };
+if { (eval echo configure:3131: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; } &&
+   test -f conftest.o && { (eval echo configure:3132: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; };
 then
   eval ac_cv_prog_cc_${ac_cc}_c_o=yes
   if test "x$CC" != xcc; then
     # Test first that cc exists at all.
-    if { ac_try='cc -c conftest.c 1>&5'; { (eval echo configure:3234: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }; }; then
+    if { ac_try='cc -c conftest.c 1>&5'; { (eval echo configure:3137: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }; }; then
       ac_try='cc -c conftest.c -o conftest.o 1>&5'
-      if { (eval echo configure:3236: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; } &&
-	 test -f conftest.o && { (eval echo configure:3237: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; };
+      if { (eval echo configure:3139: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; } &&
+	 test -f conftest.o && { (eval echo configure:3140: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; };
       then
         # cc works too.
         :
@@ -3269,7 +3172,7 @@
 fi
 
 echo $ac_n "checking how to run the C preprocessor""... $ac_c" 1>&6
-echo "configure:3273: checking how to run the C preprocessor" >&5
+echo "configure:3176: checking how to run the C preprocessor" >&5
 # On Suns, sometimes $CPP names a directory.
 if test -n "$CPP" && test -d "$CPP"; then
   CPP=
@@ -3284,13 +3187,13 @@
   # On the NeXT, cc -E runs the code through the compiler's parser,
   # not just through cpp.
   cat > conftest.$ac_ext <<EOF
-#line 3288 "configure"
+#line 3191 "configure"
 #include "confdefs.h"
 #include <assert.h>
 Syntax Error
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:3294: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:3197: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   :
@@ -3301,13 +3204,13 @@
   rm -rf conftest*
   CPP="${CC-cc} -E -traditional-cpp"
   cat > conftest.$ac_ext <<EOF
-#line 3305 "configure"
+#line 3208 "configure"
 #include "confdefs.h"
 #include <assert.h>
 Syntax Error
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:3311: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:3214: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   :
@@ -3318,13 +3221,13 @@
   rm -rf conftest*
   CPP="${CC-cc} -nologo -E"
   cat > conftest.$ac_ext <<EOF
-#line 3322 "configure"
+#line 3225 "configure"
 #include "confdefs.h"
 #include <assert.h>
 Syntax Error
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:3328: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:3231: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   :
@@ -3349,7 +3252,7 @@
 echo "$ac_t""$CPP" 1>&6
 
 echo $ac_n "checking how to run the C++ preprocessor""... $ac_c" 1>&6
-echo "configure:3353: checking how to run the C++ preprocessor" >&5
+echo "configure:3256: checking how to run the C++ preprocessor" >&5
 if test -z "$CXXCPP"; then
 if eval "test \"`echo '$''{'ac_cv_prog_CXXCPP'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -3362,12 +3265,12 @@
 cross_compiling=$ac_cv_prog_cxx_cross
   CXXCPP="${CXX-g++} -E"
   cat > conftest.$ac_ext <<EOF
-#line 3366 "configure"
+#line 3269 "configure"
 #include "confdefs.h"
 #include <stdlib.h>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:3371: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:3274: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   :
@@ -3422,7 +3325,7 @@
 # SVR4 /usr/ucb/install, which tries to use the nonexistent group "staff"
 # ./install, which can be erroneously created by make from ./install.sh.
 echo $ac_n "checking for a BSD compatible install""... $ac_c" 1>&6
-echo "configure:3426: checking for a BSD compatible install" >&5
+echo "configure:3329: checking for a BSD compatible install" >&5
 if test -z "$INSTALL"; then
 if eval "test \"`echo '$''{'ac_cv_path_install'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -3475,7 +3378,7 @@
 test -z "$INSTALL_DATA" && INSTALL_DATA='${INSTALL} -m 644'
 
 echo $ac_n "checking whether ln -s works""... $ac_c" 1>&6
-echo "configure:3479: checking whether ln -s works" >&5
+echo "configure:3382: checking whether ln -s works" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_LN_S'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -3500,7 +3403,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:3504: checking for $ac_word" >&5
+echo "configure:3407: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_PERL'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -3541,7 +3444,7 @@
 
 if test -z "$TINDERBOX_SKIP_PERL_VERSION_CHECK"; then
 echo $ac_n "checking for minimum required perl version >= $PERL_VERSION""... $ac_c" 1>&6
-echo "configure:3545: checking for minimum required perl version >= $PERL_VERSION" >&5
+echo "configure:3448: checking for minimum required perl version >= $PERL_VERSION" >&5
 _perl_version=`PERL_VERSION=$PERL_VERSION $PERL -e 'print "$]"; if ($] >= $ENV{PERL_VERSION}) { exit(0); } else { exit(1); }' 2>&5`
 _perl_res=$?
 echo "$ac_t""$_perl_version" 1>&6
@@ -3552,7 +3455,7 @@
 fi
 
 echo $ac_n "checking for full perl installation""... $ac_c" 1>&6
-echo "configure:3556: checking for full perl installation" >&5
+echo "configure:3459: checking for full perl installation" >&5
 _perl_archlib=`$PERL -e 'use Config; if ( -d $Config{archlib} ) { exit(0); } else { exit(1); }' 2>&5`
 _perl_res=$?
 if test "$_perl_res" != 0; then
@@ -3567,7 +3470,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:3571: checking for $ac_word" >&5
+echo "configure:3474: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_PYTHON'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -3612,7 +3515,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:3616: checking for $ac_word" >&5
+echo "configure:3519: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_NSINSTALL_BIN'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -3657,7 +3560,7 @@
 # Extract the first word of "doxygen", so it can be a program name with args.
 set dummy doxygen; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:3661: checking for $ac_word" >&5
+echo "configure:3564: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_DOXYGEN'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -3693,7 +3596,7 @@
 # Extract the first word of "whoami", so it can be a program name with args.
 set dummy whoami; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:3697: checking for $ac_word" >&5
+echo "configure:3600: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_WHOAMI'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -3729,7 +3632,7 @@
 # Extract the first word of "autoconf", so it can be a program name with args.
 set dummy autoconf; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:3733: checking for $ac_word" >&5
+echo "configure:3636: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_AUTOCONF'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -3765,7 +3668,7 @@
 # Extract the first word of "unzip", so it can be a program name with args.
 set dummy unzip; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:3769: checking for $ac_word" >&5
+echo "configure:3672: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_UNZIP'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -3803,7 +3706,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:3807: checking for $ac_word" >&5
+echo "configure:3710: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_ZIP'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -3844,7 +3747,7 @@
 # Extract the first word of "makedepend", so it can be a program name with args.
 set dummy makedepend; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:3848: checking for $ac_word" >&5
+echo "configure:3751: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_SYSTEM_MAKEDEPEND'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -3879,7 +3782,7 @@
 # Extract the first word of "xargs", so it can be a program name with args.
 set dummy xargs; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:3883: checking for $ac_word" >&5
+echo "configure:3786: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_XARGS'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -3940,7 +3843,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:3944: checking for $ac_word" >&5
+echo "configure:3847: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_PBBUILD'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -3990,7 +3893,7 @@
             # Extract the first word of "sdp", so it can be a program name with args.
 set dummy sdp; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:3994: checking for $ac_word" >&5
+echo "configure:3897: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_SDP'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -4111,7 +4014,7 @@
 
   
   echo $ac_n "checking for valid compiler/Mac OS X SDK combination""... $ac_c" 1>&6
-echo "configure:4115: checking for valid compiler/Mac OS X SDK combination" >&5
+echo "configure:4018: checking for valid compiler/Mac OS X SDK combination" >&5
   ac_ext=C
 # CXXFLAGS is not in ac_cpp because -g, -O, etc. are not valid cpp options.
 ac_cpp='$CXXCPP $CPPFLAGS'
@@ -4120,7 +4023,7 @@
 cross_compiling=$ac_cv_prog_cxx_cross
 
   cat > conftest.$ac_ext <<EOF
-#line 4124 "configure"
+#line 4027 "configure"
 #include "confdefs.h"
 #include <new>
                  int main() { return 0; }
@@ -4128,7 +4031,7 @@
 result=yes
 ; return 0; }
 EOF
-if { (eval echo configure:4132: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:4035: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   result=no
 else
@@ -4159,7 +4062,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:4163: checking for $ac_word" >&5
+echo "configure:4066: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_MAKE'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -4202,7 +4105,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:4206: checking for $ac_word" >&5
+echo "configure:4109: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_MAKE'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -4270,7 +4173,7 @@
 # Uses ac_ vars as temps to allow command line to override cache and checks.
 # --without-x overrides everything else, but does not touch the cache.
 echo $ac_n "checking for X""... $ac_c" 1>&6
-echo "configure:4274: checking for X" >&5
+echo "configure:4177: checking for X" >&5
 
 # Check whether --with-x or --without-x was given.
 if test "${with_x+set}" = set; then
@@ -4332,12 +4235,12 @@
 
   # First, try using that file with no special directory specified.
 cat > conftest.$ac_ext <<EOF
-#line 4336 "configure"
+#line 4239 "configure"
 #include "confdefs.h"
 #include <$x_direct_test_include>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:4341: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:4244: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -4406,14 +4309,14 @@
   ac_save_LIBS="$LIBS"
   LIBS="-l$x_direct_test_library $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 4410 "configure"
+#line 4313 "configure"
 #include "confdefs.h"
 
 int main() {
 ${x_direct_test_function}()
 ; return 0; }
 EOF
-if { (eval echo configure:4417: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:4320: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   LIBS="$ac_save_LIBS"
 # We can link X programs with no special library path.
@@ -4519,17 +4422,17 @@
     case "`(uname -sr) 2>/dev/null`" in
     "SunOS 5"*)
       echo $ac_n "checking whether -R must be followed by a space""... $ac_c" 1>&6
-echo "configure:4523: checking whether -R must be followed by a space" >&5
+echo "configure:4426: checking whether -R must be followed by a space" >&5
       ac_xsave_LIBS="$LIBS"; LIBS="$LIBS -R$x_libraries"
       cat > conftest.$ac_ext <<EOF
-#line 4526 "configure"
+#line 4429 "configure"
 #include "confdefs.h"
 
 int main() {
 
 ; return 0; }
 EOF
-if { (eval echo configure:4533: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:4436: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   ac_R_nospace=yes
 else
@@ -4545,14 +4448,14 @@
       else
 	LIBS="$ac_xsave_LIBS -R $x_libraries"
 	cat > conftest.$ac_ext <<EOF
-#line 4549 "configure"
+#line 4452 "configure"
 #include "confdefs.h"
 
 int main() {
 
 ; return 0; }
 EOF
-if { (eval echo configure:4556: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:4459: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   ac_R_space=yes
 else
@@ -4584,7 +4487,7 @@
     # libraries were built with DECnet support.  And karl@cs.umb.edu says
     # the Alpha needs dnet_stub (dnet does not exist).
     echo $ac_n "checking for dnet_ntoa in -ldnet""... $ac_c" 1>&6
-echo "configure:4588: checking for dnet_ntoa in -ldnet" >&5
+echo "configure:4491: checking for dnet_ntoa in -ldnet" >&5
 ac_lib_var=`echo dnet'_'dnet_ntoa | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -4592,7 +4495,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-ldnet  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 4596 "configure"
+#line 4499 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -4603,7 +4506,7 @@
 dnet_ntoa()
 ; return 0; }
 EOF
-if { (eval echo configure:4607: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:4510: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -4625,7 +4528,7 @@
 
     if test $ac_cv_lib_dnet_dnet_ntoa = no; then
       echo $ac_n "checking for dnet_ntoa in -ldnet_stub""... $ac_c" 1>&6
-echo "configure:4629: checking for dnet_ntoa in -ldnet_stub" >&5
+echo "configure:4532: checking for dnet_ntoa in -ldnet_stub" >&5
 ac_lib_var=`echo dnet_stub'_'dnet_ntoa | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -4633,7 +4536,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-ldnet_stub  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 4637 "configure"
+#line 4540 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -4644,7 +4547,7 @@
 dnet_ntoa()
 ; return 0; }
 EOF
-if { (eval echo configure:4648: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:4551: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -4673,12 +4576,12 @@
     # The nsl library prevents programs from opening the X display
     # on Irix 5.2, according to dickey@clark.net.
     echo $ac_n "checking for gethostbyname""... $ac_c" 1>&6
-echo "configure:4677: checking for gethostbyname" >&5
+echo "configure:4580: checking for gethostbyname" >&5
 if eval "test \"`echo '$''{'ac_cv_func_gethostbyname'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 4682 "configure"
+#line 4585 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char gethostbyname(); below.  */
@@ -4701,7 +4604,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:4705: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:4608: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_gethostbyname=yes"
 else
@@ -4722,7 +4625,7 @@
 
     if test $ac_cv_func_gethostbyname = no; then
       echo $ac_n "checking for gethostbyname in -lnsl""... $ac_c" 1>&6
-echo "configure:4726: checking for gethostbyname in -lnsl" >&5
+echo "configure:4629: checking for gethostbyname in -lnsl" >&5
 ac_lib_var=`echo nsl'_'gethostbyname | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -4730,7 +4633,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lnsl  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 4734 "configure"
+#line 4637 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -4741,7 +4644,7 @@
 gethostbyname()
 ; return 0; }
 EOF
-if { (eval echo configure:4745: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:4648: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -4771,12 +4674,12 @@
     # -lsocket must be given before -lnsl if both are needed.
     # We assume that if connect needs -lnsl, so does gethostbyname.
     echo $ac_n "checking for connect""... $ac_c" 1>&6
-echo "configure:4775: checking for connect" >&5
+echo "configure:4678: checking for connect" >&5
 if eval "test \"`echo '$''{'ac_cv_func_connect'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 4780 "configure"
+#line 4683 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char connect(); below.  */
@@ -4799,7 +4702,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:4803: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:4706: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_connect=yes"
 else
@@ -4820,7 +4723,7 @@
 
     if test $ac_cv_func_connect = no; then
       echo $ac_n "checking for connect in -lsocket""... $ac_c" 1>&6
-echo "configure:4824: checking for connect in -lsocket" >&5
+echo "configure:4727: checking for connect in -lsocket" >&5
 ac_lib_var=`echo socket'_'connect | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -4828,7 +4731,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lsocket $X_EXTRA_LIBS $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 4832 "configure"
+#line 4735 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -4839,7 +4742,7 @@
 connect()
 ; return 0; }
 EOF
-if { (eval echo configure:4843: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:4746: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -4863,12 +4766,12 @@
 
     # gomez@mi.uni-erlangen.de says -lposix is necessary on A/UX.
     echo $ac_n "checking for remove""... $ac_c" 1>&6
-echo "configure:4867: checking for remove" >&5
+echo "configure:4770: checking for remove" >&5
 if eval "test \"`echo '$''{'ac_cv_func_remove'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 4872 "configure"
+#line 4775 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char remove(); below.  */
@@ -4891,7 +4794,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:4895: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:4798: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_remove=yes"
 else
@@ -4912,7 +4815,7 @@
 
     if test $ac_cv_func_remove = no; then
       echo $ac_n "checking for remove in -lposix""... $ac_c" 1>&6
-echo "configure:4916: checking for remove in -lposix" >&5
+echo "configure:4819: checking for remove in -lposix" >&5
 ac_lib_var=`echo posix'_'remove | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -4920,7 +4823,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lposix  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 4924 "configure"
+#line 4827 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -4931,7 +4834,7 @@
 remove()
 ; return 0; }
 EOF
-if { (eval echo configure:4935: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:4838: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -4955,12 +4858,12 @@
 
     # BSDI BSD/OS 2.1 needs -lipc for XOpenDisplay.
     echo $ac_n "checking for shmat""... $ac_c" 1>&6
-echo "configure:4959: checking for shmat" >&5
+echo "configure:4862: checking for shmat" >&5
 if eval "test \"`echo '$''{'ac_cv_func_shmat'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 4964 "configure"
+#line 4867 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char shmat(); below.  */
@@ -4983,7 +4886,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:4987: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:4890: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_shmat=yes"
 else
@@ -5004,7 +4907,7 @@
 
     if test $ac_cv_func_shmat = no; then
       echo $ac_n "checking for shmat in -lipc""... $ac_c" 1>&6
-echo "configure:5008: checking for shmat in -lipc" >&5
+echo "configure:4911: checking for shmat in -lipc" >&5
 ac_lib_var=`echo ipc'_'shmat | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -5012,7 +4915,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lipc  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 5016 "configure"
+#line 4919 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -5023,7 +4926,7 @@
 shmat()
 ; return 0; }
 EOF
-if { (eval echo configure:5027: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:4930: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -5056,7 +4959,7 @@
   # libraries we check for below, so use a different variable.
   #  --interran@uluru.Stanford.EDU, kb@cs.umb.edu.
   echo $ac_n "checking for IceConnectionNumber in -lICE""... $ac_c" 1>&6
-echo "configure:5060: checking for IceConnectionNumber in -lICE" >&5
+echo "configure:4963: checking for IceConnectionNumber in -lICE" >&5
 ac_lib_var=`echo ICE'_'IceConnectionNumber | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -5064,7 +4967,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lICE $X_EXTRA_LIBS $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 5068 "configure"
+#line 4971 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -5075,7 +4978,7 @@
 IceConnectionNumber()
 ; return 0; }
 EOF
-if { (eval echo configure:5079: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:4982: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -5164,6 +5067,7 @@
     case "${target_os}" in
         linux*)       OS_ARCH=Linux OS_TARGET=Linux ;;
         kfreebsd*-gnu) OS_ARCH=GNU_kFreeBSD OS_TARGET=GNU_kFreeBSD ;;
+        gnu*)         OS_ARCH=GNU ;;
         solaris*)     OS_ARCH=SunOS OS_RELEASE=5 ;;
         mingw*)       OS_ARCH=WINNT ;;
         wince*)       OS_ARCH=WINCE ;;
@@ -5471,6 +5375,7 @@
     WARNINGS_AS_ERRORS='-Werror'
     DSO_CFLAGS=''
     DSO_PIC_CFLAGS='-fPIC'
+    ASFLAGS="$ASFLAGS -fPIC"
     _MOZ_RTTI_FLAGS_ON=${_COMPILER_PREFIX}-frtti
     _MOZ_RTTI_FLAGS_OFF=${_COMPILER_PREFIX}-fno-rtti
     _MOZ_EXCEPTIONS_FLAGS_ON='-fhandle-exceptions'
@@ -5543,7 +5448,7 @@
 if test "$COMPILE_ENVIRONMENT"; then
 if test "$GNU_CC"; then
   echo $ac_n "checking whether ld has archive extraction flags""... $ac_c" 1>&6
-echo "configure:5547: checking whether ld has archive extraction flags" >&5
+echo "configure:5452: checking whether ld has archive extraction flags" >&5
   if eval "test \"`echo '$''{'ac_cv_mkshlib_force_and_unforce'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -5560,14 +5465,14 @@
       LDFLAGS=$force
       LIBS=$unforce
       cat > conftest.$ac_ext <<EOF
-#line 5564 "configure"
+#line 5469 "configure"
 #include "confdefs.h"
 
 int main() {
 
 ; return 0; }
 EOF
-if { (eval echo configure:5571: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:5476: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   ac_cv_mkshlib_force_and_unforce=$line; break
 else
@@ -5600,7 +5505,7 @@
 '
 
 echo $ac_n "checking that static assertion macros used in autoconf tests work""... $ac_c" 1>&6
-echo "configure:5604: checking that static assertion macros used in autoconf tests work" >&5
+echo "configure:5509: checking that static assertion macros used in autoconf tests work" >&5
 if eval "test \"`echo '$''{'ac_cv_static_assertion_macros_work'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -5614,14 +5519,14 @@
 
   ac_cv_static_assertion_macros_work="yes"
   cat > conftest.$ac_ext <<EOF
-#line 5618 "configure"
+#line 5523 "configure"
 #include "confdefs.h"
 $configure_static_assert_macros
 int main() {
 CONFIGURE_STATIC_ASSERT(1)
 ; return 0; }
 EOF
-if { (eval echo configure:5625: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:5530: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   :
 else
   echo "configure: failed program was:" >&5
@@ -5631,14 +5536,14 @@
 fi
 rm -f conftest*
   cat > conftest.$ac_ext <<EOF
-#line 5635 "configure"
+#line 5540 "configure"
 #include "confdefs.h"
 $configure_static_assert_macros
 int main() {
 CONFIGURE_STATIC_ASSERT(0)
 ; return 0; }
 EOF
-if { (eval echo configure:5642: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:5547: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_static_assertion_macros_work="no"
 else
@@ -5654,14 +5559,14 @@
 cross_compiling=$ac_cv_prog_cxx_cross
 
   cat > conftest.$ac_ext <<EOF
-#line 5658 "configure"
+#line 5563 "configure"
 #include "confdefs.h"
 $configure_static_assert_macros
 int main() {
 CONFIGURE_STATIC_ASSERT(1)
 ; return 0; }
 EOF
-if { (eval echo configure:5665: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:5570: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   :
 else
   echo "configure: failed program was:" >&5
@@ -5671,14 +5576,14 @@
 fi
 rm -f conftest*
   cat > conftest.$ac_ext <<EOF
-#line 5675 "configure"
+#line 5580 "configure"
 #include "confdefs.h"
 $configure_static_assert_macros
 int main() {
 CONFIGURE_STATIC_ASSERT(0)
 ; return 0; }
 EOF
-if { (eval echo configure:5682: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:5587: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_static_assertion_macros_work="no"
 else
@@ -5713,16 +5618,16 @@
 cross_compiling=$ac_cv_prog_cc_cross
 
 echo $ac_n "checking for 64-bit OS""... $ac_c" 1>&6
-echo "configure:5717: checking for 64-bit OS" >&5
+echo "configure:5622: checking for 64-bit OS" >&5
 cat > conftest.$ac_ext <<EOF
-#line 5719 "configure"
+#line 5624 "configure"
 #include "confdefs.h"
 $configure_static_assert_macros
 int main() {
 CONFIGURE_STATIC_ASSERT(sizeof(long) == 8)
 ; return 0; }
 EOF
-if { (eval echo configure:5726: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:5631: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   result="yes"
 else
@@ -5814,7 +5719,7 @@
     LIBXUL_LIBS='$(XPCOM_FROZEN_LDOPTS) $(LIBXUL_DIST)/bin/XUL -lobjc'
     ;;
 
-*-linux*|*-kfreebsd*-gnu)
+*-linux*|*-kfreebsd*-gnu|*-gnu*)
     HOST_CFLAGS="$HOST_CFLAGS -DXP_UNIX"
     HOST_NSPR_MDCPUCFG='\"md/_linux.cfg\"'
     HOST_OPTIMIZE_FLAGS="${HOST_OPTIMIZE_FLAGS=-O3}"
@@ -5895,9 +5800,9 @@
 cross_compiling=$ac_cv_prog_cxx_cross
 
             echo $ac_n "checking for VisualAge C++ compiler version >= 6.0.0.3""... $ac_c" 1>&6
-echo "configure:5899: checking for VisualAge C++ compiler version >= 6.0.0.3" >&5
+echo "configure:5804: checking for VisualAge C++ compiler version >= 6.0.0.3" >&5
             cat > conftest.$ac_ext <<EOF
-#line 5901 "configure"
+#line 5806 "configure"
 #include "confdefs.h"
 
 int main() {
@@ -5906,7 +5811,7 @@
                  #endif
 ; return 0; }
 EOF
-if { (eval echo configure:5910: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:5815: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   _BAD_COMPILER=
 else
@@ -5944,17 +5849,17 @@
 do
 ac_safe=`echo "$ac_hdr" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for $ac_hdr""... $ac_c" 1>&6
-echo "configure:5948: checking for $ac_hdr" >&5
+echo "configure:5853: checking for $ac_hdr" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 5953 "configure"
+#line 5858 "configure"
 #include "confdefs.h"
 #include <$ac_hdr>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:5958: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:5863: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -5996,7 +5901,7 @@
     LIBS="$LIBS -lbe"
     if test "$COMPILE_ENVIRONMENT"; then
         echo $ac_n "checking for main in -lbind""... $ac_c" 1>&6
-echo "configure:6000: checking for main in -lbind" >&5
+echo "configure:5905: checking for main in -lbind" >&5
 ac_lib_var=`echo bind'_'main | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -6004,14 +5909,14 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lbind  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 6008 "configure"
+#line 5913 "configure"
 #include "confdefs.h"
 
 int main() {
 main()
 ; return 0; }
 EOF
-if { (eval echo configure:6015: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:5920: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -6032,7 +5937,7 @@
 fi
 
         echo $ac_n "checking for main in -lzeta""... $ac_c" 1>&6
-echo "configure:6036: checking for main in -lzeta" >&5
+echo "configure:5941: checking for main in -lzeta" >&5
 ac_lib_var=`echo zeta'_'main | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -6040,14 +5945,14 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lzeta  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 6044 "configure"
+#line 5949 "configure"
 #include "confdefs.h"
 
 int main() {
 main()
 ; return 0; }
 EOF
-if { (eval echo configure:6051: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:5956: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -6116,18 +6021,18 @@
     MACOSX=1
 
         echo $ac_n "checking for -dead_strip option to ld""... $ac_c" 1>&6
-echo "configure:6120: checking for -dead_strip option to ld" >&5
+echo "configure:6025: checking for -dead_strip option to ld" >&5
     _SAVE_LDFLAGS=$LDFLAGS
     LDFLAGS="$LDFLAGS -Wl,-dead_strip"
     cat > conftest.$ac_ext <<EOF
-#line 6124 "configure"
+#line 6029 "configure"
 #include "confdefs.h"
 
 int main() {
 return 0;
 ; return 0; }
 EOF
-if { (eval echo configure:6131: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:6036: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   _HAVE_DEAD_STRIP=1
 else
@@ -6280,8 +6185,7 @@
         MOZ_ENABLE_OLD_ABI_COMPAT_WRAPPERS=1
     ;;
     mips*)
-        CFLAGS="$CFLAGS -Wa,-xgot"
-        CXXFLAGS="$CXXFLAGS -Wa,-xgot"
+        MOZ_DEBUG_FLAGS="-g" # We want inlining
     ;;
     esac
     ;;
@@ -6652,17 +6556,17 @@
 do
 ac_safe=`echo "$ac_hdr" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for $ac_hdr""... $ac_c" 1>&6
-echo "configure:6656: checking for $ac_hdr" >&5
+echo "configure:6560: checking for $ac_hdr" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 6661 "configure"
+#line 6565 "configure"
 #include "confdefs.h"
 #include <$ac_hdr>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:6666: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:6570: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -6701,17 +6605,17 @@
 do
 ac_safe=`echo "$ac_hdr" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for $ac_hdr""... $ac_c" 1>&6
-echo "configure:6705: checking for $ac_hdr" >&5
+echo "configure:6609: checking for $ac_hdr" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 6710 "configure"
+#line 6614 "configure"
 #include "confdefs.h"
 #include <$ac_hdr>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:6715: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:6619: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -6957,19 +6861,19 @@
         _DEFINES_CXXFLAGS="$_DEFINES_CXXFLAGS -Uunix -U__unix -U__unix__"
 
         echo $ac_n "checking for __declspec(dllexport)""... $ac_c" 1>&6
-echo "configure:6961: checking for __declspec(dllexport)" >&5
+echo "configure:6865: checking for __declspec(dllexport)" >&5
 if eval "test \"`echo '$''{'ac_os2_declspec'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 6966 "configure"
+#line 6870 "configure"
 #include "confdefs.h"
 __declspec(dllexport) void ac_os2_declspec(void) {}
 int main() {
 return 0;
 ; return 0; }
 EOF
-if { (eval echo configure:6973: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:6877: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_os2_declspec="yes"
 else
@@ -7155,14 +7059,14 @@
            _SAVE_LDFLAGS=$LDFLAGS
            LDFLAGS="-M /usr/lib/ld/map.noexstk $LDFLAGS" 
            cat > conftest.$ac_ext <<EOF
-#line 7159 "configure"
+#line 7063 "configure"
 #include "confdefs.h"
 #include <stdio.h>
 int main() {
 printf("Hello World\n");
 ; return 0; }
 EOF
-if { (eval echo configure:7166: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:7070: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   :
 else
   echo "configure: failed program was:" >&5
@@ -7191,7 +7095,7 @@
         CC_VERSION=`$CC -V 2>&1 | grep '^cc:' 2>/dev/null | $AWK -F\: '{ print $2 }'`
         CXX_VERSION=`$CXX -V 2>&1 | grep '^CC:' 2>/dev/null | $AWK -F\: '{ print $2 }'`
        echo $ac_n "checking for Forte compiler version >= WS6U2""... $ac_c" 1>&6
-echo "configure:7195: checking for Forte compiler version >= WS6U2" >&5
+echo "configure:7099: checking for Forte compiler version >= WS6U2" >&5
        
        ac_ext=C
 # CXXFLAGS is not in ac_cpp because -g, -O, etc. are not valid cpp options.
@@ -7201,7 +7105,7 @@
 cross_compiling=$ac_cv_prog_cxx_cross
 
        cat > conftest.$ac_ext <<EOF
-#line 7205 "configure"
+#line 7109 "configure"
 #include "confdefs.h"
 
 int main() {
@@ -7210,7 +7114,7 @@
            #endif
 ; return 0; }
 EOF
-if { (eval echo configure:7214: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:7118: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   _BAD_COMPILER=
 else
@@ -7320,7 +7224,7 @@
 esac
 
 case "$target" in
-    *-linux*|*-kfreebsd*-gnu)
+    *-linux*|*-kfreebsd*-gnu|*-gnu*)
         MOZ_COMPONENTS_VERSION_SCRIPT_LDFLAGS='-Wl,--version-script -Wl,$(BUILD_TOOLS)/gnu-ld-scripts/components-version-script'
         ;;
     *-solaris*)
@@ -7361,12 +7265,12 @@
 cross_compiling=$ac_cv_prog_cc_cross
 
 echo $ac_n "checking for ANSI C header files""... $ac_c" 1>&6
-echo "configure:7365: checking for ANSI C header files" >&5
+echo "configure:7269: checking for ANSI C header files" >&5
 if eval "test \"`echo '$''{'ac_cv_header_stdc'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 7370 "configure"
+#line 7274 "configure"
 #include "confdefs.h"
 #include <stdlib.h>
 #include <stdarg.h>
@@ -7374,7 +7278,7 @@
 #include <float.h>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:7378: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:7282: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -7391,7 +7295,7 @@
 if test $ac_cv_header_stdc = yes; then
   # SunOS 4.x string.h does not declare mem*, contrary to ANSI.
 cat > conftest.$ac_ext <<EOF
-#line 7395 "configure"
+#line 7299 "configure"
 #include "confdefs.h"
 #include <string.h>
 EOF
@@ -7409,7 +7313,7 @@
 if test $ac_cv_header_stdc = yes; then
   # ISC 2.0.2 stdlib.h does not declare free, contrary to ANSI.
 cat > conftest.$ac_ext <<EOF
-#line 7413 "configure"
+#line 7317 "configure"
 #include "confdefs.h"
 #include <stdlib.h>
 EOF
@@ -7430,7 +7334,7 @@
   :
 else
   cat > conftest.$ac_ext <<EOF
-#line 7434 "configure"
+#line 7338 "configure"
 #include "confdefs.h"
 #include <ctype.h>
 #define ISLOWER(c) ('a' <= (c) && (c) <= 'z')
@@ -7441,7 +7345,7 @@
 exit (0); }
 
 EOF
-if { (eval echo configure:7445: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
+if { (eval echo configure:7349: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
 then
   :
 else
@@ -7465,12 +7369,12 @@
 fi
 
 echo $ac_n "checking for working const""... $ac_c" 1>&6
-echo "configure:7469: checking for working const" >&5
+echo "configure:7373: checking for working const" >&5
 if eval "test \"`echo '$''{'ac_cv_c_const'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 7474 "configure"
+#line 7378 "configure"
 #include "confdefs.h"
 
 int main() {
@@ -7519,7 +7423,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:7523: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:7427: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_c_const=yes
 else
@@ -7540,12 +7444,12 @@
 fi
 
 echo $ac_n "checking for mode_t""... $ac_c" 1>&6
-echo "configure:7544: checking for mode_t" >&5
+echo "configure:7448: checking for mode_t" >&5
 if eval "test \"`echo '$''{'ac_cv_type_mode_t'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 7549 "configure"
+#line 7453 "configure"
 #include "confdefs.h"
 #include <sys/types.h>
 #if STDC_HEADERS
@@ -7573,12 +7477,12 @@
 fi
 
 echo $ac_n "checking for off_t""... $ac_c" 1>&6
-echo "configure:7577: checking for off_t" >&5
+echo "configure:7481: checking for off_t" >&5
 if eval "test \"`echo '$''{'ac_cv_type_off_t'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 7582 "configure"
+#line 7486 "configure"
 #include "confdefs.h"
 #include <sys/types.h>
 #if STDC_HEADERS
@@ -7606,12 +7510,12 @@
 fi
 
 echo $ac_n "checking for pid_t""... $ac_c" 1>&6
-echo "configure:7610: checking for pid_t" >&5
+echo "configure:7514: checking for pid_t" >&5
 if eval "test \"`echo '$''{'ac_cv_type_pid_t'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 7615 "configure"
+#line 7519 "configure"
 #include "confdefs.h"
 #include <sys/types.h>
 #if STDC_HEADERS
@@ -7639,12 +7543,12 @@
 fi
 
 echo $ac_n "checking for size_t""... $ac_c" 1>&6
-echo "configure:7643: checking for size_t" >&5
+echo "configure:7547: checking for size_t" >&5
 if eval "test \"`echo '$''{'ac_cv_type_size_t'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 7648 "configure"
+#line 7552 "configure"
 #include "confdefs.h"
 #include <sys/types.h>
 #if STDC_HEADERS
@@ -7672,12 +7576,12 @@
 fi
 
 echo $ac_n "checking for st_blksize in struct stat""... $ac_c" 1>&6
-echo "configure:7676: checking for st_blksize in struct stat" >&5
+echo "configure:7580: checking for st_blksize in struct stat" >&5
 if eval "test \"`echo '$''{'ac_cv_struct_st_blksize'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 7681 "configure"
+#line 7585 "configure"
 #include "confdefs.h"
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -7685,7 +7589,7 @@
 struct stat s; s.st_blksize;
 ; return 0; }
 EOF
-if { (eval echo configure:7689: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:7593: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_struct_st_blksize=yes
 else
@@ -7706,12 +7610,12 @@
 fi
 
 echo $ac_n "checking for siginfo_t""... $ac_c" 1>&6
-echo "configure:7710: checking for siginfo_t" >&5
+echo "configure:7614: checking for siginfo_t" >&5
 if eval "test \"`echo '$''{'ac_cv_siginfo_t'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 7715 "configure"
+#line 7619 "configure"
 #include "confdefs.h"
 #define _POSIX_C_SOURCE 199506L
                   #include <signal.h>
@@ -7719,7 +7623,7 @@
 siginfo_t* info;
 ; return 0; }
 EOF
-if { (eval echo configure:7723: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:7627: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_siginfo_t=true
 else
@@ -7753,12 +7657,12 @@
 fi
 
 echo $ac_n "checking for int16_t""... $ac_c" 1>&6
-echo "configure:7757: checking for int16_t" >&5
+echo "configure:7661: checking for int16_t" >&5
 if eval "test \"`echo '$''{'ac_cv_int16_t'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 7762 "configure"
+#line 7666 "configure"
 #include "confdefs.h"
 #include <stdio.h>
                   #include <sys/types.h>
@@ -7766,7 +7670,7 @@
 int16_t foo = 0;
 ; return 0; }
 EOF
-if { (eval echo configure:7770: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:7674: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_int16_t=true
 else
@@ -7788,12 +7692,12 @@
   echo "$ac_t""no" 1>&6
 fi
 echo $ac_n "checking for int32_t""... $ac_c" 1>&6
-echo "configure:7792: checking for int32_t" >&5
+echo "configure:7696: checking for int32_t" >&5
 if eval "test \"`echo '$''{'ac_cv_int32_t'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 7797 "configure"
+#line 7701 "configure"
 #include "confdefs.h"
 #include <stdio.h>
                   #include <sys/types.h>
@@ -7801,7 +7705,7 @@
 int32_t foo = 0;
 ; return 0; }
 EOF
-if { (eval echo configure:7805: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:7709: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_int32_t=true
 else
@@ -7823,12 +7727,12 @@
   echo "$ac_t""no" 1>&6
 fi
 echo $ac_n "checking for int64_t""... $ac_c" 1>&6
-echo "configure:7827: checking for int64_t" >&5
+echo "configure:7731: checking for int64_t" >&5
 if eval "test \"`echo '$''{'ac_cv_int64_t'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 7832 "configure"
+#line 7736 "configure"
 #include "confdefs.h"
 #include <stdio.h>
                   #include <sys/types.h>
@@ -7836,7 +7740,7 @@
 int64_t foo = 0;
 ; return 0; }
 EOF
-if { (eval echo configure:7840: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:7744: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_int64_t=true
 else
@@ -7858,12 +7762,12 @@
   echo "$ac_t""no" 1>&6
 fi
 echo $ac_n "checking for int64""... $ac_c" 1>&6
-echo "configure:7862: checking for int64" >&5
+echo "configure:7766: checking for int64" >&5
 if eval "test \"`echo '$''{'ac_cv_int64'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 7867 "configure"
+#line 7771 "configure"
 #include "confdefs.h"
 #include <stdio.h>
                   #include <sys/types.h>
@@ -7871,7 +7775,7 @@
 int64 foo = 0;
 ; return 0; }
 EOF
-if { (eval echo configure:7875: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:7779: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_int64=true
 else
@@ -7893,12 +7797,12 @@
   echo "$ac_t""no" 1>&6
 fi
 echo $ac_n "checking for uint""... $ac_c" 1>&6
-echo "configure:7897: checking for uint" >&5
+echo "configure:7801: checking for uint" >&5
 if eval "test \"`echo '$''{'ac_cv_uint'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 7902 "configure"
+#line 7806 "configure"
 #include "confdefs.h"
 #include <stdio.h>
                   #include <sys/types.h>
@@ -7906,7 +7810,7 @@
 uint foo = 0;
 ; return 0; }
 EOF
-if { (eval echo configure:7910: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:7814: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_uint=true
 else
@@ -7928,12 +7832,12 @@
   echo "$ac_t""no" 1>&6
 fi
 echo $ac_n "checking for uint_t""... $ac_c" 1>&6
-echo "configure:7932: checking for uint_t" >&5
+echo "configure:7836: checking for uint_t" >&5
 if eval "test \"`echo '$''{'ac_cv_uint_t'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 7937 "configure"
+#line 7841 "configure"
 #include "confdefs.h"
 #include <stdio.h>
                   #include <sys/types.h>
@@ -7941,7 +7845,7 @@
 uint_t foo = 0;
 ; return 0; }
 EOF
-if { (eval echo configure:7945: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:7849: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_uint_t=true
 else
@@ -7963,12 +7867,12 @@
   echo "$ac_t""no" 1>&6
 fi
 echo $ac_n "checking for uint16_t""... $ac_c" 1>&6
-echo "configure:7967: checking for uint16_t" >&5
+echo "configure:7871: checking for uint16_t" >&5
 if eval "test \"`echo '$''{'ac_cv_uint16_t'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 7972 "configure"
+#line 7876 "configure"
 #include "confdefs.h"
 #include <stdio.h>
                   #include <sys/types.h>
@@ -7976,7 +7880,7 @@
 uint16_t foo = 0;
 ; return 0; }
 EOF
-if { (eval echo configure:7980: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:7884: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_uint16_t=true
 else
@@ -8007,12 +7911,12 @@
 
 
 echo $ac_n "checking for uname.domainname""... $ac_c" 1>&6
-echo "configure:8011: checking for uname.domainname" >&5
+echo "configure:7915: checking for uname.domainname" >&5
 if eval "test \"`echo '$''{'ac_cv_have_uname_domainname_field'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 8016 "configure"
+#line 7920 "configure"
 #include "confdefs.h"
 #include <sys/utsname.h>
 int main() {
@@ -8020,7 +7924,7 @@
             (void)uname(res);  if (res != 0) { domain = res->domainname; } 
 ; return 0; }
 EOF
-if { (eval echo configure:8024: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:7928: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_have_uname_domainname_field=true
 else
@@ -8044,12 +7948,12 @@
 fi
 
 echo $ac_n "checking for uname.__domainname""... $ac_c" 1>&6
-echo "configure:8048: checking for uname.__domainname" >&5
+echo "configure:7952: checking for uname.__domainname" >&5
 if eval "test \"`echo '$''{'ac_cv_have_uname_us_domainname_field'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 8053 "configure"
+#line 7957 "configure"
 #include "confdefs.h"
 #include <sys/utsname.h>
 int main() {
@@ -8057,7 +7961,7 @@
             (void)uname(res);  if (res != 0) { domain = res->__domainname; } 
 ; return 0; }
 EOF
-if { (eval echo configure:8061: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:7965: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_have_uname_us_domainname_field=true
 else
@@ -8090,12 +7994,12 @@
 
 
 echo $ac_n "checking for usable wchar_t (2 bytes, unsigned)""... $ac_c" 1>&6
-echo "configure:8094: checking for usable wchar_t (2 bytes, unsigned)" >&5
+echo "configure:7998: checking for usable wchar_t (2 bytes, unsigned)" >&5
 if eval "test \"`echo '$''{'ac_cv_have_usable_wchar_v2'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 8099 "configure"
+#line 8003 "configure"
 #include "confdefs.h"
 #include <stddef.h>
                      $configure_static_assert_macros
@@ -8104,7 +8008,7 @@
                      CONFIGURE_STATIC_ASSERT((wchar_t)-1 > (wchar_t) 0)
 ; return 0; }
 EOF
-if { (eval echo configure:8108: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:8012: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_have_usable_wchar_v2="yes"
 else
@@ -8123,7 +8027,7 @@
 EOF
 
     HAVE_CPP_2BYTE_WCHAR_T=1
-else
+elif false; then
 
     
     ac_ext=C
@@ -8137,12 +8041,12 @@
     CXXFLAGS="$CXXFLAGS -fshort-wchar"
 
     echo $ac_n "checking for compiler -fshort-wchar option""... $ac_c" 1>&6
-echo "configure:8141: checking for compiler -fshort-wchar option" >&5
+echo "configure:8045: checking for compiler -fshort-wchar option" >&5
 if eval "test \"`echo '$''{'ac_cv_have_usable_wchar_option_v2'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 8146 "configure"
+#line 8050 "configure"
 #include "confdefs.h"
 #include <stddef.h>
                          $configure_static_assert_macros
@@ -8151,7 +8055,7 @@
                          CONFIGURE_STATIC_ASSERT((wchar_t)-1 > (wchar_t) 0)
 ; return 0; }
 EOF
-if { (eval echo configure:8155: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:8059: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   ac_cv_have_usable_wchar_option_v2="yes"
 else
@@ -8171,6 +8075,7 @@
 EOF
 
         HAVE_CPP_2BYTE_WCHAR_T=1
+        WCHAR_CFLAGS="-fshort-wchar"
     else    
         CXXFLAGS=$_SAVE_CXXFLAGS
     fi
@@ -8185,7 +8090,7 @@
 
 if test "$GNU_CC"; then
   echo $ac_n "checking for visibility(hidden) attribute""... $ac_c" 1>&6
-echo "configure:8189: checking for visibility(hidden) attribute" >&5
+echo "configure:8094: checking for visibility(hidden) attribute" >&5
 if eval "test \"`echo '$''{'ac_cv_visibility_hidden'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -8210,7 +8115,7 @@
 
 
     echo $ac_n "checking for visibility(default) attribute""... $ac_c" 1>&6
-echo "configure:8214: checking for visibility(default) attribute" >&5
+echo "configure:8119: checking for visibility(default) attribute" >&5
 if eval "test \"`echo '$''{'ac_cv_visibility_default'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -8235,7 +8140,7 @@
 
 
       echo $ac_n "checking for visibility pragma support""... $ac_c" 1>&6
-echo "configure:8239: checking for visibility pragma support" >&5
+echo "configure:8144: checking for visibility pragma support" >&5
 if eval "test \"`echo '$''{'ac_cv_visibility_pragma'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -8260,7 +8165,7 @@
 echo "$ac_t""$ac_cv_visibility_pragma" 1>&6
       if test "$ac_cv_visibility_pragma" = "yes"; then
         echo $ac_n "checking For gcc visibility bug with class-level attributes (GCC bug 26905)""... $ac_c" 1>&6
-echo "configure:8264: checking For gcc visibility bug with class-level attributes (GCC bug 26905)" >&5
+echo "configure:8169: checking For gcc visibility bug with class-level attributes (GCC bug 26905)" >&5
 if eval "test \"`echo '$''{'ac_cv_have_visibility_class_bug'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -8288,7 +8193,7 @@
 echo "$ac_t""$ac_cv_have_visibility_class_bug" 1>&6
 
         echo $ac_n "checking For x86_64 gcc visibility bug with builtins (GCC bug 20297)""... $ac_c" 1>&6
-echo "configure:8292: checking For x86_64 gcc visibility bug with builtins (GCC bug 20297)" >&5
+echo "configure:8197: checking For x86_64 gcc visibility bug with builtins (GCC bug 20297)" >&5
 if eval "test \"`echo '$''{'ac_cv_have_visibility_builtin_bug'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -8336,12 +8241,12 @@
 do
 ac_safe=`echo "$ac_hdr" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for $ac_hdr that defines DIR""... $ac_c" 1>&6
-echo "configure:8340: checking for $ac_hdr that defines DIR" >&5
+echo "configure:8245: checking for $ac_hdr that defines DIR" >&5
 if eval "test \"`echo '$''{'ac_cv_header_dirent_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 8345 "configure"
+#line 8250 "configure"
 #include "confdefs.h"
 #include <sys/types.h>
 #include <$ac_hdr>
@@ -8349,7 +8254,7 @@
 DIR *dirp = 0;
 ; return 0; }
 EOF
-if { (eval echo configure:8353: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:8258: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   eval "ac_cv_header_dirent_$ac_safe=yes"
 else
@@ -8374,7 +8279,7 @@
 # Two versions of opendir et al. are in -ldir and -lx on SCO Xenix.
 if test $ac_header_dirent = dirent.h; then
 echo $ac_n "checking for opendir in -ldir""... $ac_c" 1>&6
-echo "configure:8378: checking for opendir in -ldir" >&5
+echo "configure:8283: checking for opendir in -ldir" >&5
 ac_lib_var=`echo dir'_'opendir | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -8382,7 +8287,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-ldir  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 8386 "configure"
+#line 8291 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -8393,7 +8298,7 @@
 opendir()
 ; return 0; }
 EOF
-if { (eval echo configure:8397: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:8302: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -8415,7 +8320,7 @@
 
 else
 echo $ac_n "checking for opendir in -lx""... $ac_c" 1>&6
-echo "configure:8419: checking for opendir in -lx" >&5
+echo "configure:8324: checking for opendir in -lx" >&5
 ac_lib_var=`echo x'_'opendir | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -8423,7 +8328,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lx  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 8427 "configure"
+#line 8332 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -8434,7 +8339,7 @@
 opendir()
 ; return 0; }
 EOF
-if { (eval echo configure:8438: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:8343: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -8466,17 +8371,17 @@
 do
 ac_safe=`echo "$ac_hdr" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for $ac_hdr""... $ac_c" 1>&6
-echo "configure:8470: checking for $ac_hdr" >&5
+echo "configure:8375: checking for $ac_hdr" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 8475 "configure"
+#line 8380 "configure"
 #include "confdefs.h"
 #include <$ac_hdr>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:8480: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:8385: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -8506,17 +8411,17 @@
 do
 ac_safe=`echo "$ac_hdr" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for $ac_hdr""... $ac_c" 1>&6
-echo "configure:8510: checking for $ac_hdr" >&5
+echo "configure:8415: checking for $ac_hdr" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 8515 "configure"
+#line 8420 "configure"
 #include "confdefs.h"
 #include <$ac_hdr>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:8520: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:8425: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -8546,17 +8451,17 @@
 do
 ac_safe=`echo "$ac_hdr" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for $ac_hdr""... $ac_c" 1>&6
-echo "configure:8550: checking for $ac_hdr" >&5
+echo "configure:8455: checking for $ac_hdr" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 8555 "configure"
+#line 8460 "configure"
 #include "confdefs.h"
 #include <$ac_hdr>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:8560: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:8465: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -8586,17 +8491,17 @@
 do
 ac_safe=`echo "$ac_hdr" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for $ac_hdr""... $ac_c" 1>&6
-echo "configure:8590: checking for $ac_hdr" >&5
+echo "configure:8495: checking for $ac_hdr" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 8595 "configure"
+#line 8500 "configure"
 #include "confdefs.h"
 #include <$ac_hdr>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:8600: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:8505: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -8626,17 +8531,17 @@
 do
 ac_safe=`echo "$ac_hdr" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for $ac_hdr""... $ac_c" 1>&6
-echo "configure:8630: checking for $ac_hdr" >&5
+echo "configure:8535: checking for $ac_hdr" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 8635 "configure"
+#line 8540 "configure"
 #include "confdefs.h"
 #include <$ac_hdr>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:8640: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:8545: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -8667,17 +8572,17 @@
 do
 ac_safe=`echo "$ac_hdr" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for $ac_hdr""... $ac_c" 1>&6
-echo "configure:8671: checking for $ac_hdr" >&5
+echo "configure:8576: checking for $ac_hdr" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 8676 "configure"
+#line 8581 "configure"
 #include "confdefs.h"
 #include <$ac_hdr>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:8681: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:8586: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -8708,17 +8613,17 @@
 do
 ac_safe=`echo "$ac_hdr" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for $ac_hdr""... $ac_c" 1>&6
-echo "configure:8712: checking for $ac_hdr" >&5
+echo "configure:8617: checking for $ac_hdr" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 8717 "configure"
+#line 8622 "configure"
 #include "confdefs.h"
 #include <$ac_hdr>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:8722: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:8627: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -8755,17 +8660,17 @@
 NEW_H=new.h
 ac_safe=`echo "new" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for new""... $ac_c" 1>&6
-echo "configure:8759: checking for new" >&5
+echo "configure:8664: checking for new" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 8764 "configure"
+#line 8669 "configure"
 #include "confdefs.h"
 #include <new>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:8769: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:8674: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -8807,17 +8712,17 @@
 if test "x$enable_dtrace" = "xyes"; then
   ac_safe=`echo "sys/sdt.h" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for sys/sdt.h""... $ac_c" 1>&6
-echo "configure:8811: checking for sys/sdt.h" >&5
+echo "configure:8716: checking for sys/sdt.h" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 8816 "configure"
+#line 8721 "configure"
 #include "confdefs.h"
 #include <sys/sdt.h>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:8821: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:8726: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -8857,17 +8762,17 @@
 do
 ac_safe=`echo "$ac_hdr" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for $ac_hdr""... $ac_c" 1>&6
-echo "configure:8861: checking for $ac_hdr" >&5
+echo "configure:8766: checking for $ac_hdr" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 8866 "configure"
+#line 8771 "configure"
 #include "confdefs.h"
 #include <$ac_hdr>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:8871: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:8776: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -8901,7 +8806,7 @@
 	;;
 *)
 	echo $ac_n "checking for gethostbyname_r in -lc_r""... $ac_c" 1>&6
-echo "configure:8905: checking for gethostbyname_r in -lc_r" >&5
+echo "configure:8810: checking for gethostbyname_r in -lc_r" >&5
 ac_lib_var=`echo c_r'_'gethostbyname_r | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -8909,7 +8814,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lc_r  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 8913 "configure"
+#line 8818 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -8920,7 +8825,7 @@
 gethostbyname_r()
 ; return 0; }
 EOF
-if { (eval echo configure:8924: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:8829: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -8957,7 +8862,7 @@
     ;;
 *)
     echo $ac_n "checking for atan in -lm""... $ac_c" 1>&6
-echo "configure:8961: checking for atan in -lm" >&5
+echo "configure:8866: checking for atan in -lm" >&5
 ac_lib_var=`echo m'_'atan | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -8965,7 +8870,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lm  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 8969 "configure"
+#line 8874 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -8976,7 +8881,7 @@
 atan()
 ; return 0; }
 EOF
-if { (eval echo configure:8980: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:8885: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -9004,7 +8909,7 @@
 fi
 
     echo $ac_n "checking for dlopen in -ldl""... $ac_c" 1>&6
-echo "configure:9008: checking for dlopen in -ldl" >&5
+echo "configure:8913: checking for dlopen in -ldl" >&5
 ac_lib_var=`echo dl'_'dlopen | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -9012,7 +8917,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-ldl  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 9016 "configure"
+#line 8921 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -9023,7 +8928,7 @@
 dlopen()
 ; return 0; }
 EOF
-if { (eval echo configure:9027: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:8932: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -9040,17 +8945,17 @@
   echo "$ac_t""yes" 1>&6
   ac_safe=`echo "dlfcn.h" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for dlfcn.h""... $ac_c" 1>&6
-echo "configure:9044: checking for dlfcn.h" >&5
+echo "configure:8949: checking for dlfcn.h" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 9049 "configure"
+#line 8954 "configure"
 #include "confdefs.h"
 #include <dlfcn.h>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:9054: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:8959: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -9087,12 +8992,12 @@
 for ac_func in dladdr
 do
 echo $ac_n "checking for $ac_func""... $ac_c" 1>&6
-echo "configure:9091: checking for $ac_func" >&5
+echo "configure:8996: checking for $ac_func" >&5
 if eval "test \"`echo '$''{'ac_cv_func_$ac_func'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 9096 "configure"
+#line 9001 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char $ac_func(); below.  */
@@ -9115,7 +9020,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:9119: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:9024: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_$ac_func=yes"
 else
@@ -9146,7 +9051,7 @@
     case $target in
     *-aix*)
 	echo $ac_n "checking for demangle in -lC_r""... $ac_c" 1>&6
-echo "configure:9150: checking for demangle in -lC_r" >&5
+echo "configure:9055: checking for demangle in -lC_r" >&5
 ac_lib_var=`echo C_r'_'demangle | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -9154,7 +9059,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lC_r  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 9158 "configure"
+#line 9063 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -9165,7 +9070,7 @@
 demangle()
 ; return 0; }
 EOF
-if { (eval echo configure:9169: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:9074: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -9195,7 +9100,7 @@
 	;;
      *)
 	echo $ac_n "checking for demangle in -lC""... $ac_c" 1>&6
-echo "configure:9199: checking for demangle in -lC" >&5
+echo "configure:9104: checking for demangle in -lC" >&5
 ac_lib_var=`echo C'_'demangle | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -9203,7 +9108,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lC  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 9207 "configure"
+#line 9112 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -9214,7 +9119,7 @@
 demangle()
 ; return 0; }
 EOF
-if { (eval echo configure:9218: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:9123: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -9245,7 +9150,7 @@
      esac
 fi
 echo $ac_n "checking for socket in -lsocket""... $ac_c" 1>&6
-echo "configure:9249: checking for socket in -lsocket" >&5
+echo "configure:9154: checking for socket in -lsocket" >&5
 ac_lib_var=`echo socket'_'socket | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -9253,7 +9158,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lsocket  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 9257 "configure"
+#line 9162 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -9264,7 +9169,7 @@
 socket()
 ; return 0; }
 EOF
-if { (eval echo configure:9268: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:9173: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -9309,7 +9214,7 @@
 	_SAVE_LDFLAGS="$LDFLAGS"
 	LDFLAGS="$XLDFLAGS $LDFLAGS"
 	echo $ac_n "checking for XDrawLines in -lX11""... $ac_c" 1>&6
-echo "configure:9313: checking for XDrawLines in -lX11" >&5
+echo "configure:9218: checking for XDrawLines in -lX11" >&5
 ac_lib_var=`echo X11'_'XDrawLines | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -9317,7 +9222,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lX11 $XLIBS $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 9321 "configure"
+#line 9226 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -9328,7 +9233,7 @@
 XDrawLines()
 ; return 0; }
 EOF
-if { (eval echo configure:9332: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:9237: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -9350,7 +9255,7 @@
 fi
 
 	echo $ac_n "checking for XextAddDisplay in -lXext""... $ac_c" 1>&6
-echo "configure:9354: checking for XextAddDisplay in -lXext" >&5
+echo "configure:9259: checking for XextAddDisplay in -lXext" >&5
 ac_lib_var=`echo Xext'_'XextAddDisplay | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -9358,7 +9263,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lXext $XLIBS $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 9362 "configure"
+#line 9267 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -9369,7 +9274,7 @@
 XextAddDisplay()
 ; return 0; }
 EOF
-if { (eval echo configure:9373: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:9278: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -9393,7 +9298,7 @@
    
      
 	echo $ac_n "checking for XtFree in -lXt""... $ac_c" 1>&6
-echo "configure:9397: checking for XtFree in -lXt" >&5
+echo "configure:9302: checking for XtFree in -lXt" >&5
 ac_lib_var=`echo Xt'_'XtFree | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -9401,7 +9306,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lXt  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 9405 "configure"
+#line 9310 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -9412,7 +9317,7 @@
 XtFree()
 ; return 0; }
 EOF
-if { (eval echo configure:9416: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:9321: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -9433,7 +9338,7 @@
 
         unset ac_cv_lib_Xt_XtFree
 	    echo $ac_n "checking for IceFlush in -lICE""... $ac_c" 1>&6
-echo "configure:9437: checking for IceFlush in -lICE" >&5
+echo "configure:9342: checking for IceFlush in -lICE" >&5
 ac_lib_var=`echo ICE'_'IceFlush | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -9441,7 +9346,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lICE $XT_LIBS $XLIBS $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 9445 "configure"
+#line 9350 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -9452,7 +9357,7 @@
 IceFlush()
 ; return 0; }
 EOF
-if { (eval echo configure:9456: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:9361: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -9473,7 +9378,7 @@
 fi
 
 	    echo $ac_n "checking for SmcCloseConnection in -lSM""... $ac_c" 1>&6
-echo "configure:9477: checking for SmcCloseConnection in -lSM" >&5
+echo "configure:9382: checking for SmcCloseConnection in -lSM" >&5
 ac_lib_var=`echo SM'_'SmcCloseConnection | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -9481,7 +9386,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lSM $XT_LIBS $XLIBS $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 9485 "configure"
+#line 9390 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -9492,7 +9397,7 @@
 SmcCloseConnection()
 ; return 0; }
 EOF
-if { (eval echo configure:9496: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:9401: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -9513,7 +9418,7 @@
 fi
  
         echo $ac_n "checking for XtFree in -lXt""... $ac_c" 1>&6
-echo "configure:9517: checking for XtFree in -lXt" >&5
+echo "configure:9422: checking for XtFree in -lXt" >&5
 ac_lib_var=`echo Xt'_'XtFree | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -9521,7 +9426,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lXt $X_PRE_LIBS $XT_LIBS $XLIBS $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 9525 "configure"
+#line 9430 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -9532,7 +9437,7 @@
 XtFree()
 ; return 0; }
 EOF
-if { (eval echo configure:9536: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:9441: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -9566,7 +9471,7 @@
     esac
 
                 echo $ac_n "checking for XShmCreateImage in -lXext""... $ac_c" 1>&6
-echo "configure:9570: checking for XShmCreateImage in -lXext" >&5
+echo "configure:9475: checking for XShmCreateImage in -lXext" >&5
 ac_lib_var=`echo Xext'_'XShmCreateImage | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -9574,7 +9479,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lXext $XLIBS $XEXT_LIBS $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 9578 "configure"
+#line 9483 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -9585,7 +9490,7 @@
 XShmCreateImage()
 ; return 0; }
 EOF
-if { (eval echo configure:9589: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:9494: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -9607,17 +9512,17 @@
 
     ac_safe=`echo "X11/extensions/XShm.h" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for X11/extensions/XShm.h""... $ac_c" 1>&6
-echo "configure:9611: checking for X11/extensions/XShm.h" >&5
+echo "configure:9516: checking for X11/extensions/XShm.h" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 9616 "configure"
+#line 9521 "configure"
 #include "confdefs.h"
 #include <X11/extensions/XShm.h>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:9621: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:9526: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -9647,7 +9552,7 @@
     fi
 
                 echo $ac_n "checking for XieFloGeometry in -lXIE""... $ac_c" 1>&6
-echo "configure:9651: checking for XieFloGeometry in -lXIE" >&5
+echo "configure:9556: checking for XieFloGeometry in -lXIE" >&5
 ac_lib_var=`echo XIE'_'XieFloGeometry | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -9655,7 +9560,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lXIE $XLIBS $XEXT_LIBS $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 9659 "configure"
+#line 9564 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -9666,7 +9571,7 @@
 XieFloGeometry()
 ; return 0; }
 EOF
-if { (eval echo configure:9670: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:9575: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -9688,17 +9593,17 @@
 
     ac_safe=`echo "X11/extensions/XIElib.h" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for X11/extensions/XIElib.h""... $ac_c" 1>&6
-echo "configure:9692: checking for X11/extensions/XIElib.h" >&5
+echo "configure:9597: checking for X11/extensions/XIElib.h" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 9697 "configure"
+#line 9602 "configure"
 #include "confdefs.h"
 #include <X11/extensions/XIElib.h>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:9702: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:9607: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -9772,7 +9677,7 @@
 # Extract the first word of "freetype-config", so it can be a program name with args.
 set dummy freetype-config; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:9776: checking for $ac_word" >&5
+echo "configure:9681: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_FT2_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -9808,7 +9713,7 @@
 
 min_ft_version=6.1.0
 echo $ac_n "checking for FreeType - version >= $min_ft_version""... $ac_c" 1>&6
-echo "configure:9812: checking for FreeType - version >= $min_ft_version" >&5
+echo "configure:9717: checking for FreeType - version >= $min_ft_version" >&5
 no_ft=""
 if test "$FT2_CONFIG" = "no" ; then
   no_ft=yes
@@ -9856,7 +9761,7 @@
   echo $ac_n "cross compiling; assumed OK... $ac_c"
 else
   cat > conftest.$ac_ext <<EOF
-#line 9860 "configure"
+#line 9765 "configure"
 #include "confdefs.h"
 
 #include <ft2build.h>
@@ -9882,7 +9787,7 @@
 }
 
 EOF
-if { (eval echo configure:9886: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
+if { (eval echo configure:9791: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
 then
   :
 else
@@ -9932,12 +9837,12 @@
     	CFLAGS="$CFLAGS $FT2_CFLAGS"
 
         echo $ac_n "checking for FT_Bitmap_Size.y_ppem""... $ac_c" 1>&6
-echo "configure:9936: checking for FT_Bitmap_Size.y_ppem" >&5
+echo "configure:9841: checking for FT_Bitmap_Size.y_ppem" >&5
 if eval "test \"`echo '$''{'ac_cv_member_FT_Bitmap_Size_y_ppem'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 9941 "configure"
+#line 9846 "configure"
 #include "confdefs.h"
 #include <ft2build.h>
                              #include FT_FREETYPE_H
@@ -9947,7 +9852,7 @@
                              return 1
 ; return 0; }
 EOF
-if { (eval echo configure:9951: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:9856: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_member_FT_Bitmap_Size_y_ppem=yes
 else
@@ -9973,12 +9878,12 @@
         for ac_func in FT_GlyphSlot_Embolden FT_Load_Sfnt_Table FT_Select_Size
 do
 echo $ac_n "checking for $ac_func""... $ac_c" 1>&6
-echo "configure:9977: checking for $ac_func" >&5
+echo "configure:9882: checking for $ac_func" >&5
 if eval "test \"`echo '$''{'ac_cv_func_$ac_func'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 9982 "configure"
+#line 9887 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char $ac_func(); below.  */
@@ -10001,7 +9906,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:10005: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:9910: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_$ac_func=yes"
 else
@@ -10044,7 +9949,7 @@
 *)
     
 echo $ac_n "checking for pthread_create in -lpthreads""... $ac_c" 1>&6
-echo "configure:10048: checking for pthread_create in -lpthreads" >&5
+echo "configure:9953: checking for pthread_create in -lpthreads" >&5
 echo "
     #include <pthread.h>
     #include <stdlib.h>
@@ -10067,7 +9972,7 @@
         echo "$ac_t""no" 1>&6
         
 echo $ac_n "checking for pthread_create in -lpthread""... $ac_c" 1>&6
-echo "configure:10071: checking for pthread_create in -lpthread" >&5
+echo "configure:9976: checking for pthread_create in -lpthread" >&5
 echo "
     #include <pthread.h>
     #include <stdlib.h>
@@ -10090,7 +9995,7 @@
         echo "$ac_t""no" 1>&6
         
 echo $ac_n "checking for pthread_create in -lc_r""... $ac_c" 1>&6
-echo "configure:10094: checking for pthread_create in -lc_r" >&5
+echo "configure:9999: checking for pthread_create in -lc_r" >&5
 echo "
     #include <pthread.h>
     #include <stdlib.h>
@@ -10113,7 +10018,7 @@
         echo "$ac_t""no" 1>&6
         
 echo $ac_n "checking for pthread_create in -lc""... $ac_c" 1>&6
-echo "configure:10117: checking for pthread_create in -lc" >&5
+echo "configure:10022: checking for pthread_create in -lc" >&5
 echo "
     #include <pthread.h>
     #include <stdlib.h>
@@ -10172,7 +10077,7 @@
 				rm -f conftest*
 	ac_cv_have_dash_pthread=no
 	echo $ac_n "checking whether ${CC-cc} accepts -pthread""... $ac_c" 1>&6
-echo "configure:10176: checking whether ${CC-cc} accepts -pthread" >&5
+echo "configure:10081: checking whether ${CC-cc} accepts -pthread" >&5
 	echo 'int main() { return 0; }' | cat > conftest.c
 	${CC-cc} -pthread -o conftest conftest.c > conftest.out 2>&1
 	if test $? -eq 0; then
@@ -10195,7 +10100,7 @@
 			    ac_cv_have_dash_pthreads=no
     if test "$ac_cv_have_dash_pthread" = "no"; then
 	    echo $ac_n "checking whether ${CC-cc} accepts -pthreads""... $ac_c" 1>&6
-echo "configure:10199: checking whether ${CC-cc} accepts -pthreads" >&5
+echo "configure:10104: checking whether ${CC-cc} accepts -pthreads" >&5
     	echo 'int main() { return 0; }' | cat > conftest.c
 	    ${CC-cc} -pthreads -o conftest conftest.c > conftest.out 2>&1
     	if test $? -eq 0; then
@@ -10240,7 +10145,7 @@
 			fi
 			;;
 
-	    *-*-linux*|*-*-kfreebsd*-gnu)
+	    *-*-linux*|*-*-kfreebsd*-gnu|*-*-gnu*)
 			cat >> confdefs.h <<\EOF
 #define _REENTRANT 1
 EOF
@@ -10290,7 +10195,7 @@
 fi
 
 echo $ac_n "checking whether mmap() sees write()s""... $ac_c" 1>&6
-echo "configure:10294: checking whether mmap() sees write()s" >&5
+echo "configure:10199: checking whether mmap() sees write()s" >&5
 
 
 mmap_test_prog='
@@ -10329,11 +10234,11 @@
   result="yes"
 else
   cat > conftest.$ac_ext <<EOF
-#line 10333 "configure"
+#line 10238 "configure"
 #include "confdefs.h"
 $mmap_test_prog 
 EOF
-if { (eval echo configure:10337: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
+if { (eval echo configure:10242: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
 then
   result="yes"
 else
@@ -10358,13 +10263,13 @@
 
 if test $ac_cv_prog_gcc = yes; then
     echo $ac_n "checking whether ${CC-cc} needs -traditional""... $ac_c" 1>&6
-echo "configure:10362: checking whether ${CC-cc} needs -traditional" >&5
+echo "configure:10267: checking whether ${CC-cc} needs -traditional" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_gcc_traditional'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
     ac_pattern="Autoconf.*'x'"
   cat > conftest.$ac_ext <<EOF
-#line 10368 "configure"
+#line 10273 "configure"
 #include "confdefs.h"
 #include <sgtty.h>
 Autoconf TIOCGETP
@@ -10382,7 +10287,7 @@
 
   if test $ac_cv_prog_gcc_traditional = no; then
     cat > conftest.$ac_ext <<EOF
-#line 10386 "configure"
+#line 10291 "configure"
 #include "confdefs.h"
 #include <termio.h>
 Autoconf TCGETA
@@ -10404,7 +10309,7 @@
 fi
 
 echo $ac_n "checking for 8-bit clean memcmp""... $ac_c" 1>&6
-echo "configure:10408: checking for 8-bit clean memcmp" >&5
+echo "configure:10313: checking for 8-bit clean memcmp" >&5
 if eval "test \"`echo '$''{'ac_cv_func_memcmp_clean'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -10412,7 +10317,7 @@
   ac_cv_func_memcmp_clean=no
 else
   cat > conftest.$ac_ext <<EOF
-#line 10416 "configure"
+#line 10321 "configure"
 #include "confdefs.h"
 
 main()
@@ -10422,7 +10327,7 @@
 }
 
 EOF
-if { (eval echo configure:10426: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
+if { (eval echo configure:10331: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
 then
   ac_cv_func_memcmp_clean=yes
 else
@@ -10442,12 +10347,12 @@
 for ac_func in random strerror lchown fchmod snprintf statvfs memmove rint stat64 lstat64 truncate64 statvfs64
 do
 echo $ac_n "checking for $ac_func""... $ac_c" 1>&6
-echo "configure:10446: checking for $ac_func" >&5
+echo "configure:10351: checking for $ac_func" >&5
 if eval "test \"`echo '$''{'ac_cv_func_$ac_func'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 10451 "configure"
+#line 10356 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char $ac_func(); below.  */
@@ -10470,7 +10375,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:10474: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:10379: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_$ac_func=yes"
 else
@@ -10497,12 +10402,12 @@
 for ac_func in flockfile getpagesize
 do
 echo $ac_n "checking for $ac_func""... $ac_c" 1>&6
-echo "configure:10501: checking for $ac_func" >&5
+echo "configure:10406: checking for $ac_func" >&5
 if eval "test \"`echo '$''{'ac_cv_func_$ac_func'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 10506 "configure"
+#line 10411 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char $ac_func(); below.  */
@@ -10525,7 +10430,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:10529: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:10434: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_$ac_func=yes"
 else
@@ -10554,12 +10459,12 @@
   for ac_func in localtime_r strtok_r
 do
 echo $ac_n "checking for $ac_func""... $ac_c" 1>&6
-echo "configure:10558: checking for $ac_func" >&5
+echo "configure:10463: checking for $ac_func" >&5
 if eval "test \"`echo '$''{'ac_cv_func_$ac_func'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 10563 "configure"
+#line 10468 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char $ac_func(); below.  */
@@ -10582,7 +10487,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:10586: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:10491: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_$ac_func=yes"
 else
@@ -10618,19 +10523,19 @@
 cross_compiling=$ac_cv_prog_cxx_cross
 
 echo $ac_n "checking for wcrtomb""... $ac_c" 1>&6
-echo "configure:10622: checking for wcrtomb" >&5
+echo "configure:10527: checking for wcrtomb" >&5
 if eval "test \"`echo '$''{'ac_cv_have_wcrtomb'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 10627 "configure"
+#line 10532 "configure"
 #include "confdefs.h"
 #include <wchar.h>
 int main() {
 mbstate_t ps={0};wcrtomb(0,'f',&ps);
 ; return 0; }
 EOF
-if { (eval echo configure:10634: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:10539: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   ac_cv_have_wcrtomb="yes"
 else
@@ -10650,19 +10555,19 @@
 
 fi
 echo $ac_n "checking for mbrtowc""... $ac_c" 1>&6
-echo "configure:10654: checking for mbrtowc" >&5
+echo "configure:10559: checking for mbrtowc" >&5
 if eval "test \"`echo '$''{'ac_cv_have_mbrtowc'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 10659 "configure"
+#line 10564 "configure"
 #include "confdefs.h"
 #include <wchar.h>
 int main() {
 mbstate_t ps={0};mbrtowc(0,0,0,&ps);
 ; return 0; }
 EOF
-if { (eval echo configure:10666: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:10571: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   ac_cv_have_mbrtowc="yes"
 else
@@ -10691,12 +10596,12 @@
 fi
 
 echo $ac_n "checking for res_ninit()""... $ac_c" 1>&6
-echo "configure:10695: checking for res_ninit()" >&5
+echo "configure:10600: checking for res_ninit()" >&5
 if eval "test \"`echo '$''{'ac_cv_func_res_ninit'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 10700 "configure"
+#line 10605 "configure"
 #include "confdefs.h"
 
         #ifdef linux
@@ -10708,7 +10613,7 @@
 int foo = res_ninit(&_res);
 ; return 0; }
 EOF
-if { (eval echo configure:10712: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:10617: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   ac_cv_func_res_ninit=yes
 else
@@ -10738,12 +10643,12 @@
 cross_compiling=$ac_cv_prog_cxx_cross
 
 echo $ac_n "checking for gnu_get_libc_version()""... $ac_c" 1>&6
-echo "configure:10742: checking for gnu_get_libc_version()" >&5
+echo "configure:10647: checking for gnu_get_libc_version()" >&5
 if eval "test \"`echo '$''{'ac_cv_func_gnu_get_libc_version'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 10747 "configure"
+#line 10652 "configure"
 #include "confdefs.h"
 
         #ifdef HAVE_GNU_LIBC_VERSION_H
@@ -10754,7 +10659,7 @@
 const char *glibc_version = gnu_get_libc_version();
 ; return 0; }
 EOF
-if { (eval echo configure:10758: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:10663: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   ac_cv_func_gnu_get_libc_version=yes
 else
@@ -10783,7 +10688,7 @@
     *)
     
 echo $ac_n "checking for iconv in -lc""... $ac_c" 1>&6
-echo "configure:10787: checking for iconv in -lc" >&5
+echo "configure:10692: checking for iconv in -lc" >&5
 ac_lib_var=`echo c'_'iconv | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -10791,7 +10696,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lc  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 10795 "configure"
+#line 10700 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 #ifdef __cplusplus
@@ -10805,7 +10710,7 @@
 iconv()
 ; return 0; }
 EOF
-if { (eval echo configure:10809: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:10714: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -10824,7 +10729,7 @@
 else
   echo "$ac_t""no" 1>&6
 echo $ac_n "checking for iconv in -liconv""... $ac_c" 1>&6
-echo "configure:10828: checking for iconv in -liconv" >&5
+echo "configure:10733: checking for iconv in -liconv" >&5
 ac_lib_var=`echo iconv'_'iconv | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -10832,7 +10737,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-liconv  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 10836 "configure"
+#line 10741 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 #ifdef __cplusplus
@@ -10846,7 +10751,7 @@
 iconv()
 ; return 0; }
 EOF
-if { (eval echo configure:10850: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:10755: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -10865,7 +10770,7 @@
 else
   echo "$ac_t""no" 1>&6
 echo $ac_n "checking for libiconv in -liconv""... $ac_c" 1>&6
-echo "configure:10869: checking for libiconv in -liconv" >&5
+echo "configure:10774: checking for libiconv in -liconv" >&5
 ac_lib_var=`echo iconv'_'libiconv | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -10873,7 +10778,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-liconv  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 10877 "configure"
+#line 10782 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 #ifdef __cplusplus
@@ -10887,7 +10792,7 @@
 libiconv()
 ; return 0; }
 EOF
-if { (eval echo configure:10891: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:10796: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -10914,12 +10819,12 @@
 _SAVE_LIBS=$LIBS
 LIBS="$LIBS $_ICONV_LIBS"
 echo $ac_n "checking for iconv()""... $ac_c" 1>&6
-echo "configure:10918: checking for iconv()" >&5
+echo "configure:10823: checking for iconv()" >&5
 if eval "test \"`echo '$''{'ac_cv_func_iconv'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 10923 "configure"
+#line 10828 "configure"
 #include "confdefs.h"
 
         #include <stdlib.h>
@@ -10933,7 +10838,7 @@
         
 ; return 0; }
 EOF
-if { (eval echo configure:10937: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:10842: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   ac_cv_func_iconv=yes
 else
@@ -10957,12 +10862,12 @@
     LIBXUL_LIBS="$LIBXUL_LIBS $_ICONV_LIBS"
     LIBICONV="$_ICONV_LIBS"
     echo $ac_n "checking for iconv() with const input""... $ac_c" 1>&6
-echo "configure:10961: checking for iconv() with const input" >&5
+echo "configure:10866: checking for iconv() with const input" >&5
 if eval "test \"`echo '$''{'ac_cv_func_const_iconv'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 10966 "configure"
+#line 10871 "configure"
 #include "confdefs.h"
 
             #include <stdlib.h>
@@ -10977,7 +10882,7 @@
             
 ; return 0; }
 EOF
-if { (eval echo configure:10981: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:10886: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_func_const_iconv=yes
 else
@@ -11006,19 +10911,19 @@
 
 
   echo $ac_n "checking for nl_langinfo and CODESET""... $ac_c" 1>&6
-echo "configure:11010: checking for nl_langinfo and CODESET" >&5
+echo "configure:10915: checking for nl_langinfo and CODESET" >&5
 if eval "test \"`echo '$''{'am_cv_langinfo_codeset'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 11015 "configure"
+#line 10920 "configure"
 #include "confdefs.h"
 #include <langinfo.h>
 int main() {
 char* cs = nl_langinfo(CODESET);
 ; return 0; }
 EOF
-if { (eval echo configure:11022: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:10927: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   am_cv_langinfo_codeset=yes
 else
@@ -11050,7 +10955,7 @@
 
 
 echo $ac_n "checking for an implementation of va_copy()""... $ac_c" 1>&6
-echo "configure:11054: checking for an implementation of va_copy()" >&5
+echo "configure:10959: checking for an implementation of va_copy()" >&5
 if eval "test \"`echo '$''{'ac_cv_va_copy'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -11060,7 +10965,7 @@
     
 else
   cat > conftest.$ac_ext <<EOF
-#line 11064 "configure"
+#line 10969 "configure"
 #include "confdefs.h"
 
         #include <stdarg.h>
@@ -11074,7 +10979,7 @@
         }
         int main() { f (0, 42); return 0; }
 EOF
-if { (eval echo configure:11078: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
+if { (eval echo configure:10983: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
 then
   ac_cv_va_copy=yes
 else
@@ -11091,7 +10996,7 @@
 
 echo "$ac_t""$ac_cv_va_copy" 1>&6
 echo $ac_n "checking for an implementation of __va_copy()""... $ac_c" 1>&6
-echo "configure:11095: checking for an implementation of __va_copy()" >&5
+echo "configure:11000: checking for an implementation of __va_copy()" >&5
 if eval "test \"`echo '$''{'ac_cv___va_copy'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -11101,7 +11006,7 @@
     
 else
   cat > conftest.$ac_ext <<EOF
-#line 11105 "configure"
+#line 11010 "configure"
 #include "confdefs.h"
 
         #include <stdarg.h>
@@ -11115,7 +11020,7 @@
         }
         int main() { f (0, 42); return 0; }
 EOF
-if { (eval echo configure:11119: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
+if { (eval echo configure:11024: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
 then
   ac_cv___va_copy=yes
 else
@@ -11132,7 +11037,7 @@
 
 echo "$ac_t""$ac_cv___va_copy" 1>&6
 echo $ac_n "checking whether va_lists can be copied by value""... $ac_c" 1>&6
-echo "configure:11136: checking whether va_lists can be copied by value" >&5
+echo "configure:11041: checking whether va_lists can be copied by value" >&5
 if eval "test \"`echo '$''{'ac_cv_va_val_copy'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -11142,7 +11047,7 @@
     
 else
   cat > conftest.$ac_ext <<EOF
-#line 11146 "configure"
+#line 11051 "configure"
 #include "confdefs.h"
 
         #include <stdarg.h>
@@ -11156,7 +11061,7 @@
         }
         int main() { f (0, 42); return 0; }
 EOF
-if { (eval echo configure:11160: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
+if { (eval echo configure:11065: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
 then
   ac_cv_va_val_copy=yes
 else
@@ -11255,7 +11160,7 @@
 if test "$GNU_CXX"; then
 
   echo $ac_n "checking for C++ exceptions flag""... $ac_c" 1>&6
-echo "configure:11259: checking for C++ exceptions flag" >&5
+echo "configure:11164: checking for C++ exceptions flag" >&5
 
     if eval "test \"`echo '$''{'ac_cv_cxx_exceptions_flags'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -11290,12 +11195,12 @@
 HAVE_GCC3_ABI=
 if test "$GNU_CC"; then
   echo $ac_n "checking for gcc 3.0 ABI""... $ac_c" 1>&6
-echo "configure:11294: checking for gcc 3.0 ABI" >&5
+echo "configure:11199: checking for gcc 3.0 ABI" >&5
 if eval "test \"`echo '$''{'ac_cv_gcc_three_abi'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 11299 "configure"
+#line 11204 "configure"
 #include "confdefs.h"
 
 int main() {
@@ -11308,7 +11213,7 @@
                       
 ; return 0; }
 EOF
-if { (eval echo configure:11312: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:11217: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_gcc_three_abi="yes"
 else
@@ -11332,12 +11237,12 @@
 
 
 echo $ac_n "checking for C++ \"explicit\" keyword""... $ac_c" 1>&6
-echo "configure:11336: checking for C++ \"explicit\" keyword" >&5
+echo "configure:11241: checking for C++ \"explicit\" keyword" >&5
 if eval "test \"`echo '$''{'ac_cv_cpp_explicit'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 11341 "configure"
+#line 11246 "configure"
 #include "confdefs.h"
 class X {
                                public: explicit X(int i) : i_(i) {}
@@ -11347,7 +11252,7 @@
 X x(3);
 ; return 0; }
 EOF
-if { (eval echo configure:11351: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:11256: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_cpp_explicit=yes
 else
@@ -11368,12 +11273,12 @@
 fi
 
 echo $ac_n "checking for C++ \"typename\" keyword""... $ac_c" 1>&6
-echo "configure:11372: checking for C++ \"typename\" keyword" >&5
+echo "configure:11277: checking for C++ \"typename\" keyword" >&5
 if eval "test \"`echo '$''{'ac_cv_cpp_typename'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 11377 "configure"
+#line 11282 "configure"
 #include "confdefs.h"
 class param {
                                public:
@@ -11392,7 +11297,7 @@
                                A.foo(0);
 ; return 0; }
 EOF
-if { (eval echo configure:11396: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:11301: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_cpp_typename=yes
 else
@@ -11413,12 +11318,12 @@
 fi
 
 echo $ac_n "checking for modern C++ template specialization syntax support""... $ac_c" 1>&6
-echo "configure:11417: checking for modern C++ template specialization syntax support" >&5
+echo "configure:11322: checking for modern C++ template specialization syntax support" >&5
 if eval "test \"`echo '$''{'ac_cv_cpp_modern_specialize_template_syntax'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 11422 "configure"
+#line 11327 "configure"
 #include "confdefs.h"
 template <class T> struct X { int a; };
                                class Y {};
@@ -11428,7 +11333,7 @@
                                X<Y> y_x;
 ; return 0; }
 EOF
-if { (eval echo configure:11432: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:11337: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_cpp_modern_specialize_template_syntax=yes
 else
@@ -11450,12 +11355,12 @@
 
 
 echo $ac_n "checking whether partial template specialization works""... $ac_c" 1>&6
-echo "configure:11454: checking whether partial template specialization works" >&5
+echo "configure:11359: checking whether partial template specialization works" >&5
 if eval "test \"`echo '$''{'ac_cv_cpp_partial_specialization'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 11459 "configure"
+#line 11364 "configure"
 #include "confdefs.h"
 template <class T> class Foo {};
                                template <class T> class Foo<T*> {};
@@ -11463,7 +11368,7 @@
 return 0;
 ; return 0; }
 EOF
-if { (eval echo configure:11467: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:11372: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_cpp_partial_specialization=yes
 else
@@ -11484,12 +11389,12 @@
 fi
 
 echo $ac_n "checking whether operators must be re-defined for templates derived from templates""... $ac_c" 1>&6
-echo "configure:11488: checking whether operators must be re-defined for templates derived from templates" >&5
+echo "configure:11393: checking whether operators must be re-defined for templates derived from templates" >&5
 if eval "test \"`echo '$''{'ac_cv_need_derived_template_operators'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 11493 "configure"
+#line 11398 "configure"
 #include "confdefs.h"
 template <class T> class Base { };
                                 template <class T>
@@ -11501,7 +11406,7 @@
                                 return 0;
 ; return 0; }
 EOF
-if { (eval echo configure:11505: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:11410: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_need_derived_template_operators=no
 else
@@ -11523,12 +11428,12 @@
 
 
 echo $ac_n "checking whether we need to cast a derived template to pass as its base class""... $ac_c" 1>&6
-echo "configure:11527: checking whether we need to cast a derived template to pass as its base class" >&5
+echo "configure:11432: checking whether we need to cast a derived template to pass as its base class" >&5
 if eval "test \"`echo '$''{'ac_cv_need_cpp_template_cast_to_base'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 11532 "configure"
+#line 11437 "configure"
 #include "confdefs.h"
 template <class T> class Base { };
                                 template <class T> class Derived : public Base<T> { };
@@ -11537,7 +11442,7 @@
 Derived<char> bar; return foo(bar);
 ; return 0; }
 EOF
-if { (eval echo configure:11541: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:11446: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_need_cpp_template_cast_to_base=no
 else
@@ -11558,12 +11463,12 @@
 fi
 
 echo $ac_n "checking whether the compiler can resolve const ambiguities for templates""... $ac_c" 1>&6
-echo "configure:11562: checking whether the compiler can resolve const ambiguities for templates" >&5
+echo "configure:11467: checking whether the compiler can resolve const ambiguities for templates" >&5
 if eval "test \"`echo '$''{'ac_cv_can_resolve_const_ambiguity'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 11567 "configure"
+#line 11472 "configure"
 #include "confdefs.h"
 
                                 template <class T> class ptrClass {
@@ -11584,7 +11489,7 @@
                                  a(&i); 
 ; return 0; }
 EOF
-if { (eval echo configure:11588: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:11493: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_can_resolve_const_ambiguity=yes
 else
@@ -11606,12 +11511,12 @@
 
 
 echo $ac_n "checking whether the C++ \"using\" keyword can change access""... $ac_c" 1>&6
-echo "configure:11610: checking whether the C++ \"using\" keyword can change access" >&5
+echo "configure:11515: checking whether the C++ \"using\" keyword can change access" >&5
 if eval "test \"`echo '$''{'ac_cv_cpp_access_changing_using2'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 11615 "configure"
+#line 11520 "configure"
 #include "confdefs.h"
 class A { protected: int foo() { return 0; } };
                    class B : public A { public: using A::foo; };
@@ -11619,10 +11524,10 @@
 B b; return b.foo();
 ; return 0; }
 EOF
-if { (eval echo configure:11623: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:11528: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   cat > conftest.$ac_ext <<EOF
-#line 11626 "configure"
+#line 11531 "configure"
 #include "confdefs.h"
 class A { public: int foo() { return 1; } };
                        class B : public A { private: using A::foo; };
@@ -11630,7 +11535,7 @@
 B b; return b.foo();
 ; return 0; }
 EOF
-if { (eval echo configure:11634: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:11539: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_cpp_access_changing_using2=no
 else
@@ -11658,12 +11563,12 @@
 fi
 
 echo $ac_n "checking whether the C++ \"using\" keyword resolves ambiguity""... $ac_c" 1>&6
-echo "configure:11662: checking whether the C++ \"using\" keyword resolves ambiguity" >&5
+echo "configure:11567: checking whether the C++ \"using\" keyword resolves ambiguity" >&5
 if eval "test \"`echo '$''{'ac_cv_cpp_ambiguity_resolving_using'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 11667 "configure"
+#line 11572 "configure"
 #include "confdefs.h"
 class X { 
                                  public: int go(const X&) {return 3;}
@@ -11679,7 +11584,7 @@
 X x; Y y; y.jo(x);
 ; return 0; }
 EOF
-if { (eval echo configure:11683: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:11588: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_cpp_ambiguity_resolving_using=yes
 else
@@ -11700,19 +11605,19 @@
 fi
 
 echo $ac_n "checking for \"std::\" namespace""... $ac_c" 1>&6
-echo "configure:11704: checking for \"std::\" namespace" >&5
+echo "configure:11609: checking for \"std::\" namespace" >&5
 if eval "test \"`echo '$''{'ac_cv_cpp_namespace_std'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 11709 "configure"
+#line 11614 "configure"
 #include "confdefs.h"
 #include <algorithm>
 int main() {
 return std::min(0, 1);
 ; return 0; }
 EOF
-if { (eval echo configure:11716: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:11621: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_cpp_namespace_std=yes
 else
@@ -11733,12 +11638,12 @@
 fi
 
 echo $ac_n "checking whether standard template operator!=() is ambiguous""... $ac_c" 1>&6
-echo "configure:11737: checking whether standard template operator!=() is ambiguous" >&5
+echo "configure:11642: checking whether standard template operator!=() is ambiguous" >&5
 if eval "test \"`echo '$''{'ac_cv_cpp_unambiguous_std_notequal'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 11742 "configure"
+#line 11647 "configure"
 #include "confdefs.h"
 #include <algorithm>
                                 struct T1 {};
@@ -11748,7 +11653,7 @@
 T1 a,b; return a != b;
 ; return 0; }
 EOF
-if { (eval echo configure:11752: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:11657: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_cpp_unambiguous_std_notequal=unambiguous
 else
@@ -11770,12 +11675,12 @@
 
 
 echo $ac_n "checking for C++ reinterpret_cast""... $ac_c" 1>&6
-echo "configure:11774: checking for C++ reinterpret_cast" >&5
+echo "configure:11679: checking for C++ reinterpret_cast" >&5
 if eval "test \"`echo '$''{'ac_cv_cpp_reinterpret_cast'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 11779 "configure"
+#line 11684 "configure"
 #include "confdefs.h"
 struct X { int i; };
                                struct Y { int i; };
@@ -11783,7 +11688,7 @@
 X x; X*const z = &x;Y*y = reinterpret_cast<Y*>(z);
 ; return 0; }
 EOF
-if { (eval echo configure:11787: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:11692: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_cpp_reinterpret_cast=yes
 else
@@ -11804,7 +11709,7 @@
 fi
 
 echo $ac_n "checking for C++ dynamic_cast to void*""... $ac_c" 1>&6
-echo "configure:11808: checking for C++ dynamic_cast to void*" >&5
+echo "configure:11713: checking for C++ dynamic_cast to void*" >&5
 if eval "test \"`echo '$''{'ac_cv_cpp_dynamic_cast_void_ptr'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -11812,8 +11717,11 @@
   ac_cv_cpp_dynamic_cast_void_ptr=no
 else
   cat > conftest.$ac_ext <<EOF
-#line 11816 "configure"
+#line 11721 "configure"
 #include "confdefs.h"
+#ifdef __cplusplus
+extern "C" void exit(int);
+#endif
 class X { int i; public: virtual ~X() { } };
                             class Y { int j; public: virtual ~Y() { } };
                             class Z : public X, public Y { int k; };
@@ -11828,7 +11736,7 @@
                                            ((void*)&mdo == dynamic_cast<void*>(suby))));
                             }
 EOF
-if { (eval echo configure:11832: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
+if { (eval echo configure:11740: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
 then
   ac_cv_cpp_dynamic_cast_void_ptr=yes
 else
@@ -11852,19 +11760,19 @@
 
 
 echo $ac_n "checking whether C++ requires implementation of unused virtual methods""... $ac_c" 1>&6
-echo "configure:11856: checking whether C++ requires implementation of unused virtual methods" >&5
+echo "configure:11764: checking whether C++ requires implementation of unused virtual methods" >&5
 if eval "test \"`echo '$''{'ac_cv_cpp_unused_required'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 11861 "configure"
+#line 11769 "configure"
 #include "confdefs.h"
 class X {private: virtual void never_called();};
 int main() {
 X x;
 ; return 0; }
 EOF
-if { (eval echo configure:11868: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:11776: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   ac_cv_cpp_unused_required=no
 else
@@ -11887,12 +11795,12 @@
 
 
 echo $ac_n "checking for trouble comparing to zero near std::operator!=()""... $ac_c" 1>&6
-echo "configure:11891: checking for trouble comparing to zero near std::operator!=()" >&5
+echo "configure:11799: checking for trouble comparing to zero near std::operator!=()" >&5
 if eval "test \"`echo '$''{'ac_cv_trouble_comparing_to_zero'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 11896 "configure"
+#line 11804 "configure"
 #include "confdefs.h"
 #include <algorithm>
                                 template <class T> class Foo {};
@@ -11903,7 +11811,7 @@
 Foo<int> f; return (0 != f);
 ; return 0; }
 EOF
-if { (eval echo configure:11907: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:11815: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_trouble_comparing_to_zero=no
 else
@@ -11935,19 +11843,19 @@
 
 
 echo $ac_n "checking for LC_MESSAGES""... $ac_c" 1>&6
-echo "configure:11939: checking for LC_MESSAGES" >&5
+echo "configure:11847: checking for LC_MESSAGES" >&5
 if eval "test \"`echo '$''{'ac_cv_i18n_lc_messages'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 11944 "configure"
+#line 11852 "configure"
 #include "confdefs.h"
 #include <locale.h>
 int main() {
 int category = LC_MESSAGES;
 ; return 0; }
 EOF
-if { (eval echo configure:11951: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:11859: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_cv_i18n_lc_messages=yes
 else
@@ -12050,7 +11958,7 @@
 	# Extract the first word of "nspr-config", so it can be a program name with args.
 set dummy nspr-config; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:12054: checking for $ac_word" >&5
+echo "configure:11962: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_NSPR_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -12085,7 +11993,7 @@
 
 	min_nspr_version=4.7.0
 	echo $ac_n "checking for NSPR - version >= $min_nspr_version""... $ac_c" 1>&6
-echo "configure:12089: checking for NSPR - version >= $min_nspr_version" >&5
+echo "configure:11997: checking for NSPR - version >= $min_nspr_version" >&5
 
 	no_nspr=""
 	if test "$NSPR_CONFIG" = "no"; then
@@ -12136,7 +12044,7 @@
     _SAVE_CFLAGS=$CFLAGS
     CFLAGS="$CFLAGS $NSPR_CFLAGS"
     cat > conftest.$ac_ext <<EOF
-#line 12140 "configure"
+#line 12048 "configure"
 #include "confdefs.h"
 #include "prlog.h"
 int main() {
@@ -12145,7 +12053,7 @@
                  #endif
 ; return 0; }
 EOF
-if { (eval echo configure:12149: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:12057: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   MOZ_NATIVE_NSPR=1
 else
@@ -12227,7 +12135,7 @@
 	# Extract the first word of "nss-config", so it can be a program name with args.
 set dummy nss-config; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:12231: checking for $ac_word" >&5
+echo "configure:12139: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_NSS_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -12262,7 +12170,7 @@
 
 	min_nss_version=3.12.0
 	echo $ac_n "checking for NSS - version >= $min_nss_version""... $ac_c" 1>&6
-echo "configure:12266: checking for NSS - version >= $min_nss_version" >&5
+echo "configure:12174: checking for NSS - version >= $min_nss_version" >&5
 
 	no_nss=""
 	if test "$NSS_CONFIG" = "no"; then
@@ -12310,7 +12218,7 @@
 fi
 
 if test -n "$MOZ_NATIVE_NSS"; then
-   NSS_LIBS="$NSS_LIBS -lcrmf"
+   NSS_LIBS=`echo $NSS_LIBS | sed 's/-l/-lcrmf &/'`
 else
    NSS_CFLAGS='-I$(LIBXUL_DIST)/include/nss'
    NSS_DEP_LIBS="\
@@ -12353,7 +12261,7 @@
     SYSTEM_JPEG=
 else
     echo $ac_n "checking for jpeg_destroy_compress in -ljpeg""... $ac_c" 1>&6
-echo "configure:12357: checking for jpeg_destroy_compress in -ljpeg" >&5
+echo "configure:12265: checking for jpeg_destroy_compress in -ljpeg" >&5
 ac_lib_var=`echo jpeg'_'jpeg_destroy_compress | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -12361,7 +12269,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-ljpeg $JPEG_LIBS $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 12365 "configure"
+#line 12273 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -12372,7 +12280,7 @@
 jpeg_destroy_compress()
 ; return 0; }
 EOF
-if { (eval echo configure:12376: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:12284: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -12395,10 +12303,10 @@
 
 fi
 
-if test "$SYSTEM_JPEG" = 1; then
+if test "$SYSTEM_JPEG" = 0; then
     LIBS="$JPEG_LIBS $LIBS"
     cat > conftest.$ac_ext <<EOF
-#line 12402 "configure"
+#line 12310 "configure"
 #include "confdefs.h"
  #include <stdio.h>
                      #include <sys/types.h>
@@ -12409,7 +12317,7 @@
                      #endif 
 ; return 0; }
 EOF
-if { (eval echo configure:12413: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:12321: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   SYSTEM_JPEG=1
 else
@@ -12447,7 +12355,7 @@
     SYSTEM_ZLIB=
 else
     echo $ac_n "checking for gzread in -lz""... $ac_c" 1>&6
-echo "configure:12451: checking for gzread in -lz" >&5
+echo "configure:12359: checking for gzread in -lz" >&5
 ac_lib_var=`echo z'_'gzread | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -12455,7 +12363,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lz $ZLIB_LIBS $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 12459 "configure"
+#line 12367 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -12466,7 +12374,7 @@
 gzread()
 ; return 0; }
 EOF
-if { (eval echo configure:12470: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:12378: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -12488,10 +12396,10 @@
 fi
 
 fi
-if test "$SYSTEM_ZLIB" = 1; then
+if test "$SYSTEM_ZLIB" = 0; then
     LIBS="$ZLIB_LIBS $LIBS"
     cat > conftest.$ac_ext <<EOF
-#line 12495 "configure"
+#line 12403 "configure"
 #include "confdefs.h"
  #include <stdio.h>
                      #include <string.h>
@@ -12502,7 +12410,7 @@
                      #endif 
 ; return 0; }
 EOF
-if { (eval echo configure:12506: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:12414: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   SYSTEM_ZLIB=1
 else
@@ -12540,7 +12448,7 @@
     SYSTEM_BZ2=
 else
     echo $ac_n "checking for BZ2_bzread in -lbz2""... $ac_c" 1>&6
-echo "configure:12544: checking for BZ2_bzread in -lbz2" >&5
+echo "configure:12452: checking for BZ2_bzread in -lbz2" >&5
 ac_lib_var=`echo bz2'_'BZ2_bzread | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -12548,7 +12456,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lbz2 $BZ2_LIBS $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 12552 "configure"
+#line 12460 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -12559,7 +12467,7 @@
 BZ2_bzread()
 ; return 0; }
 EOF
-if { (eval echo configure:12563: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:12471: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -12606,12 +12514,13 @@
     CFLAGS="-I${PNG_DIR}/include $CFLAGS"
     LDFLAGS="-L${PNG_DIR}/lib $LDFLAGS"
 fi
+APNG=1
 if test -z "$PNG_DIR" -o "$PNG_DIR" = no; then
     SYSTEM_PNG=
 else
     _SAVE_PNG_LIBS=$PNG_LIBS
     echo $ac_n "checking for png_get_valid in -lpng""... $ac_c" 1>&6
-echo "configure:12615: checking for png_get_valid in -lpng" >&5
+echo "configure:12524: checking for png_get_valid in -lpng" >&5
 ac_lib_var=`echo png'_'png_get_valid | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -12619,7 +12528,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lpng $PNG_LIBS $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 12623 "configure"
+#line 12532 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -12630,7 +12539,7 @@
 png_get_valid()
 ; return 0; }
 EOF
-if { (eval echo configure:12634: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:12543: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -12652,7 +12561,7 @@
 fi
 
     echo $ac_n "checking for png_get_acTL in -lpng""... $ac_c" 1>&6
-echo "configure:12656: checking for png_get_acTL in -lpng" >&5
+echo "configure:12565: checking for png_get_acTL in -lpng" >&5
 ac_lib_var=`echo png'_'png_get_acTL | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -12660,7 +12569,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lpng $_SAVE_PNG_LIBS $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 12664 "configure"
+#line 12573 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -12671,7 +12580,7 @@
 png_get_acTL()
 ; return 0; }
 EOF
-if { (eval echo configure:12675: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:12584: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -12696,14 +12605,15 @@
 
 else
   echo "$ac_t""no" 1>&6
-{ echo "configure: error: --with-system-png won't work because the system's libpng doesn't have APNG support" 1>&2; exit 1; }
+echo "configure: warning: system's libpng doesn't have APNG support" 1>&2
+		 APNG=
 fi
 
 fi
-if test "$SYSTEM_PNG" = 1; then
+if test "$SYSTEM_PNG" = 0; then
     LIBS="$PNG_LIBS $LIBS"
     cat > conftest.$ac_ext <<EOF
-#line 12707 "configure"
+#line 12617 "configure"
 #include "confdefs.h"
  #include <stdio.h>
                      #include <sys/types.h>
@@ -12717,7 +12627,7 @@
                      #endif 
 ; return 0; }
 EOF
-if { (eval echo configure:12721: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:12631: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   SYSTEM_PNG=1
 else
@@ -12759,7 +12669,7 @@
     # Extract the first word of "pkg-config", so it can be a program name with args.
 set dummy pkg-config; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:12763: checking for $ac_word" >&5
+echo "configure:12673: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_PKG_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -12803,19 +12713,19 @@
      PKG_CONFIG_MIN_VERSION=0.9.0
      if $PKG_CONFIG --atleast-pkgconfig-version $PKG_CONFIG_MIN_VERSION; then
         echo $ac_n "checking for hunspell""... $ac_c" 1>&6
-echo "configure:12807: checking for hunspell" >&5
+echo "configure:12717: checking for hunspell" >&5
 
         if $PKG_CONFIG --exists "hunspell" ; then
             echo "$ac_t""yes" 1>&6
             succeeded=yes
 
             echo $ac_n "checking MOZ_HUNSPELL_CFLAGS""... $ac_c" 1>&6
-echo "configure:12814: checking MOZ_HUNSPELL_CFLAGS" >&5
+echo "configure:12724: checking MOZ_HUNSPELL_CFLAGS" >&5
             MOZ_HUNSPELL_CFLAGS=`$PKG_CONFIG --cflags "hunspell"`
             echo "$ac_t""$MOZ_HUNSPELL_CFLAGS" 1>&6
 
             echo $ac_n "checking MOZ_HUNSPELL_LIBS""... $ac_c" 1>&6
-echo "configure:12819: checking MOZ_HUNSPELL_LIBS" >&5
+echo "configure:12729: checking MOZ_HUNSPELL_LIBS" >&5
             ## Remove evil flags like -Wl,--export-dynamic
             MOZ_HUNSPELL_LIBS="`$PKG_CONFIG --libs \"hunspell\" |sed s/-Wl,--export-dynamic//g`"
             echo "$ac_t""$MOZ_HUNSPELL_LIBS" 1>&6
@@ -13183,7 +13093,7 @@
 # Allow the application to influence configure with a confvars.sh script.
 
 echo $ac_n "checking if app-specific confvars.sh exists""... $ac_c" 1>&6
-echo "configure:13187: checking if app-specific confvars.sh exists" >&5
+echo "configure:13097: checking if app-specific confvars.sh exists" >&5
 if test -f "${srcdir}/${MOZ_BUILD_APP}/confvars.sh" ; then
   echo "$ac_t""${srcdir}/${MOZ_BUILD_APP}/confvars.sh" 1>&6
   . "${srcdir}/${MOZ_BUILD_APP}/confvars.sh"
@@ -13426,7 +13336,7 @@
     # Extract the first word of "pkg-config", so it can be a program name with args.
 set dummy pkg-config; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:13430: checking for $ac_word" >&5
+echo "configure:13340: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_PKG_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -13470,19 +13380,19 @@
      PKG_CONFIG_MIN_VERSION=0.9.0
      if $PKG_CONFIG --atleast-pkgconfig-version $PKG_CONFIG_MIN_VERSION; then
         echo $ac_n "checking for gtk+-2.0 >= $GTK2_VERSION gtk+-unix-print-2.0 gdk-x11-2.0 glib-2.0 gobject-2.0""... $ac_c" 1>&6
-echo "configure:13474: checking for gtk+-2.0 >= $GTK2_VERSION gtk+-unix-print-2.0 gdk-x11-2.0 glib-2.0 gobject-2.0" >&5
+echo "configure:13384: checking for gtk+-2.0 >= $GTK2_VERSION gtk+-unix-print-2.0 gdk-x11-2.0 glib-2.0 gobject-2.0" >&5
 
         if $PKG_CONFIG --exists "gtk+-2.0 >= $GTK2_VERSION gtk+-unix-print-2.0 gdk-x11-2.0 glib-2.0 gobject-2.0" ; then
             echo "$ac_t""yes" 1>&6
             succeeded=yes
 
             echo $ac_n "checking MOZ_GTK2_CFLAGS""... $ac_c" 1>&6
-echo "configure:13481: checking MOZ_GTK2_CFLAGS" >&5
+echo "configure:13391: checking MOZ_GTK2_CFLAGS" >&5
             MOZ_GTK2_CFLAGS=`$PKG_CONFIG --cflags "gtk+-2.0 >= $GTK2_VERSION gtk+-unix-print-2.0 gdk-x11-2.0 glib-2.0 gobject-2.0"`
             echo "$ac_t""$MOZ_GTK2_CFLAGS" 1>&6
 
             echo $ac_n "checking MOZ_GTK2_LIBS""... $ac_c" 1>&6
-echo "configure:13486: checking MOZ_GTK2_LIBS" >&5
+echo "configure:13396: checking MOZ_GTK2_LIBS" >&5
             ## Remove evil flags like -Wl,--export-dynamic
             MOZ_GTK2_LIBS="`$PKG_CONFIG --libs \"gtk+-2.0 >= $GTK2_VERSION gtk+-unix-print-2.0 gdk-x11-2.0 glib-2.0 gobject-2.0\" |sed s/-Wl,--export-dynamic//g`"
             echo "$ac_t""$MOZ_GTK2_LIBS" 1>&6
@@ -13541,7 +13451,7 @@
     # Extract the first word of "pkg-config", so it can be a program name with args.
 set dummy pkg-config; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:13545: checking for $ac_word" >&5
+echo "configure:13455: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_PKG_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -13585,19 +13495,19 @@
      PKG_CONFIG_MIN_VERSION=0.9.0
      if $PKG_CONFIG --atleast-pkgconfig-version $PKG_CONFIG_MIN_VERSION; then
         echo $ac_n "checking for libstartup-notification-1.0 >= $STARTUP_NOTIFICATION_VERSION""... $ac_c" 1>&6
-echo "configure:13589: checking for libstartup-notification-1.0 >= $STARTUP_NOTIFICATION_VERSION" >&5
+echo "configure:13499: checking for libstartup-notification-1.0 >= $STARTUP_NOTIFICATION_VERSION" >&5
 
         if $PKG_CONFIG --exists "libstartup-notification-1.0 >= $STARTUP_NOTIFICATION_VERSION" ; then
             echo "$ac_t""yes" 1>&6
             succeeded=yes
 
             echo $ac_n "checking MOZ_STARTUP_NOTIFICATION_CFLAGS""... $ac_c" 1>&6
-echo "configure:13596: checking MOZ_STARTUP_NOTIFICATION_CFLAGS" >&5
+echo "configure:13506: checking MOZ_STARTUP_NOTIFICATION_CFLAGS" >&5
             MOZ_STARTUP_NOTIFICATION_CFLAGS=`$PKG_CONFIG --cflags "libstartup-notification-1.0 >= $STARTUP_NOTIFICATION_VERSION"`
             echo "$ac_t""$MOZ_STARTUP_NOTIFICATION_CFLAGS" 1>&6
 
             echo $ac_n "checking MOZ_STARTUP_NOTIFICATION_LIBS""... $ac_c" 1>&6
-echo "configure:13601: checking MOZ_STARTUP_NOTIFICATION_LIBS" >&5
+echo "configure:13511: checking MOZ_STARTUP_NOTIFICATION_LIBS" >&5
             ## Remove evil flags like -Wl,--export-dynamic
             MOZ_STARTUP_NOTIFICATION_LIBS="`$PKG_CONFIG --libs \"libstartup-notification-1.0 >= $STARTUP_NOTIFICATION_VERSION\" |sed s/-Wl,--export-dynamic//g`"
             echo "$ac_t""$MOZ_STARTUP_NOTIFICATION_LIBS" 1>&6
@@ -13809,7 +13719,7 @@
     # Extract the first word of "pkg-config", so it can be a program name with args.
 set dummy pkg-config; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:13813: checking for $ac_word" >&5
+echo "configure:13723: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_PKG_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -13853,19 +13763,19 @@
      PKG_CONFIG_MIN_VERSION=0.9.0
      if $PKG_CONFIG --atleast-pkgconfig-version $PKG_CONFIG_MIN_VERSION; then
         echo $ac_n "checking for xft""... $ac_c" 1>&6
-echo "configure:13857: checking for xft" >&5
+echo "configure:13767: checking for xft" >&5
 
         if $PKG_CONFIG --exists "xft" ; then
             echo "$ac_t""yes" 1>&6
             succeeded=yes
 
             echo $ac_n "checking MOZ_XFT_CFLAGS""... $ac_c" 1>&6
-echo "configure:13864: checking MOZ_XFT_CFLAGS" >&5
+echo "configure:13774: checking MOZ_XFT_CFLAGS" >&5
             MOZ_XFT_CFLAGS=`$PKG_CONFIG --cflags "xft"`
             echo "$ac_t""$MOZ_XFT_CFLAGS" 1>&6
 
             echo $ac_n "checking MOZ_XFT_LIBS""... $ac_c" 1>&6
-echo "configure:13869: checking MOZ_XFT_LIBS" >&5
+echo "configure:13779: checking MOZ_XFT_LIBS" >&5
             ## Remove evil flags like -Wl,--export-dynamic
             MOZ_XFT_LIBS="`$PKG_CONFIG --libs \"xft\" |sed s/-Wl,--export-dynamic//g`"
             echo "$ac_t""$MOZ_XFT_LIBS" 1>&6
@@ -13903,7 +13813,7 @@
     # Extract the first word of "pkg-config", so it can be a program name with args.
 set dummy pkg-config; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:13907: checking for $ac_word" >&5
+echo "configure:13817: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_PKG_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -13947,19 +13857,19 @@
      PKG_CONFIG_MIN_VERSION=0.9.0
      if $PKG_CONFIG --atleast-pkgconfig-version $PKG_CONFIG_MIN_VERSION; then
         echo $ac_n "checking for pango >= $PANGO_VERSION""... $ac_c" 1>&6
-echo "configure:13951: checking for pango >= $PANGO_VERSION" >&5
+echo "configure:13861: checking for pango >= $PANGO_VERSION" >&5
 
         if $PKG_CONFIG --exists "pango >= $PANGO_VERSION" ; then
             echo "$ac_t""yes" 1>&6
             succeeded=yes
 
             echo $ac_n "checking _PANGOCHK_CFLAGS""... $ac_c" 1>&6
-echo "configure:13958: checking _PANGOCHK_CFLAGS" >&5
+echo "configure:13868: checking _PANGOCHK_CFLAGS" >&5
             _PANGOCHK_CFLAGS=`$PKG_CONFIG --cflags "pango >= $PANGO_VERSION"`
             echo "$ac_t""$_PANGOCHK_CFLAGS" 1>&6
 
             echo $ac_n "checking _PANGOCHK_LIBS""... $ac_c" 1>&6
-echo "configure:13963: checking _PANGOCHK_LIBS" >&5
+echo "configure:13873: checking _PANGOCHK_LIBS" >&5
             ## Remove evil flags like -Wl,--export-dynamic
             _PANGOCHK_LIBS="`$PKG_CONFIG --libs \"pango >= $PANGO_VERSION\" |sed s/-Wl,--export-dynamic//g`"
             echo "$ac_t""$_PANGOCHK_LIBS" 1>&6
@@ -13994,7 +13904,7 @@
     # Extract the first word of "pkg-config", so it can be a program name with args.
 set dummy pkg-config; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:13998: checking for $ac_word" >&5
+echo "configure:13908: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_PKG_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -14038,19 +13948,19 @@
      PKG_CONFIG_MIN_VERSION=0.9.0
      if $PKG_CONFIG --atleast-pkgconfig-version $PKG_CONFIG_MIN_VERSION; then
         echo $ac_n "checking for pango >= $PANGO_VERSION pangocairo >= $PANGO_VERSION pangoft2 >= $PANGO_VERSION""... $ac_c" 1>&6
-echo "configure:14042: checking for pango >= $PANGO_VERSION pangocairo >= $PANGO_VERSION pangoft2 >= $PANGO_VERSION" >&5
+echo "configure:13952: checking for pango >= $PANGO_VERSION pangocairo >= $PANGO_VERSION pangoft2 >= $PANGO_VERSION" >&5
 
         if $PKG_CONFIG --exists "pango >= $PANGO_VERSION pangocairo >= $PANGO_VERSION pangoft2 >= $PANGO_VERSION" ; then
             echo "$ac_t""yes" 1>&6
             succeeded=yes
 
             echo $ac_n "checking MOZ_PANGO_CFLAGS""... $ac_c" 1>&6
-echo "configure:14049: checking MOZ_PANGO_CFLAGS" >&5
+echo "configure:13959: checking MOZ_PANGO_CFLAGS" >&5
             MOZ_PANGO_CFLAGS=`$PKG_CONFIG --cflags "pango >= $PANGO_VERSION pangocairo >= $PANGO_VERSION pangoft2 >= $PANGO_VERSION"`
             echo "$ac_t""$MOZ_PANGO_CFLAGS" 1>&6
 
             echo $ac_n "checking MOZ_PANGO_LIBS""... $ac_c" 1>&6
-echo "configure:14054: checking MOZ_PANGO_LIBS" >&5
+echo "configure:13964: checking MOZ_PANGO_LIBS" >&5
             ## Remove evil flags like -Wl,--export-dynamic
             MOZ_PANGO_LIBS="`$PKG_CONFIG --libs \"pango >= $PANGO_VERSION pangocairo >= $PANGO_VERSION pangoft2 >= $PANGO_VERSION\" |sed s/-Wl,--export-dynamic//g`"
             echo "$ac_t""$MOZ_PANGO_LIBS" 1>&6
@@ -14127,7 +14037,7 @@
     # Extract the first word of "pkg-config", so it can be a program name with args.
 set dummy pkg-config; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:14131: checking for $ac_word" >&5
+echo "configure:14041: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_PKG_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -14171,19 +14081,19 @@
      PKG_CONFIG_MIN_VERSION=0.9.0
      if $PKG_CONFIG --atleast-pkgconfig-version $PKG_CONFIG_MIN_VERSION; then
         echo $ac_n "checking for gnome-vfs-2.0 >= $GNOMEVFS_VERSION gnome-vfs-module-2.0 >= $GNOMEVFS_VERSION""... $ac_c" 1>&6
-echo "configure:14175: checking for gnome-vfs-2.0 >= $GNOMEVFS_VERSION gnome-vfs-module-2.0 >= $GNOMEVFS_VERSION" >&5
+echo "configure:14085: checking for gnome-vfs-2.0 >= $GNOMEVFS_VERSION gnome-vfs-module-2.0 >= $GNOMEVFS_VERSION" >&5
 
         if $PKG_CONFIG --exists "gnome-vfs-2.0 >= $GNOMEVFS_VERSION gnome-vfs-module-2.0 >= $GNOMEVFS_VERSION" ; then
             echo "$ac_t""yes" 1>&6
             succeeded=yes
 
             echo $ac_n "checking MOZ_GNOMEVFS_CFLAGS""... $ac_c" 1>&6
-echo "configure:14182: checking MOZ_GNOMEVFS_CFLAGS" >&5
+echo "configure:14092: checking MOZ_GNOMEVFS_CFLAGS" >&5
             MOZ_GNOMEVFS_CFLAGS=`$PKG_CONFIG --cflags "gnome-vfs-2.0 >= $GNOMEVFS_VERSION gnome-vfs-module-2.0 >= $GNOMEVFS_VERSION"`
             echo "$ac_t""$MOZ_GNOMEVFS_CFLAGS" 1>&6
 
             echo $ac_n "checking MOZ_GNOMEVFS_LIBS""... $ac_c" 1>&6
-echo "configure:14187: checking MOZ_GNOMEVFS_LIBS" >&5
+echo "configure:14097: checking MOZ_GNOMEVFS_LIBS" >&5
             ## Remove evil flags like -Wl,--export-dynamic
             MOZ_GNOMEVFS_LIBS="`$PKG_CONFIG --libs \"gnome-vfs-2.0 >= $GNOMEVFS_VERSION gnome-vfs-module-2.0 >= $GNOMEVFS_VERSION\" |sed s/-Wl,--export-dynamic//g`"
             echo "$ac_t""$MOZ_GNOMEVFS_LIBS" 1>&6
@@ -14234,7 +14144,7 @@
     # Extract the first word of "pkg-config", so it can be a program name with args.
 set dummy pkg-config; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:14238: checking for $ac_word" >&5
+echo "configure:14148: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_PKG_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -14278,19 +14188,19 @@
      PKG_CONFIG_MIN_VERSION=0.9.0
      if $PKG_CONFIG --atleast-pkgconfig-version $PKG_CONFIG_MIN_VERSION; then
         echo $ac_n "checking for gconf-2.0 >= $GCONF_VERSION""... $ac_c" 1>&6
-echo "configure:14282: checking for gconf-2.0 >= $GCONF_VERSION" >&5
+echo "configure:14192: checking for gconf-2.0 >= $GCONF_VERSION" >&5
 
         if $PKG_CONFIG --exists "gconf-2.0 >= $GCONF_VERSION" ; then
             echo "$ac_t""yes" 1>&6
             succeeded=yes
 
             echo $ac_n "checking MOZ_GCONF_CFLAGS""... $ac_c" 1>&6
-echo "configure:14289: checking MOZ_GCONF_CFLAGS" >&5
+echo "configure:14199: checking MOZ_GCONF_CFLAGS" >&5
             MOZ_GCONF_CFLAGS=`$PKG_CONFIG --cflags "gconf-2.0 >= $GCONF_VERSION"`
             echo "$ac_t""$MOZ_GCONF_CFLAGS" 1>&6
 
             echo $ac_n "checking MOZ_GCONF_LIBS""... $ac_c" 1>&6
-echo "configure:14294: checking MOZ_GCONF_LIBS" >&5
+echo "configure:14204: checking MOZ_GCONF_LIBS" >&5
             ## Remove evil flags like -Wl,--export-dynamic
             MOZ_GCONF_LIBS="`$PKG_CONFIG --libs \"gconf-2.0 >= $GCONF_VERSION\" |sed s/-Wl,--export-dynamic//g`"
             echo "$ac_t""$MOZ_GCONF_LIBS" 1>&6
@@ -14345,7 +14255,7 @@
     # Extract the first word of "pkg-config", so it can be a program name with args.
 set dummy pkg-config; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:14349: checking for $ac_word" >&5
+echo "configure:14259: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_PKG_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -14389,19 +14299,19 @@
      PKG_CONFIG_MIN_VERSION=0.9.0
      if $PKG_CONFIG --atleast-pkgconfig-version $PKG_CONFIG_MIN_VERSION; then
         echo $ac_n "checking for libgnome-2.0 >= $LIBGNOME_VERSION""... $ac_c" 1>&6
-echo "configure:14393: checking for libgnome-2.0 >= $LIBGNOME_VERSION" >&5
+echo "configure:14303: checking for libgnome-2.0 >= $LIBGNOME_VERSION" >&5
 
         if $PKG_CONFIG --exists "libgnome-2.0 >= $LIBGNOME_VERSION" ; then
             echo "$ac_t""yes" 1>&6
             succeeded=yes
 
             echo $ac_n "checking MOZ_LIBGNOME_CFLAGS""... $ac_c" 1>&6
-echo "configure:14400: checking MOZ_LIBGNOME_CFLAGS" >&5
+echo "configure:14310: checking MOZ_LIBGNOME_CFLAGS" >&5
             MOZ_LIBGNOME_CFLAGS=`$PKG_CONFIG --cflags "libgnome-2.0 >= $LIBGNOME_VERSION"`
             echo "$ac_t""$MOZ_LIBGNOME_CFLAGS" 1>&6
 
             echo $ac_n "checking MOZ_LIBGNOME_LIBS""... $ac_c" 1>&6
-echo "configure:14405: checking MOZ_LIBGNOME_LIBS" >&5
+echo "configure:14315: checking MOZ_LIBGNOME_LIBS" >&5
             ## Remove evil flags like -Wl,--export-dynamic
             MOZ_LIBGNOME_LIBS="`$PKG_CONFIG --libs \"libgnome-2.0 >= $LIBGNOME_VERSION\" |sed s/-Wl,--export-dynamic//g`"
             echo "$ac_t""$MOZ_LIBGNOME_LIBS" 1>&6
@@ -14479,7 +14389,7 @@
     # Extract the first word of "pkg-config", so it can be a program name with args.
 set dummy pkg-config; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:14483: checking for $ac_word" >&5
+echo "configure:14393: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_PKG_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -14523,19 +14433,19 @@
      PKG_CONFIG_MIN_VERSION=0.9.0
      if $PKG_CONFIG --atleast-pkgconfig-version $PKG_CONFIG_MIN_VERSION; then
         echo $ac_n "checking for libgnomeui-2.0 >= $GNOMEUI_VERSION""... $ac_c" 1>&6
-echo "configure:14527: checking for libgnomeui-2.0 >= $GNOMEUI_VERSION" >&5
+echo "configure:14437: checking for libgnomeui-2.0 >= $GNOMEUI_VERSION" >&5
 
         if $PKG_CONFIG --exists "libgnomeui-2.0 >= $GNOMEUI_VERSION" ; then
             echo "$ac_t""yes" 1>&6
             succeeded=yes
 
             echo $ac_n "checking MOZ_GNOMEUI_CFLAGS""... $ac_c" 1>&6
-echo "configure:14534: checking MOZ_GNOMEUI_CFLAGS" >&5
+echo "configure:14444: checking MOZ_GNOMEUI_CFLAGS" >&5
             MOZ_GNOMEUI_CFLAGS=`$PKG_CONFIG --cflags "libgnomeui-2.0 >= $GNOMEUI_VERSION"`
             echo "$ac_t""$MOZ_GNOMEUI_CFLAGS" 1>&6
 
             echo $ac_n "checking MOZ_GNOMEUI_LIBS""... $ac_c" 1>&6
-echo "configure:14539: checking MOZ_GNOMEUI_LIBS" >&5
+echo "configure:14449: checking MOZ_GNOMEUI_LIBS" >&5
             ## Remove evil flags like -Wl,--export-dynamic
             MOZ_GNOMEUI_LIBS="`$PKG_CONFIG --libs \"libgnomeui-2.0 >= $GNOMEUI_VERSION\" |sed s/-Wl,--export-dynamic//g`"
             echo "$ac_t""$MOZ_GNOMEUI_LIBS" 1>&6
@@ -14612,7 +14522,7 @@
     # Extract the first word of "pkg-config", so it can be a program name with args.
 set dummy pkg-config; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:14616: checking for $ac_word" >&5
+echo "configure:14526: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_PKG_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -14656,19 +14566,19 @@
      PKG_CONFIG_MIN_VERSION=0.9.0
      if $PKG_CONFIG --atleast-pkgconfig-version $PKG_CONFIG_MIN_VERSION; then
         echo $ac_n "checking for dbus-glib-1 >= $DBUS_VERSION""... $ac_c" 1>&6
-echo "configure:14660: checking for dbus-glib-1 >= $DBUS_VERSION" >&5
+echo "configure:14570: checking for dbus-glib-1 >= $DBUS_VERSION" >&5
 
         if $PKG_CONFIG --exists "dbus-glib-1 >= $DBUS_VERSION" ; then
             echo "$ac_t""yes" 1>&6
             succeeded=yes
 
             echo $ac_n "checking MOZ_DBUS_GLIB_CFLAGS""... $ac_c" 1>&6
-echo "configure:14667: checking MOZ_DBUS_GLIB_CFLAGS" >&5
+echo "configure:14577: checking MOZ_DBUS_GLIB_CFLAGS" >&5
             MOZ_DBUS_GLIB_CFLAGS=`$PKG_CONFIG --cflags "dbus-glib-1 >= $DBUS_VERSION"`
             echo "$ac_t""$MOZ_DBUS_GLIB_CFLAGS" 1>&6
 
             echo $ac_n "checking MOZ_DBUS_GLIB_LIBS""... $ac_c" 1>&6
-echo "configure:14672: checking MOZ_DBUS_GLIB_LIBS" >&5
+echo "configure:14582: checking MOZ_DBUS_GLIB_LIBS" >&5
             ## Remove evil flags like -Wl,--export-dynamic
             MOZ_DBUS_GLIB_LIBS="`$PKG_CONFIG --libs \"dbus-glib-1 >= $DBUS_VERSION\" |sed s/-Wl,--export-dynamic//g`"
             echo "$ac_t""$MOZ_DBUS_GLIB_LIBS" 1>&6
@@ -15171,7 +15081,7 @@
   # Extract the first word of "java", so it can be a program name with args.
 set dummy java; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:15175: checking for $ac_word" >&5
+echo "configure:15085: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_JAVA'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -15207,7 +15117,7 @@
   # Extract the first word of "javac", so it can be a program name with args.
 set dummy javac; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:15211: checking for $ac_word" >&5
+echo "configure:15121: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_JAVAC'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -15243,7 +15153,7 @@
   # Extract the first word of "jar", so it can be a program name with args.
 set dummy jar; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:15247: checking for $ac_word" >&5
+echo "configure:15157: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_JAR'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -15317,7 +15227,7 @@
     # Extract the first word of "pkg-config", so it can be a program name with args.
 set dummy pkg-config; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:15321: checking for $ac_word" >&5
+echo "configure:15231: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_PKG_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -15361,19 +15271,19 @@
      PKG_CONFIG_MIN_VERSION=0.9.0
      if $PKG_CONFIG --atleast-pkgconfig-version $PKG_CONFIG_MIN_VERSION; then
         echo $ac_n "checking for gthread-2.0""... $ac_c" 1>&6
-echo "configure:15365: checking for gthread-2.0" >&5
+echo "configure:15275: checking for gthread-2.0" >&5
 
         if $PKG_CONFIG --exists "gthread-2.0" ; then
             echo "$ac_t""yes" 1>&6
             succeeded=yes
 
             echo $ac_n "checking MOZ_GTHREAD_CFLAGS""... $ac_c" 1>&6
-echo "configure:15372: checking MOZ_GTHREAD_CFLAGS" >&5
+echo "configure:15282: checking MOZ_GTHREAD_CFLAGS" >&5
             MOZ_GTHREAD_CFLAGS=`$PKG_CONFIG --cflags "gthread-2.0"`
             echo "$ac_t""$MOZ_GTHREAD_CFLAGS" 1>&6
 
             echo $ac_n "checking MOZ_GTHREAD_LIBS""... $ac_c" 1>&6
-echo "configure:15377: checking MOZ_GTHREAD_LIBS" >&5
+echo "configure:15287: checking MOZ_GTHREAD_LIBS" >&5
             ## Remove evil flags like -Wl,--export-dynamic
             MOZ_GTHREAD_LIBS="`$PKG_CONFIG --libs \"gthread-2.0\" |sed s/-Wl,--export-dynamic//g`"
             echo "$ac_t""$MOZ_GTHREAD_LIBS" 1>&6
@@ -15409,17 +15319,17 @@
 do
 ac_safe=`echo "$ac_hdr" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for $ac_hdr""... $ac_c" 1>&6
-echo "configure:15413: checking for $ac_hdr" >&5
+echo "configure:15323: checking for $ac_hdr" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 15418 "configure"
+#line 15328 "configure"
 #include "confdefs.h"
 #include <$ac_hdr>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:15423: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:15333: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -15769,7 +15679,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:15773: checking for $ac_word" >&5
+echo "configure:15683: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_MAKENSIS'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -15814,7 +15724,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:15818: checking for $ac_word" >&5
+echo "configure:15728: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_HOST_ICONV'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -15862,13 +15772,13 @@
 
 
 echo $ac_n "checking for tar archiver""... $ac_c" 1>&6
-echo "configure:15866: checking for tar archiver" >&5
+echo "configure:15776: checking for tar archiver" >&5
 for ac_prog in gnutar gtar tar
 do
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:15872: checking for $ac_word" >&5
+echo "configure:15782: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_TAR'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -15905,13 +15815,13 @@
 
 
 echo $ac_n "checking for wget""... $ac_c" 1>&6
-echo "configure:15909: checking for wget" >&5
+echo "configure:15819: checking for wget" >&5
 for ac_prog in wget
 do
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:15915: checking for $ac_word" >&5
+echo "configure:15825: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_WGET'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -15963,13 +15873,13 @@
     msvc*|mks*|cygwin*|mingw*|wince*)
         if test -n "$MOZ_UPDATER"; then
             echo $ac_n "checking for iconv""... $ac_c" 1>&6
-echo "configure:15967: checking for iconv" >&5
+echo "configure:15877: checking for iconv" >&5
             for ac_prog in $HOST_ICONV "iconv"
 do
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:15973: checking for $ac_word" >&5
+echo "configure:15883: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_prog_HOST_ICONV'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -16309,7 +16219,7 @@
     # Extract the first word of "pkg-config", so it can be a program name with args.
 set dummy pkg-config; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:16313: checking for $ac_word" >&5
+echo "configure:16223: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_PKG_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -16352,29 +16262,29 @@
   else
      PKG_CONFIG_MIN_VERSION=0.9.0
      if $PKG_CONFIG --atleast-pkgconfig-version $PKG_CONFIG_MIN_VERSION; then
-        echo $ac_n "checking for sqlite3 >= $SQLITE_VERSION""... $ac_c" 1>&6
-echo "configure:16357: checking for sqlite3 >= $SQLITE_VERSION" >&5
+        echo $ac_n "checking for sqlite3""... $ac_c" 1>&6
+echo "configure:16267: checking for sqlite3" >&5
 
-        if $PKG_CONFIG --exists "sqlite3 >= $SQLITE_VERSION" ; then
+        if $PKG_CONFIG --exists "sqlite3" ; then
             echo "$ac_t""yes" 1>&6
             succeeded=yes
 
             echo $ac_n "checking SQLITE_CFLAGS""... $ac_c" 1>&6
-echo "configure:16364: checking SQLITE_CFLAGS" >&5
-            SQLITE_CFLAGS=`$PKG_CONFIG --cflags "sqlite3 >= $SQLITE_VERSION"`
+echo "configure:16274: checking SQLITE_CFLAGS" >&5
+            SQLITE_CFLAGS=`$PKG_CONFIG --cflags "sqlite3"`
             echo "$ac_t""$SQLITE_CFLAGS" 1>&6
 
             echo $ac_n "checking SQLITE_LIBS""... $ac_c" 1>&6
-echo "configure:16369: checking SQLITE_LIBS" >&5
+echo "configure:16279: checking SQLITE_LIBS" >&5
             ## Remove evil flags like -Wl,--export-dynamic
-            SQLITE_LIBS="`$PKG_CONFIG --libs \"sqlite3 >= $SQLITE_VERSION\" |sed s/-Wl,--export-dynamic//g`"
+            SQLITE_LIBS="`$PKG_CONFIG --libs \"sqlite3\" |sed s/-Wl,--export-dynamic//g`"
             echo "$ac_t""$SQLITE_LIBS" 1>&6
         else
             SQLITE_CFLAGS=""
             SQLITE_LIBS=""
             ## If we have a custom action on failure, don't print errors, but 
             ## do set a variable so people can do so.
-            SQLITE_PKG_ERRORS=`$PKG_CONFIG --errors-to-stdout --print-errors "sqlite3 >= $SQLITE_VERSION"`
+            SQLITE_PKG_ERRORS=`$PKG_CONFIG --errors-to-stdout --print-errors "sqlite3"`
             echo $SQLITE_PKG_ERRORS
         fi
 
@@ -16390,7 +16300,7 @@
      :
   else
      if test "$COMPILE_ENVIRONMENT"; then 
-       { echo "configure: error: Library requirements (sqlite3 >= $SQLITE_VERSION) not met; consider adjusting the PKG_CONFIG_PATH environment variable if your libraries are in a nonstandard prefix so pkg-config can find them." 1>&2; exit 1; }
+       { echo "configure: error: Library requirements (sqlite3) not met; consider adjusting the PKG_CONFIG_PATH environment variable if your libraries are in a nonstandard prefix so pkg-config can find them." 1>&2; exit 1; }
      fi
   fi
 
@@ -16497,6 +16407,84 @@
 fi
 
 
+# Check whether --enable-js-binary or --disable-js-binary was given.
+if test "${enable_js_binary+set}" = set; then
+  enableval="$enable_js_binary"
+  if test "$enableval" = "yes"; then
+    ENABLE_JS_BINARY=1
+  elif test "$enableval" = "no"; then
+    ENABLE_JS_BINARY= 
+  else
+    { echo "configure: error: Option, js-binary, does not take an argument ($enableval)." 1>&2; exit 1; }
+  fi
+fi
+
+
+
+if test -n "$ENABLE_JS_BINARY"; then
+            READLINE_DIR=no
+    # Check whether --with-readline or --without-readline was given.
+if test "${with_readline+set}" = set; then
+  withval="$with_readline"
+  READLINE_DIR=$withval
+fi
+
+
+    if test -n "${READLINE_DIR}" -a "${READLINE_DIR}" != "no"; then
+        _SAVE_LDFLAGS=$LDFLAGS
+        LDFLAGS="-L${READLINE_DIR}/lib $LDFLAGS"
+        echo $ac_n "checking for readline in -lreadline""... $ac_c" 1>&6
+echo "configure:16438: checking for readline in -lreadline" >&5
+ac_lib_var=`echo readline'_'readline | sed 'y%./+-%__p_%'`
+if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
+  echo $ac_n "(cached) $ac_c" 1>&6
+else
+  ac_save_LIBS="$LIBS"
+LIBS="-lreadline  $LIBS"
+cat > conftest.$ac_ext <<EOF
+#line 16446 "configure"
+#include "confdefs.h"
+/* Override any gcc2 internal prototype to avoid an error.  */
+/* We use char because int might match the return type of a gcc2
+    builtin and then its argument prototype would still apply.  */
+char readline();
+
+int main() {
+readline()
+; return 0; }
+EOF
+if { (eval echo configure:16457: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+  rm -rf conftest*
+  eval "ac_cv_lib_$ac_lib_var=yes"
+else
+  echo "configure: failed program was:" >&5
+  cat conftest.$ac_ext >&5
+  rm -rf conftest*
+  eval "ac_cv_lib_$ac_lib_var=no"
+fi
+rm -f conftest*
+LIBS="$ac_save_LIBS"
+
+fi
+if eval "test \"`echo '$ac_cv_lib_'$ac_lib_var`\" = yes"; then
+  echo "$ac_t""yes" 1>&6
+  HAVE_READLINE=1 READLINE_LIBS="-lreadline"
+else
+  echo "$ac_t""no" 1>&6
+HAVE_READLINE= READLINE_LIBS=
+fi
+
+        LDFLAGS=$_SAVE_LDFLAGS
+    fi
+
+    if test "${READLINE_DIR}" -a -d "${READLINE_DIR}" -a "$HAVE_READLINE" = 1; then
+        READLINE_LIBS="-L${READLINE_DIR}/lib ${READLINE_LIBS}"
+    fi
+fi
+
+
+
+
 
 # Debugging and Optimizations
 
@@ -16558,18 +16546,18 @@
 
 if test -n "$MOZ_DEBUG"; then
     echo $ac_n "checking for valid debug flags""... $ac_c" 1>&6
-echo "configure:16562: checking for valid debug flags" >&5
+echo "configure:16550: checking for valid debug flags" >&5
     _SAVE_CFLAGS=$CFLAGS
     CFLAGS="$CFLAGS $MOZ_DEBUG_FLAGS"
     cat > conftest.$ac_ext <<EOF
-#line 16566 "configure"
+#line 16554 "configure"
 #include "confdefs.h"
 #include <stdio.h>
 int main() {
 printf("Hello World\n");
 ; return 0; }
 EOF
-if { (eval echo configure:16573: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:16561: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   _results=yes
 else
@@ -16610,18 +16598,18 @@
 if test "$COMPILE_ENVIRONMENT"; then
 if test -n "$MOZ_OPTIMIZE"; then
     echo $ac_n "checking for valid optimization flags""... $ac_c" 1>&6
-echo "configure:16614: checking for valid optimization flags" >&5
+echo "configure:16602: checking for valid optimization flags" >&5
     _SAVE_CFLAGS=$CFLAGS
     CFLAGS="$CFLAGS $MOZ_OPTIMIZE_FLAGS"
     cat > conftest.$ac_ext <<EOF
-#line 16618 "configure"
+#line 16606 "configure"
 #include "confdefs.h"
 #include <stdio.h>
 int main() {
 printf("Hello World\n");
 ; return 0; }
 EOF
-if { (eval echo configure:16625: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:16613: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   _results=yes
 else
@@ -16791,7 +16779,7 @@
     fi
   else
     echo $ac_n "checking size of int *""... $ac_c" 1>&6
-echo "configure:16795: checking size of int *" >&5
+echo "configure:16783: checking size of int *" >&5
 if eval "test \"`echo '$''{'ac_cv_sizeof_int_p'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -16799,18 +16787,19 @@
   ac_cv_sizeof_int_p=4
 else
   cat > conftest.$ac_ext <<EOF
-#line 16803 "configure"
+#line 16791 "configure"
 #include "confdefs.h"
 #include <stdio.h>
-int main()
+#include <sys/types.h>
+main()
 {
   FILE *f=fopen("conftestval", "w");
-  if (!f) return(1);
+  if (!f) exit(1);
   fprintf(f, "%d\n", sizeof(int *));
-  return(0);
+  exit(0);
 }
 EOF
-if { (eval echo configure:16814: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
+if { (eval echo configure:16803: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
 then
   ac_cv_sizeof_int_p=`cat conftestval`
 else
@@ -16940,17 +16929,17 @@
 
   ac_safe=`echo "valgrind/valgrind.h" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for valgrind/valgrind.h""... $ac_c" 1>&6
-echo "configure:16944: checking for valgrind/valgrind.h" >&5
+echo "configure:16933: checking for valgrind/valgrind.h" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 16949 "configure"
+#line 16938 "configure"
 #include "confdefs.h"
 #include <valgrind/valgrind.h>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:16954: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:16943: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -17027,7 +17016,7 @@
 
 if test -n "$_ENABLE_EFENCE"; then
     echo $ac_n "checking for malloc in -lefence""... $ac_c" 1>&6
-echo "configure:17031: checking for malloc in -lefence" >&5
+echo "configure:17020: checking for malloc in -lefence" >&5
 ac_lib_var=`echo efence'_'malloc | sed 'y%./+-%__p_%'`
 if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
@@ -17035,7 +17024,7 @@
   ac_save_LIBS="$LIBS"
 LIBS="-lefence  $LIBS"
 cat > conftest.$ac_ext <<EOF
-#line 17039 "configure"
+#line 17028 "configure"
 #include "confdefs.h"
 /* Override any gcc2 internal prototype to avoid an error.  */
 /* We use char because int might match the return type of a gcc2
@@ -17046,7 +17035,7 @@
 malloc()
 ; return 0; }
 EOF
-if { (eval echo configure:17050: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:17039: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_lib_$ac_lib_var=yes"
 else
@@ -17178,12 +17167,12 @@
     for ac_func in __builtin_vec_new __builtin_vec_delete __builtin_new __builtin_delete __pure_virtual
 do
 echo $ac_n "checking for $ac_func""... $ac_c" 1>&6
-echo "configure:17182: checking for $ac_func" >&5
+echo "configure:17171: checking for $ac_func" >&5
 if eval "test \"`echo '$''{'ac_cv_func_$ac_func'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 17187 "configure"
+#line 17176 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char $ac_func(); below.  */
@@ -17209,7 +17198,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:17213: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:17202: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_$ac_func=yes"
 else
@@ -17428,12 +17417,12 @@
     for ac_func in __cxa_demangle
 do
 echo $ac_n "checking for $ac_func""... $ac_c" 1>&6
-echo "configure:17432: checking for $ac_func" >&5
+echo "configure:17421: checking for $ac_func" >&5
 if eval "test \"`echo '$''{'ac_cv_func_$ac_func'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 17437 "configure"
+#line 17426 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char $ac_func(); below.  */
@@ -17459,7 +17448,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:17463: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:17452: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_$ac_func=yes"
 else
@@ -17507,17 +17496,17 @@
 if test "$HAVE_GCC3_ABI" && test -z "$SKIP_LIBRARY_CHECKS"; then
     ac_safe=`echo "unwind.h" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for unwind.h""... $ac_c" 1>&6
-echo "configure:17511: checking for unwind.h" >&5
+echo "configure:17500: checking for unwind.h" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 17516 "configure"
+#line 17505 "configure"
 #include "confdefs.h"
 #include <unwind.h>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:17521: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:17510: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -17536,12 +17525,12 @@
   for ac_func in _Unwind_Backtrace
 do
 echo $ac_n "checking for $ac_func""... $ac_c" 1>&6
-echo "configure:17540: checking for $ac_func" >&5
+echo "configure:17529: checking for $ac_func" >&5
 if eval "test \"`echo '$''{'ac_cv_func_$ac_func'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 17545 "configure"
+#line 17534 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char $ac_func(); below.  */
@@ -17564,7 +17553,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:17568: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:17557: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_$ac_func=yes"
 else
@@ -17686,7 +17675,7 @@
 # Compiler Options
 
 echo $ac_n "checking for gcc -pipe support""... $ac_c" 1>&6
-echo "configure:17690: checking for gcc -pipe support" >&5
+echo "configure:17679: checking for gcc -pipe support" >&5
 if test -n "$GNU_CC" && test -n "$GNU_CXX" && test -n "$GNU_AS"; then
     echo '#include <stdio.h>' > dummy-hello.c
     echo 'int main() { printf("Hello World\n"); exit(0); }' >> dummy-hello.c
@@ -17701,14 +17690,14 @@
         _SAVE_CFLAGS=$CFLAGS
         CFLAGS="$CFLAGS -pipe"
         cat > conftest.$ac_ext <<EOF
-#line 17705 "configure"
+#line 17694 "configure"
 #include "confdefs.h"
  #include <stdio.h> 
 int main() {
 printf("Hello World\n");
 ; return 0; }
 EOF
-if { (eval echo configure:17712: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:17701: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   _res_gcc_pipe="yes"
 else
@@ -17750,16 +17739,16 @@
      _SAVE_CFLAGS="$CFLAGS"
      CFLAGS="$CFLAGS ${_COMPILER_PREFIX}-Wno-long-long"
      echo $ac_n "checking whether compiler supports -Wno-long-long""... $ac_c" 1>&6
-echo "configure:17754: checking whether compiler supports -Wno-long-long" >&5
+echo "configure:17743: checking whether compiler supports -Wno-long-long" >&5
      cat > conftest.$ac_ext <<EOF
-#line 17756 "configure"
+#line 17745 "configure"
 #include "confdefs.h"
 
 int main() {
 return(0);
 ; return 0; }
 EOF
-if { (eval echo configure:17763: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:17752: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
    _WARNINGS_CFLAGS="${_WARNINGS_CFLAGS} ${_COMPILER_PREFIX}-Wno-long-long"
 	  _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} ${_COMPILER_PREFIX}-Wno-long-long"
@@ -17795,16 +17784,16 @@
 CFLAGS="$CFLAGS -fprofile-generate"
 
 echo $ac_n "checking whether C compiler supports -fprofile-generate""... $ac_c" 1>&6
-echo "configure:17799: checking whether C compiler supports -fprofile-generate" >&5
+echo "configure:17788: checking whether C compiler supports -fprofile-generate" >&5
 cat > conftest.$ac_ext <<EOF
-#line 17801 "configure"
+#line 17790 "configure"
 #include "confdefs.h"
 
 int main() {
 return 0;
 ; return 0; }
 EOF
-if { (eval echo configure:17808: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:17797: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
    PROFILE_GEN_CFLAGS="-fprofile-generate"
                  result="yes" 
@@ -17824,16 +17813,16 @@
 else
   CFLAGS="$_SAVE_CFLAGS -fprofile-arcs"
   echo $ac_n "checking whether C compiler supports -fprofile-arcs""... $ac_c" 1>&6
-echo "configure:17828: checking whether C compiler supports -fprofile-arcs" >&5
+echo "configure:17817: checking whether C compiler supports -fprofile-arcs" >&5
   cat > conftest.$ac_ext <<EOF
-#line 17830 "configure"
+#line 17819 "configure"
 #include "confdefs.h"
 
 int main() {
 return 0;
 ; return 0; }
 EOF
-if { (eval echo configure:17837: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:17826: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
    PROFILE_GEN_CFLAGS="-fprofile-arcs"
                    result="yes" 
@@ -17903,16 +17892,16 @@
     _SAVE_CXXFLAGS=$CXXFLAGS
     CXXFLAGS="$CXXFLAGS ${_WARNINGS_CXXFLAGS} ${_COMPILER_PREFIX}-pedantic"
     echo $ac_n "checking whether C++ compiler has -pedantic long long bug""... $ac_c" 1>&6
-echo "configure:17907: checking whether C++ compiler has -pedantic long long bug" >&5
+echo "configure:17896: checking whether C++ compiler has -pedantic long long bug" >&5
     cat > conftest.$ac_ext <<EOF
-#line 17909 "configure"
+#line 17898 "configure"
 #include "confdefs.h"
 $configure_static_assert_macros
 int main() {
 CONFIGURE_STATIC_ASSERT(sizeof(long long) == 8)
 ; return 0; }
 EOF
-if { (eval echo configure:17916: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:17905: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   result="no"
 else
@@ -17937,13 +17926,16 @@
 fi
 
 echo $ac_n "checking for correct temporary object destruction order""... $ac_c" 1>&6
-echo "configure:17941: checking for correct temporary object destruction order" >&5
+echo "configure:17930: checking for correct temporary object destruction order" >&5
 if test "$cross_compiling" = yes; then
   result="maybe"
 else
   cat > conftest.$ac_ext <<EOF
-#line 17946 "configure"
+#line 17935 "configure"
 #include "confdefs.h"
+#ifdef __cplusplus
+extern "C" void exit(int);
+#endif
  class A {
              public:  A(int& x) : mValue(x) {}
                       ~A() { mValue--; }
@@ -17962,7 +17954,7 @@
              }
              
 EOF
-if { (eval echo configure:17966: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
+if { (eval echo configure:17958: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
 then
   result="yes"
 else
@@ -17983,12 +17975,12 @@
 _SAVE_CXXFLAGS=$CXXFLAGS
 CXXFLAGS="$CXXFLAGS ${_WARNINGS_CXXFLAGS}"
 echo $ac_n "checking for correct overload resolution with const and templates""... $ac_c" 1>&6
-echo "configure:17987: checking for correct overload resolution with const and templates" >&5
+echo "configure:17979: checking for correct overload resolution with const and templates" >&5
 if eval "test \"`echo '$''{'ac_nscap_nonconst_opeq_bug'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 17992 "configure"
+#line 17984 "configure"
 #include "confdefs.h"
 
                       template <class T>
@@ -18018,7 +18010,7 @@
                     
 ; return 0; }
 EOF
-if { (eval echo configure:18022: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:18014: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   rm -rf conftest*
   ac_nscap_nonconst_opeq_bug="no"
 else
@@ -18321,7 +18313,7 @@
     # Extract the first word of "pkg-config", so it can be a program name with args.
 set dummy pkg-config; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:18325: checking for $ac_word" >&5
+echo "configure:18317: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_PKG_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -18365,19 +18357,19 @@
      PKG_CONFIG_MIN_VERSION=0.9.0
      if $PKG_CONFIG --atleast-pkgconfig-version $PKG_CONFIG_MIN_VERSION; then
         echo $ac_n "checking for libIDL-2.0 >= 0.8.0 glib-2.0 gobject-2.0""... $ac_c" 1>&6
-echo "configure:18369: checking for libIDL-2.0 >= 0.8.0 glib-2.0 gobject-2.0" >&5
+echo "configure:18361: checking for libIDL-2.0 >= 0.8.0 glib-2.0 gobject-2.0" >&5
 
         if $PKG_CONFIG --exists "libIDL-2.0 >= 0.8.0 glib-2.0 gobject-2.0" ; then
             echo "$ac_t""yes" 1>&6
             succeeded=yes
 
             echo $ac_n "checking LIBIDL_CFLAGS""... $ac_c" 1>&6
-echo "configure:18376: checking LIBIDL_CFLAGS" >&5
+echo "configure:18368: checking LIBIDL_CFLAGS" >&5
             LIBIDL_CFLAGS=`$PKG_CONFIG --cflags "libIDL-2.0 >= 0.8.0 glib-2.0 gobject-2.0"`
             echo "$ac_t""$LIBIDL_CFLAGS" 1>&6
 
             echo $ac_n "checking LIBIDL_LIBS""... $ac_c" 1>&6
-echo "configure:18381: checking LIBIDL_LIBS" >&5
+echo "configure:18373: checking LIBIDL_LIBS" >&5
             ## Remove evil flags like -Wl,--export-dynamic
             LIBIDL_LIBS="`$PKG_CONFIG --libs \"libIDL-2.0 >= 0.8.0 glib-2.0 gobject-2.0\" |sed s/-Wl,--export-dynamic//g`"
             echo "$ac_t""$LIBIDL_LIBS" 1>&6
@@ -18501,7 +18493,7 @@
   # Extract the first word of "glib-config", so it can be a program name with args.
 set dummy glib-config; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:18505: checking for $ac_word" >&5
+echo "configure:18497: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_GLIB_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -18536,7 +18528,7 @@
 
   min_glib_version=1.2.0
   echo $ac_n "checking for GLIB - version >= $min_glib_version""... $ac_c" 1>&6
-echo "configure:18540: checking for GLIB - version >= $min_glib_version" >&5
+echo "configure:18532: checking for GLIB - version >= $min_glib_version" >&5
   no_glib=""
   if test "$GLIB_CONFIG" = "no" ; then
     no_glib=yes
@@ -18559,7 +18551,7 @@
   echo $ac_n "cross compiling; assumed OK... $ac_c"
 else
   cat > conftest.$ac_ext <<EOF
-#line 18563 "configure"
+#line 18555 "configure"
 #include "confdefs.h"
 
 #include <glib.h>
@@ -18635,7 +18627,7 @@
 }
 
 EOF
-if { (eval echo configure:18639: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
+if { (eval echo configure:18631: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
 then
   :
 else
@@ -18669,7 +18661,7 @@
           CFLAGS="$CFLAGS $GLIB_CFLAGS"
           LIBS="$LIBS $GLIB_LIBS"
           cat > conftest.$ac_ext <<EOF
-#line 18673 "configure"
+#line 18665 "configure"
 #include "confdefs.h"
 
 #include <glib.h>
@@ -18679,7 +18671,7 @@
  return ((glib_major_version) || (glib_minor_version) || (glib_micro_version)); 
 ; return 0; }
 EOF
-if { (eval echo configure:18683: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:18675: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
    echo "*** The test program compiled, but did not run. This usually means"
           echo "*** that the run-time linker is not finding GLIB or finding the wrong"
@@ -18723,7 +18715,7 @@
   # Extract the first word of "libIDL-config", so it can be a program name with args.
 set dummy libIDL-config; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:18727: checking for $ac_word" >&5
+echo "configure:18719: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_LIBIDL_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -18758,7 +18750,7 @@
 
   min_libIDL_version=$LIBIDL_VERSION
   echo $ac_n "checking for libIDL - version >= $min_libIDL_version""... $ac_c" 1>&6
-echo "configure:18762: checking for libIDL - version >= $min_libIDL_version" >&5
+echo "configure:18754: checking for libIDL - version >= $min_libIDL_version" >&5
   no_libIDL=""
   if test "$LIBIDL_CONFIG" = "no" ; then
     no_libIDL=yes
@@ -18785,7 +18777,7 @@
   echo $ac_n "cross compiling; assumed OK... $ac_c"
 else
   cat > conftest.$ac_ext <<EOF
-#line 18789 "configure"
+#line 18781 "configure"
 #include "confdefs.h"
 
 #include <stdio.h>
@@ -18871,7 +18863,7 @@
 }
 
 EOF
-if { (eval echo configure:18875: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
+if { (eval echo configure:18867: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
 then
   :
 else
@@ -18905,7 +18897,7 @@
           CFLAGS="$CFLAGS $LIBIDL_CFLAGS"
           LIBS="$LIBS $LIBIDL_LIBS"
           cat > conftest.$ac_ext <<EOF
-#line 18909 "configure"
+#line 18901 "configure"
 #include "confdefs.h"
 
 #include <stdio.h>
@@ -18916,7 +18908,7 @@
  return IDL_get_libver_string ? 1 : 0; 
 ; return 0; }
 EOF
-if { (eval echo configure:18920: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:18912: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
    echo "*** The test program compiled, but did not run. This usually means"
           echo "*** that the run-time linker is not finding libIDL or finding the wrong"
@@ -18956,7 +18948,7 @@
     # Extract the first word of "pkg-config", so it can be a program name with args.
 set dummy pkg-config; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:18960: checking for $ac_word" >&5
+echo "configure:18952: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_PKG_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -19000,19 +18992,19 @@
      PKG_CONFIG_MIN_VERSION=0.9.0
      if $PKG_CONFIG --atleast-pkgconfig-version $PKG_CONFIG_MIN_VERSION; then
         echo $ac_n "checking for libIDL-2.0 >= 0.8.0""... $ac_c" 1>&6
-echo "configure:19004: checking for libIDL-2.0 >= 0.8.0" >&5
+echo "configure:18996: checking for libIDL-2.0 >= 0.8.0" >&5
 
         if $PKG_CONFIG --exists "libIDL-2.0 >= 0.8.0" ; then
             echo "$ac_t""yes" 1>&6
             succeeded=yes
 
             echo $ac_n "checking LIBIDL_CFLAGS""... $ac_c" 1>&6
-echo "configure:19011: checking LIBIDL_CFLAGS" >&5
+echo "configure:19003: checking LIBIDL_CFLAGS" >&5
             LIBIDL_CFLAGS=`$PKG_CONFIG --cflags "libIDL-2.0 >= 0.8.0"`
             echo "$ac_t""$LIBIDL_CFLAGS" 1>&6
 
             echo $ac_n "checking LIBIDL_LIBS""... $ac_c" 1>&6
-echo "configure:19016: checking LIBIDL_LIBS" >&5
+echo "configure:19008: checking LIBIDL_LIBS" >&5
             ## Remove evil flags like -Wl,--export-dynamic
             LIBIDL_LIBS="`$PKG_CONFIG --libs \"libIDL-2.0 >= 0.8.0\" |sed s/-Wl,--export-dynamic//g`"
             echo "$ac_t""$LIBIDL_LIBS" 1>&6
@@ -19049,7 +19041,7 @@
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:19053: checking for $ac_word" >&5
+echo "configure:19045: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_ORBIT_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -19086,7 +19078,7 @@
 
         if test -n "$ORBIT_CONFIG"; then
             echo $ac_n "checking for ORBit libIDL usability""... $ac_c" 1>&6
-echo "configure:19090: checking for ORBit libIDL usability" >&5
+echo "configure:19082: checking for ORBit libIDL usability" >&5
         	_ORBIT_CFLAGS=`${ORBIT_CONFIG} client --cflags`
     	    _ORBIT_LIBS=`${ORBIT_CONFIG} client --libs`
             _ORBIT_INC_PATH=`${PERL} -e '{ for $f (@ARGV) { print "$f " if ($f =~ m/^-I/); } }' -- ${_ORBIT_CFLAGS}`
@@ -19103,7 +19095,7 @@
                 result="maybe" 
 else
   cat > conftest.$ac_ext <<EOF
-#line 19107 "configure"
+#line 19099 "configure"
 #include "confdefs.h"
 
 #include <stdlib.h>
@@ -19118,7 +19110,7 @@
 }
             
 EOF
-if { (eval echo configure:19122: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
+if { (eval echo configure:19114: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
 then
   _LIBIDL_FOUND=1
                 result="yes"
@@ -19174,7 +19166,7 @@
     # Extract the first word of "pkg-config", so it can be a program name with args.
 set dummy pkg-config; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:19178: checking for $ac_word" >&5
+echo "configure:19170: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_PKG_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -19218,19 +19210,19 @@
      PKG_CONFIG_MIN_VERSION=0.9.0
      if $PKG_CONFIG --atleast-pkgconfig-version $PKG_CONFIG_MIN_VERSION; then
         echo $ac_n "checking for glib-2.0 >= 1.3.7 gobject-2.0""... $ac_c" 1>&6
-echo "configure:19222: checking for glib-2.0 >= 1.3.7 gobject-2.0" >&5
+echo "configure:19214: checking for glib-2.0 >= 1.3.7 gobject-2.0" >&5
 
         if $PKG_CONFIG --exists "glib-2.0 >= 1.3.7 gobject-2.0" ; then
             echo "$ac_t""yes" 1>&6
             succeeded=yes
 
             echo $ac_n "checking GLIB_CFLAGS""... $ac_c" 1>&6
-echo "configure:19229: checking GLIB_CFLAGS" >&5
+echo "configure:19221: checking GLIB_CFLAGS" >&5
             GLIB_CFLAGS=`$PKG_CONFIG --cflags "glib-2.0 >= 1.3.7 gobject-2.0"`
             echo "$ac_t""$GLIB_CFLAGS" 1>&6
 
             echo $ac_n "checking GLIB_LIBS""... $ac_c" 1>&6
-echo "configure:19234: checking GLIB_LIBS" >&5
+echo "configure:19226: checking GLIB_LIBS" >&5
             ## Remove evil flags like -Wl,--export-dynamic
             GLIB_LIBS="`$PKG_CONFIG --libs \"glib-2.0 >= 1.3.7 gobject-2.0\" |sed s/-Wl,--export-dynamic//g`"
             echo "$ac_t""$GLIB_LIBS" 1>&6
@@ -19315,7 +19307,7 @@
   # Extract the first word of "glib-config", so it can be a program name with args.
 set dummy glib-config; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:19319: checking for $ac_word" >&5
+echo "configure:19311: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_GLIB_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -19350,7 +19342,7 @@
 
   min_glib_version=${GLIB_VERSION}
   echo $ac_n "checking for GLIB - version >= $min_glib_version""... $ac_c" 1>&6
-echo "configure:19354: checking for GLIB - version >= $min_glib_version" >&5
+echo "configure:19346: checking for GLIB - version >= $min_glib_version" >&5
   no_glib=""
   if test "$GLIB_CONFIG" = "no" ; then
     no_glib=yes
@@ -19373,7 +19365,7 @@
   echo $ac_n "cross compiling; assumed OK... $ac_c"
 else
   cat > conftest.$ac_ext <<EOF
-#line 19377 "configure"
+#line 19369 "configure"
 #include "confdefs.h"
 
 #include <glib.h>
@@ -19449,7 +19441,7 @@
 }
 
 EOF
-if { (eval echo configure:19453: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
+if { (eval echo configure:19445: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
 then
   :
 else
@@ -19483,7 +19475,7 @@
           CFLAGS="$CFLAGS $GLIB_CFLAGS"
           LIBS="$LIBS $GLIB_LIBS"
           cat > conftest.$ac_ext <<EOF
-#line 19487 "configure"
+#line 19479 "configure"
 #include "confdefs.h"
 
 #include <glib.h>
@@ -19493,7 +19485,7 @@
  return ((glib_major_version) || (glib_minor_version) || (glib_micro_version)); 
 ; return 0; }
 EOF
-if { (eval echo configure:19497: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:19489: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
    echo "*** The test program compiled, but did not run. This usually means"
           echo "*** that the run-time linker is not finding GLIB or finding the wrong"
@@ -19573,19 +19565,19 @@
   # The Ultrix 4.2 mips builtin alloca declared by alloca.h only works
 # for constant arguments.  Useless!
 echo $ac_n "checking for working alloca.h""... $ac_c" 1>&6
-echo "configure:19577: checking for working alloca.h" >&5
+echo "configure:19569: checking for working alloca.h" >&5
 if eval "test \"`echo '$''{'ac_cv_header_alloca_h'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 19582 "configure"
+#line 19574 "configure"
 #include "confdefs.h"
 #include <alloca.h>
 int main() {
 char *p = alloca(2 * sizeof(int));
 ; return 0; }
 EOF
-if { (eval echo configure:19589: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:19581: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   ac_cv_header_alloca_h=yes
 else
@@ -19606,12 +19598,12 @@
 fi
 
 echo $ac_n "checking for alloca""... $ac_c" 1>&6
-echo "configure:19610: checking for alloca" >&5
+echo "configure:19602: checking for alloca" >&5
 if eval "test \"`echo '$''{'ac_cv_func_alloca_works'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 19615 "configure"
+#line 19607 "configure"
 #include "confdefs.h"
 
 #ifdef __GNUC__
@@ -19639,7 +19631,7 @@
 char *p = (char *) alloca(1);
 ; return 0; }
 EOF
-if { (eval echo configure:19643: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:19635: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   ac_cv_func_alloca_works=yes
 else
@@ -19671,12 +19663,12 @@
 
 
 echo $ac_n "checking whether alloca needs Cray hooks""... $ac_c" 1>&6
-echo "configure:19675: checking whether alloca needs Cray hooks" >&5
+echo "configure:19667: checking whether alloca needs Cray hooks" >&5
 if eval "test \"`echo '$''{'ac_cv_os_cray'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 19680 "configure"
+#line 19672 "configure"
 #include "confdefs.h"
 #if defined(CRAY) && ! defined(CRAY2)
 webecray
@@ -19701,12 +19693,12 @@
 if test $ac_cv_os_cray = yes; then
 for ac_func in _getb67 GETB67 getb67; do
   echo $ac_n "checking for $ac_func""... $ac_c" 1>&6
-echo "configure:19705: checking for $ac_func" >&5
+echo "configure:19697: checking for $ac_func" >&5
 if eval "test \"`echo '$''{'ac_cv_func_$ac_func'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 19710 "configure"
+#line 19702 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char $ac_func(); below.  */
@@ -19729,7 +19721,7 @@
 
 ; return 0; }
 EOF
-if { (eval echo configure:19733: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+if { (eval echo configure:19725: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
   rm -rf conftest*
   eval "ac_cv_func_$ac_func=yes"
 else
@@ -19756,7 +19748,7 @@
 fi
 
 echo $ac_n "checking stack direction for C alloca""... $ac_c" 1>&6
-echo "configure:19760: checking stack direction for C alloca" >&5
+echo "configure:19752: checking stack direction for C alloca" >&5
 if eval "test \"`echo '$''{'ac_cv_c_stack_direction'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -19764,7 +19756,7 @@
   ac_cv_c_stack_direction=0
 else
   cat > conftest.$ac_ext <<EOF
-#line 19768 "configure"
+#line 19760 "configure"
 #include "confdefs.h"
 find_stack_direction ()
 {
@@ -19783,7 +19775,7 @@
   exit (find_stack_direction() < 0);
 }
 EOF
-if { (eval echo configure:19787: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
+if { (eval echo configure:19779: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
 then
   ac_cv_c_stack_direction=1
 else
@@ -19830,17 +19822,17 @@
 do
 ac_safe=`echo "$ac_hdr" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for $ac_hdr""... $ac_c" 1>&6
-echo "configure:19834: checking for $ac_hdr" >&5
+echo "configure:19826: checking for $ac_hdr" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 19839 "configure"
+#line 19831 "configure"
 #include "confdefs.h"
 #include <$ac_hdr>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:19844: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:19836: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -19918,7 +19910,7 @@
     # Extract the first word of "pkg-config", so it can be a program name with args.
 set dummy pkg-config; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:19922: checking for $ac_word" >&5
+echo "configure:19914: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_PKG_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -19962,19 +19954,19 @@
      PKG_CONFIG_MIN_VERSION=0.9.0
      if $PKG_CONFIG --atleast-pkgconfig-version $PKG_CONFIG_MIN_VERSION; then
         echo $ac_n "checking for fontconfig freetype2""... $ac_c" 1>&6
-echo "configure:19966: checking for fontconfig freetype2" >&5
+echo "configure:19958: checking for fontconfig freetype2" >&5
 
         if $PKG_CONFIG --exists "fontconfig freetype2" ; then
             echo "$ac_t""yes" 1>&6
             succeeded=yes
 
             echo $ac_n "checking CAIRO_FT_CFLAGS""... $ac_c" 1>&6
-echo "configure:19973: checking CAIRO_FT_CFLAGS" >&5
+echo "configure:19965: checking CAIRO_FT_CFLAGS" >&5
             CAIRO_FT_CFLAGS=`$PKG_CONFIG --cflags "fontconfig freetype2"`
             echo "$ac_t""$CAIRO_FT_CFLAGS" 1>&6
 
             echo $ac_n "checking CAIRO_FT_LIBS""... $ac_c" 1>&6
-echo "configure:19978: checking CAIRO_FT_LIBS" >&5
+echo "configure:19970: checking CAIRO_FT_LIBS" >&5
             ## Remove evil flags like -Wl,--export-dynamic
             CAIRO_FT_LIBS="`$PKG_CONFIG --libs \"fontconfig freetype2\" |sed s/-Wl,--export-dynamic//g`"
             echo "$ac_t""$CAIRO_FT_LIBS" 1>&6
@@ -20065,7 +20057,7 @@
     # Extract the first word of "pkg-config", so it can be a program name with args.
 set dummy pkg-config; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:20069: checking for $ac_word" >&5
+echo "configure:20061: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_PKG_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -20109,19 +20101,19 @@
      PKG_CONFIG_MIN_VERSION=0.9.0
      if $PKG_CONFIG --atleast-pkgconfig-version $PKG_CONFIG_MIN_VERSION; then
         echo $ac_n "checking for cairo >= $CAIRO_VERSION freetype2 fontconfig""... $ac_c" 1>&6
-echo "configure:20113: checking for cairo >= $CAIRO_VERSION freetype2 fontconfig" >&5
+echo "configure:20105: checking for cairo >= $CAIRO_VERSION freetype2 fontconfig" >&5
 
         if $PKG_CONFIG --exists "cairo >= $CAIRO_VERSION freetype2 fontconfig" ; then
             echo "$ac_t""yes" 1>&6
             succeeded=yes
 
             echo $ac_n "checking CAIRO_CFLAGS""... $ac_c" 1>&6
-echo "configure:20120: checking CAIRO_CFLAGS" >&5
+echo "configure:20112: checking CAIRO_CFLAGS" >&5
             CAIRO_CFLAGS=`$PKG_CONFIG --cflags "cairo >= $CAIRO_VERSION freetype2 fontconfig"`
             echo "$ac_t""$CAIRO_CFLAGS" 1>&6
 
             echo $ac_n "checking CAIRO_LIBS""... $ac_c" 1>&6
-echo "configure:20125: checking CAIRO_LIBS" >&5
+echo "configure:20117: checking CAIRO_LIBS" >&5
             ## Remove evil flags like -Wl,--export-dynamic
             CAIRO_LIBS="`$PKG_CONFIG --libs \"cairo >= $CAIRO_VERSION freetype2 fontconfig\" |sed s/-Wl,--export-dynamic//g`"
             echo "$ac_t""$CAIRO_LIBS" 1>&6
@@ -20159,7 +20151,7 @@
     # Extract the first word of "pkg-config", so it can be a program name with args.
 set dummy pkg-config; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:20163: checking for $ac_word" >&5
+echo "configure:20155: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_PKG_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -20203,19 +20195,19 @@
      PKG_CONFIG_MIN_VERSION=0.9.0
      if $PKG_CONFIG --atleast-pkgconfig-version $PKG_CONFIG_MIN_VERSION; then
         echo $ac_n "checking for cairo-xlib-xrender >= $CAIRO_VERSION""... $ac_c" 1>&6
-echo "configure:20207: checking for cairo-xlib-xrender >= $CAIRO_VERSION" >&5
+echo "configure:20199: checking for cairo-xlib-xrender >= $CAIRO_VERSION" >&5
 
         if $PKG_CONFIG --exists "cairo-xlib-xrender >= $CAIRO_VERSION" ; then
             echo "$ac_t""yes" 1>&6
             succeeded=yes
 
             echo $ac_n "checking CAIRO_XRENDER_CFLAGS""... $ac_c" 1>&6
-echo "configure:20214: checking CAIRO_XRENDER_CFLAGS" >&5
+echo "configure:20206: checking CAIRO_XRENDER_CFLAGS" >&5
             CAIRO_XRENDER_CFLAGS=`$PKG_CONFIG --cflags "cairo-xlib-xrender >= $CAIRO_VERSION"`
             echo "$ac_t""$CAIRO_XRENDER_CFLAGS" 1>&6
 
             echo $ac_n "checking CAIRO_XRENDER_LIBS""... $ac_c" 1>&6
-echo "configure:20219: checking CAIRO_XRENDER_LIBS" >&5
+echo "configure:20211: checking CAIRO_XRENDER_LIBS" >&5
             ## Remove evil flags like -Wl,--export-dynamic
             CAIRO_XRENDER_LIBS="`$PKG_CONFIG --libs \"cairo-xlib-xrender >= $CAIRO_VERSION\" |sed s/-Wl,--export-dynamic//g`"
             echo "$ac_t""$CAIRO_XRENDER_LIBS" 1>&6
@@ -20286,7 +20278,7 @@
     # Extract the first word of "pkg-config", so it can be a program name with args.
 set dummy pkg-config; ac_word=$2
 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6
-echo "configure:20290: checking for $ac_word" >&5
+echo "configure:20282: checking for $ac_word" >&5
 if eval "test \"`echo '$''{'ac_cv_path_PKG_CONFIG'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
@@ -20329,29 +20321,29 @@
   else
      PKG_CONFIG_MIN_VERSION=0.9.0
      if $PKG_CONFIG --atleast-pkgconfig-version $PKG_CONFIG_MIN_VERSION; then
-        echo $ac_n "checking for lcms >= $LCMS_VERSION""... $ac_c" 1>&6
-echo "configure:20334: checking for lcms >= $LCMS_VERSION" >&5
+        echo $ac_n "checking for lcms""... $ac_c" 1>&6
+echo "configure:20326: checking for lcms" >&5
 
-        if $PKG_CONFIG --exists "lcms >= $LCMS_VERSION" ; then
+        if $PKG_CONFIG --exists "lcms" ; then
             echo "$ac_t""yes" 1>&6
             succeeded=yes
 
             echo $ac_n "checking LCMS_CFLAGS""... $ac_c" 1>&6
-echo "configure:20341: checking LCMS_CFLAGS" >&5
-            LCMS_CFLAGS=`$PKG_CONFIG --cflags "lcms >= $LCMS_VERSION"`
+echo "configure:20333: checking LCMS_CFLAGS" >&5
+            LCMS_CFLAGS=`$PKG_CONFIG --cflags "lcms"`
             echo "$ac_t""$LCMS_CFLAGS" 1>&6
 
             echo $ac_n "checking LCMS_LIBS""... $ac_c" 1>&6
-echo "configure:20346: checking LCMS_LIBS" >&5
+echo "configure:20338: checking LCMS_LIBS" >&5
             ## Remove evil flags like -Wl,--export-dynamic
-            LCMS_LIBS="`$PKG_CONFIG --libs \"lcms >= $LCMS_VERSION\" |sed s/-Wl,--export-dynamic//g`"
+            LCMS_LIBS="`$PKG_CONFIG --libs \"lcms\" |sed s/-Wl,--export-dynamic//g`"
             echo "$ac_t""$LCMS_LIBS" 1>&6
         else
             LCMS_CFLAGS=""
             LCMS_LIBS=""
             ## If we have a custom action on failure, don't print errors, but 
             ## do set a variable so people can do so.
-            LCMS_PKG_ERRORS=`$PKG_CONFIG --errors-to-stdout --print-errors "lcms >= $LCMS_VERSION"`
+            LCMS_PKG_ERRORS=`$PKG_CONFIG --errors-to-stdout --print-errors "lcms"`
             echo $LCMS_PKG_ERRORS
         fi
 
@@ -20367,7 +20359,7 @@
      :
   else
      if test "$COMPILE_ENVIRONMENT"; then 
-       { echo "configure: error: Library requirements (lcms >= $LCMS_VERSION) not met; consider adjusting the PKG_CONFIG_PATH environment variable if your libraries are in a nonstandard prefix so pkg-config can find them." 1>&2; exit 1; }
+       { echo "configure: error: Library requirements (lcms) not met; consider adjusting the PKG_CONFIG_PATH environment variable if your libraries are in a nonstandard prefix so pkg-config can find them." 1>&2; exit 1; }
      fi
   fi
 
@@ -20690,14 +20682,14 @@
 cross_compiling=$ac_cv_prog_cc_cross
 
     cat > conftest.$ac_ext <<EOF
-#line 20694 "configure"
+#line 20686 "configure"
 #include "confdefs.h"
 #include <gmodule.h>
 int main() {
  int x = 1; x++; 
 ; return 0; }
 EOF
-if { (eval echo configure:20701: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:20693: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   :
 else
   echo "configure: failed program was:" >&5
@@ -20983,6 +20975,8 @@
 
 
 
+
+
 cat >> confdefs.h <<EOF
 #define MOZ_DLL_SUFFIX "$DLL_SUFFIX"
 EOF
@@ -21011,7 +21005,7 @@
                 _SAVE_CFLAGS=$CFLAGS
     CFLAGS="$CFLAGS $XCFLAGS"
     cat > conftest.$ac_ext <<EOF
-#line 21015 "configure"
+#line 21009 "configure"
 #include "confdefs.h"
 
         #include <stdio.h>
@@ -21029,7 +21023,7 @@
     
 ; return 0; }
 EOF
-if { (eval echo configure:21033: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
+if { (eval echo configure:21027: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then
   :
 else
   echo "configure: failed program was:" >&5
@@ -21252,34 +21246,15 @@
 # Transform confdefs.h into DEFS.
 # Protect against shell expansion while executing Makefile rules.
 # Protect against Makefile macro expansion.
-#
-# If the first sed substitution is executed (which looks for macros that
-# take arguments), then we branch to the quote section.  Otherwise,
-# look for a macro that doesn't take arguments.
-cat >confdef2opt.sed <<\_ACEOF
-t clear
-: clear
-s,^[ 	]*#[ 	]*define[ 	][ 	]*\([^ 	(][^ 	(]*([^)]*)\)[ 	]*\(.*\),-D\1=\2,g
-t quote
-s,^[ 	]*#[ 	]*define[ 	][ 	]*\([^ 	][^ 	]*\)[ 	]*\(.*\),-D\1=\2,g
-t quote
-d
-: quote
-s,[ 	`~#$^&*(){}\\|;'"<>?],\\&,g
-s,\[,\\&,g
-s,\],\\&,g
-s,\$,$$,g
-p
-_ACEOF
-# We use echo to avoid assuming a particular line-breaking character.
-# The extra dot is to prevent the shell from consuming trailing
-# line-breaks from the sub-command output.  A line-break within
-# single-quotes doesn't work because, if this script is created in a
-# platform that uses two characters for line-breaks (e.g., DOS), tr
-# would break.
-ac_LF_and_DOT=`echo; echo .`
-DEFS=`sed -n -f confdef2opt.sed confdefs.h | tr "$ac_LF_and_DOT" ' .'`
-rm -f confdef2opt.sed
+cat > conftest.defs <<\EOF
+s%#define \([A-Za-z_][A-Za-z0-9_]*\) *\(.*\)%-D\1=\2%g
+s%[ 	`~#$^&*(){}\\|;'"<>?]%\\&%g
+s%\[%\\&%g
+s%\]%\\&%g
+s%\$%$$%g
+EOF
+DEFS=`sed -f conftest.defs confdefs.h | tr '\012' ' '`
+rm -f conftest.defs
 
 MOZ_DEFINES=$DEFS
 
@@ -21610,6 +21585,9 @@
 s%@MOZ_URL_CLASSIFIER@%$MOZ_URL_CLASSIFIER%g
 s%@MOZ_ZIPWRITER@%$MOZ_ZIPWRITER%g
 s%@JS_ULTRASPARC_OPTS@%$JS_ULTRASPARC_OPTS%g
+s%@ENABLE_JS_BINARY@%$ENABLE_JS_BINARY%g
+s%@HAVE_READLINE@%$HAVE_READLINE%g
+s%@READLINE_LIBS@%$READLINE_LIBS%g
 s%@MOZ_OPTIMIZE@%$MOZ_OPTIMIZE%g
 s%@MOZ_OPTIMIZE_FLAGS@%$MOZ_OPTIMIZE_FLAGS%g
 s%@MOZ_OPTIMIZE_LDFLAGS@%$MOZ_OPTIMIZE_LDFLAGS%g
@@ -21839,6 +21817,7 @@
 s%@WIN32_REDIST_DIR@%$WIN32_REDIST_DIR%g
 s%@SYSTEM_JPEG@%$SYSTEM_JPEG%g
 s%@SYSTEM_PNG@%$SYSTEM_PNG%g
+s%@APNG@%$APNG%g
 s%@SYSTEM_ZLIB@%$SYSTEM_ZLIB%g
 s%@SYSTEM_BZ2@%$SYSTEM_BZ2%g
 s%@JPEG_CFLAGS@%$JPEG_CFLAGS%g
@@ -21863,6 +21842,7 @@
 s%@COMPILE_CFLAGS@%$COMPILE_CFLAGS%g
 s%@COMPILE_CXXFLAGS@%$COMPILE_CXXFLAGS%g
 s%@CROSS_COMPILE@%$CROSS_COMPILE%g
+s%@WCHAR_CFLAGS@%$WCHAR_CFLAGS%g
 s%@HOST_CFLAGS@%$HOST_CFLAGS%g
 s%@HOST_CXXFLAGS@%$HOST_CXXFLAGS%g
 s%@HOST_OPTIMIZE_FLAGS@%$HOST_OPTIMIZE_FLAGS%g
@@ -22257,7 +22237,7 @@
       fi
     fi
 
-    cd $ac_popdir
+    cd "$ac_popdir"
   done
 fi
 
@@ -22400,7 +22380,7 @@
       fi
     fi
 
-    cd $ac_popdir
+    cd "$ac_popdir"
   done
 fi
 
--- xulrunner-1.9.0.19.orig/configure.in
+++ xulrunner-1.9.0.19/configure.in
@@ -986,6 +986,7 @@
     case "${target_os}" in
         linux*)       OS_ARCH=Linux OS_TARGET=Linux ;;
         kfreebsd*-gnu) OS_ARCH=GNU_kFreeBSD OS_TARGET=GNU_kFreeBSD ;;
+        gnu*)         OS_ARCH=GNU ;;
         solaris*)     OS_ARCH=SunOS OS_RELEASE=5 ;;
         mingw*)       OS_ARCH=WINNT ;;
         wince*)       OS_ARCH=WINCE ;;
@@ -1296,6 +1297,7 @@
     WARNINGS_AS_ERRORS='-Werror'
     DSO_CFLAGS=''
     DSO_PIC_CFLAGS='-fPIC'
+    ASFLAGS="$ASFLAGS -fPIC"
     _MOZ_RTTI_FLAGS_ON=${_COMPILER_PREFIX}-frtti
     _MOZ_RTTI_FLAGS_OFF=${_COMPILER_PREFIX}-fno-rtti
     _MOZ_EXCEPTIONS_FLAGS_ON='-fhandle-exceptions'
@@ -1528,7 +1530,7 @@
     LIBXUL_LIBS='$(XPCOM_FROZEN_LDOPTS) $(LIBXUL_DIST)/bin/XUL -lobjc'
     ;;
 
-*-linux*|*-kfreebsd*-gnu)
+*-linux*|*-kfreebsd*-gnu|*-gnu*)
     HOST_CFLAGS="$HOST_CFLAGS -DXP_UNIX"
     HOST_NSPR_MDCPUCFG='\"md/_linux.cfg\"'
     HOST_OPTIMIZE_FLAGS="${HOST_OPTIMIZE_FLAGS=-O3}"
@@ -1824,8 +1826,7 @@
         MOZ_ENABLE_OLD_ABI_COMPAT_WRAPPERS=1
     ;;
     mips*)
-        CFLAGS="$CFLAGS -Wa,-xgot"
-        CXXFLAGS="$CXXFLAGS -Wa,-xgot"
+        MOZ_DEBUG_FLAGS="-g" # We want inlining
     ;;
     esac
     ;;
@@ -2566,7 +2567,7 @@
 dnl = Flags to strip unused symbols from .so components
 dnl ========================================================
 case "$target" in
-    *-linux*|*-kfreebsd*-gnu)
+    *-linux*|*-kfreebsd*-gnu|*-gnu*)
         MOZ_COMPONENTS_VERSION_SCRIPT_LDFLAGS='-Wl,--version-script -Wl,$(BUILD_TOOLS)/gnu-ld-scripts/components-version-script'
         ;;
     *-solaris*)
@@ -2777,7 +2778,7 @@
 if test "$ac_cv_have_usable_wchar_v2" = "yes"; then
     AC_DEFINE(HAVE_CPP_2BYTE_WCHAR_T)
     HAVE_CPP_2BYTE_WCHAR_T=1
-else
+elif false; then
 dnl This is really gcc-only
 dnl Do this test using CXX only since some versions of gcc
 dnl 2.95-2.97 have a signed wchar_t in c++ only and some versions
@@ -2791,7 +2792,7 @@
 
     AC_CACHE_CHECK(for compiler -fshort-wchar option, 
         ac_cv_have_usable_wchar_option_v2,
-        [AC_TRY_COMPILE([#include <stddef.h>
+        [AC_TRY_LINK([#include <stddef.h>
                          $configure_static_assert_macros],
                         [CONFIGURE_STATIC_ASSERT(sizeof(wchar_t) == 2);
                          CONFIGURE_STATIC_ASSERT((wchar_t)-1 > (wchar_t) 0)],
@@ -2801,6 +2802,7 @@
     if test "$ac_cv_have_usable_wchar_option_v2" = "yes"; then
         AC_DEFINE(HAVE_CPP_2BYTE_WCHAR_T)
         HAVE_CPP_2BYTE_WCHAR_T=1
+        WCHAR_CFLAGS="-fshort-wchar"
     else    
         CXXFLAGS=$_SAVE_CXXFLAGS
     fi
@@ -3240,7 +3242,7 @@
 			fi
 			;;
 
-	    *-*-linux*|*-*-kfreebsd*-gnu)
+	    *-*-linux*|*-*-kfreebsd*-gnu|*-*-gnu*)
 			AC_DEFINE(_REENTRANT) 
 			;;
 
@@ -4051,7 +4053,7 @@
 fi
 
 if test -n "$MOZ_NATIVE_NSS"; then
-   NSS_LIBS="$NSS_LIBS -lcrmf"
+   NSS_LIBS=`echo $NSS_LIBS | sed 's/-l/-lcrmf &/'`
 else
    NSS_CFLAGS='-I$(LIBXUL_DIST)/include/nss'
    NSS_DEP_LIBS="\
@@ -4096,7 +4098,7 @@
     AC_CHECK_LIB(jpeg, jpeg_destroy_compress, [SYSTEM_JPEG=1 JPEG_LIBS="-ljpeg $JPEG_LIBS"], SYSTEM_JPEG=, $JPEG_LIBS)
 fi
 
-if test "$SYSTEM_JPEG" = 1; then
+if test "$SYSTEM_JPEG" = 0; then
     LIBS="$JPEG_LIBS $LIBS"
     AC_TRY_COMPILE([ #include <stdio.h>
                      #include <sys/types.h>
@@ -4136,7 +4138,7 @@
     AC_CHECK_LIB(z, gzread, [SYSTEM_ZLIB=1 ZLIB_LIBS="-lz $ZLIB_LIBS"], 
 	[SYSTEM_ZLIB= ZLIB_CFLAGS= ZLIB_LIBS=], $ZLIB_LIBS)
 fi
-if test "$SYSTEM_ZLIB" = 1; then
+if test "$SYSTEM_ZLIB" = 0; then
     LIBS="$ZLIB_LIBS $LIBS"
     AC_TRY_COMPILE([ #include <stdio.h>
                      #include <string.h>
@@ -4201,6 +4203,7 @@
     CFLAGS="-I${PNG_DIR}/include $CFLAGS"
     LDFLAGS="-L${PNG_DIR}/lib $LDFLAGS"
 fi
+APNG=1
 if test -z "$PNG_DIR" -o "$PNG_DIR" = no; then
     SYSTEM_PNG=
 else
@@ -4209,10 +4212,11 @@
                  AC_MSG_ERROR([--with-system-png requested but no working libpng found]), 
                  $PNG_LIBS)
     AC_CHECK_LIB(png, png_get_acTL, ,
-                 AC_MSG_ERROR([--with-system-png won't work because the system's libpng doesn't have APNG support]),
+                 AC_MSG_WARN([system's libpng doesn't have APNG support])
+		 APNG=,
                  $_SAVE_PNG_LIBS)
 fi
-if test "$SYSTEM_PNG" = 1; then
+if test "$SYSTEM_PNG" = 0; then
     LIBS="$PNG_LIBS $LIBS"
     AC_TRY_COMPILE([ #include <stdio.h>
                      #include <sys/types.h>
@@ -5981,7 +5985,7 @@
     SQLITE_CFLAGS=
     SQLITE_LIBS='$(call EXPAND_LIBNAME_PATH,sqlite3,$(DIST)/lib)'
 else
-    PKG_CHECK_MODULES(SQLITE, sqlite3 >= $SQLITE_VERSION)
+    PKG_CHECK_MODULES(SQLITE, sqlite3)
 fi
 
 AC_SUBST(MOZ_NATIVE_SQLITE)
@@ -6053,6 +6057,40 @@
 AC_SUBST(JS_ULTRASPARC_OPTS)
 
 dnl ========================================================
+dnl = Enable building of the js standalone binary
+dnl ========================================================
+MOZ_ARG_ENABLE_BOOL(js-binary,
+[  --enable-js-binary      Build the standalone JS program],
+    ENABLE_JS_BINARY=1,
+    ENABLE_JS_BINARY= )
+AC_SUBST(ENABLE_JS_BINARY)
+
+if test -n "$ENABLE_JS_BINARY"; then
+    dnl readline Support
+    dnl ========================================================
+    READLINE_DIR=no
+    MOZ_ARG_WITH_STRING(readline,
+    [  --with-readline[=PFX]
+                              Use libreadline [installed at prefix PFX]],
+        READLINE_DIR=$withval)
+
+    if test -n "${READLINE_DIR}" -a "${READLINE_DIR}" != "no"; then
+        _SAVE_LDFLAGS=$LDFLAGS
+        LDFLAGS="-L${READLINE_DIR}/lib $LDFLAGS"
+        AC_CHECK_LIB(readline, readline, [HAVE_READLINE=1 READLINE_LIBS="-lreadline"],
+           [HAVE_READLINE= READLINE_LIBS=])
+        LDFLAGS=$_SAVE_LDFLAGS
+    fi
+
+    if test "${READLINE_DIR}" -a -d "${READLINE_DIR}" -a "$HAVE_READLINE" = 1; then
+        READLINE_LIBS="-L${READLINE_DIR}/lib ${READLINE_LIBS}"
+    fi
+fi
+
+AC_SUBST(HAVE_READLINE)
+AC_SUBST(READLINE_LIBS)
+
+dnl ========================================================
 dnl =
 dnl = Feature options that require extra sources to be pulled
 dnl =
@@ -7448,7 +7486,7 @@
         LCMS_LIBS='-L$(LIBXUL_DIST)/bin -lmozlcms'
     fi
 else
-    PKG_CHECK_MODULES(LCMS, lcms >= $LCMS_VERSION)
+    PKG_CHECK_MODULES(LCMS, lcms)
 fi
 
 AC_SUBST(MOZ_NATIVE_LCMS)
@@ -7939,6 +7977,7 @@
 AC_SUBST(SYSTEM_MAKEDEPEND)
 AC_SUBST(SYSTEM_JPEG)
 AC_SUBST(SYSTEM_PNG)
+AC_SUBST(APNG)
 AC_SUBST(SYSTEM_ZLIB)
 AC_SUBST(SYSTEM_BZ2)
 
@@ -7977,6 +8016,7 @@
 AC_SUBST(LDFLAGS)
 AC_SUBST(LIBS)
 AC_SUBST(CROSS_COMPILE)
+AC_SUBST(WCHAR_CFLAGS)
 
 AC_SUBST(HOST_CC)
 AC_SUBST(HOST_CXX)
--- xulrunner-1.9.0.19.orig/extensions/pref/autoconfig/src/nsReadConfig.cpp
+++ xulrunner-1.9.0.19/extensions/pref/autoconfig/src/nsReadConfig.cpp
@@ -284,10 +284,13 @@
         jsFile->AppendNative(NS_LITERAL_CSTRING("Essential Files"));
 #endif
     } else {
-        rv = NS_GetSpecialDirectory(NS_APP_DEFAULTS_50_DIR,
+        rv = NS_GetSpecialDirectory(NS_GRE_DIR,
                                     getter_AddRefs(jsFile));
         if (NS_FAILED(rv)) 
             return rv;
+        rv = jsFile->AppendNative(NS_LITERAL_CSTRING("defaults"));
+        if (NS_FAILED(rv))
+            return rv;
         rv = jsFile->AppendNative(NS_LITERAL_CSTRING("autoconfig"));
         if (NS_FAILED(rv))
             return rv;
--- xulrunner-1.9.0.19.orig/extensions/python/xpcom/src/Makefile.in
+++ xulrunner-1.9.0.19/extensions/python/xpcom/src/Makefile.in
@@ -82,7 +82,7 @@
 
 include $(topsrcdir)/config/config.mk
 
-CXXFLAGS += -DPYTHON_SO=\"libpython$(MOZ_PYTHON_VER_DOTTED).so\"
+CXXFLAGS += -DPYTHON_SO=\"$(PYTHON_SO)\"
 
 EXTRA_DSO_LDOPTS += $(XPCOM_GLUE_LDOPTS) \
                     $(MOZ_COMPONENT_LIBS) \
--- xulrunner-1.9.0.19.orig/extensions/python/xpcom/src/loader/Makefile.in
+++ xulrunner-1.9.0.19/extensions/python/xpcom/src/loader/Makefile.in
@@ -69,6 +69,7 @@
 
 EXTRA_DSO_LDOPTS += $(XPCOM_GLUE_LDOPTS) \
                     $(MOZ_COMPONENT_LIBS) \
+                    -Wl,-rpath,/usr/lib/xulrunner-1.9 \
                     $(NULL)
 
 include $(topsrcdir)/config/rules.mk
--- xulrunner-1.9.0.19.orig/extensions/python/xpcom/src/module/Makefile.in
+++ xulrunner-1.9.0.19/extensions/python/xpcom/src/module/Makefile.in
@@ -77,6 +77,7 @@
 else
   EXTRA_DSO_LDOPTS += $(XPCOM_GLUE_LDOPTS) \
                       $(MOZ_COMPONENT_LIBS) \
+		      -Wl,-rpath,/usr/lib/xulrunner-1.9
                       $(NULL)
 endif
 IMPORT_LIBRARY		:= $(SHARED_LIBRARY:.pyd=.lib)
--- xulrunner-1.9.0.19.orig/extensions/cookie/test/unit/test_bug650522.js
+++ xulrunner-1.9.0.19/extensions/cookie/test/unit/test_bug650522.js
@@ -0,0 +1,18 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+const Cc = Components.classes;
+const Ci = Components.interfaces;
+
+function run_test() {
+  var cs = Cc["@mozilla.org/cookieService;1"].getService(Ci.nsICookieService);
+  var cm = Cc["@mozilla.org/cookiemanager;1"].getService(Ci.nsICookieManager2);
+  var ios = Cc["@mozilla.org/network/io-service;1"].getService(Ci.nsIIOService);
+  var expiry = (Date.now() + 1000) * 1000;
+
+  // Test our handling of host names with a single character at the beginning
+  // followed by a dot.
+  cm.add("e.mail.com", "/", "foo", "bar", false, false, true, expiry);
+  do_check_eq(cm.countCookiesFromHost("e.mail.com"), 1);
+  do_check_eq(cs.getCookieString(ios.newURI("http://e.mail.com", null, null), null), "foo=bar");
+}
--- xulrunner-1.9.0.19.orig/extensions/java/xpcom/Makefile.in
+++ xulrunner-1.9.0.19/extensions/java/xpcom/Makefile.in
@@ -41,7 +41,11 @@
 
 include $(DEPTH)/config/autoconf.mk
 
-DIRS = interfaces glue
+DIRS = glue
+
+ifndef DEB_NO_JAR
+DIRS += interfaces
+endif
 
 ifdef ENABLE_TESTS
 DIRS += tests
@@ -50,8 +54,10 @@
 include $(topsrcdir)/config/rules.mk
 
 # Build the implementation Java classes
+ifndef DEB_NO_JAR
 libs::
 	$(MAKE) -C src jar-libs
 
 install::
 	$(MAKE) -C src jar-install
+endif
--- xulrunner-1.9.0.19.orig/toolkit/toolkit-makefiles.sh
+++ xulrunner-1.9.0.19/toolkit/toolkit-makefiles.sh
@@ -1116,7 +1116,7 @@
   "
 fi
 
-if [ "$MOZ_JAVAXPCOM" ]; then
+if [ " " ]; then
   add_makefiles "
     extensions/java/Makefile
     extensions/java/xpcom/Makefile
--- xulrunner-1.9.0.19.orig/toolkit/themes/gnomestripe/global/jar.mn
+++ xulrunner-1.9.0.19/toolkit/themes/gnomestripe/global/jar.mn
@@ -1,4 +1,5 @@
 classic.jar:
+%  override chrome://global/skin/icons/loading_16.png chrome://global/skin/icons/loading_16_grey.gif
 +  skin/classic/global/autocomplete.css
 +  skin/classic/global/popup.css
 +  skin/classic/global/menu.css
@@ -37,6 +38,7 @@
 +  skin/classic/global/icons/find.png                          (icons/find.png)
 +  skin/classic/global/icons/folder-item.png                   (icons/folder-item.png)
 +  skin/classic/global/icons/informationGhosted-64.png         (icons/informationGhosted-64.png)
++  skin/classic/global/icons/loading_16_grey.gif               (../../pinstripe/global/icons/loading_16_grey.gif)
 +  skin/classic/global/icons/loading_16.png                    (icons/loading_16.png)
 +  skin/classic/global/icons/notloading_16.png                 (icons/notloading_16.png)
 +  skin/classic/global/icons/notfound.png                      (icons/notfound.png)
--- xulrunner-1.9.0.19.orig/toolkit/content/Makefile.in
+++ xulrunner-1.9.0.19/toolkit/content/Makefile.in
@@ -45,8 +45,6 @@
 
 include $(DEPTH)/config/autoconf.mk
 
-DEFINES += -DMOZ_APP_VERSION=$(MOZ_APP_VERSION)
-
 ifdef ENABLE_TESTS
 DIRS += tests
 endif
--- xulrunner-1.9.0.19.orig/toolkit/content/jar.mn
+++ xulrunner-1.9.0.19/toolkit/content/jar.mn
@@ -8,7 +8,8 @@
 *  content/global/license.html                (license.html)
    content/global/XPCNativeWrapper.js         (XPCNativeWrapper.js)
 *  content/global/xul.css                     (xul.css)
-*  content/global/about.xhtml                 (about.xhtml)
+   content/global/about.xhtml                 (about.xhtml)
+   content/global/about.dtd
    content/global/plugins.html
    content/global/plugins.css
 +  content/global/buildconfig.html            (buildconfig.html)
--- xulrunner-1.9.0.19.orig/toolkit/content/about.dtd
+++ xulrunner-1.9.0.19/toolkit/content/about.dtd
@@ -0,0 +1,7 @@
+<!ENTITY about.readme.debian.beforeLink "Read the ">
+<!ENTITY about.readme.debian.linkTitle  "Debian README file">
+<!ENTITY about.readme.debian.afterLink  " for this package">
+
+<!ENTITY about.bugs.beforeLink "See the ">
+<!ENTITY about.bugs.linkTitle  "Debian bug reports">
+<!ENTITY about.bugs.afterLink  " for this package">
--- xulrunner-1.9.0.19.orig/toolkit/content/about.xhtml
+++ xulrunner-1.9.0.19/toolkit/content/about.xhtml
@@ -8,6 +8,8 @@
 %aboutDTD;
 <!ENTITY % globalDTD SYSTEM "chrome://global/locale/global.dtd">
 %globalDTD;
+<!ENTITY % aboutDTD2 SYSTEM "chrome://global/content/about.dtd">
+%aboutDTD2;
 ]>
 
 <!-- ***** BEGIN LICENSE BLOCK *****
@@ -62,16 +64,16 @@
   <div id="aboutLogoContainer">
     <a id="vendorURL" href="http://www.mozilla.org/">
       <img src="about:logo" alt="&brandShortName;"/>
-#expand <p id="version">&about.version; __MOZ_APP_VERSION__</p>
+      <p id="version"></p>
     </a>
   </div>
 
   <ul id="aboutPageList">
     <li>&about.copy.beforeLink; <a href="about:credits">&about.copy.linkTitle;</a> &about.copy.afterLink;</li>
     <li>&about.license.beforeLink; <a href="about:license">&about.license.linkTitle;</a> &about.license.afterLink;</li>
-    <!-- Release notes link removed pending fix for bug 349985
     <li>&about.relnotes.beforeLink; <a id="releaseNotesURL" href="">&about.relnotes.linkTitle;</a> &about.relnotes.afterLink;</li>
-    -->
+    <li id="readme.debian">&about.readme.debian.beforeLink;<a href="about:README.Debian">&about.readme.debian.linkTitle;</a>&about.readme.debian.afterLink;</li>
+    <li id ="bugs">&about.bugs.beforeLink;<a href="about:bugs">&about.bugs.linkTitle;</a>&about.bugs.afterLink;</li>
     <li>&about.buildconfig.beforeLink; <a href="about:buildconfig">&about.buildconfig.linkTitle;</a> &about.buildconfig.afterLink;</li>
     <script type="application/javascript">
       // get release notes URL from prefs
@@ -80,14 +82,33 @@
                                   .getService(Components.interfaces.nsIURLFormatter);
         var releaseNotesURL = formatter.formatURLPref("app.releaseNotesURL");
         var relnotes = document.getElementById("releaseNotesURL");
-        relnotes.setAttribute("href", releaseNotesURL);
+        if (releaseNotesURL == "about:blank") {
+          relnotes.parentNode.style.display = "none";
+        } else {
+          relnotes.setAttribute("href", releaseNotesURL);
+        }
 
         var vendorURL = formatter.formatURLPref("app.vendorURL");
         var vendor = document.getElementById("vendorURL");
-        vendor.setAttribute("href", vendorURL);
+        if (vendorURL == "about:blank") {
+          vendor.setAttribute("href", "");
+        } else {
+          vendor.setAttribute("href", vendorURL);
+        }
+
+        var versionNum = formatter.formatURL("%VERSION%");
+        var version = document.getElementById("version");
+        version.appendChild(document.createTextNode("&about.version; " + versionNum));
       }
       catch (ex) { /* no release notes and vendor URL for you without bug 349985 being fixed */ }
 
+      ["readme.debian", "bugs"].forEach(function (name) {
+        var node = document.getElementById(name);
+        if (! Components.classes["@mozilla.org/network/protocol/about;1?what=" +  name]) {
+          node.style.display = "none";
+        }
+      });
+
       var ua = navigator.userAgent;
       if (ua) {
         var list = document.getElementById("aboutPageList");
--- xulrunner-1.9.0.19.orig/toolkit/components/url-classifier/src/Makefile.in
+++ xulrunner-1.9.0.19/toolkit/components/url-classifier/src/Makefile.in
@@ -41,5 +41,9 @@
                       nsUrlClassifierListManager.js \
                       $(NULL)
 
+ifeq ($(OS_TEST),alpha)
+MOZ_OPTIMIZE_FLAGS := -O0
+endif
+
 include $(topsrcdir)/config/rules.mk
 
--- xulrunner-1.9.0.19.orig/toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp
+++ xulrunner-1.9.0.19/toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp
@@ -2029,8 +2029,9 @@
           return NS_ERROR_FAILURE;
         }
         const nsCSubstring& str = Substring(chunk, start, 4);
-        const PRUint32 *p = reinterpret_cast<const PRUint32*>(str.BeginReading());
-        entry->mAddChunkId = PR_ntohl(*p);
+        PRUint32 p;
+        memcpy(&p, reinterpret_cast<const PRUint32*>(str.BeginReading()), 4);
+        entry->mAddChunkId = PR_ntohl(p);
         if (entry->mAddChunkId == 0) {
           NS_WARNING("Received invalid chunk number.");
           return NS_ERROR_FAILURE;
@@ -2058,8 +2059,9 @@
 
         if (chunkType == CHUNK_SUB) {
           const nsCSubstring& str = Substring(chunk, start, 4);
-          const PRUint32 *p = reinterpret_cast<const PRUint32*>(str.BeginReading());
-          entry->mAddChunkId = PR_ntohl(*p);
+          PRUint32 p;
+          memcpy(&p, reinterpret_cast<const PRUint32*>(str.BeginReading()), 4);
+          entry->mAddChunkId = PR_ntohl(p);
           if (entry->mAddChunkId == 0) {
             NS_WARNING("Received invalid chunk number.");
             return NS_ERROR_FAILURE;
--- xulrunner-1.9.0.19.orig/toolkit/components/satchel/test/test_bug_511615.html
+++ xulrunner-1.9.0.19/toolkit/components/satchel/test/test_bug_511615.html
@@ -210,10 +210,7 @@
         nextTestPrivledged = true;
         break;
     case 15:
-        // XXX even with patch the popup is still opened.
-        // the keypress triggers a form input oninput / onchange
-        todo(false, "popup should be closed");
-        checkPopupOpen(true, -1);
+        checkPopupOpen(false);
         checkForm("v");
         break;
     // try a space
@@ -222,8 +219,7 @@
         nextTestPrivledged = true;
         break;
     case 17:
-        todo(false, "popup should be closed");
-        checkPopupOpen(false, -1);
+        checkPopupOpen(false);
         checkForm("v ");
         break;
     // backspace
@@ -232,17 +228,15 @@
         nextTestPrivledged = true;
         break;
     case 19:
-        todo(false, "popup should be closed");
-        checkPopupOpen(true, -1);
+        checkPopupOpen(false);
         checkForm("v");
         nextTestPrivledged = true;
         break;
     case 20:
         // We're privledged for this test, so open the popup.
-        todo(false, "popup should be closed");
-        checkPopupOpen(true, -1);
+        checkPopupOpen(false);
         checkForm("v");
-//        doKey("down");
+        doKey("down");
         nextTestPrivledged = true;
         break;
     case 21:
@@ -331,7 +325,7 @@
         break;
     case 203:
         // XXX we should ignore this input while popup is open?
-        checkPopupOpen(false, -1);
+        checkPopupOpen(true, 0);
         checkForm("v ");
         break;
     // backspace
@@ -341,13 +335,13 @@
         break;
     case 205:
         // XXX we should ignore this input while popup is open?
-        checkPopupOpen(true, -1);
+        checkPopupOpen(true, 0);
         checkForm("v");
         nextTestPrivledged = true;
         break;
     // Oops, reselect 1st entry
     case 206:
-        doKey("down");
+        // (this space intentionally left blank)
         nextTestPrivledged = true;
         break;
     case 207:
@@ -371,7 +365,7 @@
         break;
     case 211:
         checkPopupOpen(false);
-        checkForm("v");
+        checkForm("");
 
 
         SimpleTest.finish();
--- xulrunner-1.9.0.19.orig/toolkit/xre/nsAppRunner.cpp
+++ xulrunner-1.9.0.19/toolkit/xre/nsAppRunner.cpp
@@ -278,6 +278,16 @@
 #include "nsGTKToolkit.h"
 #endif
 
+// Save literal putenv string to environment variable.
+static void
+SaveToEnv(const char *putenv)
+{
+  char *expr = strdup(putenv);
+  if (expr)
+    PR_SetEnv(expr);
+  // We intentionally leak |expr| here since it is required by PR_SetEnv.
+}
+
 // Save the given word to the specified environment variable.
 static void
 SaveWordToEnv(const char *name, const nsACString & word)
@@ -1580,7 +1590,7 @@
     gRestartArgv[gRestartArgc] = nsnull;
   }
 
-  PR_SetEnv("MOZ_LAUNCHED_CHILD=1");
+  SaveToEnv("MOZ_LAUNCHED_CHILD=1");
 
 #if defined(XP_MACOSX)
   LaunchChildMac(gRestartArgc, gRestartArgv);
@@ -1806,7 +1816,7 @@
   PRBool offline = PR_FALSE;
   aProfileSvc->GetStartOffline(&offline);
   if (offline) {
-    PR_SetEnv("XRE_START_OFFLINE=1");
+    SaveToEnv("XRE_START_OFFLINE=1");
   }
 
   return LaunchChild(aNative);
@@ -1818,7 +1828,7 @@
 {
   nsresult rv;
 
-  PR_SetEnv("XRE_IMPORT_PROFILES=1");
+  SaveToEnv("XRE_IMPORT_PROFILES=1");
 
   // try to import old-style profiles
   { // scope XPCOM
@@ -2729,7 +2739,7 @@
   }
 #endif
 
-  PR_SetEnv("MOZ_LAUNCHED_CHILD=");
+  SaveToEnv("MOZ_LAUNCHED_CHILD=");
 
   gRestartArgc = gArgc;
   gRestartArgv = (char**) malloc(sizeof(char*) * (gArgc + 1));
@@ -2768,7 +2778,7 @@
     PR_fprintf(PR_STDERR, "Error: argument -a requires an application name\n");
     return 1;
   } else if (ar == ARG_FOUND) {
-    PR_SetEnv("MOZ_NO_REMOTE=1");
+    SaveToEnv("MOZ_NO_REMOTE=1");
   }
 
   // Handle -help and -version command line arguments.
@@ -2850,6 +2860,8 @@
           PR_fprintf(PR_STDERR, "Error: no display specified\n");
           return 1;
         }
+      } else {
+	SaveWordToEnv("DISPLAY", nsDependentCString(display_name));
       }
       display = gdk_display_open(display_name);
       if (!display) {
@@ -3170,14 +3182,14 @@
 
           // clear out any environment variables which may have been set 
           // during the relaunch process now that we know we won't be relaunching.
-          PR_SetEnv("XRE_PROFILE_PATH=");
-          PR_SetEnv("XRE_PROFILE_LOCAL_PATH=");
-          PR_SetEnv("XRE_PROFILE_NAME=");
-          PR_SetEnv("XRE_START_OFFLINE=");
-          PR_SetEnv("XRE_IMPORT_PROFILES=");
-          PR_SetEnv("NO_EM_RESTART=");
-          PR_SetEnv("XUL_APP_FILE=");
-          PR_SetEnv("XRE_BINARY_PATH=");
+          SaveToEnv("XRE_PROFILE_PATH=");
+          SaveToEnv("XRE_PROFILE_LOCAL_PATH=");
+          SaveToEnv("XRE_PROFILE_NAME=");
+          SaveToEnv("XRE_START_OFFLINE=");
+          SaveToEnv("XRE_IMPORT_PROFILES=");
+          SaveToEnv("NO_EM_RESTART=");
+          SaveToEnv("XUL_APP_FILE=");
+          SaveToEnv("XRE_BINARY_PATH=");
 
 #ifdef XP_MACOSX
           // we re-initialize the command-line service and do appleevents munging
@@ -3273,10 +3285,10 @@
       else {
         char* noEMRestart = PR_GetEnv("NO_EM_RESTART");
         if (noEMRestart && *noEMRestart) {
-          PR_SetEnv("NO_EM_RESTART=1");
+          SaveToEnv("NO_EM_RESTART=1");
         }
         else {
-          PR_SetEnv("NO_EM_RESTART=0");
+          SaveToEnv("NO_EM_RESTART=0");
         }
       }
 
--- xulrunner-1.9.0.19.orig/toolkit/xre/nsXREDirProvider.cpp
+++ xulrunner-1.9.0.19/toolkit/xre/nsXREDirProvider.cpp
@@ -614,6 +614,7 @@
 }
 
 static const char *const kAppendPrefDir[] = { "defaults", "preferences", nsnull };
+static const char *const kAppendSysPrefDir[] = { "defaults", "syspref", nsnull };
 
 #ifdef DEBUG_bsmedberg
 static void
@@ -670,6 +671,7 @@
     LoadAppDirIntoArray(mXULAppDir, kAppendPrefDir, directories);
     LoadDirsIntoArray(mAppBundleDirectories,
                       kAppendPrefDir, directories);
+    LoadAppDirIntoArray(mXULAppDir, kAppendSysPrefDir, directories);
 
     rv = NS_NewArrayEnumerator(aResult, directories);
   }
--- xulrunner-1.9.0.19.orig/dom/src/base/nsPluginArray.h
+++ xulrunner-1.9.0.19/dom/src/base/nsPluginArray.h
@@ -69,7 +69,8 @@
   PRBool AllowPlugins();
 
 public:
-  void SetDocShell(nsIDocShell* aDocShell);
+  void SetDocShell(nsIDocShell *aDocShell);
+  void Invalidate();
 
 protected:
   nsNavigator* mNavigator;
--- xulrunner-1.9.0.19.orig/dom/src/base/Makefile.in
+++ xulrunner-1.9.0.19/dom/src/base/Makefile.in
@@ -145,3 +145,7 @@
 endif
 
 include $(topsrcdir)/config/rules.mk
+
+LOCAL_INCLUDES += \
+       -I$(topsrcdir)/xpcom/io \
+       $(NULL)
--- xulrunner-1.9.0.19.orig/dom/src/base/nsDOMWindowUtils.h
+++ xulrunner-1.9.0.19/dom/src/base/nsDOMWindowUtils.h
@@ -43,13 +43,15 @@
 class nsGlobalWindow;
 
 class nsDOMWindowUtils : public nsIDOMWindowUtils,
-                         public nsSupportsWeakReference
+                         public nsSupportsWeakReference,
+                         public nsIDOMWindowUtils_1_9
 {
 public:
   nsDOMWindowUtils(nsGlobalWindow *aWindow);
   ~nsDOMWindowUtils();
   NS_DECL_ISUPPORTS
   NS_DECL_NSIDOMWINDOWUTILS
+  NS_DECL_NSIDOMWINDOWUTILS_1_9
 
 protected:
   nsRefPtr<nsGlobalWindow> mWindow;
--- xulrunner-1.9.0.19.orig/dom/src/base/nsJSEnvironment.cpp
+++ xulrunner-1.9.0.19/dom/src/base/nsJSEnvironment.cpp
@@ -218,7 +218,7 @@
 static PRTime sMaxScriptRunTime;
 static PRTime sMaxChromeScriptRunTime;
 
-static nsIScriptSecurityManager *sSecurityManager;
+static nsIScriptSecurityManager_1_9_2 *sSecurityManager;
 
 static nsICollation *gCollation;
 
@@ -420,6 +420,136 @@
   return called;
 }
 
+class ScriptErrorEvent : public nsRunnable
+{
+public:
+  ScriptErrorEvent(nsIScriptGlobalObject* aScriptGlobal,
+                   PRUint32 aLineNr, PRUint32 aColumn, PRUint32 aFlags,
+                   const nsAString& aErrorMsg,
+                   const nsAString& aFileName,
+                   const nsAString& aSourceLine,
+                   PRBool aDispatchEvent)
+  : mScriptGlobal(aScriptGlobal), mLineNr(aLineNr), mColumn(aColumn),
+    mFlags(aFlags), mErrorMsg(aErrorMsg), mFileName(aFileName),
+    mSourceLine(aSourceLine), mDispatchEvent(aDispatchEvent) {}
+
+  NS_IMETHOD Run()
+  {
+    nsEventStatus status = nsEventStatus_eIgnore;
+    // First, notify the DOM that we have a script error.
+    if (mDispatchEvent) {
+      nsCOMPtr<nsPIDOMWindow> win(do_QueryInterface(mScriptGlobal));
+      nsIDocShell* docShell = win ? win->GetDocShell() : nsnull;
+      if (docShell &&
+          !JSREPORT_IS_WARNING(mFlags) &&
+          !sHandlingScriptError) {
+        sHandlingScriptError = PR_TRUE; // Recursion prevention
+
+        nsCOMPtr<nsPresContext> presContext;
+        docShell->GetPresContext(getter_AddRefs(presContext));
+
+        if (presContext) {
+          nsScriptErrorEvent errorevent(PR_TRUE, NS_LOAD_ERROR);
+
+          errorevent.fileName = mFileName.get();
+
+          nsCOMPtr<nsIScriptObjectPrincipal> sop(do_QueryInterface(win));
+          NS_ENSURE_STATE(sop);
+          nsIPrincipal* p = sop->GetPrincipal();
+          NS_ENSURE_STATE(p);
+
+          PRBool sameOrigin = mFileName.IsVoid();
+
+          if (p && !sameOrigin) {
+            nsCOMPtr<nsIURI> errorURI;
+            NS_NewURI(getter_AddRefs(errorURI), mFileName);
+            if (errorURI) {
+              // FIXME: Once error reports contain the origin of the
+              // error (principals) we should change this to do the
+              // security check based on the principals and not
+              // URIs. See bug 387476.
+              sameOrigin = NS_SUCCEEDED(p->CheckMayLoad(errorURI, PR_FALSE));
+            }
+          }
+
+          NS_NAMED_LITERAL_STRING(xoriginMsg, "Script error.");
+          if (sameOrigin) {
+            errorevent.errorMsg = mErrorMsg.get();
+            errorevent.lineNr = mLineNr;
+          } else {
+            NS_WARNING("Not same origin error!");
+            errorevent.errorMsg = xoriginMsg.get();
+            errorevent.lineNr = 0;
+            // FIXME: once the principal of the script is not tied to
+            // the filename, we can stop using the post-redirect
+            // filename if we want and remove this line.  Note that
+            // apparently we can't handle null filenames in the error
+            // event dispatching code.
+            static PRUnichar nullFilename[] = { PRUnichar(0) };
+            errorevent.fileName = nullFilename;
+          }
+
+          nsEventDispatcher::Dispatch(win, presContext, &errorevent, nsnull,
+                                      &status);
+        }
+
+        sHandlingScriptError = PR_FALSE;
+      }
+    }
+
+    if (status != nsEventStatus_eConsumeNoDefault) {
+      // Make an nsIScriptError and populate it with information from
+      // this error.
+      nsCOMPtr<nsIScriptError> errorObject =
+        do_CreateInstance("@mozilla.org/scripterror;1");
+
+      if (errorObject != nsnull) {
+        nsresult rv = NS_ERROR_NOT_AVAILABLE;
+
+        // Set category to chrome or content
+        nsCOMPtr<nsIScriptObjectPrincipal> scriptPrincipal =
+          do_QueryInterface(mScriptGlobal);
+        NS_ASSERTION(scriptPrincipal, "Global objects must implement "
+                     "nsIScriptObjectPrincipal");
+        nsCOMPtr<nsIPrincipal> systemPrincipal;
+        sSecurityManager->GetSystemPrincipal(getter_AddRefs(systemPrincipal));
+        const char * category =
+          scriptPrincipal->GetPrincipal() == systemPrincipal
+          ? "chrome javascript"
+          : "content javascript";
+
+        rv = errorObject->Init(mErrorMsg.get(), mFileName.get(),
+                               mSourceLine.get(),
+                               mLineNr, mColumn, mFlags,
+                               category);
+
+        if (NS_SUCCEEDED(rv)) {
+          nsCOMPtr<nsIConsoleService> consoleService =
+            do_GetService(NS_CONSOLESERVICE_CONTRACTID, &rv);
+          if (NS_SUCCEEDED(rv)) {
+            consoleService->LogMessage(errorObject);
+          }
+        }
+      }
+    }
+    return NS_OK;
+  }
+
+
+  nsCOMPtr<nsIScriptGlobalObject> mScriptGlobal;
+  PRUint32                        mLineNr;
+  PRUint32                        mColumn;
+  PRUint32                        mFlags;
+  nsString                        mErrorMsg;
+  nsString                        mFileName;
+  nsString                        mSourceLine;
+  PRBool                          mDispatchEvent;
+
+  static PRBool sHandlingScriptError;
+};
+
+PRBool ScriptErrorEvent::sHandlingScriptError = PR_FALSE;
+
 // NOTE: This function could be refactored to use the above.  The only reason
 // it has not been done is that the code below only fills the error event
 // after it has a good nsPresContext - whereas using the above function
@@ -432,8 +562,6 @@
   // XXX this means we are not going to get error reports on non DOM contexts
   nsIScriptContext *context = nsJSUtils::GetDynamicScriptContext(cx);
 
-  nsEventStatus status = nsEventStatus_eIgnore;
-
   // Note: we must do this before running any more code on cx (if cx is the
   // dynamic script context).
   ::JS_ClearPendingException(cx);
@@ -443,9 +571,11 @@
 
     if (globalObject) {
       nsAutoString fileName, msg;
-      NS_NAMED_LITERAL_STRING(xoriginMsg, "Script error.");
-
-      fileName.AssignWithConversion(report->filename);
+      if (!report->filename) {
+        fileName.SetIsVoid(PR_TRUE);
+      } else {
+        fileName.AssignWithConversion(report->filename);
+      }
 
       const PRUnichar *m = reinterpret_cast<const PRUnichar*>
                                              (report->ucmessage);
@@ -457,113 +587,20 @@
         msg.AssignWithConversion(message);
       }
 
-      // First, notify the DOM that we have a script error.
+
       /* We do not try to report Out Of Memory via a dom
        * event because the dom event handler would encounter
        * an OOM exception trying to process the event, and
        * then we'd need to generate a new OOM event for that
        * new OOM instance -- this isn't pretty.
        */
-      {
-        // Scope to make sure we're not using |win| in the rest of
-        // this function when we should be using |globalObject|.  We
-        // only need |win| for the event dispatch.
-        nsCOMPtr<nsPIDOMWindow> win(do_QueryInterface(globalObject));
-        nsIDocShell *docShell = win ? win->GetDocShell() : nsnull;
-        if (docShell &&
-            (report->errorNumber != JSMSG_OUT_OF_MEMORY &&
-              !JSREPORT_IS_WARNING(report->flags))) {
-          static PRInt32 errorDepth; // Recursion prevention
-          ++errorDepth;
-
-          nsCOMPtr<nsPresContext> presContext;
-          docShell->GetPresContext(getter_AddRefs(presContext));
-
-          if (presContext && errorDepth < 2) {
-            nsScriptErrorEvent errorevent(PR_TRUE, NS_LOAD_ERROR);
-
-            errorevent.fileName = fileName.get();
-
-            nsCOMPtr<nsIScriptObjectPrincipal> sop(do_QueryInterface(win));
-            nsIPrincipal *p = sop->GetPrincipal();
-
-            PRBool sameOrigin = (report->filename == nsnull);
-
-            if (p && !sameOrigin) {
-              nsCOMPtr<nsIURI> errorURI;
-              NS_NewURI(getter_AddRefs(errorURI), report->filename);
-
-              nsCOMPtr<nsIURI> codebase;
-              p->GetURI(getter_AddRefs(codebase));
-
-              if (errorURI && codebase) {
-                // FIXME: Once error reports contain the origin of the
-                // error (principals) we should change this to do the
-                // security check based on the principals and not
-                // URIs. See bug 387476.
-                sameOrigin =
-                  NS_SUCCEEDED(sSecurityManager->
-                               CheckSameOriginURI(errorURI, codebase,
-                                                  PR_FALSE));
-              }
-            }
-
-            if (sameOrigin) {
-              errorevent.errorMsg = msg.get();
-              errorevent.lineNr = report->lineno;
-            } else {
-              errorevent.errorMsg = xoriginMsg.get();
-              errorevent.lineNr = 0;
-            }
-
-            // Dispatch() must be synchronous for the recursion block
-            // (errorDepth) to work.
-            nsEventDispatcher::Dispatch(win, presContext, &errorevent, nsnull,
-                                        &status);
-          }
-
-          --errorDepth;
-        }
-      }
-
-      if (status != nsEventStatus_eConsumeNoDefault) {
-        // Make an nsIScriptError and populate it with information from
-        // this error.
-        nsCOMPtr<nsIScriptError> errorObject =
-          do_CreateInstance("@mozilla.org/scripterror;1");
-
-        if (errorObject != nsnull) {
-          nsresult rv = NS_ERROR_NOT_AVAILABLE;
-
-          // Set category to chrome or content
-          nsCOMPtr<nsIScriptObjectPrincipal> scriptPrincipal =
-            do_QueryInterface(globalObject);
-          NS_ASSERTION(scriptPrincipal, "Global objects must implement "
-                       "nsIScriptObjectPrincipal");
-          nsCOMPtr<nsIPrincipal> systemPrincipal;
-          sSecurityManager->GetSystemPrincipal(getter_AddRefs(systemPrincipal));
-          const char * category =
-            scriptPrincipal->GetPrincipal() == systemPrincipal
-            ? "chrome javascript"
-            : "content javascript";
-
-          PRUint32 column = report->uctokenptr - report->uclinebuf;
-
-          rv = errorObject->Init(msg.get(), fileName.get(),
-                                 reinterpret_cast<const PRUnichar*>
-                                                 (report->uclinebuf),
-                                 report->lineno, column, report->flags,
-                                 category);
-
-          if (NS_SUCCEEDED(rv)) {
-            nsCOMPtr<nsIConsoleService> consoleService =
-              do_GetService(NS_CONSOLESERVICE_CONTRACTID, &rv);
-            if (NS_SUCCEEDED(rv)) {
-              consoleService->LogMessage(errorObject);
-            }
-          }
-        }
-      }
+      nsAutoString sourceLine;
+      sourceLine.Assign(reinterpret_cast<const PRUnichar*>(report->uclinebuf));
+      nsContentUtils::AddScriptRunner(
+        new ScriptErrorEvent(globalObject, report->lineno,
+                             report->uctokenptr - report->uclinebuf,
+                             report->flags, msg, fileName, sourceLine,
+                             report->errorNumber != JSMSG_OUT_OF_MEMORY));
     }
   }
 
@@ -588,8 +625,7 @@
   } else {
     error.Append(message);
   }
-  if (status != nsEventStatus_eIgnore && !JSREPORT_IS_WARNING(report->flags))
-    error.Append(" Error was suppressed by event handler\n");
+
   fprintf(stderr, "%s\n", error.get());
   fflush(stderr);
 #endif
@@ -1331,6 +1367,9 @@
 
   jsval val;
 
+  rv = sSecurityManager->PushContextPrincipal(mContext, nsnull, principal);
+  NS_ENSURE_SUCCESS(rv, rv);
+
   nsJSContext::TerminationFuncHolder holder(this);
 
   // SecurityManager said "ok", but don't compile if aVersion is unknown.
@@ -1379,6 +1418,8 @@
     }
   }
 
+  sSecurityManager->PopContextPrincipal(mContext);
+
   // Pop here, after JS_ValueToString and any other possible evaluation.
   if (NS_FAILED(stack->Pop(nsnull)))
     rv = NS_ERROR_FAILURE;
@@ -1511,6 +1552,9 @@
   // execution on any thread.
   jsval val;
 
+  rv = sSecurityManager->PushContextPrincipal(mContext, nsnull, principal);
+  NS_ENSURE_SUCCESS(rv, rv);
+
   nsJSContext::TerminationFuncHolder holder(this);
 
   // SecurityManager said "ok", but don't compile if aVersion is unknown.
@@ -1556,6 +1600,8 @@
     }
   }
 
+  sSecurityManager->PopContextPrincipal(mContext);
+
   // Pop here, after JS_ValueToString and any other possible evaluation.
   if (NS_FAILED(stack->Pop(nsnull)))
     rv = NS_ERROR_FAILURE;
@@ -1672,12 +1718,20 @@
   jsval val;
   JSBool ok;
 
+  JSObject *scriptObj = (JSObject*)aScriptObject;
+  nsCOMPtr<nsIPrincipal> principal;
+
+  rv = sSecurityManager->GetObjectPrincipal(mContext, scriptObj, getter_AddRefs(principal));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = sSecurityManager->PushContextPrincipal(mContext, nsnull, principal);
+  NS_ENSURE_SUCCESS(rv, rv);
+
   nsJSContext::TerminationFuncHolder holder(this);
   JSAutoRequest ar(mContext);
   ok = ::JS_ExecuteScript(mContext,
                           (JSObject *)aScopeObject,
-                          (JSScript*)::JS_GetPrivate(mContext,
-                          (JSObject*)aScriptObject),
+                          (JSScript*)::JS_GetPrivate(mContext, scriptObj),
                           &val);
 
   if (ok) {
@@ -1699,6 +1753,8 @@
     nsContentUtils::NotifyXPCIfExceptionPending(mContext);
   }
 
+  sSecurityManager->PopContextPrincipal(mContext);
+
   // Pop here, after JS_ValueToString and any other possible evaluation.
   if (NS_FAILED(stack->Pop(nsnull)))
     rv = NS_ERROR_FAILURE;
@@ -1893,9 +1949,8 @@
   // xxxmarkh - this comment is no longer true - principals are not used at
   // all now, and never were in some cases.
 
-  nsCOMPtr<nsIJSContextStack> stack =
-    do_GetService("@mozilla.org/js/xpc/ContextStack;1", &rv);
-  if (NS_FAILED(rv) || NS_FAILED(stack->Push(mContext)))
+  nsCxPusher pusher;
+  if (!pusher.Push(mContext))
     return NS_ERROR_FAILURE;
 
   // check if the event handler can be run on the object in question
@@ -1916,6 +1971,8 @@
           if (context && context != this) {
             JSContext* cx =
               static_cast<JSContext*>(context->GetNativeContext());
+            nsCOMPtr<nsIJSContextStack> stack =
+              do_GetService("@mozilla.org/js/xpc/ContextStack;1", &rv);
             rv = stack->Push(cx);
             if (NS_SUCCEEDED(rv)) {
               rv = sSecurityManager->CheckFunctionAccess(cx, aHandler,
@@ -1949,48 +2006,53 @@
     // in the same scope as aTarget.
     rv = ConvertSupportsTojsvals(aargv, target, &argc,
                                  reinterpret_cast<void **>(&argv), &mark);
-    if (NS_FAILED(rv)) {
-      stack->Pop(nsnull);
-      return rv;
-    }
+    NS_ENSURE_SUCCESS(rv, rv);
   
     AutoFreeJSStack stackGuard(mContext, mark); // ensure always freed.
 
-    jsval funval = OBJECT_TO_JSVAL(aHandler);
+
+    JSObject *funobj = static_cast<JSObject *>(aHandler);
+    nsCOMPtr<nsIPrincipal> principal;
+    rv = sSecurityManager->GetObjectPrincipal(mContext, funobj,
+                                              getter_AddRefs(principal));
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    JSStackFrame *currentfp = nsnull;
+    rv = sSecurityManager->PushContextPrincipal(mContext,
+                                                JS_FrameIterator(mContext, &currentfp),
+                                                principal);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    jsval funval = OBJECT_TO_JSVAL(funobj);
     JSAutoRequest ar(mContext);
     PRBool ok = ::JS_CallFunctionValue(mContext, target,
                                        funval, argc, argv, &rval);
 
     if (!ok) {
-      // Tell XPConnect about any pending exceptions. This is needed
-      // to avoid dropping JS exceptions in case we got here through
-      // nested calls through XPConnect.
-
-      if (JS_IsExceptionPending(mContext)) {
-        JS_ReportPendingException(mContext);
-      }
-
       // Don't pass back results from failed calls.
       rval = JSVAL_VOID;
 
       // Tell the caller that the handler threw an error.
       rv = NS_ERROR_FAILURE;
+    } else if (rval == JSVAL_NULL) {
+      *arv = nsnull;
+    } else {
+      rv = nsContentUtils::XPConnect()->JSToVariant(mContext, rval, arv);
     }
-  }
 
-  if (NS_FAILED(stack->Pop(nsnull)))
-    return NS_ERROR_FAILURE;
+    // Tell XPConnect about any pending exceptions. This is needed
+    // to avoid dropping JS exceptions in case we got here through
+    // nested calls through XPConnect.
 
-  // Convert to variant before calling ScriptEvaluated, as it may GC, meaning
-  // we would need to root rval.
-  JSAutoRequest ar(mContext);
-  if (NS_SUCCEEDED(rv)) {
-    if (rval == JSVAL_NULL)
-      *arv = nsnull;
-    else
-      rv = nsContentUtils::XPConnect()->JSToVariant(mContext, rval, arv);
+    if (NS_FAILED(rv) && JS_IsExceptionPending(mContext)) {
+      JS_ReportPendingException(mContext);
+    }
+
+    sSecurityManager->PopContextPrincipal(mContext);
   }
 
+  pusher.Pop();
+
   // ScriptEvaluated needs to come after we pop the stack
   ScriptEvaluated(PR_TRUE);
 
--- xulrunner-1.9.0.19.orig/dom/src/base/nsMimeTypeArray.h
+++ xulrunner-1.9.0.19/dom/src/base/nsMimeTypeArray.h
@@ -1,4 +1,5 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 sw=2 et tw=79: */
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
@@ -45,6 +46,8 @@
 
 class nsIDOMNavigator;
 
+// NB: Due to weak references, nsNavigator has intimate knowledge of our
+// members.
 class nsMimeTypeArray : public nsIDOMMimeTypeArray
 {
 public:
@@ -56,6 +59,13 @@
 
   nsresult Refresh();
 
+  void Invalidate()
+  {
+    // NB: This will cause GetMimeTypes to fail from now on.
+    mNavigator = nsnull;
+    Clear();
+  }
+
 private:
   nsresult GetMimeTypes();
   void     Clear();
--- xulrunner-1.9.0.19.orig/dom/src/base/nsBarProps.h
+++ xulrunner-1.9.0.19/dom/src/base/nsBarProps.h
@@ -56,26 +56,34 @@
 class nsBarProp : public nsIDOMBarProp
 {
 public:
-  nsBarProp();
+  explicit nsBarProp(nsGlobalWindow *aWindow);
   virtual ~nsBarProp();
 
   NS_DECL_ISUPPORTS
 
-  NS_IMETHOD SetWebBrowserChrome(nsIWebBrowserChrome* aBrowserChrome);
-
   NS_IMETHOD GetVisibleByFlag(PRBool *aVisible, PRUint32 aChromeFlag);
   NS_IMETHOD SetVisibleByFlag(PRBool aVisible, PRUint32 aChromeFlag);
 
 protected:
-  // Weak Reference
-  nsIWebBrowserChrome* mBrowserChrome;
+  already_AddRefed<nsIWebBrowserChrome> GetBrowserChrome();
+
+  nsGlobalWindow             *mDOMWindow;
+  nsCOMPtr<nsIWeakReference>  mDOMWindowWeakref;
+  /* Note the odd double reference to the owning global window.
+     Since the corresponding DOM window nominally owns this object,
+     but refcounted ownership of this object can be handed off to
+     owners unknown, we need a weak ref back to the DOM window.
+     However we also need access to properties of the DOM Window
+     that aren't available through interfaces. Then it's either
+     a weak ref and some skanky casting, or this funky double ref.
+     Funky beats skanky, so here we are. */
 };
 
 // Script "menubar" object
 class nsMenubarProp : public nsBarProp
 {
 public:
-  nsMenubarProp();
+  explicit nsMenubarProp(nsGlobalWindow *aWindow);
   virtual ~nsMenubarProp();
 
   NS_DECL_NSIDOMBARPROP
@@ -85,7 +93,7 @@
 class nsToolbarProp : public nsBarProp
 {
 public:
-  nsToolbarProp();
+  explicit nsToolbarProp(nsGlobalWindow *aWindow);
   virtual ~nsToolbarProp();
 
   NS_DECL_NSIDOMBARPROP
@@ -95,7 +103,7 @@
 class nsLocationbarProp : public nsBarProp
 {
 public:
-  nsLocationbarProp();
+  explicit nsLocationbarProp(nsGlobalWindow *aWindow);
   virtual ~nsLocationbarProp();
 
   NS_DECL_NSIDOMBARPROP
@@ -105,7 +113,7 @@
 class nsPersonalbarProp : public nsBarProp
 {
 public:
-  nsPersonalbarProp();
+  explicit nsPersonalbarProp(nsGlobalWindow *aWindow);
   virtual ~nsPersonalbarProp();
 
   NS_DECL_NSIDOMBARPROP
@@ -115,31 +123,20 @@
 class nsStatusbarProp : public nsBarProp
 {
 public:
-  nsStatusbarProp();
+  explicit nsStatusbarProp(nsGlobalWindow *aWindow);
   virtual ~nsStatusbarProp();
 
   NS_DECL_NSIDOMBARPROP
 };
 
 // Script "scrollbars" object
-class nsScrollbarsProp : public nsBarProp {
+class nsScrollbarsProp : public nsBarProp
+{
 public:
-  nsScrollbarsProp(nsGlobalWindow *aWindow);
+  explicit nsScrollbarsProp(nsGlobalWindow *aWindow);
   virtual ~nsScrollbarsProp();
 
   NS_DECL_NSIDOMBARPROP
-
-private:
-  nsGlobalWindow           *mDOMWindow;
-  nsCOMPtr<nsIWeakReference>  mDOMWindowWeakref;
-  /* Note the odd double reference to the owning global window.
-     Since the corresponding DOM window nominally owns this object,
-     yet refcounted ownership of this object can be handed off to
-     owners unknown, we need a weak ref to back to the DOM window.
-     However we also need access to properties of the DOM Window
-     that aren't available through interfaces. Then it's either
-     a weak ref and some skanky casting, or this funky double ref.
-     Funky beats skanky, so here we are. */
 };
 
 #endif /* nsBarProps_h___ */
--- xulrunner-1.9.0.19.orig/dom/src/base/nsGlobalWindow.cpp
+++ xulrunner-1.9.0.19/dom/src/base/nsGlobalWindow.cpp
@@ -2121,12 +2121,6 @@
     mScreen->SetDocShell(aDocShell);
 
   if (mDocShell) {
-    // tell our member elements about the new browserwindow
-    if (mMenubar) {
-      nsCOMPtr<nsIWebBrowserChrome> browserChrome;
-      GetWebBrowserChrome(getter_AddRefs(browserChrome));
-      mMenubar->SetWebBrowserChrome(browserChrome);
-    }
 
     // Get our enclosing chrome shell and retrieve its global window impl, so
     // that we can do some forwarding to the chrome document.
@@ -2705,15 +2699,10 @@
   *aMenubar = nsnull;
 
   if (!mMenubar) {
-    mMenubar = new nsMenubarProp();
+    mMenubar = new nsMenubarProp(this);
     if (!mMenubar) {
       return NS_ERROR_OUT_OF_MEMORY;
     }
-
-    nsCOMPtr<nsIWebBrowserChrome> browserChrome;
-    GetWebBrowserChrome(getter_AddRefs(browserChrome));
-
-    mMenubar->SetWebBrowserChrome(browserChrome);
   }
 
   NS_ADDREF(*aMenubar = mMenubar);
@@ -2729,15 +2718,10 @@
   *aToolbar = nsnull;
 
   if (!mToolbar) {
-    mToolbar = new nsToolbarProp();
+    mToolbar = new nsToolbarProp(this);
     if (!mToolbar) {
       return NS_ERROR_OUT_OF_MEMORY;
     }
-
-    nsCOMPtr<nsIWebBrowserChrome> browserChrome;
-    GetWebBrowserChrome(getter_AddRefs(browserChrome));
-
-    mToolbar->SetWebBrowserChrome(browserChrome);
   }
 
   NS_ADDREF(*aToolbar = mToolbar);
@@ -2753,15 +2737,10 @@
   *aLocationbar = nsnull;
 
   if (!mLocationbar) {
-    mLocationbar = new nsLocationbarProp();
+    mLocationbar = new nsLocationbarProp(this);
     if (!mLocationbar) {
       return NS_ERROR_OUT_OF_MEMORY;
     }
-
-    nsCOMPtr<nsIWebBrowserChrome> browserChrome;
-    GetWebBrowserChrome(getter_AddRefs(browserChrome));
-
-    mLocationbar->SetWebBrowserChrome(browserChrome);
   }
 
   NS_ADDREF(*aLocationbar = mLocationbar);
@@ -2777,15 +2756,10 @@
   *aPersonalbar = nsnull;
 
   if (!mPersonalbar) {
-    mPersonalbar = new nsPersonalbarProp();
+    mPersonalbar = new nsPersonalbarProp(this);
     if (!mPersonalbar) {
       return NS_ERROR_OUT_OF_MEMORY;
     }
-
-    nsCOMPtr<nsIWebBrowserChrome> browserChrome;
-    GetWebBrowserChrome(getter_AddRefs(browserChrome));
-
-    mPersonalbar->SetWebBrowserChrome(browserChrome);
   }
 
   NS_ADDREF(*aPersonalbar = mPersonalbar);
@@ -2801,15 +2775,10 @@
   *aStatusbar = nsnull;
 
   if (!mStatusbar) {
-    mStatusbar = new nsStatusbarProp();
+    mStatusbar = new nsStatusbarProp(this);
     if (!mStatusbar) {
       return NS_ERROR_OUT_OF_MEMORY;
     }
-
-    nsCOMPtr<nsIWebBrowserChrome> browserChrome;
-    GetWebBrowserChrome(getter_AddRefs(browserChrome));
-
-    mStatusbar->SetWebBrowserChrome(browserChrome);
   }
 
   NS_ADDREF(*aStatusbar = mStatusbar);
@@ -2829,11 +2798,6 @@
     if (!mScrollbars) {
       return NS_ERROR_OUT_OF_MEMORY;
     }
-
-    nsCOMPtr<nsIWebBrowserChrome> browserChrome;
-    GetWebBrowserChrome(getter_AddRefs(browserChrome));
-
-    mScrollbars->SetWebBrowserChrome(browserChrome);
   }
 
   NS_ADDREF(*aScrollbars = mScrollbars);
@@ -6156,6 +6120,22 @@
   return NS_OK;
 }
 
+class CommandDispatcher : public nsRunnable
+{
+public:
+  CommandDispatcher(nsIDOMXULCommandDispatcher* aDispatcher,
+                    const nsAString& aAction)
+  : mDispatcher(aDispatcher), mAction(aAction) {}
+
+  NS_IMETHOD Run()
+  {
+    return mDispatcher->UpdateCommands(mAction);
+  }
+
+  nsCOMPtr<nsIDOMXULCommandDispatcher> mDispatcher;
+  nsString                             mAction;
+};
+
 NS_IMETHODIMP
 nsGlobalWindow::UpdateCommands(const nsAString& anAction)
 {
@@ -6170,7 +6150,10 @@
     // Retrieve the command dispatcher and call updateCommands on it.
     nsCOMPtr<nsIDOMXULCommandDispatcher> xulCommandDispatcher;
     xulDoc->GetCommandDispatcher(getter_AddRefs(xulCommandDispatcher));
-    xulCommandDispatcher->UpdateCommands(anAction);
+    if (xulCommandDispatcher) {
+      nsContentUtils::AddScriptRunner(new CommandDispatcher(xulCommandDispatcher,
+                                                            anAction));
+    }
   }
 
   return NS_OK;
@@ -9099,6 +9082,10 @@
 nsNavigator::nsNavigator(nsIDocShell *aDocShell)
   : mDocShell(aDocShell)
 {
+  if (mMimeTypes)
+    mMimeTypes->Invalidate();
+  if (mPlugins)
+    mPlugins->Invalidate();
 }
 
 nsNavigator::~nsNavigator()
@@ -9649,8 +9636,15 @@
   // Release these so that they will be recreated for the
   // new document (if requested).  The plugins or mime types
   // arrays may have changed.  See bug 150087.
-  mMimeTypes = nsnull;
-  mPlugins = nsnull;
+  if (mMimeTypes) {
+    mMimeTypes->Invalidate();
+    mMimeTypes = nsnull;
+  }
+
+  if (mPlugins) {
+    mPlugins->Invalidate();
+    mPlugins = nsnull;
+  }
 }
 
 nsresult
--- xulrunner-1.9.0.19.orig/dom/src/base/nsGlobalWindow.h
+++ xulrunner-1.9.0.19/dom/src/base/nsGlobalWindow.h
@@ -435,6 +435,8 @@
   virtual nsresult SetArguments(nsIArray *aArguments, nsIPrincipal *aOrigin);
 
 protected:
+  friend class nsBarProp;
+
   // Object Management
   virtual ~nsGlobalWindow();
   void CleanUp();
--- xulrunner-1.9.0.19.orig/dom/src/base/nsDOMClassInfo.cpp
+++ xulrunner-1.9.0.19/dom/src/base/nsDOMClassInfo.cpp
@@ -602,8 +602,7 @@
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(DOMException, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
-  NS_DEFINE_CLASSINFO_DATA(DocumentFragment, nsDOMGenericSH,
-                           DOM_DEFAULT_SCRIPTABLE_FLAGS)
+  NS_DEFINE_CLASSINFO_DATA(DocumentFragment, nsNodeSH, NODE_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(Element, nsElementSH,
                            ELEMENT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(Attr, nsAttributeSH,
@@ -1890,6 +1889,7 @@
 
   DOM_CLASSINFO_MAP_BEGIN(WindowUtils, nsIDOMWindowUtils)
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMWindowUtils)
+    DOM_CLASSINFO_MAP_ENTRY(nsIDOMWindowUtils_1_9)
   DOM_CLASSINFO_MAP_END
 
   DOM_CLASSINFO_MAP_BEGIN(Location, nsIDOMLocation)
@@ -5871,13 +5871,75 @@
     return NS_OK;
   }
 
+  JSString *str = JSVAL_TO_STRING(id);
+
+  if (id == sLocation_id) {
+    // This must be done even if we're just getting the value of
+    // window.location (i.e. no checking flags & JSRESOLVE_ASSIGNING
+    // here) since we must define window.location to prevent the
+    // getter from being overriden (for security reasons).
+
+    nsCOMPtr<nsIDOMLocation> location;
+    rv = win->GetLocation(getter_AddRefs(location));
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    // Make sure we wrap the location object in the inner window's
+    // scope if we've got an inner window.
+    JSObject *scope = nsnull;
+    if (win->IsOuterWindow()) {
+      nsGlobalWindow *innerWin = win->GetCurrentInnerWindowInternal();
+
+      if (innerWin) {
+        scope = innerWin->GetGlobalJSObject();
+      }
+    }
+
+    if (!scope) {
+      wrapper->GetJSObject(&scope);
+    }
+
+    jsval v;
+    nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
+    rv = WrapNative(cx, scope, location, NS_GET_IID(nsIDOMLocation), &v,
+                    getter_AddRefs(holder));
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    PRBool doSecurityCheckInAddProperty = sDoSecurityCheckInAddProperty;
+    sDoSecurityCheckInAddProperty = PR_FALSE;
+
+    if (!win->IsChromeWindow()) {
+      rv = sXPConnect->GetXOWForObject(cx, scope, JSVAL_TO_OBJECT(v), &v);
+
+      if (NS_FAILED(rv)) {
+        NS_WARNING("Failed to get XOW for window object!");
+
+        sDoSecurityCheckInAddProperty = doSecurityCheckInAddProperty;
+
+        return rv;
+      }
+    }
+
+    JSAutoRequest ar(cx);
+
+    JSBool ok = ::JS_DefineUCProperty(cx, obj, ::JS_GetStringChars(str),
+                                      ::JS_GetStringLength(str), v, nsnull,
+                                      nsnull, JSPROP_ENUMERATE);
+
+    sDoSecurityCheckInAddProperty = doSecurityCheckInAddProperty;
+
+    if (!ok) {
+      return NS_ERROR_FAILURE;
+    }
+
+    *objp = obj;
+
+    return NS_OK;
+  }
 
   // Hmm, we do an awful lot of QIs here; maybe we should add a
   // method on an interface that would let us just call into the
   // window code directly...
 
-  JSString *str = JSVAL_TO_STRING(id);
-
   // Don't resolve named frames on native wrappers
   if (!ObjectIsNativeWrapper(cx, obj)) {
     nsCOMPtr<nsIDocShellTreeNode> dsn(do_QueryInterface(win->GetDocShell()));
@@ -6004,69 +6066,6 @@
     return NS_OK;
   }
 
-  if (id == sLocation_id) {
-    // This must be done even if we're just getting the value of
-    // window.location (i.e. no checking flags & JSRESOLVE_ASSIGNING
-    // here) since we must define window.location to prevent the
-    // getter from being overriden (for security reasons).
-
-    nsCOMPtr<nsIDOMLocation> location;
-    rv = win->GetLocation(getter_AddRefs(location));
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    // Make sure we wrap the location object in the inner window's
-    // scope if we've got an inner window.
-    JSObject *scope = nsnull;
-    if (win->IsOuterWindow()) {
-      nsGlobalWindow *innerWin = win->GetCurrentInnerWindowInternal();
-
-      if (innerWin) {
-        scope = innerWin->GetGlobalJSObject();
-      }
-    }
-
-    if (!scope) {
-      wrapper->GetJSObject(&scope);
-    }
-
-    jsval v;
-    nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
-    rv = WrapNative(cx, scope, location, NS_GET_IID(nsIDOMLocation), &v,
-                    getter_AddRefs(holder));
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    PRBool doSecurityCheckInAddProperty = sDoSecurityCheckInAddProperty;
-    sDoSecurityCheckInAddProperty = PR_FALSE;
-
-    if (!win->IsChromeWindow()) {
-      rv = sXPConnect->GetXOWForObject(cx, scope, JSVAL_TO_OBJECT(v), &v);
-
-      if (NS_FAILED(rv)) {
-        NS_WARNING("Failed to get XOW for window object!");
-
-        sDoSecurityCheckInAddProperty = doSecurityCheckInAddProperty;
-
-        return rv;
-      }
-    }
-
-    JSAutoRequest ar(cx);
-
-    JSBool ok = ::JS_DefineUCProperty(cx, obj, ::JS_GetStringChars(str),
-                                      ::JS_GetStringLength(str), v, nsnull,
-                                      nsnull, JSPROP_ENUMERATE);
-
-    sDoSecurityCheckInAddProperty = doSecurityCheckInAddProperty;
-
-    if (!ok) {
-      return NS_ERROR_FAILURE;
-    }
-
-    *objp = obj;
-
-    return NS_OK;
-  }
-
   if (flags & JSRESOLVE_ASSIGNING) {
     if (IsReadonlyReplaceable(id) ||
         (!(flags & JSRESOLVE_QUALIFIED) && IsWritableReplaceable(id))) {
--- xulrunner-1.9.0.19.orig/dom/src/base/nsDOMWindowUtils.cpp
+++ xulrunner-1.9.0.19/dom/src/base/nsDOMWindowUtils.cpp
@@ -55,6 +55,12 @@
 #include "nsIParser.h"
 #include "nsJSEnvironment.h"
 
+#include "nsICSSLoader.h"
+#include "nsICSSParser.h"
+#include "nsICSSStyleSheet.h"
+#include "nsUnicharInputStream.h"
+#include "nsNetUtil.h"
+
 #ifdef MOZ_ENABLE_GTK2
 #include <gdk/gdkx.h>
 #endif
@@ -63,6 +69,7 @@
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIDOMWindowUtils)
   NS_INTERFACE_MAP_ENTRY(nsIDOMWindowUtils)
   NS_INTERFACE_MAP_ENTRY(nsISupportsWeakReference)
+  NS_INTERFACE_MAP_ENTRY(nsIDOMWindowUtils_1_9)
   NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(WindowUtils)
 NS_INTERFACE_MAP_END
 
@@ -367,3 +374,65 @@
 
   return NS_OK;
 }
+
+NS_IMETHODIMP
+nsDOMWindowUtils::CssInitialSyntaxIsValid(const nsAString& aSheet,
+                                          PRBool *aRetVal)
+{
+  PRBool hasCap = PR_FALSE;
+  if (NS_FAILED(nsContentUtils::GetSecurityManager()->
+                IsCapabilityEnabled("UniversalXPConnect", &hasCap)) || !hasCap)
+    return NS_ERROR_DOM_SECURITY_ERR;
+
+  nsCOMPtr<nsIUnicharInputStream> stream;
+  nsresult rv = nsSimpleUnicharStreamFactory::GetInstance()->
+    CreateInstanceFromString(aSheet, getter_AddRefs(stream));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIURI> uri;
+  nsCAutoString uriContents("data:text/css,");
+  AppendUTF16toUTF8(aSheet, uriContents);
+  rv = NS_NewURI(getter_AddRefs(uri), uriContents.get());
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIPrincipal> principal;
+  rv = nsContentUtils::GetSecurityManager()->
+    GetCodebasePrincipal(uri, getter_AddRefs(principal));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsICSSStyleSheet> parsedSheet;
+  rv = NS_NewCSSStyleSheet(getter_AddRefs(parsedSheet));
+  NS_ENSURE_SUCCESS(rv, rv);
+  parsedSheet->SetURIs(uri, uri, uri);
+  parsedSheet->SetPrincipal(principal);
+
+  nsCOMPtr<nsICSSLoader> loader;
+  rv = NS_NewCSSLoader(getter_AddRefs(loader));
+  NS_ENSURE_SUCCESS(rv, rv);
+  loader->SetCompatibilityMode(eCompatibility_NavQuirks);
+
+  nsCOMPtr<nsICSSParser> parser;
+  rv = loader->GetParserFor(parsedSheet, getter_AddRefs(parser));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsICSSParser_1_9> pext(do_QueryInterface(parser));
+  NS_ABORT_IF_FALSE(pext, "nsICSSParser_1_9 missing from parser impl");
+
+  rv = pext->ParseWithInitialSyntaxCheck(stream, uri, uri, principal, 0,
+                                         PR_FALSE);
+  loader->RecycleParser(parser);
+
+  // In CheckInitialSyntax mode, the parser will return
+  // NS_ERROR_DOM_SYNTAX_ERR when the sheet has been rejected.
+  if (rv == NS_OK) {
+    *aRetVal = PR_TRUE;
+    return NS_OK;
+  } else if (rv == NS_ERROR_DOM_SYNTAX_ERR) {
+    *aRetVal = PR_FALSE;
+    return NS_OK;
+  } else {
+    NS_ABORT_IF_FALSE(NS_FAILED(rv),
+                      "CSS parser produced a success code other than NS_OK?!");
+    return rv;
+  }
+}
--- xulrunner-1.9.0.19.orig/dom/src/base/nsBarProps.cpp
+++ xulrunner-1.9.0.19/dom/src/base/nsBarProps.cpp
@@ -51,8 +51,11 @@
 //
 //  Basic (virtual) BarProp class implementation
 //
-nsBarProp::nsBarProp() : mBrowserChrome(nsnull)
+nsBarProp::nsBarProp(nsGlobalWindow *aWindow)
 {
+  mDOMWindow = aWindow;
+  nsISupports *supwin = static_cast<nsIScriptGlobalObject *>(aWindow);
+  mDOMWindowWeakref = do_GetWeakReference(supwin);
 }
 
 nsBarProp::~nsBarProp()
@@ -71,25 +74,19 @@
 NS_IMPL_ADDREF(nsBarProp)
 NS_IMPL_RELEASE(nsBarProp)
 
-
-NS_IMETHODIMP
-nsBarProp::SetWebBrowserChrome(nsIWebBrowserChrome* aBrowserChrome)
-{
-  mBrowserChrome = aBrowserChrome;
-  return NS_OK;
-}
-
 NS_IMETHODIMP
 nsBarProp::GetVisibleByFlag(PRBool *aVisible, PRUint32 aChromeFlag)
 {
-  NS_ENSURE_TRUE(mBrowserChrome, NS_ERROR_FAILURE);
+  *aVisible = PR_FALSE;
+
+  nsCOMPtr<nsIWebBrowserChrome> browserChrome = GetBrowserChrome();
+  NS_ENSURE_TRUE(browserChrome, NS_OK);
 
   PRUint32 chromeFlags;
-  *aVisible = PR_FALSE;
 
-  NS_ENSURE_SUCCESS(mBrowserChrome->GetChromeFlags(&chromeFlags),
+  NS_ENSURE_SUCCESS(browserChrome->GetChromeFlags(&chromeFlags),
                     NS_ERROR_FAILURE);
-  if(chromeFlags & aChromeFlag)
+  if (chromeFlags & aChromeFlag)
     *aVisible = PR_TRUE;
 
   return NS_OK;
@@ -98,9 +95,10 @@
 NS_IMETHODIMP
 nsBarProp::SetVisibleByFlag(PRBool aVisible, PRUint32 aChromeFlag)
 {
-  NS_ENSURE_TRUE(mBrowserChrome, NS_ERROR_FAILURE);
+  nsCOMPtr<nsIWebBrowserChrome> browserChrome = GetBrowserChrome();
+  NS_ENSURE_TRUE(browserChrome, NS_OK);
 
-  PRBool   enabled = PR_FALSE;
+  PRBool enabled = PR_FALSE;
 
   nsCOMPtr<nsIScriptSecurityManager>
            securityManager(do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID));
@@ -111,23 +109,37 @@
 
   PRUint32 chromeFlags;
 
-  NS_ENSURE_SUCCESS(mBrowserChrome->GetChromeFlags(&chromeFlags),
+  NS_ENSURE_SUCCESS(browserChrome->GetChromeFlags(&chromeFlags),
                     NS_ERROR_FAILURE);
-  if(aVisible)
+  if (aVisible)
     chromeFlags |= aChromeFlag;
   else
     chromeFlags &= ~aChromeFlag;
-  NS_ENSURE_SUCCESS(mBrowserChrome->SetChromeFlags(chromeFlags),
+  NS_ENSURE_SUCCESS(browserChrome->SetChromeFlags(chromeFlags),
                     NS_ERROR_FAILURE);
 
   return NS_OK;
 }
 
+already_AddRefed<nsIWebBrowserChrome>
+nsBarProp::GetBrowserChrome()
+{
+  // Check that the window is still alive.
+  nsCOMPtr<nsIDOMWindow> domwin(do_QueryReferent(mDOMWindowWeakref));
+  if (!domwin)
+    return nsnull;
+
+  nsIWebBrowserChrome *browserChrome = nsnull;
+  mDOMWindow->GetWebBrowserChrome(&browserChrome);
+  return browserChrome;
+}
+
 //
 // MenubarProp class implementation
 //
 
-nsMenubarProp::nsMenubarProp()
+nsMenubarProp::nsMenubarProp(nsGlobalWindow *aWindow) 
+  : nsBarProp(aWindow)
 {
 }
 
@@ -153,7 +165,8 @@
 // ToolbarProp class implementation
 //
 
-nsToolbarProp::nsToolbarProp()
+nsToolbarProp::nsToolbarProp(nsGlobalWindow *aWindow)
+  : nsBarProp(aWindow)
 {
 }
 
@@ -179,7 +192,8 @@
 // LocationbarProp class implementation
 //
 
-nsLocationbarProp::nsLocationbarProp()
+nsLocationbarProp::nsLocationbarProp(nsGlobalWindow *aWindow)
+  : nsBarProp(aWindow)
 {
 }
 
@@ -207,7 +221,8 @@
 // PersonalbarProp class implementation
 //
 
-nsPersonalbarProp::nsPersonalbarProp()
+nsPersonalbarProp::nsPersonalbarProp(nsGlobalWindow *aWindow)
+  : nsBarProp(aWindow)
 {
 }
 
@@ -235,7 +250,8 @@
 // StatusbarProp class implementation
 //
 
-nsStatusbarProp::nsStatusbarProp()
+nsStatusbarProp::nsStatusbarProp(nsGlobalWindow *aWindow)
+  : nsBarProp(aWindow)
 {
 }
 
@@ -262,10 +278,8 @@
 //
 
 nsScrollbarsProp::nsScrollbarsProp(nsGlobalWindow *aWindow)
+: nsBarProp(aWindow)
 {
-  mDOMWindow = aWindow;
-  nsISupports *supwin = static_cast<nsIScriptGlobalObject *>(aWindow);
-  mDOMWindowWeakref = do_GetWeakReference(supwin);
 }
 
 nsScrollbarsProp::~nsScrollbarsProp()
@@ -339,7 +353,7 @@
   }
 
   /* Notably absent is the part where we notify the chrome window using
-     mBrowserChrome->SetChromeFlags(). Given the possibility of multiple
+     GetBrowserChrome()->SetChromeFlags(). Given the possibility of multiple
      DOM windows (multiple top-level windows, even) within a single
      chrome window, the historical concept of a single "has scrollbars"
      flag in the chrome is inapplicable, and we can't tell at this level
--- xulrunner-1.9.0.19.orig/dom/src/base/nsMimeTypeArray.cpp
+++ xulrunner-1.9.0.19/dom/src/base/nsMimeTypeArray.cpp
@@ -1,4 +1,5 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 sw=2 et tw=79: */
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
@@ -198,6 +199,10 @@
   NS_PRECONDITION(!mMimeTypeArray && mMimeTypeCount==0,
                       "already initialized");
 
+  if (!mNavigator) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+
   nsIDOMPluginArray* pluginArray = nsnull;
   nsresult rv = mNavigator->GetPlugins(&pluginArray);
   if (rv == NS_OK) {
--- xulrunner-1.9.0.19.orig/dom/src/base/nsPluginArray.cpp
+++ xulrunner-1.9.0.19/dom/src/base/nsPluginArray.cpp
@@ -181,11 +181,18 @@
 }
 
 void
-nsPluginArray::SetDocShell(nsIDocShell* aDocShell)
+nsPluginArray::SetDocShell(nsIDocShell *aDocShell)
 {
   mDocShell = aDocShell;
 }
 
+void
+nsPluginArray::Invalidate()
+{
+  mDocShell = nsnull;
+  mNavigator = nsnull;
+}
+
 NS_IMETHODIMP
 nsPluginArray::Refresh(PRBool aReloadDocuments)
 {
--- xulrunner-1.9.0.19.orig/dom/tests/mochitest/bugs/Makefile.in
+++ xulrunner-1.9.0.19/dom/tests/mochitest/bugs/Makefile.in
@@ -81,6 +81,9 @@
 		iframe_bug440572.html \
 		test_bug504862.html \
 		file_bug504862.html \
+		test_bug531176.html \
+		test_window_bar.html \
+		file_window_bar.html \
 		$(NULL)
 
 libs:: 	$(_TEST_FILES)
--- xulrunner-1.9.0.19.orig/dom/tests/mochitest/bugs/file_window_bar.html
+++ xulrunner-1.9.0.19/dom/tests/mochitest/bugs/file_window_bar.html
@@ -0,0 +1,7 @@
+<html>
+<body onload='opener.testWindow(window)'>
+
+Nothing to see here!
+
+</body>
+</html>
--- xulrunner-1.9.0.19.orig/dom/tests/mochitest/bugs/test_window_bar.html
+++ xulrunner-1.9.0.19/dom/tests/mochitest/bugs/test_window_bar.html
@@ -0,0 +1,80 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=642338
+-->
+<head>
+  <title>Test for Bug 642338</title>
+  <script type="text/javascript" src="/MochiKit/packed.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=642338">Mozilla Bug 642338</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+
+/* Test that the following window properties work:
+
+     menubar
+     toolbar
+     locationbar
+     personalbar
+     statusbar
+     scrollbars
+
+*/
+
+var numWindows = 0;
+
+/* Called when our popup loads. */
+function testWindow(w)
+{
+  // w.location.search == '?true' if we expect the bars to be on, and
+  // '?false' otherwise.
+
+  var e = w.location.search == '?true';
+  
+  is(w.menubar.visible, e, "menubar");
+  is(w.toolbar.visible, e, "toolbar");
+  is(w.personalbar.visible, e, "personalbar");
+  is(w.scrollbars.visible, e, "scrollbars");
+
+  // You can't turn these off even if you try, so check that they're true.
+  is(w.locationbar.visible, true, "locationbar");
+  is(w.statusbar.visible, true, "statusbar");
+
+  w.close();
+
+  numWindows++;
+  if (numWindows == 2) {
+    // We're done!
+    SimpleTest.finish();
+  }
+
+}
+
+SimpleTest.waitForExplicitFinish();
+
+// These will call back into testWindow when they open.
+
+var allBarsWindow =
+  window.open('file_window_bar.html?true', 'all-bars',
+              'menubar=yes,toolbar=yes,location=yes,' +
+              'personalbar=yes,status=yes,scrollbars=yes',
+              true);
+
+var noBarsWindow = 
+  window.open('file_window_bar.html?false', 'no-bars',
+              'menubar=no,toolbar=no,location=no,' +
+              'personalbar=no,status=no,scrollbars=no',
+              false);
+
+</script>
+</pre>
+</body>
+</html>
--- xulrunner-1.9.0.19.orig/dom/tests/mochitest/bugs/test_bug531176.html
+++ xulrunner-1.9.0.19/dom/tests/mochitest/bugs/test_bug531176.html
@@ -0,0 +1,61 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=531176
+-->
+<head>
+  <title>Test for Bug 531176</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=531176">Mozilla Bug 531176</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 531176 **/
+
+var errorCount = 0;
+function errorHandler(msg, filename, linenr) {
+  is(msg, "syntax error", "Wrong error!");
+  is(filename, window.location, "Wrong filename!");
+  is(linenr, 1, "Wrong linenr!");
+  ++errorCount;
+}
+
+window.onerror = errorHandler;
+document.body.setAttribute("onclick", "var x=;");
+is(errorCount, 1, "Error handler should have been called! (1)");
+
+function recursiveHandler(msg, filename, linenr) {
+  is(msg, "syntax error", "Wrong error!");
+  is(filename, window.location, "Wrong filename!");
+  is(linenr, 1, "Wrong linenr!");
+  ++errorCount;
+  document.body.setAttribute("onclick", "var z=;");
+}
+
+window.onerror = recursiveHandler;
+document.body.setAttribute("onclick", "var y=;");
+is(errorCount, 2, "Error handler should have been called! (2)");
+
+// Check that error handler works even after recursion error.
+document.body.setAttribute("onclick", "var foo=;");
+is(errorCount, 3, "Error handler should have been called! (3)");
+
+window.onerror = function() { ++errorCount; };
+</script>
+<script>
+var foo =;
+</script>
+<script>
+is(errorCount, 4, "Error handler should have been called! (4)");
+</script>
+</pre>
+</body>
+</html>
--- xulrunner-1.9.0.19.orig/dom/public/idl/base/nsIDOMWindowUtils.idl
+++ xulrunner-1.9.0.19/dom/public/idl/base/nsIDOMWindowUtils.idl
@@ -179,3 +179,13 @@
    */
   void garbageCollect();
 };
+
+[scriptable, uuid(e947d605-6d3c-40fe-a0b1-4429df635b8b)]
+interface nsIDOMWindowUtils_1_9 : nsISupports
+{
+  /**
+   * Exposes the CSS parser's "initial syntax is valid" heuristic for
+   * testing.
+   */
+  boolean cssInitialSyntaxIsValid(in AString aSheet);
+};
--- xulrunner-1.9.0.19.orig/netwerk/protocol/http/src/nsHttpTransaction.cpp
+++ xulrunner-1.9.0.19/netwerk/protocol/http/src/nsHttpTransaction.cpp
@@ -656,11 +656,13 @@
     return gHttpHandler->InitiateTransaction(this, mPriority);
 }
 
-void
+nsresult
 nsHttpTransaction::ParseLine(char *line)
 {
     LOG(("nsHttpTransaction::ParseLine [%s]\n", line));
 
+    nsresult rv = NS_OK;
+
     if (!mHaveStatusLine) {
         mResponseHead->ParseStatusLine(line);
         mHaveStatusLine = PR_TRUE;
@@ -668,8 +670,10 @@
         if (mResponseHead->Version() == NS_HTTP_VERSION_0_9)
             mHaveAllHeaders = PR_TRUE;
     }
-    else
-        mResponseHead->ParseHeaderLine(line);
+    else {
+        rv = mResponseHead->ParseHeaderLine(line);
+    }
+    return rv;
 }
 
 nsresult
@@ -684,8 +688,11 @@
         // of mLineBuf.
         mLineBuf.Truncate(mLineBuf.Length() - 1);
         if (!mHaveStatusLine || (*segment != ' ' && *segment != '\t')) {
-            ParseLine(mLineBuf.BeginWriting());
+            nsresult rv = ParseLine(mLineBuf.BeginWriting());
             mLineBuf.Truncate();
+            if (NS_FAILED(rv)) {
+                return rv;
+            }
         }
     }
 
--- xulrunner-1.9.0.19.orig/netwerk/protocol/http/src/nsHttpHeaderArray.cpp
+++ xulrunner-1.9.0.19/netwerk/protocol/http/src/nsHttpHeaderArray.cpp
@@ -64,29 +64,50 @@
 
     // Create a new entry, or...
     if (!entry) {
-        entry = mHeaders.AppendElement(); //new nsEntry(header, value);
+        entry = mHeaders.AppendElement(); // new nsEntry()
         if (!entry)
             return NS_ERROR_OUT_OF_MEMORY;
         entry->header = header;
         entry->value = value;
+    } else if (merge && !IsSingletonHeader(header)) {
+        MergeHeader(header, entry, value);
+    } else {
+        // Replace the existing string with the new value
+        entry->value = value;
     }
-    // Append the new value to the existing value iff...
-    else if (merge && CanAppendToHeader(header)) {
-        if (header == nsHttp::Set_Cookie ||
-            header == nsHttp::WWW_Authenticate ||
-            header == nsHttp::Proxy_Authenticate)
-            // Special case these headers and use a newline delimiter to
-            // delimit the values from one another as commas may appear
-            // in the values of these headers contrary to what the spec says.
-            entry->value.Append('\n');
-        else
-            // Delimit each value from the others using a comma (per HTTP spec)
-            entry->value.AppendLiteral(", ");
-        entry->value.Append(value);
-    }
-    // Replace the existing string with the new value
-    else
+
+    return NS_OK;
+}
+
+nsresult
+nsHttpHeaderArray::SetHeaderFromNet(nsHttpAtom header, const nsACString &value)
+{
+    nsEntry *entry = nsnull;
+    PRInt32 index;
+
+    index = LookupEntry(header, &entry);
+
+    if (!entry) {
+        if (value.IsEmpty())
+            return NS_OK; // ignore empty headers
+        entry = mHeaders.AppendElement(); //new nsEntry(header, value);
+        if (!entry)
+            return NS_ERROR_OUT_OF_MEMORY;
+        entry->header = header;
         entry->value = value;
+    } else if (!IsSingletonHeader(header)) {
+        MergeHeader(header, entry, value);
+    } else {
+        // Multiple instances of non-mergeable header received from network
+        // - ignore if same value
+        if (!entry->value.Equals(value)) {
+            if (IsSuspectDuplicateHeader(header)) {
+                // reply may be corrupt/hacked (ex: CLRF injection attacks)
+                return NS_ERROR_CORRUPTED_CONTENT;
+            } // else silently drop value: keep value from 1st header seen
+        }
+    }
+
     return NS_OK;
 }
 
@@ -129,8 +150,8 @@
     return NS_OK;
 }
 
-void
-nsHttpHeaderArray::ParseHeaderLine(char *line, nsHttpAtom *hdr, char **val)
+nsresult
+nsHttpHeaderArray::ParseHeaderLine(const char *line, nsHttpAtom *hdr, char **val)
 {
     //
     // BNF from section 4.2 of RFC 2616:
@@ -149,13 +170,13 @@
     char *p = (char *) strchr(line, ':');
     if (!p) {
         LOG(("malformed header [%s]: no colon\n", line));
-        return;
+        return NS_OK;
     }
 
     // make sure we have a valid token for the field-name
     if (!nsHttp::IsValidToken(line, p)) {
         LOG(("malformed header [%s]: field-name not a token\n", line));
-        return;
+        return NS_OK;
     }
     
     *p = 0; // null terminate field-name
@@ -163,7 +184,7 @@
     nsHttpAtom atom = nsHttp::ResolveAtom(line);
     if (!atom) {
         LOG(("failed to resolve atom [%s]\n", line));
-        return;
+        return NS_OK;
     }
 
     // skip over whitespace
@@ -181,7 +202,7 @@
     if (val) *val = p;
 
     // assign response header
-    SetHeader(atom, nsDependentCString(p, p2 - p), PR_TRUE);
+    return SetHeaderFromNet(atom, nsDependentCString(p, p2 - p));
 }
 
 void
@@ -215,33 +236,3 @@
 {
     mHeaders.Clear();
 }
-
-//-----------------------------------------------------------------------------
-// nsHttpHeaderArray <private>
-//-----------------------------------------------------------------------------
-
-PRInt32
-nsHttpHeaderArray::LookupEntry(nsHttpAtom header, nsEntry **entry)
-{
-    PRUint32 index = mHeaders.IndexOf(header, 0, nsEntry::MatchHeader());
-    if (index != PR_UINT32_MAX)
-      *entry = &mHeaders[index];
-    return index;
-}
-
-PRBool
-nsHttpHeaderArray::CanAppendToHeader(nsHttpAtom header)
-{
-    return header != nsHttp::Content_Type        &&
-           header != nsHttp::Content_Length      &&
-           header != nsHttp::User_Agent          &&
-           header != nsHttp::Referer             &&
-           header != nsHttp::Host                &&
-           header != nsHttp::Authorization       &&
-           header != nsHttp::Proxy_Authorization &&
-           header != nsHttp::If_Modified_Since   &&
-           header != nsHttp::If_Unmodified_Since &&
-           header != nsHttp::From                &&
-           header != nsHttp::Location            &&
-           header != nsHttp::Max_Forwards;
-}
--- xulrunner-1.9.0.19.orig/netwerk/protocol/http/src/nsHttpTransaction.h
+++ xulrunner-1.9.0.19/netwerk/protocol/http/src/nsHttpTransaction.h
@@ -139,7 +139,7 @@
 
 private:
     nsresult Restart();
-    void     ParseLine(char *line);
+    nsresult ParseLine(char *line);
     nsresult ParseLineSegment(char *seg, PRUint32 len);
     nsresult ParseHead(char *, PRUint32 count, PRUint32 *countRead);
     nsresult HandleContentStart();
--- xulrunner-1.9.0.19.orig/netwerk/protocol/http/src/nsHttpResponseHead.h
+++ xulrunner-1.9.0.19/netwerk/protocol/http/src/nsHttpResponseHead.h
@@ -106,7 +106,7 @@
     void     ParseStatusLine(char *line);
 
     // parse a header line. line must be null terminated. parsing is destructive.
-    void     ParseHeaderLine(char *line);
+    nsresult ParseHeaderLine(char *line);
 
     // cache validation support methods
     nsresult ComputeFreshnessLifetime(PRUint32 *);
--- xulrunner-1.9.0.19.orig/netwerk/protocol/http/src/nsHttpResponseHead.cpp
+++ xulrunner-1.9.0.19/netwerk/protocol/http/src/nsHttpResponseHead.cpp
@@ -197,23 +197,30 @@
         PRUintn(mVersion), PRUintn(mStatus), mStatusText.get()));
 }
 
-void
+nsresult
 nsHttpResponseHead::ParseHeaderLine(char *line)
 {
     nsHttpAtom hdr = {0};
     char *val;
 
-    mHeaders.ParseHeaderLine(line, &hdr, &val);
+    nsresult rv;
+
+    rv = mHeaders.ParseHeaderLine(line, &hdr, &val);
+    if (NS_FAILED(rv))
+        return rv;
+
     // leading and trailing LWS has been removed from |val|
 
     // handle some special case headers...
     if (hdr == nsHttp::Content_Length) {
         PRInt64 len;
         // permit only a single value here.
-        if (nsHttp::ParseInt64(val, &len))
+        if (nsHttp::ParseInt64(val, &len)) {
             mContentLength = len;
-        else
+        } else {
             LOG(("invalid content-length!\n"));
+            return NS_ERROR_CORRUPTED_CONTENT;
+        }
     }
     else if (hdr == nsHttp::Content_Type) {
         LOG(("ParseContentType [type=%s]\n", val));
@@ -225,6 +232,7 @@
         ParseCacheControl(val);
     else if (hdr == nsHttp::Pragma)
         ParsePragma(val);
+    return NS_OK;
 }
 
 // From section 13.2.3 of RFC2616, we compute the current age of a cached
--- xulrunner-1.9.0.19.orig/netwerk/protocol/http/src/nsHttpChannel.cpp
+++ xulrunner-1.9.0.19/netwerk/protocol/http/src/nsHttpChannel.cpp
@@ -836,6 +836,7 @@
     LOG(("Cancelling failed SSL proxy connection [this=%x httpStatus=%u]\n",
          this, httpStatus)); 
     Cancel(rv);
+    CallOnStartRequest();
     return rv;
 }
 
--- xulrunner-1.9.0.19.orig/netwerk/protocol/http/src/nsHttpHeaderArray.h
+++ xulrunner-1.9.0.19/netwerk/protocol/http/src/nsHttpHeaderArray.h
@@ -54,7 +54,14 @@
 
     const char *PeekHeader(nsHttpAtom header);
 
-    nsresult SetHeader(nsHttpAtom header, const nsACString &value, PRBool merge = PR_FALSE);
+    // Used by internal setters: to set header from network use SetHeaderFromNet
+    nsresult SetHeader(nsHttpAtom header, const nsACString &value,
+                       PRBool merge = PR_FALSE);
+
+    // Merges supported headers. For other duplicate values, determines if error
+    // needs to be thrown or 1st value kept.
+    nsresult SetHeaderFromNet(nsHttpAtom header, const nsACString &value);
+
     nsresult GetHeader(nsHttpAtom header, nsACString &value);
     void     ClearHeader(nsHttpAtom h);
 
@@ -73,7 +80,9 @@
 
     // parse a header line, return the header atom and a pointer to the 
     // header value (the substring of the header line -- do not free).
-    void ParseHeaderLine(char *line, nsHttpAtom *header=nsnull, char **value=nsnull);
+    nsresult ParseHeaderLine(const char *line,
+                             nsHttpAtom *header=nsnull,
+                             char **value=nsnull);
 
     void Flatten(nsACString &, PRBool pruneProxyHeaders=PR_FALSE);
 
@@ -99,10 +108,87 @@
     };
 
     PRInt32 LookupEntry(nsHttpAtom header, nsEntry **);
-    PRBool  CanAppendToHeader(nsHttpAtom header);
+    void MergeHeader(nsHttpAtom header, nsEntry *entry, const nsACString &value);
+
+    // Header cannot be merged: only one value possible
+    PRBool  IsSingletonHeader(nsHttpAtom header);
+
+    // Subset of singleton headers: should never see multiple, different
+    // instances of these, else something fishy may be going on (like CLRF
+    // injection)
+    PRBool  IsSuspectDuplicateHeader(nsHttpAtom header);
 
 private:
     nsTArray<nsEntry> mHeaders;
 };
 
+
+//-----------------------------------------------------------------------------
+// nsHttpHeaderArray <private>: inline functions
+//-----------------------------------------------------------------------------
+
+inline PRInt32
+nsHttpHeaderArray::LookupEntry(nsHttpAtom header, nsEntry **entry)
+{
+    PRUint32 index = mHeaders.IndexOf(header, 0, nsEntry::MatchHeader());
+    if (index != PR_UINT32_MAX)
+        *entry = &mHeaders[index];
+    return index;
+}
+
+inline PRBool
+nsHttpHeaderArray::IsSingletonHeader(nsHttpAtom header)
+{
+    return header == nsHttp::Content_Type        ||
+           header == nsHttp::Content_Disposition ||
+           header == nsHttp::Content_Length      ||
+           header == nsHttp::User_Agent          ||
+           header == nsHttp::Referer             ||
+           header == nsHttp::Host                ||
+           header == nsHttp::Authorization       ||
+           header == nsHttp::Proxy_Authorization ||
+           header == nsHttp::If_Modified_Since   ||
+           header == nsHttp::If_Unmodified_Since ||
+           header == nsHttp::From                ||
+           header == nsHttp::Location            ||
+           header == nsHttp::Max_Forwards;
+}
+
+inline void
+nsHttpHeaderArray::MergeHeader(nsHttpAtom header,
+                               nsEntry *entry,
+                               const nsACString &value)
+{
+    if (value.IsEmpty())
+        return;   // merge of empty header = no-op
+
+    // Append the new value to the existing value
+    if (header == nsHttp::Set_Cookie ||
+        header == nsHttp::WWW_Authenticate ||
+        header == nsHttp::Proxy_Authenticate)
+    {
+        // Special case these headers and use a newline delimiter to
+        // delimit the values from one another as commas may appear
+        // in the values of these headers contrary to what the spec says.
+        entry->value.Append('\n');
+    } else {
+        // Delimit each value from the others using a comma (per HTTP spec)
+        entry->value.AppendLiteral(", ");
+    }
+    entry->value.Append(value);
+}
+
+inline PRBool
+nsHttpHeaderArray::IsSuspectDuplicateHeader(nsHttpAtom header)
+{
+    PRBool retval =  header == nsHttp::Content_Length         ||
+                     header == nsHttp::Content_Disposition    ||
+                     header == nsHttp::Location;
+
+    NS_ASSERTION(!retval || IsSingletonHeader(header),
+                 "Only non-mergeable headers should be in this list\n");
+
+    return retval;
+}
+
 #endif
--- xulrunner-1.9.0.19.orig/netwerk/protocol/res/src/nsResProtocolHandler.cpp
+++ xulrunner-1.9.0.19/netwerk/protocol/res/src/nsResProtocolHandler.cpp
@@ -348,10 +348,6 @@
 {
     nsresult rv;
 
-    nsCOMPtr<nsIURL> url(do_QueryInterface(uri));
-    if (!url)
-        return NS_NOINTERFACE;
-
     nsCAutoString host;
     nsCAutoString path;
 
@@ -361,15 +357,15 @@
     rv = uri->GetPath(path);
     if (NS_FAILED(rv)) return rv;
 
-    nsCAutoString filepath;
-    url->GetFilePath(filepath);
+    // Unescape the path so we can perform some checks on it.
+    nsCAutoString unescapedPath(path);
+    NS_UnescapeURL(unescapedPath);
 
     // Don't misinterpret the filepath as an absolute URI.
-    if (filepath.FindChar(':') != -1)
+    if (unescapedPath.FindChar(':') != -1)
         return NS_ERROR_MALFORMED_URI;
 
-    NS_UnescapeURL(filepath);
-    if (filepath.FindChar('\\') != -1)
+    if (unescapedPath.FindChar('\\') != -1)
         return NS_ERROR_MALFORMED_URI;
 
     const char *p = path.get() + 1; // path always starts with a slash
--- xulrunner-1.9.0.19.orig/netwerk/cookie/src/Makefile.in
+++ xulrunner-1.9.0.19/netwerk/cookie/src/Makefile.in
@@ -60,5 +60,4 @@
 
 include $(topsrcdir)/config/rules.mk
 
-CXXFLAGS += $(WARNINGS_AS_ERRORS)
 DEFINES += -DIMPL_NS_NET
--- xulrunner-1.9.0.19.orig/netwerk/cookie/src/nsCookieService.h
+++ xulrunner-1.9.0.19/netwerk/cookie/src/nsCookieService.h
@@ -174,6 +174,7 @@
     void                          UpdateCookieInList(nsCookie *aCookie, PRInt64 aLastAccessed);
     static PRBool                 GetTokenValue(nsASingleFragmentCString::const_char_iterator &aIter, nsASingleFragmentCString::const_char_iterator &aEndIter, nsDependentCSubstring &aTokenString, nsDependentCSubstring &aTokenValue, PRBool &aEqualsFound);
     static PRBool                 ParseAttributes(nsDependentCString &aCookieHeader, nsCookieAttributes &aCookie);
+    nsresult                      NormalizeHost(nsCString &aHost);
     PRBool                        IsForeign(nsIURI *aHostURI, nsIURI *aFirstURI);
     PRUint32                      CheckPrefs(nsIURI *aHostURI, nsIChannel *aChannel, const char *aCookieHeader);
     PRBool                        CheckDomain(nsCookieAttributes &aCookie, nsIURI *aHostURI);
--- xulrunner-1.9.0.19.orig/netwerk/cookie/src/nsCookieService.cpp
+++ xulrunner-1.9.0.19/netwerk/cookie/src/nsCookieService.cpp
@@ -731,7 +731,11 @@
  
   // switch to a nice string type now, and process each cookie in the header
   nsDependentCString cookieHeader(aCookieHeader);
-  while (SetCookieInternal(aHostURI, aChannel, cookieHeader, serverTime, aFromHttp));
+  while (SetCookieInternal(aHostURI, aChannel, cookieHeader, serverTime, aFromHttp)) {
+    // document.cookie can only set one cookie at a time
+    if (!aFromHttp)
+      break;
+  }
 
   return NS_OK;
 }
@@ -844,6 +848,11 @@
                      PRBool            aIsSession,
                      PRInt64           aExpiry)
 {
+  // empty domains are acceptable (e.g. file:// URI's), but we reject the host
+  // '.'. 
+  NS_ENSURE_TRUE(aDomain.IsEmpty() ||
+    !(aDomain.Length() == 1 && aDomain.Last() == '.'), NS_ERROR_INVALID_ARG);
+
   PRInt64 currentTimeInUsec = PR_Now();
 
   nsRefPtr<nsCookie> cookie =
@@ -868,6 +877,11 @@
                         const nsACString &aPath,
                         PRBool           aBlocked)
 {
+  // empty domains are acceptable (e.g. file:// URI's), but we reject the host
+  // '.'.
+  NS_ENSURE_TRUE(aHost.IsEmpty() ||
+    !(aHost.Length() == 1 && aHost.Last() == '.'), NS_ERROR_INVALID_ARG);
+
   nsListIter matchIter;
   if (FindCookie(PromiseFlatCString(aHost),
                  PromiseFlatCString(aName),
@@ -1145,6 +1159,9 @@
     COOKIE_LOGFAILURE(GET_COOKIE, aHostURI, nsnull, "couldn't get host/path from URI");
     return;
   }
+  // aHostURI may be the string '.'. If so, fail.
+  if (hostFromURI.Length() == 1 && hostFromURI.Last() == '.')
+    return;
   // trim trailing dots
   hostFromURI.Trim(".");
   // insert a leading dot, so we begin the hash lookup with the
@@ -1165,6 +1182,7 @@
   PRInt64 currentTime = currentTimeInUsec / PR_USEC_PER_SEC;
   const char *currentDot = hostFromURI.get();
   const char *nextDot = currentDot + 1;
+  const char *end = currentDot + (hostFromURI.Length() - 1);
   PRBool stale = PR_FALSE;
 
   // begin hash lookup, walking up the subdomain levels.
@@ -1223,7 +1241,7 @@
     if (currentDot)
       nextDot = strchr(currentDot + 1, '.');
 
-  } while (currentDot);
+  } while (currentDot && !(currentDot <= end && *(currentDot + 1) == '\0' && *currentDot == '.'));
 
   PRInt32 count = foundCookieList.Count();
   if (count == 0)
@@ -1732,9 +1750,6 @@
     // assume foreign
     return PR_TRUE;
   }
-  // trim trailing dots
-  currentHost.Trim(".");
-  firstHost.Trim(".");
 
   // fast path: check if the two hosts are identical.
   // this also covers two special cases:
@@ -1758,7 +1773,6 @@
     // URI is an IP, eTLD, or something else went wrong - assume foreign
     return PR_TRUE;
   }  
-  baseDomain.Trim(".");
 
   // ensure the host domain is derived from the base domain.
   // we prepend dots before the comparison to ensure e.g.
@@ -1839,12 +1853,18 @@
   if (NS_FAILED(aHostURI->GetAsciiHost(hostFromURI))) {
     return PR_FALSE;
   }
-  // trim trailing dots
-  hostFromURI.Trim(".");
+
+  // aHostURI may be the string '.'. If so, fail.
+  if (hostFromURI.Length() == 1 && hostFromURI.Last() == '.')
+    return PR_FALSE;
 
   // if a domain is given, check the host has permission
   if (!aCookieAttributes.host.IsEmpty()) {
-    aCookieAttributes.host.Trim(".");
+    // Tolerate leading '.' characters, but not if it's otherwise an empty host.
+    if (aCookieAttributes.host.Length() > 1 &&
+        aCookieAttributes.host.First() == '.') {
+      aCookieAttributes.host.Cut(0, 1);
+    }
     // switch to lowercase now, to avoid case-insensitive compares everywhere
     ToLowerCase(aCookieAttributes.host);
 
@@ -1853,14 +1873,14 @@
     // represents the lowest level domain a cookie can be set for.
     nsCAutoString baseDomain;
     rv = mTLDService->GetBaseDomain(aHostURI, 0, baseDomain);
-    baseDomain.Trim(".");
     if (NS_FAILED(rv)) {
       // check whether the host is an IP address, and leave the cookie as
       // a non-domain one. this will require an exact host match for the cookie,
       // so we eliminate any chance of IP address funkiness (e.g. the alias 127.1
       // domain-matching 99.54.127.1). bug 105917 originally noted the
       // requirement to deal with IP addresses.
-      if (rv == NS_ERROR_HOST_IS_IP_ADDRESS)
+      if (rv == NS_ERROR_HOST_IS_IP_ADDRESS ||
+          rv == NS_ERROR_INSUFFICIENT_DOMAIN_LEVELS)
         return hostFromURI.Equals(aCookieAttributes.host);
 
       return PR_FALSE;
@@ -2066,12 +2086,18 @@
 nsCookieService::CountCookiesFromHostInternal(const nsACString  &aHost,
                                               nsEnumerationData &aData)
 {
+  // empty domains are acceptable (e.g. file:// URI's), but we reject the host
+  // '.'.
+  NS_ASSERTION(aHost.IsEmpty() ||
+    !(aHost.Length() == 1 && aHost.Last() == '.'), "invalid host");
+
   PRUint32 countFromHost = 0;
 
   nsCAutoString hostWithDot(NS_LITERAL_CSTRING(".") + aHost);
 
   const char *currentDot = hostWithDot.get();
   const char *nextDot = currentDot + 1;
+  const char *end = currentDot + (hostWithDot.Length() - 1);
   do {
     nsCookieEntry *entry = mHostTable.GetEntry(currentDot);
     for (nsListIter iter(entry); iter.current; ++iter) {
@@ -2091,7 +2117,7 @@
     if (currentDot)
       nextDot = strchr(currentDot + 1, '.');
 
-  } while (currentDot);
+  } while (currentDot && !(currentDot <= end && *(currentDot + 1) == '\0' && *currentDot == '.'));
 
   return countFromHost;
 }
@@ -2102,6 +2128,11 @@
 nsCookieService::CountCookiesFromHost(const nsACString &aHost,
                                       PRUint32         *aCountFromHost)
 {
+  // empty domains are acceptable (e.g. file:// URI's), but we reject the host
+  // '.'.
+  NS_ENSURE_TRUE(aHost.IsEmpty() ||
+    !(aHost.Length() == 1 && aHost.Last() == '.'), NS_ERROR_INVALID_ARG);
+
   // we don't care about finding the oldest cookie here, so disable the search
   nsEnumerationData data(PR_Now() / PR_USEC_PER_SEC, LL_MININT);
   
--- xulrunner-1.9.0.19.orig/netwerk/base/src/nsURLHelper.h
+++ xulrunner-1.9.0.19/netwerk/base/src/nsURLHelper.h
@@ -136,7 +136,8 @@
  * This function strips out all whitespace at the beginning and end of the URL
  * and strips out \r, \n, \t from the middle of the URL.  This makes it safe to
  * call on things like javascript: urls or data: urls, where we may in fact run
- * into whitespace that is not properly encoded.
+ * into whitespace that is not properly encoded.  Note that stripping does not
+ * occur in the scheme portion itself.
  *
  * @param str the pointer to the string to filter.  Must be non-null.
  * @param result the out param to write to if filtering happens
--- xulrunner-1.9.0.19.orig/netwerk/base/src/nsURLHelper.cpp
+++ xulrunner-1.9.0.19/netwerk/base/src/nsURLHelper.cpp
@@ -541,15 +541,60 @@
         p++;
     }
 
+    // Don't strip from the scheme, because other code assumes everything
+    // up to the ':' is the scheme, and it's bad not to have it match.
+    // If there's no ':', strip.
+    PRBool found_colon = PR_FALSE;
+    const char *first = nsnull;
     while (*p) {
-        if (*p == '\t' || *p == '\r' || *p == '\n') {
-            writing = PR_TRUE;
-            // append chars up to but not including *p
-            if (p > str)
-                result.Append(str, p - str);
-            str = p + 1;
+        switch (*p) {
+            case '\t': 
+            case '\r': 
+            case '\n':
+                if (found_colon) {
+                    writing = PR_TRUE;
+                    // append chars up to but not including *p
+                    if (p > str)
+                        result.Append(str, p - str);
+                    str = p + 1;
+                } else {
+                    // remember where the first \t\r\n was in case we find no scheme
+                    if (!first)
+                        first = p;
+                }
+                break;
+
+            case ':':
+                found_colon = PR_TRUE;
+                break;
+
+            case '/':
+            case '@':
+                if (!found_colon) {
+                    // colon also has to precede / or @ to be a scheme
+                    found_colon = PR_TRUE; // not really, but means ok to strip
+                    if (first) {
+                        // go back and replace
+                        p = first;
+                        continue; // process *p again
+                    }
+                }
+                break;
+
+            default:
+                break;
         }
         p++;
+
+        // At end, if there was no scheme, and we hit a control char, fix
+        // it up now.
+        if (!*p && first != nsnull && !found_colon) {
+            // TRICKY - to avoid duplicating code, we reset the loop back
+            // to the point we found something to do
+            p = first;
+            // This also stops us from looping after we finish
+            found_colon = PR_TRUE; // so we'll replace \t\r\n
+        }
     }
 
     // Remove trailing spaces if any
--- xulrunner-1.9.0.19.orig/netwerk/base/public/nsNetUtil.h
+++ xulrunner-1.9.0.19/netwerk/base/public/nsNetUtil.h
@@ -47,8 +47,10 @@
 #include "nsMemory.h"
 #include "nsCOMPtr.h"
 #include "prio.h" // for read/write flags, permissions, etc.
-
+#include "plstr.h"
 #include "nsIURI.h"
+#include "nsIURLParser.h"
+#include "nsIUUIDGenerator.h"
 #include "nsIInputStream.h"
 #include "nsIOutputStream.h"
 #include "nsISafeOutputStream.h"
@@ -1455,4 +1457,81 @@
     return channel->GetOriginalURI(uri);
 }
 
+/**
+ * Helper function to create a random URL string that's properly formed
+ * but guaranteed to be invalid.
+ */  
+#define NS_FAKE_SCHEME "http://"
+#define NS_FAKE_TLD ".invalid"
+inline nsresult
+NS_MakeRandomInvalidURLString(nsCString& result)
+{
+  nsresult rv;
+  nsCOMPtr<nsIUUIDGenerator> uuidgen =
+    do_GetService("@mozilla.org/uuid-generator;1", &rv);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsID idee;
+  rv = uuidgen->GenerateUUIDInPlace(&idee);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  char chars[NSID_LENGTH];
+  idee.ToProvidedString(chars);
+
+  result.AssignLiteral(NS_FAKE_SCHEME);
+  // Strip off the '{' and '}' at the beginning and end of the UUID
+  result.Append(chars + 1, NSID_LENGTH - 3);
+  result.AppendLiteral(NS_FAKE_TLD);
+
+  return NS_OK;
+}
+#undef NS_FAKE_SCHEME
+#undef NS_FAKE_TLD
+
+/**
+ * Helper function to determine whether urlString is Java-compatible --
+ * whether it can be passed to the Java URL(String) constructor without the
+ * latter throwing a MalformedURLException, or without Java otherwise
+ * mishandling it.
+ */  
+inline nsresult
+NS_CheckIsJavaCompatibleURLString(nsCString& urlString, PRBool *result)
+{
+  *result = PR_FALSE; // Default to "no"
+
+  nsresult rv = NS_OK;
+  nsCOMPtr<nsIURLParser> urlParser =
+    do_GetService(NS_STDURLPARSER_CONTRACTID, &rv);
+  if (NS_FAILED(rv) || !urlParser)
+    return NS_ERROR_FAILURE;
+
+  PRBool compatible = PR_TRUE;
+  PRUint32 schemePos = 0;
+  PRInt32 schemeLen = 0;
+  urlParser->ParseURL(urlString.get(), -1, &schemePos, &schemeLen,
+                      nsnull, nsnull, nsnull, nsnull);
+  if (schemeLen != -1) {
+    nsCString scheme;
+    scheme.Assign(urlString.get() + schemePos, schemeLen);
+    // By default Java only understands a small number of URL schemes, and of
+    // these only some are likely to represent user input (for example from a
+    // link or the location bar) that Java can legitimately be expected to
+    // handle.  (Besides those listed below, Java also understands the "jar",
+    // "mailto" and "netdoc" schemes.  But it probably doesn't expect these
+    // from a browser, and is therefore likely to mishandle them.)
+    if (PL_strcasecmp(scheme.get(), "http") &&
+        PL_strcasecmp(scheme.get(), "https") &&
+        PL_strcasecmp(scheme.get(), "file") &&
+        PL_strcasecmp(scheme.get(), "ftp") &&
+        PL_strcasecmp(scheme.get(), "gopher"))
+      compatible = PR_FALSE;
+  } else {
+    compatible = PR_FALSE;
+  }
+
+  *result = compatible;
+
+  return NS_OK;
+}
+
 #endif // !nsNetUtil_h__
--- xulrunner-1.9.0.19.orig/netwerk/base/public/nsNetError.h
+++ xulrunner-1.9.0.19/netwerk/base/public/nsNetError.h
@@ -144,6 +144,14 @@
 #define NS_ERROR_INVALID_CONTENT_ENCODING \
     NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_NETWORK, 27)
 
+/**
+ * A transport level corruption was found in the source document. for example
+ * a document with a calculated checksum that does not match the Content-MD5
+ * http header.
+ */
+#define NS_ERROR_CORRUPTED_CONTENT \
+    NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_NETWORK, 29)
+
 /******************************************************************************
  * Connectivity error codes:
  */
--- xulrunner-1.9.0.19.orig/netwerk/dns/src/nsEffectiveTLDService.cpp
+++ xulrunner-1.9.0.19/netwerk/dns/src/nsEffectiveTLDService.cpp
@@ -169,13 +169,18 @@
                                              nsACString &aBaseDomain)
 {
   if (aHostname.IsEmpty())
-    return NS_ERROR_INVALID_ARG;
+    return NS_ERROR_INSUFFICIENT_DOMAIN_LEVELS;
 
   // chomp any trailing dot, and keep track of it for later
   PRBool trailingDot = aHostname.Last() == '.';
   if (trailingDot)
     aHostname.Truncate(aHostname.Length() - 1);
 
+  // check the edge cases of the host being '.' or having a second trailing '.',
+  // since subsequent checks won't catch it.
+  if (aHostname.IsEmpty() || aHostname.Last() == '.')
+    return NS_ERROR_INVALID_ARG;
+
   // Check if we're dealing with an IPv4/IPv6 hostname, and return
   PRNetAddr addr;
   PRStatus result = PR_StringToNetAddr(aHostname.get(), &addr);
--- xulrunner-1.9.0.19.orig/netwerk/test/TestCookie.cpp
+++ xulrunner-1.9.0.19/netwerk/test/TestCookie.cpp
@@ -311,11 +311,11 @@
       GetACookie(cookieService, "http://www.basic.com/testPath/testfile.txt", nsnull, getter_Copies(cookie));
       rv[1] = CheckResult(cookie.get(), MUST_EQUAL, "test=basic");
       GetACookie(cookieService, "http://www.basic.com./", nsnull, getter_Copies(cookie));
-      rv[2] = CheckResult(cookie.get(), MUST_EQUAL, "test=basic");
+      rv[2] = CheckResult(cookie.get(), MUST_BE_NULL);
       GetACookie(cookieService, "http://www.basic.com.", nsnull, getter_Copies(cookie));
-      rv[3] = CheckResult(cookie.get(), MUST_EQUAL, "test=basic");
+      rv[3] = CheckResult(cookie.get(), MUST_BE_NULL);
       GetACookie(cookieService, "http://www.basic.com./testPath/testfile.txt", nsnull, getter_Copies(cookie));
-      rv[4] = CheckResult(cookie.get(), MUST_EQUAL, "test=basic");
+      rv[4] = CheckResult(cookie.get(), MUST_BE_NULL);
       GetACookie(cookieService, "http://www.basic2.com/", nsnull, getter_Copies(cookie));
       rv[5] = CheckResult(cookie.get(), MUST_BE_NULL);
       SetACookie(cookieService, "http://www.basic.com", nsnull, "test=basic; max-age=-1", nsnull);
@@ -334,7 +334,7 @@
       GetACookie(cookieService, "http://domain.com", nsnull, getter_Copies(cookie));
       rv[0] = CheckResult(cookie.get(), MUST_EQUAL, "test=domain");
       GetACookie(cookieService, "http://domain.com.", nsnull, getter_Copies(cookie));
-      rv[1] = CheckResult(cookie.get(), MUST_EQUAL, "test=domain");
+      rv[1] = CheckResult(cookie.get(), MUST_BE_NULL);
       GetACookie(cookieService, "http://www.domain.com", nsnull, getter_Copies(cookie));
       rv[2] = CheckResult(cookie.get(), MUST_EQUAL, "test=domain");
       GetACookie(cookieService, "http://foo.domain.com", nsnull, getter_Copies(cookie));
--- xulrunner-1.9.0.19.orig/netwerk/test/unit/test_multipart_streamconv.js
+++ xulrunner-1.9.0.19/netwerk/test/unit/test_multipart_streamconv.js
@@ -0,0 +1,93 @@
+do_load_httpd_js();
+
+var httpserver = null;
+var uri = "http://localhost:4444/multipart";
+
+function make_channel(url) {
+  var ios = Cc["@mozilla.org/network/io-service;1"].
+            getService(Ci.nsIIOService);
+  return ios.newChannel(url, "", null);
+}
+
+var multipartBody = "--boundary\r\n\r\nSome text\r\n--boundary\r\n\r\n<?xml version='1.0'?><root/>\r\n--boundary--";
+
+function make_channel(url) {
+  var ios = Cc["@mozilla.org/network/io-service;1"].
+            getService(Ci.nsIIOService);
+  return ios.newChannel(url, "", null);
+}
+
+function contentHandler(metadata, response)
+{
+  response.setHeader("Content-Type", 'multipart/mixed; boundary="boundary"');
+  response.bodyOutputStream.write(multipartBody, multipartBody.length);
+}
+
+var numTests = 2;
+var testNum = 0;
+
+var testData =
+  [
+   { data: "Some text", type: "text/plain" },
+   { data: "<?xml version='1.0'?><root/>", type: "text/xml" }
+  ];
+
+function responseHandler(request, buffer)
+{
+    do_check_eq(buffer, testData[testNum].data);
+    do_check_eq(request.QueryInterface(Ci.nsIChannel).contentType,
+		testData[testNum].type);
+    if (++testNum == numTests)
+	httpserver.stop(do_test_finished);
+}
+
+var multipartListener = {
+  _buffer: "",
+
+  QueryInterface: function(iid) {
+    if (iid.equals(Components.interfaces.nsIStreamListener) ||
+        iid.equals(Components.interfaces.nsIRequestObserver) ||
+        iid.equals(Components.interfaces.nsISupports))
+      return this;
+    throw Components.results.NS_ERROR_NO_INTERFACE;
+  },
+
+  onStartRequest: function(request, context) {
+    this._buffer = "";
+  },
+
+  onDataAvailable: function(request, context, stream, offset, count) {
+    try {
+      this._buffer = this._buffer.concat(read_stream(stream, count));
+      dump("BUFFEEE: " + this._buffer + "\n\n");
+    } catch (ex) {
+      do_throw("Error in onDataAvailable: " + ex);
+    }
+  },
+
+  onStopRequest: function(request, context, status) {
+    try {
+      responseHandler(request, this._buffer);
+    } catch (ex) {
+      do_throw("Error in closure function: " + ex);
+    }
+  }  
+};
+
+function run_test()
+{
+  httpserver = new nsHttpServer();
+  httpserver.registerPathHandler("/multipart", contentHandler);
+  httpserver.start(4444);
+
+  var streamConv = Cc["@mozilla.org/streamConverters;1"]
+                     .getService(Ci.nsIStreamConverterService);
+  var conv = streamConv.asyncConvertData("multipart/mixed",
+					 "*/*",
+					 multipartListener,
+					 null);
+
+  var chan = make_channel(uri);
+  chan.asyncOpen(conv, null);
+  do_test_pending();
+}
--- xulrunner-1.9.0.19.orig/netwerk/test/unit/test_duplicate_headers.js
+++ xulrunner-1.9.0.19/netwerk/test/unit/test_duplicate_headers.js
@@ -0,0 +1,363 @@
+/*
+ * Tests bugs 597706, 655389: prevent duplicate headers with differing values
+ * for some headers like Content-Length, Location, etc.
+ */
+
+////////////////////////////////////////////////////////////////////////////////
+// Test infrastructure
+
+do_load_httpd_js();
+
+var httpserver = new nsHttpServer();
+var index = 0;
+var test_flags = new Array();
+var testPathBase = "/dupe_hdrs";
+
+function run_test()
+{
+  httpserver.start(4444);
+
+  do_test_pending();
+  run_test_number(1);
+}
+
+function run_test_number(num)
+{
+  testPath = testPathBase + num;
+  httpserver.registerPathHandler(testPath, eval("handler" + num));
+
+  var channel = setupChannel(testPath);
+  flags = test_flags[num];   // OK if flags undefined for test
+  channel.asyncOpen(new ChannelListener(eval("completeTest" + num),
+                                        channel, flags), null);
+}
+
+function setupChannel(url)
+{
+  var ios = Components.classes["@mozilla.org/network/io-service;1"].
+                       getService(Ci.nsIIOService);
+  var chan = ios.newChannel("http://localhost:4444" + url, "", null);
+  var httpChan = chan.QueryInterface(Components.interfaces.nsIHttpChannel);
+  return httpChan;
+}
+
+function endTests()
+{
+  httpserver.stop(do_test_finished);
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// Test 1: FAIL because of conflicting Content-Length headers
+test_flags[1] = CL_EXPECT_FAILURE;
+
+function handler1(metadata, response)
+{
+  var body = "012345678901234567890123456789";
+  // Comrades!  We must seize power from the petty-bourgeois running dogs of
+  // httpd.js in order to reply with multiple instances of the same header!
+  response.seizePower();
+  response.write("HTTP/1.0 200 OK\r\n");
+  response.write("Content-Type: text/plain\r\n");
+  response.write("Content-Length: 30\r\n");
+  response.write("Content-Length: 20\r\n");
+  response.write("\r\n");
+  response.write(body);
+  response.finish();
+}
+
+
+function completeTest1(request, data, ctx)
+{
+  do_check_eq(request.status, Components.results.NS_ERROR_CORRUPTED_CONTENT);
+
+  run_test_number(2);
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// Test 2: OK to have duplicate same Content-Length headers
+
+function handler2(metadata, response)
+{
+  var body = "012345678901234567890123456789";
+  response.seizePower();
+  response.write("HTTP/1.0 200 OK\r\n");
+  response.write("Content-Type: text/plain\r\n");
+  response.write("Content-Length: 30\r\n");
+  response.write("Content-Length: 30\r\n");
+  response.write("\r\n");
+  response.write(body);
+  response.finish();
+}
+
+function completeTest2(request, data, ctx)
+{
+  do_check_eq(request.status, 0);
+  run_test_number(3);
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// Test 3: FAIL: 2nd Content-length is blank
+test_flags[3] = CL_EXPECT_FAILURE;
+
+function handler3(metadata, response)
+{
+  var body = "012345678901234567890123456789";
+  response.seizePower();
+  response.write("HTTP/1.0 200 OK\r\n");
+  response.write("Content-Type: text/plain\r\n");
+  response.write("Content-Length: 30\r\n");
+  response.write("Content-Length:\r\n");
+  response.write("\r\n");
+  response.write(body);
+  response.finish();
+}
+
+function completeTest3(request, data, ctx)
+{
+  do_check_eq(request.status, Components.results.NS_ERROR_CORRUPTED_CONTENT);
+
+  run_test_number(4);
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// Test 4: ensure that blank C-len header doesn't allow attacker to reset Clen, 
+// then insert CRLF attack
+test_flags[4] = CL_EXPECT_FAILURE;
+
+function handler4(metadata, response)
+{
+  var body = "012345678901234567890123456789";
+
+  response.seizePower();
+  response.write("HTTP/1.0 200 OK\r\n");
+  response.write("Content-Type: text/plain\r\n");
+  response.write("Content-Length: 30\r\n");
+
+  // Bad Mr Hacker!  Bad!
+  var evilBody = "We are the Evil bytes, Evil bytes, Evil bytes!";
+  response.write("Content-Length:\r\n");
+  response.write("Content-Length: %s\r\n\r\n%s" % (evilBody.length, evilBody));
+  response.write("\r\n");
+  response.write(body);
+  response.finish();
+}
+
+function completeTest4(request, data, ctx)
+{
+  do_check_eq(request.status, Components.results.NS_ERROR_CORRUPTED_CONTENT);
+
+  run_test_number(5);
+}
+
+
+////////////////////////////////////////////////////////////////////////////////
+// Test 5: ensure that we take 1st instance of duplicate, nonmerged headers that
+// are permitted : (ex: Referrer)
+
+function handler5(metadata, response)
+{
+  var body = "012345678901234567890123456789";
+  response.seizePower();
+  response.write("HTTP/1.0 200 OK\r\n");
+  response.write("Content-Type: text/plain\r\n");
+  response.write("Content-Length: 30\r\n");
+  response.write("Referer: naive.org\r\n");
+  response.write("Referer: evil.net\r\n");
+  response.write("\r\n");
+  response.write(body);
+  response.finish();
+}
+
+function completeTest5(request, data, ctx)
+{
+  try {
+    referer = request.getResponseHeader("Referer");
+    do_check_eq(referer, "naive.org");
+  } catch (ex) {
+    do_throw("Referer header should be present");
+  }
+
+  run_test_number(6);
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// Test 5: FAIL if multiple, different Location: headers present
+// - needed to prevent CRLF injection attacks
+test_flags[6] = CL_EXPECT_FAILURE;
+
+function handler6(metadata, response)
+{
+  var body = "012345678901234567890123456789";
+  response.seizePower();
+  response.write("HTTP/1.0 301 Moved\r\n");
+  response.write("Content-Type: text/plain\r\n");
+  response.write("Content-Length: 30\r\n");
+  response.write("Location: http://localhost:4444/content\r\n");
+  response.write("Location: http://www.microsoft.com/\r\n");
+  response.write("Connection: close/\r\n");
+  response.write("\r\n");
+  response.write(body);
+  response.finish();
+}
+
+function completeTest6(request, data, ctx)
+{
+  do_check_eq(request.status, Components.results.NS_ERROR_CORRUPTED_CONTENT);
+
+//  run_test_number(7);   // Test 7 leaking under e10s: unrelated bug?
+  run_test_number(8);
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// Test 7: OK to have multiple Location: headers with same value
+
+function handler7(metadata, response)
+{
+  var body = "012345678901234567890123456789";
+  response.seizePower();
+  response.write("HTTP/1.0 301 Moved\r\n");
+  response.write("Content-Type: text/plain\r\n");
+  response.write("Content-Length: 30\r\n");
+  // redirect to previous test handler that completes OK: test 5
+  response.write("Location: http://localhost:4444" + testPathBase + "5\r\n");
+  response.write("Location: http://localhost:4444" + testPathBase + "5\r\n");
+  response.write("Connection: close/\r\n");
+  response.write("\r\n");
+  response.write(body);
+  response.finish();
+}
+
+function completeTest7(request, data, ctx)
+{
+  // for some reason need this here
+  request.QueryInterface(Components.interfaces.nsIHttpChannel);
+
+  try {
+    referer = request.getResponseHeader("Referer");
+    do_check_eq(referer, "naive.org");
+  } catch (ex) {
+    do_throw("Referer header should be present");
+  }
+
+  run_test_number(8);
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// FAIL if 2nd Location: headers blank
+test_flags[8] = CL_EXPECT_FAILURE;
+
+function handler8(metadata, response)
+{
+  var body = "012345678901234567890123456789";
+  response.seizePower();
+  response.write("HTTP/1.0 301 Moved\r\n");
+  response.write("Content-Type: text/plain\r\n");
+  response.write("Content-Length: 30\r\n");
+  // redirect to previous test handler that completes OK: test 4
+  response.write("Location: http://localhost:4444" + testPathBase + "4\r\n");
+  response.write("Location:\r\n");
+  response.write("Connection: close/\r\n");
+  response.write("\r\n");
+  response.write(body);
+  response.finish();
+}
+
+function completeTest8(request, data, ctx)
+{
+  do_check_eq(request.status, Components.results.NS_ERROR_CORRUPTED_CONTENT);
+
+  run_test_number(9);
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// Test 9: ensure that blank Location header doesn't allow attacker to reset, 
+// then insert an evil one
+test_flags[9] = CL_EXPECT_FAILURE;
+
+function handler9(metadata, response)
+{
+  var body = "012345678901234567890123456789";
+  response.seizePower();
+  response.write("HTTP/1.0 301 Moved\r\n");
+  response.write("Content-Type: text/plain\r\n");
+  response.write("Content-Length: 30\r\n");
+  // redirect to previous test handler that completes OK: test 2 
+  response.write("Location: http://localhost:4444" + testPathBase + "2\r\n");
+  response.write("Location:\r\n");
+  // redirect to previous test handler that completes OK: test 4
+  response.write("Location: http://localhost:4444" + testPathBase + "4\r\n");
+  response.write("Connection: close/\r\n");
+  response.write("\r\n");
+  response.write(body);
+  response.finish();
+}
+
+function completeTest9(request, data, ctx)
+{
+  // All redirection should fail:
+  do_check_eq(request.status, Components.results.NS_ERROR_CORRUPTED_CONTENT);
+
+  run_test_number(10);
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// Test 10: FAIL:  if conflicting values for Content-Dispo 
+test_flags[10] = CL_EXPECT_FAILURE;
+
+function handler10(metadata, response)
+{
+  var body = "012345678901234567890123456789";
+  response.seizePower();
+  response.write("HTTP/1.0 200 OK\r\n");
+  response.write("Content-Type: text/plain\r\n");
+  response.write("Content-Length: 30\r\n");
+  response.write("Content-Disposition: attachment; filename=foo\r\n");
+  response.write("Content-Disposition: attachment; filename=bar\r\n");
+  response.write("Content-Disposition: attachment; filename=baz\r\n");
+  response.write("\r\n");
+  response.write(body);
+  response.finish();
+}
+
+
+function completeTest10(request, data, ctx)
+{
+  do_check_eq(request.status, Components.results.NS_ERROR_CORRUPTED_CONTENT);
+
+  run_test_number(11);
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// Test 11: OK to have duplicate same Content-Disposition headers
+
+function handler11(metadata, response)
+{
+  var body = "012345678901234567890123456789";
+  response.seizePower();
+  response.write("HTTP/1.0 200 OK\r\n");
+  response.write("Content-Type: text/plain\r\n");
+  response.write("Content-Length: 30\r\n");
+  response.write("Content-Disposition: attachment; filename=foo\r\n");
+  response.write("Content-Disposition: attachment; filename=foo\r\n");
+  response.write("\r\n");
+  response.write(body);
+  response.finish();
+}
+
+function completeTest11(request, data, ctx)
+{
+  do_check_eq(request.status, 0);
+
+  try {
+    // TODO when bug XXX lands, also get channel C-D properties and make sure
+    // they're blank
+    dispo = request.getResponseHeader("Content-Disposition");
+    do_check_eq(dispo, "attachment; filename=foo");
+  } catch (ex) {
+    do_throw("Content-Disposition should be present");
+  }
+
+  endTests();
+}
+
+
--- xulrunner-1.9.0.19.orig/netwerk/test/unit/test_bug643051.js
+++ xulrunner-1.9.0.19/netwerk/test/unit/test_bug643051.js
@@ -0,0 +1,24 @@
+const Cc = Components.classes;
+const Ci = Components.interfaces;
+
+function run_test() {
+  let cs = Cc["@mozilla.org/cookieService;1"].getService(Ci.nsICookieService);
+  let ios = Cc["@mozilla.org/network/io-service;1"].getService(Ci.nsIIOService);
+
+  let uri = ios.newURI("http://example.org/", null, null);
+
+  let set = "foo=bar\nbaz=foo";
+  let expected = "foo=bar; baz=foo";
+  cs.setCookieStringFromHttp(uri, null, null, set, null, null);
+
+  let actual = cs.getCookieStringFromHttp(uri, null, null);
+  do_check_eq(actual, expected);
+
+  uri = ios.newURI("http://example.com/", null, null);
+  cs.setCookieString(uri, null, set, null);
+
+  expected = "foo=bar";
+  actual = cs.getCookieString(uri, null, null);
+  do_check_eq(actual, expected);
+}
+
--- xulrunner-1.9.0.19.orig/netwerk/mime/src/nsMIMEHeaderParamImpl.cpp
+++ xulrunner-1.9.0.19/netwerk/mime/src/nsMIMEHeaderParamImpl.cpp
@@ -165,8 +165,8 @@
       if (str == start)
         return NS_ERROR_UNEXPECTED;
       *aResult = (char *) nsMemory::Clone(start, (str - start) + 1);
-      (*aResult)[str - start] = '\0';  // null-terminate
       NS_ENSURE_TRUE(*aResult, NS_ERROR_OUT_OF_MEMORY);
+      (*aResult)[str - start] = '\0';  // null-terminate
       return NS_OK;
     }
 
--- xulrunner-1.9.0.19.orig/netwerk/streamconv/converters/nsIndexedToHTML.cpp
+++ xulrunner-1.9.0.19/netwerk/streamconv/converters/nsIndexedToHTML.cpp
@@ -147,6 +147,29 @@
 
 NS_IMETHODIMP
 nsIndexedToHTML::OnStartRequest(nsIRequest* request, nsISupports *aContext) {
+    nsString buffer;
+    nsresult rv = DoOnStartRequest(request, aContext, buffer);
+    if (NS_FAILED(rv)) {
+        request->Cancel(rv);
+    }
+    
+    rv = mListener->OnStartRequest(request, aContext);
+    if (NS_FAILED(rv)) return rv;
+
+    // The request may have been canceled, and if that happens, we want to
+    // suppress calls to OnDataAvailable.
+    request->GetStatus(&rv);
+    if (NS_FAILED(rv)) return rv;
+
+    // Push our buffer to the listener.
+
+    rv = FormatInputStream(request, aContext, buffer);
+    return rv;
+}
+
+nsresult
+nsIndexedToHTML::DoOnStartRequest(nsIRequest* request, nsISupports *aContext,
+                                  nsString& aBuffer) {
     nsresult rv;
 
     nsCOMPtr<nsIChannel> channel = do_QueryInterface(request);
@@ -666,18 +689,7 @@
     }
     buffer.AppendLiteral(" <tbody>\n");
 
-    // Push buffer to the listener now, so the initial HTML will not
-    // be parsed in OnDataAvailable().
-
-    rv = mListener->OnStartRequest(request, aContext);
-    if (NS_FAILED(rv)) return rv;
-
-    // The request may have been canceled, and if that happens, we want to
-    // suppress calls to OnDataAvailable.
-    request->GetStatus(&rv);
-    if (NS_FAILED(rv)) return rv;
-
-    rv = FormatInputStream(request, aContext, buffer);
+    aBuffer = buffer;
     return rv;
 }
 
--- xulrunner-1.9.0.19.orig/netwerk/streamconv/converters/nsMultiMixedConv.h
+++ xulrunner-1.9.0.19/netwerk/streamconv/converters/nsMultiMixedConv.h
@@ -68,10 +68,15 @@
                       public nsIMultiPartChannel
 {
 public:
-  nsPartChannel(nsIChannel *aMultipartChannel, PRUint32 aPartID);
+  nsPartChannel(nsIChannel *aMultipartChannel, PRUint32 aPartID,
+                nsIStreamListener* aListener);
 
   void InitializeByteRange(PRInt64 aStart, PRInt64 aEnd);
   void SetIsLastPart() { mIsLastPart = PR_TRUE; }
+  nsresult SendOnStartRequest(nsISupports* aContext);
+  nsresult SendOnDataAvailable(nsISupports* aContext, nsIInputStream* aStream,
+                               PRUint32 aOffset, PRUint32 aLen);
+  nsresult SendOnStopRequest(nsISupports* aContext, nsresult aStatus);
 
   NS_DECL_ISUPPORTS
   NS_DECL_NSIREQUEST
@@ -84,6 +89,7 @@
 
 protected:
   nsCOMPtr<nsIChannel>    mMultipartChannel;
+  nsCOMPtr<nsIStreamListener> mListener;
   
   nsresult                mStatus;
   nsLoadFlags             mLoadFlags;
--- xulrunner-1.9.0.19.orig/netwerk/streamconv/converters/nsDirIndexParser.cpp
+++ xulrunner-1.9.0.19/netwerk/streamconv/converters/nsDirIndexParser.cpp
@@ -179,8 +179,6 @@
   // Parse a "200" format line, and remember the fields and their
   // ordering in mFormat. Multiple 200 lines stomp on each other.
 
-  delete[] mFormat;
-
   // Lets find out how many elements we have.
   // easier to do this then realloc
   const char* pos = aFormatStr;
@@ -203,6 +201,7 @@
 
   } while (*pos);
 
+  delete[] mFormat;
   mFormat = new int[num+1];
   // Prevent NULL Deref - Bug 443299 
   if (mFormat == nsnull)
--- xulrunner-1.9.0.19.orig/netwerk/streamconv/converters/nsTXTToHTMLConv.cpp
+++ xulrunner-1.9.0.19/netwerk/streamconv/converters/nsTXTToHTMLConv.cpp
@@ -37,6 +37,7 @@
 
 #include "nsTXTToHTMLConv.h"
 #include "nsNetUtil.h"
+#include "nsEscape.h"
 #include "nsStringStream.h"
 #include "nsAutoPtr.h"
 
@@ -315,11 +316,24 @@
         nsString linkText;
         // href is implied
         mBuffer.Mid(linkText, front, back-front);
+
         mBuffer.Insert(NS_LITERAL_STRING("<a href=\""), front);
         cursor += front+9;
-        if (modLen)
+        if (modLen) {
             mBuffer.Insert(mToken->modText, cursor);
-        cursor += modLen-front+back;
+            cursor += modLen;
+        }
+
+        NS_ConvertUTF16toUTF8 linkTextUTF8(linkText);
+        nsCString escaped;
+        if (NS_EscapeURL(linkTextUTF8.Data(), linkTextUTF8.Length(), esc_Minimal, escaped)) {
+            mBuffer.Cut(cursor, back - front);
+            CopyUTF8toUTF16(escaped, linkText);
+            mBuffer.Insert(linkText, cursor);
+            back = front + linkText.Length();
+        }
+
+        cursor += back-front;
         mBuffer.Insert(NS_LITERAL_STRING("\">"), cursor);
         cursor += 2;
         mBuffer.Insert(linkText, cursor);
--- xulrunner-1.9.0.19.orig/netwerk/streamconv/converters/nsIndexedToHTML.h
+++ xulrunner-1.9.0.19/netwerk/streamconv/converters/nsIndexedToHTML.h
@@ -76,7 +76,10 @@
 protected:
     
     void FormatSizeString(PRInt64 inSize, nsString& outSizeString);
-    nsresult FormatInputStream(nsIRequest* aRequest, nsISupports *aContext, const nsAString &aBuffer); 
+    nsresult FormatInputStream(nsIRequest* aRequest, nsISupports *aContext, const nsAString &aBuffer);
+    // Helper to properly implement OnStartRequest
+    nsresult DoOnStartRequest(nsIRequest* request, nsISupports *aContext,
+                              nsString& aBuffer);
 
 protected:
     nsCOMPtr<nsIDirIndexParser>     mParser;
--- xulrunner-1.9.0.19.orig/netwerk/streamconv/converters/nsMultiMixedConv.cpp
+++ xulrunner-1.9.0.19/netwerk/streamconv/converters/nsMultiMixedConv.cpp
@@ -48,6 +48,7 @@
 #include "nsCRT.h"
 #include "nsIHttpChannelInternal.h"
 #include "nsURLHelper.h"
+#include "nsIStreamConverterService.h"
 
 //
 // Helper function for determining the length of data bytes up to
@@ -67,7 +68,10 @@
     return len;
 }
 
-nsPartChannel::nsPartChannel(nsIChannel *aMultipartChannel, PRUint32 aPartID) :
+nsPartChannel::nsPartChannel(nsIChannel *aMultipartChannel, PRUint32 aPartID,
+                             nsIStreamListener* aListener) :
+  mMultipartChannel(aMultipartChannel),
+  mListener(aListener),
   mStatus(NS_OK),
   mContentLength(LL_MAXUINT),
   mIsByteRangeRequest(PR_FALSE),
@@ -96,6 +100,26 @@
     mByteRangeEnd   = aEnd;
 }
 
+nsresult nsPartChannel::SendOnStartRequest(nsISupports* aContext)
+{
+    return mListener->OnStartRequest(this, aContext);
+}
+
+nsresult nsPartChannel::SendOnDataAvailable(nsISupports* aContext,
+                                            nsIInputStream* aStream,
+                                            PRUint32 aOffset, PRUint32 aLen)
+{
+    return mListener->OnDataAvailable(this, aContext, aStream, aOffset, aLen);
+}
+
+nsresult nsPartChannel::SendOnStopRequest(nsISupports* aContext,
+                                          nsresult aStatus)
+{
+    // Drop the listener
+    nsCOMPtr<nsIStreamListener> listener;
+    listener.swap(mListener);
+    return listener->OnStopRequest(this, aContext, aStatus);
+}
 
 //
 // nsISupports implementation...
@@ -734,15 +758,30 @@
 nsMultiMixedConv::SendStart(nsIChannel *aChannel) {
     nsresult rv = NS_OK;
 
-    if (mContentType.IsEmpty())
+    nsCOMPtr<nsIStreamListener> partListener(mFinalListener);
+    if (mContentType.IsEmpty()) {
         mContentType.AssignLiteral(UNKNOWN_CONTENT_TYPE);
+        nsCOMPtr<nsIStreamConverterService> serv =
+            do_GetService(NS_STREAMCONVERTERSERVICE_CONTRACTID, &rv);
+        if (NS_SUCCEEDED(rv)) {
+            nsCOMPtr<nsIStreamListener> converter;
+            rv = serv->AsyncConvertData(UNKNOWN_CONTENT_TYPE,
+                                        "*/*",
+                                        mFinalListener,
+                                        mContext,
+                                        getter_AddRefs(converter));
+            if (NS_SUCCEEDED(rv)) {
+                partListener = converter;
+            }
+        }
+    }
 
     // if we already have an mPartChannel, that means we never sent a Stop()
     // before starting up another "part." that would be bad.
     NS_ASSERTION(!mPartChannel, "tisk tisk, shouldn't be overwriting a channel");
 
     nsPartChannel *newChannel;
-    newChannel = new nsPartChannel(aChannel, mCurrentPartID++);
+    newChannel = new nsPartChannel(aChannel, mCurrentPartID++, partListener);
     if (!newChannel)
         return NS_ERROR_OUT_OF_MEMORY;
 
@@ -780,7 +819,7 @@
 
     // Let's start off the load. NOTE: we don't forward on the channel passed
     // into our OnDataAvailable() as it's the root channel for the raw stream.
-    return mFinalListener->OnStartRequest(mPartChannel, mContext);
+    return mPartChannel->SendOnStartRequest(mContext);
 }
 
 
@@ -789,7 +828,7 @@
     
     nsresult rv = NS_OK;
     if (mPartChannel) {
-        rv = mFinalListener->OnStopRequest(mPartChannel, mContext, aStatus);
+        rv = mPartChannel->SendOnStopRequest(mContext, aStatus);
         // don't check for failure here, we need to remove the channel from 
         // the loadgroup.
 
@@ -836,7 +875,7 @@
     nsCOMPtr<nsIInputStream> inStream(do_QueryInterface(ss, &rv));
     if (NS_FAILED(rv)) return rv;
 
-    return mFinalListener->OnDataAvailable(mPartChannel, mContext, inStream, offset, aLen);
+    return mPartChannel->SendOnDataAvailable(mContext, inStream, offset, aLen);
 }
 
 PRInt32
--- xulrunner-1.9.0.19.orig/parser/xml/src/nsSAXXMLReader.cpp
+++ xulrunner-1.9.0.19/parser/xml/src/nsSAXXMLReader.cpp
@@ -627,11 +627,7 @@
   TryChannelCharset(aChannel, charsetSource, charset);
   parser->SetDocumentCharset(charset, charsetSource);
 
-#ifdef MOZILLA_1_8_BRANCH
-  rv = parser->Parse(mBaseURI, aObserver, PR_FALSE);
-#else
   rv = parser->Parse(mBaseURI, aObserver);
-#endif
   NS_ENSURE_SUCCESS(rv, rv);
 
   mListener = do_QueryInterface(parser, &rv);
--- xulrunner-1.9.0.19.orig/parser/htmlparser/src/nsScanner.cpp
+++ xulrunner-1.9.0.19/parser/htmlparser/src/nsScanner.cpp
@@ -187,14 +187,22 @@
 
   nsIUnicodeDecoder * decoder = nsnull;
   res = nsParser::GetCharsetConverterManager()->
-    GetUnicodeDecoderRaw(mCharset.get(), &decoder);
+     GetUnicodeDecoderRaw(mCharset.get(), &decoder);
+  if (NS_FAILED(res))
+  {
+    // GetUnicodeDecoderRaw can fail if the charset has the .isXSSVulnerable
+    // flag. Try to fallback to ISO-8859-1
+    mCharset.AssignLiteral("ISO-8859-1");
+    mCharsetSource = kCharsetFromWeakDocTypeDefault;
+    res = nsParser::GetCharsetConverterManager()->
+      GetUnicodeDecoderRaw(mCharset.get(), &decoder);
+  }
   if(NS_SUCCEEDED(res) && (nsnull != decoder))
   {
      NS_IF_RELEASE(mUnicodeDecoder);
 
      mUnicodeDecoder = decoder;
   }
-
   return res;
 }
 
--- xulrunner-1.9.0.19.orig/parser/htmlparser/public/nsIFragmentContentSink.h
+++ xulrunner-1.9.0.19/parser/htmlparser/public/nsIFragmentContentSink.h
@@ -46,6 +46,10 @@
   { 0x1ecdb30d, 0x1f10, 0x45d2, \
     { 0xa4, 0xf4, 0xec, 0xbc, 0x03, 0x52, 0x9a, 0x7e } }
 
+#define NS_I_PARANOID_FRAGMENT_CONTENT_SINK_IID \
+  { 0x86b5390d, 0xd80e, 0x4a86, \
+    { 0x83, 0xec, 0xda, 0x44, 0xac, 0x5b, 0x8c, 0x5f } }
+
 /**
  * The fragment sink allows a client to parse a fragment of sink, possibly
  * surrounded in context. Also see nsIParser::ParseFragment().
@@ -102,6 +106,28 @@
                               NS_I_FRAGMENT_CONTENT_SINK_IID)
 
 /**
+ * This interface is implemented by paranoid content sinks, and allows consumers
+ * to add tags and attributes to the default white-list set.
+ */
+class nsIParanoidFragmentContentSink : public nsISupports {
+public:
+  NS_DECLARE_STATIC_IID_ACCESSOR(NS_I_PARANOID_FRAGMENT_CONTENT_SINK_IID)
+
+  /**
+   * Allow the content sink to accept style elements and attributes.
+   */
+  virtual void AllowStyles() = 0;
+
+  /**
+   * Allow the content sink to accept comments.
+   */
+  virtual void AllowComments() = 0;
+};
+
+NS_DEFINE_STATIC_IID_ACCESSOR(nsIParanoidFragmentContentSink,
+                              NS_I_PARANOID_FRAGMENT_CONTENT_SINK_IID)
+
+/**
  * Base version takes string nested in context, content surrounded by
  * WillBuildContent()/DidBuildContent() calls. The 2nd version just loads
  * the whole string.
@@ -111,11 +137,15 @@
 #define NS_HTMLFRAGMENTSINK2_CONTRACTID "@mozilla.org/layout/htmlfragmentsink;2"
 #define NS_HTMLPARANOIDFRAGMENTSINK_CONTRACTID \
 "@mozilla.org/htmlparanoidfragmentsink;1"
+#define NS_HTMLPARANOIDFRAGMENTSINK2_CONTRACTID \
+"@mozilla.org/htmlparanoidfragmentsink;2"
 
 #define NS_XMLFRAGMENTSINK_CONTRACTID "@mozilla.org/layout/xmlfragmentsink;1"
 #define NS_XMLFRAGMENTSINK2_CONTRACTID "@mozilla.org/layout/xmlfragmentsink;2"
 #define NS_XHTMLPARANOIDFRAGMENTSINK_CONTRACTID \
 "@mozilla.org/xhtmlparanoidfragmentsink;1"
+#define NS_XHTMLPARANOIDFRAGMENTSINK2_CONTRACTID \
+"@mozilla.org/xhtmlparanoidfragmentsink;2"
 
 
 // the HTML versions are in nsHTMLParts.h
@@ -128,6 +158,8 @@
 // in nsContentSink.h
 nsresult
 NS_NewXHTMLParanoidFragmentSink(nsIFragmentContentSink** aInstancePtrResult);
+nsresult
+NS_NewXHTMLParanoidFragmentSink2(nsIFragmentContentSink** aInstancePtrResult);
 void
 NS_XHTMLParanoidFragmentSinkShutdown();
 #endif
--- xulrunner-1.9.0.19.orig/modules/plugin/base/src/ns4xPluginInstance.h
+++ xulrunner-1.9.0.19/modules/plugin/base/src/ns4xPluginInstance.h
@@ -189,9 +189,10 @@
     PRPackedBool  mTransparent;
     PRPackedBool  mStarted;
     PRPackedBool  mCached;
-    PRPackedBool  mIsJavaPlugin;
 
 public:
+    PRPackedBool  mIsJavaPlugin;
+
     // True while creating the plugin, or calling NPP_SetWindow() on
     // it.
     PRPackedBool  mInPluginInitCall;
@@ -199,6 +200,8 @@
     nsInstanceStream *mStreams;
 
     nsVoidArray mPopupStates;
+
+    nsXPIDLCString mFakeURL;
 };
 
 #endif // ns4xPluginInstance_h__
--- xulrunner-1.9.0.19.orig/modules/plugin/base/src/nsPluginHostImpl.cpp
+++ xulrunner-1.9.0.19/modules/plugin/base/src/nsPluginHostImpl.cpp
@@ -173,6 +173,10 @@
 #include "nsIContentPolicy.h"
 #include "nsContentPolicyUtils.h"
 #include "nsContentErrors.h"
+#include "nsIContentUtils.h"
+
+#include "nsIInterfaceRequestor.h"
+#include "nsIChannelEventSink.h"
 
 #if defined(XP_UNIX) && defined(MOZ_WIDGET_GTK2)
 #include <gdk/gdkx.h> // for GDK_DISPLAY()
@@ -260,6 +264,24 @@
 nsIFile *nsPluginHostImpl::sPluginTempDir;
 nsPluginHostImpl *nsPluginHostImpl::sInst;
 
+// Globally disable plugins
+static
+int pluginsdisabled()
+{
+  static int _disabled = -1;
+
+  if (_disabled >= 0)
+    return _disabled;
+
+  const char *env = PR_GetEnv("MOZILLA_DISABLE_PLUGINS");
+  if (env && env[0])
+    _disabled = 1;
+  else
+    _disabled = 0;
+
+  return _disabled;
+}
+
 ////////////////////////////////////////////////////////////////////////
 // flat file reg funcs
 static
@@ -1272,7 +1294,9 @@
 class nsPluginStreamListenerPeer : public nsIStreamListener,
                                    public nsIProgressEventSink,
                                    public nsIHttpHeaderVisitor,
-                                   public nsSupportsWeakReference
+                                   public nsSupportsWeakReference,
+                                   public nsIInterfaceRequestor,
+                                   public nsIChannelEventSink
 {
 public:
   nsPluginStreamListenerPeer();
@@ -1283,6 +1307,8 @@
   NS_DECL_NSIREQUESTOBSERVER
   NS_DECL_NSISTREAMLISTENER
   NS_DECL_NSIHTTPHEADERVISITOR
+  NS_DECL_NSIINTERFACEREQUESTOR
+  NS_DECL_NSICHANNELEVENTSINK
 
   // Called by GetURL and PostURL (via NewStream)
   nsresult Initialize(nsIURI *aURL,
@@ -1305,6 +1331,7 @@
   nsresult SetUpCache(nsIURI* aURL); // todo: see about removing this...
   nsresult SetUpStreamListener(nsIRequest* request, nsIURI* aURL);
   nsresult SetupPluginCacheFile(nsIChannel* channel);
+  nsresult GetInterfaceGlobal(const nsIID& aIID, void** result);
 
   nsIURI                  *mURL;
   nsIPluginInstanceOwner  *mOwner;
@@ -1763,11 +1790,13 @@
 
 
 ////////////////////////////////////////////////////////////////////////
-NS_IMPL_ISUPPORTS4(nsPluginStreamListenerPeer,
+NS_IMPL_ISUPPORTS6(nsPluginStreamListenerPeer,
                    nsIStreamListener,
                    nsIRequestObserver,
                    nsIHttpHeaderVisitor,
-                   nsISupportsWeakReference)
+                   nsISupportsWeakReference,
+                   nsIInterfaceRequestor,
+                   nsIChannelEventSink)
 ////////////////////////////////////////////////////////////////////////
 
 
@@ -2632,6 +2661,89 @@
 
 /////////////////////////////////////////////////////////////////////////
 
+nsresult
+nsPluginStreamListenerPeer::GetInterfaceGlobal(const nsIID& aIID, void** result)
+{
+  if (!mInstance) {
+    return NS_ERROR_FAILURE;
+  }
+
+  nsCOMPtr<nsIPluginInstancePeer> instancePeer;
+  nsresult rv = mInstance->GetPeer(getter_AddRefs(instancePeer));
+  if (NS_FAILED(rv) || !instancePeer) {
+    return NS_ERROR_FAILURE;
+  }
+
+  nsCOMPtr<nsPIPluginInstancePeer> pInstancePeer(do_QueryInterface(instancePeer));
+  nsCOMPtr<nsIPluginInstanceOwner> owner;
+  rv = pInstancePeer->GetOwner(getter_AddRefs(owner));
+  if (NS_SUCCEEDED(rv) && owner) {
+    nsCOMPtr<nsIDocument> doc;
+    nsresult rv = owner->GetDocument(getter_AddRefs(doc));
+    if (NS_SUCCEEDED(rv) && doc) {
+      nsPIDOMWindow *window = doc->GetWindow();
+      if (window) {
+        nsCOMPtr<nsIWebNavigation> webNav = do_GetInterface(window);
+        nsCOMPtr<nsIInterfaceRequestor> ir = do_QueryInterface(webNav);
+        return ir->GetInterface(aIID, result);
+      }
+    }
+  }
+
+  return NS_ERROR_FAILURE;
+}
+
+NS_IMETHODIMP
+nsPluginStreamListenerPeer::GetInterface(const nsIID& aIID, void** result)
+{
+  // Provide nsIChannelEventSink ourselves, otherwise let our document's
+  // window provide the interface.
+
+  if (aIID.Equals(NS_GET_IID(nsIChannelEventSink))) {
+    return QueryInterface(aIID, result);
+  }
+
+  return GetInterfaceGlobal(aIID, result);
+}
+
+NS_IMETHODIMP
+nsPluginStreamListenerPeer::OnChannelRedirect(nsIChannel *oldChannel, nsIChannel *newChannel, PRUint32 flags)
+{
+  // Don't allow cross-origin 307 POST redirects. Fall back to channel event sink for window.
+
+  nsCOMPtr<nsIHttpChannel> oldHttpChannel(do_QueryInterface(oldChannel));
+  if (oldHttpChannel) {
+    PRUint32 responseStatus;
+    nsresult rv = oldHttpChannel->GetResponseStatus(&responseStatus);
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
+    if (responseStatus == 307) {
+      nsCAutoString method;
+      rv = oldHttpChannel->GetRequestMethod(method);
+      if (NS_FAILED(rv)) {
+        return rv;
+      }
+      if (method.EqualsLiteral("POST")) {
+        nsCOMPtr<nsIContentUtils2> contentUtils2 = do_GetService("@mozilla.org/content/contentutils2;1");
+        NS_ENSURE_TRUE(contentUtils2, NS_ERROR_FAILURE);
+        rv = contentUtils2->CheckSameOrigin(oldChannel, newChannel);
+        if (NS_FAILED(rv)) {
+          return rv;
+        }
+      }
+    }
+  }
+
+  nsCOMPtr<nsIChannelEventSink> channelEventSink;
+  nsresult rv = GetInterfaceGlobal(NS_GET_IID(nsIChannelEventSink), getter_AddRefs(channelEventSink));
+  if (NS_FAILED(rv)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  return channelEventSink->OnChannelRedirect(oldChannel, newChannel, flags);
+}
+
 nsPluginHostImpl::nsPluginHostImpl()
 {
   mPluginsLoaded = PR_FALSE;
@@ -5380,6 +5492,10 @@
   // possible reset in subsequent ScanPluginsDirectory calls
   PRBool pluginschanged = PR_FALSE;
 
+  if (pluginsdisabled()) {
+    mPluginsLoaded = PR_TRUE;
+    return NS_OK;
+  }
   // Scan the app-defined list of plugin dirs.
   rv = dirService->Get(NS_APP_PLUGINS_DIR_LIST, NS_GET_IID(nsISimpleEnumerator), getter_AddRefs(dirList));
   if (NS_SUCCEEDED(rv)) {
@@ -5694,6 +5810,9 @@
 nsresult
 nsPluginHostImpl::ReadPluginInfo()
 {
+  if (pluginsdisabled())
+    return NS_ERROR_FAILURE;
+
   nsresult rv;
 
   nsCOMPtr<nsIProperties> directoryService(do_GetService(NS_DIRECTORY_SERVICE_CONTRACTID,&rv));
@@ -6004,29 +6123,13 @@
 
     if (NS_SUCCEEDED(rv))
     {
-      nsCOMPtr<nsIInterfaceRequestor> callbacks;
-
-      if (doc)
-      {
-        // Get the script global object owner and use that as the
-        // notification callback.
-        nsIScriptGlobalObject* global = doc->GetScriptGlobalObject();
-
-        if (global)
-        {
-          nsCOMPtr<nsIWebNavigation> webNav = do_GetInterface(global);
-
-          callbacks = do_QueryInterface(webNav);
-        }
-      }
-
       nsCOMPtr<nsIChannel> channel;
 
       rv = NS_NewChannel(getter_AddRefs(channel), url, nsnull,
         nsnull, /* do not add this internal plugin's channel
                 on the load group otherwise this channel could be canceled
                 form |nsWebShell::OnLinkClickSync| bug 166613 */
-        callbacks);
+        listenerPeer);
       if (NS_FAILED(rv))
         return rv;
 
--- xulrunner-1.9.0.19.orig/modules/plugin/base/src/ns4xPlugin.cpp
+++ xulrunner-1.9.0.19/modules/plugin/base/src/ns4xPlugin.cpp
@@ -89,6 +89,8 @@
 
 #include "nsJSNPRuntime.h"
 
+#include "nsNetUtil.h"
+
 static PRLock *sPluginThreadAsyncCallLock = nsnull;
 static PRCList sPendingAsyncCalls = PR_INIT_STATIC_CLIST(&sPendingAsyncCalls);
 
@@ -1920,7 +1922,87 @@
                  ("NPN_GetProperty(npp %p, npobj %p, property %p) called\n",
                   npp, npobj, property));
 
-  return npobj->_class->getProperty(npobj, property, result);
+  if (!npobj->_class->getProperty(npobj, property, result))
+    return false;
+
+  // If a Java plugin tries to get the document.URL or document.documentURI
+  // property from us, don't pass back a value that Java won't be able to
+  // understand -- one that will make the URL(String) constructor throw a
+  // MalformedURL exception.  Passing such a value causes Java Plugin2 to
+  // crash (to throw a RuntimeException in Plugin2Manager.getDocumentBase()).
+  // Also don't pass back a value that Java is likely to mishandle.
+
+  ns4xPluginInstance* inst = (ns4xPluginInstance*) npp->ndata;
+  if (!inst)
+    return false;
+  if (!inst->mIsJavaPlugin)
+    return true;
+
+  if (!NPVARIANT_IS_STRING(*result))
+    return true;
+
+  NPUTF8* propertyName = _utf8fromidentifier(property);
+  if (!propertyName)
+    return true;
+  bool notURL =
+    (PL_strcasecmp(propertyName, "URL") &&
+     PL_strcasecmp(propertyName, "documentURI"));
+  _memfree(propertyName);
+  if (notURL)
+    return true;
+
+  NPObject* window_obj = _getwindowobject(npp);
+  if (!window_obj)
+    return true;
+
+  NPVariant doc_v;
+  NPObject* document_obj = nsnull;
+  NPIdentifier doc_id = _getstringidentifier("document");
+  bool ok = npobj->_class->getProperty(window_obj, doc_id, &doc_v);
+  _releaseobject(window_obj);
+  if (ok) {
+    if (NPVARIANT_IS_OBJECT(doc_v)) {
+      document_obj = NPVARIANT_TO_OBJECT(doc_v);
+    } else {
+      _releasevariantvalue(&doc_v);
+      return true;
+    }
+  } else {
+    return true;
+  }
+  _releaseobject(document_obj);
+  if (document_obj != npobj)
+    return true;
+
+  NPString urlnp = NPVARIANT_TO_STRING(*result);
+  nsXPIDLCString url;
+  url.Assign(urlnp.utf8characters, urlnp.utf8length);
+
+  PRBool javaCompatible = PR_FALSE;
+  if (NS_FAILED(NS_CheckIsJavaCompatibleURLString(url, &javaCompatible)))
+    javaCompatible = PR_FALSE;
+  if (javaCompatible)
+    return true;
+
+  // If Java won't be able to interpret the original value of document.URL or
+  // document.documentURI, or is likely to mishandle it, pass back something
+  // that Java will understand but won't be able to use to access the network,
+  // and for which same-origin checks will always fail.
+
+  if (inst->mFakeURL.IsVoid()) {
+    // Abort (do an error return) if NS_MakeRandomInvalidURLString() fails.
+    if (NS_FAILED(NS_MakeRandomInvalidURLString(inst->mFakeURL))) {
+      _releasevariantvalue(result);
+      return false;
+    }
+  }
+
+  _releasevariantvalue(result);
+  char* fakeurl = (char *) _memalloc(inst->mFakeURL.Length() + 1);
+  strcpy(fakeurl, inst->mFakeURL);
+  STRINGZ_TO_NPVARIANT(fakeurl, *result);
+
+  return true;
 }
 
 bool NP_CALLBACK
--- xulrunner-1.9.0.19.orig/modules/plugin/base/src/nsJSNPRuntime.cpp
+++ xulrunner-1.9.0.19/modules/plugin/base/src/nsJSNPRuntime.cpp
@@ -1045,7 +1045,8 @@
 
     NPObject *npobj = (NPObject *)::JS_GetPrivate(cx, obj);
 
-    return _retainobject(npobj);
+    if (LookupNPP(npobj) == npp)
+      return _retainobject(npobj);
   }
 
   if (!sJSObjWrappers.ops) {
@@ -1960,10 +1961,8 @@
 LookupNPP(NPObject *npobj)
 {
   if (npobj->_class == &nsJSObjWrapper::sJSObjWrapperNPClass) {
-    NS_ERROR("NPP requested for NPObject of class "
-             "nsJSObjWrapper::sJSObjWrapperNPClass!\n");
-
-    return nsnull;
+    nsJSObjWrapper* o = static_cast<nsJSObjWrapper*>(npobj);
+    return o->mNpp;
   }
 
   NPObjWrapperHashEntry *entry = static_cast<NPObjWrapperHashEntry *>
@@ -2170,6 +2169,11 @@
                      "NPObject Member => fieldValue", arg);
   }
 
+  if (!JSVAL_IS_PRIMITIVE(memberPrivate->methodName)) {
+    ::JS_MarkGCThing(cx, JSVAL_TO_OBJECT(memberPrivate->methodName),
+                     "NPObject Member => methodName", arg);
+  }
+
   // There's no strong reference from our private data to the
   // NPObject, so make sure to mark the NPObject wrapper to keep the
   // NPObject alive as long as this NPObjectMember is alive.
--- xulrunner-1.9.0.19.orig/modules/libpr0n/decoders/jpeg/nsJPEGDecoder.cpp
+++ xulrunner-1.9.0.19/modules/libpr0n/decoders/jpeg/nsJPEGDecoder.cpp
@@ -192,12 +192,17 @@
       return NS_ERROR_OUT_OF_MEMORY;
       
     mImageLoad->SetImage(mImage);
-    nsresult result = mImage->SetDiscardable("image/jpeg");
-    if (NS_FAILED(result)) {
-      mState = JPEG_ERROR;
-      PR_LOG(gJPEGDecoderAccountingLog, PR_LOG_DEBUG,
-             (" (could not set image container to discardable)"));
-      return result;
+
+    // Don't discard if we're multipart, and assume we are for safety.
+    PRBool multipart = PR_TRUE;
+    if (NS_SUCCEEDED(mImageLoad->GetIsMultiPartChannel(&multipart)) && !multipart) {
+      nsresult result = mImage->SetDiscardable("image/jpeg");
+      if (NS_FAILED(result)) {
+        mState = JPEG_ERROR;
+        PR_LOG(gJPEGDecoderAccountingLog, PR_LOG_DEBUG,
+               (" (could not set image container to discardable)"));
+        return result;
+      }
     }
   }
 
--- xulrunner-1.9.0.19.orig/modules/libpr0n/decoders/png/nsPNGDecoder.h
+++ xulrunner-1.9.0.19/modules/libpr0n/decoders/png/nsPNGDecoder.h
@@ -73,7 +73,9 @@
 
   void CreateFrame(png_uint_32 x_offset, png_uint_32 y_offset, 
                    PRInt32 width, PRInt32 height, gfx_format format);
+#ifdef APNG
   void SetAnimFrameInfo();
+#endif
   
   void EndImageFrame();
 
@@ -94,7 +96,9 @@
   PRUint8 mChannels;
   PRPackedBool mError;
   PRPackedBool mFrameHasNoAlpha;
+#ifdef APNG
   PRPackedBool mFrameIsHidden;
+#endif
 };
 
 #endif // nsPNGDecoder_h__
--- xulrunner-1.9.0.19.orig/modules/libpr0n/decoders/png/nsPNGDecoder.cpp
+++ xulrunner-1.9.0.19/modules/libpr0n/decoders/png/nsPNGDecoder.cpp
@@ -62,7 +62,9 @@
 static void PNGAPI info_callback(png_structp png_ptr, png_infop info_ptr);
 static void PNGAPI row_callback(png_structp png_ptr, png_bytep new_row,
                            png_uint_32 row_num, int pass);
+#ifdef APNG
 static void PNGAPI frame_info_callback(png_structp png_ptr, png_uint_32 frame_num);
+#endif
 static void PNGAPI end_callback(png_structp png_ptr, png_infop info_ptr);
 static void PNGAPI error_callback(png_structp png_ptr, png_const_charp error_msg);
 static void PNGAPI warning_callback(png_structp png_ptr, png_const_charp warning_msg);
@@ -86,7 +88,10 @@
   mPNG(nsnull), mInfo(nsnull),
   mCMSLine(nsnull), interlacebuf(nsnull),
   mInProfile(nsnull), mTransform(nsnull),
-  mChannels(0), mError(PR_FALSE), mFrameIsHidden(PR_FALSE)
+  mChannels(0), mError(PR_FALSE)
+#ifdef APNG
+  , mFrameIsHidden(PR_FALSE)
+#endif
 {
 }
 
@@ -117,8 +122,10 @@
   if (NS_FAILED(rv))
     longjmp(mPNG->jmpbuf, 5); // NS_ERROR_OUT_OF_MEMORY
 
+#ifdef APNG
   if (png_get_valid(mPNG, mInfo, PNG_INFO_acTL))
     SetAnimFrameInfo();
+#endif
   
   mImage->AppendFrame(mFrame);
   
@@ -134,6 +141,7 @@
   mFrameHasNoAlpha = PR_TRUE;
 }
 
+#ifdef APNG
 // set timeout and frame disposal method for the current frame
 void nsPNGDecoder::SetAnimFrameInfo()
 {
@@ -173,6 +181,7 @@
   /*else // 'over' is the default for a gfxImageFrame
       mFrame->SetBlendMethod(imgIContainer::kBlendOver); */
 }
+#endif
 
 // set timeout and frame disposal method for the current frame
 void nsPNGDecoder::EndImageFrame()
@@ -240,7 +249,7 @@
   /* Always decode to 24 bit pixdepth */
 
 #ifdef PNG_USER_MEM_SUPPORTED
-  if (gfxPlatform::GetCMSMode() != eCMSMode_Off) {
+  if (gfxPlatform::IsCMSEnabled()) {
     mPNG = png_create_read_struct_2(PNG_LIBPNG_VER_STRING,
                                     NULL,
                                     error_callback,
@@ -277,7 +286,7 @@
   
 # if PNG_LIBPNG_VER < 10401
 #  if defined(PNG_WRITE_SUPPORTED)
-  if (gfxPlatform::GetCMSMode() != eCMSMode_Off) {
+  if (gfxPlatform::IsCMSEnabled()) {
     /* Increase speed of decompressing large iCCP chunks (default buffer
        size is 8192) */
     png_set_compression_buffer_size(mPNG, (png_size_t)32768L);
@@ -302,11 +311,16 @@
       return NS_ERROR_OUT_OF_MEMORY;
       
     mImageLoad->SetImage(mImage);
-    if (NS_FAILED(mImage->SetDiscardable("image/png"))) {
-      PR_LOG(gPNGDecoderAccountingLog, PR_LOG_DEBUG,
-             ("PNGDecoderAccounting: info_callback(): failed to set image container %p as discardable",
-              mImage.get()));
-      return NS_ERROR_FAILURE;
+
+    // Don't discard if we're multipart, and assume we are for safety.
+    PRBool multipart = PR_TRUE;
+    if (NS_SUCCEEDED(mImageLoad->GetIsMultiPartChannel(&multipart)) && !multipart) {
+      if (NS_FAILED(mImage->SetDiscardable("image/png"))) {
+        PR_LOG(gPNGDecoderAccountingLog, PR_LOG_DEBUG,
+               ("PNGDecoderAccounting: info_callback(): failed to set image container %p as discardable",
+                mImage.get()));
+        return NS_ERROR_FAILURE;
+      }
     }
   }
 
@@ -671,12 +685,15 @@
     }
   }
 
+#ifdef APNG
   if (png_get_valid(png_ptr, info_ptr, PNG_INFO_acTL))
     png_set_progressive_frame_fn(png_ptr, frame_info_callback, NULL);
   
   if (png_get_first_frame_is_hidden(png_ptr, info_ptr)) {
     decoder->mFrameIsHidden = PR_TRUE;
-  } else {
+  } else
+#endif
+  {
     decoder->CreateFrame(0, 0, width, height, decoder->format);
   }
   
@@ -699,7 +716,7 @@
 
 #ifdef PNG_USER_MEM_SUPPORTED
   /* Revert to the default memory allocator */
-  if (gfxPlatform::GetCMSMode() != eCMSMode_Off)
+  if (gfxPlatform::IsCMSEnabled())
      png_set_mem_fn(decoder->mPNG, NULL, NULL, NULL);
 #endif
 
@@ -707,7 +724,7 @@
 # if PNG_LIBPNG_VER < 10401
 #  if defined(PNG_WRITE_SUPPORTED)
   /* Revert to the default zlib buffer size */
-  if (gfxPlatform::GetCMSMode() != eCMSMode_Off) {
+  if (gfxPlatform::IsCMSEnabled()) {
     png_set_compression_buffer_size(decoder->mPNG, (png_size_t)8192);
   }
 #  endif
@@ -721,8 +738,10 @@
    */
   png_set_crc_action(png_ptr, NULL, PNG_CRC_ERROR_QUIT);
   
+#ifdef APNG
   if (png_get_first_frame_is_hidden(png_ptr, info_ptr))
     decoder->mFrame = nsnull;
+#endif
   
   return;
 }
@@ -760,9 +779,16 @@
    */
   nsPNGDecoder *decoder = static_cast<nsPNGDecoder*>(png_get_progressive_ptr(png_ptr));
   
+#ifdef APNG
   // skip this frame
   if (decoder->mFrameIsHidden)
     return;
+#endif
+
+  PRInt32 height;
+  decoder->mFrame->GetHeight(&height);
+  if (row_num >= height)
+    return;
 
   if (new_row) {
     PRInt32 width;
@@ -862,6 +888,7 @@
   }
 }
 
+#ifdef APNG
 // got the header of a new frame that's coming
 void
 frame_info_callback(png_structp png_ptr, png_uint_32 frame_num)
@@ -871,11 +898,15 @@
   
   nsPNGDecoder *decoder = static_cast<nsPNGDecoder*>(png_get_progressive_ptr(png_ptr));
   
+#ifdef APNG
   // old frame is done
   if (!decoder->mFrameIsHidden)
+#endif
     decoder->EndImageFrame();
   
+#ifdef APNG
   decoder->mFrameIsHidden = PR_FALSE;
+#endif
   
   x_offset = png_get_next_frame_x_offset(png_ptr, decoder->mInfo);
   y_offset = png_get_next_frame_y_offset(png_ptr, decoder->mInfo);
@@ -884,6 +915,7 @@
   
   decoder->CreateFrame(x_offset, y_offset, width, height, decoder->format);
 }
+#endif
 
 void
 end_callback(png_structp png_ptr, png_infop info_ptr)
@@ -902,12 +934,14 @@
 
   nsPNGDecoder *decoder = static_cast<nsPNGDecoder*>(png_get_progressive_ptr(png_ptr));
   
+#ifdef APNG
   if (png_get_valid(png_ptr, info_ptr, PNG_INFO_acTL)) {
     PRInt32 num_plays = png_get_num_plays(png_ptr, info_ptr);
     decoder->mImage->SetLoopCount(num_plays - 1);
   }
   
   if (!decoder->mFrameIsHidden)
+#endif
     decoder->EndImageFrame();
   
   decoder->mImage->DecodingComplete();
--- xulrunner-1.9.0.19.orig/modules/libpr0n/encoders/png/nsPNGEncoder.h
+++ xulrunner-1.9.0.19/modules/libpr0n/encoders/png/nsPNGEncoder.h
@@ -65,12 +65,14 @@
 protected:
   nsresult ParseOptions(const nsAString& aOptions,
                            PRBool* useTransparency,
+#ifdef APNG
                            PRBool* skipFirstFrame,
                            PRUint32* numAnimatedFrames,
                            PRUint32* numIterations,
                            PRUint32* frameDispose,
                            PRUint32* frameBlend,
                            PRUint32* frameDelay,
+#endif
                            PRUint32* offsetX,
                            PRUint32* offsetY);
   void ConvertHostARGBRow(const PRUint8* aSrc, PRUint8* aDest,
@@ -83,7 +85,9 @@
   png_struct* mPNG;
   png_info* mPNGinfo;
 
+#ifdef APNG
   PRBool mIsAnimation;
+#endif
 
   // image buffer
   PRUint8* mImageBuffer;
--- xulrunner-1.9.0.19.orig/modules/libpr0n/encoders/png/nsPNGEncoder.cpp
+++ xulrunner-1.9.0.19/modules/libpr0n/encoders/png/nsPNGEncoder.cpp
@@ -51,7 +51,9 @@
 NS_IMPL_THREADSAFE_ISUPPORTS2(nsPNGEncoder, imgIEncoder, nsIInputStream)
 
 nsPNGEncoder::nsPNGEncoder() : mPNG(nsnull), mPNGinfo(nsnull),
+#ifdef APNG
                                mIsAnimation(PR_FALSE),
+#endif
                                mImageBuffer(nsnull), mImageBufferSize(0),
                                mImageBufferUsed(0), mImageBufferReadPoint(0)
 {
@@ -109,9 +111,12 @@
                                              PRUint32 aInputFormat,
                                              const nsAString& aOutputOptions)
 {
-  PRBool useTransparency = PR_TRUE, skipFirstFrame = PR_FALSE;
+  PRBool useTransparency = PR_TRUE;
+#ifdef APNG
+  PRBool skipFirstFrame = PR_FALSE;
   PRUint32 numFrames = 1;
   PRUint32 numPlays = 0; // For animations, 0 == forever
+#endif
 
   // can't initialize more than once
   if (mImageBuffer != nsnull)
@@ -124,14 +129,19 @@
     return NS_ERROR_INVALID_ARG;
 
   // parse and check any provided output options
-  nsresult rv = ParseOptions(aOutputOptions, &useTransparency, &skipFirstFrame,
-                             &numFrames, &numPlays, nsnull, nsnull,
-                             nsnull, nsnull, nsnull);
+  nsresult rv = ParseOptions(aOutputOptions, &useTransparency,
+#ifdef APNG
+                             &skipFirstFrame, &numFrames, &numPlays,
+			     nsnull, nsnull, nsnull,
+#endif
+			     nsnull, nsnull);
   if (rv != NS_OK) { return rv; }
 
+#ifdef APNG
   if (numFrames > 1) {
     mIsAnimation = PR_TRUE;
   }
+#endif
 
   // initialize
   mPNG = png_create_write_struct(PNG_LIBPNG_VER_STRING,
@@ -181,10 +191,12 @@
                PNG_INTERLACE_NONE, PNG_COMPRESSION_TYPE_DEFAULT,
                PNG_FILTER_TYPE_DEFAULT);
 
+#ifdef APNG
   if (mIsAnimation) {
     png_set_first_frame_is_hidden(mPNG, mPNGinfo, skipFirstFrame);
     png_set_acTL(mPNG, mPNGinfo, numFrames, numPlays);
   }
+#endif
 
   // XXX: support PLTE, gAMA, tRNS, bKGD?
 
@@ -203,9 +215,11 @@
                                           const nsAString& aFrameOptions)
 {
   PRBool useTransparency= PR_TRUE;
+#ifdef APNG
   PRUint32 delay_ms = 500;
   PRUint32 dispose_op = PNG_DISPOSE_OP_NONE;
   PRUint32 blend_op = PNG_BLEND_OP_SOURCE;
+#endif
   PRUint32 x_offset = 0, y_offset = 0;
 
   // must be initialized
@@ -229,17 +243,22 @@
   }
 
   // parse and check any provided output options
-  nsresult rv = ParseOptions(aFrameOptions, &useTransparency, nsnull,
-                             nsnull, nsnull, &dispose_op, &blend_op,
-                             &delay_ms, &x_offset, &y_offset);
+  nsresult rv = ParseOptions(aFrameOptions, &useTransparency,
+#ifdef APNG
+                             nsnull, nsnull, nsnull, &dispose_op,
+			     &blend_op, &delay_ms,
+#endif
+                             &x_offset, &y_offset);
   if (rv != NS_OK) { return rv; }
 
+#ifdef APNG
   if (mIsAnimation) {
     // XXX the row pointers arg (#3) is unused, can it be removed?
     png_write_frame_head(mPNG, mPNGinfo, nsnull,
                          aWidth, aHeight, x_offset, y_offset,
                          delay_ms, 1000, dispose_op, blend_op);
   }
+#endif
 
   // Stride is the padded width of each row, so it better be longer (I'm afraid
   // people will not understand what stride means, so check it well)
@@ -283,9 +302,11 @@
     return NS_ERROR_INVALID_ARG;
   }
 
+#ifdef APNG
   if (mIsAnimation) {
     png_write_frame_tail(mPNG, mPNGinfo);
   }
+#endif
 
   return NS_OK;
 }
@@ -321,12 +342,14 @@
 nsresult
 nsPNGEncoder::ParseOptions(const nsAString& aOptions,
                            PRBool* useTransparency,
+#ifdef APNG
                            PRBool* skipFirstFrame,
                            PRUint32* numFrames,
                            PRUint32* numPlays,
                            PRUint32* frameDispose,
                            PRUint32* frameBlend,
                            PRUint32* frameDelay,
+#endif
                            PRUint32* offsetX,
                            PRUint32* offsetY)
 {
@@ -355,6 +378,7 @@
         return NS_ERROR_INVALID_ARG;
       }
 
+#ifdef APNG
     // skipfirstframe=[yes|no]
     } else if (nsCRT::strcmp(token, "skipfirstframe") == 0 && skipFirstFrame) {
       if (!value) { return NS_ERROR_INVALID_ARG; }
@@ -414,6 +438,7 @@
       if (!value) { return NS_ERROR_INVALID_ARG; }
 
       if (PR_sscanf(value, "%u", frameDelay) != 1) { return NS_ERROR_INVALID_ARG; }
+#endif
 
     // xoffset=#
     } else if (nsCRT::strcmp(token, "xoffset") == 0 && offsetX) {
--- xulrunner-1.9.0.19.orig/modules/oji/src/ProxyJNI.cpp
+++ xulrunner-1.9.0.19/modules/oji/src/ProxyJNI.cpp
@@ -47,6 +47,7 @@
 #include "nsVoidArray.h"
 #include "plstr.h"
 #include "ProxyClassLoader.h"
+#include "nsCSecurityContext.h"
 
 #include "ProxyJNI.h"
 #include "nsDataHashtable.h"
@@ -281,6 +282,7 @@
     nsISecureEnv* mSecureEnv;
     nsISecurityContext* mContext;
     jbool mInProxyFindClass;
+    nsXPIDLCString mFakeOrigin;
 
     static ProxyJNIEnv& GetProxyEnv(JNIEnv* env) { return *(ProxyJNIEnv*)env; }
 
@@ -293,6 +295,27 @@
         }
     }
 
+    // Don't generate a new fake origin on every call to
+    // nsCSecurityContext::GetOrigin().
+    nsresult getOrSetFakeOrigin(nsCSecurityContext *securityContext)
+    {
+        if (!securityContext)
+            return NS_OK;
+        if (!mFakeOrigin.IsVoid())
+            securityContext->SetFakeOrigin(mFakeOrigin);
+        char origin[256];
+        nsresult rv = securityContext->GetOrigin(origin, 256);
+        if (NS_FAILED(rv))
+            return rv;
+        if (mFakeOrigin.IsVoid()) {
+            const nsCString& contextFakeOrigin =
+               securityContext->GetFakeOrigin();
+            if (!contextFakeOrigin.IsVoid())
+                mFakeOrigin.Assign(contextFakeOrigin);
+        }
+        return NS_OK;
+    }
+
     static jint JNICALL GetVersion(JNIEnv* env)
     {
         jint version = 0;
@@ -499,10 +522,10 @@
         ProxyJNIEnv& proxyEnv = GetProxyEnv(env);
         nsISecureEnv* secureEnv = GetSecureEnv(env);
         nsISecurityContext* securityContext = proxyEnv.getContext();
-        nsresult result;
-        result = secureEnv->NewObject(clazz, method->mMethodID, jargs, &outObject, securityContext);
+        nsresult rv = proxyEnv.getOrSetFakeOrigin((nsCSecurityContext*)securityContext);
+        if (NS_SUCCEEDED(rv))
+            secureEnv->NewObject(clazz, method->mMethodID, jargs, &outObject, securityContext);
         NS_IF_RELEASE(securityContext);
-        
         return outObject;
     }
 
@@ -513,8 +536,9 @@
         nsISecureEnv* secureEnv = GetSecureEnv(env);
         JNIMethod* method = (JNIMethod*)methodID;
         nsISecurityContext* securityContext = proxyEnv.getContext();
-        nsresult result;
-        result = secureEnv->NewObject(clazz, method->mMethodID, args, &outObject, securityContext);
+        nsresult rv = proxyEnv.getOrSetFakeOrigin((nsCSecurityContext*)securityContext);
+        if (NS_SUCCEEDED(rv))
+            secureEnv->NewObject(clazz, method->mMethodID, args, &outObject, securityContext);
         NS_IF_RELEASE(securityContext);
         return outObject;
     }
@@ -568,7 +592,9 @@
         ProxyJNIEnv& proxyEnv = GetProxyEnv(env);
         nsISecureEnv* secureEnv = GetSecureEnv(env);
         nsISecurityContext* securityContext = proxyEnv.getContext();
-        nsresult rv = secureEnv->CallMethod(method->mReturnType, obj, method->mMethodID, args, &outValue, securityContext);
+        nsresult rv = proxyEnv.getOrSetFakeOrigin((nsCSecurityContext*)securityContext);
+        if (NS_SUCCEEDED(rv))
+            rv = secureEnv->CallMethod(method->mReturnType, obj, method->mMethodID, args, &outValue, securityContext);
         NS_IF_RELEASE(securityContext);
         return NS_SUCCEEDED(rv) ? outValue : kErrorValue;
     }
@@ -586,8 +612,9 @@
         ProxyJNIEnv& proxyEnv = GetProxyEnv(env);
         nsISecureEnv* secureEnv = GetSecureEnv(env);
         nsISecurityContext* securityContext = proxyEnv.getContext();
-        nsresult result;
-        result = secureEnv->CallMethod(jvoid_type, obj, method->mMethodID, args, &unusedValue, securityContext);
+        nsresult rv = proxyEnv.getOrSetFakeOrigin((nsCSecurityContext*)securityContext);
+        if (NS_SUCCEEDED(rv))
+            secureEnv->CallMethod(jvoid_type, obj, method->mMethodID, args, &unusedValue, securityContext);
         NS_IF_RELEASE(securityContext);
     }
 
@@ -675,7 +702,9 @@
         ProxyJNIEnv& proxyEnv = GetProxyEnv(env);
         nsISecureEnv* secureEnv = GetSecureEnv(env);
         nsISecurityContext* securityContext = proxyEnv.getContext();
-        nsresult rv = secureEnv->CallNonvirtualMethod(method->mReturnType, obj, clazz, method->mMethodID, args, &outValue, securityContext);
+        nsresult rv = proxyEnv.getOrSetFakeOrigin((nsCSecurityContext*)securityContext);
+        if (NS_SUCCEEDED(rv))
+            rv = secureEnv->CallNonvirtualMethod(method->mReturnType, obj, clazz, method->mMethodID, args, &outValue, securityContext);
         NS_IF_RELEASE(securityContext);
         return NS_SUCCEEDED(rv) ? outValue : kErrorValue;
     }
@@ -693,8 +722,9 @@
         ProxyJNIEnv& proxyEnv = GetProxyEnv(env);
         nsISecureEnv* secureEnv = GetSecureEnv(env);
         nsISecurityContext* securityContext = proxyEnv.getContext();
-        nsresult result;
-        result = secureEnv->CallNonvirtualMethod(jvoid_type, obj, clazz, method->mMethodID, args, &unusedValue, securityContext);
+        nsresult rv = proxyEnv.getOrSetFakeOrigin((nsCSecurityContext*)securityContext);
+        if (NS_SUCCEEDED(rv))
+            secureEnv->CallNonvirtualMethod(jvoid_type, obj, clazz, method->mMethodID, args, &unusedValue, securityContext);
         NS_IF_RELEASE(securityContext);
     }
 
@@ -780,7 +810,9 @@
         ProxyJNIEnv& proxyEnv = GetProxyEnv(env);
         nsISecureEnv* secureEnv = GetSecureEnv(env);
         nsISecurityContext* securityContext = proxyEnv.getContext();
-        nsresult rv = secureEnv->GetField(field->mFieldType, obj, field->mFieldID, &outValue, securityContext);
+        nsresult rv = proxyEnv.getOrSetFakeOrigin((nsCSecurityContext*)securityContext);
+        if (NS_SUCCEEDED(rv))
+            rv = secureEnv->GetField(field->mFieldType, obj, field->mFieldID, &outValue, securityContext);
         NS_IF_RELEASE(securityContext);
         return NS_SUCCEEDED(rv) ? outValue : kErrorValue;
     }
@@ -808,8 +840,9 @@
         ProxyJNIEnv& proxyEnv = GetProxyEnv(env);
         nsISecureEnv* secureEnv = GetSecureEnv(env);
         nsISecurityContext* securityContext = proxyEnv.getContext();
-        nsresult result;
-        result = secureEnv->SetField(field->mFieldType, obj, field->mFieldID, value, securityContext);
+        nsresult rv = proxyEnv.getOrSetFakeOrigin((nsCSecurityContext*)securityContext);
+        if (NS_SUCCEEDED(rv))
+            secureEnv->SetField(field->mFieldType, obj, field->mFieldID, value, securityContext);
         NS_IF_RELEASE(securityContext);
     }
 
@@ -864,7 +897,9 @@
         ProxyJNIEnv& proxyEnv = GetProxyEnv(env);
         nsISecureEnv* secureEnv = GetSecureEnv(env);
         nsISecurityContext* securityContext = proxyEnv.getContext();
-        nsresult rv = secureEnv->CallStaticMethod(method->mReturnType, clazz, method->mMethodID, args, &outValue, securityContext);
+        nsresult rv = proxyEnv.getOrSetFakeOrigin((nsCSecurityContext*)securityContext);
+        if (NS_SUCCEEDED(rv))
+            rv = secureEnv->CallStaticMethod(method->mReturnType, clazz, method->mMethodID, args, &outValue, securityContext);
         NS_IF_RELEASE(securityContext);
         return NS_SUCCEEDED(rv) ? outValue : kErrorValue;
     }
@@ -882,8 +917,9 @@
         ProxyJNIEnv& proxyEnv = GetProxyEnv(env);
         nsISecureEnv* secureEnv = GetSecureEnv(env);
         nsISecurityContext* securityContext = proxyEnv.getContext();
-        nsresult result;
-        result = secureEnv->CallStaticMethod(jvoid_type, clazz, method->mMethodID, args, &unusedValue, securityContext);
+        nsresult rv = proxyEnv.getOrSetFakeOrigin((nsCSecurityContext*)securityContext);
+        if (NS_SUCCEEDED(rv))
+            secureEnv->CallStaticMethod(jvoid_type, clazz, method->mMethodID, args, &unusedValue, securityContext);
         NS_IF_RELEASE(securityContext);
     }
 
@@ -969,7 +1005,9 @@
         ProxyJNIEnv& proxyEnv = GetProxyEnv(env);
         nsISecureEnv* secureEnv = GetSecureEnv(env);
         nsISecurityContext* securityContext = proxyEnv.getContext();
-        nsresult rv = secureEnv->GetStaticField(field->mFieldType, clazz, field->mFieldID, &outValue, securityContext);
+        nsresult rv = proxyEnv.getOrSetFakeOrigin((nsCSecurityContext*)securityContext);
+        if (NS_SUCCEEDED(rv))
+            rv = secureEnv->GetStaticField(field->mFieldType, clazz, field->mFieldID, &outValue, securityContext);
         NS_IF_RELEASE(securityContext);
         return NS_SUCCEEDED(rv) ? outValue : kErrorValue;
     }
@@ -997,8 +1035,9 @@
         ProxyJNIEnv& proxyEnv = GetProxyEnv(env);
         nsISecureEnv* secureEnv = GetSecureEnv(env);
         nsISecurityContext* securityContext = proxyEnv.getContext();
-        nsresult result;
-        result = secureEnv->SetStaticField(field->mFieldType, clazz, field->mFieldID, value, securityContext);
+        nsresult rv = proxyEnv.getOrSetFakeOrigin((nsCSecurityContext*)securityContext);
+        if (NS_SUCCEEDED(rv))
+            secureEnv->SetStaticField(field->mFieldType, clazz, field->mFieldID, value, securityContext);
         NS_IF_RELEASE(securityContext);
     }
 
@@ -1734,9 +1773,8 @@
 ProxyJNIEnv::~ProxyJNIEnv()
 {
     this->functions = NULL;
-    
-    if (mSecureEnv != NULL)
-        mSecureEnv->Release();
+
+    NS_IF_RELEASE(mSecureEnv);
 }
 
 JNIEnv* CreateProxyJNI(nsIJVMPlugin* jvmPlugin, nsISecureEnv* inSecureEnv)
--- xulrunner-1.9.0.19.orig/modules/oji/src/nsCSecurityContext.h
+++ xulrunner-1.9.0.19/modules/oji/src/nsCSecurityContext.h
@@ -50,6 +50,7 @@
 #include "nsISecurityContext.h"
 #include "nsIPrincipal.h"
 #include "nsCOMPtr.h"
+#include "nsString.h"
 
 struct JSContext;
 
@@ -105,13 +106,22 @@
     nsCSecurityContext(nsIPrincipal* principal);
     virtual ~nsCSecurityContext(void);
 
+    ////////////////////////////////////////////////////////////////////////////
+    // Miscellaneous
+
+    const nsCString& GetFakeOrigin() const { return mFakeOrigin; }
+    void SetFakeOrigin(nsCString& fakeOrigin) { mFakeOrigin.Assign(fakeOrigin); }
+
 protected:
     JSStackFrame *m_pJStoJavaFrame;
     JSContext    *m_pJSCX;
 private:
+    nsresult GetOriginImpl(nsXPIDLCString& origin);
+
     nsCOMPtr<nsIPrincipal> m_pPrincipal;
     PRBool        m_HasUniversalJavaCapability;
     PRBool        m_HasUniversalBrowserReadCapability;
+    nsXPIDLCString mFakeOrigin;
 };
 
 #endif // nsCSecurityContext_h___
--- xulrunner-1.9.0.19.orig/modules/oji/src/nsCSecurityContext.cpp
+++ xulrunner-1.9.0.19/modules/oji/src/nsCSecurityContext.cpp
@@ -57,6 +57,7 @@
 #include "nsIScriptSecurityManager.h"
 #include "nsIServiceManager.h"
 #include "nsCRT.h"
+#include "nsNetUtil.h"
 
 #include "nsTraceRefcnt.h"
 
@@ -103,38 +104,70 @@
     return NS_OK;
 }
 
-
-NS_METHOD 
-nsCSecurityContext::GetOrigin(char* buf, int buflen)
+nsresult
+nsCSecurityContext::GetOriginImpl(nsXPIDLCString& origin)
 {
+    nsresult rv = NS_OK;
+
     if (!m_pPrincipal) {
         // Get the Script Security Manager.
-        nsresult rv = NS_OK;
         nsCOMPtr<nsIScriptSecurityManager> secMan =
              do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID, &rv);
-        if (NS_FAILED(rv) || !secMan) {
+        if (NS_FAILED(rv) || !secMan)
             return NS_ERROR_FAILURE;
-        }
 
         secMan->GetSubjectPrincipal(getter_AddRefs(m_pPrincipal));
-        if (!m_pPrincipal) {
+        if (!m_pPrincipal)
             return NS_ERROR_FAILURE;
-        }
     }
 
-    nsXPIDLCString origin;
     m_pPrincipal->GetOrigin(getter_Copies(origin));
+    if (origin.IsEmpty())
+        return NS_ERROR_FAILURE;
+
+    return NS_OK;
+}
+
+// This method is called from the OJI plugin without checking its return
+// value (from getAndPackSecurityInfo() in remotejni.cpp).  So we need to
+// set the origin appropriately except in the very worst of circumstances,
+// and only then do an error return.
+NS_METHOD
+nsCSecurityContext::GetOrigin(char* buf, int buflen)
+{
+    nsXPIDLCString origin;
+    PRBool javaCompatible = PR_FALSE;
+
+    if (NS_SUCCEEDED(GetOriginImpl(origin))) {
+        if (NS_FAILED(NS_CheckIsJavaCompatibleURLString(origin, &javaCompatible)))
+            javaCompatible = PR_FALSE;
+    } else {
+        javaCompatible = PR_FALSE;
+    }
 
     PRInt32 originlen = origin.Length();
-    if (origin.IsEmpty() || originlen > buflen - 1) {
-        return NS_ERROR_FAILURE;
+
+    // Don't pass back a value that Java won't be able to understand or
+    // won't handle correctly.  Instead pass back something that Java will
+    // understand but won't be able to use to access the network, and for
+    // which same-origin checks will always fail.
+    if (!javaCompatible) {
+        if (mFakeOrigin.IsVoid()) {
+            if (NS_FAILED(NS_MakeRandomInvalidURLString(mFakeOrigin)))
+                return NS_ERROR_FAILURE;
+        }
+        origin.Assign(mFakeOrigin);
+        originlen = origin.Length();
     }
 
+    if (originlen > buflen - 1)
+        return NS_ERROR_FAILURE;
+
     // Copy the string into to user supplied buffer. Is there a better
     // way to do this?
 
     memcpy(buf, origin, originlen);
-    buf[originlen] = nsnull; // Gotta terminate it.
+    buf[originlen] = '\0'; // Gotta terminate it.
 
     return NS_OK;
 }
--- xulrunner-1.9.0.19.orig/modules/libpref/src/prefapi.cpp
+++ xulrunner-1.9.0.19/modules/libpref/src/prefapi.cpp
@@ -336,8 +336,6 @@
                           pref->userPref,
                           (PrefType) PREF_TYPE(pref)))
         sourcePref = &pref->userPref;
-    else if (PREF_IS_LOCKED(pref))
-        sourcePref = &pref->defaultPref;
     else
         // do not save default prefs that haven't changed
         return PL_DHASH_NEXT;
@@ -957,7 +955,10 @@
                          const char *pref,
                          PrefValue   value,
                          PrefType    type,
-                         PRBool      isDefault)
+                         PRBool      isDefault,
+                         PRBool      isLocked)
 {
     pref_HashPref(pref, value, type, isDefault);
+    if (isLocked)
+        PREF_LockPref(pref, PR_TRUE);
 }
--- xulrunner-1.9.0.19.orig/modules/libpref/src/prefread.cpp
+++ xulrunner-1.9.0.19/modules/libpref/src/prefread.cpp
@@ -75,6 +75,7 @@
 #define BITS_PER_HEX_DIGIT      4
 
 static const char kUserPref[] = "user_pref";
+static const char kLockPref[] = "lockPref";
 static const char kPref[] = "pref";
 static const char kTrue[] = "true";
 static const char kFalse[] = "false";
@@ -161,7 +162,7 @@
     default:
         break;
     }
-    (*ps->reader)(ps->closure, ps->lb, value, ps->vtype, ps->fdefault);
+    (*ps->reader)(ps->closure, ps->lb, value, ps->vtype, ps->fdefault, ps->flock);
     return PR_TRUE;
 }
 
@@ -220,6 +221,7 @@
                 ps->vb    = NULL;
                 ps->vtype = PREF_INVALID;
                 ps->fdefault = PR_FALSE;
+                ps->flock = PR_FALSE;
             }
             switch (c) {
             case '/':       /* begin comment block or line? */
@@ -230,7 +232,9 @@
                 break;
             case 'u':       /* indicating user_pref */
             case 'p':       /* indicating pref */
-                ps->smatch = (c == 'u' ? kUserPref : kPref);
+            case 'l':       /* indicating lockPref */
+                ps->smatch = (c == 'u' ? kUserPref :
+                                         (c == 'p' ? kPref : kLockPref));
                 ps->sindex = 1;
                 ps->nextstate = PREF_PARSE_UNTIL_OPEN_PAREN;
                 state = PREF_PARSE_MATCH_STRING;
@@ -274,7 +278,8 @@
         /* name parsing */
         case PREF_PARSE_UNTIL_NAME:
             if (c == '\"' || c == '\'') {
-                ps->fdefault = (ps->smatch == kPref);
+                ps->fdefault = (ps->smatch != kUserPref);
+                ps->flock = (ps->smatch == kLockPref);
                 ps->quotechar = c;
                 ps->nextstate = PREF_PARSE_UNTIL_COMMA; /* return here when done */
                 state = PREF_PARSE_QUOTED_STRING;
--- xulrunner-1.9.0.19.orig/modules/libpref/src/prefread.h
+++ xulrunner-1.9.0.19/modules/libpref/src/prefread.h
@@ -62,7 +62,8 @@
                            const char *pref,
                            PrefValue   val,
                            PrefType    type,
-                           PRBool      defPref);
+                           PRBool      defPref,
+                           PRBool      lockPref);
 
 /* structure fields are private */
 typedef struct PrefParseState {
@@ -83,6 +84,7 @@
     char       *vb;         /* value buffer (ptr into lb)    */
     PrefType    vtype;      /* PREF_STRING,INT,BOOL          */
     PRBool      fdefault;   /* PR_TRUE if (default) pref     */
+    PRBool      flock;      /* PR_TRUE if pref to be locked  */
 } PrefParseState;
 
 /**
--- xulrunner-1.9.0.19.orig/modules/libpref/src/prefapi.h
+++ xulrunner-1.9.0.19/modules/libpref/src/prefapi.h
@@ -207,7 +207,8 @@
                           const char *pref,
                           PrefValue   value,
                           PrefType    type,
-                          PRBool      isDefault);
+                          PRBool      isDefault,
+                          PRBool      isLocked);
 
 NSPR_END_EXTERN_C
 #endif
--- xulrunner-1.9.0.19.orig/modules/libpref/src/init/all.js
+++ xulrunner-1.9.0.19/modules/libpref/src/init/all.js
@@ -501,6 +501,7 @@
 pref("javascript.allow.mailnews",           false);
 pref("javascript.options.strict",           false);
 pref("javascript.options.relimit",          false);
+pref("javascript.options.showInConsole",    true);
 
 // advanced prefs
 pref("security.enable_java",                true);
@@ -2229,7 +2230,7 @@
 pref("network.hosts.smtp_server", "localhost");
 pref("network.hosts.pop_server", "pop");
 pref("network.protocol-handler.warn-external.file", false);
-pref("layout.css.dpi", -1); // max(96dpi, System setting)
+pref("layout.css.dpi", 0); // System setting
 pref("browser.drag_out_of_frame_style", 1);
 pref("editor.singleLine.pasteNewlines", 0);
 
@@ -2258,7 +2259,7 @@
 pref("ui.allow_platform_file_picker", true);
 
 // should NetworkManager be authoritative for online/offline status?
-pref("toolkit.networkmanager.disable", false);
+pref("toolkit.networkmanager.disable", true);
 
 pref("helpers.global_mime_types_file", "/etc/mime.types");
 pref("helpers.global_mailcap_file", "/etc/mailcap");
--- xulrunner-1.9.0.19.orig/modules/libjar/nsJAR.cpp
+++ xulrunner-1.9.0.19/modules/libjar/nsJAR.cpp
@@ -127,6 +127,7 @@
                 mReleaseTime(PR_INTERVAL_NO_TIMEOUT), 
                 mCache(nsnull), 
                 mLock(nsnull),
+                mMtime(0),
                 mTotalItemsInManifest(0)
 {
 }
@@ -170,13 +171,16 @@
   if (mLock) return NS_ERROR_FAILURE; // Already open!
 
   mZipFile = zipFile;
+  nsresult rv = zipFile->GetLastModifiedTime(&mMtime);
+  if (NS_FAILED(rv)) return rv;
+
   mLock = PR_NewLock();
   NS_ENSURE_TRUE(mLock, NS_ERROR_OUT_OF_MEMORY);
 
   PRFileDesc *fd = OpenFile();
   NS_ENSURE_TRUE(fd, NS_ERROR_FAILURE);
 
-  nsresult rv = mZip.OpenArchive(fd);
+  rv = mZip.OpenArchive(fd);
   if (NS_FAILED(rv)) Close();
 
   return rv;
@@ -1121,6 +1125,7 @@
 {
   NS_ENSURE_ARG_POINTER(zipFile);
   nsresult rv;
+  nsCOMPtr<nsIJAR> antiLockZipGrip;
   nsAutoLock lock(mLock);
 
 #ifdef ZIP_CACHE_HIT_RATE
@@ -1131,15 +1136,23 @@
   rv = zipFile->GetNativePath(path);
   if (NS_FAILED(rv)) return rv;
 
+  PRInt64 Mtime;
+  rv = zipFile->GetLastModifiedTime(&Mtime);
+  if (NS_FAILED(rv)) return rv;
+
   nsCStringKey key(path);
   nsJAR* zip = static_cast<nsJAR*>(static_cast<nsIZipReader*>(mZips.Get(&key))); // AddRefs
-  if (zip) {
+  if (zip && (Mtime == zip->GetMtime())) {
 #ifdef ZIP_CACHE_HIT_RATE
     mZipCacheHits++;
 #endif
     zip->ClearReleaseTime();
   }
   else {
+    if (zip) {
+      antiLockZipGrip = zip;
+      mZips.Remove(&key);
+    }
     zip = new nsJAR();
     if (zip == nsnull)
         return NS_ERROR_OUT_OF_MEMORY;
--- xulrunner-1.9.0.19.orig/modules/libjar/nsJAR.h
+++ xulrunner-1.9.0.19/modules/libjar/nsJAR.h
@@ -133,6 +133,9 @@
       mCache = cache;
     }
 
+    PRInt64 GetMtime() {
+      return mMtime;
+    }
   protected:
     //-- Private data members
     nsCOMPtr<nsIFile>        mZipFile;        // The zip/jar file on disk
@@ -144,6 +147,7 @@
     PRIntervalTime           mReleaseTime;    // used by nsZipReaderCache for flushing entries
     nsZipReaderCache*        mCache;          // if cached, this points to the cache it's contained in
     PRLock*                  mLock;	
+    PRInt64                  mMtime;
     PRInt32                  mTotalItemsInManifest;
     
     //-- Private functions
--- xulrunner-1.9.0.19.orig/content/xul/content/src/nsXULElement.h
+++ xulrunner-1.9.0.19/content/xul/content/src/nsXULElement.h
@@ -383,6 +383,12 @@
     {
         NS_ASSERTION(!mScriptObject.mObject, "Leaking script object.");
 
+        if (!aObject) {
+            mScriptObject.mObject = nsnull;
+
+            return;
+        }
+
         nsresult rv = nsContentUtils::HoldScriptObject(mScriptObject.mLangID,
                                                        this,
                                                        &NS_CYCLE_COLLECTION_NAME(nsXULPrototypeNode),
--- xulrunner-1.9.0.19.orig/content/xul/templates/src/nsXULTemplateBuilder.cpp
+++ xulrunner-1.9.0.19/content/xul/templates/src/nsXULTemplateBuilder.cpp
@@ -1115,14 +1115,9 @@
         // Check for a change to the 'datasources' attribute. If so, setup
         // mDB by parsing the vew value and rebuild.
         else if (aAttribute == nsGkAtoms::datasources) {
-            Uninit(PR_FALSE);  // Reset results
-
-            PRBool shouldDelay;
-            LoadDataSources(aDocument, &shouldDelay);
-            if (!shouldDelay)
-                nsContentUtils::AddScriptRunner(
-                    NS_NEW_RUNNABLE_METHOD(nsXULTemplateBuilder, this,
-                                           RunnableRebuild));
+            nsContentUtils::AddScriptRunner(
+                NS_NEW_RUNNABLE_METHOD(nsXULTemplateBuilder, this,
+                                       RunnableLoadAndRebuild));
         }
     }
 }
@@ -1139,8 +1134,9 @@
         if (mQueryProcessor)
             mQueryProcessor->Done();
 
-        // use false since content is going away anyway
-        Uninit(PR_FALSE);
+        // Pass false to Uninit since content is going away anyway
+        nsContentUtils::AddScriptRunner(
+            NS_NEW_RUNNABLE_METHOD(nsXULTemplateBuilder, this, UninitFalse));
 
         aDocument->RemoveObserver(this);
 
@@ -1158,7 +1154,6 @@
 
         mDB = nsnull;
         mCompDB = nsnull;
-        mRoot = nsnull;
         mDataSource = nsnull;
     }
 }
@@ -1177,9 +1172,9 @@
     mDataSource = nsnull;
     mDB = nsnull;
     mCompDB = nsnull;
-    mRoot = nsnull;
 
-    Uninit(PR_TRUE);
+    nsContentUtils::AddScriptRunner(
+        NS_NEW_RUNNABLE_METHOD(nsXULTemplateBuilder, this, UninitTrue));
 }
 
 
--- xulrunner-1.9.0.19.orig/content/xul/templates/src/nsXULTemplateBuilder.h
+++ xulrunner-1.9.0.19/content/xul/templates/src/nsXULTemplateBuilder.h
@@ -46,6 +46,7 @@
 #include "nsStubDocumentObserver.h"
 #include "nsIScriptSecurityManager.h"
 #include "nsIContent.h"
+#include "nsIDocument.h"
 #include "nsIObserver.h"
 #include "nsIRDFCompositeDataSource.h"
 #include "nsIRDFContainer.h"
@@ -153,6 +154,23 @@
     RebuildAll() = 0; // must be implemented by subclasses
 
     void RunnableRebuild() { Rebuild(); }
+    void RunnableLoadAndRebuild() {
+      Uninit(PR_FALSE);  // Reset results
+
+      nsCOMPtr<nsIDocument> doc = mRoot ? mRoot->GetDocument() : nsnull;
+      if (doc) {
+        PRBool shouldDelay;
+        LoadDataSources(doc, &shouldDelay);
+        if (!shouldDelay) {
+          Rebuild();
+        }
+      }
+    }
+
+    // mRoot should not be cleared until after Uninit is finished so that
+    // generated content can be removed during uninitialization.
+    void UninitFalse() { Uninit(PR_FALSE); mRoot = nsnull; }
+    void UninitTrue() { Uninit(PR_TRUE); mRoot = nsnull; }
 
     /**
      * Find the <template> tag that applies for this builder
--- xulrunner-1.9.0.19.orig/content/xul/templates/src/Makefile.in
+++ xulrunner-1.9.0.19/content/xul/templates/src/Makefile.in
@@ -102,7 +102,8 @@
 include $(topsrcdir)/config/rules.mk
 
 LOCAL_INCLUDES	= -I$(srcdir)/../../../base/src \
-		   -I$(srcdir)/../../content/src \
-		   $(NULL)
+		  -I$(srcdir)/../../content/src \
+		  -I$(srcdir)/../../../../layout/xul/base/src/tree/src \
+		  $(NULL)
 
 DEFINES += -D_IMPL_NS_LAYOUT
--- xulrunner-1.9.0.19.orig/content/xul/templates/src/nsXULTreeBuilder.cpp
+++ xulrunner-1.9.0.19/content/xul/templates/src/nsXULTreeBuilder.cpp
@@ -63,6 +63,8 @@
 #include "nsUnicharUtils.h"
 #include "nsINameSpaceManager.h"
 #include "nsIDOMClassInfo.h"
+#include "nsTreeContentView.h"
+#include "nsDOMError.h"
 
 // For security check
 #include "nsIDocument.h"
@@ -439,6 +441,9 @@
 NS_IMETHODIMP
 nsXULTreeBuilder::SetSelection(nsITreeSelection* aSelection)
 {
+    NS_ENSURE_TRUE(!aSelection ||
+                   nsTreeContentView::CanTrustTreeSelection(aSelection),
+                   NS_ERROR_DOM_SECURITY_ERR);
     mSelection = aSelection;
     return NS_OK;
 }
--- xulrunner-1.9.0.19.orig/content/xul/document/src/nsXULCommandDispatcher.cpp
+++ xulrunner-1.9.0.19/content/xul/document/src/nsXULCommandDispatcher.cpp
@@ -361,6 +361,8 @@
     if (NS_FAILED(rv)) return rv;
   }
 
+  nsCOMArray<nsIContent> updaters;
+
   for (Updater* updater = mUpdaters; updater != nsnull; updater = updater->mNext) {
     // Skip any nodes that don't match our 'events' or 'targets'
     // filters.
@@ -375,6 +377,12 @@
     if (! content)
       return NS_ERROR_UNEXPECTED;
 
+    updaters.AppendObject(content);
+  }
+
+  for (PRUint32 u = 0; u < updaters.Count(); u++) {
+    nsIContent* content = updaters[u];
+
     nsCOMPtr<nsIDocument> document = content->GetDocument();
 
     NS_ASSERTION(document != nsnull, "element has no document");
@@ -387,7 +395,7 @@
       CopyUTF16toUTF8(aEventName, aeventnameC);
       PR_LOG(gLog, PR_LOG_NOTICE,
              ("xulcmd[%p] update %p event=%s",
-              this, updater->mElement.get(),
+              this, content,
               aeventnameC.get()));
     }
 #endif
--- xulrunner-1.9.0.19.orig/content/xul/document/test/Makefile.in
+++ xulrunner-1.9.0.19/content/xul/document/test/Makefile.in
@@ -54,6 +54,8 @@
 		$(NULL)
 
 _CHROME_FILES = \
+		test_bug583948.xul \
+		window_bug583948.xul \
 		test_bug497875.xul \
 		     bug497875-iframe.xul \
 		$(NULL)
--- xulrunner-1.9.0.19.orig/content/xul/document/test/window_bug583948.xul
+++ xulrunner-1.9.0.19/content/xul/document/test/window_bug583948.xul
@@ -0,0 +1,8 @@
+<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<command oncommandupdate="document.removeChild(document.documentElement)" commandupdater="true"/>
+<box command="c"/>
+<iframe/>
+
+</window>
--- xulrunner-1.9.0.19.orig/content/xul/document/test/test_bug583948.xul
+++ xulrunner-1.9.0.19/content/xul/document/test/test_bug583948.xul
@@ -0,0 +1,41 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<script type="application/javascript" src="chrome://mochikit/content/MochiKit/packed.js"></script>
+<script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js" />
+
+<body xmlns="http://www.w3.org/1999/xhtml">
+  <div id="content" style="display: none"/>
+</body>
+
+<script>
+SimpleTest.waitForExplicitFinish();
+
+var attempts = 0;
+
+function update() {
+  setTimeout(function() {
+    if (otherWindow.location)
+      otherWindow.location.reload()
+    }, 1);
+  otherWindow.document.commandDispatcher.updateCommands('');
+  // without the crash fix, this usually crashes after 2 to 4 reloads
+  if (++attempts == 6) {
+    ok(true, "didn't crash after 6 attempts");
+    otherWindow.close();
+    SimpleTest.finish();
+  }
+  else {
+    setTimeout(update, 100);
+  }
+}
+
+var otherWindow = window.open("window_bug583948.xul", "_new", "chrome");
+setTimeout(update, 100);
+</script>
+
+</window>
--- xulrunner-1.9.0.19.orig/content/events/src/nsEventStateManager.cpp
+++ xulrunner-1.9.0.19/content/events/src/nsEventStateManager.cpp
@@ -2377,7 +2377,7 @@
         }
 
         nsIFrame* currFrame = mCurrentTarget;
-        nsIContent* activeContent = nsnull;
+        nsCOMPtr<nsIContent> activeContent;
         if (mCurrentTarget)
           activeContent = mCurrentTarget->GetContent();
 
--- xulrunner-1.9.0.19.orig/content/xml/document/src/Makefile.in
+++ xulrunner-1.9.0.19/content/xml/document/src/Makefile.in
@@ -91,6 +91,7 @@
 		-I$(srcdir)/../../../xul/content/src \
 		-I$(srcdir)/../../../events/src \
 		-I$(srcdir)/../../../../dom/src/base \
+		-I$(srcdir)/../../../../caps/include \
 		$(NULL)
 
 DEFINES += -D_IMPL_NS_LAYOUT
--- xulrunner-1.9.0.19.orig/content/xml/document/src/nsXMLFragmentContentSink.cpp
+++ xulrunner-1.9.0.19/content/xml/document/src/nsXMLFragmentContentSink.cpp
@@ -49,6 +49,7 @@
 #include "nsGkAtoms.h"
 #include "nsINodeInfo.h"
 #include "nsNodeInfoManager.h"
+#include "nsNullPrincipal.h"
 #include "nsContentCreatorFunctions.h"
 #include "nsDOMError.h"
 #include "nsIConsoleService.h"
@@ -485,7 +486,7 @@
 class nsXHTMLParanoidFragmentSink : public nsXMLFragmentContentSink
 {
 public:
-  nsXHTMLParanoidFragmentSink();
+  nsXHTMLParanoidFragmentSink(PRBool aAllContent = PR_FALSE);
 
   static nsresult Init();
   static void Cleanup();
@@ -516,6 +517,9 @@
                                  PRUint32 aLength);
 protected:
   PRUint32 mSkipLevel; // used when we descend into <style> or <script>
+
+  nsCOMPtr<nsIPrincipal> mNullPrincipal;
+
   // Use nsTHashTable as a hash set for our whitelists
   static nsTHashtable<nsISupportsHashKey>* sAllowedTags;
   static nsTHashtable<nsISupportsHashKey>* sAllowedAttributes;
@@ -524,8 +528,8 @@
 nsTHashtable<nsISupportsHashKey>* nsXHTMLParanoidFragmentSink::sAllowedTags;
 nsTHashtable<nsISupportsHashKey>* nsXHTMLParanoidFragmentSink::sAllowedAttributes;
 
-nsXHTMLParanoidFragmentSink::nsXHTMLParanoidFragmentSink():
-  nsXMLFragmentContentSink(PR_FALSE), mSkipLevel(0)
+nsXHTMLParanoidFragmentSink::nsXHTMLParanoidFragmentSink(PRBool aAllContent):
+  nsXMLFragmentContentSink(aAllContent), mSkipLevel(0)
 {
 }
 
@@ -595,6 +599,20 @@
   return NS_OK;
 }
 
+nsresult
+NS_NewXHTMLParanoidFragmentSink2(nsIFragmentContentSink** aResult)
+{
+  nsXHTMLParanoidFragmentSink* it = new nsXHTMLParanoidFragmentSink(PR_TRUE);
+  if (!it) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+  nsresult rv = nsXHTMLParanoidFragmentSink::Init();
+  NS_ENSURE_SUCCESS(rv, rv);
+  NS_ADDREF(*aResult = it);
+  
+  return NS_OK;
+}
+
 void
 NS_XHTMLParanoidFragmentSinkShutdown()
 {
@@ -623,6 +641,12 @@
   PRInt32 nameSpaceID;
   nsCOMPtr<nsIAtom> prefix, localName;
   nsCOMPtr<nsINodeInfo> nodeInfo;
+
+  if (!mNullPrincipal) {
+      mNullPrincipal = do_CreateInstance(NS_NULLPRINCIPAL_CONTRACTID, &rv);
+      NS_ENSURE_SUCCESS(rv, rv);
+  }
+
   while (*aAtts) {
     nsContentUtils::SplitExpatName(aAtts[0], getter_AddRefs(prefix),
                                    getter_AddRefs(localName), &nameSpaceID);
@@ -639,8 +663,7 @@
       rv = NS_NewURI(getter_AddRefs(attrURI), nsDependentString(aAtts[1]),
                      nsnull, baseURI);
       if (NS_SUCCEEDED(rv)) {
-        rv = secMan->CheckLoadURIWithPrincipal(mTargetDocument->NodePrincipal(),
-                                               attrURI, flags);
+        rv = secMan->CheckLoadURIWithPrincipal(mNullPrincipal, attrURI, flags);
       }
     }
 
--- xulrunner-1.9.0.19.orig/content/xml/document/src/nsXMLDocument.cpp
+++ xulrunner-1.9.0.19/content/xml/document/src/nsXMLDocument.cpp
@@ -87,6 +87,8 @@
 #include "nsIScriptGlobalObjectOwner.h"
 #include "nsIJSContextStack.h"
 #include "nsContentCreatorFunctions.h"
+#include "nsContentPolicyUtils.h"
+#include "nsContentErrors.h"
 #include "nsIDOMUserDataHandler.h"
 #include "nsEventDispatcher.h"
 #include "nsNodeUtils.h"
@@ -358,10 +360,6 @@
     return rv;
   }
 
-  nsCOMPtr<nsIPrincipal> principal = NodePrincipal();
-  nsCOMPtr<nsIURI> codebase;
-  principal->GetURI(getter_AddRefs(codebase));
-
   // Check to see whether the current document is allowed to load this URI.
   // It's important to use the current document's principal for this check so
   // that we don't end up in a case where code with elevated privileges is
@@ -370,9 +368,26 @@
   // Enforce same-origin even for chrome loaders to avoid someone accidentally
   // using a document that content has a reference to and turn that into a
   // chrome document.
-  if (codebase) {
+  nsCOMPtr<nsIPrincipal> principal = NodePrincipal();
+  if (!nsContentUtils::IsSystemPrincipal(principal)) {
     rv = principal->CheckMayLoad(uri, PR_FALSE);
     NS_ENSURE_SUCCESS(rv, rv);
+
+    PRInt16 shouldLoad = nsIContentPolicy::ACCEPT;
+    rv = NS_CheckContentLoadPolicy(nsIContentPolicy::TYPE_XMLHTTPREQUEST,
+                                   uri,
+                                   principal,
+                                   callingDoc ? callingDoc.get() :
+                                     static_cast<nsIDocument*>(this),
+                                   NS_LITERAL_CSTRING("application/xml"),
+                                   nsnull,
+                                   &shouldLoad,
+                                   nsContentUtils::GetContentPolicy(),
+                                   nsContentUtils::GetSecurityManager());
+    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_CP_REJECTED(shouldLoad)) {
+      return NS_ERROR_CONTENT_BLOCKED;
+    }
   } else {
     // We're called from chrome, check to make sure the URI we're
     // about to load is also chrome.
--- xulrunner-1.9.0.19.orig/content/xbl/src/nsXBLBinding.cpp
+++ xulrunner-1.9.0.19/content/xbl/src/nsXBLBinding.cpp
@@ -1376,7 +1376,7 @@
     return PR_FALSE;
   }
 
-  nsIDocument* doc = mBoundElement->GetOwnerDoc();
+  nsIDocument* doc = mBoundElement ? mBoundElement->GetOwnerDoc() : nsnull;
   if (!doc) {
     return PR_FALSE;
   }
--- xulrunner-1.9.0.19.orig/content/xbl/src/nsBindingManager.cpp
+++ xulrunner-1.9.0.19/content/xbl/src/nsBindingManager.cpp
@@ -534,6 +534,9 @@
     SetWrappedJS(aContent, nsnull);
     SetContentListFor(aContent, nsnull);
     SetAnonymousNodesFor(aContent, nsnull);
+    if (oldBinding) {
+      oldBinding->SetBoundElement(nsnull);
+    }
   }
 
   return result ? NS_OK : NS_ERROR_FAILURE;
--- xulrunner-1.9.0.19.orig/content/xbl/src/nsXBLService.cpp
+++ xulrunner-1.9.0.19/content/xbl/src/nsXBLService.cpp
@@ -1172,56 +1172,6 @@
   return NS_OK;
 }
 
-class nsSameOriginChecker : public nsIChannelEventSink,
-                            public nsIInterfaceRequestor
-{
-  NS_DECL_ISUPPORTS
-  NS_DECL_NSICHANNELEVENTSINK
-  NS_DECL_NSIINTERFACEREQUESTOR
-};
-
-NS_IMPL_ISUPPORTS2(nsSameOriginChecker,
-                   nsIChannelEventSink,
-                   nsIInterfaceRequestor)
-
-NS_IMETHODIMP
-nsSameOriginChecker::OnChannelRedirect(nsIChannel *aOldChannel,
-                                       nsIChannel *aNewChannel,
-                                       PRUint32    aFlags)
-{
-    NS_PRECONDITION(aNewChannel, "Redirecting to null channel?");
-
-    nsCOMPtr<nsIURI> oldURI;
-    nsresult rv = aOldChannel->GetURI(getter_AddRefs(oldURI)); // The original URI
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    nsCOMPtr<nsIURI> newURI;
-    rv = aNewChannel->GetURI(getter_AddRefs(newURI)); // The new URI
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    rv = nsContentUtils::GetSecurityManager()->
-      CheckSameOriginURI(oldURI, newURI, PR_TRUE);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    nsCOMPtr<nsIURI> newOrigURI;
-    rv = aNewChannel->GetOriginalURI(getter_AddRefs(newOrigURI));
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    if (newOrigURI != newURI) {
-        rv = nsContentUtils::GetSecurityManager()->
-            CheckSameOriginURI(oldURI, newOrigURI, PR_TRUE);
-        NS_ENSURE_SUCCESS(rv, rv);
-    }
-
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-nsSameOriginChecker::GetInterface(const nsIID & aIID, void **aResult)
-{
-    return QueryInterface(aIID, aResult);
-}
-
 nsresult
 nsXBLService::FetchBindingDocument(nsIContent* aBoundElement, nsIDocument* aBoundDocument,
                                    nsIURI* aDocumentURI, nsIURI* aBindingURI, 
@@ -1256,7 +1206,7 @@
   rv = NS_NewChannel(getter_AddRefs(channel), aDocumentURI, nsnull, loadGroup);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsCOMPtr<nsIInterfaceRequestor> sameOriginChecker = new nsSameOriginChecker;
+  nsCOMPtr<nsIInterfaceRequestor> sameOriginChecker = nsContentUtils::GetSameOriginChecker();
   NS_ENSURE_TRUE(sameOriginChecker, NS_ERROR_OUT_OF_MEMORY);
 
   channel->SetNotificationCallbacks(sameOriginChecker);
--- xulrunner-1.9.0.19.orig/content/svg/content/src/nsSVGTSpanElement.cpp
+++ xulrunner-1.9.0.19/content/svg/content/src/nsSVGTSpanElement.cpp
@@ -46,6 +46,7 @@
 #include "nsISVGTextContentMetrics.h"
 #include "nsIFrame.h"
 #include "nsDOMError.h"
+#include "nsIDOMSVGPoint.h"
 
 typedef nsSVGStylableElement nsSVGTSpanElementBase;
 
@@ -337,9 +338,10 @@
 NS_IMETHODIMP nsSVGTSpanElement::GetCharNumAtPosition(nsIDOMSVGPoint *point,
                                                       PRInt32 *_retval)
 {
-  // null check when implementing - this method can be used by scripts!
-  if (!point)
+  nsCOMPtr<nsISVGValue> p = do_QueryInterface(point);
+  if (!p) {
     return NS_ERROR_DOM_SVG_WRONG_TYPE_ERR;
+  }
 
   nsCOMPtr<nsISVGTextContentMetrics> metrics = GetTextContentMetrics();
 
--- xulrunner-1.9.0.19.orig/content/svg/content/src/nsSVGPathElement.cpp
+++ xulrunner-1.9.0.19/content/svg/content/src/nsSVGPathElement.cpp
@@ -959,9 +959,11 @@
       if (aMarks->Length())
         aMarks->ElementAt(aMarks->Length() - 1).angle = prevAngle;
     } else {
-      aMarks->ElementAt(aMarks->Length() - 1).angle =
-        nsSVGUtils::AngleBisect(prevAngle, startAngle);
-      prevAngle = endAngle;
+      if (aMarks->Length()) {
+        aMarks->ElementAt(aMarks->Length() - 1).angle =
+          nsSVGUtils::AngleBisect(prevAngle, startAngle);
+        prevAngle = endAngle;
+      }
     }
 
     aMarks->AppendElement(nsSVGMark(x, y, 0));
--- xulrunner-1.9.0.19.orig/content/svg/content/src/nsSVGNumberList.cpp
+++ xulrunner-1.9.0.19/content/svg/content/src/nsSVGNumberList.cpp
@@ -262,16 +262,31 @@
                              PRUint32 index,
                              nsIDOMSVGNumber **_retval)
 {
+  *_retval = nsnull;
+
   if (!newItem) {
-    *_retval = nsnull;
     return NS_ERROR_DOM_SVG_WRONG_TYPE_ERR;
   }
 
-  nsresult rv = RemoveItem(index, _retval);
-  if (NS_FAILED(rv))
-    return rv;
+  if (index >= mNumbers.Count()) {
+    return NS_ERROR_DOM_INDEX_SIZE_ERR;
+  }
 
-  return InsertElementAt(newItem, index);
+  // The following is equivalent to RemoveItem() followed by InsertElementAt(),
+  // but with the WillModify() / DidModify() notifications collapsed.
+
+  WillModify();
+  nsIDOMSVGNumber* number = ElementAt(index);
+  NS_REMOVE_SVGVALUE_OBSERVER(number);
+  NS_RELEASE(number);
+  mNumbers.ReplaceElementAt(newItem, index);
+  NS_ADDREF(newItem);
+  NS_ADD_SVGVALUE_OBSERVER(newItem);
+  DidModify();
+
+  NS_ADDREF(*_retval = newItem);
+
+  return NS_OK;
 }
 
 /* nsIDOMSVGNumberList removeItem (in unsigned long index); */
--- xulrunner-1.9.0.19.orig/content/svg/content/src/nsSVGTextPathElement.cpp
+++ xulrunner-1.9.0.19/content/svg/content/src/nsSVGTextPathElement.cpp
@@ -44,6 +44,7 @@
 #include "nsSVGTextPathElement.h"
 #include "nsSVGAnimatedString.h"
 #include "nsDOMError.h"
+#include "nsIDOMSVGPoint.h"
 
 nsSVGElement::LengthInfo nsSVGTextPathElement::sLengthInfo[1] =
 {
@@ -260,9 +261,10 @@
 NS_IMETHODIMP nsSVGTextPathElement::GetCharNumAtPosition(nsIDOMSVGPoint *point,
                                                          PRInt32 *_retval)
 {
-  // null check when implementing - this method can be used by scripts!
-  if (!point)
+  nsCOMPtr<nsISVGValue> p = do_QueryInterface(point);
+  if (!p) {
     return NS_ERROR_DOM_SVG_WRONG_TYPE_ERR;
+  }
 
   nsCOMPtr<nsISVGTextContentMetrics> metrics = GetTextContentMetrics();
 
--- xulrunner-1.9.0.19.orig/content/svg/content/src/nsSVGTextElement.cpp
+++ xulrunner-1.9.0.19/content/svg/content/src/nsSVGTextElement.cpp
@@ -46,6 +46,7 @@
 #include "nsISVGTextContentMetrics.h"
 #include "nsIFrame.h"
 #include "nsDOMError.h"
+#include "nsIDOMSVGPoint.h"
 
 typedef nsSVGGraphicElement nsSVGTextElementBase;
 
@@ -333,9 +334,10 @@
 /* long getCharNumAtPosition (in nsIDOMSVGPoint point); */
 NS_IMETHODIMP nsSVGTextElement::GetCharNumAtPosition(nsIDOMSVGPoint *point, PRInt32 *_retval)
 {
-  // null check when implementing - this method can be used by scripts!
-  if (!point)
+  nsCOMPtr<nsISVGValue> p = do_QueryInterface(point);
+  if (!p) {
     return NS_ERROR_DOM_SVG_WRONG_TYPE_ERR;
+  }
 
   nsCOMPtr<nsISVGTextContentMetrics> metrics = GetTextContentMetrics();
 
--- xulrunner-1.9.0.19.orig/content/svg/content/src/nsSVGPathSegList.cpp
+++ xulrunner-1.9.0.19/content/svg/content/src/nsSVGPathSegList.cpp
@@ -243,17 +243,24 @@
 {
   NS_ENSURE_NATIVE_PATH_SEG(newItem, _retval);
 
+  if (index >= static_cast<PRUint32>(mSegments.Count())) {
+    return NS_ERROR_DOM_INDEX_SIZE_ERR;
+  }
+
   // immediately remove the new item from its current list
   nsSVGPathSeg* newItemSeg = static_cast<nsSVGPathSeg*>(newItem);
   RemoveFromCurrentList(newItemSeg);
 
+  // check length *again*, since mutation listener may have changed it!
   if (index >= static_cast<PRUint32>(mSegments.Count())) {
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
   }
 
-  // NOTE: the new item can never be the item we will be replacing now that we removed it from its current list beforehand
-  InsertElementAt(newItemSeg, index);
-  RemoveFromCurrentList(static_cast<nsSVGPathSeg*>(mSegments.ObjectAt(index+1)));
+  WillModify();
+  mSegments.ReplaceObjectAt(newItemSeg, index);
+  newItemSeg->SetCurrentList(this);
+  DidModify();
+
   NS_ADDREF(*_retval = newItem);
 
   return NS_OK;
--- xulrunner-1.9.0.19.orig/content/html/content/src/nsHTMLFrameSetElement.cpp
+++ xulrunner-1.9.0.19/content/html/content/src/nsHTMLFrameSetElement.cpp
@@ -43,6 +43,7 @@
 #include "nsIFrameSetElement.h"
 #include "nsIHTMLDocument.h"
 #include "nsIDocument.h"
+#include "prlog.h"
 
 class nsHTMLFrameSetElement : public nsGenericHTMLElement,
                               public nsIDOMHTMLFrameSetElement,
@@ -320,10 +321,11 @@
   spec.StripChars(" \n\r\t\"\'");
   spec.Trim(",");
   
-  // Count the commas 
+  // Count the commas. Don't count more than X commas (bug 576447).
+  PR_STATIC_ASSERT(NS_MAX_FRAMESET_SPEC_COUNT * sizeof(nsFramesetSpec) < (1 << 30));
   PRInt32 commaX = spec.FindChar(sComma);
   PRInt32 count = 1;
-  while (commaX != kNotFound) {
+  while (commaX != kNotFound && count < NS_MAX_FRAMESET_SPEC_COUNT) {
     count++;
     commaX = spec.FindChar(sComma, commaX + 1);
   }
--- xulrunner-1.9.0.19.orig/content/html/content/test/Makefile.in
+++ xulrunner-1.9.0.19/content/html/content/test/Makefile.in
@@ -117,6 +117,7 @@
 		test_bug430392.html \
 		bug441930_iframe.html \
 		test_bug441930.html \
+		test_bug643051.html \
 		$(NULL)
 
 libs:: $(_TEST_FILES)
--- xulrunner-1.9.0.19.orig/content/html/content/test/test_bug643051.html
+++ xulrunner-1.9.0.19/content/html/content/test/test_bug643051.html
@@ -0,0 +1,43 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=643051
+-->
+<head>
+  <title>Test for Bug 643051</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=643051">Mozilla Bug 643051</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 643051 **/
+document.cookie = "a=; expires=Thu, 01-Jan-1970 00:00:01 GMT";  // clear cookie
+document.cookie = "a2=; expires=Thu, 01-Jan-1970 00:00:01 GMT";  // clear cookie
+document.cookie = "a3=; expires=Thu, 01-Jan-1970 00:00:01 GMT";  // clear cookie
+
+// single cookie, should work
+document.cookie = "a=bar";
+is(document.cookie, "a=bar", "Can't read stored cookie!");
+
+document.cookie = "a2=bar\na3=bar";
+is(document.cookie, "a=bar; a2=bar", "Wrong cookie value");
+
+document.cookie = "a2=baz; a3=bar";
+is(document.cookie, "a=bar; a2=baz", "Wrong cookie value");
+
+// clear cookies again to avoid affecting other tests
+document.cookie = "a=; expires=Thu, 01-Jan-1970 00:00:01 GMT";
+document.cookie = "a2=; expires=Thu, 01-Jan-1970 00:00:01 GMT";
+document.cookie = "a3=; expires=Thu, 01-Jan-1970 00:00:01 GMT";
+</script>
+</pre>
+</body>
+</html>
--- xulrunner-1.9.0.19.orig/content/html/content/public/nsIFrameSetElement.h
+++ xulrunner-1.9.0.19/content/html/content/public/nsIFrameSetElement.h
@@ -66,6 +66,12 @@
 };
 
 /**
+ * The maximum number of entries allowed in the frame set element row
+ * or column spec.
+ */
+#define NS_MAX_FRAMESET_SPEC_COUNT 16000
+
+/**
  * This interface is used by the nsFramesetFrame to access the parsed
  * values of the "rows" and "cols" attributes
  */
--- xulrunner-1.9.0.19.orig/content/html/document/src/nsHTMLFragmentContentSink.cpp
+++ xulrunner-1.9.0.19/content/html/document/src/nsHTMLFragmentContentSink.cpp
@@ -59,12 +59,23 @@
 #include "nsContentUtils.h"
 #include "nsEscape.h"
 #include "nsNodeInfoManager.h"
+#include "nsNullPrincipal.h"
 #include "nsContentCreatorFunctions.h"
 #include "nsNetUtil.h"
 #include "nsIScriptSecurityManager.h"
 #include "nsContentSink.h"
 #include "nsTHashtable.h"
 #include "nsCycleCollectionParticipant.h"
+#include "nsICSSLoader.h"
+#include "nsICSSParser.h"
+#include "nsCSSProperty.h"
+#include "nsCSSDeclaration.h"
+#include "nsICSSStyleRule.h"
+#include "nsUnicharInputStream.h"
+#include "nsCSSStyleSheet.h"
+#include "nsCSSDeclaration.h"
+#include "nsCSSProperty.h"
+#include "nsIDOMCSSRule.h"
 
 //
 // XXX THIS IS TEMPORARY CODE
@@ -76,6 +87,9 @@
 class nsHTMLFragmentContentSink : public nsIFragmentContentSink,
                                   public nsIHTMLContentSink {
 public:
+  /**
+   * @param aAllContent Whether there is context information available for the fragment.
+   */
   nsHTMLFragmentContentSink(PRBool aAllContent = PR_FALSE);
   virtual ~nsHTMLFragmentContentSink();
 
@@ -140,8 +154,6 @@
   void ProcessBaseTag(nsIContent* aContent);
   void AddBaseTagInfo(nsIContent* aContent);
 
-  nsresult Init();
-
   PRPackedBool mAllContent;
   PRPackedBool mProcessing;
   PRPackedBool mSeenBody;
@@ -874,10 +886,11 @@
 // Find the whitelist of allowed elements and attributes in
 // nsContentSink.h We share it with nsHTMLParanoidFragmentSink
 
-class nsHTMLParanoidFragmentSink : public nsHTMLFragmentContentSink
+class nsHTMLParanoidFragmentSink : public nsHTMLFragmentContentSink,
+                                   public nsIParanoidFragmentContentSink
 {
 public:
-  nsHTMLParanoidFragmentSink();
+  nsHTMLParanoidFragmentSink(PRBool aAllContent = PR_FALSE);
 
   static nsresult Init();
   static void Cleanup();
@@ -893,14 +906,26 @@
 
   nsresult AddAttributes(const nsIParserNode& aNode,
                          nsIContent* aContent);
+
+  // nsIParanoidFragmentContentSink
+  virtual void AllowStyles();
+  virtual void AllowComments();
+
 protected:
   nsresult NameFromType(const nsHTMLTag aTag,
                         nsIAtom **aResult);
 
   nsresult NameFromNode(const nsIParserNode& aNode,
                         nsIAtom **aResult);
+
+  void SanitizeStyleRule(nsICSSStyleRule *aRule, nsAutoString &aRuleText);
   
-  PRBool mSkip; // used when we descend into <style> or <script>
+  PRPackedBool mSkip; // used when we descend into <style> or <script>
+  PRPackedBool mProcessStyle; // used when style is explicitly white-listed
+  PRPackedBool mInStyle; // whether we're inside a style element
+  PRPackedBool mProcessComments; // used when comments are allowed
+
+  nsCOMPtr<nsIPrincipal> mNullPrincipal;
 
   // Use nsTHashTable as a hash set for our whitelists
   static nsTHashtable<nsISupportsHashKey>* sAllowedTags;
@@ -910,8 +935,9 @@
 nsTHashtable<nsISupportsHashKey>* nsHTMLParanoidFragmentSink::sAllowedTags;
 nsTHashtable<nsISupportsHashKey>* nsHTMLParanoidFragmentSink::sAllowedAttributes;
 
-nsHTMLParanoidFragmentSink::nsHTMLParanoidFragmentSink():
-  nsHTMLFragmentContentSink(PR_FALSE), mSkip(PR_FALSE)
+nsHTMLParanoidFragmentSink::nsHTMLParanoidFragmentSink(PRBool aAllContent):
+  nsHTMLFragmentContentSink(aAllContent), mSkip(PR_FALSE),
+  mProcessStyle(PR_FALSE), mInStyle(PR_FALSE), mProcessComments(PR_FALSE)
 {
 }
 
@@ -982,14 +1008,27 @@
   return NS_OK;
 }
 
+nsresult
+NS_NewHTMLParanoidFragmentSink2(nsIFragmentContentSink** aResult)
+{
+  nsHTMLParanoidFragmentSink* it = new nsHTMLParanoidFragmentSink(PR_TRUE);
+  if (!it) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+  nsresult rv = nsHTMLParanoidFragmentSink::Init();
+  NS_ENSURE_SUCCESS(rv, rv);
+  NS_ADDREF(*aResult = it);
+  
+  return NS_OK;
+}
+
 void
 NS_HTMLParanoidFragmentSinkShutdown()
 {
   nsHTMLParanoidFragmentSink::Cleanup();
 }
 
-NS_IMPL_ISUPPORTS_INHERITED0(nsHTMLParanoidFragmentSink,
-                             nsHTMLFragmentContentSink)
+NS_IMPL_ISUPPORTS_INHERITED1(nsHTMLParanoidFragmentSink, nsHTMLFragmentContentSink, nsIParanoidFragmentContentSink)
 
 nsresult
 nsHTMLParanoidFragmentSink::NameFromType(const nsHTMLTag aTag,
@@ -1026,6 +1065,18 @@
   return rv;
 }
 
+void
+nsHTMLParanoidFragmentSink::AllowStyles()
+{
+  mProcessStyle = PR_TRUE;
+}
+
+void
+nsHTMLParanoidFragmentSink::AllowComments()
+{
+  mProcessComments = PR_TRUE;
+}
+
 // nsHTMLFragmentContentSink
 
 nsresult
@@ -1044,7 +1095,12 @@
   nsresult rv;
   // use this to check for safe URIs in the few attributes that allow them
   nsIScriptSecurityManager* secMan = nsContentUtils::GetSecurityManager();
+  PRUint32 flags = nsIScriptSecurityManager::DISALLOW_INHERIT_PRINCIPAL;
   nsCOMPtr<nsIURI> baseURI;
+  if (!mNullPrincipal) {
+      mNullPrincipal = do_CreateInstance(NS_NULLPRINCIPAL_CONTRACTID, &rv);
+      NS_ENSURE_SUCCESS(rv, rv);
+  }
 
   for (PRInt32 i = ac - 1; i >= 0; i--) {
     rv = NS_OK;
@@ -1054,8 +1110,13 @@
 
     nsCOMPtr<nsIAtom> keyAtom = do_GetAtom(k);
 
-    // not an allowed attribute
-    if (!sAllowedAttributes || !sAllowedAttributes->GetEntry(keyAtom)) {
+    // Check if this is an allowed attribute, or a style attribute in case
+    // we've been asked to allow style attributes, or an HTML5 data-*
+    // attribute, or an attribute which begins with "_".
+    if ((!sAllowedAttributes || !sAllowedAttributes->GetEntry(keyAtom)) &&
+        (!mProcessStyle || keyAtom != nsGkAtoms::style) &&
+        !(StringBeginsWith(key, NS_LITERAL_STRING("data-")) ||
+          StringBeginsWith(key, NS_LITERAL_STRING("_")))) {
       continue;
     }
 
@@ -1065,7 +1126,10 @@
       nsContentUtils::TrimCharsInSet(kWhitespace, aNode.GetValueAt(i));
 
     // check the attributes we allow that contain URIs
-    if (IsAttrURI(keyAtom)) {
+    // special case src attributes for img tags, because they can't
+    // run any dangerous code.
+    if (IsAttrURI(keyAtom) &&
+        !(nodeType == eHTMLTag_img && keyAtom == nsGkAtoms::src)) {
       if (!baseURI) {
         baseURI = aContent->GetBaseURI();
       }
@@ -1073,9 +1137,7 @@
       rv = NS_NewURI(getter_AddRefs(attrURI), v, nsnull, baseURI);
       if (NS_SUCCEEDED(rv)) {
         rv = secMan->
-          CheckLoadURIWithPrincipal(mTargetDocument->NodePrincipal(),
-                attrURI,
-                nsIScriptSecurityManager::DISALLOW_INHERIT_PRINCIPAL);
+          CheckLoadURIWithPrincipal(mNullPrincipal, attrURI, flags);
       }
     }
     
@@ -1085,7 +1147,31 @@
       continue;
     }
 
-    if (nodeType == eHTMLTag_a && keyAtom == nsGkAtoms::name) {
+    // Filter unsafe stuff from style attributes if they're allowed
+    if (mProcessStyle && keyAtom == nsGkAtoms::style) {
+      if (!baseURI) {
+        baseURI = aContent->GetBaseURI();
+      }
+      nsICSSLoader* cssLoader = mTargetDocument->CSSLoader();
+      nsCOMPtr<nsICSSParser> parser;
+      rv = cssLoader->GetParserFor(nsnull, getter_AddRefs(parser));
+      if (NS_SUCCEEDED(rv)) {
+        nsCOMPtr<nsICSSStyleRule> rule;
+        rv = parser->ParseStyleAttribute(aNode.GetValueAt(i),
+                                         mTargetDocument->GetDocumentURI(),
+                                         baseURI,
+                                         mTargetDocument->NodePrincipal(),
+                                         getter_AddRefs(rule));
+        if (NS_SUCCEEDED(rv)) {
+          nsAutoString cleanValue;
+          SanitizeStyleRule(rule, cleanValue);
+          aContent->SetAttr(kNameSpaceID_None, keyAtom, cleanValue, PR_FALSE);
+        } else {
+          // we couldn't sanitize the style attribute, ignore it
+          continue;
+        }
+      }
+    } else if (nodeType == eHTMLTag_a && keyAtom == nsGkAtoms::name) {
       NS_ConvertUTF16toUTF8 cname(v);
       NS_ConvertUTF8toUTF16 uv(nsUnescape(cname.BeginWriting()));
       // Add attribute to content
@@ -1114,9 +1200,10 @@
 {
   nsresult rv = NS_OK;
   
-  // bail if it's a script or style, or we're already inside one of those
+  // bail if it's a script or style (when we don't allow processing of stylesheets),
+  // or we're already inside one of those
   eHTMLTags type = (eHTMLTags)aNode.GetNodeType();
-  if (type == eHTMLTag_script || type == eHTMLTag_style) {
+  if (type == eHTMLTag_script || (!mProcessStyle && type == eHTMLTag_style)) {
     mSkip = PR_TRUE;
     return rv;
   }
@@ -1127,7 +1214,14 @@
 
   // not on whitelist
   if (!sAllowedTags || !sAllowedTags->GetEntry(name)) {
-    return NS_OK;
+    // unless it's style, and we're allowing it
+    if (!mProcessStyle || name != nsGkAtoms::style) {
+      return NS_OK;
+    }
+  }
+
+  if (type == eHTMLTag_style) {
+    mInStyle = PR_TRUE;
   }
 
   return nsHTMLFragmentContentSink::OpenContainer(aNode);
@@ -1138,6 +1232,10 @@
 {
   nsresult rv = NS_OK;
 
+  if (mIgnoreNextCloseHead && aTag == eHTMLTag_head) {
+    mIgnoreNextCloseHead = PR_FALSE;
+    return NS_OK;
+  }
   if (mSkip) {
     mSkip = PR_FALSE;
     return rv;
@@ -1149,12 +1247,128 @@
   
   // not on whitelist
   if (!sAllowedTags || !sAllowedTags->GetEntry(name)) {
-    return NS_OK;
+    // unless it's style, and we're allowing it
+    if (!mProcessStyle || name != nsGkAtoms::style) {
+      return NS_OK;
+    }
+  }
+
+  if (mInStyle && name == nsGkAtoms::style) {
+    mInStyle = PR_FALSE;
+
+    // Flush the text to make sure that the style text is complete.
+    FlushText();
+
+    // sanitizedStyleText will hold the permitted CSS text.
+    // We use a white-listing approach, so we explicitly allow
+    // the CSS style and font-face rule types.  We also clear
+    // -moz-binding CSS properties.
+    nsAutoString sanitizedStyleText;
+    nsIContent* style = GetCurrentContent();
+    if (style) {
+      // styleText will hold the text inside the style element.
+      nsAutoString styleText;
+      nsContentUtils::GetNodeTextContent(style, PR_FALSE, styleText);
+      // Create a unichar input stream for the CSS parser.
+      nsCOMPtr<nsIUnicharInputStream> uin;
+      rv = nsSimpleUnicharStreamFactory::GetInstance()->
+        CreateInstanceFromString(styleText, getter_AddRefs(uin));
+      if (NS_SUCCEEDED(rv)) {
+        // Create a sheet to hold the parsed CSS
+        nsRefPtr<nsICSSStyleSheet> sheet;
+        rv = NS_NewCSSStyleSheet(getter_AddRefs(sheet));
+        if (NS_SUCCEEDED(rv)) {
+          nsCOMPtr<nsIURI> baseURI = style->GetBaseURI();
+          sheet->SetURIs(mTargetDocument->GetDocumentURI(), nsnull, baseURI);
+          sheet->SetPrincipal(mTargetDocument->NodePrincipal());
+          // Create the CSS parser, and parse the CSS text.
+          nsICSSLoader* cssLoader = mTargetDocument->CSSLoader();
+          nsCOMPtr<nsICSSParser> parser;
+          rv = cssLoader->GetParserFor(sheet, getter_AddRefs(parser));
+          if (NS_SUCCEEDED(rv)) {
+            rv = parser->Parse(uin, mTargetDocument->GetDocumentURI(),
+                               baseURI, mTargetDocument->NodePrincipal(),
+                               0, PR_FALSE);
+          }
+          // Mark the sheet as complete.
+          if (NS_SUCCEEDED(rv)) {
+            sheet->SetModified(PR_FALSE);
+            sheet->SetComplete();
+          }
+          if (NS_SUCCEEDED(rv)) {
+            // Loop through all the rules found in the CSS text
+            PRInt32 ruleCount = 0;
+            sheet->StyleRuleCount(ruleCount);
+            for (PRInt32 i = 0; i < ruleCount; ++i) {
+              nsRefPtr<nsICSSRule> rule;
+              rv = sheet->GetStyleRuleAt(i, *getter_AddRefs(rule));
+              if (NS_FAILED(rv))
+                continue;
+              NS_ASSERTION(rule, "We should have a rule by now");
+              PRInt32 type;
+              rv = rule->GetType(type);
+              if (NS_FAILED(rv))
+                continue;
+              switch (type) {
+                case nsICSSRule::UNKNOWN_RULE:
+                case nsICSSRule::CHARSET_RULE:
+                case nsICSSRule::IMPORT_RULE:
+                case nsICSSRule::MEDIA_RULE:
+                case nsICSSRule::PAGE_RULE:
+                  // Ignore these rule types.
+                  break;
+                case nsICSSRule::NAMESPACE_RULE:
+                case nsICSSRule::FONT_FACE_RULE: {
+                  // Append @namespace and @font-face rules verbatim.
+                  nsAutoString cssText;
+                  nsCOMPtr<nsIDOMCSSRule> styleRule = do_QueryInterface(rule);
+                  if (styleRule) {
+                    rv = styleRule->GetCssText(cssText);
+                    if (NS_SUCCEEDED(rv)) {
+                      sanitizedStyleText.Append(cssText);
+                    }
+                  }
+                  break;
+                }
+                case nsICSSRule::STYLE_RULE: {
+                  // For style rules, we will just look for and remove the
+                  // -moz-binding properties.
+                  nsCOMPtr<nsICSSStyleRule> styleRule = do_QueryInterface(rule);
+                  NS_ASSERTION(styleRule, "Must be a style rule");
+                  nsAutoString decl;
+                  SanitizeStyleRule(styleRule, decl);
+                  rv = styleRule->GetCssText(decl);
+                  // Only add the rule when sanitized.
+                  if (NS_SUCCEEDED(rv)) {
+                    sanitizedStyleText.Append(decl);
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+      // Replace the style element content with its sanitized style text
+      nsContentUtils::SetNodeTextContent(style, sanitizedStyleText, PR_TRUE);
+    }
   }
 
   return nsHTMLFragmentContentSink::CloseContainer(aTag);
 }
 
+void
+nsHTMLParanoidFragmentSink::SanitizeStyleRule(nsICSSStyleRule *aRule, nsAutoString &aRuleText)
+{
+  aRuleText.Truncate();
+  nsCSSDeclaration *style = aRule->GetDeclaration();
+  if (style) {
+    nsresult rv = style->RemoveProperty(eCSSProperty_binding);
+    if (NS_SUCCEEDED(rv)) {
+      style->ToString(aRuleText);
+    }
+  }
+}
+
 NS_IMETHODIMP
 nsHTMLParanoidFragmentSink::AddLeaf(const nsIParserNode& aNode)
 {
@@ -1162,30 +1376,18 @@
   
   nsresult rv = NS_OK;
 
-#ifndef MOZILLA_1_8_BRANCH
-  if (mSkip) {
+  // We need to explicitly skip adding leaf nodes in the paranoid sink,
+  // otherwise things like the textnode under <title> get appended to
+  // the fragment itself, and won't be popped off in CloseContainer.
+  if (mSkip || mIgnoreNextCloseHead) {
     return rv;
   }
-#endif
   
   if (aNode.GetTokenType() == eToken_start) {
     nsCOMPtr<nsIAtom> name;
     rv = NameFromNode(aNode, getter_AddRefs(name));
     NS_ENSURE_SUCCESS(rv, rv);
 
-#ifdef MOZILLA_1_8_BRANCH
-    // we have to do this on the branch for some late 90s reason
-    if (name == nsGkAtoms::script || name == nsGkAtoms::style) {
-      nsCOMPtr<nsIDTD> dtd;
-      mParser->GetDTD(getter_AddRefs(dtd));
-      NS_ENSURE_TRUE(dtd, NS_ERROR_FAILURE);
-
-      nsAutoString skippedContent;
-      PRInt32 lineNo = 0;                
-      dtd->CollectSkippedContent(nodeType, skippedContent, lineNo);
-    }
-#endif
-
     // We will process base tags, but we won't include them
     // in the output
     if (name == nsGkAtoms::base) {
@@ -1206,7 +1408,9 @@
     }
 
     if (!sAllowedTags || !sAllowedTags->GetEntry(name)) {
-      return NS_OK;
+      if (!mProcessStyle || name != nsGkAtoms::style) {
+        return NS_OK;
+      }
     }
   }
 
@@ -1216,6 +1420,8 @@
 NS_IMETHODIMP
 nsHTMLParanoidFragmentSink::AddComment(const nsIParserNode& aNode)
 {
+  if (mProcessComments)
+    return nsHTMLFragmentContentSink::AddComment(aNode);
   // no comments
   return NS_OK;
 }
--- xulrunner-1.9.0.19.orig/content/html/document/src/Makefile.in
+++ xulrunner-1.9.0.19/content/html/document/src/Makefile.in
@@ -103,6 +103,8 @@
 		-I$(srcdir)/../../content/src \
 		-I$(srcdir)/../../../../layout/style \
 		-I$(srcdir)/../../../../dom/src/base \
+		-I$(srcdir)/../../../../xpcom/io \
+		-I$(srcdir)/../../../../caps/include \
 		$(NULL)
 
 DEFINES += -D_IMPL_NS_LAYOUT
--- xulrunner-1.9.0.19.orig/content/html/document/src/nsHTMLDocument.h
+++ xulrunner-1.9.0.19/content/html/document/src/nsHTMLDocument.h
@@ -208,6 +208,7 @@
   virtual NS_HIDDEN_(void) Destroy();
 
   nsresult ChangeContentEditableCount(nsIContent *aElement, PRInt32 aChange);
+  void DeferredContentEditableCountChange(nsIContent *aElement);
 
   virtual EditingState GetEditingState()
   {
--- xulrunner-1.9.0.19.orig/content/html/document/src/nsHTMLDocument.cpp
+++ xulrunner-1.9.0.19/content/html/document/src/nsHTMLDocument.cpp
@@ -3823,15 +3823,45 @@
 
   mContentEditableCount += aChange;
 
+  class DeferredContentEditableCountChangeEvent : public nsRunnable
+  {
+  public:
+    DeferredContentEditableCountChangeEvent(nsHTMLDocument *aDoc, nsIContent *aElement)
+      : mDoc(aDoc)
+      , mElement(aElement)
+    {
+    }
+
+    NS_IMETHOD Run() {
+      if (mElement->GetOwnerDoc() == mDoc) {
+        mDoc->DeferredContentEditableCountChange(mElement);
+      }
+      return NS_OK;
+    }
+
+  private:
+    nsRefPtr<nsHTMLDocument> mDoc;
+    nsCOMPtr<nsIContent> mElement;
+  };
+
+  nsContentUtils::AddScriptRunner(
+    new DeferredContentEditableCountChangeEvent(this, aElement));
+
+  return NS_OK;
+}
+
+void
+nsHTMLDocument::DeferredContentEditableCountChange(nsIContent *aElement)
+{
   if (mParser ||
       (mUpdateNestLevel > 0 && mContentEditableCount > 0 != IsEditingOn())) {
-    return NS_OK;
+    return;
   }
 
   EditingState oldState = mEditingState;
 
   nsresult rv = EditingStateChanged();
-  NS_ENSURE_SUCCESS(rv, rv);
+  NS_ENSURE_SUCCESS(rv, );
 
   if (oldState == mEditingState && mEditingState == eContentEditable) {
     // We just changed the contentEditable state of a node, we need to reset
@@ -3840,40 +3870,37 @@
     if (node) {
       nsPIDOMWindow *window = GetWindow();
       if (!window)
-        return NS_ERROR_FAILURE;
+        return;
 
       nsIDocShell *docshell = window->GetDocShell();
       if (!docshell)
-        return NS_ERROR_FAILURE;
+        return;
 
       nsCOMPtr<nsIEditorDocShell> editorDocShell =
         do_QueryInterface(docshell, &rv);
-      NS_ENSURE_SUCCESS(rv, rv);
+      NS_ENSURE_SUCCESS(rv, );
 
       nsCOMPtr<nsIEditor> editor;
       editorDocShell->GetEditor(getter_AddRefs(editor));
       if (editor) {
         nsCOMPtr<nsIDOMRange> range;
         rv = NS_NewRange(getter_AddRefs(range));
-        NS_ENSURE_SUCCESS(rv, rv);
+        NS_ENSURE_SUCCESS(rv, );
 
         rv = range->SelectNode(node);
-        NS_ENSURE_SUCCESS(rv, rv);
+        NS_ENSURE_SUCCESS(rv, );
 
         nsCOMPtr<nsIInlineSpellChecker> spellChecker;
         rv = editor->GetInlineSpellChecker(PR_FALSE,
                                            getter_AddRefs(spellChecker));
-        NS_ENSURE_SUCCESS(rv, rv);
+        NS_ENSURE_SUCCESS(rv, );
 
         if (spellChecker) {
           rv = spellChecker->SpellCheckRange(range);
-          NS_ENSURE_SUCCESS(rv, rv);
         }
       }
     }
   }
-
-  return NS_OK;
 }
 
 static PRBool
--- xulrunner-1.9.0.19.orig/content/html/document/src/nsImageDocument.cpp
+++ xulrunner-1.9.0.19/content/html/document/src/nsImageDocument.cpp
@@ -72,6 +72,7 @@
 #include "nsIDocShell.h"
 #include "nsIContentViewer.h"
 #include "nsIMarkupDocumentViewer.h"
+#include "nsIJSContextStack.h"
 
 #define AUTOMATIC_IMAGE_RESIZING_PREF "browser.enable_automatic_image_resizing"
 
@@ -336,7 +337,20 @@
     // Break reference cycle with mImageContent, if we have one
     nsCOMPtr<nsIImageLoadingContent> imageLoader = do_QueryInterface(mImageContent);
     if (imageLoader) {
+      // Push a null JSContext on the stack so that code that
+      // nsImageLoadingContent doesn't think it's being called by JS.  See
+      // Bug 631241
+
+      nsIThreadJSContextStack* stack = nsContentUtils::ThreadJSContextStack();
+      if (stack) {
+        stack->Push(nsnull);
+      }
+
       imageLoader->RemoveObserver(this);
+
+      if (stack) {
+        stack->Pop(nsnull);
+      }
     }
 
     mImageContent = nsnull;
@@ -622,6 +636,14 @@
   nsCAutoString src;
   mDocumentURI->GetSpec(src);
 
+  // Push a null JSContext on the stack so that code that runs within
+  // the below code doesn't think it's being called by JS. See bug
+  // 604262.
+  nsIThreadJSContextStack* stack = nsContentUtils::ThreadJSContextStack();
+  if (stack) {
+    stack->Push(nsnull);
+  }
+
   NS_ConvertUTF8toUTF16 srcString(src);
   // Make sure not to start the image load from here...
   imageLoader->SetLoadingEnabled(PR_FALSE);
@@ -631,6 +653,10 @@
   body->AppendChildTo(mImageContent, PR_FALSE);
   imageLoader->SetLoadingEnabled(PR_TRUE);
 
+  if (stack) {
+    stack->Pop(nsnull);
+  }
+
   return NS_OK;
 }
 
--- xulrunner-1.9.0.19.orig/content/html/document/crashtests/631421.html
+++ xulrunner-1.9.0.19/content/html/document/crashtests/631421.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+"use strict";
+
+var f2;
+
+function newIframe()
+{
+  var f = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
+  f.setAttributeNS(null, "src", "631421.png");
+  document.body.appendChild(f);
+  return f;
+}
+
+function b1()
+{
+  void newIframe();
+  f2 = newIframe();
+  setTimeout(b2, 0);
+}
+
+function b2()
+{
+  document.body.removeChild(f2);
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="b1();"></body>
+</html>
--- xulrunner-1.9.0.19.orig/content/base/src/nsNodeUtils.cpp
+++ xulrunner-1.9.0.19/content/base/src/nsNodeUtils.cpp
@@ -237,8 +237,22 @@
 
   if (aNode->IsNodeOfType(nsINode::eELEMENT)) {
     nsIDocument* ownerDoc = aNode->GetOwnerDoc();
+    nsIContent* cont = static_cast<nsIContent*>(aNode);
     if (ownerDoc) {
-      ownerDoc->ClearBoxObjectFor(static_cast<nsIContent*>(aNode));
+      ownerDoc->ClearBoxObjectFor(cont);
+    }
+
+    NS_ASSERTION(aNode->HasFlag(NODE_FORCE_XBL_BINDINGS) ||
+                 !ownerDoc ||
+                 !ownerDoc->BindingManager() ||
+                 !ownerDoc->BindingManager()->GetBinding(cont),
+                 "Non-forced node has binding on destruction");
+
+    // if NODE_FORCE_XBL_BINDINGS is set, the node might still have a binding
+    // attached
+    if (aNode->HasFlag(NODE_FORCE_XBL_BINDINGS) &&
+        ownerDoc && ownerDoc->BindingManager()) {
+      ownerDoc->BindingManager()->ChangeDocumentFor(cont, ownerDoc, nsnull);
     }
   }
 
--- xulrunner-1.9.0.19.orig/content/base/src/nsImageLoadingContent.cpp
+++ xulrunner-1.9.0.19/content/base/src/nsImageLoadingContent.cpp
@@ -163,13 +163,15 @@
   LOOP_OVER_OBSERVERS(FrameChanged(aContainer, aFrame, aDirtyRect));
   return NS_OK;
 }
-            
+
 /*
  * imgIDecoderObserver impl
  */
 NS_IMETHODIMP
 nsImageLoadingContent::OnStartRequest(imgIRequest* aRequest)
 {
+  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);
+
   LOOP_OVER_OBSERVERS(OnStartRequest(aRequest));
   return NS_OK;
 }
@@ -177,6 +179,8 @@
 NS_IMETHODIMP
 nsImageLoadingContent::OnStartDecode(imgIRequest* aRequest)
 {
+  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);
+
   LOOP_OVER_OBSERVERS(OnStartDecode(aRequest));
   return NS_OK;
 }
@@ -185,6 +189,8 @@
 nsImageLoadingContent::OnStartContainer(imgIRequest* aRequest,
                                         imgIContainer* aContainer)
 {
+  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);
+
   LOOP_OVER_OBSERVERS(OnStartContainer(aRequest, aContainer));
 
   // Have to check for state changes here, since we might have been in
@@ -197,6 +203,8 @@
 nsImageLoadingContent::OnStartFrame(imgIRequest* aRequest,
                                     gfxIImageFrame* aFrame)
 {
+  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);
+
   LOOP_OVER_OBSERVERS(OnStartFrame(aRequest, aFrame));
   return NS_OK;    
 }
@@ -206,6 +214,8 @@
                                        gfxIImageFrame* aFrame,
                                        const nsRect* aRect)
 {
+  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);
+
   LOOP_OVER_OBSERVERS(OnDataAvailable(aRequest, aFrame, aRect));
   return NS_OK;
 }
@@ -214,6 +224,8 @@
 nsImageLoadingContent::OnStopFrame(imgIRequest* aRequest,
                                    gfxIImageFrame* aFrame)
 {
+  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);
+
   LOOP_OVER_OBSERVERS(OnStopFrame(aRequest, aFrame));
   return NS_OK;
 }
@@ -222,6 +234,8 @@
 nsImageLoadingContent::OnStopContainer(imgIRequest* aRequest,
                                        imgIContainer* aContainer)
 {
+  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);
+
   LOOP_OVER_OBSERVERS(OnStopContainer(aRequest, aContainer));
   return NS_OK;
 }
@@ -233,6 +247,9 @@
 {
   NS_PRECONDITION(aRequest == mCurrentRequest || aRequest == mPendingRequest,
                   "Unknown request");
+
+  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);
+
   LOOP_OVER_OBSERVERS(OnStopDecode(aRequest, aStatus, aStatusArg));
 
   if (aRequest == mPendingRequest) {
@@ -264,6 +281,8 @@
 NS_IMETHODIMP
 nsImageLoadingContent::OnStopRequest(imgIRequest* aRequest, PRBool aLastPart)
 {
+  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);
+
   LOOP_OVER_OBSERVERS(OnStopRequest(aRequest, aLastPart));
 
   return NS_OK;
@@ -276,6 +295,8 @@
 NS_IMETHODIMP
 nsImageLoadingContent::GetLoadingEnabled(PRBool *aLoadingEnabled)
 {
+  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);
+
   *aLoadingEnabled = mLoadingEnabled;
   return NS_OK;
 }
@@ -283,6 +304,8 @@
 NS_IMETHODIMP
 nsImageLoadingContent::SetLoadingEnabled(PRBool aLoadingEnabled)
 {
+  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);
+
   if (nsContentUtils::GetImgLoader()) {
     mLoadingEnabled = aLoadingEnabled;
   }
@@ -292,6 +315,8 @@
 NS_IMETHODIMP
 nsImageLoadingContent::GetImageBlockingStatus(PRInt16* aStatus)
 {
+  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);
+
   NS_PRECONDITION(aStatus, "Null out param");
   *aStatus = mImageBlockingStatus;
   return NS_OK;
@@ -300,6 +325,8 @@
 NS_IMETHODIMP
 nsImageLoadingContent::AddObserver(imgIDecoderObserver* aObserver)
 {
+  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);
+
   NS_ENSURE_ARG_POINTER(aObserver);
 
   if (!mObserverList.mObserver) {
@@ -326,6 +353,8 @@
 NS_IMETHODIMP
 nsImageLoadingContent::RemoveObserver(imgIDecoderObserver* aObserver)
 {
+  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);
+
   NS_ENSURE_ARG_POINTER(aObserver);
 
   if (mObserverList.mObserver == aObserver) {
@@ -383,6 +412,8 @@
 nsImageLoadingContent::GetRequestType(imgIRequest* aRequest,
                                       PRInt32* aRequestType)
 {
+  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);
+
   NS_PRECONDITION(aRequestType, "Null out param");
   
   if (aRequest == mCurrentRequest) {
@@ -419,6 +450,8 @@
 nsImageLoadingContent::LoadImageWithChannel(nsIChannel* aChannel,
                                             nsIStreamListener** aListener)
 {
+  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);
+
   NS_PRECONDITION(aListener, "null out param");
   
   NS_ENSURE_ARG_POINTER(aChannel);
@@ -456,6 +489,8 @@
 
 NS_IMETHODIMP nsImageLoadingContent::ForceReload()
 {
+  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);
+
   nsCOMPtr<nsIURI> currentURI;
   GetCurrentURI(getter_AddRefs(currentURI));
   if (!currentURI) {
--- xulrunner-1.9.0.19.orig/content/base/src/nsGenericDOMDataNode.cpp
+++ xulrunner-1.9.0.19/content/base/src/nsGenericDOMDataNode.cpp
@@ -354,8 +354,7 @@
 {
   aReturn.Truncate();
 
-  // XXX add <0 checks if types change
-  PRUint32 textLength = PRUint32( mText.GetLength() );
+  PRUint32 textLength = mText.GetLength();
   if (aStart > textLength) {
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
   }
@@ -423,6 +422,20 @@
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
   }
 
+  if (aCount > textLength - aOffset) {
+    aCount = textLength - aOffset;
+  }
+
+  PRUint32 endOffset = aOffset + aCount;
+
+  // Make sure the text fragment can hold the new data.
+  if (aLength > aCount && !mText.CanGrowBy(aLength - aCount)) {
+    // This exception isn't per spec, but the spec doesn't actually
+    // say what to do here.
+
+    return NS_ERROR_DOM_DOMSTRING_SIZE_ERR;
+  }
+
   nsIDocument *document = GetCurrentDoc();
   mozAutoDocUpdate updateBatch(document, UPDATE_CONTENT_MODEL, aNotify);
 
@@ -436,12 +449,6 @@
     oldValue = GetCurrentValueAtom();
   }
     
-  PRUint32 endOffset = aOffset + aCount;
-  if (endOffset > textLength) {
-    aCount = textLength - aOffset;
-    endOffset = textLength;
-  }
-
   if (aNotify) {
     CharacterDataChangeInfo info = {
       aOffset == textLength,
@@ -469,10 +476,10 @@
     NS_ENSURE_TRUE(to, NS_ERROR_OUT_OF_MEMORY);
 
     // Copy over appropriate data
-    if (0 != aOffset) {
+    if (aOffset) {
       mText.CopyTo(to, 0, aOffset);
     }
-    if (0 != aLength) {
+    if (aLength) {
       memcpy(to + aOffset, aBuffer, aLength * sizeof(PRUnichar));
     }
     if (endOffset != textLength) {
--- xulrunner-1.9.0.19.orig/content/base/src/nsDOMAttribute.cpp
+++ xulrunner-1.9.0.19/content/base/src/nsDOMAttribute.cpp
@@ -789,7 +789,7 @@
   aHasChild = !value.IsEmpty();
 
   if (aSetText && aHasChild) {
-    mChild->SetText(value, PR_TRUE);
+    mChild->SetText(value, PR_FALSE);
   }
 
   return NS_OK;
--- xulrunner-1.9.0.19.orig/content/base/src/nsContentUtils.cpp
+++ xulrunner-1.9.0.19/content/base/src/nsContentUtils.cpp
@@ -56,6 +56,7 @@
 #include "nsIDOMScriptObjectFactory.h"
 #include "nsDOMCID.h"
 #include "nsContentUtils.h"
+#include "nsIContentUtils.h"
 #include "nsIXPConnect.h"
 #include "nsIContent.h"
 #include "nsIDocument.h"
@@ -151,6 +152,8 @@
 #include "nsIScriptObjectPrincipal.h"
 #include "nsIRunnable.h"
 #include "nsDOMJSUtils.h"
+#include "nsIChannelEventSink.h"
+#include "nsIInterfaceRequestor.h"
 
 #ifdef IBMBIDI
 #include "nsIBidiKeyboard.h"
@@ -203,6 +206,7 @@
 PRUint32 nsContentUtils::sRemovableScriptBlockerCount = 0;
 nsCOMArray<nsIRunnable>* nsContentUtils::sBlockedScriptRunners = nsnull;
 PRUint32 nsContentUtils::sRunnersCountAtFirstBlocker = 0;
+nsIInterfaceRequestor* nsContentUtils::sSameOriginChecker = nsnull;
 
 nsIJSRuntimeService *nsAutoGCRoot::sJSRuntimeService;
 JSRuntime *nsAutoGCRoot::sJSScriptRuntime;
@@ -250,6 +254,14 @@
   lm->~EventListenerManagerMapEntry();
 }
 
+class nsSameOriginChecker : public nsIChannelEventSink,
+                            public nsIInterfaceRequestor
+{
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSICHANNELEVENTSINK
+  NS_DECL_NSIINTERFACEREQUESTOR
+};
+
 // static
 nsresult
 nsContentUtils::Init()
@@ -835,6 +847,8 @@
   delete sBlockedScriptRunners;
   sBlockedScriptRunners = nsnull;
 
+  NS_IF_RELEASE(sSameOriginChecker);
+  
   nsAutoGCRoot::Shutdown();
 }
 
@@ -1201,7 +1215,7 @@
     return NS_ERROR_NOT_AVAILABLE;
   }
 
-  return sXPConnect->ReparentScopeAwareWrappers(cx, oldScopeObj, newScopeObj);
+  return sXPConnect->MoveWrappers(cx, oldScopeObj, newScopeObj);
 }
 
 nsIDocShell *
@@ -3937,6 +3951,14 @@
   return aLoadingPrincipal->CheckMayLoad(aURIToLoad, PR_TRUE);
 }
 
+PRBool
+nsContentUtils::IsSystemPrincipal(nsIPrincipal* aPrincipal)
+{
+  PRBool isSystem;
+  nsresult rv = sSecurityManager->IsSystemPrincipal(aPrincipal, &isSystem);
+  return NS_SUCCEEDED(rv) && isSystem;
+}
+
 /* static */
 void
 nsContentUtils::TriggerLink(nsIContent *aContent, nsPresContext *aPresContext,
@@ -4264,6 +4286,21 @@
   }
 }
 
+NS_IMPL_ISUPPORTS1(nsIContentUtils, nsIContentUtils)
+
+PRBool
+nsIContentUtils::IsSafeToRunScript()
+{
+  return nsContentUtils::IsSafeToRunScript();
+}
+
+NS_IMPL_ISUPPORTS1(nsIContentUtils2, nsIContentUtils2)
+
+nsresult
+nsIContentUtils2::CheckSameOrigin(nsIChannel *aOldChannel, nsIChannel *aNewChannel)
+{
+  return nsContentUtils::CheckSameOrigin(aOldChannel, aNewChannel);
+}
 
 /* static */
 PRBool
@@ -4350,3 +4387,65 @@
     }
   }
 }
+
+/* static */
+nsIInterfaceRequestor*
+nsContentUtils::GetSameOriginChecker()
+{
+  if (!sSameOriginChecker) {
+    sSameOriginChecker = new nsSameOriginChecker();
+    NS_IF_ADDREF(sSameOriginChecker);
+  }
+  return sSameOriginChecker;
+}
+
+/* static */
+nsresult
+nsContentUtils::CheckSameOrigin(nsIChannel *aOldChannel, nsIChannel *aNewChannel)
+{
+  nsCOMPtr<nsIURI> oldURI;
+  nsresult rv = aOldChannel->GetURI(getter_AddRefs(oldURI)); // The original URI
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIURI> newURI;
+  rv = aNewChannel->GetURI(getter_AddRefs(newURI)); // The new URI
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = nsContentUtils::GetSecurityManager()->
+    CheckSameOriginURI(oldURI, newURI, PR_TRUE);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIURI> newOrigURI;
+  rv = aNewChannel->GetOriginalURI(getter_AddRefs(newOrigURI));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (newOrigURI != newURI) {
+      rv = nsContentUtils::GetSecurityManager()->
+          CheckSameOriginURI(oldURI, newOrigURI, PR_TRUE);
+      NS_ENSURE_SUCCESS(rv, rv);
+  }
+
+  return NS_OK;
+}
+
+
+NS_IMPL_ISUPPORTS2(nsSameOriginChecker,
+                   nsIChannelEventSink,
+                   nsIInterfaceRequestor)
+
+NS_IMETHODIMP
+nsSameOriginChecker::OnChannelRedirect(nsIChannel *aOldChannel,
+                                       nsIChannel *aNewChannel,
+                                       PRUint32    aFlags)
+{
+  NS_PRECONDITION(aNewChannel, "Redirecting to null channel?");
+
+  return nsContentUtils::CheckSameOrigin(aOldChannel, aNewChannel);
+}
+
+NS_IMETHODIMP
+nsSameOriginChecker::GetInterface(const nsIID & aIID, void **aResult)
+{
+  return QueryInterface(aIID, aResult);
+}
+
--- xulrunner-1.9.0.19.orig/content/base/src/nsObjectLoadingContent.cpp
+++ xulrunner-1.9.0.19/content/base/src/nsObjectLoadingContent.cpp
@@ -417,7 +417,11 @@
     // end up trying to dispatch to a nsFrameLoader, which will complain that
     // it couldn't find a way to handle application/octet-stream
 
-    chan->SetContentType(mContentType);
+    nsCAutoString typeHint, dummy;
+    NS_ParseContentType(mContentType, typeHint, dummy);
+    if (!typeHint.IsEmpty()) {
+      chan->SetContentType(typeHint);
+    }
   } else {
     mContentType = channelType;
   }
@@ -885,8 +889,9 @@
                                           nsIChannel *aNewChannel,
                                           PRUint32    aFlags)
 {
-  // If we're already busy with a new load, cancel the redirect
-  if (aOldChannel != mChannel) {
+  // If we're already busy with a new load, or have no load at all,
+  // cancel the redirect.
+  if (!mChannel || aOldChannel != mChannel) {
     return NS_BINDING_ABORTED;
   }
 
@@ -1292,7 +1297,11 @@
 
   // MIME Type hint
   if (!aTypeHint.IsEmpty()) {
-    chan->SetContentType(aTypeHint);
+    nsCAutoString typeHint, dummy;
+    NS_ParseContentType(aTypeHint, typeHint, dummy);
+    if (!typeHint.IsEmpty()) {
+      chan->SetContentType(typeHint);
+    }
   }
 
   // Set up the channel's principal and such, like nsDocShell::DoURILoad does
--- xulrunner-1.9.0.19.orig/content/base/src/nsDocument.cpp
+++ xulrunner-1.9.0.19/content/base/src/nsDocument.cpp
@@ -4253,13 +4253,9 @@
 NS_IMETHODIMP
 nsDocument::Normalize()
 {
-  PRInt32 count = mChildren.ChildCount();
-  for (PRInt32 i = 0; i < count; ++i) {
+  for (PRInt32 i = 0; i < mChildren.ChildCount(); ++i) {
     nsCOMPtr<nsIDOMNode> node(do_QueryInterface(mChildren.ChildAt(i)));
-
-    if (node) {
-      node->Normalize();
-    }
+    node->Normalize();
   }
 
   return NS_OK;
@@ -5718,11 +5714,30 @@
 }
 
 void
+nsDocument::AsyncBlockOnload()
+{
+  while (mAsyncOnloadBlockCount) {
+    --mAsyncOnloadBlockCount;
+    BlockOnload();
+  }
+}
+
+void
 nsDocument::BlockOnload()
 {
   // If mScriptGlobalObject is null, we shouldn't be messing with the loadgroup
   // -- it's not ours.
   if (mOnloadBlockCount == 0 && mScriptGlobalObject) {
+    if (!nsContentUtils::IsSafeToRunScript()) {
+      // Because AddRequest may lead to OnStateChange calls in chrome,
+      // block onload only when there are no script blockers.
+      ++mAsyncOnloadBlockCount;
+      if (mAsyncOnloadBlockCount == 1) {
+        nsContentUtils::AddScriptRunner(
+          NS_NEW_RUNNABLE_METHOD(nsDocument, this, AsyncBlockOnload));
+      }
+      return;
+    }
     nsCOMPtr<nsILoadGroup> loadGroup = GetDocumentLoadGroup();
     if (loadGroup) {
       loadGroup->AddRequest(mOnloadBlocker, nsnull);
@@ -5734,7 +5749,7 @@
 void
 nsDocument::UnblockOnload(PRBool aFireSync)
 {
-  if (mOnloadBlockCount == 0) {
+  if (mOnloadBlockCount == 0 && mAsyncOnloadBlockCount == 0) {
     NS_NOTREACHED("More UnblockOnload() calls than BlockOnload() calls; dropping call");
     return;
   }
@@ -5744,7 +5759,7 @@
   // If mScriptGlobalObject is null, we shouldn't be messing with the loadgroup
   // -- it's not ours.
   if (mOnloadBlockCount == 0 && mScriptGlobalObject) {
-    if (aFireSync) {
+    if (aFireSync && mAsyncOnloadBlockCount == 0) {
       // Increment mOnloadBlockCount, since DoUnblockOnload will decrement it
       ++mOnloadBlockCount;
       DoUnblockOnload();
@@ -5793,6 +5808,11 @@
     return;
   }
 
+  if (mAsyncOnloadBlockCount != 0) {
+    // We need to wait until the async onload block has been handled.
+    PostUnblockOnloadEvent();
+  }
+
   // If mScriptGlobalObject is null, we shouldn't be messing with the loadgroup
   // -- it's not ours.
   if (mScriptGlobalObject) {
--- xulrunner-1.9.0.19.orig/content/base/src/nsGenericElement.cpp
+++ xulrunner-1.9.0.19/content/base/src/nsGenericElement.cpp
@@ -2674,6 +2674,29 @@
                          mAttrsAndChildren);
 }
 
+static nsresult
+AdoptNodeIntoOwnerDoc(nsINode *aParent, nsIDOMNode *aNode)
+{
+  nsIDocument *doc = aParent->GetOwnerDoc();
+
+  nsresult rv;
+  nsCOMPtr<nsIDOM3Document> domDoc = do_QueryInterface(doc, &rv);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIDOMNode> adoptedNode;
+  rv = domDoc->AdoptNode(aNode, getter_AddRefs(adoptedNode));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (doc != aParent->GetOwnerDoc()) {
+    return NS_ERROR_DOM_WRONG_DOCUMENT_ERR;
+  }
+
+  NS_ASSERTION(adoptedNode == aNode, "Uh, adopt node changed nodes?");
+  NS_ASSERTION(aParent->HasSameOwnerDoc(nsCOMPtr<nsINode>(do_QueryInterface(aNode))),
+               "ownerDocument changed again after adopting!");
+
+  return NS_OK;
+}
 
 /* static */
 nsresult
@@ -2697,32 +2720,25 @@
     rv = kid->GetNodeType(&nodeType);
     NS_ENSURE_SUCCESS(rv, rv);
 
-    nsCOMPtr<nsIDOM3Document> domDoc =
-      do_QueryInterface(container->GetOwnerDoc());
-
     // DocumentType nodes are the only nodes that can have a null
     // ownerDocument according to the DOM spec, and we need to allow
     // inserting them w/o calling AdoptNode().
 
-    if (domDoc && (nodeType != nsIDOMNode::DOCUMENT_TYPE_NODE ||
-                   aKid->GetOwnerDoc())) {
-      nsCOMPtr<nsIDOMNode> adoptedKid;
-      rv = domDoc->AdoptNode(kid, getter_AddRefs(adoptedKid));
+    if (nodeType != nsIDOMNode::DOCUMENT_TYPE_NODE || aKid->GetOwnerDoc()) {
+      rv = AdoptNodeIntoOwnerDoc(container, kid);
       NS_ENSURE_SUCCESS(rv, rv);
-
-      NS_ASSERTION(adoptedKid == kid, "Uh, adopt node changed nodes?");
     }
   }
 
-  PRUint32 childCount = aChildArray.ChildCount();
-  NS_ENSURE_TRUE(aIndex <= childCount, NS_ERROR_ILLEGAL_VALUE);
-
   nsMutationGuard::DidMutate();
 
-  PRBool isAppend = (aIndex == childCount);
-
+  // Do this before checking the child-count since this could cause mutations
   mozAutoDocUpdate updateBatch(aDocument, UPDATE_CONTENT_MODEL, aNotify);
 
+  PRUint32 childCount = aChildArray.ChildCount();
+  NS_ENSURE_TRUE(aIndex <= childCount, NS_ERROR_ILLEGAL_VALUE);
+  PRBool isAppend = (aIndex == childCount);
+
   rv = aChildArray.InsertChildAt(aKid, aIndex);
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -3226,27 +3242,32 @@
     return NS_ERROR_DOM_HIERARCHY_REQUEST_ERR;
   }
 
+  nsMutationGuard guard;
+
   // DocumentType nodes are the only nodes that can have a null
   // ownerDocument according to the DOM spec, and we need to allow
   // inserting them w/o calling AdoptNode().
   if (!container->HasSameOwnerDoc(newContent) &&
       (nodeType != nsIDOMNode::DOCUMENT_TYPE_NODE ||
        newContent->GetOwnerDoc())) {
-    nsCOMPtr<nsIDOM3Document> domDoc = do_QueryInterface(aDocument);
-
-    if (domDoc) {
-      nsCOMPtr<nsIDOMNode> adoptedKid;
-      nsresult rv = domDoc->AdoptNode(aNewChild, getter_AddRefs(adoptedKid));
-      NS_ENSURE_SUCCESS(rv, rv);
+    res = AdoptNodeIntoOwnerDoc(container, aNewChild);
+    NS_ENSURE_SUCCESS(res, res);
+  }
+  
+  if (guard.Mutated(0)) {
+    insPos = refContent ? container->IndexOf(refContent) :
+                          container->GetChildCount();
+    if (insPos < 0) {
+      return NS_ERROR_DOM_NOT_FOUND_ERR;
+    }
 
-      NS_ASSERTION(adoptedKid == aNewChild, "Uh, adopt node changed nodes?");
+    if (!IsAllowedAsChild(newContent, nodeType, aParent, aDocument, aReplace,
+                          refContent)) {
+      return NS_ERROR_DOM_HIERARCHY_REQUEST_ERR;
     }
   }
 
-  // We want an update batch when we expect several mutations to be performed,
-  // which is when we're replacing a node, or when we're inserting a fragment.
-  mozAutoDocConditionalContentUpdateBatch(aDocument,
-    aReplace || nodeType == nsIDOMNode::DOCUMENT_FRAGMENT_NODE);
+  mozAutoDocConditionalContentUpdateBatch batch(aDocument, PR_TRUE);
 
   // If we're replacing
   if (aReplace) {
@@ -3341,6 +3362,10 @@
 
       nsMutationGuard guard;
 
+      if (!container->HasSameOwnerDoc(childContent)) {
+        return NS_ERROR_DOM_HIERARCHY_REQUEST_ERR;
+      }
+
       // XXXbz how come no reparenting here?  That seems odd...
       // Insert the child.
       res = container->InsertChildAt(childContent, insPos, PR_TRUE);
@@ -3398,6 +3423,12 @@
       }
     }
 
+    if (!container->HasSameOwnerDoc(newContent) &&
+        (nodeType != nsIDOMNode::DOCUMENT_TYPE_NODE ||
+         newContent->GetOwnerDoc())) {
+      return NS_ERROR_DOM_HIERARCHY_REQUEST_ERR;
+    }
+
     if (!newContent->IsNodeOfType(eXUL)) {
       nsContentUtils::ReparentContentWrapper(newContent, aParent,
                                              container->GetOwnerDoc(),
--- xulrunner-1.9.0.19.orig/content/base/src/nsContentSink.cpp
+++ xulrunner-1.9.0.19/content/base/src/nsContentSink.cpp
@@ -1529,20 +1529,26 @@
   &nsGkAtoms::acronym,
   &nsGkAtoms::address,
   &nsGkAtoms::area,
+  &nsGkAtoms::article,
+  &nsGkAtoms::aside,
   &nsGkAtoms::b,
   &nsGkAtoms::bdo,
   &nsGkAtoms::big,
   &nsGkAtoms::blockquote,
   &nsGkAtoms::br,
   &nsGkAtoms::button,
+  &nsGkAtoms::canvas,
   &nsGkAtoms::caption,
   &nsGkAtoms::center,
   &nsGkAtoms::cite,
   &nsGkAtoms::code,
   &nsGkAtoms::col,
   &nsGkAtoms::colgroup,
+  &nsGkAtoms::command,
+  &nsGkAtoms::datalist,
   &nsGkAtoms::dd,
   &nsGkAtoms::del,
+  &nsGkAtoms::details,
   &nsGkAtoms::dfn,
   &nsGkAtoms::dir,
   &nsGkAtoms::div,
@@ -1550,7 +1556,10 @@
   &nsGkAtoms::dt,
   &nsGkAtoms::em,
   &nsGkAtoms::fieldset,
+  &nsGkAtoms::figcaption,
+  &nsGkAtoms::figure,
   &nsGkAtoms::font,
+  &nsGkAtoms::footer,
   &nsGkAtoms::form,
   &nsGkAtoms::h1,
   &nsGkAtoms::h2,
@@ -1558,6 +1567,8 @@
   &nsGkAtoms::h4,
   &nsGkAtoms::h5,
   &nsGkAtoms::h6,
+  &nsGkAtoms::header,
+  &nsGkAtoms::hgroup,
   &nsGkAtoms::hr,
   &nsGkAtoms::i,
   &nsGkAtoms::img,
@@ -1569,22 +1580,32 @@
   &nsGkAtoms::li,
   &nsGkAtoms::listing,
   &nsGkAtoms::map,
+  &nsGkAtoms::mark,
   &nsGkAtoms::menu,
+  &nsGkAtoms::meter,
+  &nsGkAtoms::nav,
   &nsGkAtoms::nobr,
+  &nsGkAtoms::noscript,
   &nsGkAtoms::ol,
   &nsGkAtoms::optgroup,
   &nsGkAtoms::option,
+  &nsGkAtoms::output,
   &nsGkAtoms::p,
   &nsGkAtoms::pre,
   &nsGkAtoms::q,
+  &nsGkAtoms::rp,
+  &nsGkAtoms::rt,
+  &nsGkAtoms::ruby,
   &nsGkAtoms::s,
   &nsGkAtoms::samp,
+  &nsGkAtoms::section,
   &nsGkAtoms::select,
   &nsGkAtoms::small,
   &nsGkAtoms::span,
   &nsGkAtoms::strike,
   &nsGkAtoms::strong,
   &nsGkAtoms::sub,
+  &nsGkAtoms::summary,
   &nsGkAtoms::sup,
   &nsGkAtoms::table,
   &nsGkAtoms::tbody,
@@ -1593,11 +1614,14 @@
   &nsGkAtoms::tfoot,
   &nsGkAtoms::th,
   &nsGkAtoms::thead,
+  &nsGkAtoms::time,
   &nsGkAtoms::tr,
+  &nsGkAtoms::track,
   &nsGkAtoms::tt,
   &nsGkAtoms::u,
   &nsGkAtoms::ul,
   &nsGkAtoms::var,
+  &nsGkAtoms::wbr,
   nsnull
 };
 
@@ -1610,6 +1634,7 @@
   &nsGkAtoms::align,
   &nsGkAtoms::alt,
   &nsGkAtoms::autocomplete,
+  &nsGkAtoms::autofocus,
   &nsGkAtoms::axis,
   &nsGkAtoms::background,
   &nsGkAtoms::bgcolor,
@@ -1627,46 +1652,74 @@
   &nsGkAtoms::colspan,
   &nsGkAtoms::color,
   &nsGkAtoms::compact,
+  &nsGkAtoms::contenteditable,
+  &nsGkAtoms::contextmenu,
   &nsGkAtoms::coords,
   &nsGkAtoms::datetime,
   &nsGkAtoms::dir,
   &nsGkAtoms::disabled,
   &nsGkAtoms::enctype,
+  &nsGkAtoms::face,
   &nsGkAtoms::_for,
   &nsGkAtoms::frame,
   &nsGkAtoms::headers,
   &nsGkAtoms::height,
+  &nsGkAtoms::hidden,
+  &nsGkAtoms::high,
   &nsGkAtoms::href,
   &nsGkAtoms::hreflang,
   &nsGkAtoms::hspace,
+  &nsGkAtoms::icon,
   &nsGkAtoms::id,
   &nsGkAtoms::ismap,
+  &nsGkAtoms::itemid,
+  &nsGkAtoms::itemprop,
+  &nsGkAtoms::itemref,
+  &nsGkAtoms::itemscope,
+  &nsGkAtoms::itemtype,
+  &nsGkAtoms::kind,
   &nsGkAtoms::label,
   &nsGkAtoms::lang,
+  &nsGkAtoms::list,
   &nsGkAtoms::longdesc,
   &nsGkAtoms::maxlength,
+  &nsGkAtoms::low,
+  &nsGkAtoms::max,
   &nsGkAtoms::media,
+  &nsGkAtoms::min,
   &nsGkAtoms::method,
   &nsGkAtoms::multiple,
   &nsGkAtoms::name,
   &nsGkAtoms::nohref,
   &nsGkAtoms::noshade,
+  &nsGkAtoms::novalidate,
   &nsGkAtoms::nowrap,
+  &nsGkAtoms::open,
+  &nsGkAtoms::optimum,
+  &nsGkAtoms::pattern,
+  &nsGkAtoms::placeholder,
   &nsGkAtoms::pointSize,
   &nsGkAtoms::prompt,
+  &nsGkAtoms::pubdate,
+  &nsGkAtoms::radiogroup,
   &nsGkAtoms::readonly,
   &nsGkAtoms::rel,
+  &nsGkAtoms::required,
   &nsGkAtoms::rev,
+  &nsGkAtoms::reversed,
   &nsGkAtoms::role,
   &nsGkAtoms::rows,
   &nsGkAtoms::rowspan,
   &nsGkAtoms::rules,
   &nsGkAtoms::scope,
+  &nsGkAtoms::scoped,
   &nsGkAtoms::selected,
   &nsGkAtoms::shape,
   &nsGkAtoms::size,
   &nsGkAtoms::span,
+  &nsGkAtoms::spellcheck,
   &nsGkAtoms::src,
+  &nsGkAtoms::srclang,
   &nsGkAtoms::start,
   &nsGkAtoms::summary,
   &nsGkAtoms::tabindex,
@@ -1678,5 +1731,6 @@
   &nsGkAtoms::value,
   &nsGkAtoms::vspace,
   &nsGkAtoms::width,
+  &nsGkAtoms::wrap,
   nsnull
 };
--- xulrunner-1.9.0.19.orig/content/base/src/nsTextFragment.h
+++ xulrunner-1.9.0.19/content/base/src/nsTextFragment.h
@@ -144,6 +144,11 @@
     return mState.mLength;
   }
 
+  PRBool CanGrowBy(size_t n) const
+  {
+    return n < (1 << 29) && mState.mLength + n < (1 << 29);
+  }
+
   /**
    * Change the contents of this fragment to be a copy of the given
    * buffer.
--- xulrunner-1.9.0.19.orig/content/base/src/nsDocument.h
+++ xulrunner-1.9.0.19/content/base/src/nsDocument.h
@@ -676,6 +676,9 @@
 
   virtual nsISupports* GetCurrentContentSink();
 
+  // Only BlockOnload should call this!
+  void AsyncBlockOnload();
+
 protected:
 
   /**
@@ -860,7 +863,10 @@
   // 2)  We haven't had Destroy() called on us yet.
   nsCOMPtr<nsILayoutHistoryState> mLayoutHistoryState;
 
+  // Currently active onload blockers
   PRUint32 mOnloadBlockCount;
+  // Onload blockers which haven't been activated yet
+  PRUint32 mAsyncOnloadBlockCount;
   nsCOMPtr<nsIRequest> mOnloadBlocker;
   
   // A map from unvisited URI hashes to content elements
--- xulrunner-1.9.0.19.orig/content/base/src/nsGkAtomList.h
+++ xulrunner-1.9.0.19/content/base/src/nsGkAtomList.h
@@ -103,6 +103,8 @@
 GK_ATOM(applyTemplates, "apply-templates")
 GK_ATOM(archive, "archive")
 GK_ATOM(area, "area")
+GK_ATOM(article, "article")
+GK_ATOM(aside, "aside")
 GK_ATOM(ascending, "ascending")
 GK_ATOM(assign, "assign")
 GK_ATOM(attribute, "attribute")
@@ -111,6 +113,7 @@
 GK_ATOM(_auto, "auto")
 GK_ATOM(autocheck, "autocheck")
 GK_ATOM(autocomplete, "autocomplete")
+GK_ATOM(autofocus, "autofocus")
 GK_ATOM(autorepeatbutton, "autorepeatbutton")
 GK_ATOM(axis, "axis")
 GK_ATOM(b, "b")
@@ -236,6 +239,7 @@
 GK_ATOM(current, "current")
 GK_ATOM(cycler, "cycler")
 GK_ATOM(data, "data")
+GK_ATOM(datalist, "datalist")
 GK_ATOM(dataType, "data-type")
 GK_ATOM(datasources, "datasources")
 GK_ATOM(datetime, "datetime")
@@ -261,6 +265,7 @@
 GK_ATOM(descending, "descending")
 GK_ATOM(description, "description")
 GK_ATOM(destructor, "destructor")
+GK_ATOM(details, "details")
 GK_ATOM(dfn, "dfn")
 GK_ATOM(dialog, "dialog")
 GK_ATOM(difference, "difference")
@@ -332,6 +337,8 @@
 GK_ATOM(farthest, "farthest")
 GK_ATOM(field, "field")
 GK_ATOM(fieldset, "fieldset")
+GK_ATOM(figcaption, "figcaption")
+GK_ATOM(figure, "figure")
 GK_ATOM(fixed, "fixed")
 GK_ATOM(fixedList, "Fixed-list")
 GK_ATOM(flags, "flags")
@@ -345,6 +352,7 @@
 GK_ATOM(font, "font")
 GK_ATOM(fontWeight, "font-weight")
 GK_ATOM(fontpicker, "fontpicker")
+GK_ATOM(footer, "footer")
 GK_ATOM(_for, "for")
 GK_ATOM(forEach, "for-each")
 GK_ATOM(form, "form")
@@ -378,10 +386,13 @@
 GK_ATOM(hasSameNode, "has-same-node")
 GK_ATOM(hbox, "hbox")
 GK_ATOM(head, "head")
+GK_ATOM(header, "header")
 GK_ATOM(headers, "headers")
 GK_ATOM(height, "height")
+GK_ATOM(hgroup, "hgroup")
 GK_ATOM(hidden, "hidden")
 GK_ATOM(hidechrome, "hidechrome")
+GK_ATOM(high, "high")
 GK_ATOM(highest, "highest")
 GK_ATOM(horizontal, "horizontal")
 GK_ATOM(hover, "hover")
@@ -394,6 +405,7 @@
 GK_ATOM(htmlBaseTarget, "html-base-target")
 GK_ATOM(httpEquiv, "http-equiv")
 GK_ATOM(i, "i")
+GK_ATOM(icon, "icon")
 GK_ATOM(id, "id")
 GK_ATOM(_if, "if")
 GK_ATOM(iframe, "iframe")
@@ -430,6 +442,11 @@
 GK_ATOM(isempty, "isempty")
 GK_ATOM(isindex, "isindex")
 GK_ATOM(ismap, "ismap")
+GK_ATOM(itemid, "itemid")
+GK_ATOM(itemprop, "itemprop")
+GK_ATOM(itemref, "itemref")
+GK_ATOM(itemscope, "itemscope")
+GK_ATOM(itemtype, "itemtype")
 GK_ATOM(kbd, "kbd")
 GK_ATOM(noautofocus, "noautofocus")
 GK_ATOM(key, "key")
@@ -439,6 +456,7 @@
 GK_ATOM(keyset, "keyset")
 GK_ATOM(keytext, "keytext")
 GK_ATOM(keyup, "keyup")
+GK_ATOM(kind, "kind")
 GK_ATOM(label, "label")
 GK_ATOM(lang, "lang")
 GK_ATOM(last, "last")
@@ -456,6 +474,7 @@
 GK_ATOM(li, "li")
 GK_ATOM(line, "line")
 GK_ATOM(link, "link")
+GK_ATOM(list, "list")
 GK_ATOM(listbox, "listbox")
 GK_ATOM(listboxbody, "listboxbody")
 GK_ATOM(listcell, "listcell")
@@ -470,6 +489,7 @@
 GK_ATOM(load, "load")
 GK_ATOM(localName, "local-name")
 GK_ATOM(longdesc, "longdesc")
+GK_ATOM(low, "low")
 GK_ATOM(lowerFirst, "lower-first")
 GK_ATOM(lowest, "lowest")
 GK_ATOM(lowsrc, "lowsrc")
@@ -478,6 +498,7 @@
 GK_ATOM(manifest, "manifest")
 GK_ATOM(marginheight, "marginheight")
 GK_ATOM(marginwidth, "marginwidth")
+GK_ATOM(mark, "mark")
 GK_ATOM(marquee, "marquee")
 GK_ATOM(match, "match")
 GK_ATOM(max, "max")
@@ -498,6 +519,7 @@
 GK_ATOM(menupopup, "menupopup")
 GK_ATOM(message, "message")
 GK_ATOM(meta, "meta")
+GK_ATOM(meter, "meter")
 GK_ATOM(method, "method")
 GK_ATOM(middle, "middle")
 GK_ATOM(min, "min")
@@ -522,6 +544,7 @@
 GK_ATOM(namespaceAlias, "namespace-alias")
 GK_ATOM(namespaceUri, "namespace-uri")
 GK_ATOM(NaN, "NaN")
+GK_ATOM(nav, "nav")
 GK_ATOM(negate, "negate")
 GK_ATOM(never, "never")
 GK_ATOM(_new, "new")
@@ -541,6 +564,7 @@
 GK_ATOM(noscript, "noscript")
 GK_ATOM(noshade, "noshade")
 GK_ATOM(_not, "not")
+GK_ATOM(novalidate, "novalidate")
 GK_ATOM(nowrap, "nowrap")
 GK_ATOM(number, "number")
 GK_ATOM(null, "null")
@@ -629,6 +653,7 @@
 GK_ATOM(onunload, "onunload")
 GK_ATOM(open, "open")
 GK_ATOM(optgroup, "optgroup")
+GK_ATOM(optimum, "optimum")
 GK_ATOM(option, "option")
 GK_ATOM(_or, "or")
 GK_ATOM(order, "order")
@@ -662,6 +687,7 @@
 GK_ATOM(phase, "phase")
 GK_ATOM(ping, "ping")
 GK_ATOM(plaintext, "plaintext")
+GK_ATOM(placeholder, "placeholder")
 GK_ATOM(pointSize, "point-size")
 GK_ATOM(poly, "poly")
 GK_ATOM(polygon, "polygon")
@@ -698,6 +724,7 @@
 GK_ATOM(propagate, "propagate")
 GK_ATOM(properties, "properties")
 GK_ATOM(property, "property")
+GK_ATOM(pubdate, "pubdate")
 GK_ATOM(q, "q")
 GK_ATOM(query, "query")
 GK_ATOM(queryset, "queryset")
@@ -711,6 +738,7 @@
 GK_ATOM(refresh, "refresh")
 GK_ATOM(rel, "rel")
 GK_ATOM(removeelement, "removeelement")
+GK_ATOM(required, "required")
 GK_ATOM(repeat, "repeat")
 GK_ATOM(replace, "replace")
 GK_ATOM(reset, "reset")
@@ -723,6 +751,7 @@
 GK_ATOM(resultPrefix, "result-prefix")
 GK_ATOM(rev, "rev")
 GK_ATOM(reverse, "reverse")
+GK_ATOM(reversed, "reversed")
 GK_ATOM(right, "right")
 GK_ATOM(rightmargin, "rightmargin")
 GK_ATOM(rightpadding, "rightpadding")
@@ -731,13 +760,17 @@
 GK_ATOM(row, "row")
 GK_ATOM(rows, "rows")
 GK_ATOM(rowspan, "rowspan")
+GK_ATOM(rp, "rp")
+GK_ATOM(rt, "rt")
 GK_ATOM(rtl, "rtl")
+GK_ATOM(ruby, "ruby")
 GK_ATOM(rule, "rule")
 GK_ATOM(rules, "rules")
 GK_ATOM(s, "s")
 GK_ATOM(samp, "samp")
 GK_ATOM(scheme, "scheme")
 GK_ATOM(scope, "scope")
+GK_ATOM(scoped, "scoped")
 GK_ATOM(screen, "screen")
 GK_ATOM(screenX, "screenX")
 GK_ATOM(screenY, "screenY")
@@ -748,6 +781,7 @@
 GK_ATOM(scrollbox, "scrollbox")
 GK_ATOM(scrollcorner, "scrollcorner")
 GK_ATOM(scrolling, "scrolling")
+GK_ATOM(section, "section")
 GK_ATOM(select, "select")
 GK_ATOM(selectPopupList, "selectPopupList")
 GK_ATOM(selectable, "selectable")
@@ -788,6 +822,7 @@
 GK_ATOM(splitter, "splitter")
 GK_ATOM(spring, "spring")
 GK_ATOM(src, "src")
+GK_ATOM(srclang, "srclang")
 GK_ATOM(stack, "stack")
 GK_ATOM(standalone, "standalone")
 GK_ATOM(standby, "standby")
@@ -842,6 +877,7 @@
 GK_ATOM(th, "th")
 GK_ATOM(thead, "thead")
 GK_ATOM(thumb, "thumb")
+GK_ATOM(time, "time")
 GK_ATOM(title, "title")
 GK_ATOM(titlebar, "titlebar")
 GK_ATOM(titletip, "titletip")
@@ -858,6 +894,7 @@
 GK_ATOM(topmargin, "topmargin")
 GK_ATOM(toppadding, "toppadding")
 GK_ATOM(tr, "tr")
+GK_ATOM(track, "track")
 GK_ATOM(trailing, "trailing")
 GK_ATOM(transform, "transform")
 GK_ATOM(transformiix, "transformiix")
--- xulrunner-1.9.0.19.orig/content/base/test/test_bug626262.html
+++ xulrunner-1.9.0.19/content/base/test/test_bug626262.html
@@ -0,0 +1,55 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=626262
+-->
+<head>
+  <title>Test for Bug 626262</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=626262">Mozilla Bug 626262</a>
+<p id="display"><iframe id="f" src="data:text/html,1"></iframe></p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 626262 **/
+SimpleTest.waitForExplicitFinish();
+
+addLoadEvent(function() {
+  var iframe = document.getElementById("f");
+  var frameDoc = iframe.contentDocument;
+  var parent = frameDoc.createElementNS("http://www.w3.org/1999/xhtml", "div");
+
+  function a()
+  {
+    window.removeEventListener("DOMNodeRemoved", arguments.callee, false);
+    document.adoptNode(parent);
+  }
+
+  var text = document.createTextNode(" ");
+  document.documentElement.appendChild(text);
+
+  var thrown = false;
+  try {
+    window.addEventListener("DOMNodeRemoved", a, false);
+    parent.appendChild(text);
+  }
+  catch (e) {
+    thrown = true;
+  }
+
+  ok(thrown, "changing ownerDocument during adoptNode should throw");
+
+  SimpleTest.finish();
+});
+
+</script>
+</pre>
+</body>
+</html>
--- xulrunner-1.9.0.19.orig/content/base/test/Makefile.in
+++ xulrunner-1.9.0.19/content/base/test/Makefile.in
@@ -201,6 +201,7 @@
 		file_XHRDocURI.xml^headers^ \
 		file_XHRDocURI.text \
 		file_XHRDocURI.text^headers^ \
+		test_bug626262.html \
 	$(NULL)
 
 libs:: $(_TEST_FILES)
--- xulrunner-1.9.0.19.orig/content/base/test/test_bug461735.html
+++ xulrunner-1.9.0.19/content/base/test/test_bug461735.html
@@ -17,21 +17,31 @@
 </div>
 <pre id="test">
 <script type="application/javascript">
+var errorFired = false;
 window.onerror = function(message, uri, line) {
   is(message, "Script error.", "Should have empty error message");
-  is(uri, "http://example.com/tests/content/base/test/bug461735-post-redirect.js", "Unexpected error location URI");
+  is(uri, "", "Should have empty error location URI");
   is(line, 0, "Shouldn't have a line here");
+  errorFired = true;
 }
 </script>
 <script src="bug461735-redirect1.sjs"></script>
+<script>
+  is(errorFired, true, "Should have error in redirected different origin script");
+  errorFired = false;
+</script>
 <script type="application/javascript">
 window.onerror = function(message, uri, line) {
   is(message, "c is not defined", "Should have correct error message");
   is(uri, "http://localhost:8888/tests/content/base/test/bug461735-post-redirect.js", "Unexpected error location URI");
   is(line, 3, "Should have a line here");
+  errorFired = true;
 }
 </script>
 <script src="bug461735-redirect2.sjs"></script>
+<script>
+  is(errorFired, true, "Should have error in same origin script");
+</script>
 </pre>
 </body>
 </html>
--- xulrunner-1.9.0.19.orig/content/base/public/Makefile.in
+++ xulrunner-1.9.0.19/content/base/public/Makefile.in
@@ -53,6 +53,7 @@
 nsContentErrors.h \
 nsContentPolicyUtils.h \
 nsContentUtils.h \
+nsIContentUtils.h \
 nsIDocument.h \
 nsIDocumentObserver.h \
 nsIMutationObserver.h \
--- xulrunner-1.9.0.19.orig/content/base/public/nsContentUtils.h
+++ xulrunner-1.9.0.19/content/base/public/nsContentUtils.h
@@ -95,6 +95,7 @@
 class nsIEventListenerManager;
 class nsIScriptContext;
 class nsIRunnable;
+class nsIInterfaceRequestor;
 template<class E> class nsCOMArray;
 class nsIPref;
 class nsVoidArray;
@@ -109,6 +110,7 @@
 #ifdef IBMBIDI
 class nsIBidiKeyboard;
 #endif
+class nsIChannel;
 
 extern const char kLoadAsData[];
 
@@ -1134,6 +1136,11 @@
                                           nsISupports* aExtra = nsnull);
 
   /**
+   * Returns true if aPrincipal is the system principal.
+   */
+  static PRBool IsSystemPrincipal(nsIPrincipal* aPrincipal);
+
+  /**
    * Trigger a link with uri aLinkURI. If aClick is false, this triggers a
    * mouseover on the link, otherwise it triggers a load after doing a
    * security check using aContent's principal.
@@ -1280,6 +1287,15 @@
     return sRemovableScriptBlockerCount;
   }
 
+
+  // Returns NS_OK for same origin, error (NS_ERROR_DOM_BAD_URI) if not.
+  static nsresult CheckSameOrigin(nsIChannel *aOldChannel, nsIChannel *aNewChannel);
+  static nsIInterfaceRequestor* GetSameOriginChecker();
+
+  static nsIThreadJSContextStack* ThreadJSContextStack()
+  {
+    return sThreadJSContextStack;
+  }
 private:
 
   static PRBool InitializeEventTable();
@@ -1356,6 +1372,8 @@
   static PRUint32 sRemovableScriptBlockerCount;
   static nsCOMArray<nsIRunnable>* sBlockedScriptRunners;
   static PRUint32 sRunnersCountAtFirstBlocker;
+
+  static nsIInterfaceRequestor* sSameOriginChecker;
 };
 
 #define NS_HOLD_JS_OBJECTS(obj, clazz)                                         \
--- xulrunner-1.9.0.19.orig/content/base/public/nsIContentUtils.h
+++ xulrunner-1.9.0.19/content/base/public/nsIContentUtils.h
@@ -0,0 +1,75 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+#ifndef nsIContentUtils_h__
+#define nsIContentUtils_h__
+
+class nsIChannel;
+
+// C4EA618E-A3D9-4524-8EEA-E92F26FC44DB
+#define NS_ICONTENTUTILS_IID \
+{ 0xC4EA618E, 0xA3D9, 0x4524, \
+  { 0x8E, 0xEA, 0xE9, 0x2F, 0x26, 0xFC, 0x44, 0xDB } }
+
+class nsIContentUtils : public nsISupports
+{
+public:
+    NS_DECLARE_STATIC_IID_ACCESSOR(NS_ICONTENTUTILS_IID)
+    NS_DECL_ISUPPORTS
+
+    virtual PRBool IsSafeToRunScript();
+};
+
+NS_DEFINE_STATIC_IID_ACCESSOR(nsIContentUtils, NS_ICONTENTUTILS_IID)
+
+// {fbff0101-84ad-49f0-aea0-97ee4863bf55}
+#define NS_ICONTENTUTILS2_IID \
+{ 0xfbff0101, 0x84ad, 0x49f0, \
+{ 0xae, 0xa0, 0x97, 0xee, 0x48, 0x63, 0xbf, 0x55 } }
+
+class nsIContentUtils2 : public nsISupports
+{
+public:
+  NS_DECLARE_STATIC_IID_ACCESSOR(NS_ICONTENTUTILS2_IID)
+  NS_DECL_ISUPPORTS
+
+  // Returns NS_OK for same origin, error (NS_ERROR_DOM_BAD_URI) if not.
+  virtual nsresult CheckSameOrigin(nsIChannel *aOldChannel, nsIChannel *aNewChannel);
+};
+
+NS_DEFINE_STATIC_IID_ACCESSOR(nsIContentUtils2, NS_ICONTENTUTILS2_IID)
+
+#endif /* nsIContentUtils_h__ */
--- xulrunner-1.9.0.19.orig/content/base/public/nsIContentPolicy.idl
+++ xulrunner-1.9.0.19/content/base/public/nsIContentPolicy.idl
@@ -112,7 +112,7 @@
   const unsigned long TYPE_PING        = 10;
 
   /**
-   * Indicates an XMLHttpRequest.
+   * Indicates an XMLHttpRequest. Also used for document.load.
    */
   const unsigned long TYPE_XMLHTTPREQUEST = 11;
 
--- xulrunner-1.9.0.19.orig/content/base/public/nsContentCID.h
+++ xulrunner-1.9.0.19/content/base/public/nsContentCID.h
@@ -219,6 +219,10 @@
 #define NS_HTMLPARANOIDFRAGMENTSINK_CID \
 { 0xa47e9526, 0x6e48, 0x4574, { 0x9d, 0x6c, 0x31, 0x64, 0xe2, 0x71, 0xf7, 0x4e } }
 
+// {A47EF526-6E48-4574-9D60-3164E271F75E}
+#define NS_HTMLPARANOIDFRAGMENTSINK2_CID \
+{ 0xa47ef526, 0x6e48, 0x4574, { 0x9d, 0x60, 0x31, 0x64, 0xe2, 0x71, 0xf7, 0x5e } }
+
 // {4B664E54-72A2-4bbf-A5C2-66D4DC3066A0}
 #define NS_XMLFRAGMENTSINK_CID \
 { 0x4b664e54, 0x72a2, 0x4bbf, { 0xa5, 0xc2, 0x66, 0xd4, 0xdc, 0x30, 0x66, 0xa0 } }
@@ -231,6 +235,10 @@
 #define NS_XHTMLPARANOIDFRAGMENTSINK_CID  \
 { 0x2d78bbf0, 0xe26c, 0x482b, { 0x92, 0xb3, 0x78, 0xa7, 0xb2, 0xaf, 0xc8, 0xf7} }
 
+// {AD78BBF0-E261-482B-32B3-78A7B2AFC8F7}
+#define NS_XHTMLPARANOIDFRAGMENTSINK2_CID  \
+{ 0xad78bbf0, 0xe261, 0x482b, { 0x32, 0xb3, 0x78, 0xa7, 0xb2, 0xaf, 0xc8, 0xf7} }
+
 // {3986B301-097C-11d3-BF87-00105A1B0627}
 #define NS_XULPOPUPLISTENER_CID \
 { 0x3986b301, 0x97c, 0x11d3, { 0xbf, 0x87, 0x0, 0x10, 0x5a, 0x1b, 0x6, 0x27 } }
--- xulrunner-1.9.0.19.orig/content/xslt/src/xslt/txNodeSorter.cpp
+++ xulrunner-1.9.0.19/content/xslt/src/xslt/txNodeSorter.cpp
@@ -178,7 +178,15 @@
 
     // Create and set up memoryblock for sort-values and indexarray
     PRUint32 len = static_cast<PRUint32>(aNodes->size());
-    void* mem = PR_Malloc(len * (sizeof(PRUint32) + mNKeys * sizeof(TxObject*)));
+
+    // Don't overflow when calculating the length of the sort buffer.
+    PRUint32 itemSize = sizeof(PRUint32) + mNKeys * sizeof(TxObject*);
+    if (mNKeys > (PR_UINT32_MAX - sizeof(PRUint32)) / sizeof(TxObject*) ||
+        len >= PR_UINT32_MAX / itemSize) {
+        return NS_ERROR_OUT_OF_MEMORY;
+    }
+
+    void* mem = PR_Malloc(len * itemSize);
     NS_ENSURE_TRUE(mem, NS_ERROR_OUT_OF_MEMORY);
 
     PRUint32* indexes = static_cast<PRUint32*>(mem);
--- xulrunner-1.9.0.19.orig/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp
+++ xulrunner-1.9.0.19/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp
@@ -677,10 +677,12 @@
                                          mObserver);
     es.mOutputHandlerFactory = &handlerFactory;
 
-    es.init(*sourceNode, &mVariables);
+    nsresult rv = es.init(*sourceNode, &mVariables);
 
     // Process root of XML source document
-    nsresult rv = txXSLTProcessor::execute(es);
+    if (NS_SUCCEEDED(rv)) {
+        rv = txXSLTProcessor::execute(es);
+    }
     
     nsresult endRv = es.end(rv);
     if (NS_SUCCEEDED(rv)) {
@@ -734,10 +736,12 @@
     txToFragmentHandlerFactory handlerFactory(*aResult);
     es.mOutputHandlerFactory = &handlerFactory;
 
-    es.init(*sourceNode, &mVariables);
+    rv = es.init(*sourceNode, &mVariables);
 
     // Process root of XML source document
-    rv = txXSLTProcessor::execute(es);
+    if (NS_SUCCEEDED(rv)) {
+        rv = txXSLTProcessor::execute(es);
+    }
     // XXX setup exception context, bug 204658
     nsresult endRv = es.end(rv);
     if (NS_SUCCEEDED(rv)) {
--- xulrunner-1.9.0.19.orig/content/xslt/src/xslt/txExecutionState.cpp
+++ xulrunner-1.9.0.19/content/xslt/src/xslt/txExecutionState.cpp
@@ -86,13 +86,12 @@
 
 txExecutionState::txExecutionState(txStylesheet* aStylesheet,
                                    PRBool aDisableLoads)
-    : mStylesheet(aStylesheet),
+    : mOutputHandler(nsnull),
+      mResultHandler(nsnull),
+      mStylesheet(aStylesheet),
       mNextInstruction(nsnull),
       mLocalVariables(nsnull),
       mRecursionDepth(0),
-      mTemplateRules(nsnull),
-      mTemplateRulesBufferSize(0),
-      mTemplateRuleCount(0),
       mEvalContext(nsnull),
       mInitialEvalContext(nsnull),
       mGlobalParams(nsnull),
@@ -109,12 +108,6 @@
     delete mResultHandler;
     delete mLocalVariables;
     delete mEvalContext;
-
-    PRInt32 i;
-    for (i = 0; i < mTemplateRuleCount; ++i) {
-        NS_IF_RELEASE(mTemplateRules[i].mModeLocalName);
-    }
-    delete [] mTemplateRules;
     
     txStackIterator varsIter(&mLocalVarsStack);
     while (varsIter.hasNext()) {
@@ -204,7 +197,14 @@
 nsresult
 txExecutionState::end(nsresult aResult)
 {
-    popTemplateRule();
+    NS_ASSERTION(NS_FAILED(aResult) || mTemplateRules.Length() == 1,
+                 "Didn't clean up template rules properly");
+    if (NS_SUCCEEDED(aResult)) {
+        popTemplateRule();
+    }
+    else if (!mOutputHandler) {
+        return NS_OK;
+    }
     return mOutputHandler->endDocument(aResult);
 }
 
@@ -408,35 +408,22 @@
                                    const txExpandedName& aMode,
                                    txVariableMap* aParams)
 {
-    if (mTemplateRuleCount == mTemplateRulesBufferSize) {
-        PRInt32 newSize =
-            mTemplateRulesBufferSize ? mTemplateRulesBufferSize * 2 : 10;
-        TemplateRule* newRules = new TemplateRule[newSize];
-        NS_ENSURE_TRUE(newRules, NS_ERROR_OUT_OF_MEMORY);
-        
-        memcpy(newRules, mTemplateRules,
-               mTemplateRuleCount * sizeof(TemplateRule));
-        delete [] mTemplateRules;
-        mTemplateRules = newRules;
-        mTemplateRulesBufferSize = newSize;
-    }
+    TemplateRule* rule = mTemplateRules.AppendElement();
+    NS_ENSURE_TRUE(rule, NS_ERROR_OUT_OF_MEMORY);
+
+    rule->mFrame = aFrame;
+    rule->mModeNsId = aMode.mNamespaceID;
+    rule->mModeLocalName = aMode.mLocalName;
+    rule->mParams = aParams;
 
-    mTemplateRules[mTemplateRuleCount].mFrame = aFrame;
-    mTemplateRules[mTemplateRuleCount].mModeNsId = aMode.mNamespaceID;
-    mTemplateRules[mTemplateRuleCount].mModeLocalName = aMode.mLocalName;
-    mTemplateRules[mTemplateRuleCount].mParams = aParams;
-    NS_IF_ADDREF(mTemplateRules[mTemplateRuleCount].mModeLocalName);
-    ++mTemplateRuleCount;
-    
     return NS_OK;
 }
 
 void
 txExecutionState::popTemplateRule()
 {
-    // decrement outside of RELEASE, that would decrement twice
-    --mTemplateRuleCount;
-    NS_IF_RELEASE(mTemplateRules[mTemplateRuleCount].mModeLocalName);
+    NS_PRECONDITION(!mTemplateRules.IsEmpty(), "No rules to pop");
+    mTemplateRules.RemoveElementAt(mTemplateRules.Length() - 1);
 }
 
 txIEvalContext*
@@ -500,7 +487,8 @@
 txExecutionState::TemplateRule*
 txExecutionState::getCurrentTemplateRule()
 {
-    return mTemplateRules + mTemplateRuleCount - 1;
+    NS_PRECONDITION(!mTemplateRules.IsEmpty(), "No current rule!");
+    return &mTemplateRules[mTemplateRules.Length() - 1];
 }
 
 txInstruction*
--- xulrunner-1.9.0.19.orig/content/xslt/src/xslt/txXSLTNumberCounters.cpp
+++ xulrunner-1.9.0.19/content/xslt/src/xslt/txXSLTNumberCounters.cpp
@@ -220,8 +220,8 @@
 
 void txRomanCounter::appendNumber(PRInt32 aNumber, nsAString& aDest)
 {
-    // Numbers bigger then 3999 can't be done in roman
-    if (aNumber >= 4000) {
+    // Numbers bigger then 3999 and negative numbers can't be done in roman
+    if (PRUint32(aNumber) >= 4000) {
         txDecimalCounter().appendNumber(aNumber, aDest);
         return;
     }
--- xulrunner-1.9.0.19.orig/content/xslt/src/xslt/txExecutionState.h
+++ xulrunner-1.9.0.19/content/xslt/src/xslt/txExecutionState.h
@@ -104,10 +104,11 @@
     /**
      * Struct holding information about a current template rule
      */
-    struct TemplateRule {
+    class TemplateRule {
+    public:
         txStylesheet::ImportFrame* mFrame;
         PRInt32 mModeNsId;
-        nsIAtom* mModeLocalName;
+        nsCOMPtr<nsIAtom> mModeLocalName;
         txVariableMap* mParams;
     };
 
@@ -173,9 +174,7 @@
     nsRefPtr<txAExprResult> mGlobalVarPlaceholderValue;
     PRInt32 mRecursionDepth;
 
-    TemplateRule* mTemplateRules;
-    PRInt32 mTemplateRulesBufferSize;
-    PRInt32 mTemplateRuleCount;
+    nsAutoTArray<TemplateRule, 10> mTemplateRules;
 
     txIEvalContext* mEvalContext;
     txIEvalContext* mInitialEvalContext;
--- xulrunner-1.9.0.19.orig/content/xslt/crashtests/545927.html
+++ xulrunner-1.9.0.19/content/xslt/crashtests/545927.html
@@ -0,0 +1,28 @@
+<html>
+<head>
+<script>
+function main()
+{
+	xml=document.implementation.createDocument('', '', null);
+	xml.appendChild(doc=xml.createElement('root'));
+
+	var p = new DOMParser();
+	text  = '<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">';
+	text += '<xsl:template match="/">';
+	text += '<body>';
+	text += '<xsl:number value="2147483648" format="i"/>';
+	text += '</body>';
+	text += '</xsl:template>';	
+	text += '</xsl:stylesheet>';
+	xsl=p.parseFromString(text, 'text/xml');
+
+	xsltProcessor=new XSLTProcessor();
+	xsltProcessor.importStylesheet(xsl);
+	d = xsltProcessor.transformToFragment(xml, document);
+}
+</script>
+</head>
+<body onload="main()">
+</body>
+</html>
+
--- xulrunner-1.9.0.19.orig/content/xslt/crashtests/602115.html
+++ xulrunner-1.9.0.19/content/xslt/crashtests/602115.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<script>
+
+try {
+  var docType = document.implementation.createDocumentType(undefined, '', '');
+  var doc = document.implementation.createDocument('', '', null);
+  var xp = new XSLTProcessor;
+  xp.importStylesheet(doc);
+  xp.transformToDocument(docType);
+}
+catch (ex) {}
+
+try {
+  docType = document.implementation.createDocumentType(undefined, '', '');
+  doc = document.implementation.createDocument('', '', null);
+  xp = new XSLTProcessor;
+  xp.importStylesheet(doc);
+  xp.transformToFragment(docType, document);
+}
+catch (ex) {}
+
+</script>
--- xulrunner-1.9.0.19.orig/content/xslt/crashtests/crashtests.list
+++ xulrunner-1.9.0.19/content/xslt/crashtests/crashtests.list
@@ -3,3 +3,5 @@
 load 485286.xml
 load 528300.xml
 load 528488.xml
+load 545927.html
+load 602115.html
--- xulrunner-1.9.0.19.orig/content/canvas/src/nsCanvasRenderingContext2D.cpp
+++ xulrunner-1.9.0.19/content/canvas/src/nsCanvasRenderingContext2D.cpp
@@ -710,6 +710,9 @@
     mSaveCount = 0;
 
     ContextState *state = mStyleStack.AppendElement();
+    if (!state) {
+        return NS_ERROR_OUT_OF_MEMORY;
+    }
     state->globalAlpha = 1.0;
     for (int i = 0; i < STYLE_MAX; i++)
         state->colorStyles[i] = NS_RGB(0,0,0);
@@ -845,7 +848,9 @@
 nsCanvasRenderingContext2D::Save()
 {
     ContextState state = CurrentState();
-    mStyleStack.AppendElement(state);
+    if (!mStyleStack.AppendElement(state)) {
+        return NS_ERROR_OUT_OF_MEMORY;
+    }
     cairo_save (mCairo);
     mSaveCount++;
     return NS_OK;
--- xulrunner-1.9.0.19.orig/debian/xulrunner-1.9.README.Debian
+++ xulrunner-1.9.0.19/debian/xulrunner-1.9.README.Debian
@@ -0,0 +1,18 @@
+Xulrunner for Debian
+====================
+
+Weak SSL
+--------
+
+From version 1.8.0.1-11 onwards, SSLv2 and SSLv3 40-bit ciphers are disabled
+due to their weakness. If your xulrunner or embedding application provides a
+way to alert the user about the weakness of the cipher in use, while still
+allowing the user to use it, you may re-enable them in your application
+preferences.
+
+The preferences to reenable them are the following:
+pref("security.enable_ssl2", true);
+pref("security.ssl3.rsa_rc4_40_md5", true);
+pref("security.ssl3.rsa_rc2_40_md5", true);
+
+ -- Mike Hommey <glandium@debian.org>  Sat, 20 May 2006 11:03:22 +0200
--- xulrunner-1.9.0.19.orig/debian/copyright
+++ xulrunner-1.9.0.19/debian/copyright
@@ -0,0 +1,798 @@
+This package was debianized by Mike Hommey <glandium@debian.org> on
+Tue, 16 Aug 2005 13:45:47 +0200.
+
+It was downloaded from http://ftp.mozilla.org/pub/mozilla.org/xulrunner/
+
+The source tarball is an aggregate of several different works in which the
+main one, developed by the Mozilla Project, is xulrunner.
+
+The contents of the debian directory are licensed like the bulk of
+xulrunner, tri-licensed under the GPL/LGPL/MPL.
+
+Other works include gzip, bzip2, sqlite, libjpeg, libpng, cairo, and others.
+Please see the sections following the copyright statements for xulrunner for
+these.
+
+If this file is incomplete, which I'm pretty sure is the case, because it's
+difficult not to forget anything in this huge amount of data, please file
+a bug or contact me.
+
+=== xulrunner
+
+Overall, the xulrunner project is licensed under the terms of the Mozilla
+Public License version 1.1 or, at your option, under the terms of the GNU 
+General Public License version 2 or subsequent, or the terms of the GNU
+Lesser General Public License version 2.1 or subsequent.
+
+On Debian systems, the complete text of the GNU General Public
+License can be found in the file `/usr/share/common-licenses/GPL' ;
+the complete text of the GNU Lesser General Public License can be
+found in the file `/usr/share/common-licenses/LGPL'.
+
+The complete text of the Mozilla Public License can be found in the MPL file
+in the same directory as this file.
+
+Some of the files are also licensed (single, dual or tri) under the terms of
+the Netscape Public License (NPL) which can be found as amendments to the
+MPL at the end of the file.
+
+While the Mozilla Project is undergoing a global relicensing so that the
+aim is to have a full tree with these tri-license terms, there are at the
+moment quite some exceptions as following:
+
+(Note that I sometimes assumed files not explicitely licensed to be licensed
+under the same terms as the files around them and that a lot of the
+information has been extracted automatically, thus maybe leaving some doubt.
+Again, if you find "bugs", please contact me by email or via the BTS.)
+
+The following files are tri licensed under the terms of the NPL, of the
+GPL, and the LGPL:
+
+  extensions/pref/system-pref/src/gconf/nsSystemPrefService.cpp
+  extensions/pref/system-pref/src/gconf/nsSystemPrefService.h
+  extensions/pref/system-pref/src/nsSystemPref.cpp
+  extensions/pref/system-pref/src/nsSystemPref.h
+  extensions/pref/system-pref/src/nsSystemPrefFactory.cpp
+  extensions/pref/system-pref/src/nsSystemPrefLog.h
+  modules/plugin/samples/npruntime/np_entry.cpp
+  modules/plugin/samples/npruntime/npn_gate.cpp
+  modules/plugin/samples/npruntime/npp_gate.cpp
+  modules/plugin/samples/npruntime/plugin.cpp
+  modules/plugin/samples/npruntime/plugin.h
+  netwerk/base/public/nsIIOService2.idl
+  netwerk/base/public/nsINetworkLinkService.idl
+  toolkit/system/dbus/nsDBusModule.cpp
+  toolkit/system/dbus/nsDBusService.cpp
+  toolkit/system/dbus/nsDBusService.h
+  toolkit/system/dbus/nsNetworkManagerListener.cpp
+  toolkit/system/dbus/nsNetworkManagerListener.h
+
+The following files are licensed under the terms of the NPL only:
+
+  intl/uconv/ucvibm/864i.uf
+  intl/uconv/ucvibm/cp850.uf
+  intl/uconv/ucvibm/cp852.uf
+  intl/uconv/ucvibm/cp855.uf
+  intl/uconv/ucvibm/cp857.uf
+  intl/uconv/ucvibm/cp862.uf
+  intl/uconv/ucvibm/cp864.uf
+  intl/uconv/ucvmath/mathematica1.uf
+  intl/uconv/ucvmath/mathematica2.uf
+  intl/uconv/ucvmath/mathematica3.uf
+  intl/uconv/ucvmath/mathematica4.uf
+  intl/uconv/ucvmath/mathematica5.uf
+  intl/uconv/ucvmath/mtextra.uf
+  intl/uconv/ucvmath/texcmex-t1.uf
+  intl/uconv/ucvmath/texcmex-ttf.uf
+  intl/uconv/ucvmath/texcmmi-t1.uf
+  intl/uconv/ucvmath/texcmmi-ttf.uf
+  intl/uconv/ucvmath/texcmr-ttf.uf
+  intl/uconv/ucvmath/texcmsy-t1.uf
+
+The following files are licensed under the terms of the GPL only:
+
+  build/autoconf/codeset.m4
+  build/autoconf/config.guess
+  build/autoconf/config.sub
+  nsprpub/build/autoconf/config.guess
+  nsprpub/build/autoconf/config.sub
+
+The following files are licensed under the terms of the GPL and the MIT
+license, which terms are following:
+
+  dom/tests/mochitest/ajax/jquery/dist/jquery.js
+  dom/tests/mochitest/ajax/jquery/src/jquery/jquery.js
+
+  Permission is hereby granted, free of charge, to any person
+  obtaining a copy of this software and associated documentation
+  files (the "Software"), to deal in the Software without
+  restriction, including without limitation the rights to use,
+  copy, modify, merge, publish, distribute, sublicense, and/or sell
+  copies of the Software, and to permit persons to whom the
+  Software is furnished to do so, subject to the following
+  conditions:
+
+  The above copyright notice and this permission notice shall be
+  included in all copies or substantial portions of the Software.
+
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+  EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+  OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+  NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+  HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+  WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+  FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+  OTHER DEALINGS IN THE SOFTWARE.
+
+The following files are in the Public Domain:
+  
+  aclocal.m4
+  build/autoconf/freetype2.m4
+  build/autoconf/gtk.m4
+  build/autoconf/nspr.m4
+  db/mork/src/morkDeque.cpp
+  db/mork/src/morkDeque.h
+
+The file db/mork/src/morkQuickSort.cpp is licensed under the following terms:
+ 
+  Copyright (c) 1992, 1993
+   The Regents of the University of California.  All rights reserved.
+ 
+  Redistribution and use in source and binary forms, with or without
+  modification, are permitted provided that the following conditions
+  are met:
+  1. Redistributions of source code must retain the above copyright
+     notice, this list of conditions and the following disclaimer.
+  2. Redistributions in binary form must reproduce the above copyright
+     notice, this list of conditions and the following disclaimer in the
+     documentation and/or other materials provided with the distribution.
+  3. Neither the name of the University nor the names of its contributors
+     may be used to endorse or promote products derived from this software
+     without specific prior written permission.
+ 
+  THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+  ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+  ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+  DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+  OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+  HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+  LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+  OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+  SUCH DAMAGE.
+
+The following files come from X11R5, without any clear licensing terms:
+
+  build/autoconf/install-sh
+  nsprpub/build/autoconf/install-sh
+
+The embedding/qa/mozembed/public/nsIQABrowserUIGlue.idl file and the files
+under the embedding/tests directory are licensed under the following terms:
+
+  Copyright (c) 2002 Netscape Communications Corporation and
+  other contributors
+
+  Permission is hereby granted, free of charge, to any person obtaining a
+  copy of this Mozilla sample software and associated documentation files
+  (the "Software"), to deal in the Software without restriction, including
+  without limitation the rights to use, copy, modify, merge, publish,
+  distribute, sublicense, and/or sell copies of the Software, and to permit
+  persons to whom the Software is furnished to do so, subject to the
+  following conditions:
+ 
+  The above copyright notice and this permission notice shall be included
+  in all copies or substantial portions of the Software.
+  
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+  OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+  THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+  FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+  DEALINGS IN THE SOFTWARE.
+
+=== sqlite
+
+The db/sqlite3 directory contains a copy of sqlite with the following
+licensing terms:
+
+  The author disclaims copyright to this source code.  In place of
+  a legal notice, here is a blessing:
+
+     May you do good and not evil.
+     May you find forgiveness for yourself and forgive others.
+     May you share freely, never taking more than you give.
+
+=== dbm
+
+The dbm directory, except the files listed under the xulrunner section, is
+licensed under the following terms:
+
+  Copyright (c) 1991, 1993, 1994
+  The Regents of the University of California.  All rights reserved.
+ 
+  Redistribution and use in source and binary forms, with or without
+  modification, are permitted provided that the following conditions
+  are met:
+  1. Redistributions of source code must retain the above copyright
+     notice, this list of conditions and the following disclaimer.
+  2. Redistributions in binary form must reproduce the above copyright
+     notice, this list of conditions and the following disclaimer in the
+     documentation and/or other materials provided with the distribution.
+  3. All advertising materials mentioning features or use of this software
+     must display the following acknowledgement:
+  This product includes software developed by the University of
+  California, Berkeley and its contributors.
+  4. Neither the name of the University nor the names of its contributors
+     may be used to endorse or promote products derived from this software
+     without specific prior written permission.
+ 
+  THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+  ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+  ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+  DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+  OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+  HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+  LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+  OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+  SUCH DAMAGE.
+ 
+=== myspell
+
+The extensions/spellcheck/myspell directory is licensed under the following
+terms:
+
+  Copyright 2002 Kevin B. Hendricks, Stratford, Ontario, Canada
+  And Contributors.  All rights reserved.
+ 
+  Redistribution and use in source and binary forms, with or without
+  modification, are permitted provided that the following conditions
+  are met:
+ 
+  1. Redistributions of source code must retain the above copyright
+     notice, this list of conditions and the following disclaimer.
+ 
+  2. Redistributions in binary form must reproduce the above copyright
+     notice, this list of conditions and the following disclaimer in the
+     documentation and/or other materials provided with the distribution.
+ 
+  3. All modifications to the source code must be clearly marked as
+     such.  Binary redistributions based on modified source code
+     must be clearly marked as modified versions in the documentation
+     and/or other materials provided with the distribution.
+ 
+  THIS SOFTWARE IS PROVIDED BY KEVIN B. HENDRICKS AND CONTRIBUTORS 
+  ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 
+  LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 
+  FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL 
+  KEVIN B. HENDRICKS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 
+  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 
+  BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 
+  LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+  HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+  LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+  OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+  SUCH DAMAGE.
+
+=== cairo
+
+The gfx/cairo/cairo directory is licensed under the following terms:
+
+  Copyright (c) 2003 University of Southern California
+  Copyright (c) 1999 Tom Tromey
+  Copyright (c) 2002, 2003 University of Southern California
+  Copyright (c) 2004 Calum Robinson
+  Copyright (c) 2004 David Reveman
+  Copyright (c) 2000, 2002, 2004 Keith Packard
+  Copyright (c) 2004, 2005 Red Hat, Inc
+
+  Cairo is free software and is available to be redistributed and/or
+  modified under the terms of either the GNU Lesser General Public
+  License (LGPL) version 2.1 or the Mozilla Public License (MPL) version
+  1.1.
+
+=== glitz
+
+The gfx/cairo/glitz directory is licensed under the following terms:
+(from gfx/cairo/glitz/COPYING)
+
+  Copyright © 2004 David Reveman, Peter Nilsson
+
+  Permission to use, copy, modify, distribute, and sell this software
+  and its documentation for any purpose is hereby granted without
+  fee, provided that the above copyright notice appear in all copies
+  and that both that copyright notice and this permission notice
+  appear in supporting documentation, and that the names of
+  David Reveman and Peter Nilsson not be used in advertising or
+  publicity pertaining to distribution of the software without
+  specific, written prior permission. David Reveman and Peter Nilsson
+  makes no representations about the suitability of this software for
+  any purpose. It is provided "as is" without express or implied warranty.
+
+  DAVID REVEMAN AND PETER NILSSON DISCLAIMS ALL WARRANTIES WITH
+  REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF
+  MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL DAVID REVEMAN AND
+  PETER NILSSON BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL
+  DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA
+  OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+  TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+  PERFORMANCE OF THIS SOFTWARE.
+
+=== libpixman
+
+The gfx/cairo/libpixman directory is licensed under the following terms:
+(from gfx/cairo/libpixman/COPYING)
+
+  libpixregion
+  
+  Copyright 1987, 1998  The Open Group
+  
+  Permission to use, copy, modify, distribute, and sell this software and its
+  documentation for any purpose is hereby granted without fee, provided that
+  the above copyright notice appear in all copies and that both that
+  copyright notice and this permission notice appear in supporting
+  documentation.
+  
+  The above copyright notice and this permission notice shall be included in
+  all copies or substantial portions of the Software.
+  
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
+  OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+  AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+  CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+  
+  Except as contained in this notice, the name of The Open Group shall not be
+  used in advertising or otherwise to promote the sale, use or other dealings
+  in this Software without prior written authorization from The Open Group.
+  
+  
+  Copyright 1987 by Digital Equipment Corporation, Maynard, Massachusetts.
+  
+                          All Rights Reserved
+  
+  Permission to use, copy, modify, and distribute this software and its 
+  documentation for any purpose and without fee is hereby granted, 
+  provided that the above copyright notice appear in all copies and that
+  both that copyright notice and this permission notice appear in 
+  supporting documentation, and that the name of Digital not be
+  used in advertising or publicity pertaining to distribution of the
+  software without specific, written prior permission.  
+  
+  DIGITAL DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
+  ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
+  DIGITAL BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
+  ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
+  WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
+  ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+  SOFTWARE.
+  
+  ----------------------------------------------------------------------
+  libic
+  
+  Copyright © 2001 Keith Packard
+  
+  Permission to use, copy, modify, distribute, and sell this software and its
+  documentation for any purpose is hereby granted without fee, provided that
+  the above copyright notice appear in all copies and that both that
+  copyright notice and this permission notice appear in supporting
+  documentation, and that the name of Keith Packard not be used in
+  advertising or publicity pertaining to distribution of the software without
+  specific, written prior permission.  Keith Packard makes no
+  representations about the suitability of this software for any purpose.  It
+  is provided "as is" without express or implied warranty.
+  
+  KEITH PACKARD DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
+  INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
+  EVENT SHALL KEITH PACKARD BE LIABLE FOR ANY SPECIAL, INDIRECT OR
+  CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
+  DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+  TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+  PERFORMANCE OF THIS SOFTWARE.
+  
+  ----------------------------------------------------------------------
+  slim
+  
+  slim is Copyright © 2003 Richard Henderson
+  
+  Permission to use, copy, modify, distribute, and sell this software
+  and its documentation for any purpose is hereby granted without fee,
+  provided that the above copyright notice appear in all copies and that
+  both that copyright notice and this permission notice appear in
+  supporting documentation, and that the name of Richard Henderson not be
+  used in advertising or publicity pertaining to distribution of the
+  software without specific, written prior permission.  Richard Henderson
+  makes no representations about the suitability of this software for
+  any purpose.  It is provided "as is" without express or implied
+  warranty.
+  
+  RICHARD HENDERSON DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
+  INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
+  EVENT SHALL RICHARD HENDERSON BE LIABLE FOR ANY SPECIAL, INDIRECT OR
+  CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
+  USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+  OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+  PERFORMANCE OF THIS SOFTWARE.
+
+=== libjpeg
+
+The jpeg directory, except the files under the xulrunner section, are licensed
+under the following terms:
+
+  The authors make NO WARRANTY or representation, either express or implied,
+  with respect to this software, its quality, accuracy, merchantability, or
+  fitness for a particular purpose.  This software is provided "AS IS", and you,
+  its user, assume the entire risk as to its quality and accuracy.
+
+  This software is copyright (C) 1991-1998, Thomas G. Lane.
+  All Rights Reserved except as specified below.
+
+  Permission is hereby granted to use, copy, modify, and distribute this
+  software (or portions thereof) for any purpose, without fee, subject to these
+  conditions:
+  (1) If any part of the source code for this software is distributed, then this
+  README file must be included, with this copyright and no-warranty notice
+  unaltered; and any additions, deletions, or changes to the original files
+  must be clearly indicated in accompanying documentation.
+  (2) If only executable code is distributed, then the accompanying
+  documentation must state that "this software is based in part on the work of
+  the Independent JPEG Group".
+  (3) Permission for use of this software is granted only if the user accepts
+  full responsibility for any undesirable consequences; the authors accept
+  NO LIABILITY for damages of any kind.
+
+  These conditions apply to any software derived from or based on the IJG code,
+  not just to the unmodified library.  If you use our work, you ought to
+  acknowledge us.
+
+  Permission is NOT granted for the use of any IJG author's name or company name
+  in advertising or publicity relating to this software or products derived from
+  it.  This software may be referred to only as "the Independent JPEG Group's
+  software".
+
+  We specifically permit and encourage the use of this software as the basis of
+  commercial products, provided that all warranty or liability claims are
+  assumed by the product vendor.
+
+=== bzip2
+
+The modules/libbz2/src directory is licensed under the following terms:
+(from modules/libbz2/src/LICENSE)
+
+  This program, "bzip2", the associated library "libbzip2", and all
+  documentation, are copyright (C) 1996-2005 Julian R Seward.  All
+  rights reserved.
+  
+  Redistribution and use in source and binary forms, with or without
+  modification, are permitted provided that the following conditions
+  are met:
+  
+  1. Redistributions of source code must retain the above copyright
+     notice, this list of conditions and the following disclaimer.
+  
+  2. The origin of this software must not be misrepresented; you must 
+     not claim that you wrote the original software.  If you use this 
+     software in a product, an acknowledgment in the product 
+     documentation would be appreciated but is not required.
+  
+  3. Altered source versions must be plainly marked as such, and must
+     not be misrepresented as being the original software.
+  
+  4. The name of the author may not be used to endorse or promote 
+     products derived from this software without specific prior written 
+     permission.
+  
+  THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS
+  OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+  WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+  ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+  DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+  DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
+  GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+  INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+  WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+  
+  Julian Seward, Cambridge, UK.
+  jseward@acm.org
+  bzip2/libbzip2 version 1.0.3 of 15 February 2005
+
+=== libpng
+
+The directory modules/libimg/png is licensed under the following terms:
+(from modules/libimg/png/LICENSE)
+
+  This copy of the libpng notices is provided for your convenience.  In case of
+  any discrepancy between this copy and the notices in the file png.h that is
+  included in the libpng distribution, the latter shall prevail.
+  
+  COPYRIGHT NOTICE, DISCLAIMER, and LICENSE:
+  
+  If you modify libpng you may insert additional notices immediately following
+  this sentence.
+  
+  libpng version 1.2.6, September 12, 2004, is
+  Copyright (c) 2004 Glenn Randers-Pehrson, and is
+  distributed according to the same disclaimer and license as libpng-1.2.5
+  with the following individual added to the list of Contributing Authors
+  
+     Cosmin Truta
+  
+  libpng versions 1.0.7, July 1, 2000, through 1.2.5 - October 3, 2002, are
+  Copyright (c) 2000-2002 Glenn Randers-Pehrson, and are
+  distributed according to the same disclaimer and license as libpng-1.0.6
+  with the following individuals added to the list of Contributing Authors
+  
+     Simon-Pierre Cadieux
+     Eric S. Raymond
+     Gilles Vollant
+  
+  and with the following additions to the disclaimer:
+  
+     There is no warranty against interference with your enjoyment of the
+     library or against infringement.  There is no warranty that our
+     efforts or the library will fulfill any of your particular purposes
+     or needs.  This library is provided with all faults, and the entire
+     risk of satisfactory quality, performance, accuracy, and effort is with
+     the user.
+  
+  libpng versions 0.97, January 1998, through 1.0.6, March 20, 2000, are
+  Copyright (c) 1998, 1999 Glenn Randers-Pehrson, and are
+  distributed according to the same disclaimer and license as libpng-0.96,
+  with the following individuals added to the list of Contributing Authors:
+  
+     Tom Lane
+     Glenn Randers-Pehrson
+     Willem van Schaik
+  
+  libpng versions 0.89, June 1996, through 0.96, May 1997, are
+  Copyright (c) 1996, 1997 Andreas Dilger
+  Distributed according to the same disclaimer and license as libpng-0.88,
+  with the following individuals added to the list of Contributing Authors:
+  
+     John Bowler
+     Kevin Bracey
+     Sam Bushell
+     Magnus Holmgren
+     Greg Roelofs
+     Tom Tanner
+  
+  libpng versions 0.5, May 1995, through 0.88, January 1996, are
+  Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.
+  
+  For the purposes of this copyright and license, "Contributing Authors"
+  is defined as the following set of individuals:
+  
+     Andreas Dilger
+     Dave Martindale
+     Guy Eric Schalnat
+     Paul Schmidt
+     Tim Wegner
+  
+  The PNG Reference Library is supplied "AS IS".  The Contributing Authors
+  and Group 42, Inc. disclaim all warranties, expressed or implied,
+  including, without limitation, the warranties of merchantability and of
+  fitness for any purpose.  The Contributing Authors and Group 42, Inc.
+  assume no liability for direct, indirect, incidental, special, exemplary,
+  or consequential damages, which may result from the use of the PNG
+  Reference Library, even if advised of the possibility of such damage.
+  
+  Permission is hereby granted to use, copy, modify, and distribute this
+  source code, or portions hereof, for any purpose, without fee, subject
+  to the following restrictions:
+  
+  1. The origin of this source code must not be misrepresented.
+  
+  2. Altered versions must be plainly marked as such and must not
+     be misrepresented as being the original source.
+  
+  3. This Copyright notice may not be removed or altered from any
+     source or altered source distribution.
+  
+  The Contributing Authors and Group 42, Inc. specifically permit, without
+  fee, and encourage the use of this source code as a component to
+  supporting the PNG file format in commercial products.  If you use this
+  source code in a product, acknowledgment is not required but would be
+  appreciated.
+  
+  
+  A "png_get_copyright" function is available, for convenient use in "about"
+  boxes and the like:
+  
+     printf("%s",png_get_copyright(NULL));
+  
+  Also, the PNG logo (in PNG format, of course) is supplied in the
+  files "pngbar.png" and "pngbar.jpg (88x31) and "pngnow.png" (98x31).
+  
+  Libpng is OSI Certified Open Source Software.  OSI Certified Open Source is a
+  certification mark of the Open Source Initiative.
+  
+  Glenn Randers-Pehrson
+  glennrp@users.sourceforge.net
+  September 12, 2004
+
+=== zlib
+
+The directories modules/zlib/src and security/nss/cmd/zlib are licensed under
+the following terms:
+
+ (C) 1995-2004 Jean-loup Gailly and Mark Adler
+
+  This software is provided 'as-is', without any express or implied
+  warranty.  In no event will the authors be held liable for any damages
+  arising from the use of this software.
+
+  Permission is granted to anyone to use this software for any purpose,
+  including commercial applications, and to alter it and redistribute it
+  freely, subject to the following restrictions:
+
+  1. The origin of this software must not be misrepresented; you must not
+     claim that you wrote the original software. If you use this software
+     in a product, an acknowledgment in the product documentation would be
+     appreciated but is not required.
+  2. Altered source versions must be plainly marked as such, and must not be
+     misrepresented as being the original software.
+  3. This notice may not be removed or altered from any source distribution.
+
+  Jean-loup Gailly        Mark Adler
+  jloup@gzip.org          madler@alumni.caltech.edu
+
+  If you use the zlib library in a product, we would appreciate *not*
+  receiving lengthy legal documents to sign. The sources are provided
+  for free but without warranty of any kind.  The library has been
+  entirely written by Jean-loup Gailly and Mark Adler; it does not
+  include third-party code.
+  
+  If you redistribute modified sources, we would appreciate that you include
+  in the file ChangeLog history information documenting your changes. Please
+  read the FAQ for more information on the distribution of modified source
+  versions.
+  
+=== expat
+
+The directory parser/expat is licensed under the following terms:
+(from parser/expat/COPYING)
+
+  Copyright (c) 1998, 1999, 2000 Thai Open Source Software Center Ltd
+                                 and Clark Cooper
+  Copyright (c) 2001, 2002 Expat maintainers.
+  
+  Permission is hereby granted, free of charge, to any person obtaining
+  a copy of this software and associated documentation files (the
+  "Software"), to deal in the Software without restriction, including
+  without limitation the rights to use, copy, modify, merge, publish,
+  distribute, sublicense, and/or sell copies of the Software, and to
+  permit persons to whom the Software is furnished to do so, subject to
+  the following conditions:
+  
+  The above copyright notice and this permission notice shall be included
+  in all copies or substantial portions of the Software.
+  
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+  EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+  MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+  IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+  CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+  TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+  SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+=== jemalloc
+
+The memory/jemalloc/jemalloc.c is liensed under the following terms:
+
+  Copyright (C) 2006-2008 Jason Evans <jasone@FreeBSD.org>.
+  All rights reserved.
+
+  Redistribution and use in source and binary forms, with or without
+  modification, are permitted provided that the following conditions
+  are met:
+  1. Redistributions of source code must retain the above copyright
+     notice(s), this list of conditions and the following disclaimer as
+     the first lines of this file unmodified other than the possible
+     addition of one or more copyright notices.
+  2. Redistributions in binary form must reproduce the above copyright
+     notice(s), this list of conditions and the following disclaimer in
+     the documentation and/or other materials provided with the
+     distribution.
+
+  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER(S) ``AS IS'' AND ANY
+  EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+  PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) BE
+  LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+  WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+  OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
+  EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+The memory/jemalloc/tree.h is liensed under the following terms:
+
+  Copyright 2002 Niels Provos <provos@citi.umich.edu>
+  All rights reserved.
+
+  Redistribution and use in source and binary forms, with or without
+  modification, are permitted provided that the following conditions
+  are met:
+  1. Redistributions of source code must retain the above copyright
+     notice, this list of conditions and the following disclaimer.
+  2. Redistributions in binary form must reproduce the above copyright
+     notice, this list of conditions and the following disclaimer in the
+     documentation and/or other materials provided with the distribution.
+
+  THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+  IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+  OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+  NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+== lcms
+ 
+The directory modules/lcms is licensed under the followin terms:
+(from modules/lcms/COPYING)
+
+  Copyright (c) 1998-2007 Marti Maria Saguer
+
+  Permission is hereby granted, free of charge, to any person obtaining
+  a copy of this software and associated documentation files (the "Software"),
+  to deal in the Software without restriction, including without limitation
+  the rights to use, copy, modify, merge, publish, distribute, sublicense,
+  and/or sell copies of the Software, and to permit persons to whom the
+  Software is furnished to do so, subject to the following conditions:
+
+  The above copyright notice and this permission notice shall be included in
+  all copies or substantial portions of the Software.
+
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+  EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO
+  THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+  NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+  LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+  OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+  WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+== breakpad
+
+The directory toolkit/crashreporter/google-breakpad is licensed under the
+followin terms:
+(from toolkit/crashreporter/google-breakpad/COPYING)
+
+  Copyright (c) 2006, Google Inc.
+  All rights reserved.
+
+  Redistribution and use in source and binary forms, with or without
+  modification, are permitted provided that the following conditions are
+  met:
+
+      * Redistributions of source code must retain the above copyright
+  notice, this list of conditions and the following disclaimer.
+      * Redistributions in binary form must reproduce the above
+  copyright notice, this list of conditions and the following disclaimer
+  in the documentation and/or other materials provided with the
+  distribution.
+      * Neither the name of Google Inc. nor the names of its
+  contributors may be used to endorse or promote products derived from
+  this software without specific prior written permission.
+
+  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+  "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+  LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+  A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+  OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
--- xulrunner-1.9.0.19.orig/debian/xulrunner-1.9.prerm
+++ xulrunner-1.9.0.19/debian/xulrunner-1.9.prerm
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+set -e
+
+if [ "$1" = "remove" ]; then
+    rm -f /usr/lib/xulrunner-1.9/components/compreg.dat \
+          /usr/lib/xulrunner-1.9/components/xpti.dat \
+          /usr/lib/xulrunner-1.9/.autoreg
+fi
+
+#DEBHELPER#
--- xulrunner-1.9.0.19.orig/debian/xulrunner-1.9.dirs
+++ xulrunner-1.9.0.19/debian/xulrunner-1.9.dirs
@@ -0,0 +1 @@
+usr/share/xulrunner-1.9/defaults/pref
--- xulrunner-1.9.0.19.orig/debian/xulrunner-1.9.docs
+++ xulrunner-1.9.0.19/debian/xulrunner-1.9.docs
@@ -0,0 +1 @@
+README.txt
--- xulrunner-1.9.0.19.orig/debian/libmozjs1d.symbols
+++ xulrunner-1.9.0.19/debian/libmozjs1d.symbols
@@ -0,0 +1,495 @@
+libmozjs.so.1d libmozjs1d #MINVER#
+ JS_AddArgumentFormatter@Base 1.9~b4
+ JS_AddExternalStringFinalizer@Base 1.9~b4
+ JS_AddNamedRoot@Base 1.9~b4
+ JS_AddNamedRootRT@Base 1.9~b4
+ JS_AddRoot@Base 1.9~b4
+ JS_AliasElement@Base 1.9~b4
+ JS_AliasProperty@Base 1.9~b4
+ JS_AlreadyHasOwnElement@Base 1.9~b4
+ JS_AlreadyHasOwnProperty@Base 1.9~b4
+ JS_AlreadyHasOwnUCProperty@Base 1.9~b4
+ JS_ArenaAllocate@Base 1.9~b4
+ JS_ArenaFinish@Base 1.9~b4
+ JS_ArenaGrow@Base 1.9~b4
+ JS_ArenaRealloc@Base 1.9~b4
+ JS_ArenaRelease@Base 1.9~b4
+ JS_ArenaShutDown@Base 1.9~b4
+ JS_Assert@Base 1.9~b4
+ JS_BeginRequest@Base 1.9~b4
+ JS_BufferIsCompilableUnit@Base 1.9~b4
+ JS_CStringsAreUTF8@Base 1.9~b4
+ JS_CallFunction@Base 1.9~b4
+ JS_CallFunctionName@Base 1.9~b4
+ JS_CallFunctionValue@Base 1.9~b4
+ JS_CallTracer@Base 1.9~b4
+ JS_CeilingLog2@Base 1.9~b4
+ JS_CheckAccess@Base 1.9~b4
+ JS_ClearAllTraps@Base 1.9~b4
+ JS_ClearAllWatchPoints@Base 1.9~b4
+ JS_ClearContextThread@Base 1.9~b4
+ JS_ClearInterrupt@Base 1.9~b4
+ JS_ClearNewbornRoots@Base 1.9~b4
+ JS_ClearOperationCallback@Base 1.9~b4
+ JS_ClearPendingException@Base 1.9~b4
+ JS_ClearRegExpRoots@Base 1.9~b4
+ JS_ClearRegExpStatics@Base 1.9~b4
+ JS_ClearScope@Base 1.9~b4
+ JS_ClearScriptTraps@Base 1.9~b4
+ JS_ClearTrap@Base 1.9~b4
+ JS_ClearWatchPoint@Base 1.9~b4
+ JS_ClearWatchPointsForObject@Base 1.9~b4
+ JS_CloneFunctionObject@Base 1.9~b4
+ JS_CompareStrings@Base 1.9~b4
+ JS_CompareValues@Base 1.9~b4
+ JS_CompileFile@Base 1.9~b4
+ JS_CompileFileHandle@Base 1.9~b4
+ JS_CompileFileHandleForPrincipals@Base 1.9~b4
+ JS_CompileFunction@Base 1.9~b4
+ JS_CompileFunctionForPrincipals@Base 1.9~b4
+ JS_CompileScript@Base 1.9~b4
+ JS_CompileScriptForPrincipals@Base 1.9~b4
+ JS_CompileUCFunction@Base 1.9~b4
+ JS_CompileUCFunctionForPrincipals@Base 1.9~b4
+ JS_CompileUCScript@Base 1.9~b4
+ JS_CompileUCScriptForPrincipals@Base 1.9~b4
+ JS_ComputeThis@Base 1.9~b4
+ JS_ConcatStrings@Base 1.9~b4
+ JS_ConstructObject@Base 1.9~b4
+ JS_ConstructObjectWithArguments@Base 1.9~b4
+ JS_ContextIterator@Base 1.9~b4
+ JS_ConvertArguments@Base 1.9~b4
+ JS_ConvertArgumentsVA@Base 1.9~b4
+ JS_ConvertStub@Base 1.9~b4
+ JS_ConvertValue@Base 1.9~b4
+ JS_DHashAllocTable@Base 1.9~b4
+ JS_DHashClearEntryStub@Base 1.9~b4
+ JS_DHashFinalizeStub@Base 1.9~b4
+ JS_DHashFreeStringKey@Base 1.9~b4
+ JS_DHashFreeTable@Base 1.9~b4
+ JS_DHashGetStubOps@Base 1.9~b4
+ JS_DHashMatchEntryStub@Base 1.9~b4
+ JS_DHashMatchStringKey@Base 1.9~b4
+ JS_DHashMoveEntryStub@Base 1.9~b4
+ JS_DHashStringKey@Base 1.9~b4
+ JS_DHashTableDestroy@Base 1.9~b4
+ JS_DHashTableEnumerate@Base 1.9~b4
+ JS_DHashTableFinish@Base 1.9~b4
+ JS_DHashTableInit@Base 1.9~b4
+ JS_DHashTableOperate@Base 1.9~b4
+ JS_DHashTableRawRemove@Base 1.9~b4
+ JS_DHashTableSetAlphaBounds@Base 1.9~b4
+ JS_DHashVoidPtrKeyStub@Base 1.9~b4
+ JS_DecodeBytes@Base 1.9~b4
+ JS_DecompileFunction@Base 1.9~b4
+ JS_DecompileFunctionBody@Base 1.9~b4
+ JS_DecompileScript@Base 1.9~b4
+ JS_DefineConstDoubles@Base 1.9~b4
+ JS_DefineElement@Base 1.9~b4
+ JS_DefineFunction@Base 1.9~b4
+ JS_DefineFunctions@Base 1.9~b4
+ JS_DefineObject@Base 1.9~b4
+ JS_DefineProperties@Base 1.9~b4
+ JS_DefineProperty@Base 1.9~b4
+ JS_DefinePropertyWithTinyId@Base 1.9~b4
+ JS_DefineUCFunction@Base 1.9~b4
+ JS_DefineUCProperty@Base 1.9~b4
+ JS_DefineUCPropertyWithTinyId@Base 1.9~b4
+ JS_DeleteElement2@Base 1.9~b4
+ JS_DeleteElement@Base 1.9~b4
+ JS_DeleteProperty2@Base 1.9~b4
+ JS_DeleteProperty@Base 1.9~b4
+ JS_DeleteUCProperty2@Base 1.9~b4
+ JS_DestroyContext@Base 1.9~b4
+ JS_DestroyContextMaybeGC@Base 1.9~b4
+ JS_DestroyContextNoGC@Base 1.9~b4
+ JS_DestroyIdArray@Base 1.9~b4
+ JS_DestroyScript@Base 1.9~b4
+ JS_DropExceptionState@Base 1.9~b4
+ JS_DropPrincipals@Base 1.9~b4
+ JS_EncodeCharacters@Base 1.9~b4
+ JS_EncodeString@Base 1.9~b4
+ JS_EndRequest@Base 1.9~b4
+ JS_EnterLocalRootScope@Base 1.9~b4
+ JS_Enumerate@Base 1.9~b4
+ JS_EnumerateResolvedStandardClasses@Base 1.9~b4
+ JS_EnumerateStandardClasses@Base 1.9~b4
+ JS_EnumerateStub@Base 1.9~b4
+ JS_ErrorFromException@Base 1.9~b4
+ JS_EvalFramePrincipals@Base 1.9~b4
+ JS_EvaluateInStackFrame@Base 1.9~b4
+ JS_EvaluateScript@Base 1.9~b4
+ JS_EvaluateScriptForPrincipals@Base 1.9~b4
+ JS_EvaluateUCInStackFrame@Base 1.9~b4
+ JS_EvaluateUCScript@Base 1.9~b4
+ JS_EvaluateUCScriptForPrincipals@Base 1.9~b4
+ JS_ExecuteScript@Base 1.9~b4
+ JS_ExecuteScriptPart@Base 1.9~b4
+ JS_FinalizeStub@Base 1.9~b4
+ JS_Finish@Base 1.9~b4
+ JS_FinishArenaPool@Base 1.9~b4
+ JS_FlagScriptFilenamePrefix@Base 1.9~b4
+ JS_FloorLog2@Base 1.9~b4
+ JS_ForgetLocalRoot@Base 1.9~b4
+ JS_FrameIterator@Base 1.9~b4
+ JS_FreeArenaPool@Base 1.9~b4
+ JS_GC@Base 1.9~b4
+ JS_GetArrayLength@Base 1.9~b4
+ JS_GetClass@Base 1.9~b4
+ JS_GetClassObject@Base 1.9~b4
+ JS_GetConstructor@Base 1.9~b4
+ JS_GetContextPrivate@Base 1.9~b4
+ JS_GetContextThread@Base 1.9~b4
+ JS_GetElement@Base 1.9~b4
+ JS_GetEmptyStringValue@Base 1.9~b4
+ JS_GetExternalStringGCType@Base 1.9~b4
+ JS_GetFrameAnnotation@Base 1.9~b4
+ JS_GetFrameCallObject@Base 1.9~b4
+ JS_GetFrameCalleeObject@Base 1.9~b4
+ JS_GetFrameFunction@Base 1.9~b4
+ JS_GetFrameFunctionObject@Base 1.9~b4
+ JS_GetFrameObject@Base 1.9~b4
+ JS_GetFramePC@Base 1.9~b4
+ JS_GetFramePrincipalArray@Base 1.9~b4
+ JS_GetFrameReturnValue@Base 1.9~b4
+ JS_GetFrameScopeChain@Base 1.9~b4
+ JS_GetFrameScript@Base 1.9~b4
+ JS_GetFrameThis@Base 1.9~b4
+ JS_GetFunctionArity@Base 1.9~b4
+ JS_GetFunctionFastNative@Base 1.9~b4
+ JS_GetFunctionFlags@Base 1.9~b4
+ JS_GetFunctionId@Base 1.9~b4
+ JS_GetFunctionName@Base 1.9~b4
+ JS_GetFunctionNative@Base 1.9~b4
+ JS_GetFunctionObject@Base 1.9~b4
+ JS_GetFunctionScript@Base 1.9~b4
+ JS_GetFunctionTotalSize@Base 1.9~b4
+ JS_GetGlobalDebugHooks@Base 1.9~b4
+ JS_GetGlobalForObject@Base 1.9~b4
+ JS_GetGlobalObject@Base 1.9~b4
+ JS_GetImplementationVersion@Base 1.9~b4
+ JS_GetInstancePrivate@Base 1.9~b4
+ JS_GetLocaleCallbacks@Base 1.9~b4
+ JS_GetMethod@Base 1.9~b4
+ JS_GetMethodById@Base 1.9~b4
+ JS_GetNaNValue@Base 1.9~b4
+ JS_GetNegativeInfinityValue@Base 1.9~b4
+ JS_GetObjectId@Base 1.9~b4
+ JS_GetObjectTotalSize@Base 1.9~b4
+ JS_GetOperationCallback@Base 1.9~b4
+ JS_GetOperationLimit@Base 1.9~b4
+ JS_GetOptions@Base 1.9~b4
+ JS_GetParent@Base 1.9~b4
+ JS_GetPendingException@Base 1.9~b4
+ JS_GetPositiveInfinityValue@Base 1.9~b4
+ JS_GetPrivate@Base 1.9~b4
+ JS_GetProperty@Base 1.9~b4
+ JS_GetPropertyAttributes@Base 1.9~b4
+ JS_GetPropertyAttrsGetterAndSetter@Base 1.9~b4
+ JS_GetPropertyDesc@Base 1.9~b4
+ JS_GetPropertyDescArray@Base 1.9~b4
+ JS_GetPrototype@Base 1.9~b4
+ JS_GetReservedSlot@Base 1.9~b4
+ JS_GetRuntime@Base 1.9~b4
+ JS_GetRuntimePrivate@Base 1.9~b4
+ JS_GetScopeChain@Base 1.9~b4
+ JS_GetScriptBaseLineNumber@Base 1.9~b4
+ JS_GetScriptFilename@Base 1.9~b4
+ JS_GetScriptFilenameFlags@Base 1.9~b4
+ JS_GetScriptLineExtent@Base 1.9~b4
+ JS_GetScriptObject@Base 1.9~b4
+ JS_GetScriptPrincipals@Base 1.9~b4
+ JS_GetScriptTotalSize@Base 1.9~b4
+ JS_GetScriptVersion@Base 1.9~b4
+ JS_GetScriptedCaller@Base 1.9~b4
+ JS_GetStringBytes@Base 1.9~b4
+ JS_GetStringChars@Base 1.9~b4
+ JS_GetStringLength@Base 1.9~b4
+ JS_GetTopScriptFilenameFlags@Base 1.9~b4
+ JS_GetTrapOpcode@Base 1.9~b4
+ JS_GetTypeName@Base 1.9~b4
+ JS_GetUCProperty@Base 1.9~b4
+ JS_GetUCPropertyAttributes@Base 1.9~b4
+ JS_GetUCPropertyAttrsGetterAndSetter@Base 1.9~b4
+ JS_GetVersion@Base 1.9~b4
+ JS_HandleTrap@Base 1.9~b4
+ JS_HasArrayLength@Base 1.9~b4
+ JS_HasElement@Base 1.9~b4
+ JS_HasInstance@Base 1.9~b4
+ JS_HasProperty@Base 1.9~b4
+ JS_HasUCProperty@Base 1.9~b4
+ JS_HashString@Base 1.9~b4
+ JS_HashTableAdd@Base 1.9~b4
+ JS_HashTableDestroy@Base 1.9~b4
+ JS_HashTableDump@Base 1.9~b4
+ JS_HashTableEnumerateEntries@Base 1.9~b4
+ JS_HashTableLookup@Base 1.9~b4
+ JS_HashTableRawAdd@Base 1.9~b4
+ JS_HashTableRawLookup@Base 1.9~b4
+ JS_HashTableRawRemove@Base 1.9~b4
+ JS_HashTableRemove@Base 1.9~b4
+ JS_HoldPrincipals@Base 1.9~b4
+ JS_IdToValue@Base 1.9~b4
+ JS_Init@Base 1.9~b4
+ JS_InitArenaPool@Base 1.9~b4
+ JS_InitClass@Base 1.9~b4
+ JS_InitStandardClasses@Base 1.9~b4
+ JS_InstanceOf@Base 1.9~b4
+ JS_InternString@Base 1.9~b4
+ JS_InternUCString@Base 1.9~b4
+ JS_InternUCStringN@Base 1.9~b4
+ JS_IsAboutToBeFinalized@Base 1.9~b4
+ JS_IsArrayObject@Base 1.9~b4
+ JS_IsAssigning@Base 1.9~b4
+ JS_IsConstructing@Base 1.9~b4
+ JS_IsConstructorFrame@Base 1.9~b4
+ JS_IsDebuggerFrame@Base 1.9~b4
+ JS_IsExceptionPending@Base 1.9~b4
+ JS_IsGCMarkingTracer@Base 1.9~b4
+ JS_IsNativeFrame@Base 1.9~b4
+ JS_IsRunning@Base 1.9~b4
+ JS_IsSystemObject@Base 1.9~b4
+ JS_LeaveLocalRootScope@Base 1.9~b4
+ JS_LeaveLocalRootScopeWithResult@Base 1.9~b4
+ JS_LineNumberToPC@Base 1.9~b4
+ JS_Lock@Base 1.9~b4
+ JS_LockGCThing@Base 1.9~b4
+ JS_LockGCThingRT@Base 1.9~b4
+ JS_LookupElement@Base 1.9~b4
+ JS_LookupProperty@Base 1.9~b4
+ JS_LookupPropertyWithFlags@Base 1.9~b4
+ JS_LookupUCProperty@Base 1.9~b4
+ JS_MakeStringImmutable@Base 1.9~b4
+ JS_MapGCRoots@Base 1.9~b4
+ JS_MarkGCThing@Base 1.9~b4
+ JS_MaybeGC@Base 1.9~b4
+ JS_NewArrayObject@Base 1.9~b4
+ JS_NewContext@Base 1.9~b4
+ JS_NewDHashTable@Base 1.9~b4
+ JS_NewDependentString@Base 1.9~b4
+ JS_NewDouble@Base 1.9~b4
+ JS_NewDoubleValue@Base 1.9~b4
+ JS_NewExternalString@Base 1.9~b4
+ JS_NewFunction@Base 1.9~b4
+ JS_NewGrowableString@Base 1.9~b4
+ JS_NewHashTable@Base 1.9~b4
+ JS_NewNumberValue@Base 1.9~b4
+ JS_NewObject@Base 1.9~b4
+ JS_NewObjectWithGivenProto@Base 1.9~b4
+ JS_NewPropertyIterator@Base 1.9~b4
+ JS_NewRegExpObject@Base 1.9~b4
+ JS_NewScriptObject@Base 1.9~b4
+ JS_NewString@Base 1.9~b4
+ JS_NewStringCopyN@Base 1.9~b4
+ JS_NewStringCopyZ@Base 1.9~b4
+ JS_NewSystemObject@Base 1.9~b4
+ JS_NewUCRegExpObject@Base 1.9~b4
+ JS_NewUCString@Base 1.9~b4
+ JS_NewUCStringCopyN@Base 1.9~b4
+ JS_NewUCStringCopyZ@Base 1.9~b4
+ JS_NextProperty@Base 1.9~b4
+ JS_Now@Base 1.9~b4
+ JS_ObjectIsFunction@Base 1.9~b4
+ JS_PCToLineNumber@Base 1.9~b4
+ JS_PopArguments@Base 1.9~b4
+ JS_PropertyIterator@Base 1.9~b4
+ JS_PropertyStub@Base 1.9~b4
+ JS_PushArguments@Base 1.9~b4
+ JS_PushArgumentsVA@Base 1.9~b4
+ JS_PutPropertyDescArray@Base 1.9~b4
+ JS_RemoveArgumentFormatter@Base 1.9~b4
+ JS_RemoveExternalStringFinalizer@Base 1.9~b4
+ JS_RemoveRoot@Base 1.9~b4
+ JS_RemoveRootRT@Base 1.9~b4
+ JS_ReportAllocationOverflow@Base 1.9~b5
+ JS_ReportError@Base 1.9~b4
+ JS_ReportErrorFlagsAndNumber@Base 1.9~b4
+ JS_ReportErrorFlagsAndNumberUC@Base 1.9~b4
+ JS_ReportErrorNumber@Base 1.9~b4
+ JS_ReportErrorNumberUC@Base 1.9~b4
+ JS_ReportOutOfMemory@Base 1.9~b4
+ JS_ReportPendingException@Base 1.9~b4
+ JS_ReportWarning@Base 1.9~b4
+ JS_ResolveStandardClass@Base 1.9~b4
+ JS_ResolveStub@Base 1.9~b4
+ JS_RestoreExceptionState@Base 1.9~b4
+ JS_RestoreFrameChain@Base 1.9~b4
+ JS_ResumeRequest@Base 1.9~b4
+ JS_SaveExceptionState@Base 1.9~b4
+ JS_SaveFrameChain@Base 1.9~b4
+ JS_SealObject@Base 1.9~b4
+ JS_SetArrayLength@Base 1.9~b4
+ JS_SetBranchCallback@Base 1.9~b4
+ JS_SetCStringsAreUTF8@Base 1.9~b4
+ JS_SetCallHook@Base 1.9~b4
+ JS_SetCallReturnValue2@Base 1.9~b4
+ JS_SetCheckObjectAccessCallback@Base 1.9~b4
+ JS_SetContextCallback@Base 1.9~b4
+ JS_SetContextDebugHooks@Base 1.9~b4
+ JS_SetContextPrivate@Base 1.9~b4
+ JS_SetContextThread@Base 1.9~b4
+ JS_SetDebugErrorHook@Base 1.9~b4
+ JS_SetDebuggerHandler@Base 1.9~b4
+ JS_SetDestroyScriptHookProc@Base 1.9~b4
+ JS_SetElement@Base 1.9~b4
+ JS_SetErrorReporter@Base 1.9~b4
+ JS_SetExecuteHook@Base 1.9~b4
+ JS_SetExtraGCRoots@Base 1.9~b4
+ JS_SetFrameAnnotation@Base 1.9~b4
+ JS_SetFrameReturnValue@Base 1.9~b4
+ JS_SetGCCallback@Base 1.9~b4
+ JS_SetGCCallbackRT@Base 1.9~b4
+ JS_SetGCParameter@Base 1.9~b4
+ JS_SetGlobalObject@Base 1.9~b4
+ JS_SetInterrupt@Base 1.9~b4
+ JS_SetLocaleCallbacks@Base 1.9~b4
+ JS_SetNewScriptHookProc@Base 1.9~b4
+ JS_SetObjectHook@Base 1.9~b4
+ JS_SetObjectPrincipalsFinder@Base 1.9~b4
+ JS_SetOperationCallback@Base 1.9~b4
+ JS_SetOperationLimit@Base 1.9~b4
+ JS_SetOptions@Base 1.9~b4
+ JS_SetParent@Base 1.9~b4
+ JS_SetPendingException@Base 1.9~b4
+ JS_SetPrincipalsTranscoder@Base 1.9~b4
+ JS_SetPrivate@Base 1.9~b4
+ JS_SetProperty@Base 1.9~b4
+ JS_SetPropertyAttributes@Base 1.9~b4
+ JS_SetPrototype@Base 1.9~b4
+ JS_SetRegExpInput@Base 1.9~b4
+ JS_SetReservedSlot@Base 1.9~b4
+ JS_SetRuntimePrivate@Base 1.9~b4
+ JS_SetScriptStackQuota@Base 1.9~b4
+ JS_SetSourceHandler@Base 1.9~b4
+ JS_SetThreadStackLimit@Base 1.9~b4
+ JS_SetThrowHook@Base 1.9~b4
+ JS_SetTrap@Base 1.9~b4
+ JS_SetUCProperty@Base 1.9~b4
+ JS_SetUCPropertyAttributes@Base 1.9~b4
+ JS_SetVersion@Base 1.9~b4
+ JS_SetWatchPoint@Base 1.9~b4
+ JS_ShutDown@Base 1.9~b4
+ JS_StackFramePrincipals@Base 1.9~b4
+ JS_StringToVersion@Base 1.9~b4
+ JS_SuspendRequest@Base 1.9~b4
+ JS_ThrowReportedError@Base 1.9~b4
+ JS_ThrowStopIteration@Base 1.9~b4
+ JS_ToggleOptions@Base 1.9~b4
+ JS_TraceChildren@Base 1.9~b4
+ JS_TraceRuntime@Base 1.9~b4
+ JS_TypeOfValue@Base 1.9~b4
+ JS_UndependString@Base 1.9~b4
+ JS_Unlock@Base 1.9~b4
+ JS_UnlockGCThing@Base 1.9~b4
+ JS_UnlockGCThingRT@Base 1.9~b4
+ JS_ValueToBoolean@Base 1.9~b4
+ JS_ValueToConstructor@Base 1.9~b4
+ JS_ValueToECMAInt32@Base 1.9~b4
+ JS_ValueToECMAUint32@Base 1.9~b4
+ JS_ValueToFunction@Base 1.9~b4
+ JS_ValueToId@Base 1.9~b4
+ JS_ValueToInt32@Base 1.9~b4
+ JS_ValueToNumber@Base 1.9~b4
+ JS_ValueToObject@Base 1.9~b4
+ JS_ValueToString@Base 1.9~b4
+ JS_ValueToUint16@Base 1.9~b4
+ JS_VersionToString@Base 1.9~b4
+ JS_XDRBytes@Base 1.9~b4
+ JS_XDRCString@Base 1.9~b4
+ JS_XDRCStringOrNull@Base 1.9~b4
+ JS_XDRDestroy@Base 1.9~b4
+ JS_XDRDouble@Base 1.9~b4
+ JS_XDRFindClassById@Base 1.9~b4
+ JS_XDRFindClassIdByName@Base 1.9~b4
+ JS_XDRInitBase@Base 1.9~b4
+ JS_XDRMemDataLeft@Base 1.9~b4
+ JS_XDRMemGetData@Base 1.9~b4
+ JS_XDRMemResetData@Base 1.9~b4
+ JS_XDRMemSetData@Base 1.9~b4
+ JS_XDRNewMem@Base 1.9~b4
+ JS_XDRRegisterClass@Base 1.9~b4
+ JS_XDRScript@Base 1.9~b4
+ JS_XDRString@Base 1.9~b4
+ JS_XDRStringOrNull@Base 1.9~b4
+ JS_XDRUint16@Base 1.9~b4
+ JS_XDRUint32@Base 1.9~b4
+ JS_XDRUint8@Base 1.9~b4
+ JS_XDRValue@Base 1.9~b4
+ JS_YieldRequest@Base 1.9~b4
+ JS_dtobasestr@Base 1.9~b4
+ JS_dtostr@Base 1.9~b4
+ JS_free@Base 1.9~b4
+ JS_malloc@Base 1.9~b4
+ JS_realloc@Base 1.9~b4
+ JS_smprintf@Base 1.9~b4
+ JS_smprintf_free@Base 1.9~b4
+ JS_snprintf@Base 1.9~b4
+ JS_sprintf_append@Base 1.9~b4
+ JS_strdup@Base 1.9~b4
+ JS_strtod@Base 1.9~b4
+ JS_sxprintf@Base 1.9~b4
+ JS_vsmprintf@Base 1.9~b4
+ JS_vsnprintf@Base 1.9~b4
+ JS_vsprintf_append@Base 1.9~b4
+ JS_vsxprintf@Base 1.9~b4
+ js_AllocStack@Base 1.9~b4
+ js_AnyNameClass@Base 1.9~b4
+ js_AttributeNameClass@Base 1.9~b4
+ js_CallClass@Base 1.9~b4
+ js_CallDestroyScriptHook@Base 1.9~rc1
+ js_CallIteratorNext@Base 1.9~b4
+ js_CallNewScriptHook@Base 1.9~rc1
+ js_CloseIterator@Base 1.9~b4
+ js_DateGetDate@Base 1.9~b4
+ js_DateGetHours@Base 1.9~b4
+ js_DateGetMinutes@Base 1.9~b4
+ js_DateGetMonth@Base 1.9~b4
+ js_DateGetMsecSinceEpoch@Base 1.9~b4
+ js_DateGetSeconds@Base 1.9~b4
+ js_DateGetYear@Base 1.9~b4
+ js_DateIsValid@Base 1.9~b4
+ js_DateSetDate@Base 1.9~b4
+ js_DateSetHours@Base 1.9~b4
+ js_DateSetMinutes@Base 1.9~b4
+ js_DateSetMonth@Base 1.9~b4
+ js_DateSetSeconds@Base 1.9~b4
+ js_DateSetYear@Base 1.9~b4
+ js_FindProperty@Base 1.9~b4
+ js_FinishCodeGenerator@Base 1.9~b4
+ js_FreeStack@Base 1.9~b4
+ js_FunctionClass@Base 1.9~b4
+ js_GetGCThingTraceKind@Base 1.9~b4
+ js_GetScriptLineExtent@Base 1.9~b4
+ js_GetSlotThreadSafe@Base 1.9~b4
+ js_GetSrcNoteOffset@Base 1.9~b4
+ js_GetterOnlyPropertyStub@Base 1.9.0.12
+ js_InitCodeGenerator@Base 1.9~b4
+ js_Invoke@Base 1.9~b4
+ js_LookupProperty@Base 1.9~b4
+ js_MapKeywords@Base 1.9~b4
+ js_NamespaceClass@Base 1.9~b4
+ js_NewDateObject@Base 1.9~b4
+ js_NewDateObjectMsec@Base 1.9~b4
+ js_ObjectOps@Base 1.9~b4
+ js_ParseXMLText@Base 1.9~b4
+ js_PutArgsObject@Base 1.9~b4
+ js_PutCallObject@Base 1.9~b4
+ js_QNameClass@Base 1.9~b4
+ js_ReportErrorAgain@Base 1.9~b4
+ js_RestoreRegExpStatics@Base 1.9.0.15
+ js_SaveAndClearRegExpStatics@Base 1.9.0.15
+ js_ScriptClass@Base 1.9~b4
+ js_SearchScope@Base 1.9~b4
+ js_SetObjectWeakRoot@Base 1.9.0.19-7
+ js_SrcNoteLength@Base 1.9~b4
+ js_SrcNoteSpec@Base 1.9~b4
+ js_TraceContext@Base 1.9~b4
+ js_ValueToIterator@Base 1.9~b4
+ js_ValueToPrintable@Base 1.9~b4
+ js_ValueToSource@Base 1.9~b4
+ js_ValueToString@Base 1.9~b4
+ js_WithObjectOps@Base 1.9~b4
+ js_XMLClass@Base 1.9~b4
+ js_XMLObjectOps@Base 1.9~b4
+ js_fgets@Base 1.9~b4
+ resolving_MatchEntry@Base 1.9~b4
--- xulrunner-1.9.0.19.orig/debian/spidermonkey-bin.dirs
+++ xulrunner-1.9.0.19/debian/spidermonkey-bin.dirs
@@ -0,0 +1 @@
+usr/bin
--- xulrunner-1.9.0.19.orig/debian/postinstrm.in
+++ xulrunner-1.9.0.19/debian/postinstrm.in
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+set -e
+
+dpkg-trigger --check-supported > /dev/null 2>&1 ||
+if [ "$1" = "configure" ] || [ "$1" = "abort-install" ] ||
+   [ "$1" = "abort-upgrade" ]; then
+    touch /usr/lib/xulrunner-1.9/.autoreg
+    rm -f /usr/lib/xulrunner-1.9/components/compreg.dat \
+          /usr/lib/xulrunner-1.9/components/xpti.dat
+    cd /usr/lib/xulrunner-1.9
+    export HOME=`mktemp -d`
+    ./run-mozilla.sh ./xpcshell -e "" ||
+    rm -f /usr/lib/xulrunner-1.9/components/compreg.dat \
+          /usr/lib/xulrunner-1.9/components/xpti.dat
+    rm -rf "$HOME"
+fi
+
+#DEBHELPER#
+
--- xulrunner-1.9.0.19.orig/debian/xulrunner-1.9-gnome-support.install
+++ xulrunner-1.9.0.19/debian/xulrunner-1.9-gnome-support.install
@@ -0,0 +1,3 @@
+usr/lib/xulrunner-1.9/components/libdbusservice.so
+usr/lib/xulrunner-1.9/components/libmozgnome.so
+usr/lib/xulrunner-1.9/components/libnkgnomevfs.so
--- xulrunner-1.9.0.19.orig/debian/compat
+++ xulrunner-1.9.0.19/debian/compat
@@ -0,0 +1 @@
+5
--- xulrunner-1.9.0.19.orig/debian/mozconfig
+++ xulrunner-1.9.0.19/debian/mozconfig
@@ -0,0 +1,44 @@
+. $topsrcdir/xulrunner/config/mozconfig
+ac_add_options --prefix=/usr
+ac_add_options --with-default-mozilla-five-home=/usr/lib/xulrunner-1.9
+ac_add_options --enable-default-toolkit=cairo-gtk2
+ac_add_options --enable-pango
+ac_add_options --enable-xft
+ac_add_options --disable-freetype2
+ac_add_options --enable-system-cairo
+ac_add_options --with-system-png
+ac_add_options --with-system-jpeg
+ac_add_options --with-system-zlib
+ac_add_options --with-system-bz2
+ac_add_options --with-gssapi=/usr
+ac_add_options --with-system-nspr
+ac_add_options --with-system-nss
+ac_add_options --enable-xinerama
+ac_add_options --enable-single-profile
+ac_add_options --disable-profilesharing
+ac_add_options --enable-svg
+ac_add_options --enable-svg-renderer=cairo
+ac_add_options --enable-mathml
+ac_add_options --disable-pedantic
+ac_add_options --disable-long-long-warning
+ac_add_options --enable-gnomevfs
+ac_add_options --enable-gnomeui
+ac_add_options --disable-tests
+ac_add_options --disable-mochitest
+ac_add_options --disable-debug
+ac_add_options --enable-canvas
+#ac_add_options --disable-xpcom-obsolete
+ac_add_options --enable-js-binary
+ac_add_options --with-readline
+ac_add_options --enable-extensions="default cookie permissions python/xpcom spellcheck"
+ac_add_options --disable-installer
+ac_add_options --disable-javaxpcom
+ac_add_options --disable-elf-dynstr-gc
+ac_add_options --enable-system-hunspell
+ac_add_options --disable-crashreporter
+ac_add_options --enable-system-sqlite
+ac_add_options --enable-system-lcms
+ac_add_options --disable-strip
+ac_add_options --disable-install-strip
+ac_add_options --enable-url-classifier
+ac_add_options --enable-startup-notification
--- xulrunner-1.9.0.19.orig/debian/xulrunner-dev.install
+++ xulrunner-1.9.0.19/debian/xulrunner-dev.install
@@ -0,0 +1,13 @@
+usr/include/xulrunner-1.9
+usr/share/idl
+usr/lib/xulrunner-devel-1.9
+usr/lib/pkgconfig/libxul-unstable.pc
+usr/lib/pkgconfig/libxul-embedding-unstable.pc
+usr/lib/pkgconfig/libxul.pc
+usr/lib/pkgconfig/libxul-embedding.pc
+usr/lib/pkgconfig/mozilla-gtkmozembed.pc
+usr/lib/pkgconfig/mozilla-gtkmozembed-embedding.pc
+usr/lib/pkgconfig/mozilla-plugin.pc
+usr/lib/xulrunner-1.9/xpt_dump
+usr/lib/xulrunner-1.9/xpt_link
+usr/lib/xulrunner-1.9/xpidl
--- xulrunner-1.9.0.19.orig/debian/spidermonkey-bin.prerm
+++ xulrunner-1.9.0.19/debian/spidermonkey-bin.prerm
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+set -e
+
+if [ "$1" = "remove" ]; then
+    update-alternatives --remove js /usr/bin/smjs
+fi
+
+#DEBHELPER#
--- xulrunner-1.9.0.19.orig/debian/spidermonkey-bin.postinst
+++ xulrunner-1.9.0.19/debian/spidermonkey-bin.postinst
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+set -e
+
+if [ "$1" = "configure" ]; then
+    update-alternatives --install /usr/bin/js js /usr/bin/smjs 200 \
+                        --slave /usr/share/man/man1/js.1.gz js.1.gz /usr/share/man/man1/smjs.1.gz
+fi
+
+#DEBHELPER#
+
--- xulrunner-1.9.0.19.orig/debian/libmozillainterfaces-java.install
+++ xulrunner-1.9.0.19/debian/libmozillainterfaces-java.install
@@ -0,0 +1,4 @@
+usr/lib/xulrunner-1.9/javaxpcom.jar
+usr/lib/xulrunner-devel-1.9/sdk/lib/MozillaGlue.jar
+usr/lib/xulrunner-devel-1.9/sdk/lib/MozillaInterfaces.jar usr/share/java
+usr/lib/xulrunner-devel-1.9/sdk/lib/MozillaInterfaces-src.jar
--- xulrunner-1.9.0.19.orig/debian/libmozillainterfaces-java.links
+++ xulrunner-1.9.0.19/debian/libmozillainterfaces-java.links
@@ -0,0 +1 @@
+usr/share/java/MozillaInterfaces.jar usr/lib/xulrunner-devel-1.9/sdk/lib/MozillaInterfaces.jar
--- xulrunner-1.9.0.19.orig/debian/spidermonkey-bin.menu
+++ xulrunner-1.9.0.19/debian/spidermonkey-bin.menu
@@ -0,0 +1,2 @@
+?package(spidermonkey-bin):needs="text" section="Applications/Programming" \
+  title="SpiderMonkey JavaScript Interpreter" command="/usr/bin/smjs"
--- xulrunner-1.9.0.19.orig/debian/remove.nonfree
+++ xulrunner-1.9.0.19/debian/remove.nonfree
@@ -0,0 +1,84 @@
+#! /bin/sh
+
+rm -fv ./modules/oji/tests/script/killer.exe
+rm -fv ./memory/jemalloc/ed.exe
+rm -fv ./toolkit/crashreporter/tools/win32/dump_syms.exe
+rm -fv ./modules/plugin/samples/default/mac/NullPlugin.rsrc
+rm -fv "./modules/plugin/tools/sdk/samples/basic/mac/Basic Plugin.mcp"
+rm -fv ./modules/plugin/tools/sdk/samples/basic/mac/Basic.rsrc
+rm -fv "./modules/plugin/tools/sdk/samples/scriptable/mac/Scriptable Plugin.mcp"
+rm -fv "./modules/plugin/tools/sdk/samples/scriptable/mac/Scriptable PluginIDL.mcp"
+rm -fv ./modules/plugin/tools/sdk/samples/scriptable/mac/Scriptable.rsrc
+rm -fv ./other-licenses/7zstub/firefox/7zSD.sfx
+rm -fv ./toolkit/mozapps/update/src/updater/macbuild/Contents/Resources/English.lproj/MainMenu.nib/keyedobjects.nib
+rm -fv ./toolkit/mozapps/update/src/updater/macbuild/Contents/PkgInfo
+rm -fv ./extensions/manticore/resources/manticore.psd
+rm -fv ./extensions/universalchardet/doc/UniversalCharsetDetection.doc
+rm -fv ./config/bin2rc.exe
+rm -fv ./config/makedep.exe
+rm -fv ./config/mangle.exe
+rm -fv ./config/mantomak.exe
+rm -fv ./embedding/browser/activex/src/pluginhostctrl/cab/redist/ATL.DLL
+rm -fv ./embedding/browser/activex/tests/vbrowse/browser.frx
+rm -fv ./embedding/browser/activex/tests/vbrowse/frmToolBar.frx
+rm -fv ./embedding/qa/testembed/testembed.aps
+rm -fv ./embedding/tests/MSDotNETCSEmbed/MSDotNETCSEmbed.suo
+rm -fv ./embedding/tests/cocoaEmbed/res/English.lproj/MainMenu.nib/objects.nib
+rm -fv ./embedding/wrappers/DotNETEmbed/DotNETEmbed.snk
+rm -fv ./intl/unicharutil/tools/data/case.dat
+rm -fv ./intl/unicharutil/tools/data/cmbcl.dat
+rm -fv ./intl/unicharutil/tools/data/ctype.dat
+rm -fv ./intl/unicharutil/tools/data/decomp.dat
+rm -fv ./intl/unicharutil/tools/data/num.dat
+rm -fv ./js/src/fdlibm/fdlibm.mdp
+rm -fv ./js/src/js.mdp
+rm -fv ./js/src/liveconnect/jsj_nodl.c
+rm -fv ./plugin/oji/JEP/MRJPlugin.plugin/Contents/MacOS/MRJPlugin
+rm -fv ./plugin/oji/JEP/MRJPlugin.plugin/Contents/MacOS/MRJPlugin.jar
+rm -fv ./plugin/oji/JEP/MRJPlugin.plugin/Contents/Resources/MRJPlugin.rsrc
+rm -fv ./plugin/oji/JEP/JavaEmbeddingPlugin.bundle/Contents/MacOS/JavaEmbeddingPlugin
+rm -fv ./plugin/oji/JEP/JavaEmbeddingPlugin.bundle/Contents/Resources/Java/JavaEmbeddingPlugin.jar
+rm -fv ./plugin/oji/MRJ/plugin/Resources/Dialogs.rsrc
+rm -fv ./plugin/oji/MRJ/plugin/Resources/Strings.rsrc
+rm -fv ./plugin/oji/MRJ/plugin/Resources/Version.rsrc
+rm -fv ./plugin/oji/MRJ/plugin/MRJPlugin.jar
+rm -fv ./plugin/oji/MRJ/plugin/netscape.plugin.jar
+rm -fv ./plugin/oji/MRJ/plugin/Source/JMURLConnection
+rm -fv ./plugin/oji/MRJ/testing/ConsoleApplet/ConsoleApplet.mcp
+rm -fv ./plugin/oji/MRJ/testing/JSApplet/JSApplet.mcp
+rm -fv ./plugin/oji/MRJ/testing/SwingApplet/TestApplet.mcp
+rm -fv ./plugin/oji/MRJ/testing/TrivialApplet/MyApplet.mcp
+rm -fv ./plugin/oji/MRJCarbon/MRJSDK/JavaFrameworks/JavaEmbeddingLib
+rm -fv ./plugin/oji/MRJCarbon/plugin/MRJPlugin.jar
+rm -fv ./plugin/oji/MRJCarbon/plugin/Resources/Dialogs.rsrc
+rm -fv ./plugin/oji/MRJCarbon/plugin/Resources/Strings.rsrc
+rm -fv ./plugin/oji/MRJCarbon/plugin/Resources/Version.rsrc
+rm -fv ./xpcom/reflect/xptcall/tests/eVC4/XPTCInvoke_Testing.cpp
+rm -fv ./xpcom/tests/StringFactoringTests/StringTest.mcp
+rm -fv ./xpcom/typelib/xpidl/macplugin/compiler.rsrc
+rm -fv ./xpcom/typelib/xpidl/macplugin/linker.rsrc
+rm -fv ./xpcom/typelib/xpidl/macplugin/panel.rsrc
+rm -fv ./xpcom/typelib/xpidl/macplugin/version.rsrc
+rm -fv ./xpinstall/test/pre_checkin.xpi
+rm -fv ./layout/doc/SpaceMgr_BlockReflSt_OD.sda
+rm -fv ./layout/doc/object_diagram_template.sda
+rm -fv ./layout/html/tests/block/bugs/RealSnow.jar
+rm -fv ./xpfe/bootstrap/appleevents/nsAppleEvents.rsrc
+rm -fv ./toolkit/mozapps/installer/windows/nsis/AppAssocReg.dll
+rm -fv ./toolkit/mozapps/installer/windows/nsis/UAC.dll
+rm -fv ./toolkit/mozapps/installer/windows/nsis/Processes.dll
+rm -fv ./toolkit/mozapps/installer/windows/nsis/ShellLink.dll
+rm -fv ./toolkit/mozapps/installer/windows/nsis/nsProcess.dll
+rm -fv ./toolkit/crashreporter/google-breakpad/src/tools/solaris/dump_syms/testdata/dump_syms_regtest.o
+
+echo also we need to remove any copyrighted image files from the mozilla src  suite,  not replaced by the branding process. This includes theme throbbers depending on how you handle that and windows icons, app icons, windows splash etc
+
+rm -fvr ./other-licenses/7zstub
+rm -fvr ./other-licenses/branding
+rm -fv README/mozilla/README.os2
+
+rm -fv netwerk/protocol/ftp/doc/rfc959.txt
+
+# CVS stuff
+find . -type d -name CVS | xargs rm -rf
+find . -type f -name .cvsignore | xargs rm -f
--- xulrunner-1.9.0.19.orig/debian/rules
+++ xulrunner-1.9.0.19/debian/rules
@@ -0,0 +1,277 @@
+#!/usr/bin/make -f
+# -*- makefile -*-
+# Sample debian/rules that uses debhelper.
+# This file was originally written by Joey Hess and Craig Small.
+# As a special exception, when this file is copied by dh-make into a
+# dh-make output file, you may use that output file without restriction.
+# This special exception was added by Craig Small in version 0.37 of dh-make.
+
+# Uncomment this to turn on verbose mode.
+#export DH_VERBOSE=1
+
+# These are used for cross-compiling and for saving the configure script
+# from having to guess our platform (since we know it already)
+DEB_HOST_GNU_TYPE   ?= $(shell dpkg-architecture -qDEB_HOST_GNU_TYPE)
+DEB_BUILD_GNU_TYPE  ?= $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE)
+DEB_BUILD_ARCH  ?= $(shell dpkg-architecture -qDEB_BUILD_ARCH)
+
+DEBIAN_VERSION := $(shell dpkg-parsechangelog | sed -n 's/^Version: *\(.*\)$$/\1/ p')
+UPSTREAM_VERSION := $(shell dpkg-parsechangelog | sed -n 's/^Version: *\(.*\)-.*$$/\1/ p')
+
+PYVER := $(shell pyversions -d)
+
+CFLAGS := -g
+LDFLAGS := -Wl,--as-needed
+
+AUTOCONF_DIRS := build/autoconf
+
+JAVA_VARS := \
+	MOZ_JAVAXPCOM=1 \
+	JAVA_INCLUDE_PATH=$(CURDIR)/sun-java/stubs/include \
+	JAVAC=javac \
+	JAR=jar \
+
+ifneq (,$(findstring noopt,$(DEB_BUILD_OPTIONS)))
+	CONFIGURE_FLAGS += --disable-optimize
+endif
+
+ifeq ($(DEB_BUILD_ARCH),alpha)
+	LDFLAGS += -Wl,--no-relax
+endif
+
+ifeq ($(DEB_BUILD_ARCH),ppc64)
+	CFLAGS += -mminimal-toc
+endif
+
+ifneq (,$(findstring debug,$(DEB_BUILD_OPTIONS)))
+	CONFIGURE_FLAGS += --enable-debug
+else
+	GENSYMBOLS_FLAGS := -c4
+endif
+
+DH_INSTALL_FILES := $(foreach arch, kfreebsd-i386 kfreebsd-amd64, debian/xulrunner-1.9.install.$(arch))
+COMPONENT_PACKAGES := python-xpcom xulrunner-1.9-gnome-support
+COMPONENT_SCRIPTS := $(COMPONENT_PACKAGES:%=debian/%.postinst) $(COMPONENT_PACKAGES:%=debian/%.postrm)
+GENERATED_FILES := $(COMPONENT_SCRIPTS) $(DH_INSTALL_FILES) debian/xulrunner-1.9.postinst
+$(COMPONENT_SCRIPTS): %: debian/postinstrm.in
+	cp $^ $@
+
+debian/xulrunner-1.9.postinst: debian/postinstrm.in
+	sed 's/abort-install/triggered/;/^dpkg-trigger/d' $^ > $@
+
+$(DH_INSTALL_FILES): debian/xulrunner-1.9.install
+	grep -v jemalloc $< > $@
+
+config.status: ./configure debian/mozconfig
+	dh_testdir
+
+	for dir in $(AUTOCONF_DIRS); do \
+		for file in config.guess config.sub; do \
+			sed -i '2!b;/^#/ i\exec "/usr/share/misc/'$$file'" "$$@"' $$dir/$$file; \
+		done; \
+	done
+
+	# Add here commands to configure the package.
+	JAVA_HOME=/usr/lib/jvm/java-gcj \
+	MOZCONFIG=debian/mozconfig \
+	ASFLAGS="-g" \
+	CFLAGS="$(CFLAGS)" \
+	CXXFLAGS="$(CFLAGS)" \
+	./configure --host=$(DEB_HOST_GNU_TYPE) --build=$(DEB_BUILD_GNU_TYPE) \
+	            $(CONFIGURE_FLAGS)
+
+build: build-stamp
+
+build-stamp:  config.status
+	dh_testdir
+
+	# Add here commands to compile the package.
+	LD_LIBRARY_PATH=$(CURDIR)/dist/lib \
+	$(MAKE) \
+		PYTHON_SO=$(shell objdump -p /usr/lib/lib$(PYVER).so | awk '/SONAME/ {print $$2}') \
+		$(JAVA_VARS) \
+		DEB_NO_JAR=1 \
+		OS_LDFLAGS="$(LDFLAGS) $(shell sed -n 's/^OS_LDFLAGS\s*=\s*//p' config/autoconf.mk)"
+	#docbook-to-man debian/xulrunner.sgml > xulrunner.1
+
+	touch build-stamp
+
+TEST =	( if ( \
+		cd dist/bin; \
+		GNOME22_USER_DIR="$(CURDIR)/dist/.gnome2" \
+		HOME="$(CURDIR)/dist" \
+		xvfb-run -a sh -c "./xulrunner '$(CURDIR)/debian/test/application.ini' 2> /dev/null" || \
+			echo "xulrunner test exited with code $$?" >&2; \
+	) | grep -q '^unload$$'; then \
+		echo "xulrunner test successful" >&2; \
+	else \
+		echo "xulrunner test failed" >&2; \
+		exit 1; \
+	fi )
+
+test: build-stamp
+	dh_testdir
+
+	# xpcshell should be enough to trigger xptc invoke/stubs breakages
+	@cd dist/bin && \
+	./run-mozilla.sh ./xpcshell -e \
+		"var f = Components.classes['@mozilla.org/file/local;1'] \
+		         .createInstance(Components.interfaces.nsILocalFile); \
+		 f.initWithPath('/'); \
+		 dump('xpcshell test ' + (f.isDirectory() ? 'successful' : 'failed') + '\n');"
+
+	# basic test
+	$(call TEST)
+
+build-jars: build-jars-stamp
+
+build-jars-stamp: build-stamp
+	$(MAKE) -C extensions/java/xpcom/interfaces $(JAVA_VARS)
+	$(MAKE) -C extensions/java/xpcom/src jar-libs $(JAVA_VARS)
+	
+	touch build-jars-stamp
+
+clean:
+	dh_testdir
+	dh_testroot
+	rm -f build*-stamp install*-stamp mozilla MPL debian/*.shlibs.local
+	rm -rf debian/include
+	rm -f $(GENERATED_FILES)
+
+	# Add here commands to clean up after the build process.
+	[ ! -f Makefile ] || $(MAKE) distclean $(JAVA_VARS)
+
+	for dir in $(AUTOCONF_DIRS); do \
+		for file in config.guess config.sub; do \
+			sed -i '2!b;/^exec "/ d' $$dir/$$file; \
+		done; \
+	done
+
+	dh_clean 
+
+install: install-stamp
+
+install-stamp: build-stamp
+	dh_testdir
+	dh_testroot
+	dh_clean -k 
+	dh_installdirs
+
+	# Add here commands to install the package into debian/tmp.
+	$(MAKE) install DESTDIR=$(CURDIR)/debian/tmp
+
+	mv debian/tmp/usr/bin/xulrunner debian/tmp/usr/bin/xulrunner-1.9
+
+	# Fixup permissions
+	find debian/tmp -type f -print0 | xargs -0 chmod 644
+	for f in \
+		js \
+		run-mozilla.sh \
+		xulrunner \
+		mozilla-xremote-client \
+		updater \
+		xpcshell \
+		xpidl \
+		xpt_dump \
+		xpt_link \
+		xulrunner-bin \
+		xulrunner-stub \
+		; do \
+			chmod 755 debian/tmp/usr/lib/xulrunner-1.9/$$f; \
+	done
+
+	# Replace some installed files by symlinks
+	cd debian/tmp/usr/lib/xulrunner-devel-1.9/sdk/lib; \
+		for f in *.so; do \
+			rm -f $$f; ln -s /usr/lib/xulrunner-1.9/$$f $$f; \
+		done
+	cd debian/tmp/usr/include/xulrunner-1.9/stable; \
+		for f in *; do \
+			rm -f ../unstable/$$f; ln -s ../stable/$$f ../unstable/$$f; \
+		done
+	cd debian/tmp/usr/share/idl/xulrunner-1.9/stable; \
+		for f in *; do \
+			rm -f ../unstable/$$f; ln -s ../stable/$$f ../unstable/$$f; \
+		done
+	ln -s ../../xulrunner-1.9 debian/tmp/usr/lib/xulrunner-devel-1.9/sdk/bin
+
+	find dist/bin -printf %P\\n | sort -u > debian/dist.list
+	find debian/tmp/usr/lib/xulrunner-1.9 -printf %P\\n | sort -u > debian/tmp.list
+	diff debian/tmp.list debian/dist.list | grep "^[<>]" | grep -v "^> DEBIAN" | sort
+	rm -f debian/tmp.list debian/dist.list
+
+	cp -Lr dist/include/js debian/tmp/usr/include/mozjs
+	find debian/tmp/usr/include/mozjs -type f -printf %P\\n | while read f; do \
+		file=$$(echo debian/tmp/usr/include/xulrunner-1.9/*/$$f); \
+		rm $$file; \
+		ln -s /usr/include/mozjs/$$(basename $$f) $$file; \
+	done
+	for f in /usr/include/nspr/* /usr/include/nss/*; do \
+		ln -s $$f debian/tmp/usr/include/xulrunner-1.9/stable/$$(basename $$f); \
+		ln -s $$f debian/tmp/usr/include/xulrunner-1.9/unstable/$$(basename $$f); \
+	done
+	# Move out libraries in /usr
+	mv debian/tmp/usr/lib/xulrunner-1.9/libmozjs.so* debian/tmp/usr/lib
+	mv debian/tmp/usr/lib/xulrunner-1.9/js debian/tmp/usr/bin/smjs
+
+	install -d -m 755 debian/tmp/usr/lib/$(PYVER)
+	mv debian/tmp/usr/lib/xulrunner-1.9/python debian/tmp/usr/lib/$(PYVER)/site-packages
+
+	install -m 644 debian/debAbout.js debian/tmp/usr/lib/xulrunner-1.9/components/
+
+	sed -i '/^Cflags/ s,$${includedir}/stable,/usr/include/mozjs,' debian/tmp/usr/lib/pkgconfig/mozilla-js.pc
+
+	sed -i 's/\(Milestone=1.9\).*/\1/' debian/tmp/usr/lib/xulrunner-1.9/platform.ini
+
+	cp -f LICENSE MPL
+	touch install-stamp
+
+# Build architecture-independent files here.
+binary-indep: build-jars install
+	dh_testdir
+	dh_testroot
+	dh_installchangelogs -i
+	dh_installdocs -A -i MPL
+	dh_installexamples -i
+	dh_install -i --sourcedir=debian/tmp
+	dh_link -i
+	dh_compress -i
+	dh_fixperms -i
+	dh_installdeb -i
+	dh_gencontrol -i
+	dh_md5sums -i
+	dh_builddeb -i
+
+# Build architecture-dependent files here.
+binary-arch: build test install $(GENERATED_FILES)
+	dh_testdir
+	dh_testroot
+	dh_installchangelogs -a
+	dh_installdocs -A -a -XREADME.txt MPL
+	dh_installexamples -a
+	dh_installmenu -pspidermonkey-bin
+	dh_install -a --sourcedir=debian/tmp -XMozillaInterfaces -XMozillaGlue
+	sed -i '/^usr\/lib\/xulrunner-1.9\/libjemalloc.so$$/ d' debian/xulrunner-1.9.install
+	dh_pysupport -ppython-xpcom
+	dh_installman -pspidermonkey-bin debian/smjs.1
+	dh_link -a
+	dh_strip -a -Nlibmozjs1d -Nspidermonkey-bin --dbg-package=xulrunner-1.9-dbg
+	dh_strip -plibmozjs1d -pspidermonkey-bin --dbg-package=libmozjs1d-dbg
+	dh_compress -a
+	dh_fixperms -a
+	dh_makeshlibs -plibmozjs1d -V 'libmozjs1d (>= 1.9~rc1)' -- $(GENSYMBOLS_FLAGS)
+	dh_installdeb -a
+	dh_shlibdeps -a -l$(CURDIR)/debian/tmp/usr/lib/xulrunner-1.9
+	dh_gencontrol -a
+	dh_md5sums -a
+	dh_builddeb -a
+
+binary: binary-indep binary-arch
+	find debian/tmp -printf %P\\n | sort -u > debian/tmp.list
+	find `grep Package: debian/control | awk '{print "debian/"$$2}'` -printf %P\\n | sed 's,usr/share/xulrunner,usr/lib/xulrunner,' | sort -u > debian/pkg.list
+	diff debian/tmp.list debian/pkg.list | grep "^[<>]" | grep -v "^> DEBIAN" | sort
+	rm -f debian/tmp.list debian/pkg.list
+
+.PHONY: build clean binary-indep binary-arch binary install build-jars test
+
+.NOTPARALLEL:
--- xulrunner-1.9.0.19.orig/debian/python-xpcom.install
+++ xulrunner-1.9.0.19/debian/python-xpcom.install
@@ -0,0 +1,4 @@
+usr/lib/xulrunner-1.9/libpyxpcom.so
+usr/lib/xulrunner-1.9/components/libpyloader.so
+usr/lib/xulrunner-1.9/components/pyabout.py
+usr/lib/python*/site-packages
--- xulrunner-1.9.0.19.orig/debian/python-xpcom.dirs
+++ xulrunner-1.9.0.19/debian/python-xpcom.dirs
@@ -0,0 +1 @@
+usr/share
--- xulrunner-1.9.0.19.orig/debian/spidermonkey-bin.install
+++ xulrunner-1.9.0.19/debian/spidermonkey-bin.install
@@ -0,0 +1 @@
+usr/bin/smjs
--- xulrunner-1.9.0.19.orig/debian/libmozjs1d.install
+++ xulrunner-1.9.0.19/debian/libmozjs1d.install
@@ -0,0 +1 @@
+usr/lib/libmozjs.so.* usr/lib
--- xulrunner-1.9.0.19.orig/debian/xulrunner-1.9.install
+++ xulrunner-1.9.0.19/debian/xulrunner-1.9.install
@@ -0,0 +1,33 @@
+etc/gre.d/1.9.system.conf
+
+usr/lib/xulrunner-1.9/platform.ini
+
+usr/lib/xulrunner-1.9/libxul.so
+usr/lib/xulrunner-1.9/libxpcom.so
+usr/lib/xulrunner-1.9/libjavaxpcomglue.so
+
+usr/bin/xulrunner-1.9
+usr/lib/xulrunner-1.9/run-mozilla.sh
+usr/lib/xulrunner-1.9/xpcshell
+usr/lib/xulrunner-1.9/mozilla-xremote-client
+usr/lib/xulrunner-1.9/updater
+usr/lib/xulrunner-1.9/xulrunner
+usr/lib/xulrunner-1.9/xulrunner-bin
+usr/lib/xulrunner-1.9/xulrunner-stub
+
+usr/lib/xulrunner-1.9/plugins
+
+usr/lib/xulrunner-1.9/icons usr/share/xulrunner-1.9
+usr/lib/xulrunner-1.9/chrome usr/share/xulrunner-1.9
+
+usr/lib/xulrunner-1.9/greprefs usr/share/xulrunner-1.9
+usr/lib/xulrunner-1.9/defaults/pref usr/share/xulrunner-1.9/defaults
+usr/lib/xulrunner-1.9/defaults/autoconfig usr/share/xulrunner-1.9/defaults
+
+usr/lib/xulrunner-1.9/res usr/share/xulrunner-1.9
+usr/lib/xulrunner-1.9/modules usr/share/xulrunner-1.9
+
+usr/lib/xulrunner-1.9/components/*.js
+usr/lib/xulrunner-1.9/components/*.xpt
+usr/lib/xulrunner-1.9/components/libimgicon.so
+usr/lib/xulrunner-1.9/libjemalloc.so
--- xulrunner-1.9.0.19.orig/debian/changelog
+++ xulrunner-1.9.0.19/debian/changelog
@@ -0,0 +1,2264 @@
+xulrunner (1.9.0.19-14) oldstable-security; urgency=low
+
+  * Fixes for mfsa2011-{36-40}, also known as
+    CVE-2011-2995, CVE-2011-2998, CVE-2011-2999, CVE-2011-3000,
+    CVE-2011-2372.
+  * security/manager/ssl/src/nsIdentityChecking.cpp,
+    security/manager/ssl/src/nsNSSCallbacks.*,
+    security/manager/ssl/src/nsNSSIOLayer.*: Mark DigiNotar root certificates
+    as revoked instead of untrusted.
+
+ -- Mike Hommey <glandium@debian.org>  Thu, 29 Sep 2011 08:01:50 +0200
+
+xulrunner (1.9.0.19-13) oldstable-security; urgency=low
+
+  * Fixes for mfsa2011-30, including:
+    CVE-2011-2982, CVE-2011-2981, CVE-2011-2378, CVE-2011-2984,
+    CVE-2011-2983.
+  * Fixes another cookie regression from the previous cookie regression
+    fix.
+
+ -- Mike Hommey <glandium@debian.org>  Mon, 15 Aug 2011 14:34:43 +0200
+
+xulrunner (1.9.0.19-12) oldstable-security; urgency=low
+
+   * Fixes for mfsa2011-{19,20,22-24}, also known as
+     CVE-2011-2374, CVE-2011-2376, CVE-2011-2373, CVE-2011-2371,
+     CVE-2011-0083, CVE-2011-2363, CVE-2011-0085, CVE-2011-2362.
+   * Fixes cookie regression preventing login on mail.ru. Closes: #627475.
+
+ -- Mike Hommey <glandium@debian.org>  Fri, 01 Jul 2011 14:23:43 +0200
+
+xulrunner (1.9.0.19-11) oldstable-security; urgency=low
+
+  * Fix missing piece in backport of CVE-2011-0067.
+
+ -- Mike Hommey <glandium@debian.org>  Sat, 07 May 2011 08:50:57 +0200
+
+xulrunner (1.9.0.19-10) oldstable-security; urgency=low
+
+  * Fixes for mfsa2011-{12-14,16}, also known as
+    CVE-2011-0070, CVE-2011-0080, CVE-2011-0077, CVE-2011-0078,
+    CVE-2011-0072, CVE-2011-0065, CVE-2011-0066, CVE-2011-0073,
+    CVE-2011-0067, CVE-2011-0071.
+
+ -- Mike Hommey <glandium@debian.org>  Sat, 30 Apr 2011 08:31:00 +0200
+
+xulrunner (1.9.0.19-9) oldstable-security; urgency=low
+
+  * mfsa2011-11: Update to HTTPS certificate blacklist.
+
+ -- Mike Hommey <glandium@debian.org>  Wed, 23 Mar 2011 10:42:28 +0100
+
+xulrunner (1.9.0.19-8) oldstable-security; urgency=low
+
+  * Fixes for mfsa2011-{01-02,05,07-08,10}, also known as
+    CVE-2011-0053, CVE-2011-0051, CVE-2011-0056, CVE-2011-0058,
+    CVE-2010-1585, CVE-2011-0059.
+
+ -- Mike Hommey <glandium@debian.org>  Mon, 07 Mar 2011 20:32:01 +0100
+
+xulrunner (1.9.0.19-7) stable-security; urgency=low
+
+  * Fixes for mfsa2010-{74-77,79,81-82,84}, also known as
+    CVE-2010-3776, CVE-2010-3778, CVE-2010-3769, CVE-2010-3771,
+    CVE-2010-3772, CVE-2010-3775, CVE-2010-3767, CVE-2010-3773,
+    CVE-2010-3770
+  * Fix for one more regression from CVE-2010-2769.
+  * debian/libmozjs1d.symbols: Add new symbol.
+
+ -- Mike Hommey <glandium@debian.org>  Wed, 08 Dec 2010 10:23:44 +0100
+
+xulrunner (1.9.0.19-6) stable-security; urgency=low
+
+  * Fixes for mfsa2010-{64-69,73}, also known as
+    CVE-2010-3176, CVE-2010-3174, CVE-2010-3179, CVE-2010-3180,
+    CVE-2010-3183, CVE-2010-3177, CVE-2010-3178, CVE-2010-3765.
+  * Fix for mfsa2010-71 aka CVE-2010-3182, which only applies to
+    applications using run-mozilla.sh (e.g. not iceweasel)
+  * Fixes for regressions from CVE-2010-0654 and CVE-2010-2769.
+
+ -- Mike Hommey <glandium@debian.org>  Thu, 28 Oct 2010 11:15:04 +0200
+
+xulrunner (1.9.0.19-5) stable-security; urgency=low
+
+  * Fixes for regressions from CVE-2010-3169 and CVE-2010-2769.
+
+ -- Mike Hommey <glandium@debian.org>  Fri, 17 Sep 2010 20:40:40 +0200
+
+xulrunner (1.9.0.19-4) stable-security; urgency=low
+
+  * Fixes for mfsa2010-{49-51,54-57,60-62}, also known as
+    CVE-2010-3169, CVE-2010-2765, CVE-2010-2767, CVE-2010-2760,
+    CVE-2010-3168, CVE-2010-3167, CVE-2010-2766, CVE-2010-2763,
+    CVE-2010-2768, CVE-2010-2769.
+
+ -- Mike Hommey <glandium@debian.org>  Wed, 08 Sep 2010 09:04:24 +0200
+
+xulrunner (1.9.0.19-3) stable-security; urgency=low
+
+  * Fixes for mfsa2010-{24,34-35,37,40-41,45-47}, also known as
+    CVE-2010-0182, CVE-2010-1211, CVE-2010-1208, CVE-2010-1214,
+    CVE-2010-2753, CVE-2010-1205, CVE-2010-2751, CVE-2010-0654,
+    CVE-2010-2754.
+
+ -- Mike Hommey <glandium@debian.org>  Tue, 20 Jul 2010 23:53:41 +0200
+
+xulrunner (1.9.0.19-2) stable-security; urgency=low
+
+  * Fixes for mfsa2010-{25-30,32}, also known as
+    CVE-2010-1121, CVE-2010-1200, CVE-2010-1201, CVE-2010-1202,
+    CVE-2010-0183, CVE-2010-1198, CVE-2010-1196, CVE-2010-1199,
+    CVE-2010-1197.
+
+ -- Mike Hommey <glandium@debian.org>  Fri, 25 Jun 2010 11:32:15 +0200
+
+xulrunner (1.9.0.19-1) stable-security; urgency=low
+
+  * New upstream release.
+  * Fixes mfsa-2010-{16-21}, also known as
+    CVE-2010-0174, CVE-2010-0175, CVE-2010-0176, CVE-2010-0177,
+    CVE-2010-0178, CVE-2010-0179.
+  * modules/libpr0n/decoders/png/nsPNGDecoder.cpp: Fix breakage with png
+    decoder update in 1.9.0.19.
+
+ -- Mike Hommey <glandium@debian.org>  Tue, 30 Mar 2010 22:45:04 +0200
+
+xulrunner (1.9.0.18-1) stable-security; urgency=low
+
+  * New upstream release.
+  * Fixes mfsa-2010-{01-05}, also known as
+    CVE-2010-0159, CVE-2010-0160, CVE-2009-1571, CVE-2009-3988,
+    CVE-2010-0162.
+
+ -- Mike Hommey <glandium@debian.org>  Wed, 17 Feb 2010 20:24:58 +0100
+
+xulrunner (1.9.0.16-1) stable-security; urgency=low
+
+  * New upstream release.
+  * Fixes mfsa-2009-{65,68-70}, also known as
+    CVE-2009-3979, CVE-2009-3981, CVE-2009-3983, CVE-2009-3984,
+    CVE-2009-3985, CVE-2009-3986.
+
+ -- Mike Hommey <glandium@debian.org>  Wed, 16 Dec 2009 10:26:48 +0100
+
+xulrunner (1.9.0.15-0lenny1) stable-security; urgency=high
+
+  * New upstream release.
+  * Fixes mfsa-2009-{52,53,55-57,59,61,62,64}, also known as
+    CVE-2009-3370, CVE-2009-3274, CVE-2009-3372, CVE-2009-3373,
+    CVE-2009-3374, CVE-2009-1563, CVE-2009-3375, CVE-2009-3376,
+    CVE-2009-3380, CVE-2009-3382.
+  * modules/libpref/src/prefapi.cpp: Avoid writing out locked prefs default
+    value in user preferences. Closes: #512111.
+  * debian/libmozjs1d.symbols: Add new symbols.
+
+ -- Mike Hommey <glandium@debian.org>  Wed, 28 Oct 2009 14:54:31 +0100
+
+xulrunner (1.9.0.14-0lenny1) stable-security; urgency=high
+
+  * New upstream release.
+  * Fixes mfsa-2009-{47-50}, also known as
+    CVE-2009-3070, CVE-2009-3071, CVE-2009-3072, CVE-2009-3074,
+    CVE-2009-3075, CVE-2009-3076, CVE-2009-3077, CVE-2009-3078.
+  * security/manager/ssl/src/nsNSSCallbacks.{h,cpp},
+    security/manager/ssl/src/nsNSSComponent.cpp,
+    security/manager/ssl/src/nsNSSCertHelper.cpp: Revert previous changes.
+  * debian/control: Build depend on newer libnss3-dev.
+
+ -- Mike Hommey <glandium@debian.org>  Thu, 10 Sep 2009 09:06:07 +0200
+
+xulrunner (1.9.0.13-0lenny1) stable-security; urgency=high
+
+  * New upstream release.
+  * Fixes mfsa-2009-44, also known as CVE-2009-2654.
+  * security/manager/ssl/src/nsNSSCallbacks.{h,cpp},
+    security/manager/ssl/src/nsNSSComponent.cpp: Leave out OCSP responders,
+    as they require latest nss which we don't have in Lenny.
+  * security/manager/ssl/src/nsNSSCertHelper.cpp: Define
+    CERT_RFC1485_EscapeAndQuote function when it is not defined in nss headers.
+
+ -- Mike Hommey <glandium@debian.org>  Thu, 20 Aug 2009 19:48:22 +0200
+
+xulrunner (1.9.0.12-0lenny1) stable-security; urgency=high
+
+  * New upstream release.
+  * Fixes mfsa-2009-{34,35,37,38,39,40,45}, also known as
+    CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465,
+    CVE-2009-2466, CVE-2009-2467, CVE-2009-2469, CVE-2009-2470,
+    CVE-2009-2471, CVE-2009-2472.
+  * debian/libmozjs1d.symbols: Add new symbol.
+
+ -- Mike Hommey <glandium@debian.org>  Wed, 22 Jul 2009 21:00:45 +0200
+
+xulrunner (1.9.0.11-0lenny1) stable-security; urgency=high
+
+  * New upstream release.
+  * Fixes mfsa-2009-{24-32}, also known as
+    CVE-2009-1392, CVE-2009-1832, CVE-2009-1833, CVE-2009-1834,
+    CVE-2009-1835, CVE-2009-1836, CVE-2009-1837, CVE-2009-1838,
+    CVE-2009-1839, CVE-2009-1840, CVE-2009-1841.
+  * configure.in, configure: Don't require sqlite >= 3.6.7.
+
+ -- Mike Hommey <glandium@debian.org>  Fri, 12 Jun 2009 09:23:08 +0200
+
+xulrunner (1.9.0.9-0lenny2) stable-security; urgency=high
+
+  * Fix mfsa-2009-23 also known as CVE-2009-1313 (Regression crash).
+    Closes: #525740.
+
+ -- Mike Hommey <glandium@debian.org>  Tue, 28 Apr 2009 07:35:25 +0200
+
+xulrunner (1.9.0.9-0lenny1) stable-security; urgency=high
+
+  * New upstream release.
+  * Fixes mfsa-2009-{14-19,21,22}, also known as
+    CVE-2009-1302, CVE-2009-1303, CVE-2009-1304, CVE-2009-1305,
+    CVE-2009-0652, CVE-2009-1306, CVE-2009-1307, CVE-2009-1308,
+    CVE-2009-1309, CVE-2009-1311, CVE-2009-1312.
+
+ -- Mike Hommey <glandium@debian.org>  Wed, 22 Apr 2009 21:29:35 +0200
+
+xulrunner (1.9.0.7-0lenny2) stable-security; urgency=high
+
+  * Non-maintainer upload by the security team.
+  * Fix msfa-2009-13 (CVE-2009-1044)
+  * Fix mfsa-2009-12 (CVE-2009-1169)
+
+ -- Noah Meyerhans <noahm@debian.org>  Fri, 27 Mar 2009 23:31:21 -0400
+
+xulrunner (1.9.0.7-0lenny1) stable-security; urgency=high
+
+  * New upstream release.
+  * Fixes mfsa-2009-{07-09}, also known as
+    CVE-2009-0771, CVE-2009-0772, CVE-2009-0773, CVE-2009-0774,
+    CVE-2009-0775, CVE-2009-0776.
+
+ -- Mike Hommey <glandium@debian.org>  Wed, 18 Mar 2009 19:09:05 +0100
+
+xulrunner (1.9.0.6-1) unstable; urgency=low
+
+  * New upstream release.
+  * Fixes mfsa-2009-{01,02,04-06}, also known as
+    CVE-2009-0352, CVE-2009-0353, CVE-2009-0354, CVE-2009-0356,
+    CVE-2009-0357, CVE-2009-0358.
+
+ -- Mike Hommey <glandium@debian.org>  Wed, 04 Feb 2009 08:00:40 +0100
+
+xulrunner (1.9.0.5-1) unstable; urgency=low
+
+  * New upstream release.
+  * Fixes mfsa-2008-{60,63-68}, also known as
+    CVE-2008-5500, CVE-2008-5501, CVE-2008-5502, CVE-2008-5505,
+    CVE-2008-5506, CVE-2008-5507, CVE-2008-5508, CVE-2008-5510,
+    CVE-2008-5511, CVE-2008-5512.
+  * debian/control: conflict with pango-graphite, to avoid all problems
+    it causes.
+
+ -- Mike Hommey <glandium@debian.org>  Sat, 20 Dec 2008 10:55:24 +0100
+
+xulrunner (1.9.0.4-2) unstable; urgency=low
+
+  * debian/xulrunner-1.9.preinst: Brown paper bag fix to avoid failure on
+    install (upgrades were fine).
+
+ -- Mike Hommey <glandium@debian.org>  Sun, 23 Nov 2008 09:34:15 +0100
+
+xulrunner (1.9.0.4-1) unstable; urgency=low
+
+  * New upstream release.
+  * Fixes mfsa-2008-{47,51-58}, also known as
+    CVE-2008-0017, CVE-2008-4582, CVE-2008-5015, CVE-2008-5016,
+    CVE-2008-5017, CVE-2008-5018, CVE-2008-5019, CVE-2008-5021,
+    CVE-2008-5022, CVE-2008-5023, CVE-2008-5024.
+  * debian/postinst.in: Use a temporary directory as $HOME when running
+    xpcshell. Thanks Theppitak Karoonboonyanan. Closes: #495311.
+  * debian/rules:
+    + Exclude jemalloc from kfreebsd packages, as it is not built.
+      Thanks Petr Salinger. Closes: #501476.
+    + Use LDFLAGS instead of CFLAGS to set -Wl,--no-relax on alpha.
+  * modules/libpr0n/src/imgRequest.cpp: Apply patch from bz#373701 to
+    properly close streaming HTTP connections and avoid sucking bandwidth.
+    Closes: #491144.
+  * browser/app/mozilla.in: Do exec instead of uselessly forking.
+    Closes: #496626.
+  * memory/jemalloc/jemalloc.c: Apply patch from bz#460933 to avoid
+    possible deadlock on fork with jemalloc enabled.
+  * xpcom/glue/nsThreadUtils.cpp: Better fix to avoid crashes such as bug
+    #481925. Might fix bug #503926, too.
+  * debian/xulrunner-1.9.preinst: If /usr/lib/xulrunner-1.9/chrome is an
+    empty directory, remove it. This will allow dpkg to create the symbolic
+    link correctly. Closes: #482415, #486334, #486354, #492488.
+  * toolkit/components/url-classifier/src/Makefile.in: Disable optimization
+    on alpha as it leads to crashes when using this component.
+  * uriloader/exthandler/nsMIMEInfoImpl.h,
+    uriloader/exthandler/unix/nsMIMEInfoUnix.cpp,
+    uriloader/exthandler/unix/nsOSHelperAppService.cpp,
+    uriloader/exthandler/unix/nsOSHelperAppService.h: Revert change from
+    release 1.9.0.1-1.
+  * uriloader/exthandler/unix/nsMIMEInfoUnix.cpp: Properly launch
+    applications set in $HOME/.mailcap. Replaces the previous patch in
+    a much simpler way.
+
+ -- Mike Hommey <glandium@debian.org>  Sat, 22 Nov 2008 12:50:09 +0100
+
+xulrunner (1.9.0.3-1) unstable; urgency=low
+
+  * New upstream release.
+  * Fixes mfsa-2008-{40-44}, also known as
+    CVE-2007-3837, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060,
+    CVE-2008-4065, CVE-2008-4066, CVE-2008-4066, CVE-2008-4067.
+  * debian/xulrunner-1.9.install: Don't install dependentlibs.list. It's
+    causing problems with gdb and is not necessary on our builds.
+  * debian/control: Bumped Standards-Version to 3.8.0.1. No changes.
+  * xulrunner/app/Makefile.in: Use browser/app/mozilla.in instead of
+    xulrunner/app/mozilla.in. The browser version has received more love
+    upstream, and properly remove the xremote code, which has been handled
+    by the binary itself for a while, and causes some problems on PPC at
+    least.
+  * build/unix/run-mozilla.sh, debian/postinstrm.in, debian/rules,
+    xulrunner/stub/nsXULStub.cpp: Disable jemalloc by default, because of all
+    the kinds of random problems it causes, but let advanced users load it by
+    setting the MOZILLA_JEMALLOC environment variable. Closes: #490360.
+  * debian/rules: Create sdk/bin as a symlink to /usr/lib/xulrunner-1.9.
+    Closes: #491693
+  * modules/plugin/base/src/nsPluginHostImpl.cpp: Don't register plugins if
+    the MOZILLA_DISABLE_PLUGINS environment variable is set.
+
+ -- Mike Hommey <glandium@debian.org>  Sun, 28 Sep 2008 16:30:37 +0200
+
+xulrunner (1.9.0.1-1) unstable; urgency=low
+
+  * New upstream release.
+    + Fix urlclassifier so that its black list is properly updated.
+      Closes: #486311.
+  * memory/jemalloc/jemalloc.c: Allow memory to be allocated from a small pool
+    of static memory during initialization. Some LD_PRELOADed libraries such
+    as libaoss and libtrash can divert some functions used by jemalloc
+    initialization, themselves needing malloc or calloc. This used to lead to
+    a deadlock. Closes: #487614.
+  * uriloader/exthandler/nsHandlerService.js: Avoid spurious "Run" items in
+    application handlers configuration pane.
+  * uriloader/exthandler/nsMIMEInfoImpl.h,
+    uriloader/exthandler/unix/nsMIMEInfoUnix.cpp,
+    uriloader/exthandler/unix/nsOSHelperAppService.cpp,
+    uriloader/exthandler/unix/nsOSHelperAppService.h: Properly launch
+    applications set in $HOME/.mailcap. Closes: #488971.
+  * uriloader/exthandler/unix/nsOSHelperAppService.cpp: Apply small changes
+    asked by upstream in bz#440840 so that we have what will be applied
+    upstream.
+  * xpcom/reflect/xptcall/src/md/unix/xptc_platforms_unixish_x86.h,
+    xpcom/reflect/xptcall/src/md/unix/Makefile.in: Fix FTBFS on Hurd-i386.
+    Closes: #490390.
+  * debian/control:
+    + libmozjs1d-dbg conflicts with libmozjs0d-dbg.  Closes: #490296.
+    + Conflict with j2re1.4. Even when solving the infinite loop issue, new
+      issues were showing up one after another with this old and obviously
+      broken plugin. Closes: #481407.
+  * debian/rules:
+    + Don't fail to build with DEB_BUILD_OPTIONS=debug, which adds symbols to
+      libmozjs1d.
+    + Add symbolic links for nss headers in the SDK directories.
+      Closes: #490747.
+    + Avoid breaking current iceweasel that doesn't have a broad enough
+      version range in application.ini.
+  * debian/remove.nonfree: Don't remove files that don't exist anymore, and
+    synchronize with the remove.nonfree file from iceweasel.
+  * modules/libpref/src/init/all.js: Disable network manager authority over
+    online/offline. Closes: #483167.
+  * xpcom/io/nsLocalFileUnix.cpp, xpcom/io/nsLocalFileUnix.h: Use stat64()
+    where supported, so that directory listing doesn't choke on 2GB+ files.
+    Closes: #489733.
+  * debian/test/application.ini: Allow our testcase to work with versions up
+    to 2.0.
+  * config/autoconf.mk.in, xulrunner/installer/Makefile.in: Don't use the full
+    version (1.9.0.1) in install paths.
+  * extensions/pref/autoconfig/src/nsReadConfig.cpp: Read autoconfig files
+    from GRE directory instead of application directory. Closes: #490814.
+
+ -- Mike Hommey <glandium@debian.org>  Mon, 14 Jul 2008 22:15:18 +0200
+
+xulrunner (1.9~rc2-5) unstable; urgency=low
+
+  * debian/control: Add a dependency on xulrunner-1.9 to
+    xulrunner-1.9-gnome-support.
+  * uriloader/exthandler/unix/nsOSHelperAppService.cpp: Properly catch test
+    process exit code. This avoids mailcap entries where the test fails to be
+    chosen.
+  * toolkit/xre/nsAppRunner.cpp: Set DISPLAY with the value passed to
+    --display. This avoids surprises when running DISPLAY=:0 iceweasel
+    --display=:1, and some other problems.
+  * toolkit/themes/gnomestripe/global/jar.mn: Install loading_16_grey.gif in
+    classic.jar, and add an override to replace loading16.png, which happens
+    to be an APNG file, with it. Closes: #487556.
+  * toolkit/xre/nsAppRunner.cpp: Don't use static strings when setting
+    environment, since there are situations where libxul.so gets dlclose()d,
+    making these strings unavailable and leading to strange segfaults.
+    Closes: #487785.
+  * build/unix/run-mozilla.sh: Allow to debug with LD_PRELOADed libraries.
+  * debian/rules, debian/postinstrm.in: Generate xulrunner-1.9.postinst from
+    template, too. Also replace handling of upgrade by handling of
+    abort-install.
+  * debian/xulrunner-1.9.postinst: Removed.
+  * debian/postinstrm.in:
+    + Avoid xpcshell to use libjemalloc, avoiding install to hang while using
+      libtrash or other LD_PRELOADed library conflicting with libjemalloc.
+      Closes: #488349.
+    + Catch xpcshell crashes in postinst/rm so that install can proceed
+      properly. Remove possibly incomplete components registries it could
+      have generated, then. Closes: #488350.
+  * xpcom/glue/nsThreadUtils.cpp:
+    + Tentatively fix crashes when epiphany exits.  This will require an
+      epihany rebuild. Closes: #481925.
+    + Also add a failsafe in NS_ProcessPendingEvents.
+
+ -- Mike Hommey <glandium@debian.org>  Sun, 29 Jun 2008 10:32:32 +0200
+
+xulrunner (1.9~rc2-4) unstable; urgency=low
+
+  * xulrunner/stub/nsXULStub.cpp: Refactored the previous change allowing
+    xulrunner-stub to be symlinked, so that it works properly in more cases.
+  * xpcom/io/nsAppFileLocationProvider.cpp: Add /usr/lib/mozilla/plugins as
+    global location to find plugins.
+  * configure, configure.in: Force to not use -fshort-wchar. Closes: #485876.
+  * uriloader/exthandler/unix/nsOSHelperAppService.cpp: Avoid thread wait
+    catching system() child process termination, which can make mailcap
+    entries with tests ignored (since tests end up failing). Closes: #473557.
+  * uriloader/exthandler/unix/nsOSHelperAppService.cpp: Ignore mailcap entries
+    with "needsterminal". Closes: #467612.
+  * toolkit/content/about.dtd, toolkit/content/about.xhtml,
+    toolkit/content/jar.mn, toolkit/locales/en-US/chrome/global/about.dtd:
+    Avoid the about: page to be broken when l10n chrome doesn't include the
+    debian specific strings, which will stay in english.
+  * modules/libpref/src/prefapi.*, modules/libpref/src/prefread.*: Allow .js
+    preference files to set locked prefs with lockPref(). Closes: #469020.
+  * toolkit/xre/nsXREDirProvider.cpp: Add another preferences directory for
+    applications: preferences/syspref. It was existing in previous versions of
+    iceweasel as a symlink to /etc/iceweasel/pref. This has the side effect to
+    make these preferences there work again, and to disable the "set as
+    default browser" dialog. Closes: #485662.
+  * xulrunner/app/Makefile.in: Don't link xulrunner-bin against libjemalloc
+    anymore.
+  * build/unix/run-mozilla.sh, xulrunner/stub/Makefile.in,
+    xulrunner/stub/nsXULStub.cpp: Load libjemalloc through LD_PRELOAD in both
+    stub (which happened to not be linked against libjemalloc, so iceweasel
+    should get a performance boost) and xulrunner-bin. This can be disabled
+    by setting the MOZILLA_NO_JEMALLOC environment variable to some value.
+  * debian/xulrunner-1.9.install: Don't install libjemalloc by default.
+    Closes: #486663.
+  * debian/rules: Refactored tests to use MOZILLA_NO_JEMALLOC, and install
+    libjemalloc if the corresponding test succeeded.
+
+ -- Mike Hommey <glandium@debian.org>  Sat, 21 Jun 2008 14:28:44 +0200
+
+xulrunner (1.9~rc2-3) unstable; urgency=low
+
+  * config/autoconf.mk.in, configure, configure.in,
+    xulrunner/installer/Makefile.in,
+    xulrunner/installer/libxul-embedding-unstable.pc.in,
+    xulrunner/installer/libxul-embedding.pc.in,
+    xulrunner/installer/libxul-unstable.pc.in,
+    xulrunner/installer/libxul.pc.in: Don't hardcode -fshort-wchar in the .pc
+    files. Thanks Riku Voipio. Closes: #485618.
+  * xpcom/glue/nsTextFormatter.cpp: Fixed bad certificate error message
+    displaying (null) as common name at least on amd64, due to the way
+    va_lists are being used in nsTextFormatter.
+  * security/manager/ssl/public/Makefile.in,
+    security/manager/ssl/public/nsIBadCertListener.idl,
+    security/manager/ssl/src/nsNSSIOLayer.*: Fore-port nsIBadCertListener from
+    1.8, to allow embedding applications to use the same dialogs as before,
+    instead of the new ssl alert pages from Firefox, which have several
+    problems in embedding applications.
+  * debian/control: Make -dbg packages less a hassle for manual installations
+    with dpkg.
+  * debian/debAbout.js: Removed last debugging message.
+
+ -- Mike Hommey <glandium@debian.org>  Sun, 15 Jun 2008 22:11:16 +0200
+
+xulrunner (1.9~rc2-2) unstable; urgency=low
+
+  * debian/libmozillainterfaces-java.install, debian/xulrunner-1.9.install:
+    Move javaxpcom.jar into the libmozillainterfaces-java package.
+    Closes: #485284.
+  * debian/control: Small description changes to fit this move.
+  * debian/libmozillainterfaces-java.install: Move MozillaGlue.jar into the
+    libmozillainterfaces-java package.
+  * debian/rules: Don't install MozillaInterfaces and MozillaGlue files in
+    xulrunner-dev.
+
+ -- Mike Hommey <glandium@debian.org>  Mon, 09 Jun 2008 08:15:35 +0200
+
+xulrunner (1.9~rc2-1) unstable; urgency=low
+
+  * modules/libjar/nsJAR.cpp: Apply patch from Alexander Sack to avoid
+    deadlocks.
+  * debian/xulrunner-1.9.links: Don't create links for nspr libraries,
+    since nspr now has them.
+  * debian/control: Since we don't ship neither nspr nor nss so links, force
+    dependencies onto versions of nspr and nss that ship them, to avoid
+    partial upgrade surprises to our testing or unstable users.
+  * toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp:
+    Fix unaligned word access. Thanks Martin Guy to have tracked this down.
+    Closes: #483949.
+  * debian/control: Remove xulrunner-dev-bin and xulrunner-1.9-common
+    packages, adapt xulrunner-dev and xulrunner-1.9 for transition.
+  * debian/xulrunner-1.9-common.*, debian/xulrunner-dev-bin.*: Removed.
+  * debian/xulrunner-1.9.*, debian/xulrunner-dev.*: Install files that
+    previously were in xulrunner-1.9-common and xulrunner-dev-bin.
+  * debian/rules:
+    + Don't filter-out mozilla-config and xpcom-config files when
+      installing arch-indep files.
+    + Don't install the buildconfig.html override, it is not needed anymore.
+  * toolkit/content/jar.mn: Do include content/global/buildconfig.html in
+    toolkit.jar.
+
+ -- Mike Hommey <glandium@debian.org>  Sun, 08 Jun 2008 10:41:19 +0200
+
+xulrunner (1.9~rc1-2) experimental; urgency=low
+
+  * toolkit/content/about.xhtml: Remove unintendly left debugging message.
+  * xpcom/reflect/xptcall/src/md/unix/Makefile.in: Use -O0 instead of -O1 for
+    xptcstubs on hppa, it seems -O1 is still too much.
+  * debian/control: Ensure xulrunner-1.9 depends on libmozjs1d >= 1.9~rc1.
+    Closes: #482824.
+  * debian/rules: Workaround libgnome exitting when it can't create its
+    configuration directory when user home doesn't exist (as it happens on
+    buildds) despite $HOME being set, by setting GNOME22_USER_DIR.
+    Closes: #482812.
+  * debian/xulrunner-dev-bin.install, debian/rules: Install xpcom-config.h
+    in arch-dependent xulrunner-dev-bin package.
+
+ -- Mike Hommey <glandium@debian.org>  Tue, 27 May 2008 00:12:49 +0200
+
+xulrunner (1.9~rc1-1) experimental; urgency=low
+
+  * New upstream Release Candidate release (taken from upstream CVS):
+    + Avoid non null terminated strings being considered as such, leading to
+      garbage at the end of drag&dropped content. Closes: #481021.
+  * debian/control: Turn libmozjs-dev into an arch-dependent package, so that
+    arch-dependent jsautocfg.h has the proper content on all architectures.
+    Closes: #480045.
+  * xpcom/reflect/xptcall/src/md/unix/xptcstubs_linux_m68k.cpp,
+    xpcom/reflect/xptcall/src/md/unix/xptcstubs_mips.cpp: Add missing #include
+    in xptcstubs on m68k and mips. This should finally settle the FTBFSes on
+    these architectures. Closes: #479107.
+  * debian/xulrunner-1.9.postinst: Remove test for 'upgrade', it is not a
+    valid postinst argument.
+  * debian/xulrunner-dev-bin.install, debian/rules: Install mozilla-config.h
+    in arch-dependent xulrunner-dev-bin package.
+  * debian/pyversions: Removed. It is actually useless in our case.
+  * debian/rules:
+    + Fix mozilla-js.pc to provide the proper include directory.
+    + Add a test rule to try to detect xptc invoke/stubs breakages. An
+      xpcshell script should be enough for that purpose.
+    + Add -g to flags given to the assembler.
+    + Make DEB_BUILD_OPTIONS=noopt actually work.
+    + Use objdump -p instead of objdump -x.
+    + Bumped shlibs for libmozjs1d. Also add option for dh_makeshlibs to fail
+      when symbols file is not up-to-date.
+  * debian/libmozjs1d.symbols: Add symbols file for libmozjs1d.
+  * xpcom/reflect/xptcall/src/md/unix/Makefile.in, configure, configure.in:
+    Add -fPIC to flags given to the assembler, and clean-up the Makefile.
+    This will fix current xpcom brokenness on mips.
+  * debian/control:
+    + Added proper conflicts related to python-xpcom to xulrunner-1.9-dbg.
+      Closes:#482471.
+    + Build-Depend on libnspr4-dev >= 4.7.0 instead of wrong 3.7.0 (oops).
+    + Build-Depend on libstartup-notification0-dev.
+  * xpcom/build/nsXPComInit.cpp: Check for GRE_DIR/.autoreg to trigger
+    components auto-registration, so that we can have independent application
+    and xulrunner updates triggering it.
+  * debian/xulrunner-1.9.postinst, debian/postinstrm.in: Don't remove .autoreg
+    file, but create/refresh it.
+  * config/rules.mk: Avoid to remove source .s files on make clean, which
+    broke building again after make clean on architectures having .s source
+    files.
+  * xpcom/reflect/xptcall/src/md/unix/Makefile.in: Build xptcstubs with less
+    optimizations on hppa to avoid g++ outsmarting the assembly code.
+    Closes: #480905.
+  * debian/configure.in: disable mochitest.
+  * xulrunner/installer/Makefile.in, debian/rules: Revert previous change to
+    build as if we were version 1.9 instead of 1.9bn, since milestone is now
+    1.9.
+  * debian/postinstrm.in, debian/rules, debian/xulrunner-1.9.install,
+    debian/xulrunner-1.9.postinst: Don't ship regxpcom, as it is not supported
+    upstream anymore, and generate components registry by a void call to
+    xpcshell, which does the work.
+  * debian/control: Build depends on xvfb, xfonts-base and xauth to be able to
+    launch xulrunner tests.
+  * debian/rules, debian/test: Implement a test application and run it during
+    the test rule. Test both with and without libjemalloc, forcing memory
+    allocation libraries with LD_PRELOAD to avoid relying on what is linked
+    at build time, as it may change in the future. If we built against
+    libjemalloc and the test fails, automatically rebuild without.
+  * js/src/xpconnect/shell/xpcshell.cpp: Drop ancient code in xpcshell that
+    ended up making error messages not being included.
+  * debian/control, debian/rules: Insert carriage returns where lines are too
+    long. This will improve diff readability in the future.
+  * debian/mozconfig:
+    + Enable url-classifier component ; it is needed by iceweasel.
+    + Enable startup-notification.
+  * debian/xulrunner-1.9.install: Don't put nsXULAppInstall.js component in
+    the xulrunner-1.9 package.
+  * debian/control: Adapt conflicts accordingly.
+  * debian/xulrunner-1.9-common.install: Use wildcards to install typelibs
+    and javascript components, since we don't put any in another package.
+  * debian/python-xpcom.install: Add new pyabout.py component.
+  * docshell/base/nsAboutRedirector.cpp: Don't register about:about, which
+    doesn't exist, and register about:, giving it permission to run chrome
+    scripts.
+  * xpfe/appshell/src/Makefile.in, xpfe/appshell/src/nsAppShellFactory.cpp:
+    Remove nsAbout, from appshell, since we made nsAboutRedirector happily
+    replace it.
+  * debian/debAbout.js, debian/rules: Add a component to handle special
+    about:debian, about:bugs and about:readme.debian urls.
+  * modules/libjar/nsJAR.cpp: Apply suggestions from Christian Biesinger in
+    bz#368428. The patch will eventually be applied upstream.
+  * storage/src/mozStorageConnection.cpp,
+    storage/test/unit/test_storage_connection.js: Apply patch from bz#421482
+    to mitigate I/O issues with sqlite fsync()ing.
+  * toolkit/content/Makefile.in, toolkit/content/about.xhtml,
+    toolkit/content/jar.mn: Don't hardcode the XRE version number in the
+    about: page.
+  * toolkit/content/about.xhtml:
+    + Unhide release notes link, but only if app.releaseNotesURL is defined.
+    + Don't put an about:blank link when there is no vendorURL defined.
+    + Add links for about:bugs and about:README.Debian.
+  * toolkit/locales/en-US/chrome/global/about.dtd: Add corresponding en_US
+    strings.
+
+ -- Mike Hommey <glandium@debian.org>  Sat, 24 May 2008 19:24:54 +0200
+
+xulrunner (1.8.1.14-3) unstable; urgency=low
+
+  * debian/patches/38_mips_xpcom.dpatch: Add -fPIC to flags given to the
+    assembler, and clean-up the Makefile. This will fix current xpcom
+    brokenness on mips.
+  * debian/patches/99_configure.dpatch: Updated.
+
+ -- Mike Hommey <glandium@debian.org>  Mon, 12 May 2008 17:15:45 +0200
+
+xulrunner (1.9~b5-4) experimental; urgency=low
+
+  * js/src/jsfun.h: use struct JSArenaPool instead of undefined opaque
+    JSArenaPool type. bz#430955.
+  * content/html/document/src/nsHTMLFragmentContentSink.cpp,
+    embedding/browser/gtk/src/EmbedContextMenuInfo.cpp,
+    embedding/browser/gtk/src/EmbedPasswordMgr.cpp,
+    extensions/canvas3d/src/nsCanvas3DModule.cpp,
+    extensions/cck/browser/resources/content/cckwizard/srcfiles/cckService.js.in,
+    extensions/metrics/build/nsMetricsModule.cpp,
+    extensions/metrics/src/nsLoadCollector.cpp,
+    extensions/metrics/src/nsMetricsService.cpp,
+    extensions/metrics/test/TestMetricsConfig.cpp,
+    js/src/jsapi.h, parser/xml/src/nsSAXXMLReader.cpp,
+    toolkit/components/places/src/nsFaviconService.cpp,
+    toolkit/components/places/src/nsMaybeWeakPtr.h,
+    toolkit/components/places/src/nsNavHistory.cpp,
+    toolkit/components/places/src/nsNavHistoryQuery.h,
+    toolkit/components/satchel/src/nsStorageFormHistory.h,
+    toolkit/components/url-classifier/src/nsUrlClassifierDBService.h:
+    Remove MOZILLA_1_8_BRANCH ifdefs. bz#398810, bz#398811.
+  * debian/control, debian/xulrunner-dev-static.install: Rename
+    xulrunner-dev-static package to xulrunner-dev-bin.
+  * debian/xulrunner-dev-bin.install, debian/xulrunner-1.9.install: Move
+    xpidl, xpt_link and xpt_dump binaries to xulrunner-dev-bin.
+  * debian/control: Add shlibs:Depends to Depends list for xulrunner-dev-bin.
+  * debian/pycompat: Removed.
+  * debian/python-xpcom.postinst, debian/python-xpcom.prerm: Fix directory
+    used for component registration.
+  * debian/python-xpcom.install, debian/rules: Put python-xpcom files under
+    /usr/lib/pythonX.Y/site-packages. Closes: #478527.
+  * debian/mozconfig: Re-add default-mozilla-five-home, which appears to be
+    necessary for proper python-xpcom functionning.
+  * extensions/python/xpcom/src/module/Makefile.in: Add an rpath to _xpcom.so
+    so that libxpcom.so and libpyxpcom.so can be found when importing it from
+    python.
+  * extensions/python/xpcom/src/loader/Makefile.in: Add an rpath to
+    libpyloader.so xpcom component so that libpyxpcom.so can be found when
+    libxul loads the component.
+  * debian/control: Add a dependency on xulrunner-1.9 for python-xpcom.
+  * debian/rules:
+    + Don't use $(CURDIR) when not necessary.
+    + Symplify how we set PYTHON_SO.
+  * debian/xulrunner-1.9.install, debian/xulrunner-1.9-common.install: Move
+    /etc/gre.d/1.9.system.conf, /usr/lib/xulrunner-1.9/dependentlibs.list and
+    /usr/lib/xulrunner-1.9/platform.ini from xulrunner-1.9-common to
+    xulrunner-1.9. Closes: #478037.
+  * toolkit/content/jar.mn: Don't include content/global/buildconfig.html in
+    toolkit.jar.
+  * debian/rules: Install buildconfig.html under a subdirectory of the chrome,
+    and register it in toolkit.manifest.
+  * debian/xulrunner-1.9.install: Put this new buildconfig.html file in the
+    xulrunner-1.9 package so that build information is architecture dependent.
+  * debian/xulrunner-1.9-common.install: Put all chrome jars and manifests in
+    the package, instead of using fixed names followed by wildcards.
+  * debian/control: Make xulrunner-1.9 conflict with versions of
+    xulrunner-1.9-common containing moved files.
+  * debian/xulrunner-1.9.postinst: Do registration work on upgrade and
+    become trigger-aware. Also use regxpcom instead of relying on
+    autoregistration of components. Closes: #409049.
+  * debian/xulrunner-1.9.triggers: Add trigger to the xulrunner-1.9 package.
+  * debian/control: Build-depend on trigger-aware version of debhelper.
+  * debian/postinstrm.in: New postinst/postrm trigger-aware template for
+    python-xpcom and xulrunner-1.9-gnome-support, using the same registration
+    technique.
+  * debian/rules: Generate python-xpcom and xulrunner-1.9-gnome-support
+    maintainer scripts from debian/postinstrm.in
+  * debian/python-xpcom.postinst, debian/python-xpcom.prerm,
+    debian/xulrunner-1.9-gnome-support.postinst,
+    debian/xulrunner-1.9-gnome-support.prerm: Removed.
+  * debian/spidermonkey-bin.postinst: As versions 1.8 to 1.8.0.1-6 have long
+    been gone and were never in a stable release, we don't care about
+    upgrading properly from them anymore.
+  * xpcom/reflect/xptcall/src/md/unix/xptcstubs_linux_m68k.cpp,
+    xpcom/reflect/xptcall/src/md/unix/xptcstubs_mips.cpp: Implement more of
+    the new XPCOM ABI on m68k and mips. This fixes FTBFSes on these
+    architectures.
+  * xulrunner/stub/nsXULStub.cpp: Use application.ini in the executable dir
+    without following symlinks for the executable, if present. This will avoid
+    copying the stub in all xulrunner applications like upstream does.
+
+ -- Mike Hommey <glandium@debian.org>  Thu, 01 May 2008 14:41:15 +0200
+
+xulrunner (1.9~b5-3) experimental; urgency=low
+
+  * xpcom/reflect/xptcall/src/md/unix/xptcinvoke_linux_m68k.cpp,
+    xpcom/reflect/xptcall/src/md/unix/xptcinvoke_asm_mips.s,
+    xpcom/reflect/xptcall/src/md/unix/xptcinvoke_mips.cpp: Implement new XPCOM
+    API on m68k and mips. This fixes FTBFSes on these architectures.
+    Closes: #477068.
+  * configure, configure.in, xpcom/base/nscore.h, xpcom/glue/nsMemory.h,
+    xpcom/glue/nsProxyRelease.h, xpcom/glue/nsStringAPI.h,
+    xpcom/glue/standalone/Makefile.in, xpcom/glue/standalone/nsGlueLinking.h,
+    xpcom/glue/standalone/nsXPCOMGlue.h: Don't build the standalone glue as a
+    dynamic library. This is actually not maintenable without being a PITA.
+    Closes: #476920, #476921.
+  * debian/control:
+    + Invert xulrunner-dev and xulrunner-static-dev dependencies on each
+      other.
+    + xulrunner-dev doesn't need to conflict with libxul-dev now it doesn't
+      contain libxpcomglue.so.
+    + Modify xulrunner-dev-static description.
+  * (was: debian/patches/38_armel.dpatch)
+    configure.in, configure: Force to not use -fshort-wchar where it fails.
+    Closes: #476303.
+  * debian/xulrunner-dev-static.install, debian/xulrunner-dev.install: Move
+    all pkg-config files into xulrunner-dev.
+
+ -- Mike Hommey <glandium@debian.org>  Thu, 24 Apr 2008 21:12:31 +0200
+
+xulrunner (1.8.1.14-2) unstable; urgency=low
+
+  * xpcom/reflect/xptcall/src/md/unix/xptcinvoke_ipf64.cpp: Apply fix from
+    bz#419350 for FTBFS with g++-4.3 on ia64. Closes: #477168.
+
+ -- Mike Hommey <glandium@debian.org>  Tue, 22 Apr 2008 22:24:18 +0200
+
+xulrunner (1.8.1.14-1) unstable; urgency=low
+
+  * New security/stability upstream release (taken from upstream CVS)
+  * Fixes mfsa-2008-20, also known as CVE-2008-1380.
+  * debian/patches/38_armel.dpatch: Force to not use -fshort-wchar where it
+    fails. Closes: #476303.
+  * debian/patches/00list: Updated accordingly.
+  * debian/patches/99_configure.dpatch: Updated.
+
+ -- Mike Hommey <glandium@debian.org>  Thu, 17 Apr 2008 21:08:57 +0200
+
+xulrunner (1.9~b5-2) experimental; urgency=low
+
+  * debian/control: Don't make xulrunner-dev depend on xulrunner (the older
+    package).
+  * debian/rules:
+    + Don't add the debian release version in platform.ini. This can create
+      some problems.
+    + Fixed sdk/lib/libxpcomglue.so symlink. Closes: #475614.
+    + Add nspr include files in /usr/include/xulrunner-1.9/(un|)stable/.
+    + Bump shlibs for libxpcomglue0d, and fail when symbols file is not
+      up-to-date.
+  * debian/libxpcomglue0d.symbols: Add symbols file.
+  * xpcom/glue/nsGREGlue.cpp: Fix FTBFS on architectures not defining
+    TARGET_XPCOM_ABI. Closes: #476092.
+  * debian/xulrunner-dev-static.install, debian/xulrunner-dev.install: Move
+    mozilla-gtkmozembed.pc from xulrunner-dev to xulrunner-dev-static.
+    Closes: #475613.
+  * xpcom/base/nscore.h, xpcom/glue/nsMemory.h, xpcom/glue/nsProxyRelease.h,
+    xpcom/glue/nsStringAPI.h: Export standalone glue symbols instead of hiding
+    them. This will make nsAString::BeginReading and many other symbols
+    available.
+  * xpcom/glue/standalone/Makefile.in: Force even more symbols to be exported
+    from standalone glue by removing visibiliby flags.
+  * config/config.mk: Fix FTBFS with newer hunspell due to local hunspell.hxx
+    (from version 1.1) being chosen over system hunspell.hxx because of
+    include flags.
+
+ -- Mike Hommey <glandium@debian.org>  Sat, 19 Apr 2008 13:05:22 +0200
+
+xulrunner (1.9~b5-1) experimental; urgency=low
+
+  * New upstream beta release (taken from upstream CVS).
+  * debian/mozconfig:
+    + Don't enable native uconv. I'm tired of maintaining this broken piece
+      of code (especially considering there are still know broken things).
+    + Don't build with flat chrome. The original need for that was to allow to
+      override content from other packages, but in the end this happened to be
+      made possible with extensions and proper overlays.
+  * debian/xulrunner-1.9-common.install:
+    + Don't install ucnative.xpt, which is native uconv's xpt file.
+    + Add new components files: nsBadCertHandler.js and exthelper.xpt.
+  * intl/uconv/native/nsINativeUConvService.idl,
+    intl/uconv/native/nsNativeUConvService.cpp,
+    intl/uconv/src/charsetalias.properties,
+    intl/uconv/src/nsCharsetConverterManager.cpp: Revert fixes to the native
+    uconv.
+  * debian/control:
+    + Build-depend on zip for jar chrome. This has the side effect to make
+      nsIPref.java removal from MozillaInterfaces-src.jar work.
+    + Bump build dependency on libnss3-dev, since we require additions only
+      available in latest version.
+  * config/config.mk, config/make-jars.pl, configure.in: Revert changes to
+    avoid needing zip when not required.
+  * configure: Updated.
+  * debian/xulrunner-1.9-gnome-support.install, debian/xulrunner-1.9.install:
+    Moved libimgicon.so from xulrunner-1.9-gnome-support to xulrunner-1.9.
+    This component doesn't require gnome, only standard gtk and glib.
+  * memory/jemalloc/Makefile.in, toolkit/library/Makefile.in: Don't link
+    libjemalloc statically into libxul, which has a potential of breaking
+    embedding applications.
+  * netwerk/cookie/src/Makefile.in: Don't turn warnings into errors.
+    Closes: #474925. (Hoping it will not turn in a runtime failure)
+
+ -- Mike Hommey <glandium@debian.org>  Fri, 11 Apr 2008 21:07:40 +0200
+
+xulrunner (1.9~b4-1) experimental; urgency=low
+
+  * New upstream beta release (taken from upstream CVS). Closes: #449448.
+    + Don't crash when font file is unreadable. Closes: #425233.
+    + Better rendering of some extreme conditions. Closes: #391024.
+    + MOZILLA_1_8_BRANCH is not defined anymore: Closes: #441059.
+    + Don't jump when clicking out of the search bar. Closes: #404759.
+    + Ligatures don't overlap the following glyph. Closes: #363159.
+  * debian/patches/*: Remove patches.
+  * debian/rules: Remove patch rules.
+  * debian/control: Don't depend on dpatch.
+  * debian/mozconfig: Use the new default cairo-gtk toolkit.
+  * (was: debian/patches/31_system_bz2.dpatch)
+    config/Makefile.in, config/autoconf.mk.in, config/system-headers,
+    configure.in, extensions/metrics/build/Makefile.in
+    extensions/metrics/src/Makefile.in,
+    extensions/metrics/test/Makefile.in,
+    toolkit/mozapps/update/src/updater/Makefile.in,
+    toolkit/mozapps/update/src/updater/updater.cpp,
+    toolkit/toolkit-tiers.mk: Allow to use system libbz2. bz#305782.
+  * (was: debian/patches/35_zip_cache.dpatch)
+    modules/libjar/nsJAR.cpp, modules/libjar/nsJAR.h: Invalidate cache for
+    modified jar files. bz#368428.
+  * (was: debian/patches/38_gnu.dpatch and debian/patches/38_kbsd.dpatch)
+    config/rules.mk, configure.in, xpcom/glue/standalone/Makefile.in,
+    xpcom/reflect/xptcall/src/md/unix/Makefile.in,
+    xpcom/reflect/xptcall/src/md/unix/xptc_platforms_unixish_x86.h: Support
+    building on GNU/kFreeBSD and GNU/Hurd. bz#356011.
+  * (was: debian/patches/38_hppa_xpcom.dpatch)
+    Most of the patch was applied upstream, but need a small fix in
+    xpcom/reflect/xptcall/src/md/unix/Makefile.in.
+  * (was: debian/patches/38_mips_xpcom.dpatch)
+    xpcom/reflect/xptcall/src/md/unix/Makefile.in,
+    xpcom/reflect/xptcall/src/md/unix/xptcinvoke_asm_mips.s,
+    xpcom/reflect/xptcall/src/md/unix/xptcinvoke_mips.cpp,
+    xpcom/reflect/xptcall/src/md/unix/xptcstubs_asm_mips.s: Fix crashes on
+    mips. bz#258429.
+  * (was: debian/patches/60_js_binary.dpatch)
+    config/autoconf.mk.in, config/rules.mk, configure.in, js/src/Makefile.in:
+    Allow to build a standalone js binary. bz#331776.
+    js/src/xpconnect/shell/Makefile.in: Add readline support to xpcshell.
+    bz#331776.
+    js/src/js.c, js/src/xpconnect/shell/xpcshell.cpp: Avoid visibility hidden
+    issues with readline symbols. bz#331776.
+  * (was: debian/patches/60_pyxpcom.dpatch)
+    extensions/python/xpcom/src/Makefile.in: Allow to override the PYTHON_SO
+    variable.
+  * (was: debian/patches/65_native_uconv.dpatch)
+    intl/uconv/native/nsINativeUConvService.idl,
+    intl/uconv/native/nsNativeUConvService.cpp,
+    intl/uconv/src/nsCharsetConverterManager.cpp: Properly load invalid UTF-8
+    files with native uconv. bz#331748.
+    intl/uconv/src/charsetalias.properties: Fix aliases for gbk and euc-tw for
+    use with native uconv. bz#369403.
+  * (was: debian/patches/68_m68k_xpcom.dpatch)
+    xpcom/reflect/xptcall/src/md/unix/xptcinvoke_linux_m68k.cpp,
+    xpcom/reflect/xptcall/src/md/unix/xptcstubs_linux_m68k.cpp: Improve
+    assembly for m68k. bz#422337.
+  * (was: debian/patches/68_mips_performance.dpatch)
+    config/rules.mk, configure.in: Increase stability and performance on mips.
+    Reverted to Thiemo's original version for better followup with upstream
+    when it will happen (but already has to wait for bz#258429).
+  * (was: debian/patches/80_config.dpatch)
+    debian/rules: Use config.guess and config.sub from autotools-dev.
+  * (was: debian/patches/80_crmf.dpatch)
+    configure.in: Put the crmf library before the NSS libraries.
+  * (was: debian/patches/80_javaxpcom.dpatch)
+    extensions/java/xpcom/Makefile.in, toolkit/toolkit-makefiles.sh: Force
+    creation of Makefiles in extensions/java, even when javaxpcom is disabled.
+    Don't build the jars if DEB_NO_JAR is defined.
+  * (was: debian/patches/80_libxpcom_hack.dpatch)
+    js/src/xpconnect/shell/Makefile.in, xulrunner/app/Makefile.in: Force
+    libxpcom to be linked to xulrunner-bin and xpcshell so that it is loaded
+    in most cases.
+  * (was: debian/patches/80_no_examples.dpatch)
+    xulrunner/Makefile.in: Don't build example component.
+  * (was: debian/patches/80_no_sys_profile.dpatch)
+    xulrunner/app/Makefile.in: Don't install system profile.
+  * (was: debian/patches/80_system_libs.dpatch)
+    configure.in: Make sure we won't be bitten by upstream changing libjpeg,
+    libpng or zlib internal version, which makes system library not used even
+    though --with-system-* argument is given to configure.
+  * (was: debian/patches/80_xulrunner-config.dpatch)
+    build/unix/mozilla-config.in: Give more appropriate cflags and libs.
+  * (was: debian/patches/80_zip.dpatch)
+    config/config.mk, config/make-jars.pl, configure.in: Avoid needing zip if
+    not required. bz#331785.
+  * (was: debian/patches/81_soname.dpatch)
+    config/rules.mk, js/src/Makefile.in, toolkit/library/Makefile.in,
+    xpcom/stub/Makefile.in: Add soname to appropriate libraries. This is
+    a stripped down version, compared to the dpatch version, because we
+    actually are never going to use minor and micro version numbers. Also, we
+    now don't set a SO version on libxul and libxpcom because they will now
+    be dlloaded() by the standalone xpcomglue.
+  * (was: debian/patches/82_locale.dpatch)
+    xulrunner/app/xulrunner.js: Enable intl.locale.matchOS, and report the
+    locale correctly. bz#331779.
+  * (was: debian/patches/82_prefs.dpatch)
+    modules/libpref/src/init/all.js: Set javascript.options.showInConsole ;
+    Set DPI to system settings.
+  * (was: debian/patches/85_installer.dpatch)
+    xulrunner/setup/nsXULAppInstall.js: Install applications in /usr/local/lib
+    instead of /usr/lib.
+  * (was: debian/patches/85_no_register.dpatch)
+    xulrunner/app/nsXULRunnerApp.cpp: Remove (un|)registering system.
+  * (was: debian/patches/85_xpcomglue.dpatch)
+    configure.in, xpcom/base/nscore.h, xpcom/glue/standalone/Makefile.in,
+    xpcom/glue/standalone/nsGlueLinking.h,
+    xpcom/glue/standalone/nsXPCOMGlue.h: Build the xpcom glue as a shared
+    library. Now, also build the dependent xpcom glue.
+    xpcom/glue/standalone/nsGlueLinkingDlopen.cpp: Load DSOs from . when
+    directory is not given.
+  * Other patches have been removed either because incorporated or made
+    obsolete by this new upstream release.
+
+  * config/autoconf.mk.in, configure.in,
+    modules/libpr0n/decoders/png/nsPNGDecoder.cpp,
+    modules/libpr0n/decoders/png/nsPNGDecoder.h,
+    modules/libpr0n/encoders/png/nsPNGEncoder.cpp,
+    modules/libpr0n/encoders/png/nsPNGEncoder.h: Disable APNG support when
+    system libpng doesn't support it.
+  * Makefile.in, netwerk/dns/src/Makefile.in, xulrunner/build.mk: Make
+    distclean cleaner. While previous cleanups have been incorporated
+    upstream, some new files need to be removed. bz#333308.
+  * debian/control:
+    + Add new required build-dependency on libdbus-glib-1-dev.
+    + Build-Depend on libnspr4-dev >= 3.7.0.
+    + Build-Depend on libnss3-dev >= 3.12.0~beta2.
+    + Build-Depend on libcairo2-dev >= 1.5.
+    + Build-Depend on libgtk2.0-dev >= 2.10.
+  * debian/remove.nonfree: Updated for new binary blobs and removed
+    directory/c-sdk removals, since the directory is not here anymore.
+    Also, fixed removal of files with names containing spaces.
+  * debian/copyright: A whole lot of files have been either removed or
+    relicensed under MPL/GPL/LGPL tri-license. Some new external libraries
+    have been incorporated into the source tree, too.
+  * debian/mozconfig: Don't build crash reporter (Google Breakpad).
+  * debian/mozconfig, debian/control: Use system sqlite and lcms.
+  * configure.in: Don't check lcms version, for the same reason as libpng
+    and others.
+  * js/src/Makefile.in, debian/control, debian/libmozjs0d.install,
+    debian/rules: Bumped libmozjs SO version to 1d.
+  * debian/libmozjs0d.README.Debian: Removed, as it is not relevant anymore.
+  * intl/uconv/native/nsNativeUConvService.cpp: Fix native uconv so that
+    XmlHTTPRequest works properly. bz#342133.
+  * xulrunner/installer/Makefile.in, debian/rules: Build as if we were version
+    1.9 instead of 1.9b4. Also fix permissions for /etc/gre.d file.
+  * debian/control, debian/*: Change package names and installed files to fit
+    new upstream.
+  * debian/rules:
+    + Adapted to new upstream files and install method. There is unfortunately
+      only one install target now, and it must be run after build-jars when
+      building binary-indep. This is why we must set .NOTPARALLEL.
+    + Removed source target, which isn't appropriate anymore.
+    + Changed the way we set optimization flags so that we use upstream ones,
+      and arrange LDFLAGS so that -Wl,--as-needed appears before -lpthread
+      during builds.
+  * debian/mozconfig:
+    + Don't set mozilla default home, it's not useful anymore.
+    + Disable stripping of binaries during build.
+  * debian/xulrunner.conf: Removed. The equivalent is now provided by upstream
+    build system.
+  * xulrunner/app/Makefile.in: Link libjemalloc to the xulrunner binary.
+  * libxpcomglue0d.preinst, libxpcomglue0d.postrm: Divert libxpcomglue.so.0d
+    from libxul0d so that both packages can be installed at the same time.
+
+  * (was: debian/patches/99_configure.dpatch)
+    configure: Updated.
+
+ -- Mike Hommey <glandium@debian.org>  Sun, 06 Apr 2008 13:01:04 +0200
+
+xulrunner (1.8.1.13-1) unstable; urgency=low
+
+  * New security/stability upstream release (taken from upstream CVS)
+  * Fixes mfsa-2008-{13-19}, also known as
+    CVE-2007-4879, CVE-2008-0416, CVE-2008-1195, CVE-2008-1233,
+    CVE-2008-1234, CVE-2008-1235, CVE-2008-1236, CVE-2008-1237,
+    CVE-2008-1238, CVE-2008-1240, CVE-2008-1241.
+  * debian/patches/10_SECAlgorithmIDTemplate.dpatch: Removed, as applied
+    upstream.
+  * debian/patches/00list: Updated accordingly.
+
+ -- Mike Hommey <glandium@debian.org>  Wed, 26 Mar 2008 22:50:09 +0100
+
+xulrunner (1.8.1.12-5) unstable; urgency=low
+
+  * debian/patches/65_native_uconv.dpatch: Fixed BOM removal added in release
+    1.8.1.12-3. Closes: #465321.
+  * debian/patches/80_crmf.dpatch: Put the crmf library before the NSS
+    libraries. Closes: #470442.
+  * debian/patches/00list: Updated accordingly.
+  * debian/patches/99_configure.dpatch: Updated.
+
+ -- Mike Hommey <glandium@debian.org>  Tue, 11 Mar 2008 22:11:36 +0100
+
+xulrunner (1.8.1.12-4) unstable; urgency=low
+
+  * debian/patches/10_SECAlgorithmIDTemplate.dpatch: Move
+    SECAlgorithmIDTemplate around so that the lack of its definition in
+    secdert.h doesn't break the build. bz#399589. Closes: #470094.
+  * debian/patches/00list: Updated accordingly.
+
+ -- Mike Hommey <glandium@debian.org>  Sun, 09 Mar 2008 11:14:17 +0100
+
+xulrunner (1.8.1.12-3) unstable; urgency=low
+
+  * debian/patches/99_configure.dpatch: Forgot to update in previous release.
+    Closes: #408745.
+  * debian/patches/65_native_uconv.dpatch: Remove BOM from UTF-16 output.
+    Closes: #456338, #465321, #461450.
+  * debian/rules: Don't ignore $(MAKE) distclean errors.
+  * debian/control:
+    + Bumped Standards-Version to 3.7.3.0. No changes.
+    + Turned Homepage indications in descriptions into a control field.
+    + Fixed GNOME and GnomeVFS capitalization/spelling.
+    + Build depend on binutils >= 2.17 instead of 2.17-1 for mips and mipsel.
+  * debian/spidermonkey-bin.menu: Moved into the Applications/Programming
+    section.
+
+ -- Mike Hommey <glandium@debian.org>  Sat, 08 Mar 2008 20:47:27 +0100
+
+xulrunner (1.8.1.12-2) unstable; urgency=low
+
+  * debian/patches/01_gtkmozembed_change_toplevel.dpatch: Removed, as it is
+    useless (epiphany doesn't support to move tabs between windows), and
+    can lead to crashes. Closes: #461351.
+  * debian/patches/38_kbsd.dpatch, debian/patches/38_gnu.dpatch,
+    debian/patches/80_uname.dpatch: Support GNU/Hurd, and fix FTBFS on
+    GNU/kFreeBSD. Thanks Samuel Thibault. Closes: #408745, #433126.
+  * debian/patches/00list: Updated accordingly.
+
+ -- Mike Hommey <glandium@debian.org>  Sat, 23 Feb 2008 17:05:32 +0100
+
+xulrunner (1.8.1.12-1) unstable; urgency=low
+
+  * New security/stability upstream release (taken from upstream CVS)
+  * Fixes mfsa-2008-01 to mfsa-2008-06 and mfsa-2008-08 to mfsa-2008-11,
+    also known as CVE-2008-0412, CVE-2008-0413, CVE-2008-0414, CVE-2008-0415,
+    CVE-2008-0417, CVE-2008-0418, CVE-2008-0419, CVE-2008-0591,
+    CVE-2008-0592, CVE-2008-0593, CVE-2008-0594.
+  * debian/patches/99_configure.dpatch: Updated.
+
+ -- Mike Hommey <glandium@debian.org>  Sat, 09 Feb 2008 01:21:17 +0100
+
+xulrunner (1.8.1.11-1) unstable; urgency=low
+
+  * New security/stability upstream release (taken from upstream CVS)
+  * Fixes mfsa-2007-37 to mfsa-2007-39, also known as CVE-2007-5947,
+    CVE-2007-5959, CVE-2007-5960.
+  * debian/patches/99_configure.dpatch: Updated, and removed nsprpub/configure
+    changes: we've not been changing nsprpub/configure.in since we use system
+    nspr.
+
+ -- Mike Hommey <glandium@debian.org>  Sat, 01 Dec 2007 15:08:29 +0100
+
+xulrunner (1.8.1.9-2) unstable; urgency=low
+
+  * debian/patches/30_cairo_xlib.dpatch: Properly get cairo lib dependencies
+    and don't rely on GTK bringing them, which just don't happen anymore (see
+    #343711). Patch from bz#344818. Closes: #451464.
+  * debian/patches/00list: Updated accordingly.
+  * debian/patches/99_configure.dpatch: Updated.
+
+ -- Mike Hommey <glandium@debian.org>  Sat, 17 Nov 2007 15:02:22 +0100
+
+xulrunner (1.8.1.9-1) unstable; urgency=low
+
+  * New security/stability upstream release (taken from upstream CVS)
+    + xpidl produces proper java file names. Closes: #435689.
+  * Fixes mfsa-2007-29 to mfsa-2007-36, also known as CVE-2007-1095,
+    CVE-2007-2292, CVE-2006-2894, CVE-2007-3511, CVE-2007-4841,
+    CVE-2007-5334, CVE-2007-5337, CVE-2007-5338, CVE-2007-5339,
+    CVE-2007-5340. Closes: #447734.
+  * debian/remove.nonfree: Remove some more object files.
+  * debian/control: Remove build dependency on ecj-bootstrap, as it doesn't
+    exist anymore, and is not useful nowadays. Closes: #441511.
+  * debian/patches/99_configure.dpatch: Updated.
+  * debian/patches/35_python_2.5.dpatch: Fix FTBFS with python 2.5. Thanks
+    Alexander Sack. Closes: #431483.
+  * debian/patches/10_gdkpango_system_wrapper.dpatch: Create a system wrapper
+    for gdkpango.h to avoid FTBFS because of default visibility.
+  * debian/patches/00list: Updated accordingly.
+
+ -- Mike Hommey <glandium@debian.org>  Thu, 01 Nov 2007 12:52:17 +0100
+
+xulrunner (1.8.1.6-1) unstable; urgency=low
+
+  * New security/stability upstream release (taken from upstream CVS)
+  * Fixes mfsa-2007-{26,27}, also known as CVE-2007-3844, CVE-2007-3845.
+
+ -- Mike Hommey <glandium@debian.org>  Wed, 01 Aug 2007 23:11:08 +0200
+
+xulrunner (1.8.1.5-1) unstable; urgency=high
+
+  * New security/stability upstream release (taken from upstream CVS)
+  * Fixes mfsa-2007-{18-22}, mfsa-2007-{24-25}, also known as
+    CVE-2007-3089, CVE-2007-3285, CVE-2007-3656, CVE-2007-3734,
+    CVE-2007-3735, CVE-2007-3736, CVE-2007-3737, CVE-2007-3738.
+  * debian/remove.nonfree: add more binary files from tarball that don't
+    have sources (Thanks Alexander Sack).
+  * debian/patches/35_psm_wakeups.dpatch: Removed, as applied upstream.
+  * debian/patches/80_system_libs.dpatch: Make sure we won't be bitten by
+    upstream changing libjpeg, libpng or zlib internal version, which
+    makes system library not used even though --with-system-* argument
+    is given to configure. This time, it happened with libpng.
+  * debian/patches/99_configure.dpatch: Updated.
+  * debian/patches/00list: Updated accordingly.
+  * debian/rules: Bumped shlibs for libmozjs as this version introduced 2
+    new symbols.
+  * debian/control: Even laxer dependencies.
+
+ -- Mike Hommey <glandium@debian.org>  Sat, 21 Jul 2007 23:39:50 +0200
+
+xulrunner (1.8.1.4-3) unstable; urgency=low
+
+  * debian/patches/60_js_binary.dpatch: Avoid visibility hidden issues with
+    readline symbols.
+  * debian/patches/85_xpcomglue.dpatch: Fix so that visibility issues don't
+    raise with gcc 4.2.
+  * debian/patches/31_system_bz2.dpatch: Added system wrapper for bzlib.h.
+  * debian/patches/80_hunspell.dpatch: Added system wrapper for hunspell.hxx.
+    All these fix FTBFS with gcc 4.2. Closes: #429744.
+  * debian/control: Fixup some dependencies so that architectures that take
+    time to build can still install libxul-dev.
+
+ -- Mike Hommey <glandium@debian.org>  Sun, 01 Jul 2007 14:23:56 +0200
+
+xulrunner (1.8.1.4-2) unstable; urgency=low
+
+  * debian/patches/85_URI_fixup.dpatch: Enable keyword lookup by default in
+    URI fixup. Temporary until Galeon and Kazehakase are fixed. (bugs #428244
+    and #428245)
+  * debian/patches/00list: Updated accordingly.
+  * debian/patches/80_xulrunner-config.dpatch: Substitutions being done only
+    once a line, split component_includes fixup. Thanks Alexander Sack.
+    Closes: #427079.
+  * debian/libxul0d.postinst, debian/python-xpcom.postinst,
+    debian/python-xpcom.prerm, debian/xulrunner-gnome-support.postinst,
+    debian/xulrunner-gnome-support.prerm: Remove compreg.dat and xpti.dat
+    when installing/removing packages. This avoids problems with compreg.dat
+    files generated ages ago. Closes: #426569, #427569.
+  * debian/patches/82_prefs.dpatch: Set layout.css.dpi to 0 instead of -1.
+    libxul will use system DPI and avoid using huge fonts on systems where
+    DPI < 96. Closes: #426229
+  * debian/control: Improved spidermonkey-bin short description. Thanks CJ
+    Fearnley. Closes: #426614.
+
+ -- Mike Hommey <glandium@debian.org>  Sun, 10 Jun 2007 09:46:32 +0200
+
+xulrunner (1.8.1.4-1) unstable; urgency=high
+
+  * New upstream release (taken from upstream CVS)
+  * Fixes several security issues, including CVE-2007-1116. Closes: #415945.
+  * Acknowledge Steve Langasek's NMU.
+  * debian/patches/65_native_uconv.dpatch: Properly handle when UTF16
+    character can't be converted to the destination charset, avoiding
+    an infinite loop. Closes: #424042.
+  * debian/patches/10_dash_workaround.dpatch,
+    debian/patches/10_pangoxft.dpatch,
+    debian/patches/10_system_nss.dpatch,
+    debian/patches/15_atk_crash.dpatch,
+    debian/patches/15_gtk_dropdown.dpatch,
+    debian/patches/15_passwdmgr.dpatch,
+    debian/patches/20_visibility.dpatch,
+    debian/patches/82_ssl.dpatch: Removed, as being applied upstream.
+  * debian/patches/20_about:plugins.dpatch,
+    debian/patches/25_gnome_helpers_with_params.dpatch,
+    debian/patches/30_distclean.dpatch,
+    debian/patches/65_native_uconv.dpatch,
+    debian/patches/80_javaxpcom.dpatch,
+    debian/patches/81_sonames.dpatch,
+    debian/patches/85_sidebar.dpatch: Adapted to upstream changes.
+  * debian/patches/10_toolkit_library.dpatch: Add Freetype library to the
+    list of linked libraries. Stolen from bz#340795.
+  * debian/patches/61_javaxpcom.dpatch:
+    + Correctly build java files. This part is fixed on upstream trunk.
+    + Install jar file with appropriate permissions. bz#350886 comment #17.
+  * debian/libxul-common.install: Add new components, and remove
+    xmlextras.xpt, which disappeared.
+  * debian/patches/80_xulrunner-config.dpatch: Patch mozilla-config.in so that
+    the changes end up in xulrunner-config.
+  * debian/patches/00list: Updated accordingly.
+  * debian/xulrunner-config: Removed.
+  * debian/copyright: Fixed typo. Thanks to Sam Hocevar.
+  * debian/rules:
+    + Bumped shlibs for libmozjs0d and libxul0d.
+    + Removed shlibdeps tweaks.
+    + Removed dh_makeshlibs call for packages others than libmozjs0d and
+      libxul0d: there are no such packages anymore.
+    + Adapted rules to create javaxpcom jar files.
+    + Revert change from version 1.8.0.11-2 and 1.8.0.10-3 as gcj-4.1 and
+      pcmanx-gtk2 should be fixed now.
+  * debian/patches/80_hunspell.dpatch: Replace myspell support with hunspell,
+    and allow to build with system shared library. Stolen from iceape.
+  * debian/patches/99_configure.dpatch: Updated with autoconf.
+  * debian/mozconfig:
+    + Don't disable xpcom obsolete, it is needed for xpinstall.
+    + Enable spellchecker and use of the system hunspell library.
+      Closes: #404726.
+  * debian/control:
+    + Build depend on appropriate version of libhunspell.
+    + Remove libsmjs-dev and libsmjs1 transition packages.
+  * debian/libxul0d.install, debian/libxul-common.install: Install the
+    spellchecker components.
+  * debian/libxul0d.links: Create the /usr/lib/xulrunner/dictionaries link.
+  * debian/libsmjs-dev.links, debian/libsmjs1.links: Removed.
+  * debian/patches/65_mozjs_abi.dpatch:  Make 1.8.1 ABI compatible with
+    version 1.8.0.
+  * debian/libmozjs0d.README.Debian: Added a note about ABI compatibility.
+  * debian/patches/35_psm_wakeups.dpatch: Avoid some cpu wake ups in PSM.
+    bz#380558.
+  * debian/patches/00list: Updated accordingly.
+
+ -- Mike Hommey <glandium@debian.org>  Sat, 26 May 2007 20:28:00 +0200
+
+xulrunner (1.8.0.11-4.1) unstable; urgency=low
+
+  * Non-maintainer upload
+  * Build with -Wl,--no-relax on alpha, to work around a binutils bug
+    causing a build failure.
+
+ -- Steve Langasek <vorlon@debian.org>  Sun, 20 May 2007 18:14:00 -0700
+
+xulrunner (1.8.0.11-4) unstable; urgency=low
+
+  * debian/rules: Don't make shlibs for components (which happened to make one
+    for libsystem-pref.so, because of the -).
+  * debian/mozconfig: Disabled spell checker, it requires too much cherry
+    picking from 1.8.1 to be any useful for epiphany.
+  * debian/patches/35_system_myspell.dpatch: Removed.
+  * debian/patches/00list: Updated accordingly.
+  * debian/patches/99_configure.dpatch: Updated with autoconf.
+  * debian/control: Removed build dependency on libmyspell-dev.
+  * debian/libxul0d.install, debian/libxul-common.install: Don't install
+    spellchecker files.
+  * debian/libxul0d.links: Don't create the /usr/lib/xulrunner/dictionaries
+    link.
+  * debian/rules:
+    + Fixed the .pc files so that xpcom and js depend on xulrunner-nspr, so
+      that it can be taken from any existing version of libnspr, even the
+      one from older xulrunner releases, not only the one from the new
+      separate package.
+    + Removed shlib versioning for libxul0d, which was due to spellchecker
+      being added.
+
+ -- Mike Hommey <glandium@debian.org>  Mon, 09 Apr 2007 23:55:49 +0200
+
+xulrunner (1.8.0.11-3) experimental; urgency=low
+
+  * debian/control:
+    + Removed libnspr* and libnss* packages.
+    + Adapted dependencies accordingly.
+    + Build-Depend on libnspr4-dev.
+    + Build-Depend on libnss3-dev (>= 3.11.5-2) for nss-config and libcrmf.
+    + Build-Depend on libmyspell-dev.
+    + Bumped Standards-Version to 3.7.2.2. No changes.
+  * debian/libnspr*, debian/libnss*: Removed.
+  * debian/rules:
+    + Replaced some = with :=.
+    + Removed unused AUTOCONF_DIRS variable.
+    + Removed rules for libnspr and libnss.
+    + Added links to nspr include and lib files to sdk.
+  * debian/patches/18_kbsd_nspr.dpatch, debian/patches/60_nspr_m4.dpatch,
+    debian/patches/25_entropy.dpatch, debian/patches/28_ppc64_build.dpatch:
+    debian/patches/38_mips64_build.dpatch,
+    debian/patches/80_security_build.dpatch,
+    debian/patches/80_security_tools.dpatch,
+    debian/patches/38_unsupported_arch_build.dpatch: Removed.
+  * debian/patches/10_system_nss.dpatch: Build with system nss. bz#255408.
+  * debian/patches/35_system_myspell.dpatch: Build with system myspell.
+    Stolen from iceape.
+  * debian/patches/00list: Updated accordingly.
+  * debian/mozconfig:
+    + Use --with-system-nspr and the newly added --with-system-nss.
+    + Enable spellchecker.
+  * debian/patches/80_config.dpatch: Don't put the config.{guess|sub}
+    workaround in the nsprpub directory.
+  * debian/patches/38_kbsd.dpatch: Removed parts that apply to the nss
+    directories.
+  * debian/patches/81_sonames.dpatch: Removed parts that apply to both
+    nspr and nss directories.
+  * debian/patches/99_configure.dpatch: Removed part for the nspr configure
+    script and updated with autoconf.
+  * debian/rules: Set shlibs for libxul0d to versions higher than
+    1.8.0.11-3.
+  * debian/libxul0d.install: Install the spellchecker component.
+  * debian/libxul0d.links: Create the /usr/lib/xulrunner/dictionaries link.
+
+ -- Mike Hommey <glandium@debian.org>  Wed, 28 Mar 2007 21:24:21 +0200
+
+xulrunner (1.8.0.11-2) unstable; urgency=low
+
+  * debian/rules: Use real upstream version instead for xulrunner-plugin.pc
+    dependency on xulrunner-xpcom.pc. Closes: #416425.
+
+ -- Mike Hommey <glandium@debian.org>  Wed, 28 Mar 2007 08:05:04 +0200
+
+xulrunner (1.8.0.11-1) unstable; urgency=low
+
+  * New upstream release (taken from upstream CVS)
+  * Fixes mfsa-2007-11.
+  * debian/python-xpcom.postinst, debian/python-xpcom.prerm: Added missing
+    component registration/unregistration.
+  * debian/patches/25_gnome_helpers_with_params.dpatch: Make MIME registry
+    use system mime.types when it doesn't get extensions from the Gnome
+    registry. Closes: #414008.
+  * debian/rules: Add the debugging symbols from python-xpcom to the
+    libxul0d-dbg package.
+  * debian/control:
+    + Make python-xpcom conflict with epiphany-browser until epiphany
+      fixes its problems with python thread state. Closes: #416031.
+    + Add the fact that python-xpcom debugging symbols are in the
+      libxul0d-dbg package.
+
+ -- Mike Hommey <glandium@debian.org>  Sat, 24 Mar 2007 18:04:03 +0100
+
+xulrunner (1.8.0.10-3) unstable; urgency=low
+
+  * debian/rules: Re-add xulrunner-xpcom requirement in xulrunner-plugin.pc,
+    until classpath, gcj-4.1 and pcmanx-gtk2 get fixed. Closes: #413964.
+
+ -- Mike Hommey <glandium@debian.org>  Fri,  9 Mar 2007 08:14:35 +0100
+
+xulrunner (1.8.0.10-2) unstable; urgency=low
+
+  * debian/copyright: Added licensing terms for the content in the debian
+    directory.
+  * debian/patches/15_passwdmgr.dpatch: Restore parts that were actually
+    NOT applied upstream, and adapt them. Thanks Sam Hocevar for spotting
+    this. Closes: #413991.
+
+ -- Mike Hommey <glandium@debian.org>  Thu,  8 Mar 2007 19:08:10 +0100
+
+xulrunner (1.8.0.10-1) unstable; urgency=low
+
+  * New upstream release (taken from upstream CVS)
+  * Fixes mfsa-2007-{01-07}, also known as
+    CVE-2006-6077, CVE-2007-0008, CVE-2007-0009, CVE-2007-0045,
+    CVE-2007-0775, CVE-2007-0776, CVE-2007-0777, CVE-2007-0778,
+    CVE-2007-0779, CVE-2007-0780, CVE-2007-0800, CVE-2007-0981,
+    CVE-2007-0995.
+  * debian/patches/35_pango_null_char.dpatch: Avoid freeze/crash when null
+    characters are present in justified text by discarding NULL characters
+    before displaying. bz#366902. Closes: #406713.
+  * debian/patches/20_pangoxft.dpatch: Renamed to 10_pangoxft.dpatch and
+    updated with patch from bz#338446 (Stolen from iceape, actually)
+    Also added MOZ_PANGO_LIBS to build command line for the toolkit library.
+  * debian/patches/15_atk_crash.dpatch: Fix random crashed in GetMaiAtkType.
+    bz#302250. (Stolen from iceape, too)
+  * debian/control: Tighten dependency of libxul0d on libxul-common.
+  * debian/patches/15_pango_textarea_position.dpatch: Fix for cursor position
+    when moving in a textarea. bz#366796. Closes: #408914.
+  * debian/patches/35_zip_cache.dpatch: Invalidate cache for a zip file that
+    got modified. It will prevent corruption of the XUL FastLoad cache when
+    upgrade is performed while an instance of the application is running.
+    bz#368428.
+  * debian/patches/80_config.dpatch: Use config.guess and config.sub from
+    autotools-dev.
+  * debian/rules: Don't install config.{guess,sub}, since that was done as a
+    dpatch.
+  * debian/patches/15_nspr_setuid.dpatch,
+    debian/patches/25_passwdmgr_crash.dpatch,
+    debian/patches/20_broken_perl.dpatch: Removed, as being applied upstream.
+  * debian/patches/15_passwdmgr.dpatch,
+    debian/patches/30_distclean.dpatch: Removed parts that were applied
+    upstream.
+  * debian/patches/18_kbsd_nspr.dpatch, debian/patches/25_entropy.dpatch:
+    debian/patches/38_kbsd.dpatch, debian/patches/80_security_tools.dpatch:
+    debian/patches/80_security_build.dpatch,
+    debian/patches/60_xpcomstub.dpatch, debian/patches/61_javaxpcom.dpatch,
+    debian/patches/81_sonames.dpatch, debian/patches/85_installer.dpatch
+    debian/patches/15_passwdmgr.dpatch : Adapted to upstream changes.
+  * debian/patches/80_zip.dpatch: Removed part that is not needed anymore due
+    to changes upstream.
+  * debian/patches/99_configure.dpatch: Updated with autoconf.
+  * debian/control: Make libxul-dev and libmozjs-dev conflict with old
+    versions of mozilla-browser, not the current transition packages for
+    iceape-browser that don't contain conflicting files anymore.
+    Closes: #407966.
+  * debian/libnss3-0d.install: Install libfreebl files.
+  * debian/rules:
+    - Run shlibsign on libfreebl files.
+    - Bump shlibs for libnss3-0d and libnspr4-0d, as they introduced new
+      symbols.
+  * debian/patches/15_gtk_dropdown.dpatch: Fix for focus problem with drop
+    down lists. bz#281551. Closes: #409889.
+  * debian/patches/00list: Updated accordingly.
+  * debian/patches/80_security_build.dpatch: Also added a dirty hack to load
+    libfreebl from /usr/lib/xulrunner.
+  * debian/patches/80_security_tools.dpatch: Also disable rpath.
+
+ -- Mike Hommey <glandium@debian.org>  Thu,  1 Mar 2007 19:01:34 +0100
+
+xulrunner (1.8.0.9-1) unstable; urgency=low
+
+  * New upstream release (taken from upstream CVS)
+  * Fixes mfsa-2006-{68-73} also known as
+    CVE-2006-6497, CVE-2006-6498, CVE-2006-6499, CVE-2006-6500,
+    CVE-2006-6501, CVE-2006-6502, CVE-2006-6503, CVE-2006-6504.
+  * Removed non-free and sourceless binaries from source package
+    with the script from the gnuzilla project, with 2 additional removals of
+    IETF files. Closes: #393422.
+    You can find this modified script for reference in debian/remove.nonfree.
+    Note this script also removes useless CVS files.
+  * debian/patches/80_uname.dpatch: Fix OS_TARGET so that it is correctly set
+    to Linux for things that expect this value instead of linux-gnu (such as
+    the extensions manager)
+  * debian/libxul0d.links: Added a link for libgtkembedmoz in
+    /usr/lib/xulrunner. Closes: #393440.
+  * debian/patches/15_passwdmgr.dpatch: Adapted to changes in upstream. Thanks
+    to Andreas Metzler.
+  * debian/patches/35_crash_focus.dpatch: Removed: applied upstream.
+  * debian/patches/15_nspr_setuid.dpatch: Patches from bz#351470 and bz#365703
+    to fix privilege escalation issues with setuid/setgid program linked
+    against libnspr and some other boundaries issue. Closes: #405062.
+  * debian/patches/18_m68k_xpcom.dpatch: Apply changes provided by Roman
+    Zippel to fix FTBFS of third party software on m68k. Closes: #402011.
+    Renamed as 68_m68k_xpcom.dpatch, since it needs to be sent upstream.
+  * debian/libnss3-dev.links: Add nss.pc symlink to xulrunner-nss.pc.
+    Closes: #402846.
+  * debian/patches/38_kbsd.dpatch, debian/patches/38_mips64_build.dpatch,
+    debian/patches/80_uname.dpatch, debian/patches/18_kbsd_nspr.dpatch:
+    Applied patch from Petr Salinger to build on GNU/kFreeBSD.
+    Closes: #388475.
+  * debian/patches/00list: Updated accordingly.
+  * debian/patches/99_configure.dpatch: Updated with autoconf.
+  * debian/patches/81_soname.dpatch: Updated to fit changes to Linux2.6.mk in
+    38_kbsd.dpatch.
+  * debian/patches/65_native_uconv.dpatch:
+    - Reworked so that UTF-16 is used internally instead of UCS-2, and
+      improved to better handle corner cases.
+    - Allow claimed iso-8859-1 actually encoded as windows-1252 to be
+      converted flawlessly. Closes: #368779, #401784, #405681
+
+ -- Mike Hommey <glandium@debian.org>  Sat,  6 Jan 2007 17:51:16 +0100
+
+xulrunner (1.8.0.8-1) unstable; urgency=high
+
+  * New upstream release (taken from upstream CVS)
+  * Fixes several security issues, CVE-2006-5464, CVE-2006-5748,
+    CVE-2006-5462, CVE-2006-5463, CVE-2006-4310 being some of these.
+  * debian/patches/15_print_fontconfig.dpatch,
+    debian/patches/15_embed_initial_visibility.dpatch: Removed:
+    Applied upstream.
+  * debian/patches/00list: Updated accordingly.
+  * debian/rules: Changed the way we use uptodate config.guess and config.sub.
+    If will make the .diff.gz file lighter.
+
+ -- Mike Hommey <glandium@debian.org>  Sat, 18 Nov 2006 23:04:54 +0100
+
+xulrunner (1.8.0.7-2) unstable; urgency=low
+
+  * debian/patches/65_nativeuconv.dpatch: Reimplement most of the native
+    uconv service so that it works as proper nsUnicode(En|De)coder
+    implementations and don't break things when a multibyte character is
+    split between two buffers. Also add a workaround so that backslash is not
+    turned into Yen in shift-jis, which breaks javascript code using escaping.
+    The layout code turns it back to Yen anyways.
+  * debian/control: Changed dependency versions of arch-indep packages on
+    arch-dependent packages. Closes: #385793.
+  * debian/patches/15_print_fontconfig.dpatch: Patch from bz#294879 to avoid
+    crash with fontconfig when printing. Thanks Alexander Sack.
+    Closes: #390140, #390472, #391119.
+  * debian/patches/00list: Updated accordingly.
+
+ -- Mike Hommey <glandium@debian.org>  Fri,  6 Oct 2006 19:13:56 +0200
+
+xulrunner (1.8.0.7-1) unstable; urgency=low
+
+  * New upstream release (taken from the MOZILLA_1_8_0_7_RELEASE tag in
+    upstream CVS)
+
+  * Fixes the following security vulnerabilities:
+    CVE-2006-4340, CVE-2006-4253, CVE-2006-4565, CVE-2006-4566,
+    CVE-2006-4568, CVE-2006-4569, CVE-2006-4571.
+
+  * Removed patches from NMUs by Matthias Klose, because work done on java
+    build in this release makes them unnecessary.
+  * debian/patches/15_nodataprotocolcontentpolicy_fix.dpatch,
+    debian/patches/15_overthespot.dpatch: Removed, since they've been applied
+    upstream.
+  * debian/patches/35_embed_initial_visibility.dpatch: Renamed as
+    debian/patches/15_embed_initial_visibility.dpatch, since it got applied in
+    an upstream branch.
+  * debian/patches/80_security_tools.dpatch: Added missing backslash.
+    Closes: #385847.
+  * debian/patches/15_jni.dpatch: Patch from bz#333738 to update java stubs.
+  * debian/patches/80_javaxpcom.dpatch: Force creation of Makefiles in
+    extensions/java, even when javaxpcom is disabled. Don't build the jars if
+    DEB_NO_JAR is defined.
+  * debian/patches/00list: Updated accordingly.
+  * debian/mozconfig: Disable javaxpcom.
+  * debian/rules:
+    + Added rules to build the java class files only for binary
+      independent build. This way, no more waiting on java on buildds
+      (especially on arm).
+    + Build the javaxpcomglue from the bundled jni headers instead of the gcj
+      headers.
+  * debian/control: Adapted build dependencies so that the minimum is taken to
+    build the architecture dependant part, and added adequate
+    Build-Depends-Indep field.
+  * debian/patches/80_uname.dpatch: Don't use the ppc_linux stuff for ppc64.
+
+ -- Mike Hommey <glandium@debian.org>  Thu, 28 Sep 2006 20:20:59 +0200
+
+xulrunner (1.8.0.5-4.2) unstable; urgency=low
+
+  * Relax the dependencies even more, so that the -dev packages can be
+    installed with the arm binaries currently in the archive (1.8.0.4).
+
+ -- Matthias Klose <doko@debian.org>  Sun,  3 Sep 2006 13:39:45 +0200
+
+xulrunner (1.8.0.5-4.1) unstable; urgency=medium
+
+  * NMU
+  * Relax dependencies of the -dev packages on the libraries. Closes: #385793.
+
+ -- Matthias Klose <doko@debian.org>  Sun,  3 Sep 2006 10:41:10 +0200
+
+xulrunner (1.8.0.5-4) unstable; urgency=low
+
+  * debian/patches/*: Moved around after some triage.
+    Some changed names, some changed only ordering number.
+    One got split.
+    One, that was disabled because it has been applied upstream, got removed.
+    Two, who were depending on each other, being reordered, have been updated.
+  * debian/patches/30_distclean.dpatch: Added a bit more clean-up, not
+    necessary for xulrunner, but still better to have around. One of the added
+    bits will actually be useful for the 1.8.1 branch, when we'll remove
+    debian/patches/20_visibility.dpatch.
+  * debian/patches/00list: Added a nomenclature for the patches naming.
+
+  * debian/patches/80_security_tools.dpatch: Enable building of some NSS
+    tools.
+  * debian/patches/00list: Updated accordingly.
+  * debian/control:
+    + Added a libnss3-tools package to contain these NSS tools.
+    + Added proper conflicts to libnss3-tools.
+  * debian/libnss3-tools.install: Install the binary files in the newly
+    created package.
+  * debian/rules: Strip files from the libnss3-tools package and put the
+    debugging symbols into libnss3-dbg.
+    Closes: #377269.
+  * debian/control: Use the suggestion from lintian for binNMU safety instead
+    of our previous own. And really add binNMU safety to libnss3-dev.
+
+ -- Mike Hommey <glandium@debian.org>  Fri,  1 Sep 2006 07:38:05 +0200
+
+xulrunner (1.8.0.5-3) unstable; urgency=low
+
+  * The ${host_cpu} is not uname -m release.
+
+  * debian/patches/90_xpcom_hppa.dpatch: Added support for 'hppa' instead of
+    'parisc' and 'parisc64' since we changed from using `uname -m` to using
+    ${host_cpu}. I'm not putting hppa64 because I don't think the code works
+    on parisc64.
+  * debian/patches/01_uname.dpatch: Fixed
+    xpcom/reflect/xptcall/src/md/unix/Makefile.in so that it recognizes
+    powerpc instead of ppc, since we now use ${host_cpu}. Thanks a lot to
+    Michel Dänzer for the big hint. Closes: #383053, #383056, #383313.
+
+ -- Mike Hommey <glandium@debian.org>  Fri, 25 Aug 2006 20:37:55 +0200
+
+xulrunner (1.8.0.5-2) unstable; urgency=low
+
+  * The Fix-ups release.
+
+  * debian/patches/01_libxpcom_hack.dpatch: Force libxpcom to be linked to
+    xulrunner-bin, xpcshell and libgtkmozembed so that it is loaded in most
+    of the cases.
+  * debian/patches/01_passwdmgr_crash.dpatch: Avoid crash of the password
+    manager when embedding applications don't set a profile directory. Patch
+    from bz#294075. Closes: #376323.
+  * debian/patches/01_gnome_helpers_with_params.dpatch: Make helper
+    applications with parameters work. Adapted patch from bz#273524.
+    Closes: #381291.
+  * debian/patches/01_nspr_m4.dpatch: Avoid aclocal warnings about
+    underquoted definition of AM_PATH_NSPR". Closes: #382539.
+  * debian/patches/01_gtkmozembed_change_toplevel.dpatch: Fix drop-down menus
+    when gtkmozembed is moved from different toplevel. Patch from bz#296002.
+    Closes: #367106.
+  * debian/patches/01_overthespot.dpatch: Apply patch from bz#271815 for GTK2
+    IM Over-The-Spot support.
+  * debian/patches/00list: Updated accordingly.
+  * debian/control:
+    + Make the controls more BinNMU compliant. Closes: #384200, #384203.
+    + Bumped Standards-Version to 3.7.2.1. No changes.
+
+ -- Mike Hommey <glandium@debian.org>  Tue, 22 Aug 2006 23:15:16 +0200
+
+xulrunner (1.8.0.5-1) unstable; urgency=high
+
+  * The "upstream doesn't, so I do" release: Checked out the
+    XULRUNNER_1_8_0_5_RELEASE tagged code from upstream CVS.
+
+  * Fixes the following security vulnerabilities:
+    CVE-2006-3113, CVE-2006-3677, CVE-2006-3801, CVE-2006-3802,
+    CVE-2006-3803, CVE-2006-3805, CVE-2006-3806, CVE-2006-3807,
+    CVE-2006-3808, CVE-2006-3809, CVE-2006-3810, CVE-2006-3811,
+    CVE-2006-3812.
+
+  * debian/patches/01_pyxpcom_deadcode.dpatch: Remove pyxpcom dead code and
+    fix FTBFS on alpha this way. Closes: #381662.
+  * debian/patches/01_nodataprotocolcontentpolicy_fix.dpatch: Fix from
+    Firefox 1.5.0.6 to allow urls like mms:// in <object/>s
+  * debian/patches/01_uname.dpatch: Use ${host_*} variables instead of
+    uname in configure.in. Closes: #377418.
+    This is a minimalist patch to solve the particular bad assembler choice
+    issue. It would need a much greater work to actually do something totally
+    clean, but the current patch should be enough for Linux builds.
+  * debian/patches/00list: Updated accordingly.
+  * debian/patches/99_configure.dpatch: Updated with autoconf.
+  * debian/libxul-dev.install: Install files from SDK independently and don't
+    install the jar files from sdk/lib, since they are in the
+    libmozillainterfaces-java package.
+  * debian/control: Fixed typo in libxul-common description.
+  * debian/rules: Bumped shlibs for libmozjs as this version introduced 2
+    new symbols.
+
+ -- Mike Hommey <glandium@debian.org>  Wed,  9 Aug 2006 21:01:47 +0200
+
+xulrunner (1.8.0.4-2) unstable; urgency=low
+
+  * The "finally enabling these stuff" release.
+
+  * debian/watch: Stole the watch file from firefox.
+  * debian/rules, debian/control, debian/mozconfig,
+    debian/libmozillainterfaces-java.install,
+    debian/libmozillainterfaces-java.links, debian/*.conf: Enable pyxpcom
+    and javaxpcom again, with some changes on the python part, to fit the
+    new python policy. Closes: #173264, #277120, #373906.
+  * debian/python-xpcom.dirs, debian/python-xpcom.install: Replace the
+    previous .in files, and replace PYVERS by a wildcard.
+  * debian/control:
+    + Added build dependency on python-support and python-dev.
+    + Only create a python-xpcom package instead of pythonX.Y-xpcom.
+    + Added XB-Python-Version field to python-xpcom.
+    + Bumped debhelper dependency.
+  * debian/pyversions, debian/pycompat: Files necessary for dh_pysupport and
+    dh_python.
+
+  * debian/libxul-common.*, debian/libxul0d.*, debian/control: Create a new
+    libxul-common package for most architecture independent files.
+
+  * debian/control: Add a build dependency on binutils >= 2.17-1 for mips and
+    mipsel, where #274738 is fixed.
+  * debian/patches/90_mips_performance.dpatch: Remove the xgot hack.
+    Closes: #374389. Thanks Thiemo Seufer.
+    Also remove the specific setting of MOZ_DEBUG_FLAGS="-g" for mips, it's
+    built with -g anyways.
+  * debian/rules:
+    + Bump shlib for libmozjs0d because of a new symbol. Other libraries were
+      not subject to symbol additions, so we can keep them as they are.
+      Closes: #376374.
+    + Removed an extra parenthesis to really build with minimal toc on ppc64.
+      Dammit. Closes: #361188.
+  * debian/patches/01_crash_focus: Fix a crasher and several similar potential
+    crashers.
+  * debian/patches/00list: Updated accordingly.
+
+ -- Mike Hommey <glandium@debian.org>  Sat,  8 Jul 2006 14:22:43 +0200
+
+xulrunner (1.8.0.4-1) unstable; urgency=high
+
+  * The "finally a new upstream" release.
+  * Fixes the following security vulnerabilities:
+    CVE-2006-2775, CVE-2006-2776, CVE-2006-2778, CVE-2006-2780,
+    CVE-2006-2782, CVE-2006-2783, CVE-2006-2784, CVE-2006-2785,
+    CVE-2006-2786, CVE-2006-2787.
+
+  * debian/patches/00_securityfix.dpatch: Removed, since this release includes
+    all the security changes we brought from CVS in this patch.
+  * debian/patches/90_js_mipsel_endianness.dpatch: Removed, since it was
+    applied upstream.
+  * debian/patches/01_installer.dpatch,
+    debian/patches/01_javaxpcom.dpatch: Removed parts that were applied
+  * debian/patches/00list: Updated accordingly.
+  * debian/patches/01_distclean.dpatch,
+    debian/patches/01_xpcomglue.dpatch: Adapted to upstream changes.
+    upstream.
+  * debian/patches/99_configure.dpatch: Updated.
+
+  * debian/patches/01_pyxpcom.dpatch: Use a make variable for PYTHON_SO.
+  * debian/patches/90_unichar_alignment.dpatch.
+  * debian/patches/00list: Added 90_unichar_alignment.
+  * debian/rules:
+    + Set this PYTHON_SO variable when building python modules.
+    + Disabled strict aliasing from optimized builds.
+    + Build with minimal toc on ppc64. Closes: #361188.
+    + Fix for Gecko date extraction from client.mk.
+  * debian/mozconfig: Set default mozilla home.
+  * debian/control: Replaced some Conflicts with Replaces, which should be fine.
+
+  * debian/rules, debian/control, debian/mozconfig, debian/python-xpcom.dirs.in,
+    debian/python-xpcom.install.in, debian/libmozillainterfaces-java.install,
+    debian/libmozillainterfaces-java.links, debian/*.conf: Remove pyxpcom and
+    javaxpcom (again) packages and build. We want this release not to go through
+    NEW (again).
+
+ -- Mike Hommey <glandium@debian.org>  Thu, 15 Jun 2006 01:05:34 +0200
+
+xulrunner (1.8.0.1-12) unstable; urgency=low
+
+  * The release of the Beast.
+  * debian/control:
+    + Added dependency upon libnss3-dev to libxul-dev.
+    + Fixed dependencies and conflicts so that the package should be binNMU
+      safe.
+    + Depends upon dpkg-dev >= 1.13.19 accordingly.
+  * debian/control, debian/rules: xulrunner must depend on libxul0d
+    versions >= 1.8.0.1-9. Closes: #370152.
+
+  * Add support for PyXPCOM:
+    + debian/mozconfig: Added the python/xpcom extension.
+    + debian/control: Added build dependency on python-dev. Added
+      python2.3-xpcom and python2.4-xpcom packages.
+    + debian/python-xpcom.install.in: Install template for python XPCOM files.
+    + debian/python-xpcom.dirs.in: Directories to create in python XPCOM
+      packages.
+    + debian/rules:
+      - Add rules to build the python xpcom packages.
+      - Add a shlibs.local hack to have python xpcom packages correctly depend
+        on libxul0d >= 1.8.0.1-12.
+    + debian/patches/01_no_examples.dpatch: Don't install the pyxpcom sample
+      component.
+    Closes: #173264, #277120.
+
+  * Add support for JavaXPCOM again:
+    + debian/mozconfig: --enable-javaxpcom.
+    + debian/*.conf: Set javaxpcom=1.
+    + debian/control: Added a build dependency on java-gcj-compat-dev
+      >= 1.0.56 to avoid #365934, and force build dependency on ecj-bootstrap
+      >= 3.1.2-6 to avoid #361608.
+    + debian/rules: Uncommented the javaxpcom related rules. Removed the
+      workarounds for #365934 and #361608. Install all MozillaInterfaces jar
+      files in the sdk directory.
+    + debian/libxul0d.install: Uncommented the javaxpcom files. Removed
+      installation of MozillaInterfaces.jar.
+    + debian/control: Added a libmozillainterfaces-java package for the public
+      java interfaces.
+    + debian/libmozillainterfaces-java.(install|links): Install
+      MozillaInterfaces.jar in /usr/share/java, and install the -src.jar file
+      in the sdk directory.
+    + debian/patches/01_pyxpcom.dpatch: Fix installation directory.
+    + debian/patches/00list: Updated to include this new patch.
+
+ -- Mike Hommey <glandium@debian.org>  Tue,  6 Jun 2006 23:26:09 +0200
+
+xulrunner (1.8.0.1-11) unstable; urgency=low
+
+  * The "Let's get migrated" release.
+  * debian/control: Don't build-depend on java-gcj-compat-dev.
+  * debian/libxul0d.install: Comment out the javaxpcom files installation.
+  * debian/rules: Comment out javaxpcom related rules, but put the fix for
+    jni.h detection nevertheless. Closes: #367863.
+  * debian/*.conf: Set javaxpcom=0.
+  * debian/mozconfig: --disable-javaxpcom.
+
+  * debian/rules:
+    + Remove extra parenthesis in the productComment.
+    + Generate the .chk file from the stripped libsoftokn3.so.0d.
+  * debian/patches/01_security.dpatch: Build the shlibsign utility again, so
+    that we can generate the .chk that can be useful for FIPS mode, but don't
+    build the .chk file automatically since we are going to strip the library,
+    making the .chk file obsolete.
+  * debian/patches/01_ssl.dpatch: Disable SSLv2 and SSLv3 40-bit ciphers.
+    Closes: #308334.
+  * debian/patches/01_soname.dpatch: Change the way libnss tries to find the
+    .chk file for FIPS mode so that the .chk file name needn't contain ".so"
+    when using a full SONAME.
+  * debian/patches/00list: Apply 01_security after 01_soname ; Added 01_ssl.
+  * debian/libxul0d.README.Debian: Add a note about SSLv2 and SSLv3 40-bit
+    ciphers.
+
+ -- Mike Hommey <glandium@debian.org>  Sat, 20 May 2006 21:23:00 +0200
+
+xulrunner (1.8.0.1-10) unstable; urgency=critical
+
+  * The "how dumb can I be ?" release.
+  * debian/rules: Don't use x86 specific directory to find jni.h.
+
+ -- Mike Hommey <glandium@debian.org>  Sun, 14 May 2006 01:25:10 +0200
+
+xulrunner (1.8.0.1-9) unstable; urgency=critical
+
+  * The "I wish they had a distribution-friendly security policy" release.
+  * Fixes the following security vulnerabilities:
+    CVE-2006-0297, CVE-2006-0748, CVE-2006-1530, CVE-2006-1531,
+    CVE-2006-1723, CVE-2006-1724, CVE-2006-1725, CVE-2006-1726,
+    CVE-2006-1727, CVE-2006-1728, CVE-2006-1729, CVE-2006-1730,
+    CVE-2006-1732, CVE-2006-1742.
+  * Should fix the following security vulnerabilities:
+    CVE-2006-0884, CVE-2006-1045, CVE-2006-1529, CVE-2005-2353.
+  * debian/patches/00_securityfix.dpatch: All security patches for the issues
+    above. I hope none has been forgotten, it has been a real PITA to go
+    through all the patches in upstream CVS to find those commits that *might*
+    be related to fixing the flaws.
+
+  * debian/patches/01_native_uconv.dpatch:
+    + Add the scriptableunicodeconverter component. Will make chatzilla work.
+    + Fix GBK and EUC-TW charset names so that iconv recognizes them.
+      Closes: #365886.
+  * debian/patches/01_killAll.dpatch, debian/xulrunner.install: Correctly
+    install the killAll component.
+  * debian/patches/01_js_binary.dpatch: Add readline support to xpcshell.
+  * debian/patches/01_no_register.dpatch: Remove (un|)registering system. We
+    don't need it since we register ourselves.
+  * debian/patches/01_broken_perl.dpatch: Apply patch from bz#325148 instead
+    of removing the broken perl code.
+  * debian/patches/01_no_chromelist.dpatch: Also correctly call make-jars.pl
+    to avoid creation of unexpected chrome in dist/bin instead of
+    dist/bin/chrome.
+  * debian/mozconfig:
+    + Disable elf-dynstr-gc, which is pretty useless nowadays.
+    + Enable javaxpcom support.
+  * debian/rules:
+    + Added a check between dist/bin and $DESTDIR/usr/lib/xulrunner to see if
+      upstream correctly installs everything...
+    + Set JAVA_HOME for configure to find the java compiler.
+    + Work around bug #361806 by setting JAVAC at build time.
+    + Work around bug #365934 by using --with-java-include-path configure
+      option, and work around a feature of cpp by creating a symlink to the
+      real location of jni.h in the debian directory.
+    + Don't install dependentlibs.list (see debian/patches/01_xpcomstub.dpatch
+      below).
+    + Changed the way we move libraries to /usr/lib.
+    + Changed the User-Agent string again, it seems too many dumb scripts use
+      the useless date from the product string.
+  * debian/control: Added java-gcj-compat-dev to build dependencies.
+  * debian/patches/01_javaxpcom.dpatch:
+    + Apply patch from bz#327654 to be able to actually build the javaxpcom
+      stuff.
+    + Allow to build with gcj headers.
+    + Don't install GenerateJavaInterfaces.
+    + Correctly install javaxpcom.jar.
+    + Don't use visibility flags so that symbols are exported.
+  * debian/*.conf: Set jaxaxpcom to 1.
+  * debian/patches/01_icons.dpatch: Apply patch from  bz#314927 to install
+    default.xpm in the right place
+  * debian/xulrunner.install: Install chrome/icons, where default.xpm is
+    sitting.
+  * debian/patches/01_installer.dpatch: Apply patch from bz#328505 to allow
+    to install without a vendor name.
+  * debian/patches/01_mouse_buttons.dpatch: Extended mouse buttons support
+    taken from #244305. Thanks Peter Colberg.
+  * debian/patches/01_xpcomstub.dpatch: Correctly install dependentlibs.list
+    and apply patch from bz#332262 for it to contain NSS libraries.
+  * debian/patches/01_distclean.dpatch: Make distclean cleaner.
+  * debian/patches/01_target_xpcom_abi.dpatch: Apply patch from bz#322450 plus
+    the OS_TEST fix that got landed at the same time so that TARGET_XPCOM_ABI
+    is correctly set on sparc.
+  * debian/patches/01_embed_initial_visibility.dpatch: Apply patch from
+    bz#312998 to fix gtkmozembed's EmbedWindow::GetVisibility. Closes: #365868.
+  * debian/patches/01_config_install.dpatch: Correct installation of all the
+    headers files from the config/ directory.
+  * debian/patches/00list: Updated to include all the new patches.
+  * debian/patches/99_configure.dpatch: Updated.
+  * debian/control:
+    + Bumped Standards-Version to 3.7.2.0. No changes.
+    + Add small text about the SDK to libxul-dev's description.
+    + Make libxul-dev depend on xulrunner for the development tools (xpt_link,
+      xpt_dump, xpidl, regxpchrome)
+  * debian/rules, debian/libxul-dev.install: Install the SDK files.
+  * debian/libxul0d.install: Install MozillaInterfaces.jar in
+    /usr/lib/xulrunner instead of inside the SDK (but put a symlink there),
+    since it is useful to embed javaxpcom.
+  * debian/libxul0d.install, debian/xulrunner.install: Move the PSM files
+    from xulrunner to libxul0d. Closes: #359220, #359226.
+  * debian/control: Make libxul0d conflict with those older versions of
+    xulrunner that included the PSM files.
+
+ -- Mike Hommey <glandium@debian.org>  Sat, 13 May 2006 23:22:35 +0200
+
+xulrunner (1.8.0.1-8) unstable; urgency=low
+
+  * debian/libxul0d.install:
+    + Install xpt files one by one instead of glob, so that we:
+      - put mozgnome.xpt in xulrunner-gnome-support
+        (debian/xulrunner-gnome-support.install)
+      - don't install the sample simple.xpt
+    + Don't install the sample component libsimpletest.so.
+  * debian/rules:
+    + Don't remove the .chk file, since we don't install it anymore.
+    + Use -Wl,--as-needed as LDFLAGS. That will work around upstream linking
+      strategy to limit useless linkage.
+    + Use a specific LD_LIBRARY_PATH at link time so that we don't need to
+      link against indirect dependencies. This is a temporary workaround until
+      this is workaround some better other way.
+    + Added some install checks after binary packages build, so that we can
+      know if we forgot anything.
+    + Fixed the way we get the DEBIAN_VERSION.
+  * debian/patches/01_native_uconv.dpatch:
+    + Don't build intl/uconv/ucvja and friends, since this is supported by
+      the native uconv implementation and not even linked into something we
+      ship.
+    + Properly load invalid UTF-8 files and more generally malformed files
+      as to their (supposed) encoding. Closes: #358815, #359049, #358599.
+  * debian/patches/01_prefs.dpatch: set javascript.options.showInConsole.
+  * debian/patches/01_security_build.dpatch:
+    + Don't build the stuff we don't need, and dynamically link libnssckbi to
+      both libplc4 and libplds4 instead of linking statically.
+    + Build with debugging symbols.
+  * debian/patches/01_no_chromelist.dpatch: Don't build chromelist.txt files.
+  * debian/patches/01_no_sys_profile.dpatch: Don't install system profile.
+  * debian/patches/01_no_examples.dpatch: Don't build the examples.
+  * debian/patches/01_xpcomglue.dpatch:
+    + Build the xpcom glue as a shared library.
+    + Load DSOs from . when directory is not given. That makes regxpcom work
+      as "expected".
+  * debian/patches/80_xpidl.dpatch: Added an error message when no file is
+    given, to sync with the patch against trunk I sent upstream.
+  * debian/patches/01_about:plugins.dpatch: Install the files for
+    about:plugins. Closes: #354037, #356082.
+  * debian/patches/01_installer.dpatch: Install applications in /usr/local/lib
+    instead of /usr/lib.
+  * debian/patches/00list: Updated accordingly.
+  * debian/patches/99_configure.dpatch: Updated.
+  * debian/rules, debian/spidermonkey-bin.install: Move out some files from
+    the install target instead of the binary target. Install them with
+    dh_install.
+  * debian/control: Bumped to Standards-Version: 3.6.2.2. No changes required.
+  * debian/libxul0d.postinst, debian/libxul0d.preinst: Instead of removing
+    compreg.dat and xpti.dat to solve #357589, create a .autoreg file. That
+    will trigger components registration in all cases, even in cases where the
+    component registry was stored in a profile directory.
+    Do it on postinst at configure time instead of preinst.
+  * debian/xulrunner-gnome-support.{postinst|prerm}: Also do it when
+    configuring or removing xulrunner-gnome-support.
+  * debian/libxul0d.prerm: Remove all files that could be generated by running
+    xulrunner or programs using libxul as root, plus the .autoreg file we
+    create in case it's still there.
+  * debian/libxul0d.install, debian/libxul-dev.install: Install the
+    libxpcomglue files.
+  * debian/control, debian/rules: Added debugging symbols in separated
+    packages.
+  * debian/control, debian/compat: Bumped debhelper compatibility to 5.
+  * debian/libxul0d.links: Add links to the libraries in /usr/lib/xulrunner.
+    That will allow some (but not all, because of C++ ABI differences)
+    components from mozilla and/or upstream to work with xulrunner. It also
+    allows the XPCOM Glue to kinda work without deep modifications.
+  * debian/libxul0d.conf, debian/xulrunner.conf, debian/libxul0d.install,
+    debian/xulrunner.install, debian/rules: Install GRE "configurations" into
+    /etc/gre.d. That is used by the XPCOM Glue (thus, by the xulrunner stub).
+  * debian/rules, debian/libxul0d.install: Install the dependentlibs.list file.
+
+ -- Mike Hommey <glandium@debian.org>  Sat,  1 Apr 2006 16:09:27 +0200
+
+xulrunner (1.8.0.1-7) unstable; urgency=low
+
+  * debian/rules: Add -g to the build flags when building with
+    DEB_BUILD_OPTIONS=nostrip. If we ask for nostrip, we want the debugging
+    symbols, right? ;)
+  * debian/libxul0d.preinst, debian/libxul0d.prerm: Remove
+    /usr/lib/xulrunner/components/{compreg|xpti}.dat files on upgrade and
+    removal. Closes: #357589. That will also avoid gnome-support components to
+    be ignored if they were created when the components were not yet
+    installed.
+
+ -- Mike Hommey <glandium@debian.org>  Thu, 23 Mar 2006 23:02:29 +0100
+
+xulrunner (1.8.0.1-6) unstable; urgency=low
+
+  * debian/copyright: Fixed typo.
+  * debian/patches/90_mips64_build.dpatch: Patch from Martin Michlmayr for
+    mips64 builds.
+  * debian/patches/90_unsupported_arch_build.dpatch: Don't use x86 as CPU_ARCH
+    when building on an unsupported architectures. Closes: #357035.
+  * Put back some stuff that used to be in spidermonkey-bin:
+    + debian/rules, debian/smjs.1: Add the manual page.
+    + debian/rules, debian/spidermonkey-bin.menu: Add the menu item.
+    + debian/spidermonkey-bin.postinst, debian/spidermonkey-bin.prerm:
+      Add the /usr/bin/js alternative. Closes: #355729.
+  * debian/mozconfig: Enable iconv support.
+  * debian/patches/01_native_uconv.dpatch: Fix for the build to succeed when
+    iconv support is enabled.
+  * debian/patches/00list: Updated accordingly.
+
+ -- Mike Hommey <glandium@debian.org>  Fri, 17 Mar 2006 07:16:10 +0100
+
+xulrunner (1.8.0.1-5) unstable; urgency=low
+
+  * debian/mozconfig: DON'T build the typeaheadfind module. It will cause
+    problems with firefox as stated before AND with the newer Galeons. I guess
+    it will also be problematic with newer Epiphanies.
+  * debian/rules: Changed the Gecko/Debian/x.y.z.t-r string to
+    Gecko/Debian-x.y.z.t-r for RFC2616 compliance. Thanks Josh Triplett and
+    Matthew Wilcox.
+  * debian/rules, debian/xulrunner-config: Provide a version of
+    xulrunner-config that gives more appropriate cflags and libs.
+
+ -- Mike Hommey <glandium@debian.org>  Mon, 27 Feb 2006 19:44:59 +0100
+
+xulrunner (1.8.0.1-4) unstable; urgency=low
+
+  * debian/mozconfig:
+    + Build the typeaheadfind module. It will enable it in Galeon and
+      Epiphany, but might cause problems with future firefoxes built on top on
+      xulrunner. That will need to be investigated further.
+    + Build with a flat chrome instead of jar files.
+  * debian/libxul0d.install, debian/xulrunner.install: Changed chrome
+    wildcards accordingly.
+  * debian/patches/01_zip.dpatch: Don't need zip if not needed (not building
+    jar files)
+  * debian/patches/01_broken_perl.dpatch: Remove useless broken perl code.
+  * debian/patches/01_useragent.dpatch: Remove useless useragent setter at
+    startup so that general.useragent.product and general.useragent.productSub
+    set in our vendor.js preference file work at startup time.
+  * debian/patches/99_configure.dpatch: Updated.
+  * debian/patches/00list: Updated accordingly.
+  * debian/control: Removed build dependency upon zip.
+
+ -- Mike Hommey <glandium@debian.org>  Tue, 21 Feb 2006 18:36:26 +0100
+
+xulrunner (1.8.0.1-3) unstable; urgency=low
+
+  * debian/control:
+    + Added a conflict against mozilla-browser on libxul-dev. Closes: #353600.
+    + Renamed libsmjs1-dev to libsmjs-dev, since that what is the name of the
+      dev package provided by the old spidermonkey package.
+    + Sync sections with override for spidermonkey-bin, libsmjs1 and
+      libsmjs-dev.
+  * debian/libsmjs1-dev.links: Renamed to libsmjs-dev.links.
+  * debian/patches/90_xpcom_hppa.dpatch: Somehow, the assembler files got
+    their content twice. Fixing that should make it build properly on HPPA.
+  * debian/xulrunner.*, debian/libxul0d.*:
+    + Moved /usr/share/xulrunner/defaults from xulrunner to libxul0d ; leave
+      out profile and preferences. They will be reintroduced if they appear to
+      be really useful. As for now, they just seem to be vestiges of Mozilla,
+      Firefox or Thunderbird.
+    + Moved /usr/share/xulrunner/res from xulrunner to libxul0d.
+    + Moved /usr/share/xulrunner/chrome/classic.*, en-US.* and toolkit.* from
+      xulrunner to libxul0d. If the other chrome files appear to be required
+      for something else, we might consider moving them as well.
+  * debian/control: Add a conflict on older xulrunner to libxul0d according to
+    the moving around of files.
+  * debian/rules: Changed the way we identificate ourselves in
+    /usr/share/xulrunner/defaults/pref/vendor.js, and move it in libxul0d.
+    We will using be Gecko/Debian/<debian_release> instead of Gecko/yyyymmdd,
+    which was pointless anyway, because it was giving the date of the build,
+    not the date of the API...
+  * debian/patches/01_prefs.dpatch: Fix some printer and font configuration.
+  * debian/patches/00list: Updated accordingly.
+
+ -- Mike Hommey <glandium@debian.org>  Mon, 20 Feb 2006 23:11:39 +0100
+
+xulrunner (1.8.0.1-2) unstable; urgency=low
+
+  * debian/rules:
+    + copy LICENSE instead of creating a link.
+    + add -A to dh_installdocs.
+    + don't install README.txt.
+    + don't change xulrunner-gtkmozembed.pc, xulrunner-plugin.pc
+      and xulrunner-xpcom.pc. Some applications that build against gecko
+      seem to make bad assumptions, at least with gtkmozembed. It is safest
+      this way, until things change upstream.
+  * debian/patches/01_sonames.dpatch: Fix the dirname complain.
+  * debian/xulrunner.install, debian/xulrunner.links, debian/libxul0d.install,
+    debian/libxul0d.links: Moved greprefs from xulrunner to libxul0d.
+    The usually necessary changes to dependencies and conflicts have not been
+    made because 1.8.0.1-1 never reached the archive.
+  * debian/patches/90_js_mipsel_endianness.dpatch: Patch to fix little
+    endianness of mipsel. Thanks Ian Jackson and Thiemo Seufer.
+  * debian/patches/80_passwdmgr.dpatch: Take patch from bz#235336 as suggested
+    by Ian Jackson to allow password manager to work with sites that only have
+    a password field, no username.
+  * debian/patches/01_gfx_cairo.dpatch, debian/patches/01_gfx_thebes.dpatch,
+    debian/patches/01_canvas_cairo.dpatch: Removed. They were for the 1.9
+    branch.
+  * debian/patches/00list: Updated accordingly.
+
+ -- Mike Hommey <glandium@debian.org>  Wed,  8 Feb 2006 18:53:28 +0100
+
+xulrunner (1.8.0.1-1) unstable; urgency=low
+
+  * Initial release. Closes: #284189.
+  * First upstream release: 1.8.0.1, synched with Firefox 1.5.0.1.
+  * debian/patches/99_configure.dpatch: Updated.
+  * debian/rules:
+    + Removed package names from the dh_makeshlibs call. It just works fine
+      with the -a option.
+    + Removed useless dh_shlibdeps call when building arch-independent
+      packages.
+    + Removed the -l option to the dh_shlibdeps call, it works fine without.
+    + Move libnssckbi.so back in /usr/lib/xulrunner.
+    + Add a MPL file to the docs installed, taken from the upstream LICENSE
+      file.
+  * debian/control:
+    + Added a xulrunner-gnome-support package for a separate gnome support.
+    + Made the xulrunner package suggest this new package.
+    + Typos corrections.
+    + Add sections to packages.
+  * debian/xulrunner-gnome-support.install: Install the gnome related
+    components.
+  * debian/libxul0d.install, debian/xulrunner.install: Moved some components
+    from libxul0d to xulrunner.
+  * debian/patches/01_ckbi_location: Removed.
+  * debian/patches/00list: Updated accordingly.
+  * debian/copyright: Updated.
+
+ -- Mike Hommey <glandium@debian.org>  Tue,  7 Feb 2006 19:52:24 +0100
+
+xulrunner (1.7.99+cvs20060113-1) experimental; urgency=low
+
+  * New CVS checkout.
+  * debian/mozconfig: Disable Java-XPCOM bridge.
+  * debian/control: Added | libreadline-dev to build dependencies.
+  * debian/patches/01_pangoxft.dpatch: force linking against pangoxft with
+    newer versions of pango.
+  * debian/patches/80_dash_workaround.dpatch,
+    debian/patches/80_entropy.dpatch,
+    debian/patches/80_xpidl.dpatch,
+    debian/patches/80_xrender_bug.dpatch,
+    debian/patches/90_ia64_align.dpatch,
+    debian/patches/90_mips_performance.dpatch,
+    debian/patches/90_ppc64_build.dpatch,
+    debian/patches/90_xpcom_arm_optim.dpatch,
+    debian/patches/90_xpcom_arm_unused_attribute.dpatch,
+    debian/patches/90_xpcom_hppa.dpatch,
+    debian/patches/90_xpcom_m68k.dpatch,
+    debian/patches/90_xpcom_mips.dpatch: Patches stolen from Firefox.
+  * debian/patches/00list: Updated accordingly.
+  * debian/patches/99_configure.dpatch: Updated.
+
+ -- Mike Hommey <glandium@debian.org>  Thu, 19 Jan 2006 17:08:58 +0100
+
+xulrunner (1.7.99+cvs20051212-1) experimental; urgency=low
+
+  * New CVS checkout.
+  * debian/control: Moved -dev packages from arch: any to arch: all.
+  * debian/rules:
+    + Properly copy nss includes.
+    + Properly call dh_shlibdeps with the changed package names.
+    + Add a vendor.js file adding debian version in user-agent string.
+    + Modify *.pc files to fit modified include and library directories
+      and install them.
+  * debian/lib*-dev.install: Removed pkgconfig files.
+  * debian/*-dev.dirs: Create usr/lib/pkgconfig in the dev packages.
+  * debian/xulrunner.dirs: Create the prefs dir for the vendor.js file.
+  * debian/patches/01_locale.dpatch: Correctly set locale.
+  * debian/patches/00list: Updated accordingly.
+
+ -- Mike Hommey <glandium@debian.org>  Sun, 18 Dec 2005 13:44:17 +0100
+
+xulrunner (1.7.99+cvs20051130-1) experimental; urgency=low
+
+  * New CVS checkout.
+  * debian/mozconfig:
+    + Added cookie and permissions extensions.
+    + Disabled building of the installer.
+  * debian/patches/01_sidebar.dpatch: Added the sidebar extension.
+  * debian/rules:
+    + Copy config.guess and config.sub files to the right places.
+    + Remove the .chk files.
+    + Add a debug DEB_BUILD_OPTIONS to add --enable-debug to configure.
+  * debian/patches/01_sonames.dpatch: Added soname support.
+  * debian/patches/01_js_binary.dpatch: Add dependency for js on libmozjs.so.
+  * debian/patches/99_configure.dpatch: Updated and added nsprpub/configure.in
+    in the scope.
+  * debian/patches/00list: Updated accordingly.
+  * debian/libmozjs-dev.install, debian/libmozjs.install,
+    debian/libnspr4.6-dev.install, debian/libnspr4.6.install,
+    debian/libnss3.10-dev.install, debian/libnss3.10.install,
+    debian/libxul-dev.install, debian/libxul.install:
+    + Moved .so files in -dev packages and put .so.* files in non -dev
+      packages.
+    + put usr/lib/xulrunner/components in libxul instead of xulrunner.
+  * debian/*.preinst, debian/*.postrm: Removed, since we remove the
+    diversions.
+  * debian/control:
+    + Add proper conflicts with mozilla's packages.
+    + Renamed packages to reflect the sonames.
+    + Removed xulrunner-dev package.
+  * debian/lib*.install: Renamed accordingly.
+  * debian/patches/01_system_bz2.dpatch: Changes to better fit upstream build
+    system.
+  * debian/xulrunner-dev.install: Removed, as we removed the package.
+  * debian/libxul-dev.install: Added the xulrunner-config file that used to be
+    in xulrunner-dev.
+  * debian/xulrunner.install: Added xulrunner-stub.
+  * debian/libxul0d.dirs: Create /usr/lib/xulrunner/extensions, that the
+    extensions manager insists on having existing, even if empty.
+  * debian/libsmjs1.links: Changed link for the versioned library.
+
+ -- Mike Hommey <glandium@debian.org>  Mon, 12 Dec 2005 11:12:47 +0100
+
+xulrunner (1.7.99+cvs20051002-1) experimental; urgency=low
+
+  * New CVS checkout.
+  * debian/patches/01_visibility.dpatch: Use -fvisibility=hidden instead of
+    the system wrappers, since because of bug #331460, with the system
+    wrappers, the resulting binary is not PIC.
+  * debian/patches/99_configure.dpatch: Updated.
+  * debian/patches/00list: Updated accordingly.
+
+ -- Mike Hommey <glandium@debian.org>  Sun,  2 Oct 2005 12:48:41 +0200
+
+xulrunner (1.7.99+cvs20050915-1) experimental; urgency=low
+
+  * New CVS checkout of the less experimental 1.8 branch.
+  * debian/mozconfig: Use gtk2 gfx instead of cairo-gtk2 since it is not
+    developped in 1.8 branch.
+  * debian/patches/01_canvas_cairo.dpatch: Removed: been applied upstream.
+  * debian/patches/01_ckbi_location.dpatch: Allow libnssckbi to be loaded from
+    /usr/lib. (quite dirty, but, well...)
+  * debian/patches/01_gfx_cairo.dpatch, 01_gfx_thebes.dpatch: Removed.
+  * debian/patches/01_system_bz2.dpatch: Updated following upstream advices.
+  * debian/patches/99_configure.dpatch: Updated.
+  * debian/patches/00list: Updated accordingly.
+
+ -- Mike Hommey <glandium@debian.org>  Thu, 15 Sep 2005 15:42:40 +0200
+
+xulrunner (1.8.99+cvs20050816-0) experimental; urgency=low
+
+  * Initial package.
+  * debian/mozconfig: Enabled build with system cairo and cairo-gtk2 gfx.
+  * debian/patches/01_canvas_cairo.dpatch: Correctly build with system cairo.
+  * debian/patches/01_embedding_tests.dpatch: Don't build embedding tests when
+    using --disable-tests.
+  * debian/patches/01_install_path.dpatch: Install in the xulrunner directory
+    instead of xulrunner-1.8.
+  * debian/patches/01_gfx_cairo.dpatch, 01_gfx_thebes.dpatch: Patches for
+    correct building of gfx with system cairo.
+  * debian/patches/01_js_binary.dpatch: Allow to build the js binary to
+    provide a more up-to-date spidermonkey.
+  * debian/patches/01_system_bz2.dpatch: Allow to build with the system bzip2
+    library.
+  * debian/patches/99_configure.dpatch: Changes to configure resulted from
+    changes to configure.in.
+  * debian/patches/00list: Built list accordingly.
+
+ -- Mike Hommey <glandium@debian.org>  Tue, 16 Aug 2005 13:45:47 +0200
--- xulrunner-1.9.0.19.orig/debian/smjs.1
+++ xulrunner-1.9.0.19/debian/smjs.1
@@ -0,0 +1,16 @@
+.TH SMJS 1 "7 March 2003"
+.SH NAME
+smjs - javascript shell
+.SH SYNOPSIS
+\fBsmjs\fP
+.SH DESCRIPTION
+The "JS shell", a simple interpreter program that uses the JS API and more
+than a few internal interfaces (some of these internal interfaces could
+be replaced by jsapi.h calls). The js program built from this
+source provides a test vehicle for evaluating scripts and calling functions,
+trying out new debugger primitives, etc.
+.SH AUTHOR
+This manpage was originally written by Bastian Kleineidam
+<calvin@debian.org> for the Debian distribution of Spidermonkey.
+
+The main author of Spidermonkey is the Mozilla Project.
--- xulrunner-1.9.0.19.orig/debian/watch
+++ xulrunner-1.9.0.19/debian/watch
@@ -0,0 +1,2 @@
+version=3
+http://ftp.mozilla.org/pub/mozilla.org/xulrunner/releases/(\d\.[\d\.]+)/source/xulrunner-([\d\.]+)-source\.tar\.bz2
--- xulrunner-1.9.0.19.orig/debian/libmozjs-dev.install
+++ xulrunner-1.9.0.19/debian/libmozjs-dev.install
@@ -0,0 +1,2 @@
+usr/include/mozjs
+usr/lib/pkgconfig/mozilla-js.pc
--- xulrunner-1.9.0.19.orig/debian/xulrunner-1.9.links
+++ xulrunner-1.9.0.19/debian/xulrunner-1.9.links
@@ -0,0 +1,8 @@
+usr/lib/libmozjs.so.1d usr/lib/xulrunner-1.9/libmozjs.so
+usr/share/myspell/dicts usr/lib/xulrunner-1.9/dictionaries
+usr/share/xulrunner-1.9/icons usr/lib/xulrunner-1.9/icons
+usr/share/xulrunner-1.9/greprefs usr/lib/xulrunner-1.9/greprefs
+usr/share/xulrunner-1.9/res usr/lib/xulrunner-1.9/res
+usr/share/xulrunner-1.9/defaults usr/lib/xulrunner-1.9/defaults
+usr/share/xulrunner-1.9/chrome usr/lib/xulrunner-1.9/chrome
+usr/share/xulrunner-1.9/modules usr/lib/xulrunner-1.9/modules
--- xulrunner-1.9.0.19.orig/debian/control
+++ xulrunner-1.9.0.19/debian/control
@@ -0,0 +1,232 @@
+Source: xulrunner
+Section: devel
+Priority: optional
+Maintainer: Mike Hommey <glandium@debian.org>
+Build-Depends: debhelper (>= 5.0.59),
+               autotools-dev,
+               libx11-dev,
+               libxt-dev,
+               libidl-dev,
+               libgtk2.0-dev (>= 2.10),
+               libstartup-notification0-dev,
+               libgnomevfs2-dev,
+               libgnome2-dev,
+               libgnomeui-dev,
+               libcairo2-dev (>= 1.5),
+               libpng12-dev,
+               libjpeg62-dev,
+               zlib1g-dev,
+               libbz2-dev,
+               libreadline5-dev | libreadline-dev,
+               libkrb5-dev,
+               python-dev,
+               python-support (>= 0.3),
+               dpkg-dev (>= 1.13.19),
+               binutils (>= 2.17) [mips mipsel],
+               libnspr4-dev (>= 4.7.0),
+               libnss3-dev (>= 3.12.3),
+               libhunspell-dev (>= 1.1.5-2),
+               libdbus-glib-1-dev,
+               libsqlite3-dev (>= 3.5),
+               liblcms1-dev,
+               zip,
+               xvfb,
+               xfonts-base,
+               xauth
+Build-Depends-Indep: java-gcj-compat-dev (>= 1.0.56)
+Standards-Version: 3.8.0.1
+
+Package: xulrunner-1.9
+Section: devel
+Architecture: any
+Depends: ${shlibs:Depends},
+         ${misc:Depends},
+         libmozjs1d (>= 1.9~rc1),
+         libnspr4-0d (>> 4.7.1-1),
+         libnss3-1d (>> 3.12.0~rc3-1),
+Suggests: xulrunner-1.9-gnome-support
+Replaces: xulrunner-1.9-common
+Conflicts: j2re1.4,
+           pango-graphite
+Description: XUL + XPCOM application runner
+ XULRunner is a single "gecko runtime" that can be used to bootstrap
+ multiple XUL + XPCOM applications that are as rich as Firefox and
+ Thunderbird.
+ .
+ XUL is Mozilla's XML based User Interface language that lets you build
+ feature-rich cross platform applications. These applications are easily
+ customized with alternative text, graphics and layout so that they can be
+ readily branded or localized for various markets. Web developers already
+ familiar with Dynamic HTML (DHTML) will learn XUL quickly and can start
+ building applications right away.
+ .
+ XPCOM is a cross platform component model. It has multiple language
+ bindings and IDL descriptions so programmers can plug their custom
+ functionality into the framework and connect it with other components.
+ .
+ This package also contains the Gecko engine library (libxul)
+Homepage: http://developer.mozilla.org/en/docs/XULRunner
+
+Package: xulrunner-1.9-gnome-support
+Section: devel
+Architecture: any
+Depends: ${shlibs:Depends},
+         ${misc:Depends},
+         xulrunner-1.9
+Description: Support for GNOME in xulrunner applications
+ This is an extension to xulrunner that allows XUL applications to use
+ protocol handlers from GnomeVFS, such as smb or sftp, and other GNOME
+ integration features.
+
+Package: libmozjs1d
+Section: libs
+Architecture: any
+Depends: ${shlibs:Depends},
+         ${misc:Depends}
+Description: The Mozilla SpiderMonkey JavaScript library
+ This library provides the embeddable JavaScript/ECMAScript engine from
+ the Mozilla project (used among others by the Mozilla, Epiphany, Firefox
+ browsers as well as by the iPlanet WebServer).
+Homepage: http://www.mozilla.org/js/
+
+Package: libmozjs-dev
+Section: libdevel
+Architecture: any
+Depends: ${misc:Depends},
+         libmozjs1d (>= ${source:Upstream-Version}),
+         libnspr4-dev
+Conflicts: mozilla-browser (<< 2:1.8)
+Description: Development files for the Mozilla SpiderMonkey JavaScript library
+ This library provides the embeddable JavaScript/ECMAScript engine from
+ the Mozilla project (used among others by the Mozilla, Epiphany, Firefox
+ browsers as well as by the iPlanet WebServer).
+ .
+ Install this package if you wish to develop your own programs using the
+ Mozilla SpiderMonkey JavaScript library.
+Homepage: http://www.mozilla.org/js/
+
+Package: libmozjs1d-dbg
+Section: libdevel
+Priority: extra
+Architecture: any
+Depends: libmozjs1d (= ${binary:Version})
+         | spidermonkey-bin (= ${binary:Version})
+Conflicts: libmozjs0d-dbg
+Description: Development files for the Mozilla SpiderMonkey JavaScript library
+ This library provides the embeddable JavaScript/ECMAScript engine from
+ the Mozilla project (used among others by the Mozilla, Epiphany, Firefox
+ browsers as well as by the iPlanet WebServer).
+ .
+ This package provides the debugging symbols for the library and for
+ the spidermonkey-bin package.
+Homepage: http://www.mozilla.org/js/
+
+Package: spidermonkey-bin
+Section: interpreters
+Architecture: any
+Depends: ${shlibs:Depends},
+         ${misc:Depends}
+Description: standalone JavaScript/ECMAScript (ECMA-262) interpreter
+ SpiderMonkey is a standalone JavaScript/ECMAScript interpreter. It can either
+ take input from files or from a command line driven interface.
+ .
+ ECMAScript (ECMA-262) is a dynamic scripting language supporting prototype
+ based object construction. The basic syntax is intentionally similar to
+ both Java and C++ to reduce the number of new concepts required to learn
+ the language. Language constructs, such as if statements, for and while
+ loops, and switch and try ... catch blocks function the same as these
+ languages (or nearly so).
+ .
+ JavaScript is a superset of the ECMA-262 Edition 3 (ECMAScript) standard
+ first introduced by Netscape and now led by the Mozilla project.
+Homepage: http://www.mozilla.org/js/
+
+Package: xulrunner-dev
+Section: libdevel
+Architecture: any
+Depends: ${shlibs:Depends},
+         ${misc:Depends},
+         xulrunner-1.9 (>= ${source:Upstream-Version}),
+         libnss3-dev,
+         libnspr4-dev,
+         libmozjs-dev (>= ${source:Version}),
+Replaces: xulrunner-dev-bin
+Description: Development files for the Gecko engine library
+ This library provides an  API for XUL applications and Gecko embedders.
+ The Gecko engine is the core of the mozilla.org applications such as
+ Firefox, Thunderbird or SeaMonkey.
+ .
+ Gecko features include XPCOM, networking, DOM editing and transaction
+ support, XBL, XUL, SVG, XSLT, XML Extras (XMLHttpRequest and DOMParser),
+ Web Services (SOAP), accessibility support, IPC services, gtkmozembed, etc.
+ .
+ Install this package if you wish to embed the Gecko engine in your
+ program or want to develop XPCOM components.
+ .
+ This package also provides the Xulrunner Software Development Kit in the
+ same form as the one you may find on mozilla.org in /usr/lib/xulrunner/sdk.
+Homepage: http://wiki.mozilla.org/XUL:Lib_XUL
+
+Package: xulrunner-1.9-dbg
+Section: libdevel
+Priority: extra
+Architecture: any
+Depends: xulrunner-1.9 (= ${binary:Version})
+         | xulrunner-1.9-gnome-support (= ${binary:Version})
+         | python-xpcom (= ${binary:Version})
+Conflicts: libxul0d-dbg
+Description: Development files for the Gecko engine library
+ This library provides an  API for XUL applications and Gecko embedders.
+ The Gecko engine is the core of the mozilla.org applications such as
+ Firefox, Thunderbird or SeaMonkey.
+ .
+ Gecko features include XPCOM, networking, DOM editing and transaction
+ support, XBL, XUL, SVG, XSLT, XML Extras (XMLHttpRequest and DOMParser),
+ Web Services (SOAP), accessibility support, IPC services, gtkmozembed, etc.
+ .
+ This package provides the debugging symbols for the library, and for the
+ xulrunner, xulrunner-gnome-support and python-xpcom packages.
+Homepage: http://wiki.mozilla.org/XUL:Lib_XUL
+
+Package: libmozillainterfaces-java
+Section: libdevel
+Priority: extra
+Architecture: all
+Depends: xulrunner-1.9,
+         gij | java2-runtime
+Description: XPCOM bindings for Java
+ JavaXPCOM allows for communication between Java and XPCOM, such that a
+ Java application can access XPCOM objects, and XPCOM can access any Java
+ class that implements an XPCOM interface.
+ With JavaXPCOM, a developer can talk to XPCOM or embed Gecko from a Java
+ application. JavaXPCOM is very similar to XPConnect (JavaScript-XPCOM
+ bridge), and uses XPIDL
+ .
+ Install this package if you wish to access XPCOM objects from Java or
+ the other way around.
+ .
+ This package also provides the JavaXPCOM interfaces sources.
+Homepage: http://developer.mozilla.org/en/docs/JavaXPCOM
+
+Package: python-xpcom
+Section: python
+Priority: extra
+Architecture: any
+Provides: ${python:Provides}
+Depends: ${shlibs:Depends},
+         ${misc:Depends},
+         ${python:Depends},
+         xulrunner-1.9
+Conflicts: epiphany-browser
+XB-Python-Version: ${python:Versions}
+Description: XPCOM bindings for Python
+ PyXPCOM allows for communication between Python and XPCOM, such that a
+ Python application can access XPCOM objects, and XPCOM can access any
+ Python class that implements an XPCOM interface.
+ With PyXPCOM, a developer can talk to XPCOM or embed Gecko from a
+ Python application. PyXPCOM is similar to JavaXPCOM (Java-XPCOM bridge)
+ or XPConnect (JavaScript-XPCOM bridge).
+ .
+ Install this package if you wish to access XPCOM objects from Python, or
+ want to use Python components from XPCOM.
+Homepage: http://developer.mozilla.org/en/docs/pyxpcom
--- xulrunner-1.9.0.19.orig/debian/libmozjs-dev.links
+++ xulrunner-1.9.0.19/debian/libmozjs-dev.links
@@ -0,0 +1 @@
+usr/lib/libmozjs.so.1d usr/lib/libmozjs.so
--- xulrunner-1.9.0.19.orig/debian/debAbout.js
+++ xulrunner-1.9.0.19/debian/debAbout.js
@@ -0,0 +1,167 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ *   Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is debAbout.
+ *
+ * The Initial Developer of the Original Code is
+ * Mike Hommey.
+ * Portions created by the Initial Developer are Copyright (C) 2007
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+/* Used Javascript XPCOM component generator from
+   http://ted.mielczarek.org/code/mozilla/jscomponentwiz/ to get a skeleton */
+
+const Cc = Components.classes;
+const Ci = Components.interfaces;
+const Cr = Components.results;
+
+// You can change these if you like
+const CLASS_ID = Components.ID("1359a506-95b6-4fec-9f03-3d81ce131fc0");
+const CLASS_NAME = "about: handler for Debian and package related information";
+const CONTRACT_ID_PREFIX = "@mozilla.org/network/protocol/about;1?what=";
+
+var debAboutURLs = {
+  get urls() {
+    if (!this._urls)
+      this._init();
+
+    return this._urls;
+  },
+
+  _init: function() {
+    this._urls = { "debian": "http://debian.org/" };
+
+    var prefService = Cc["@mozilla.org/preferences-service;1"].getService(Ci.nsIPrefBranch);
+    try {
+      /* Assuming nobody change these values */
+      var name = prefService.getCharPref("debian.package.name");
+      var source = prefService.getCharPref("debian.package.source");
+    } catch(e) {}
+
+    if (name) {
+      var file = Cc['@mozilla.org/file/local;1'].createInstance(Ci.nsILocalFile);
+      file.initWithPath("/usr/share/doc/" + name + "/README.Debian.html");
+      if (!file.exists()) {
+        file.initWithPath("/usr/share/doc/" + name + "/README.Debian");
+      }
+      if (file.exists()) {
+        this._urls["readme.debian"] = "file://" + file.path;
+      }
+      this._urls["bugs"] = "http://bugs.debian.org/" + (source ? "src:" + source : name);
+    }
+  }
+}
+
+// This is your constructor.
+// You can do stuff here.
+function debAboutRedirector() {
+  // you can cheat and use this
+  // while testing without
+  // writing your own interface
+  this.wrappedJSObject = this;
+}
+
+// This is the implementation of your component.
+debAboutRedirector.prototype = {
+  // for nsISupports
+  QueryInterface: function(aIID)
+  {
+    // add any other interfaces you support here
+    if (!aIID.equals(Ci.nsISupports) && !aIID.equals(Ci.nsIAboutModule))
+        throw Cr.NS_ERROR_NO_INTERFACE;
+    return this;
+  },
+
+  newChannel: function(uri)
+  {
+    var ioService = Cc["@mozilla.org/network/io-service;1"].getService(Ci.nsIIOService);
+    var request = uri.path.toLowerCase();
+    var uri = ioService.newURI(debAboutURLs.urls[request], null, null);
+    var channel = ioService.newChannelFromURI(uri);
+    var securityManager = Cc["@mozilla.org/scriptsecuritymanager;1"].getService(Ci.nsIScriptSecurityManager);
+    var principal = securityManager.getCodebasePrincipal(uri);
+    channel.owner = principal;
+    return channel;
+  },
+
+  getURIFlags: function(uri)
+  {
+    return Ci.nsIAboutModule.URI_SAFE_FOR_UNTRUSTED_CONTENT;
+  }
+}
+
+//=================================================
+// Note: You probably don't want to edit anything
+// below this unless you know what you're doing.
+//
+// Factory
+var debAboutFactory = {
+  createInstance: function (aOuter, aIID)
+  {
+    if (aOuter != null)
+      throw Cr.NS_ERROR_NO_AGGREGATION;
+    return (new debAboutRedirector()).QueryInterface(aIID);
+  }
+};
+
+// Module
+var debAboutModule = {
+  registerSelf: function(aCompMgr, aFileSpec, aLocation, aType)
+  {
+
+    aCompMgr = aCompMgr.QueryInterface(Ci.nsIComponentRegistrar);
+    for (var key in debAboutURLs.urls) {
+      aCompMgr.registerFactoryLocation(CLASS_ID, CLASS_NAME, CONTRACT_ID_PREFIX + key, aFileSpec, aLocation, aType);
+    }
+  },
+
+  unregisterSelf: function(aCompMgr, aLocation, aType)
+  {
+    aCompMgr = aCompMgr.QueryInterface(Ci.nsIComponentRegistrar);
+    for (var key in this.urls) {
+      aCompMgr.unregisterFactoryLocation(CLASS_ID_PREFIX + key, aLocation);
+    }
+  },
+
+  getClassObject: function(aCompMgr, aCID, aIID)
+  {
+    if (!aIID.equals(Ci.nsIFactory))
+      throw Cr.NS_ERROR_NOT_IMPLEMENTED;
+
+    if (aCID.equals(CLASS_ID))
+      return debAboutFactory;
+
+    throw Cr.NS_ERROR_NO_INTERFACE;
+  },
+
+  canUnload: function(aCompMgr) { return true; }
+};
+
+//module initialization
+function NSGetModule(aCompMgr, aFileSpec) { return debAboutModule; }
--- xulrunner-1.9.0.19.orig/debian/xulrunner-1.9.preinst
+++ xulrunner-1.9.0.19/debian/xulrunner-1.9.preinst
@@ -0,0 +1,12 @@
+#!/bin/sh
+
+set -e
+
+if [ "$1" = "install" ] || [ "$1" = "upgrade" ]; then
+    if [ -d /usr/lib/xulrunner-1.9/chrome ] &&
+       [ ! -L /usr/lib/xulrunner-1.9/chrome ]; then
+        rmdir /usr/lib/xulrunner-1.9/chrome
+    fi
+fi
+
+#DEBHELPER#
--- xulrunner-1.9.0.19.orig/debian/xulrunner-1.9.triggers
+++ xulrunner-1.9.0.19/debian/xulrunner-1.9.triggers
@@ -0,0 +1 @@
+interest /usr/lib/xulrunner-1.9/components
--- xulrunner-1.9.0.19.orig/debian/test/application.ini
+++ xulrunner-1.9.0.19/debian/test/application.ini
@@ -0,0 +1,11 @@
+[App]
+Vendor=Debian
+Name=Test
+Version=0.1
+BuildID=2008051801
+Copyright=Copyright (c) 2008 Mike Hommey
+ID={b8aaac34-1e88-4610-b586-4b151c4fc760}
+
+[Gecko]
+MinVersion=1.9b5
+MaxVersion=2.0
--- xulrunner-1.9.0.19.orig/debian/test/defaults/preferences/test.js
+++ xulrunner-1.9.0.19/debian/test/defaults/preferences/test.js
@@ -0,0 +1,3 @@
+pref("toolkit.defaultChromeURI", "chrome://test/content/test.xul");
+pref("general.warnOnAboutConfig", false);
+pref("browser.dom.window.dump.enabled", true);
--- xulrunner-1.9.0.19.orig/debian/test/chrome/chrome.manifest
+++ xulrunner-1.9.0.19/debian/test/chrome/chrome.manifest
@@ -0,0 +1 @@
+content test content/
--- xulrunner-1.9.0.19.orig/debian/test/chrome/content/test.xul
+++ xulrunner-1.9.0.19/debian/test/chrome/content/test.xul
@@ -0,0 +1,12 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+<window
+  id     = "test"
+  title  = "Test"
+  height = "480"
+  width = "640"
+  xmlns  = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+  onunload="dump('unload\n');"
+  onload="close()">
+  <browser flex="1" src="about:config"/>
+</window>
--- xulrunner-1.9.0.19.orig/memory/jemalloc/jemalloc.c
+++ xulrunner-1.9.0.19/memory/jemalloc/jemalloc.c
@@ -569,6 +569,7 @@
 
 /* Set to true once the allocator has been initialized. */
 static bool malloc_initialized = false;
+static bool malloc_initializing = false;
 
 #if defined(MOZ_MEMORY_WINDOWS)
 /* No init lock for Windows. */
@@ -1333,6 +1334,9 @@
 #endif
 }
 
+void		_malloc_prefork(void);
+void		_malloc_postfork(void);
+
 /*
  * End mutex.
  */
@@ -3718,9 +3722,27 @@
 		return (arena_malloc_large(arena, size, zero));
 }
 
+#define STATIC_BUFFER_SIZE (64 * 1024)
+static char static_buffer[STATIC_BUFFER_SIZE];
+
+static inline void *
+static_alloc(size_t size)
+{
+	static char *next_buf = static_buffer;
+	char *ret = next_buf;
+
+	next_buf = &next_buf[size];
+	if (next_buf <= &static_buffer[STATIC_BUFFER_SIZE])
+		return ret;
+
+	return NULL;
+}
+
 static inline void *
 imalloc(size_t size)
 {
+	if (malloc_initializing)
+		goto static_alloc;
 
 	assert(size != 0);
 
@@ -3728,16 +3750,22 @@
 		return (arena_malloc(choose_arena(), size, false));
 	else
 		return (huge_malloc(size, false));
+static_alloc:
+	return static_alloc(size);
 }
 
 static inline void *
 icalloc(size_t size)
 {
+	if (malloc_initializing)
+		goto static_alloc;
 
 	if (size <= arena_maxclass)
 		return (arena_malloc(choose_arena(), size, true));
 	else
 		return (huge_malloc(size, true));
+static_alloc:
+	return static_alloc(size);
 }
 
 /* Only handles large allocations that require more than page alignment. */
@@ -4212,11 +4240,16 @@
 
 	assert(ptr != NULL);
 
+	if ((ptr >= (void *)static_buffer) && (ptr < (void *)&static_buffer[STATIC_BUFFER_SIZE]))
+		goto end;
+
 	chunk = (arena_chunk_t *)CHUNK_ADDR2BASE(ptr);
 	if (chunk != ptr)
 		arena_dalloc(chunk->arena, chunk, ptr);
 	else
 		huge_dalloc(ptr);
+end:
+	return;
 }
 
 static void
@@ -5200,6 +5233,10 @@
 	int linklen;
 #endif
 
+	/* Recursive malloc_init(), it means we still need to allocate memory */
+	if (malloc_initializing)
+		return(false);
+
 #ifndef MOZ_MEMORY_WINDOWS
 	malloc_mutex_lock(&init_lock);
 #endif
@@ -5214,6 +5251,7 @@
 #endif
 		return (false);
 	}
+	malloc_initializing = true;
 
 #ifdef MOZ_MEMORY_WINDOWS
 	/* get a thread local storage index */
@@ -5656,6 +5694,7 @@
 	/* Allocate and initialize arenas. */
 	arenas = (arena_t **)base_alloc(sizeof(arena_t *) * narenas);
 	if (arenas == NULL) {
+		malloc_initializing = false;
 #ifndef MOZ_MEMORY_WINDOWS
 		malloc_mutex_unlock(&init_lock);
 #endif
@@ -5673,6 +5712,7 @@
 	 */
 	arenas_extend(0);
 	if (arenas[0] == NULL) {
+		malloc_initializing = false;
 #ifndef MOZ_MEMORY_WINDOWS
 		malloc_mutex_unlock(&init_lock);
 #endif
@@ -5701,6 +5741,7 @@
 
 	malloc_spin_init(&arenas_lock);
 
+	malloc_initializing = false;
 	malloc_initialized = true;
 #ifndef MOZ_MEMORY_WINDOWS
 	malloc_mutex_unlock(&init_lock);
--- xulrunner-1.9.0.19.orig/caps/src/nsScriptSecurityManager.cpp
+++ xulrunner-1.9.0.19/caps/src/nsScriptSecurityManager.cpp
@@ -459,6 +459,8 @@
                                               JSStackFrame *fp,
                                               nsIPrincipal *principal)
 {
+    NS_ASSERTION(principal, "Must pass a non-null principal");
+
     ContextPrincipal *cp = new ContextPrincipal(mContextPrincipals, cx, fp,
                                                 principal);
     if (!cp)
@@ -2598,12 +2600,32 @@
     JSStackFrame *fp = nsnull;
     JSContext *cx = GetCurrentJSContext();
     fp = cx ? JS_FrameIterator(cx, &fp) : nsnull;
+
+    JSStackFrame *target = nsnull;
+    nsIPrincipal *targetPrincipal = nsnull;
+    for (ContextPrincipal *cp = mContextPrincipals; cp; cp = cp->mNext)
+    {
+        if (cp->mCx == cx)
+        {
+            target = cp->mFp;
+            targetPrincipal = cp->mPrincipal;
+            break;
+        }
+    }
+
     if (!fp)
     {
-        // No script code on stack. Allow execution.
-        *result = PR_TRUE;
+        // No script code on stack. If we had a principal pushed for this
+        // context and fp is null, then we use that principal. Otherwise, we
+        // don't have enough information and have to allow execution.
+
+        *result = (targetPrincipal && !target)
+                  ? (targetPrincipal == mSystemPrincipal)
+                  : PR_TRUE;
+
         return NS_OK;
     }
+
     *result = PR_FALSE;
     nsIPrincipal* previousPrincipal = nsnull;
     do
--- xulrunner-1.9.0.19.orig/xulrunner/Makefile.in
+++ xulrunner-1.9.0.19/xulrunner/Makefile.in
@@ -47,7 +47,6 @@
 	setup \
 	stub \
 	app \
-	examples \
 	$(NULL)
 
 ifeq ($(OS_ARCH),WINNT)
--- xulrunner-1.9.0.19.orig/xulrunner/stub/nsXULStub.cpp
+++ xulrunner-1.9.0.19/xulrunner/stub/nsXULStub.cpp
@@ -208,8 +208,12 @@
   // 3) give up
 
   struct stat fileStat;
-
-  if (!realpath(argv[0], iniPath) || stat(iniPath, &fileStat)) {
+  strncpy(tmpPath, argv[0], sizeof(tmpPath));
+  lastSlash = strrchr(tmpPath, '/');
+  if (lastSlash) {
+    *lastSlash = 0;
+    realpath(tmpPath, iniPath);
+  } else {
     const char *path = getenv("PATH");
     if (!path)
       return 1;
@@ -222,8 +226,11 @@
     char *token = strtok(pathdup, ":");
     while (token) {
       sprintf(tmpPath, "%s/%s", token, argv[0]);
-      if (realpath(tmpPath, iniPath) && stat(iniPath, &fileStat) == 0) {
+      if (stat(tmpPath, &fileStat) == 0) {
         found = PR_TRUE;
+        lastSlash = strrchr(tmpPath, '/');
+        *lastSlash = 0;
+        realpath(tmpPath, iniPath);
         break;
       }
       token = strtok(NULL, ":");
@@ -232,11 +239,15 @@
     if (!found)
       return 1;
   }
+  lastSlash = iniPath + strlen(iniPath);
+  *lastSlash = '/';
 #endif
 
+#ifndef XP_UNIX
   lastSlash = strrchr(iniPath, PATH_SEPARATOR_CHAR);
   if (!lastSlash)
     return 1;
+#endif
 
   *(++lastSlash) = '\0';
 
@@ -311,6 +322,52 @@
   DosSetExtLIBPATH(tmpPath, BEGIN_LIBPATH);
 #endif
 
+  const char *env;
+  env = getenv("MOZILLA_JEMALLOC");
+  if (env && env[0]) {
+    // Fill tmpPath with location to the jemalloc library
+    strcpy(tmpPath, greDir);
+    lastSlash = strrchr(tmpPath, PATH_SEPARATOR_CHAR);
+    if (lastSlash)
+      lastSlash++;
+    else
+      lastSlash = tmpPath;
+    *lastSlash = '\0';
+    strncpy(lastSlash, JEMALLOC_LIB, MAXPATHLEN - (lastSlash - tmpPath) - 1);
+
+    // Don't do anything if libjemalloc doesn't exist
+    struct stat st;
+    if (stat(tmpPath, &st) == 0 && S_ISREG(st.st_mode)) {
+      // Avoid infinite loop
+      unsetenv("MOZILLA_JEMALLOC");
+
+      // Keep previously set LD_PRELOAD
+      char *ldpreload;
+      env = getenv("LD_PRELOAD");
+      setenv("MOZILLA_OLD_PRELOAD", env ? env : "", 1);
+      if (env && env[0]) {
+        int len = strlen(env);
+        ldpreload = (char *) malloc(len + strlen(tmpPath) + 2);
+        strcpy(ldpreload, env);
+        ldpreload[len] = ':';
+        ldpreload[len + 1] = '\0';
+      } else {
+        ldpreload = (char *) malloc(strlen(tmpPath) + 1);
+        *ldpreload = '\0';
+      }
+      // Add jemalloc to LD_PRELOAD
+      strcat(ldpreload, tmpPath);
+      setenv("LD_PRELOAD", ldpreload, 1);
+      execv(argv[0], argv);
+    }
+  }
+  // Even if execv fails we want to do this cleanup
+  env = getenv("MOZILLA_OLD_PRELOAD");
+  if (env) {
+    setenv("LD_PRELOAD", env, 1);
+    unsetenv("MOZILLA_OLD_PRELOAD");
+  }
+
   rv = XPCOMGlueStartup(greDir);
   if (NS_FAILED(rv)) {
     Output(PR_TRUE, "Couldn't load XPCOM.\n");
--- xulrunner-1.9.0.19.orig/xulrunner/stub/Makefile.in
+++ xulrunner-1.9.0.19/xulrunner/stub/Makefile.in
@@ -102,3 +102,5 @@
 ifeq ($(OS_ARCH),WINNT)
 OS_LIBS += $(call EXPAND_LIBNAME,shell32)
 endif
+
+nsXULStub.o: DEFINES += -DJEMALLOC_LIB=\"$(DLL_PREFIX)jemalloc$(DLL_SUFFIX)\"
--- xulrunner-1.9.0.19.orig/xulrunner/setup/nsXULAppInstall.js
+++ xulrunner-1.9.0.19/xulrunner/setup/nsXULAppInstall.js
@@ -243,7 +243,7 @@
 #else
       aDirectory = Components.classes["@mozilla.org/file/local;1"].
         createInstance(nsILocalFile);
-      aDirectory.initWithPath("/usr/lib");
+      aDirectory.initWithPath("/usr/local/lib");
       if (vendor)
         aDirectory.append(vendor.toLowerCase());
 #endif
--- xulrunner-1.9.0.19.orig/xulrunner/installer/Makefile.in
+++ xulrunner-1.9.0.19/xulrunner/installer/Makefile.in
@@ -67,7 +67,7 @@
 
 include $(topsrcdir)/toolkit/mozapps/installer/packager.mk
 
-$(MOZILLA_VERSION).system.conf: $(topsrcdir)/config/milestone.txt Makefile
+1.9.system.conf: $(topsrcdir)/config/milestone.txt Makefile
 	printf "[%s]\nGRE_PATH=%s\nxulrunner=true\nabi=%s" \
 	  $(MOZILLA_VERSION) $(installdir) $(TARGET_XPCOM_ABI)> $@
 
@@ -75,9 +75,9 @@
 # to register xulrunner per-user, override this with $HOME/.gre.d
 regdir = /etc/gre.d
 
-install:: $(MOZILLA_VERSION).system.conf
+install:: 1.9.system.conf
 	$(NSINSTALL) -D $(DESTDIR)$(regdir)
-	$(SYSINSTALL) $^ $(DESTDIR)$(regdir)
+	$(SYSINSTALL) $(IFLAGS1) $^ $(DESTDIR)$(regdir)
 endif
 
 # Add pkg-config files to the install:: target
@@ -118,6 +118,7 @@
 	-e "s|%sdkdir%|$(sdkdir)|" \
 	-e "s|%MOZ_APP_NAME%|$(MOZ_APP_NAME)|" \
 	-e "s|%MOZILLA_VERSION%|$(MOZ_APP_VERSION)|" \
+	-e "s|%WCHAR_CFLAGS%|$(WCHAR_CFLAGS)|" \
 	-e "s|%FULL_NSPR_LIBS%|$(FULL_NSPR_LIBS)|" \
 	-e "s|%FULL_NSPR_CFLAGS%|$(FULL_NSPR_CFLAGS)|" \
 	-e "s|%NSPR_NAME%|$(NSPR_NAME)|" \
@@ -128,4 +129,4 @@
 	@echo pkg_config_file: $(pkg_config_files)
 	$(SYSINSTALL) $(IFLAGS1) $^ $(DESTDIR)$(libdir)/pkgconfig
 
-GARBAGE += $(MOZILLA_VERSION).system.conf $(pkg_config_files)
+GARBAGE += 1.9.system.conf $(pkg_config_files)
--- xulrunner-1.9.0.19.orig/xulrunner/installer/libxul-embedding.pc.in
+++ xulrunner-1.9.0.19/xulrunner/installer/libxul-embedding.pc.in
@@ -12,4 +12,4 @@
 Description: Static library for version-independent embedding of the Mozilla runtime
 Version: %MOZILLA_VERSION%
 Libs: -L${sdkdir}/lib -lxpcomglue
-Cflags: -DXPCOM_GLUE -I${includedir}/${includetype} -fshort-wchar
+Cflags: -DXPCOM_GLUE -I${includedir}/${includetype} %WCHAR_CFLAGS%
--- xulrunner-1.9.0.19.orig/xulrunner/installer/libxul-embedding-unstable.pc.in
+++ xulrunner-1.9.0.19/xulrunner/installer/libxul-embedding-unstable.pc.in
@@ -8,4 +8,4 @@
 Description: Static library for version-independent embedding of the Mozilla runtime (unstable API)
 Version: %MOZILLA_VERSION%
 Libs: -L${sdkdir}/lib -lxpcomglue
-Cflags: -DXPCOM_GLUE -I${includedir}/${includetype} -fshort-wchar
+Cflags: -DXPCOM_GLUE -I${includedir}/${includetype} %WCHAR_CFLAGS%
--- xulrunner-1.9.0.19.orig/xulrunner/installer/libxul-unstable.pc.in
+++ xulrunner-1.9.0.19/xulrunner/installer/libxul-unstable.pc.in
@@ -9,4 +9,4 @@
 Version: %MOZILLA_VERSION%
 Requires: %NSPR_NAME% >= %NSPR_VERSION%
 Libs: -L${sdkdir}/lib -lxpcomglue_s -lxul -lxpcom
-Cflags: -I${includedir}/${includetype} -fshort-wchar
+Cflags: -I${includedir}/${includetype} %WCHAR_CFLAGS%
--- xulrunner-1.9.0.19.orig/xulrunner/installer/libxul.pc.in
+++ xulrunner-1.9.0.19/xulrunner/installer/libxul.pc.in
@@ -13,4 +13,4 @@
 Version: %MOZILLA_VERSION%
 Requires: %NSPR_NAME% >= %NSPR_VERSION%
 Libs: -L${sdkdir}/lib -lxpcomglue_s -lxul -lxpcom
-Cflags: -I${includedir}/${includetype} -fshort-wchar
\ No newline at end of file
+Cflags: -I${includedir}/${includetype} %WCHAR_CFLAGS%
--- xulrunner-1.9.0.19.orig/xulrunner/app/Makefile.in
+++ xulrunner-1.9.0.19/xulrunner/app/Makefile.in
@@ -47,8 +47,6 @@
 
 include $(DEPTH)/config/autoconf.mk
 
-DIRS		= profile
-
 PREF_JS_EXPORTS = $(srcdir)/xulrunner.js
 GARBAGE += $(addprefix $(DIST)/bin/defaults/pref/,xulrunner.js)
 
@@ -115,7 +113,9 @@
 	$(EXTRA_DSO_LIBS) \
 	$(MOZ_JS_LIBS) \
 	$(DIST)/lib/$(LIB_PREFIX)xpcomglue_s.$(LIB_SUFFIX) \
+	-Wl,--no-as-needed \
 	$(XPCOM_LIBS) \
+	-Wl,--as-needed \
 	$(NSPR_LIBS) \
 	$(TK_LIBS) \
 	$(NULL)
@@ -204,7 +204,7 @@
 
 ifneq (,$(filter-out OS2 WINNT Darwin BeOS,$(OS_ARCH)))
 
-xulrunner:: mozilla.in Makefile.in Makefile $(DEPTH)/config/autoconf.mk
+xulrunner:: $(topsrcdir)/browser/app/mozilla.in Makefile.in Makefile $(DEPTH)/config/autoconf.mk
 	cat $< | sed -e "s|%MOZAPPDIR%|$(mozappdir)|" \
                 -e "s|%MOZ_USER_DIR%|.mozilla/xulrunner|" \
 		-e "s|%MREDIR%|$(mredir)|" > $@
--- xulrunner-1.9.0.19.orig/xulrunner/app/xulrunner.js
+++ xulrunner-1.9.0.19/xulrunner/app/xulrunner.js
@@ -39,7 +39,8 @@
 // We need to override the default values of these preferences since all.js
 // assumes these are in the navigator package, which for us is non-existant.
 // XXX(darin): perhaps all.js should not be seamonkey specific
-pref("general.useragent.locale", "@AB_CD@");
+pref("intl.locale.matchOS", true);
+pref("general.useragent.locale", "chrome://global/locale/intl.properties");
 pref("font.language.group", "chrome://global/locale/intl.properties");
 pref("intl.accept_languages", "chrome://global/locale/intl.properties");
 pref("intl.charsetmenu.browser.static", "chrome://global/locale/intl.properties");
--- xulrunner-1.9.0.19.orig/xulrunner/app/nsXULRunnerApp.cpp
+++ xulrunner-1.9.0.19/xulrunner/app/nsXULRunnerApp.cpp
@@ -43,7 +43,6 @@
 
 #include "nsXULAppAPI.h"
 #include "nsXPCOMGlue.h"
-#include "nsRegisterGRE.h"
 #include "nsAppRunner.h"
 #include "nsILocalFile.h"
 #include "nsIXULAppInstall.h"
@@ -165,12 +164,6 @@
            "  -h, --help                 show this message\n"
            "  -v, --version              show version\n"
            "  --gre-version              print the GRE version string on stdout\n"
-           "  --register-global          register this GRE in the machine registry\n"
-           "  --register-user            register this GRE in the user registry\n"
-           "  --unregister-global        unregister this GRE formerly registered with\n"
-           "                             --register-global\n"
-           "  --unregister-user          unregister this GRE formely registered with\n"
-           "                             --register-user\n"
            "  --find-gre <version>       Find a GRE with version <version> and print\n"
            "                             the path on stdout\n"
            "  --install-app <application> [<destination> [<directoryname>]]\n"
@@ -307,42 +300,6 @@
     if (NS_FAILED(rv))
       return 2;
 
-    PRBool registerGlobal = IsArg(argv[1], "register-global");
-    PRBool registerUser   = IsArg(argv[1], "register-user");
-    if (registerGlobal || registerUser) {
-      if (argc != 2) {
-        Usage(argv[0]);
-        return 1;
-      }
-
-      nsCOMPtr<nsIFile> regDir;
-      rv = GetXULRunnerDir(argv[0], getter_AddRefs(regDir));
-      if (NS_FAILED(rv))
-        return 2;
-
-      return RegisterXULRunner(registerGlobal, regDir,
-                               kGREProperties,
-                               NS_ARRAY_LENGTH(kGREProperties),
-                               milestone.get()) ? 0 : 2;
-    }
-
-    registerGlobal = IsArg(argv[1], "unregister-global");
-    registerUser   = IsArg(argv[1], "unregister-user");
-    if (registerGlobal || registerUser) {
-      if (argc != 2) {
-        Usage(argv[0]);
-        return 1;
-      }
-
-      nsCOMPtr<nsIFile> regDir;
-      rv = GetXULRunnerDir(argv[0], getter_AddRefs(regDir));
-      if (NS_FAILED(rv))
-        return 2;
-
-      UnregisterXULRunner(registerGlobal, regDir, milestone.get());
-      return 0;
-    }
-
     if (IsArg(argv[1], "find-gre")) {
       if (argc != 3) {
         Usage(argv[0]);
--- xulrunner-1.9.0.19.orig/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
+++ xulrunner-1.9.0.19/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
@@ -48,6 +48,7 @@
 #include "nsPromptService.h"
 #include "nsWWJSUtils.h"
 #include "plstr.h"
+#include "nsIContentUtils.h"
 
 #include "nsIBaseWindow.h"
 #include "nsIDocShell.h"
@@ -515,6 +516,12 @@
   NS_ENSURE_ARG_POINTER(_retval);
   *_retval = 0;
 
+  nsCOMPtr<nsIContentUtils> utils =
+    do_GetService("@mozilla.org/content/contentutils;1");
+  if (utils && !utils->IsSafeToRunScript()) {
+    return NS_ERROR_FAILURE;
+  }
+
   GetWindowTreeOwner(aParent, getter_AddRefs(parentTreeOwner));
 
   if (aUrl) {
--- xulrunner-1.9.0.19.orig/embedding/components/windowwatcher/src/nsPromptService.cpp
+++ xulrunner-1.9.0.19/embedding/components/windowwatcher/src/nsPromptService.cpp
@@ -769,6 +769,8 @@
     aParent = activeParent;
   }
 
+  aParamBlock->SetInt(eButtonPressed, 1);
+
   nsCOMPtr<nsISupports> arguments(do_QueryInterface(aParamBlock));
   nsCOMPtr<nsIDOMWindow> dialog;
   rv = mWatcher->OpenWindow(aParent, aChromeURL, "_blank",
--- xulrunner-1.9.0.19.orig/embedding/browser/gtk/src/EmbedPasswordMgr.cpp
+++ xulrunner-1.9.0.19/embedding/browser/gtk/src/EmbedPasswordMgr.cpp
@@ -50,12 +50,7 @@
 #include "nsIPrefBranch2.h"
 #include "prmem.h"
 #include "nsIStringBundle.h"
-#ifdef MOZILLA_1_8_BRANCH
-#include "nsIArray.h"
-#include "nsObserverService.h"
-#else
 #include "nsIMutableArray.h"
-#endif
 #include "nsICategoryManager.h"
 #include "nsIObserverService.h"
 #include "nsIWebProgress.h"
--- xulrunner-1.9.0.19.orig/embedding/browser/gtk/src/EmbedContextMenuInfo.cpp
+++ xulrunner-1.9.0.19/embedding/browser/gtk/src/EmbedContextMenuInfo.cpp
@@ -167,11 +167,7 @@
     nsCOMPtr<nsIContent> tgContent = do_QueryInterface(mEventTarget);
 	nsIFrame* frame = nsnull;
 #if defined(FIXED_BUG347731) || !defined(MOZ_ENABLE_LIBXUL)
-#ifdef MOZILLA_1_8_BRANCH
-    presShell->GetPrimaryFrameFor(tgContent, &frame);
-#else
     frame = presShell->GetPrimaryFrameFor(tgContent);
-#endif
     if (frame)
       mFormRect = frame->GetScreenRectExternal();
 #endif
@@ -186,11 +182,7 @@
   nsresult rv = NS_ERROR_FAILURE;
   nsCOMPtr<nsIContent> targetContent = do_QueryInterface(originalTarget);
   mCtxFormType = 0;
-#ifdef MOZILLA_1_8_BRANCH
-  if (targetContent && targetContent->IsContentOfType(nsIContent::eHTML_FORM_CONTROL)) {
-#else
   if (targetContent && targetContent->IsNodeOfType(nsIContent::eHTML_FORM_CONTROL)) {
-#endif
     nsCOMPtr<nsIFormControl> formControl(do_QueryInterface(targetContent));
     if (formControl) {
       mCtxFormType = formControl->GetType();
@@ -604,12 +596,7 @@
   if (mEmbedCtxType & GTK_MOZ_EMBED_CTX_RICHEDIT)
     frame = presShell->GetRootFrame();
   else {
-#ifdef MOZILLA_1_8_BRANCH
-    frame = nsnull;
-    presShell->GetPrimaryFrameFor(tgContent, &frame);
-#else
     frame = presShell->GetPrimaryFrameFor(tgContent);
-#endif
   }
   if (frame) {
     mFormRect = frame->GetScreenRectExternal();
--- xulrunner-1.9.0.19.orig/gfx/thebes/src/gfxWindowsFonts.cpp
+++ xulrunner-1.9.0.19/gfx/thebes/src/gfxWindowsFonts.cpp
@@ -970,9 +970,9 @@
         nsAutoString utf16;
         AppendASCIItoUTF16(cString, utf16);
         if (isComplex) {
-            InitTextRunUniscribe(aParams->mContext, textRun, utf16.get(), aLength);
+            InitTextRunUniscribe(aParams->mContext, textRun, utf16.get(), utf16.Length());
         } else {
-            InitTextRunGDI(aParams->mContext, textRun, utf16.get(), aLength);
+            InitTextRunGDI(aParams->mContext, textRun, utf16.get(), utf16.Length());
         }
     }
 
@@ -2000,9 +2000,13 @@
 };
 
 
-#define MAX_ITEM_LENGTH 32768
-
+// This is _slightly less_ than half of the maximum analysis window
+// we use with ScriptBreak, so that in typical cases we end up re-processing
+// only a small amount of overlap when we move the analysis window forward.
+#define MAX_ITEM_LENGTH      32499
 
+// Limit length of text passed to Uniscribe APIs, to avoid failure there.
+#define MAX_UNISCRIBE_LENGTH 65000
 
 static PRUint32 FindNextItemStart(int aOffset, int aLimit,
                                   nsTArray<SCRIPT_LOGATTR> &aLogAttr,
@@ -2065,28 +2069,53 @@
     nsresult CopyItemSplitOversize(int aIndex, nsTArray<SCRIPT_ITEM> &aDest) {
         aDest.AppendElement(mItems[aIndex]);
         const int itemLength = mItems[aIndex+1].iCharPos - mItems[aIndex].iCharPos;
-        if (ESTIMATE_MAX_GLYPHS(itemLength) > 65535) {
+        if (ESTIMATE_MAX_GLYPHS(itemLength) > MAX_UNISCRIBE_LENGTH) {
             // This items length would cause ScriptShape() to fail. We need to
             // add extra items here so that no item's length could cause the fail.
 
             // Get cluster boundaries, so we can break cleanly if possible.
             nsTArray<SCRIPT_LOGATTR> logAttr;
-            if (!logAttr.SetLength(itemLength))
-                return NS_ERROR_FAILURE;
-            HRESULT rv= ScriptBreak(mString+mItems[aIndex].iCharPos, itemLength,
-                                    &mItems[aIndex].a, logAttr.Elements());
-            if (FAILED(rv))
-                return NS_ERROR_FAILURE;
 
             const int nextItemStart = mItems[aIndex+1].iCharPos;
-            int start = FindNextItemStart(mItems[aIndex].iCharPos,
-                                          nextItemStart, logAttr, mString);
+            int start = mItems[aIndex].iCharPos;
 
             while (start < nextItemStart) {
-                SCRIPT_ITEM item = mItems[aIndex];
-                item.iCharPos = start;
-                aDest.AppendElement(item);
-                start = FindNextItemStart(start, nextItemStart, logAttr, mString);
+                // ScriptBreak will fail for strings longer than 64K,
+                // so we do the analysis using a "sliding window" over the
+                // huge item.
+                int analysisLen = PR_MIN(nextItemStart - start,
+                                         MAX_UNISCRIBE_LENGTH);
+                if (!logAttr.SetLength(analysisLen)) {
+                    return NS_ERROR_FAILURE;
+                }
+                HRESULT rv = ScriptBreak(mString + start,
+                                         analysisLen,
+                                         &mItems[aIndex].a,
+                                         logAttr.Elements());
+                if (FAILED(rv)) {
+                    return NS_ERROR_FAILURE;
+                }
+
+                int analysisLimit = start + analysisLen;
+                start = FindNextItemStart(start, analysisLimit,
+                                          logAttr, mString);
+                int prevStart = start;
+                while (start < analysisLimit) {
+                    SCRIPT_ITEM item = mItems[aIndex];
+                    item.iCharPos = start;
+                    aDest.AppendElement(item);
+                    prevStart = start;
+                    start = FindNextItemStart(start, analysisLimit,
+                                              logAttr, mString);
+                }
+
+                // If the analysis window didn't reach the end of the entire
+                // original item, reset start so that the final (perhaps
+                // badly-terminated) item we just created will be merged with
+                // the following section of the text.
+                if (start < nextItemStart) {
+                    start = prevStart;
+                }
             }
         } 
         return NS_OK;
@@ -2115,7 +2144,7 @@
             Init();
         }
 
-        if (ESTIMATE_MAX_GLYPHS(mLength) > 65535) {
+        if (ESTIMATE_MAX_GLYPHS(mLength) > MAX_UNISCRIBE_LENGTH) {
             // Any item of length > 43680 will cause ScriptShape() to fail, as its
             // mMaxGlyphs value will be greater than 65535 (43680*1.5+16>65535). So we
             // need to break up items which are longer than that upon cluster boundaries.
--- xulrunner-1.9.0.19.orig/config/rules.mk
+++ xulrunner-1.9.0.19/config/rules.mk
@@ -155,6 +155,18 @@
 SHARED_LIBRARY		:= $(DLL_PREFIX)$(LIBRARY_NAME)$(DLL_SUFFIX)
 endif
 
+ifdef SO_VERSION
+UNVERSIONED_LIBRARY	:= $(notdir $(SHARED_LIBRARY))
+
+ifeq ($(strip $(SHARED_LIBRARY)),$(strip $(SDK_LIBRARY)))
+SDK_LIBRARY		:= $(SHARED_LIBRARY)
+endif
+
+SHARED_LIBRARY		:= $(SHARED_LIBRARY).$(SO_VERSION)
+
+MKSHLINKS		= rm -f $(1)/$(UNVERSIONED_LIBRARY); ln -s $(SHARED_LIBRARY) $(1)/$(UNVERSIONED_LIBRARY)
+endif
+
 ifeq ($(OS_ARCH),OS2)
 DEF_FILE		:= $(SHARED_LIBRARY:.dll=.def)
 endif
@@ -264,7 +276,7 @@
 endif
 
 ifndef TARGETS
-TARGETS			= $(LIBRARY) $(SHARED_LIBRARY) $(PROGRAM) $(SIMPLE_PROGRAMS) $(HOST_LIBRARY) $(HOST_PROGRAM) $(HOST_SIMPLE_PROGRAMS) $(JAVA_LIBRARY)
+TARGETS			= $(LIBRARY) $(UNVERSIONED_LIBRARY) $(SHARED_LIBRARY) $(PROGRAM) $(SIMPLE_PROGRAMS) $(HOST_LIBRARY) $(HOST_PROGRAM) $(HOST_SIMPLE_PROGRAMS) $(JAVA_LIBRARY)
 endif
 
 ifndef OBJS
@@ -482,15 +494,6 @@
 endif
 endif
 
-ifeq ($(OS_ARCH),Linux)
-ifneq (,$(filter mips mipsel,$(OS_TEST)))
-ifeq ($(MODULE),layout)
-OS_CFLAGS += -Wa,-xgot
-OS_CXXFLAGS += -Wa,-xgot
-endif
-endif
-endif
-
 #
 # HP-UXBeOS specific section: for COMPONENTS only, add -Bsymbolic flag
 # which uses internal symbols first
@@ -541,6 +544,14 @@
 endif 
 
 #
+# GNU doesn't have path length limitation
+#
+
+ifeq ($(OS_ARCH),GNU)
+OS_CPPFLAGS += -DPATH_MAX=1024 -DMAXPATHLEN=1024
+endif
+
+#
 # MINGW32
 #
 ifeq ($(OS_ARCH),WINNT)
@@ -717,7 +728,7 @@
 DSO_LDOPTS_DEPS = $(EXTRA_DSO_LIBS) $(filter %.$(LIB_SUFFIX), $(EXTRA_DSO_LDOPTS))
 
 ##############################################
-libs:: $(SUBMAKEFILES) $(MAKE_DIRS) $(HOST_LIBRARY) $(LIBRARY) $(SHARED_LIBRARY) $(IMPORT_LIBRARY) $(HOST_PROGRAM) $(PROGRAM) $(HOST_SIMPLE_PROGRAMS) $(SIMPLE_PROGRAMS) $(JAVA_LIBRARY)
+libs:: $(SUBMAKEFILES) $(MAKE_DIRS) $(HOST_LIBRARY) $(LIBRARY) $(UNVERSIONED_LIBRARY) $(SHARED_LIBRARY) $(IMPORT_LIBRARY) $(HOST_PROGRAM) $(PROGRAM) $(HOST_SIMPLE_PROGRAMS) $(SIMPLE_PROGRAMS) $(JAVA_LIBRARY)
 ifndef NO_DIST_INSTALL
 ifdef LIBRARY
 ifdef EXPORT_LIBRARY # Stage libs that will be linked into a static build
@@ -747,8 +758,10 @@
 	$(INSTALL) $(IFLAGS2) $(IMPORT_LIBRARY) $(DIST)/lib
 else
 	$(INSTALL) $(IFLAGS2) $(SHARED_LIBRARY) $(DIST)/lib
+	$(call MKSHLINKS,$(DIST)/lib)
 endif
 	$(INSTALL) $(IFLAGS2) $(SHARED_LIBRARY) $(FINAL_TARGET)
+	$(call MKSHLINKS,$(FINAL_TARGET))
 ifdef BEOS_ADDON_WORKAROUND
 	( cd $(FINAL_TARGET) && $(CC) -nostart -o $(SHARED_LIBRARY).stub $(SHARED_LIBRARY) )
 endif
@@ -945,7 +958,7 @@
 ifeq ($(CPP_PROG_LINK),1)
 	$(CCC) $(WRAP_MALLOC_CFLAGS) $(CXXFLAGS) -o $@ $< $(WIN32_EXE_LDFLAGS) $(SOLARIS_JEMALLOC_LDFLAGS) $(LDFLAGS) $(LIBS_DIR) $(LIBS) $(OS_LIBS) $(EXTRA_LIBS) $(WRAP_MALLOC_LIB) $(PROFILER_LIBS) $(BIN_FLAGS)
 else
-	$(CC) $(WRAP_MALLOC_CFLAGS) $(CFLAGS) $(OUTOPTION)$@ $< $(WIN32_EXE_LDFLAGS) $(SOLARIS_JEMALLOC_LDFLAGS) $(LDFLAGS) $(LIBS_DIR) $(LIBS) $(OS_LIBS) $(EXTRA_LIBS) $(WRAP_MALLOC_LIB) $(PROFILER_LIBS) $(BIN_FLAGS)
+	$(CC) $(WRAP_MALLOC_CFLAGS) $(CFLAGS) $(OUTOPTION)$@ $< $(WIN32_EXE_LDFLAGS) $(SOLARIS_JEMALLOC_LDFLAGS) $(LDFLAGS) $(LIBS_DIR) $(LIBS) $(OS_LIBS) $(EXTRA_LIBS) $(WRAP_MALLOC_LIB) $(PROFILER_LIBS) $(BIN_FLAGS) $(PROG_LIBS)
 endif # CPP_PROG_LINK
 endif # WINNT && !GNU_CC
 endif # OS/2 VACPP
@@ -1101,6 +1114,8 @@
 # so instead of deleting .o files after repacking them into a dylib, we make
 # symlinks back to the originals. The symlinks are a no-op for stabs debugging,
 # so no need to conditionalize on OS version or debugging format.
+$(UNVERSIONED_LIBRARY): $(SHARED_LIBRARY)
+	$(call MKSHLINKS,.)
 
 $(SHARED_LIBRARY): $(OBJS) $(LOBJS) $(DEF_FILE) $(RESFILE) $(SHARED_LIBRARY_LIBS) $(EXTRA_DEPS) $(DSO_LDOPTS_DEPS) Makefile Makefile.in
 ifndef INCREMENTAL_LINKER
--- xulrunner-1.9.0.19.orig/config/config.mk
+++ xulrunner-1.9.0.19/config/config.mk
@@ -508,7 +508,7 @@
 JAVA_DIST_DIR = $(DEPTH)/$(JAVA_GEN_DIR)
 JAVA_IFACES_PKG_NAME = org/mozilla/interfaces
 
-REQ_INCLUDES	= -I$(srcdir) -I. $(foreach d,$(REQUIRES),-I$(DIST)/include/$d) -I$(DIST)/include 
+REQ_INCLUDES	= $(foreach d,$(REQUIRES),-I$(DIST)/include/$d) -I$(DIST)/include
 ifdef LIBXUL_SDK
 REQ_INCLUDES_SDK = $(foreach d,$(REQUIRES),-I$(LIBXUL_SDK)/include/$d) -I$(LIBXUL_SDK)/include
 endif
--- xulrunner-1.9.0.19.orig/config/autoconf.mk.in
+++ xulrunner-1.9.0.19/config/autoconf.mk.in
@@ -58,14 +58,14 @@
 prefix		= @prefix@
 exec_prefix	= @exec_prefix@
 bindir		= @bindir@
-includedir	= @includedir@/$(MOZ_APP_NAME)-$(MOZ_APP_VERSION)
+includedir	= @includedir@/$(MOZ_APP_NAME)-1.9
 libdir		= @libdir@
 datadir		= @datadir@
 mandir		= @mandir@
-idldir		= $(datadir)/idl/$(MOZ_APP_NAME)-$(MOZ_APP_VERSION)
+idldir		= $(datadir)/idl/$(MOZ_APP_NAME)-1.9
 
-installdir	= $(libdir)/$(MOZ_APP_NAME)-$(MOZ_APP_VERSION)
-sdkdir		= $(libdir)/$(MOZ_APP_NAME)-devel-$(MOZ_APP_VERSION)
+installdir	= $(libdir)/$(MOZ_APP_NAME)-1.9
+sdkdir		= $(libdir)/$(MOZ_APP_NAME)-devel-1.9
 
 DIST		= $(DEPTH)/dist
 LIBXUL_SDK      = @LIBXUL_SDK@
@@ -87,6 +87,9 @@
 MOZ_X11			= @MOZ_X11@
 
 MOZ_JS_LIBS		   = @MOZ_JS_LIBS@
+ENABLE_JS_BINARY	= @ENABLE_JS_BINARY@
+HAVE_READLINE		= @HAVE_READLINE@
+READLINE_LIBS		= @READLINE_LIBS@
 
 MOZ_DEBUG	= @MOZ_DEBUG@
 MOZ_DEBUG_MODULES = @MOZ_DEBUG_MODULES@
@@ -220,6 +223,7 @@
 MOZ_NATIVE_BZ2	= @SYSTEM_BZ2@
 MOZ_NATIVE_JPEG	= @SYSTEM_JPEG@
 MOZ_NATIVE_PNG	= @SYSTEM_PNG@
+APNG		= @APNG@
 MOZ_TREE_CAIRO = @MOZ_TREE_CAIRO@
 
 MOZ_UPDATE_XTERM = @MOZ_UPDATE_XTERM@
@@ -270,6 +274,8 @@
 
 CROSS_COMPILE   = @CROSS_COMPILE@
 
+WCHAR_CFLAGS	= @WCHAR_CFLAGS@
+
 OS_CPPFLAGS	= @CPPFLAGS@
 OS_CFLAGS	= $(OS_CPPFLAGS) @CFLAGS@
 OS_CXXFLAGS	= $(OS_CPPFLAGS) @CXXFLAGS@
--- xulrunner-1.9.0.19.orig/build/unix/run-mozilla.sh
+++ xulrunner-1.9.0.19/build/unix/run-mozilla.sh
@@ -163,7 +163,13 @@
 	##
 	## Run the program
 	##
-	"$prog" ${1+"$@"}
+	if [ "$MOZILLA_JEMALLOC" ] &&
+	   [ -f "$MOZILLA_FIVE_HOME/libjemalloc.so" ]; then
+		LD_PRELOAD="${LD_PRELOAD+$LD_PRELOAD:}$MOZILLA_FIVE_HOME/libjemalloc.so" "$prog" ${1+"$@"}
+	else
+		"$prog" ${1+"$@"}
+	fi
+
 	exitcode=$?
 	if [ "$DEBUG_CORE_FILES" ]
 	then
@@ -230,6 +236,10 @@
             echo " '$PARAM'" | perl -pe 'chomp' >> $tmpfile
         done
         echo >> $tmpfile
+	if [ "$MOZILLA_JEMALLOC" ] &&
+	   [ -f "$MOZILLA_FIVE_HOME/libjemalloc.so" ]; then
+		echo "set env LD_PRELOAD '${LD_PRELOAD+$LD_PRELOAD:}$MOZILLA_FIVE_HOME/libjemalloc.so'" >> $tmpfile
+	fi
 # If you are not using ddd, gdb and know of a way to convey the arguments 
 # over to the prog then add that here- Gagan Saksena 03/15/00
         case `basename $debugger` in
@@ -353,36 +363,36 @@
 ##  a symbolic link, all other shared libraries are symbolic links also.
 if [ `uname -s` != "SunOS" -o -h "$MOZ_DIST_BIN/libmozjs.so" ]
 then
-	LD_LIBRARY_PATH=${MOZ_DIST_BIN}:${MOZ_DIST_BIN}/plugins:${MRE_HOME}${LD_LIBRARY_PATH+":$LD_LIBRARY_PATH"}
+	LD_LIBRARY_PATH=${MOZ_DIST_BIN}:${MOZ_DIST_BIN}/plugins:${MRE_HOME}${LD_LIBRARY_PATH:+":$LD_LIBRARY_PATH"}
 fi 
 
 if [ -n "$LD_LIBRARYN32_PATH" ]
 then
-	LD_LIBRARYN32_PATH=${MOZ_DIST_BIN}:${MOZ_DIST_BIN}/plugins:${MRE_HOME}${LD_LIBRARYN32_PATH+":$LD_LIBRARYN32_PATH"}
+	LD_LIBRARYN32_PATH=${MOZ_DIST_BIN}:${MOZ_DIST_BIN}/plugins:${MRE_HOME}${LD_LIBRARYN32_PATH:+":$LD_LIBRARYN32_PATH"}
 fi
 if [ -n "$LD_LIBRARYN64_PATH" ]
 then
-	LD_LIBRARYN64_PATH=${MOZ_DIST_BIN}:${MOZ_DIST_BIN}/plugins:${MRE_HOME}${LD_LIBRARYN64_PATH+":$LD_LIBRARYN64_PATH"}
+	LD_LIBRARYN64_PATH=${MOZ_DIST_BIN}:${MOZ_DIST_BIN}/plugins:${MRE_HOME}${LD_LIBRARYN64_PATH:+":$LD_LIBRARYN64_PATH"}
 fi
 if [ -n "$LD_LIBRARY_PATH_64" ]; then
-	LD_LIBRARY_PATH_64=${MOZ_DIST_BIN}:${MOZ_DIST_BIN}/plugins:${MRE_HOME}${LD_LIBRARY_PATH_64+":$LD_LIBRARY_PATH_64"}
+	LD_LIBRARY_PATH_64=${MOZ_DIST_BIN}:${MOZ_DIST_BIN}/plugins:${MRE_HOME}${LD_LIBRARY_PATH_64:+":$LD_LIBRARY_PATH_64"}
 fi
 #
 #
 ## Set SHLIB_PATH for HPUX
-SHLIB_PATH=${MOZ_DIST_BIN}:${MRE_HOME}${SHLIB_PATH+":$SHLIB_PATH"}
+SHLIB_PATH=${MOZ_DIST_BIN}:${MRE_HOME}${SHLIB_PATH:+":$SHLIB_PATH"}
 #
 ## Set LIBPATH for AIX
-LIBPATH=${MOZ_DIST_BIN}:${MRE_HOME}${LIBPATH+":$LIBPATH"}
+LIBPATH=${MOZ_DIST_BIN}:${MRE_HOME}${LIBPATH:+":$LIBPATH"}
 #
 ## Set DYLD_LIBRARY_PATH for Mac OS X (Darwin)
-DYLD_LIBRARY_PATH=${MOZ_DIST_BIN}:${MRE_HOME}${DYLD_LIBRARY_PATH+":$DYLD_LIBRARY_PATH"}
+DYLD_LIBRARY_PATH=${MOZ_DIST_BIN}:${MRE_HOME}${DYLD_LIBRARY_PATH:+":$DYLD_LIBRARY_PATH"}
 #
 ## Set LIBRARY_PATH for BeOS
-LIBRARY_PATH=${MOZ_DIST_BIN}:${MOZ_DIST_BIN}/components:${MRE_HOME}${LIBRARY_PATH+":$LIBRARY_PATH"}
+LIBRARY_PATH=${MOZ_DIST_BIN}:${MOZ_DIST_BIN}/components:${MRE_HOME}${LIBRARY_PATH:+":$LIBRARY_PATH"}
 #
 ## Set ADDON_PATH for BeOS
-ADDON_PATH=${MOZ_DIST_BIN}${ADDON_PATH+":$ADDON_PATH"}
+ADDON_PATH=${MOZ_DIST_BIN}${ADDON_PATH:+":$ADDON_PATH"}
 #
 ## Solaris Xserver(Xsun) tuning - use shared memory transport if available
 if [ "$XSUNTRANSPORT" = "" ]
--- xulrunner-1.9.0.19.orig/build/unix/mozilla-config.in
+++ xulrunner-1.9.0.19/build/unix/mozilla-config.in
@@ -22,7 +22,6 @@
     xpcom
     nspr
     js
-    jsj
     gfx
 EOF
 	exit $1
@@ -60,9 +59,6 @@
       exit 0
       ;;
     --cflags)
-      if test "%includedir%" != /usr/include ; then
-        includes="-I%includedir%"
-      fi
       echo_cflags=yes
       ;;
     --defines)
@@ -74,7 +70,7 @@
     --idlflags)
       echo_idlflags=yes
       ;;
-    xpcom|js|nspr|gfx|jsj)
+    xpcom|js|nspr|gfx)
       echo_components="$echo_components $1"
       echo_libraries="$echo_libraries $1"
       ;;
@@ -105,7 +101,17 @@
 if test "$echo_cflags" = "yes"; then
     nspr_cflags="%FULL_NSPR_CFLAGS%"
     for n in $echo_components; do
-	component_includes="$component_includes -I%includedir%/$n"
+        case "$n" in
+        js)
+               component_includes="$component_includes -I/usr/include/mozjs"
+            ;;
+        nspr)
+            ;;
+        *)
+               component_includes="$component_includes -I%includedir% \
+                                   -I%includedir%/$n"
+            ;;
+        esac
     done
     echo $component_includes $includes $nspr_cflags
 fi
@@ -133,10 +139,7 @@
 	js)
 	    libs="$libs $_js_libs"
 	    ;;
-	jsj)
-	    libs="$libs -ljsj $_js_libs $_xpcom_libs"
-	    ;;
         esac
     done
-    echo -L%libdir% $libs
+    echo $libs
 fi
--- xulrunner-1.9.0.19.orig/uriloader/exthandler/nsExternalHelperAppService.cpp
+++ xulrunner-1.9.0.19/uriloader/exthandler/nsExternalHelperAppService.cpp
@@ -1240,8 +1240,7 @@
     tempLeafName.Append(ext);
   }
 
-#ifdef XP_WIN
-  // On windows, we need to temporarily create a dummy file with the correct
+  // We need to temporarily create a dummy file with the correct
   // file extension to determine the executable-ness, so do this before adding
   // the extra .part extension.
   nsCOMPtr<nsIFile> dummyFile;
@@ -1257,7 +1256,6 @@
   // Store executable-ness then delete
   dummyFile->IsExecutable(&mTempFileIsExecutable);
   dummyFile->Remove(PR_FALSE);
-#endif
 
   // Add an additional .part to prevent the OS from running this file in the
   // default application.
@@ -1269,12 +1267,6 @@
   rv = mTempFile->CreateUnique(nsIFile::NORMAL_FILE_TYPE, 0600);
   NS_ENSURE_SUCCESS(rv, rv);
 
-#ifndef XP_WIN
-  // On other platforms, the file permission bits are used, so we can just call
-  // IsExecutable
-  mTempFile->IsExecutable(&mTempFileIsExecutable);
-#endif
-
 #ifdef XP_MACOSX
   // Now that the file exists set Mac type if the file has no extension
   // and we can determine a type.
--- xulrunner-1.9.0.19.orig/uriloader/exthandler/nsHandlerService.js
+++ xulrunner-1.9.0.19/uriloader/exthandler/nsHandlerService.js
@@ -609,25 +609,24 @@
 
     try {
       file.initWithPath(aPath);
-
-      if (file.exists())
-        return file;
     }
     catch(ex) {
       // Note: for historical reasons, we don't actually check to see
       // if the exception is NS_ERROR_FILE_UNRECOGNIZED_PATH, which is what
       // nsILocalFile::initWithPath throws when a path is relative.
-
       file = this._dirSvc.get("XCurProcD", Ci.nsIFile);
 
       try {
         file.append(aPath);
-        if (file.exists())
-          return file;
       }
       catch(ex) {}
     }
 
+    if (file && file.exists() &&
+        file.isExecutable() &&
+        file.isFile())
+      return file;
+
     return null;
   },
 
--- xulrunner-1.9.0.19.orig/uriloader/exthandler/unix/nsOSHelperAppService.cpp
+++ xulrunner-1.9.0.19/uriloader/exthandler/unix/nsOSHelperAppService.cpp
@@ -67,7 +67,6 @@
 #include "nsDirectoryServiceUtils.h"
 #include "prenv.h"      // for PR_GetEnv()
 #include "nsAutoPtr.h"
-#include <stdlib.h>		// for system()
 
 #define LOG(args) PR_LOG(mLog, PR_LOG_DEBUG, args)
 #define LOG_ENABLED() PR_LOG_TEST(mLog, PR_LOG_DEBUG)
@@ -1141,9 +1140,32 @@
                                        aMinorType,
                                        aTypeOptions,
                                        testCommand);
+                  if (NS_FAILED(rv))
+                    continue;
+                  nsCOMPtr<nsIProcess> process = do_CreateInstance(NS_PROCESS_CONTRACTID, &rv);
+                  if (NS_FAILED(rv))
+                    continue;
+                  nsCOMPtr<nsILocalFile> file(do_CreateInstance(NS_LOCAL_FILE_CONTRACTID, &rv));
+                  if (NS_FAILED(rv))
+                    continue;
+                  rv = file->InitWithNativePath(NS_LITERAL_CSTRING("/bin/sh"));
+                  if (NS_FAILED(rv))
+                    continue;
+                  rv = process->Init(file);
+                  if (NS_FAILED(rv))
+                    continue;
+                  const char *args[] = { "-c", testCommand.get() };
                   LOG(("Running Test: %s\n", testCommand.get()));
-                  // XXX this should not use system(), since that can block the UI thread!
-                  if (NS_SUCCEEDED(rv) && system(testCommand.get()) != 0) {
+                  PRUint32 pid;
+                  rv = process->Run(PR_TRUE, args, 2, &pid);
+                  if (NS_FAILED(rv))
+                    continue;
+                  PRInt32 exitValue;
+                  rv = process->GetExitValue(&exitValue);
+                  if (NS_FAILED(rv))
+                    continue;
+                  LOG(("Exit code: %d\n", exitValue));
+                  if (exitValue) {
                     match = PR_FALSE;
                   }
                 }
--- xulrunner-1.9.0.19.orig/uriloader/exthandler/unix/nsMIMEInfoUnix.cpp
+++ xulrunner-1.9.0.19/uriloader/exthandler/unix/nsMIMEInfoUnix.cpp
@@ -50,6 +50,12 @@
 NS_IMETHODIMP
 nsMIMEInfoUnix::GetHasDefaultHandler(PRBool *_retval)
 {
+  // if mDefaultApplication is set, it means the application has been set from
+  // either /etc/mailcap or ${HOME}/.mailcap, in which case we don't want to
+  // give the GNOME answer.
+  if (mDefaultApplication)
+    return nsMIMEInfoImpl::GetHasDefaultHandler(_retval);
+
   *_retval = PR_FALSE;
   nsCOMPtr<nsIGnomeVFSService> vfs = do_GetService(NS_GNOMEVFSSERVICE_CONTRACTID);
   if (vfs) {
@@ -58,16 +64,18 @@
       *_retval = PR_TRUE;
   }
 
-  if (*_retval)
-    return NS_OK;
-
-  // If we didn't find a VFS handler, fallback.
-  return nsMIMEInfoImpl::GetHasDefaultHandler(_retval);
+  return NS_OK;
 }
 
 nsresult
 nsMIMEInfoUnix::LaunchDefaultWithFile(nsIFile *aFile)
 {
+  // if mDefaultApplication is set, it means the application has been set from
+  // either /etc/mailcap or ${HOME}/.mailcap, in which case we don't want to
+  // give the GNOME answer.
+  if (mDefaultApplication)
+    return nsMIMEInfoImpl::LaunchDefaultWithFile(aFile);
+
   nsCAutoString nativePath;
   aFile->GetNativePath(nativePath);
 
--- xulrunner-1.9.0.19.orig/uriloader/base/nsURILoader.cpp
+++ xulrunner-1.9.0.19/uriloader/base/nsURILoader.cpp
@@ -440,7 +440,8 @@
       return NS_OK;
     }
 
-    // If we aren't allowed to try other listeners, we're done here.
+    // If we aren't allowed to try other listeners, just skip through to
+    // trying to convert the data.
     if (!(mFlags & nsIURILoader::DONT_RETARGET)) {
 
       //
@@ -519,44 +520,39 @@
           return rv;
         }
       }
+    } else {
+      LOG(("  DONT_RETARGET flag set, so skipped over random other content "
+           "listeners and content handlers"));
+    }
+
+    //
+    // Fifth step:  If no listener prefers this type, see if any stream
+    //              converters exist to transform this content type into
+    //              some other.
+    //
+    // Don't do this if the server sent us a MIME type of "*/*" because they saw
+    // it in our Accept header and got confused.
+    // XXXbz have to be careful here; may end up in some sort of bizarre infinite
+    // decoding loop.
+    if (mContentType != anyType) {
+      rv = ConvertData(request, m_contentListener, mContentType, anyType);
+      if (NS_FAILED(rv)) {
+        m_targetStreamListener = nsnull;
+      } else if (m_targetStreamListener) {
+        // We found a converter for this MIME type.  We'll just pump data into it
+        // and let the downstream nsDocumentOpenInfo handle things.
+        LOG(("  Converter taking over now"));
+        return NS_OK;
+      }
     }
-  } else if (mFlags & nsIURILoader::DONT_RETARGET) {
-    // External handling was forced, but we must not retarget
-    // -> abort
-    LOG(("  External handling forced, but not allowed to retarget -> aborting"));
-    return NS_ERROR_WONT_HANDLE_CONTENT;
   }
 
   NS_ASSERTION(!m_targetStreamListener,
                "If we found a listener, why are we not using it?");
   
-  //
-  // Fifth step:  If no listener prefers this type, see if any stream
-  //              converters exist to transform this content type into
-  //              some other.
-  //
-
-  // We always want to do this, since even content being forced to
-  // be handled externally may need decoding (eg via the unknown
-  // content decoder).
-  // Don't do this if the server sent us a MIME type of "*/*" because they saw
-  // it in our Accept header and got confused.
-  // XXXbz have to be careful here; may end up in some sort of bizarre infinite
-  // decoding loop.
-  if (mContentType != anyType) {
-    rv = ConvertData(request, m_contentListener, mContentType, anyType);
-    if (NS_FAILED(rv)) {
-      m_targetStreamListener = nsnull;
-    } else if (m_targetStreamListener) {
-      // We found a converter for this MIME type.  We'll just pump data into it
-      // and let the downstream nsDocumentOpenInfo handle things.
-      LOG(("  Converter taking over now"));
-      return NS_OK;
-    }
-  }
-
   if (mFlags & nsIURILoader::DONT_RETARGET) {
-    LOG(("  Listener not interested and no stream converter exists, and retargeting disallowed -> aborting"));
+    LOG(("  External handling forced or (listener not interested and no "
+         "stream converter exists), and retargeting disallowed -> aborting"));
     return NS_ERROR_WONT_HANDLE_CONTENT;
   }
 
--- xulrunner-1.9.0.19.orig/docshell/shistory/src/nsSHTransaction.cpp
+++ xulrunner-1.9.0.19/docshell/shistory/src/nsSHTransaction.cpp
@@ -111,10 +111,12 @@
 NS_IMETHODIMP
 nsSHTransaction::SetNext(nsISHTransaction * aNext)
 {
-   NS_ENSURE_SUCCESS(aNext->SetPrev(this), NS_ERROR_FAILURE);
+  if (aNext) {
+    NS_ENSURE_SUCCESS(aNext->SetPrev(this), NS_ERROR_FAILURE);
+  }
 
-   mNext = aNext;
-   return NS_OK;
+  mNext = aNext;
+  return NS_OK;
 }
 
 NS_IMETHODIMP
--- xulrunner-1.9.0.19.orig/docshell/shistory/src/nsSHistory.cpp
+++ xulrunner-1.9.0.19/docshell/shistory/src/nsSHistory.cpp
@@ -569,9 +569,14 @@
   PRInt32 cnt = 0;
   while (cnt < aEntries) {
     nsCOMPtr<nsISHTransaction> nextTxn;
-    if (mListRoot)
+    if (mListRoot) {
       mListRoot->GetNext(getter_AddRefs(nextTxn));
+      mListRoot->SetNext(nsnull);
+    }
     mListRoot = nextTxn;
+    if (mListRoot) {
+      mListRoot->SetPrev(nsnull);
+    }
     cnt++;        
   }
   mLength -= cnt;
--- xulrunner-1.9.0.19.orig/docshell/build/nsDocShellModule.cpp
+++ xulrunner-1.9.0.19/docshell/build/nsDocShellModule.cpp
@@ -158,6 +158,11 @@
     },
 
     // about redirector
+    { "about:",
+      NS_ABOUT_REDIRECTOR_MODULE_CID,
+      NS_ABOUT_MODULE_CONTRACTID_PREFIX,
+      nsAboutRedirector::Create
+    },
     { "about:config",
       NS_ABOUT_REDIRECTOR_MODULE_CID,
       NS_ABOUT_MODULE_CONTRACTID_PREFIX "config",
@@ -205,11 +210,13 @@
       NS_ABOUT_MODULE_CONTRACTID_PREFIX "licence",
       nsAboutRedirector::Create
     },
+#ifndef MOZ_XUL_APP
     { "about:about",
       NS_ABOUT_REDIRECTOR_MODULE_CID,
       NS_ABOUT_MODULE_CONTRACTID_PREFIX "about",
       nsAboutRedirector::Create
     },
+#endif
     { "about:neterror",
       NS_ABOUT_REDIRECTOR_MODULE_CID,
       NS_ABOUT_MODULE_CONTRACTID_PREFIX "neterror",
--- xulrunner-1.9.0.19.orig/docshell/base/nsAboutRedirector.cpp
+++ xulrunner-1.9.0.19/docshell/base/nsAboutRedirector.cpp
@@ -64,6 +64,8 @@
   URI.  Perhaps we should separate the two concepts out...
  */
 static RedirEntry kRedirMap[] = {
+    { "", "chrome://global/content/about.xhtml",
+      nsIAboutModule::ALLOW_SCRIPT },
     { "credits", "http://www.mozilla.org/credits/",
       nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT },
     { "mozilla", "chrome://global/content/mozilla.xhtml",
@@ -85,7 +87,9 @@
       nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT },
     { "licence", "chrome://global/content/license.html",
       nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT },
+#ifndef MOZ_XUL_APP
     { "about", "chrome://global/content/aboutAbout.html", 0 },
+#endif
     { "neterror", "chrome://global/content/netError.xhtml",
       nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT |
       nsIAboutModule::ALLOW_SCRIPT }
--- xulrunner-1.9.0.19.orig/docshell/base/nsWebShell.cpp
+++ xulrunner-1.9.0.19/docshell/base/nsWebShell.cpp
@@ -872,6 +872,10 @@
   nsCOMPtr<nsIDOMHTMLAnchorElement> anchor(do_QueryInterface(aContent));
   if (anchor) {
     anchor->GetType(typeHint);
+    NS_ConvertUTF16toUTF8 utf8Hint(typeHint);
+    nsCAutoString type, dummy;
+    NS_ParseContentType(utf8Hint, type, dummy);
+    CopyUTF8toUTF16(type, typeHint);
   }
   
   rv = InternalLoad(aURI,               // New URI
--- xulrunner-1.9.0.19.orig/docshell/base/nsDocShellEnumerator.h
+++ xulrunner-1.9.0.19/docshell/base/nsDocShellEnumerator.h
@@ -42,7 +42,9 @@
 #include "nsIEnumerator.h"
 
 #include "nsCOMPtr.h"
-#include "nsVoidArray.h"
+#include "nsTArray.h"
+#include "nsIWeakReference.h"
+#include "nsIWeakReferenceUtils.h"
 
 class nsIDocShellTreeItem;
 
@@ -98,17 +100,18 @@
   nsresult                    EnsureDocShellArray();
   nsresult                    ClearState();
   
-  nsresult                    BuildDocShellArray(nsVoidArray& inItemArray);
-  virtual nsresult            BuildArrayRecursive(nsIDocShellTreeItem* inItem, nsVoidArray& inItemArray) = 0;
+  nsresult                    BuildDocShellArray(nsTArray<nsWeakPtr>& inItemArray);
+  virtual nsresult            BuildArrayRecursive(nsIDocShellTreeItem* inItem, nsTArray<nsWeakPtr>& inItemArray) = 0;
     
 protected:
 
-  nsIDocShellTreeItem*        mRootItem;      // weak ref!
+  nsWeakPtr                   mRootItem;      // weak ref!
   
-  nsVoidArray*                mItemArray;     // flattened list of items with matching type
-  PRInt32                     mCurIndex;
+  nsTArray<nsWeakPtr>         mItemArray;     // flattened list of items with matching type
+  PRUint32                    mCurIndex;
   
   PRInt32                     mDocShellType;  // only want shells of this type
+  PRPackedBool                mArrayValid;    // is mItemArray up to date?
 
   const PRInt8                mEnumerationDirection;
 };
@@ -125,7 +128,7 @@
 
 protected:
 
-  virtual nsresult            BuildArrayRecursive(nsIDocShellTreeItem* inItem, nsVoidArray& inItemArray);
+  virtual nsresult            BuildArrayRecursive(nsIDocShellTreeItem* inItem, nsTArray<nsWeakPtr>& inItemArray);
 
 };
 
@@ -139,6 +142,6 @@
                               }
 protected:
 
-  virtual nsresult            BuildArrayRecursive(nsIDocShellTreeItem* inItem, nsVoidArray& inItemArray);
+  virtual nsresult            BuildArrayRecursive(nsIDocShellTreeItem* inItem, nsTArray<nsWeakPtr>& inItemArray);
 
 };
--- xulrunner-1.9.0.19.orig/docshell/base/nsDocShell.cpp
+++ xulrunner-1.9.0.19/docshell/base/nsDocShell.cpp
@@ -5081,6 +5081,12 @@
             return; // nothing to tell anybody about
         AddToGlobalHistory(oldURI, PR_TRUE, aOldChannel);
     }
+
+    if (!(aRedirectFlags & nsIChannelEventSink::REDIRECT_INTERNAL) && 
+        mLoadType & (LOAD_CMD_RELOAD | LOAD_CMD_HISTORY)) {
+        mLoadType = LOAD_NORMAL_REPLACE;
+        SetHistoryEntry(&mLSHE, nsnull);
+    }
 }
 
 NS_IMETHODIMP
--- xulrunner-1.9.0.19.orig/docshell/base/nsDocShellEnumerator.cpp
+++ xulrunner-1.9.0.19/docshell/base/nsDocShellEnumerator.cpp
@@ -44,16 +44,15 @@
 
 nsDocShellEnumerator::nsDocShellEnumerator(PRInt32 inEnumerationDirection)
 : mRootItem(nsnull)
-, mItemArray(nsnull)
 , mCurIndex(0)
 , mDocShellType(nsIDocShellTreeItem::typeAll)
+, mArrayValid(PR_FALSE)
 , mEnumerationDirection(inEnumerationDirection)
 {
 }
 
 nsDocShellEnumerator::~nsDocShellEnumerator()
 {
-  delete mItemArray;
 }
 
 NS_IMPL_ISUPPORTS1(nsDocShellEnumerator, nsISimpleEnumerator)
@@ -68,18 +67,14 @@
   nsresult rv = EnsureDocShellArray();
   if (NS_FAILED(rv)) return rv;
   
-  if (mCurIndex >= 0 && mCurIndex < mItemArray->Count())
-  {
-    nsIDocShellTreeItem* thisItem = reinterpret_cast<nsIDocShellTreeItem*>(mItemArray->ElementAt(mCurIndex));
-    rv = thisItem->QueryInterface(NS_GET_IID(nsISupports), (void **)outCurItem);
-    if (NS_FAILED(rv)) return rv;
-  }
-  else
+  if (mCurIndex >= mItemArray.Length()) {
     return NS_ERROR_FAILURE;
-  
-  mCurIndex ++;
-  
-  return NS_OK;
+  }
+
+  // post-increment is important here
+  nsCOMPtr<nsISupports> item = do_QueryReferent(mItemArray[mCurIndex++], &rv);
+  item.forget(outCurItem);
+  return rv;
 }
 
 /* boolean hasMoreElements (); */
@@ -91,21 +86,21 @@
   nsresult rv = EnsureDocShellArray();
   if (NS_FAILED(rv)) return rv;
 
-  *outHasMore = (mCurIndex < mItemArray->Count());
+  *outHasMore = (mCurIndex < mItemArray.Length());
   return NS_OK;
 }
 
 nsresult nsDocShellEnumerator::GetEnumerationRootItem(nsIDocShellTreeItem * *aEnumerationRootItem)
 {
   NS_ENSURE_ARG_POINTER(aEnumerationRootItem);
-  *aEnumerationRootItem = mRootItem;
-  NS_IF_ADDREF(*aEnumerationRootItem);
+  nsCOMPtr<nsIDocShellTreeItem> item = do_QueryReferent(mRootItem);
+  item.forget(aEnumerationRootItem);
   return NS_OK;
 }
 
 nsresult nsDocShellEnumerator::SetEnumerationRootItem(nsIDocShellTreeItem * aEnumerationRootItem)
 {
-  mRootItem = aEnumerationRootItem;
+  mRootItem = do_GetWeakReference(aEnumerationRootItem);
   ClearState();
   return NS_OK;
 }
@@ -132,12 +127,10 @@
 
 nsresult nsDocShellEnumerator::EnsureDocShellArray()
 {
-  if (!mItemArray)
+  if (!mArrayValid)
   {
-    mItemArray = new nsVoidArray;
-    if (!mItemArray) return NS_ERROR_OUT_OF_MEMORY;
-  
-    return BuildDocShellArray(*mItemArray);
+    mArrayValid = PR_TRUE;
+    return BuildDocShellArray(mItemArray);
   }
   
   return NS_OK;
@@ -145,21 +138,21 @@
 
 nsresult nsDocShellEnumerator::ClearState()
 {
-  delete mItemArray;
-  mItemArray = nsnull;
-  
+  mItemArray.Clear();
+  mArrayValid = PR_FALSE;
   mCurIndex = 0;
   return NS_OK;
 }
 
-nsresult nsDocShellEnumerator::BuildDocShellArray(nsVoidArray& inItemArray)
+nsresult nsDocShellEnumerator::BuildDocShellArray(nsTArray<nsWeakPtr>& inItemArray)
 {
   NS_ENSURE_TRUE(mRootItem, NS_ERROR_NOT_INITIALIZED);
   inItemArray.Clear();
-  return BuildArrayRecursive(mRootItem, inItemArray);
+  nsCOMPtr<nsIDocShellTreeItem> item = do_QueryReferent(mRootItem);
+  return BuildArrayRecursive(item, inItemArray);
 }
 
-nsresult nsDocShellForwardsEnumerator::BuildArrayRecursive(nsIDocShellTreeItem* inItem, nsVoidArray& inItemArray)
+nsresult nsDocShellForwardsEnumerator::BuildArrayRecursive(nsIDocShellTreeItem* inItem, nsTArray<nsWeakPtr>& inItemArray)
 {
   nsresult rv;
   nsCOMPtr<nsIDocShellTreeNode> itemAsNode = do_QueryInterface(inItem, &rv);
@@ -170,8 +163,8 @@
   if ((mDocShellType == nsIDocShellTreeItem::typeAll) ||
       (NS_SUCCEEDED(inItem->GetItemType(&itemType)) && (itemType == mDocShellType)))
   {
-    rv = inItemArray.AppendElement((void *)inItem);
-    if (NS_FAILED(rv)) return rv;
+    if (!inItemArray.AppendElement(do_GetWeakReference(inItem)))
+      return NS_ERROR_OUT_OF_MEMORY;
   }
 
   PRInt32   numChildren;
@@ -192,7 +185,7 @@
 }
 
 
-nsresult nsDocShellBackwardsEnumerator::BuildArrayRecursive(nsIDocShellTreeItem* inItem, nsVoidArray& inItemArray)
+nsresult nsDocShellBackwardsEnumerator::BuildArrayRecursive(nsIDocShellTreeItem* inItem, nsTArray<nsWeakPtr>& inItemArray)
 {
   nsresult rv;
   nsCOMPtr<nsIDocShellTreeNode> itemAsNode = do_QueryInterface(inItem, &rv);
@@ -217,8 +210,8 @@
   if ((mDocShellType == nsIDocShellTreeItem::typeAll) ||
       (NS_SUCCEEDED(inItem->GetItemType(&itemType)) && (itemType == mDocShellType)))
   {
-    rv = inItemArray.AppendElement((void *)inItem);
-    if (NS_FAILED(rv)) return rv;
+    if (!inItemArray.AppendElement(do_GetWeakReference(inItem)))
+      return NS_ERROR_OUT_OF_MEMORY;
   }
 
 
--- xulrunner-1.9.0.19.orig/intl/uconv/ucvlatin/nsUCS2BEToUnicode.h
+++ xulrunner-1.9.0.19/intl/uconv/ucvlatin/nsUCS2BEToUnicode.h
@@ -62,6 +62,8 @@
   PRUint8 mOddByte;
   // to store an odd high surrogate left over between runs
   PRUnichar mOddHighSurrogate;
+  // to store an odd low surrogate left over between runs
+  PRUnichar mOddLowSurrogate;
 };
 
 // UTF-16 big endian
--- xulrunner-1.9.0.19.orig/intl/uconv/ucvlatin/nsUCS2BEToUnicode.cpp
+++ xulrunner-1.9.0.19/intl/uconv/ucvlatin/nsUCS2BEToUnicode.cpp
@@ -42,14 +42,16 @@
 #include <string.h>
 #include "prtypes.h"
 
-#define STATE_NORMAL          0
-#define STATE_HALF_CODE_POINT 1
-#define STATE_FIRST_CALL      2
-#define STATE_FOUND_BOM       3
+#define STATE_NORMAL             0
+#define STATE_HALF_CODE_POINT    1
+#define STATE_FIRST_CALL         2
+#define STATE_FOUND_BOM          3
+#define STATE_ODD_SURROGATE_PAIR 4
 
 static nsresult
 UTF16ConvertToUnicode(PRUint8& aState, PRUint8& aOddByte,
-                      PRUnichar& aOddHighSurrogate, const char * aSrc,
+                      PRUnichar& aOddHighSurrogate, PRUnichar& aOddLowSurrogate,
+                      const char * aSrc,
                       PRInt32 * aSrcLength, PRUnichar * aDest,
                       PRInt32 * aDestLength,
                       PRBool aSwapBytes)
@@ -59,32 +61,48 @@
   PRUnichar* dest = aDest;
   PRUnichar* destEnd = aDest + *aDestLength;
 
-  if(STATE_FOUND_BOM == aState) // caller found a BOM
-  {
-    if (*aSrcLength < 2)
-      return NS_ERROR_ILLEGAL_INPUT;
-    src+=2;
-    aState = STATE_NORMAL;
-  } else if(STATE_FIRST_CALL == aState) { // first time called
-    if (*aSrcLength < 2)
-      return NS_ERROR_ILLEGAL_INPUT;
-
-    // Eliminate BOM (0xFEFF). Note that different endian case is taken care of
-    // in |Convert| of LE and BE converters. Here, we only have to
-    // deal with the same endian case. That is, 0xFFFE (byte-swapped BOM) is
-    // illegal.
-    if(0xFEFF == *((PRUnichar*)src)) {
+  switch(aState) {
+    case STATE_FOUND_BOM:
+      NS_ASSERTION(*aSrcLength > 1, "buffer too short");
       src+=2;
-    } else if(0xFFFE == *((PRUnichar*)src)) {
-      *aSrcLength=0;
-      *aDestLength=0;
-      return NS_ERROR_ILLEGAL_INPUT;
-    }  
-    aState = STATE_NORMAL;
+      aState = STATE_NORMAL;
+      break;
+
+    case STATE_FIRST_CALL: // first time called
+      NS_ASSERTION(*aSrcLength > 1, "buffer too short");
+      // Eliminate BOM (0xFEFF). Note that different endian case is taken care
+      // of in |Convert| of LE and BE converters. Here, we only have to
+      // deal with the same endian case. That is, 0xFFFE (byte-swapped BOM) is
+      // illegal.
+      if(0xFEFF == *((PRUnichar*)src)) {
+        src+=2;
+      } else if(0xFFFE == *((PRUnichar*)src)) {
+        *aSrcLength=0;
+        *aDestLength=0;
+        return NS_ERROR_ILLEGAL_INPUT;
+      }  
+      aState = STATE_NORMAL;
+      break;
+
+    case STATE_ODD_SURROGATE_PAIR:
+      if (*aDestLength < 2)
+        *dest++ = UCS2_REPLACEMENT_CHAR;
+      else {
+        *dest++ = aOddHighSurrogate;
+        *dest++ = aOddLowSurrogate;
+        aOddHighSurrogate = aOddLowSurrogate = 0;
+        aState = STATE_NORMAL;
+      }
+      break;
+
+    case STATE_NORMAL:
+    case STATE_HALF_CODE_POINT:
+    default:
+      break;
   }
 
   if (src == srcEnd) {
-    *aDestLength = 0;
+    *aDestLength = dest - aDest;
     return NS_OK;
   }
 
@@ -136,17 +154,19 @@
       oddHighSurrogate = u;
     }
     else /* if (NS_IS_LOW_SURROGATE(u)) */ {
-      if (oddHighSurrogate) {
-        if (dest == destEnd - 1) {
-          *dest++ = UCS2_REPLACEMENT_CHAR;
+      if (oddHighSurrogate && *aDestLength > 1) {
+        if (dest + 1 >= destEnd) {
+          aOddLowSurrogate = u;
+          aOddHighSurrogate = oddHighSurrogate;
+          aState = STATE_ODD_SURROGATE_PAIR;
           goto error;
         }
         *dest++ = oddHighSurrogate;
         *dest++ = u;
-        oddHighSurrogate = 0;
       } else {
         *dest++ = UCS2_REPLACEMENT_CHAR;
       }
+      oddHighSurrogate = 0;
     }
   }
   if (src != srcEnd) {
@@ -173,6 +193,7 @@
   mState = STATE_FIRST_CALL;
   mOddByte = 0;
   mOddHighSurrogate = 0;
+  mOddLowSurrogate = 0;
   return NS_OK;
 }
 
@@ -181,9 +202,11 @@
                                    PRInt32 * aDestLength)
 {
   // the left-over data of the previous run have to be taken into account.
-  *aDestLength = (aSrcLength +
-                    ((STATE_HALF_CODE_POINT == mState) ? 1 : 0)) / 2 +
-                 ((mOddHighSurrogate != 0) ? 1 : 0);
+  *aDestLength = (aSrcLength + ((STATE_HALF_CODE_POINT == mState) ? 1 : 0)) / 2;
+  if (mOddHighSurrogate)
+    (*aDestLength)++;
+  if (mOddLowSurrogate)
+    (*aDestLength)++;
   return NS_OK;
 }
 
@@ -192,14 +215,19 @@
 nsUTF16BEToUnicode::Convert(const char * aSrc, PRInt32 * aSrcLength,
                             PRUnichar * aDest, PRInt32 * aDestLength)
 {
+    if(STATE_FIRST_CALL == mState && *aSrcLength < 2)
+    {
+      nsresult res = (*aSrcLength == 0) ? NS_OK : NS_ERROR_ILLEGAL_INPUT;
+      *aSrcLength=0;
+      *aDestLength=0;
+      return res;
+    }
 #ifdef IS_LITTLE_ENDIAN
     // Remove the BOM if we're little-endian. The 'same endian' case with the
     // leading BOM will be taken care of by |UTF16ConvertToUnicode|.
     if(STATE_FIRST_CALL == mState) // Called for the first time.
     {
       mState = STATE_NORMAL;
-      if (*aSrcLength < 2)
-        return NS_ERROR_ILLEGAL_INPUT;
       if(0xFFFE == *((PRUnichar*)aSrc)) {
         // eliminate BOM (on LE machines, BE BOM is 0xFFFE)
         mState = STATE_FOUND_BOM;
@@ -212,6 +240,7 @@
 #endif
 
   nsresult rv = UTF16ConvertToUnicode(mState, mOddByte, mOddHighSurrogate,
+                                      mOddLowSurrogate,
                                       aSrc, aSrcLength, aDest, aDestLength,
 #ifdef IS_LITTLE_ENDIAN
                                       PR_TRUE
@@ -226,14 +255,19 @@
 nsUTF16LEToUnicode::Convert(const char * aSrc, PRInt32 * aSrcLength,
                             PRUnichar * aDest, PRInt32 * aDestLength)
 {
+    if(STATE_FIRST_CALL == mState && *aSrcLength < 2)
+    {
+      nsresult res = (*aSrcLength == 0) ? NS_OK : NS_ERROR_ILLEGAL_INPUT;
+      *aSrcLength=0;
+      *aDestLength=0;
+      return res;
+    }
 #ifdef IS_BIG_ENDIAN
     // Remove the BOM if we're big-endian. The 'same endian' case with the
     // leading BOM will be taken care of by |UTF16ConvertToUnicode|.
     if(STATE_FIRST_CALL == mState) // first time called
     {
       mState = STATE_NORMAL;
-      if (*aSrcLength < 2)
-        return NS_ERROR_ILLEGAL_INPUT;
       if(0xFFFE == *((PRUnichar*)aSrc)) {
         // eliminate BOM (on BE machines, LE BOM is 0xFFFE)
         mState = STATE_FOUND_BOM;
@@ -246,6 +280,7 @@
 #endif
     
   nsresult rv = UTF16ConvertToUnicode(mState, mOddByte, mOddHighSurrogate,
+                                      mOddLowSurrogate,
                                       aSrc, aSrcLength, aDest, aDestLength,
 #ifdef IS_BIG_ENDIAN
                                       PR_TRUE
@@ -268,12 +303,16 @@
 nsUTF16ToUnicode::Convert(const char * aSrc, PRInt32 * aSrcLength,
                           PRUnichar * aDest, PRInt32 * aDestLength)
 {
+    if(STATE_FIRST_CALL == mState && *aSrcLength < 2)
+    {
+      nsresult res = (*aSrcLength == 0) ? NS_OK : NS_ERROR_ILLEGAL_INPUT;
+      *aSrcLength=0;
+      *aDestLength=0;
+      return res;
+    }
     if(STATE_FIRST_CALL == mState) // first time called
     {
       mState = STATE_NORMAL;
-      if (*aSrcLength < 2)
-        return NS_ERROR_ILLEGAL_INPUT;
-
       // check if BOM (0xFEFF) is at the beginning, remove it if found, and
       // set mEndian accordingly.
       if(0xFF == PRUint8(aSrc[0]) && 0xFE == PRUint8(aSrc[1])) {
@@ -304,6 +343,7 @@
     }
     
     nsresult rv = UTF16ConvertToUnicode(mState, mOddByte, mOddHighSurrogate,
+                                        mOddLowSurrogate,
                                         aSrc, aSrcLength, aDest, aDestLength,
 #ifdef IS_BIG_ENDIAN
                                         (mEndian == kLittleEndian)
--- xulrunner-1.9.0.19.orig/intl/uconv/idl/nsIScriptableUConv.idl
+++ xulrunner-1.9.0.19/intl/uconv/idl/nsIScriptableUConv.idl
@@ -102,3 +102,16 @@
    */
   attribute string charset;
 };
+
+[scriptable, uuid(f7ed6618-5ff5-4f0b-bb83-48ce63eb289b)]
+interface nsIScriptableUnicodeConverter_1_9_BRANCH : nsIScriptableUnicodeConverter
+{
+  /**
+   * Internal use
+   *
+   * When this attribute is set, all charsets may be accessed.
+   * When it is not set (the default), charsets with the isXSSVulnerable flag
+   *  may not be accessed
+   */
+  attribute boolean isInternal;
+};
--- xulrunner-1.9.0.19.orig/intl/uconv/idl/nsICharsetConverterManager.idl
+++ xulrunner-1.9.0.19/intl/uconv/idl/nsICharsetConverterManager.idl
@@ -113,10 +113,11 @@
      * character encoding may be used for certain purposes, if it is 
      * multi-byte, and the language code for it. See charsetData.properties
      * for the source of this data. Some known property names:
-     *    notForBrowser  - not to be used in the bowser.
+     *    notForBrowser  - not to be used in the browser.
      *    notForOutgoing - not to be used for exporting files.
      *    LangGroup      - language code for charset, e.g. 'he' and 'zh-CN'.
      *    isMultibyte    - is this a multi-byte charset?
+     *    isXSSVulnerable - not to be used in untrusted web content
      * 
      * @param charset name of the character encoding, e.g. 'iso-8859-15'.
      * @param prop property desired for the character encoding.
@@ -135,3 +136,16 @@
     nsIAtom getCharsetLangGroup(in string charset);
     nsIAtom getCharsetLangGroupRaw(in string charset);
 };
+
+[scriptable, uuid(36982132-707c-4d77-b27f-958e76e022de)]
+interface nsICharsetConverterManager_1_9_BRANCH : nsICharsetConverterManager
+{
+    /**
+     * "Internal" versions of getUnicodeDecoder* will return a decoder for any
+     *  charset; the other versions will return NS_ERROR_UCONV_NOCONV if the
+     *  requested charset is vulnerable to XSS attacks and should not be used
+     * with untrusted input
+     */
+    nsIUnicodeDecoder getUnicodeDecoderInternal(in string charset);
+    nsIUnicodeDecoder getUnicodeDecoderRawInternal(in string charset);
+};
--- xulrunner-1.9.0.19.orig/intl/uconv/src/nsUTF8ToUnicode.cpp
+++ xulrunner-1.9.0.19/intl/uconv/src/nsUTF8ToUnicode.cpp
@@ -64,6 +64,15 @@
   return res;
 }
 
+static PRUnichar* EmitSurrogatePair(PRUint32 ucs4, PRUnichar* aDest)
+{
+  NS_ASSERTION(ucs4 > 0xFFFF, "Should be a supplementary character");
+  ucs4 -= 0x00010000;
+  *aDest++ = 0xD800 | (0x000003FF & (ucs4 >> 10));
+  *aDest++ = 0xDC00 | (0x000003FF & ucs4);
+  return aDest;
+}
+
 //----------------------------------------------------------------------
 // Class nsUTF8ToUnicode [implementation]
 
@@ -136,12 +145,28 @@
 
   nsresult res = NS_OK; // conversion result
 
+  out = aDest;
+  if (mState == 0xFF) {
+    // Emit supplementary character left over from previous iteration. If the
+    // buffer size is insufficient, treat it as an illegal character.
+    if (aDestLen < 2) {
+      NS_ERROR("Output buffer insufficient to hold supplementary character");
+      mState = 0;
+      return NS_ERROR_ILLEGAL_INPUT;
+    }
+    out = EmitSurrogatePair(mUcs4, out);
+    mUcs4 = 0;
+    mState = 0;
+    mBytes = 1;
+    mFirst = PR_FALSE;
+  }
+
   // Set mFirst to PR_FALSE now so we don't have to every time through the ASCII
   // branch within the loop.
   if (mFirst && aSrcLen && (0 == (0x80 & (*aSrc))))
     mFirst = PR_FALSE;
 
-  for (in = aSrc, out = aDest; ((in < inend) && (out < outend)); ++in) {
+  for (in = aSrc; ((in < inend) && (out < outend)); ++in) {
     if (0 == mState) {
       // When mState is zero we expect either a US-ASCII character or a
       // multi-octet sequence.
@@ -227,9 +252,15 @@
           }
           if (mUcs4 > 0xFFFF) {
             // mUcs4 is in the range 0x10000 - 0x10FFFF. Output a UTF-16 pair
-            mUcs4 -= 0x00010000;
-            *out++ = 0xD800 | (0x000003FF & (mUcs4 >> 10));
-            *out++ = 0xDC00 | (0x000003FF & mUcs4);
+            if (out + 2 > outend) {
+              // insufficient space left in the buffer. Keep mUcs4 for the
+              // next iteration.
+              mState = 0xFF;
+              ++in;
+              res = NS_OK_UDEC_MOREOUTPUT;
+              break;
+            }
+            out = EmitSurrogatePair(mUcs4, out);
           } else if (UNICODE_BYTE_ORDER_MARK != mUcs4 || !mFirst) {
             // Don't output the BOM only if it is the first character
             *out++ = mUcs4;
--- xulrunner-1.9.0.19.orig/intl/uconv/src/nsConverterInputStream.cpp
+++ xulrunner-1.9.0.19/intl/uconv/src/nsConverterInputStream.cpp
@@ -254,7 +254,8 @@
     NS_ASSERTION(srcConsumed <= mByteData->GetLength(),
                  "Whoa.  The converter should have returned NS_OK_UDEC_MOREINPUT before this point!");
   } while (mReplacementChar &&
-           NS_FAILED(*aErrorCode));
+           NS_FAILED(*aErrorCode) &&
+           mUnicharData->GetBufferSize() > mUnicharDataLength);
 
   mLeftOverBytes = mByteData->GetLength() - srcConsumed;
 
--- xulrunner-1.9.0.19.orig/intl/uconv/src/charsetData.properties
+++ xulrunner-1.9.0.19/intl/uconv/src/charsetData.properties
@@ -47,6 +47,10 @@
 ## charset_name.notForOutgoing = anything  -  specifies that this charset is 
 ## not to be used for exporting files ('SaveAsCharset' in composer)
 ##
+## charset_name.isXSSVulnerable = anything - specifies that this charset is
+## known to be vulnerable to XSS attacks and should not be exposed to web
+## content
+##
 ## charset_name.LangGroup = 
 ##
 ## charset_name.isMultibyte = multi byte charsets
@@ -67,6 +71,13 @@
 x-ibm1046.notForBrowser                 = true
 iso-8859-8-e.notForBrowser              = true
 utf-7.notForBrowser                     = true
+x-mac-arabic.notForBrowser              = true
+x-mac-farsi.notForBrowser               = true
+x-mac-hebrew.notForBrowser              = true
+
+x-mac-arabic.isXSSVulnerable            = true
+x-mac-farsi.isXSSVulnerable             = true
+x-mac-hebrew.isXSSVulnerable            = true
 
 t.61-8bit.notForOutgoing             = true
 utf-7.notForOutgoing                 = true
--- xulrunner-1.9.0.19.orig/intl/uconv/src/nsScriptableUConv.h
+++ xulrunner-1.9.0.19/intl/uconv/src/nsScriptableUConv.h
@@ -44,11 +44,12 @@
 #include "nsICharsetConverterManager.h"
 #include "nsIScriptableUConv.h"
 
-class nsScriptableUnicodeConverter : public nsIScriptableUnicodeConverter
+class nsScriptableUnicodeConverter : public nsIScriptableUnicodeConverter_1_9_BRANCH
 {
 public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSISCRIPTABLEUNICODECONVERTER
+  NS_DECL_NSISCRIPTABLEUNICODECONVERTER_1_9_BRANCH
 
   nsScriptableUnicodeConverter();
   virtual ~nsScriptableUnicodeConverter();
@@ -59,6 +60,7 @@
   nsCAutoString mCharset;
   nsCOMPtr<nsIUnicodeEncoder> mEncoder;
   nsCOMPtr<nsIUnicodeDecoder> mDecoder;
+  PRPackedBool mIsInternal;
 
   nsresult FinishWithLength(char **_retval, PRInt32* aLength);
   nsresult ConvertFromUnicodeWithLength(const nsAString& aSrc,
--- xulrunner-1.9.0.19.orig/intl/uconv/src/nsCharsetConverterManager.h
+++ xulrunner-1.9.0.19/intl/uconv/src/nsCharsetConverterManager.h
@@ -46,10 +46,11 @@
 #include "nsINativeUConvService.h"
 #endif
 
-class nsCharsetConverterManager : public nsICharsetConverterManager
+class nsCharsetConverterManager : public nsICharsetConverterManager_1_9_BRANCH
 {
   NS_DECL_ISUPPORTS
   NS_DECL_NSICHARSETCONVERTERMANAGER
+  NS_DECL_NSICHARSETCONVERTERMANAGER_1_9_BRANCH
 
 public:
 
--- xulrunner-1.9.0.19.orig/intl/uconv/src/nsScriptableUConv.cpp
+++ xulrunner-1.9.0.19/intl/uconv/src/nsScriptableUConv.cpp
@@ -52,9 +52,12 @@
 static PRInt32          gInstanceCount = 0;
 
 /* Implementation file */
-NS_IMPL_ISUPPORTS1(nsScriptableUnicodeConverter, nsIScriptableUnicodeConverter)
+NS_IMPL_ISUPPORTS2(nsScriptableUnicodeConverter,
+                   nsIScriptableUnicodeConverter,
+                   nsIScriptableUnicodeConverter_1_9_BRANCH)
 
 nsScriptableUnicodeConverter::nsScriptableUnicodeConverter()
+: mIsInternal(PR_FALSE)
 {
   PR_AtomicIncrement(&gInstanceCount);
 }
@@ -270,13 +273,27 @@
   return InitConverter();
 }
 
+NS_IMETHODIMP
+nsScriptableUnicodeConverter::GetIsInternal(PRBool *aIsInternal)
+{
+  *aIsInternal = mIsInternal;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsScriptableUnicodeConverter::SetIsInternal(const PRBool aIsInternal)
+{
+  mIsInternal = aIsInternal;
+  return NS_OK;
+}
+
 nsresult
 nsScriptableUnicodeConverter::InitConverter()
 {
   nsresult rv = NS_OK;
   mEncoder = NULL ;
 
-  nsCOMPtr<nsICharsetConverterManager> ccm = do_GetService(NS_CHARSETCONVERTERMANAGER_CONTRACTID, &rv);
+  nsCOMPtr<nsICharsetConverterManager_1_9_BRANCH> ccm = do_GetService(NS_CHARSETCONVERTERMANAGER_CONTRACTID, &rv);
 
   if (NS_SUCCEEDED( rv) && (nsnull != ccm)) {
     // get charset atom due to getting unicode converter
@@ -286,7 +303,11 @@
     if(NS_SUCCEEDED(rv)) {
       rv = mEncoder->SetOutputErrorBehavior(nsIUnicodeEncoder::kOnError_Replace, nsnull, (PRUnichar)'?');
       if(NS_SUCCEEDED(rv)) {
-        rv = ccm->GetUnicodeDecoder(mCharset.get(), getter_AddRefs(mDecoder));
+        rv = mIsInternal ?
+          ccm->GetUnicodeDecoderInternal(mCharset.get(),
+                                         getter_AddRefs(mDecoder)) :
+          ccm->GetUnicodeDecoder(mCharset.get(),
+                                 getter_AddRefs(mDecoder));
       }
     }
   }
--- xulrunner-1.9.0.19.orig/intl/uconv/src/nsCharsetConverterManager.cpp
+++ xulrunner-1.9.0.19/intl/uconv/src/nsCharsetConverterManager.cpp
@@ -69,8 +69,9 @@
 
 // Class nsCharsetConverterManager [implementation]
 
-NS_IMPL_THREADSAFE_ISUPPORTS1(nsCharsetConverterManager,
-                              nsICharsetConverterManager)
+NS_IMPL_THREADSAFE_ISUPPORTS2(nsCharsetConverterManager,
+                              nsICharsetConverterManager,
+                              nsICharsetConverterManager_1_9_BRANCH)
 
 nsCharsetConverterManager::nsCharsetConverterManager() 
   :mDataBundle(NULL), mTitleBundle(NULL)
@@ -223,6 +224,20 @@
 }
 
 NS_IMETHODIMP
+nsCharsetConverterManager::GetUnicodeDecoderRaw(const char * aSrc,
+                                                nsIUnicodeDecoder ** aResult)
+{
+  nsresult rv;
+
+  nsAutoString str;
+  rv = GetCharsetData(aSrc, NS_LITERAL_STRING(".isXSSVulnerable").get(), str);
+  if (NS_SUCCEEDED(rv))
+    return NS_ERROR_UCONV_NOCONV;
+
+  return GetUnicodeDecoderRawInternal(aSrc, aResult);
+}
+
+NS_IMETHODIMP
 nsCharsetConverterManager::GetUnicodeDecoder(const char * aSrc, 
                                              nsIUnicodeDecoder ** aResult)
 {
@@ -237,8 +252,22 @@
 }
 
 NS_IMETHODIMP
-nsCharsetConverterManager::GetUnicodeDecoderRaw(const char * aSrc, 
-                                                nsIUnicodeDecoder ** aResult)
+nsCharsetConverterManager::GetUnicodeDecoderInternal(const char * aSrc, 
+                                                     nsIUnicodeDecoder ** aResult)
+{
+  // resolve the charset first
+  nsCAutoString charset;
+  
+  // fully qualify to possibly avoid vtable call
+  nsCharsetConverterManager::GetCharsetAlias(aSrc, charset);
+
+  return nsCharsetConverterManager::GetUnicodeDecoderRawInternal(charset.get(),
+                                                                 aResult);
+}
+
+NS_IMETHODIMP
+nsCharsetConverterManager::GetUnicodeDecoderRawInternal(const char * aSrc, 
+                                                        nsIUnicodeDecoder ** aResult)
 {
   *aResult= nsnull;
   nsCOMPtr<nsIUnicodeDecoder> decoder;
--- xulrunner-1.9.0.19.orig/intl/uconv/ucvja/nsJapaneseToUnicode.cpp
+++ xulrunner-1.9.0.19/intl/uconv/ucvja/nsJapaneseToUnicode.cpp
@@ -322,10 +322,10 @@
             if(0xFF == off) {
               *dest++ = 0xFFFD;
                // if the first byte is valid for EUC-JP but the second 
-               // is not while being a valid US-ASCII(i.e. < 0xc0), save it
+               // is not while being a valid US-ASCII, save it
                // instead of eating it up !
-               if ( ! (*src & 0xc0)  )
-                 *dest++ = (PRUnichar) *src;;
+              if ( (PRUint8)*src < (PRUint8)0x7f )
+                --src;
             } else {
                *dest++ = gJapaneseMap[mData+off];
             }
@@ -344,7 +344,7 @@
               // if 0x8e is not followed by a valid JIS X 0201 byte
               // but by a valid US-ASCII, save it instead of eating it up.
               if ( (PRUint8)*src < (PRUint8)0x7f )
-                 *dest++ = (PRUnichar) *src;
+                --src;
             }
             mState = 0;
             if(dest >= destEnd)
--- xulrunner-1.9.0.19.orig/intl/uconv/ucvcn/nsGBKToUnicode.cpp
+++ xulrunner-1.9.0.19/intl/uconv/ucvcn/nsGBKToUnicode.cpp
@@ -197,8 +197,7 @@
                *aDest = UCS2_NO_MAPPING;
            } else {
               // let's try supplement mapping
-             NS_ASSERTION(( (iDestlen+1) <= (*aDestLength) ), "no enouth output memory");
-             if ( (iDestlen+1) <= (*aDestLength) )
+             if ( (iDestlen+1) < (*aDestLength) )
              {
                if(DecodeToSurrogate(aSrc, aDest))
                {
@@ -209,7 +208,13 @@
                  *aDest = UCS2_NO_MAPPING;
               }
              } else {
-               *aDest = UCS2_NO_MAPPING;
+               if (*aDestLength < 2) {
+                 NS_ERROR("insufficient space in output buffer");
+                 *aDest = UCS2_NO_MAPPING;
+               } else {
+                 rv = NS_OK_UDEC_MOREOUTPUT;
+                 break;
+               }
              }
            }
         } else {
--- xulrunner-1.9.0.19.orig/browser/app/mozilla.in
+++ xulrunner-1.9.0.19/browser/app/mozilla.in
@@ -135,8 +135,5 @@
 then
   echo $dist_bin/run-mozilla.sh $script_args $dist_bin/$MOZILLA_BIN "$@"
 fi
-"$dist_bin/run-mozilla.sh" $script_args "$dist_bin/$MOZILLA_BIN" "$@"
-exitcode=$?
-
-exit $exitcode
+exec "$dist_bin/run-mozilla.sh" $script_args "$dist_bin/$MOZILLA_BIN" "$@"
 # EOF.
--- xulrunner-1.9.0.19.orig/layout/generic/nsFirstLetterFrame.cpp
+++ xulrunner-1.9.0.19/layout/generic/nsFirstLetterFrame.cpp
@@ -47,6 +47,10 @@
 #include "nsAutoPtr.h"
 #include "nsStyleSet.h"
 #include "nsFrameManager.h"
+#include "nsPlaceholderFrame.h"
+#include "nsCSSFrameConstructor.h"
+
+NS_DEFINE_IID(kFirstLetterFrameCID, NS_FIRSTLETTER_FRAME_CID);
 
 nsIFrame*
 NS_NewFirstLetterFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
@@ -54,6 +58,19 @@
   return new (aPresShell) nsFirstLetterFrame(aContext);
 }
 
+NS_IMETHODIMP
+nsFirstLetterFrame::QueryInterface(const nsIID& aIID, void** aInstancePtr)
+{
+  NS_PRECONDITION(aInstancePtr, "null out param");
+
+  if (aIID.Equals(kFirstLetterFrameCID)) {
+    *aInstancePtr = this;
+    return NS_OK;
+  }
+
+  return nsFirstLetterFrameSuper::QueryInterface(aIID, aInstancePtr);
+}
+
 #ifdef NS_DEBUG
 NS_IMETHODIMP
 nsFirstLetterFrame::GetFrameName(nsAString& aResult) const
@@ -278,23 +295,32 @@
   else {
     // Create a continuation for the child frame if it doesn't already
     // have one.
-    nsIFrame* nextInFlow;
-    rv = CreateNextInFlow(aPresContext, this, kid, nextInFlow);
-    if (NS_FAILED(rv)) {
-      return rv;
-    }
+    if (!GetStyleDisplay()->IsFloating()) {
+      nsIFrame* nextInFlow;
+      rv = CreateNextInFlow(aPresContext, this, kid, nextInFlow);
+      if (NS_FAILED(rv)) {
+        return rv;
+      }
 
-    // And then push it to our overflow list
-    if (nextInFlow) {
-      kid->SetNextSibling(nsnull);
-      SetOverflowFrames(aPresContext, nextInFlow);
-    }
-    else {
-      nsIFrame* nextSib = kid->GetNextSibling();
-      if (nextSib) {
+      // And then push it to our overflow list
+      if (nextInFlow) {
         kid->SetNextSibling(nsnull);
-        SetOverflowFrames(aPresContext, nextSib);
+        SetOverflowFrames(aPresContext, nextInFlow);
       }
+      else {
+        nsIFrame* nextSib = kid->GetNextSibling();
+        if (nextSib) {
+          kid->SetNextSibling(nsnull);
+          SetOverflowFrames(aPresContext, nextSib);
+        }
+      }
+    } else if (!kid->GetNextInFlow()) {
+      // For floating first letter frames (if a continuation wasn't already
+      // created for us) we need to put the continuation with the rest of the
+      // text that the first letter frame was made out of.
+      nsIFrame* continuation;
+      rv = CreateContinuationForFloatingParent(aPresContext, kid,
+                                               &continuation, PR_TRUE);
     }
   }
 
@@ -311,6 +337,53 @@
   return PR_TRUE;
 }
 
+nsresult
+nsFirstLetterFrame::CreateContinuationForFloatingParent(nsPresContext* aPresContext,
+                                                        nsIFrame* aChild,
+                                                        nsIFrame** aContinuation,
+                                                        PRBool aIsFluid)
+{
+  NS_ASSERTION(GetStyleDisplay()->IsFloating(),
+               "can only call this on floating first letter frames");
+  NS_PRECONDITION(aContinuation, "bad args");
+
+  *aContinuation = nsnull;
+  nsresult rv = NS_OK;
+
+  nsIPresShell* presShell = aPresContext->PresShell();
+  nsPlaceholderFrame* placeholderFrame =
+    presShell->FrameManager()->GetPlaceholderFrameFor(this);
+  nsIFrame* parent = placeholderFrame->GetParent();
+
+  nsIFrame* continuation;
+  rv = presShell->FrameConstructor()->
+    CreateContinuingFrame(aPresContext, aChild, parent, &continuation, aIsFluid);
+  if (NS_FAILED(rv) || !continuation) {
+    return rv;
+  }
+
+  // The continuation will have gotten the first letter style from it's
+  // prev continuation, so we need to repair the style context so it
+  // doesn't have the first letter styling.
+  nsStyleContext* parentSC = this->GetStyleContext()->GetParent();
+  if (parentSC) {
+    nsRefPtr<nsStyleContext> newSC;
+    newSC = presShell->StyleSet()->ResolveStyleForNonElement(parentSC);
+    if (newSC) {
+      continuation->SetStyleContext(newSC);
+    }
+  }
+
+  //XXX Bidi may not be involved but we have to use the list name
+  // nsGkAtoms::nextBidi because this is just like creating a continuation
+  // except we have to insert it in a different place and we don't want a
+  // reflow command to try to be issued.
+  rv = parent->InsertFrames(nsGkAtoms::nextBidi, placeholderFrame, continuation);
+
+  *aContinuation = continuation;
+  return rv;
+}
+
 void
 nsFirstLetterFrame::DrainOverflowFrames(nsPresContext* aPresContext)
 {
--- xulrunner-1.9.0.19.orig/layout/generic/nsTextFrameThebes.cpp
+++ xulrunner-1.9.0.19/layout/generic/nsTextFrameThebes.cpp
@@ -29,7 +29,7 @@
  *   Daniel Glazman <glazman@netscape.com>
  *   Neil Deakin <neil@mozdevgroup.com>
  *   Masayuki Nakano <masayuki@d-toybox.com>
- *   Mats Palmgren <mats.palmgren@bredband.net>
+ *   Mats Palmgren <matspal@gmail.com>
  *   Uri Bernstein <uriber@gmail.com>
  *   Stephen Blackheath <entangled.mooched.stephen@blacksapphire.com>
  *
@@ -308,44 +308,101 @@
   }
 }
 
-// Remove the textrun from the frame continuation chain starting at aFrame,
-// which should be marked as a textrun owner.
-static void
-ClearAllTextRunReferences(nsTextFrame* aFrame, gfxTextRun* aTextRun)
+/**
+ * Remove |aTextRun| from the frame continuation chain starting at
+ * |aStartContinuation| if non-null, otherwise starting at |aFrame|.
+ * Unmark |aFrame| as a text run owner if it's the frame we start at.
+ * Return PR_TRUE if |aStartContinuation| is non-null and was found
+ * in the next-continuation chain of |aFrame|.
+ */
+static PRBool
+ClearAllTextRunReferences(nsTextFrame* aFrame, gfxTextRun* aTextRun,
+                          nsTextFrame* aStartContinuation)
 {
-  aFrame->RemoveStateBits(TEXT_IN_TEXTRUN_USER_DATA);
+  NS_PRECONDITION(aFrame, "");
+  NS_PRECONDITION(!aStartContinuation ||
+                  !aStartContinuation->GetTextRun() ||
+                  aStartContinuation->GetTextRun() == aTextRun,
+                  "wrong aStartContinuation for this text run");
+
+  if (!aStartContinuation || aStartContinuation == aFrame) {
+    aFrame->RemoveStateBits(TEXT_IN_TEXTRUN_USER_DATA);
+  } else {
+    do {
+      NS_ASSERTION(aFrame->GetType() == nsGkAtoms::textFrame, "Bad frame");
+      aFrame = static_cast<nsTextFrame*>(aFrame->GetNextContinuation());
+    } while (aFrame && aFrame != aStartContinuation);
+  }
+  PRBool found = aStartContinuation == aFrame;
   while (aFrame) {
-    NS_ASSERTION(aFrame->GetType() == nsGkAtoms::textFrame,
-                 "Bad frame");
+    NS_ASSERTION(aFrame->GetType() == nsGkAtoms::textFrame, "Bad frame");
     if (aFrame->GetTextRun() != aTextRun)
       break;
     aFrame->SetTextRun(nsnull);
     aFrame = static_cast<nsTextFrame*>(aFrame->GetNextContinuation());
   }
+  NS_POSTCONDITION(!found || aStartContinuation, "how did we find null?");
+  return found;
 }
 
-// Figure out which frames 
+/**
+ * Kill all references to |aTextRun| starting at |aStartContinuation|.
+ * It could be referenced by any of its owners, and all their in-flows.
+ * If |aStartContinuation| is null then process all userdata frames
+ * and their continuations.
+ * @note the caller is expected to take care of possibly destroying the
+ * text run if all userdata frames were reset (userdata is deallocated
+ * by this function though). The caller can detect this has occured by
+ * checking |aTextRun->GetUserData() == nsnull|.
+ */
 static void
-UnhookTextRunFromFrames(gfxTextRun* aTextRun)
+UnhookTextRunFromFrames(gfxTextRun* aTextRun, nsTextFrame* aStartContinuation)
 {
   if (!aTextRun->GetUserData())
     return;
 
-  // Kill all references to the textrun. It could be referenced by any of its
-  // owners, and all their in-flows.
   if (aTextRun->GetFlags() & nsTextFrameUtils::TEXT_IS_SIMPLE_FLOW) {
-    nsIFrame* firstInFlow = static_cast<nsIFrame*>(aTextRun->GetUserData());
-    ClearAllTextRunReferences(static_cast<nsTextFrame*>(firstInFlow), aTextRun);
+    nsIFrame* userDataFrame = static_cast<nsIFrame*>(aTextRun->GetUserData());
+    PRBool found =
+      ClearAllTextRunReferences(static_cast<nsTextFrame*>(userDataFrame),
+                                aTextRun, aStartContinuation);
+    NS_ASSERTION(!aStartContinuation || found,
+                 "aStartContinuation wasn't found in simple flow text run");
+    if (!(userDataFrame->GetStateBits() & TEXT_IN_TEXTRUN_USER_DATA)) {
+      aTextRun->SetUserData(nsnull);
+    }
   } else {
     TextRunUserData* userData =
       static_cast<TextRunUserData*>(aTextRun->GetUserData());
-    PRInt32 i;
-    for (i = 0; i < userData->mMappedFlowCount; ++i) {
-      ClearAllTextRunReferences(userData->mMappedFlows[i].mStartFrame, aTextRun);
+    PRInt32 destroyFromIndex = aStartContinuation ? -1 : 0;
+    for (PRInt32 i = 0; i < userData->mMappedFlowCount; ++i) {
+      nsTextFrame* userDataFrame = userData->mMappedFlows[i].mStartFrame;
+      PRBool found =
+        ClearAllTextRunReferences(userDataFrame, aTextRun,
+                                  aStartContinuation);
+      if (found) {
+        if (userDataFrame->GetStateBits() & TEXT_IN_TEXTRUN_USER_DATA) {
+          destroyFromIndex = i + 1;
+        }
+        else {
+          destroyFromIndex = i;
+        }
+        aStartContinuation = nsnull;
+      }
+    }
+    NS_ASSERTION(destroyFromIndex >= 0,
+                 "aStartContinuation wasn't found in multi flow text run");
+    if (destroyFromIndex == 0) {
+      DestroyUserData(userData);
+      aTextRun->SetUserData(nsnull);
+    }
+    else {
+      userData->mMappedFlowCount = destroyFromIndex;
+      if (userData->mLastFlowIndex >= destroyFromIndex) {
+        userData->mLastFlowIndex = destroyFromIndex - 1;
+      }
     }
-    DestroyUserData(userData);
   }
-  aTextRun->SetUserData(nsnull);  
 }
 
 class FrameTextRunCache;
@@ -375,7 +432,7 @@
 
   // This gets called when the timeout has expired on a gfxTextRun
   virtual void NotifyExpired(gfxTextRun* aTextRun) {
-    UnhookTextRunFromFrames(aTextRun);
+    UnhookTextRunFromFrames(aTextRun, nsnull);
     RemoveFromCache(aTextRun);
     delete aTextRun;
   }
@@ -711,6 +768,7 @@
   // on the line, or null if there was no previous leaf frame.
   nsIFrame*                     mCommonAncestorWithLastFrame;
   // mMaxTextLength is an upper bound on the size of the text in all mapped frames
+  // The value PR_UINT32_MAX represents overflow; text will be discarded
   PRUint32                      mMaxTextLength;
   PRPackedBool                  mDoubleByteText;
   PRPackedBool                  mBidiEnabled;
@@ -1120,8 +1178,11 @@
       (textRun->GetFlags() & nsTextFrameUtils::TEXT_TRAILING_WHITESPACE) != 0;
   } else {
     nsAutoTArray<PRUint8,BIG_TEXT_NODE_SIZE> buffer;
-    if (!buffer.AppendElements(mMaxTextLength*(mDoubleByteText ? 2 : 1)))
+    PRUint32 bufferSize = mMaxTextLength*(mDoubleByteText ? 2 : 1);
+    if (bufferSize < mMaxTextLength || bufferSize == PR_UINT32_MAX ||
+        !buffer.AppendElements(bufferSize)) {
       return;
+    }
     textRun = BuildTextRunForFrames(buffer.Elements());
   }
 
@@ -1150,8 +1211,14 @@
 
 void BuildTextRunsScanner::AccumulateRunInfo(nsTextFrame* aFrame)
 {
-  NS_ASSERTION(mMaxTextLength <= mMaxTextLength + aFrame->GetContentLength(), "integer overflow");
-  mMaxTextLength += aFrame->GetContentLength();
+  if (mMaxTextLength != PR_UINT32_MAX) {
+    NS_ASSERTION(mMaxTextLength < PR_UINT32_MAX - aFrame->GetContentLength(), "integer overflow");
+    if (mMaxTextLength >= PR_UINT32_MAX - aFrame->GetContentLength()) {
+      mMaxTextLength = PR_UINT32_MAX;
+    } else {
+      mMaxTextLength += aFrame->GetContentLength();
+    }
+  }
   mDoubleByteText |= aFrame->GetContent()->GetText()->Is2b();
   mLastFrame = aFrame;
   mCommonAncestorWithLastFrame = aFrame->GetParent();
@@ -1807,6 +1874,50 @@
   }
 }
 
+// Find the flow corresponding to aContent in aUserData
+static inline TextRunMappedFlow*
+FindFlowForContent(TextRunUserData* aUserData, nsIContent* aContent)
+{
+  // Find the flow that contains us
+  PRInt32 i = aUserData->mLastFlowIndex;
+  PRInt32 delta = 1;
+  PRInt32 sign = 1;
+  // Search starting at the current position and examine close-by
+  // positions first, moving further and further away as we go.
+  while (i >= 0 && i < aUserData->mMappedFlowCount) {
+    TextRunMappedFlow* flow = &aUserData->mMappedFlows[i];
+    if (flow->mStartFrame->GetContent() == aContent) {
+      return flow;
+    }
+
+    i += delta;
+    delta = -delta - sign;
+    sign = -sign;
+  }
+
+  // We ran into an array edge.  Add |delta| to |i| once more to get
+  // back to the side where we still need to search, then step in
+  // the |sign| direction.
+  i += delta;
+  if (sign > 0) {
+    for (; i < aUserData->mMappedFlowCount; ++i) {
+      TextRunMappedFlow* flow = &aUserData->mMappedFlows[i];
+      if (flow->mStartFrame->GetContent() == aContent) {
+        return flow;
+      }
+    }
+  } else {
+    for (; i >= 0; --i) {
+      TextRunMappedFlow* flow = &aUserData->mMappedFlows[i];
+      if (flow->mStartFrame->GetContent() == aContent) {
+        return flow;
+      }
+    }
+  }
+
+  return nsnull;
+}
+
 void
 BuildTextRunsScanner::AssignTextRun(gfxTextRun* aTextRun)
 {
@@ -1838,7 +1949,50 @@
         }
       }
 #endif
-      f->ClearTextRun();
+
+      gfxTextRun* oldTextRun = f->GetTextRun();
+      if (oldTextRun) {
+        nsTextFrame* firstFrame = nsnull;
+        PRUint32 startOffset = 0;
+        if (oldTextRun->GetFlags() & nsTextFrameUtils::TEXT_IS_SIMPLE_FLOW) {
+          firstFrame = static_cast<nsTextFrame*>(oldTextRun->GetUserData());
+        }
+        else {
+          TextRunUserData* userData = static_cast<TextRunUserData*>(oldTextRun->GetUserData());
+          firstFrame = userData->mMappedFlows[0].mStartFrame;
+          if (NS_UNLIKELY(f != firstFrame)) {
+            TextRunMappedFlow* flow = FindFlowForContent(userData, f->GetContent());
+            if (flow) {
+              startOffset = flow->mDOMOffsetToBeforeTransformOffset;
+            }
+            else {
+              NS_ERROR("Can't find flow containing frame 'f'");
+            }
+          }
+        }
+
+        // Optimization: if |f| is the first frame in the flow then there are no
+        // prev-continuations that use |oldTextRun|.
+        nsTextFrame* clearFrom = nsnull;
+        if (NS_UNLIKELY(f != firstFrame)) {
+          // If all the frames in the mapped flow starting at |f| (inclusive)
+          // are empty then we let the prev-continuations keep the old text run.
+          gfxSkipCharsIterator iter(oldTextRun->GetSkipChars(), startOffset, f->GetContentOffset());
+          PRUint32 textRunOffset = iter.ConvertOriginalToSkipped(f->GetContentOffset());
+          clearFrom = textRunOffset == oldTextRun->GetLength() ? f : nsnull;
+        }
+        f->ClearTextRun(clearFrom);
+
+#ifdef DEBUG
+        if (firstFrame && !firstFrame->GetTextRun()) {
+          // oldTextRun was destroyed - assert that we don't reference it.
+          for (PRUint32 i = 0; i < mBreakSinks.Length(); ++i) {
+            NS_ASSERTION(oldTextRun != mBreakSinks[i]->mTextRun,
+                         "destroyed text run is still in use");
+          }
+        }
+#endif
+      }
       f->SetTextRun(aTextRun);
     }
     // Set this bit now; we can't set it any earlier because
@@ -3188,7 +3342,7 @@
 void
 nsTextFrame::Destroy()
 {
-  ClearTextRun();
+  ClearTextRun(nsnull);
   if (mNextContinuation) {
     mNextContinuation->SetPrevInFlow(nsnull);
   }
@@ -3274,7 +3428,7 @@
   if (prev->GetStyleContext() != GetStyleContext()) {
     // We're taking part of prev's text, and its style may be different
     // so clear its textrun which may no longer be valid (and don't set ours)
-    prev->ClearTextRun();
+    prev->ClearTextRun(nsnull);
   } else {
     mTextRun = prev->GetTextRun();
   }
@@ -3330,7 +3484,7 @@
   if ((GetStateBits() & TEXT_IN_TEXTRUN_USER_DATA) ||
       !mPrevContinuation ||
       mPrevContinuation->GetStyleContext() != GetStyleContext()) {
-    ClearTextRun();
+    ClearTextRun(nsnull);
   }
   nsSplittableFrame::RemoveFromFlow(this);
   // Let the base class destroy the frame
@@ -3506,15 +3660,15 @@
 }
 
 void
-nsTextFrame::ClearTextRun()
+nsTextFrame::ClearTextRun(nsTextFrame* aStartContinuation)
 {
-  // save textrun because ClearAllTextRunReferences will clear ours
+  // save textrun because ClearAllTextRunReferences may clear ours
   gfxTextRun* textRun = mTextRun;
   
   if (!textRun)
     return;
 
-  UnhookTextRunFromFrames(textRun);
+  UnhookTextRunFromFrames(textRun, aStartContinuation);
   // see comments in BuildTextRunForFrames...
 //  if (textRun->GetFlags() & gfxFontGroup::TEXT_IS_PERSISTENT) {
 //    NS_ERROR("Shouldn't reach here for now...");
@@ -3527,7 +3681,8 @@
 //    return;
 //  }
 
-  if (!(textRun->GetFlags() & gfxTextRunWordCache::TEXT_IN_CACHE)) {
+  if (!(textRun->GetFlags() & gfxTextRunWordCache::TEXT_IN_CACHE) &&
+      !textRun->GetUserData()) {
     // Remove it now because it's not doing anything useful
     gTextRuns->RemoveFromCache(textRun);
     delete textRun;
@@ -3539,7 +3694,7 @@
 {
   nsTextFrame* f;
   for (f = aFrame; f; f = static_cast<nsTextFrame*>(f->GetNextInFlow())) {
-    f->ClearTextRun();
+    f->ClearTextRun(nsnull);
   }
 }
 
@@ -3589,7 +3744,7 @@
 NS_IMETHODIMP
 nsTextFrame::DidSetStyleContext()
 {
-  ClearTextRun();
+  ClearTextRun(nsnull);
   return NS_OK;
 } 
 
@@ -5068,7 +5223,7 @@
 /* virtual */ 
 void nsTextFrame::MarkIntrinsicWidthsDirty()
 {
-  ClearTextRun();
+  ClearTextRun(nsnull);
   nsFrame::MarkIntrinsicWidthsDirty();
 }
 
@@ -5387,8 +5542,8 @@
     // Our frame is shrinking. Give the text to our next in flow.
     f->mContentOffset = end;
     if (f->GetTextRun() != mTextRun) {
-      ClearTextRun();
-      f->ClearTextRun();
+      ClearTextRun(nsnull);
+      f->ClearTextRun(nsnull);
     }
     return;
   }
@@ -5396,8 +5551,8 @@
     // Our frame is growing. Take text from our in-flow.
     f->mContentOffset = end;
     if (f->GetTextRun() != mTextRun) {
-      ClearTextRun();
-      f->ClearTextRun();
+      ClearTextRun(nsnull);
+      f->ClearTextRun(nsnull);
     }
     f = static_cast<nsTextFrame*>(f->GetNextInFlow());
   }
@@ -5525,7 +5680,7 @@
       // floating first-letter boundaries are significant in textrun
       // construction, so clear the textrun out every time we hit a first-letter
       // and have changed our length (which controls the first-letter boundary)
-      ClearTextRun();
+      ClearTextRun(nsnull);
       // Find the length of the first-letter. We need a textrun for this.
       gfxSkipCharsIterator iter =
         EnsureTextRun(ctx, lineContainer, lineLayout.GetLine(), &flowEndInTextRun);
@@ -5551,7 +5706,7 @@
         // right first-letter boundary
         SetLength(offset + length - GetContentOffset());
         // Ensure that the textrun will be rebuilt
-        ClearTextRun();
+        ClearTextRun(nsnull);
       }
     } 
   }
@@ -5567,7 +5722,7 @@
     // when the textrun was ended in the middle of a text node because a
     // preformatted newline was encountered, and prev-in-flow frames have
     // consumed all the text of the textrun. We need a new textrun.
-    ClearTextRun();
+    ClearTextRun(nsnull);
     iter = EnsureTextRun(ctx, lineContainer,
                          lineLayout.GetLine(), &flowEndInTextRun);
   }
@@ -6180,12 +6335,10 @@
   // Output the tag
   IndentBy(out, aIndent);
   ListTag(out);
-#ifdef DEBUG_waterson
-  fprintf(out, " [parent=%p]", mParent);
-#endif
   if (HasView()) {
     fprintf(out, " [view=%p]", static_cast<void*>(GetView()));
   }
+  fprintf(out, " [run=%p]", static_cast<void*>(mTextRun));
 
   PRInt32 totalContentLength;
   nsCAutoString tmp;
@@ -6312,7 +6465,7 @@
    * This is called during bidi resolution from the block container, so we
    * shouldn't be holding a local reference to a textrun anywhere.
    */
-  ClearTextRun();
+  ClearTextRun(nsnull);
 
   nsTextFrame* prev = static_cast<nsTextFrame*>(GetPrevContinuation());
   if (prev) {
@@ -6321,7 +6474,7 @@
     PRInt32 prevOffset = prev->GetContentOffset();
     aStart = PR_MAX(aStart, prevOffset);
     aEnd = PR_MAX(aEnd, prevOffset);
-    prev->ClearTextRun();
+    prev->ClearTextRun(nsnull);
   }
 
   mContentOffset = aStart;
--- xulrunner-1.9.0.19.orig/layout/generic/nsFrame.h
+++ xulrunner-1.9.0.19/layout/generic/nsFrame.h
@@ -387,13 +387,14 @@
    */
   void CheckInvalidateSizeChange(nsHTMLReflowMetrics&     aNewDesiredSize);
 
-  // Helper function that tests if the frame tree is too deep; if it
-  // is it marks the frame as "unflowable" and zeros out the metrics
-  // and returns PR_TRUE. Otherwise, the frame is unmarked
-  // "unflowable" and the metrics are not touched and PR_FALSE is
-  // returned.
+  // Helper function that tests if the frame tree is too deep; if it is
+  // it marks the frame as "unflowable", zeroes out the metrics, sets
+  // the reflow status, and returns PR_TRUE. Otherwise, the frame is
+  // unmarked "unflowable" and the metrics and reflow status are not
+  // touched and PR_FALSE is returned.
   PRBool IsFrameTreeTooDeep(const nsHTMLReflowState& aReflowState,
-                            nsHTMLReflowMetrics& aMetrics);
+                            nsHTMLReflowMetrics& aMetrics,
+                            nsReflowStatus& aStatus);
 
   // Do the work for getting the parent style context frame so that
   // other frame's |GetParentStyleContextFrame| methods can call this
--- xulrunner-1.9.0.19.orig/layout/generic/nsSelection.cpp
+++ xulrunner-1.9.0.19/layout/generic/nsSelection.cpp
@@ -5931,6 +5931,9 @@
     return NS_ERROR_INVALID_ARG;
   if (!mFrameSelection)
     return NS_ERROR_NOT_INITIALIZED; // Can't do selection
+
+  nsCOMPtr<nsIDOMNode> kungfuDeathGrip = aParentNode;
+
   mFrameSelection->InvalidateDesiredX();
   if (!IsValidSelectionPoint(mFrameSelection, aParentNode))
     return NS_ERROR_FAILURE;
--- xulrunner-1.9.0.19.orig/layout/generic/nsFrame.cpp
+++ xulrunner-1.9.0.19/layout/generic/nsFrame.cpp
@@ -504,10 +504,6 @@
     shell->ClearFrameRefs(this);
   }
 
-  //XXX Why is this done in nsFrame instead of some frame class
-  // that actually loads images?
-  presContext->StopImagesFor(this);
-
   if (view) {
     // Break association between view and frame
     view->SetClientData(nsnull);
@@ -3806,9 +3802,11 @@
 
 PRBool
 nsFrame::IsFrameTreeTooDeep(const nsHTMLReflowState& aReflowState,
-                            nsHTMLReflowMetrics& aMetrics)
+                            nsHTMLReflowMetrics& aMetrics,
+                            nsReflowStatus& aStatus)
 {
   if (aReflowState.mReflowDepth >  MAX_FRAME_DEPTH) {
+    NS_WARNING("frame tree too deep; setting zero size and returning");
     mState |= NS_FRAME_TOO_DEEP_IN_FRAME_TREE;
     mState &= ~NS_FRAME_OUTSIDE_CHILDREN;
     aMetrics.width = 0;
@@ -3819,6 +3817,16 @@
     aMetrics.mOverflowArea.y = 0;
     aMetrics.mOverflowArea.width = 0;
     aMetrics.mOverflowArea.height = 0;
+
+    if (GetNextInFlow()) {
+      // Reflow depth might vary between reflows, so we might have
+      // successfully reflowed and split this frame before.  If so, we
+      // shouldn't delete its continuations.
+      aStatus = NS_FRAME_NOT_COMPLETE;
+    } else {
+      aStatus = NS_FRAME_COMPLETE;
+    }
+
     return PR_TRUE;
   }
   mState &= ~NS_FRAME_TOO_DEEP_IN_FRAME_TREE;
--- xulrunner-1.9.0.19.orig/layout/generic/nsColumnSetFrame.cpp
+++ xulrunner-1.9.0.19/layout/generic/nsColumnSetFrame.cpp
@@ -932,7 +932,7 @@
 
   NS_FRAME_SET_TRUNCATION(aStatus, aReflowState, aDesiredSize);
 
-  NS_ASSERTION(NS_FRAME_IS_COMPLETE(aStatus) ||
+  NS_ASSERTION(NS_FRAME_IS_FULLY_COMPLETE(aStatus) ||
                aReflowState.availableHeight != NS_UNCONSTRAINEDSIZE,
                "Column set should be complete if the available height is unconstrained");
 
--- xulrunner-1.9.0.19.orig/layout/generic/nsObjectFrame.cpp
+++ xulrunner-1.9.0.19/layout/generic/nsObjectFrame.cpp
@@ -2999,11 +2999,12 @@
   // Nav 4.x would simply replace the "data" with "src". Because some plugins correctly
   // look for "data", lets instead copy the "data" attribute and add another entry
   // to the bottom of the array if there isn't already a "src" specified.
-  PRInt16 numRealAttrs = mNumCachedAttrs;
+  PRUint16 numRealAttrs = mNumCachedAttrs;
   nsAutoString data;
-  if (mContent->Tag() == nsGkAtoms::object
-    && !mContent->HasAttr(kNameSpaceID_None, nsGkAtoms::src)
-    && mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::data, data)) {
+  if (mContent->Tag() == nsGkAtoms::object &&
+      !mContent->HasAttr(kNameSpaceID_None, nsGkAtoms::src) &&
+      mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::data, data) &&
+      !data.IsEmpty()) {
       mNumCachedAttrs++;
   }
 
@@ -3014,7 +3015,7 @@
   NS_ENSURE_TRUE(mCachedAttrParamValues, NS_ERROR_OUT_OF_MEMORY);
 
   // let's fill in our attributes
-  PRInt16 c = 0;
+  PRUint32 nextAttrParamIndex = 0;
 
   // Some plugins (eg Flash, see bug 234675.) are actually sensitive to the
   // attribute order.  So we want to make sure we give the plugin the
@@ -3022,7 +3023,7 @@
   // other browsers.  Now in HTML, the storage order is the reverse of the
   // source order, while in XML and XHTML it's the same as the source order
   // (see the AddAttributes functions in the HTML and XML content sinks).
-  PRInt16 start, end, increment;
+  PRInt32 start, end, increment;
   if (mContent->IsNodeOfType(nsINode::eHTML) &&
       mContent->NodeInfo()->NamespaceEquals(kNameSpaceID_None)) {
     // HTML.  Walk attributes in reverse order.
@@ -3035,7 +3036,7 @@
     end = numRealAttrs;
     increment = 1;
   }
-  for (PRInt16 index = start; index != end; index += increment) {
+  for (PRInt32 index = start; index != end; index += increment) {
     const nsAttrName* attrName = mContent->GetAttrNameAt(index);
     nsIAtom* atom = attrName->LocalName();
     nsAutoString value;
@@ -3045,24 +3046,25 @@
 
     FixUpURLS(name, value);
 
-    mCachedAttrParamNames [c] = ToNewUTF8String(name);
-    mCachedAttrParamValues[c] = ToNewUTF8String(value);
-    c++;
+    mCachedAttrParamNames [nextAttrParamIndex] = ToNewUTF8String(name);
+    mCachedAttrParamValues[nextAttrParamIndex] = ToNewUTF8String(value);
+    nextAttrParamIndex++;
   }
 
   // if the conditions above were met, copy the "data" attribute to a "src" array entry
-  if (data.Length()) {
-    mCachedAttrParamNames [mNumCachedAttrs-1] = ToNewUTF8String(NS_LITERAL_STRING("SRC"));
-    mCachedAttrParamValues[mNumCachedAttrs-1] = ToNewUTF8String(data);
+  if (!data.IsEmpty()) {
+    mCachedAttrParamNames [nextAttrParamIndex] = ToNewUTF8String(NS_LITERAL_STRING("SRC"));
+    mCachedAttrParamValues[nextAttrParamIndex] = ToNewUTF8String(data);
+    nextAttrParamIndex++;
   }
 
   // add our PARAM and null separator
-  mCachedAttrParamNames [mNumCachedAttrs] = ToNewUTF8String(NS_LITERAL_STRING("PARAM"));
-  mCachedAttrParamValues[mNumCachedAttrs] = nsnull;
+  mCachedAttrParamNames [nextAttrParamIndex] = ToNewUTF8String(NS_LITERAL_STRING("PARAM"));
+  mCachedAttrParamValues[nextAttrParamIndex] = nsnull;
+  nextAttrParamIndex++;
 
   // now fill in the PARAM name/value pairs from the cached DOM nodes
-  c = 0;
-  for (PRInt16 idx = 0; idx < mNumCachedParams; idx++) {
+  for (PRUint16 idx = 0; idx < mNumCachedParams; idx++) {
     nsIDOMElement* param = ourParams.ObjectAt(idx);
     if (param) {
      nsAutoString name;
@@ -3084,9 +3086,9 @@
       */            
      name.Trim(" \n\r\t\b", PR_TRUE, PR_TRUE, PR_FALSE);
      value.Trim(" \n\r\t\b", PR_TRUE, PR_TRUE, PR_FALSE);
-     mCachedAttrParamNames [mNumCachedAttrs + 1 + c] = ToNewUTF8String(name);
-     mCachedAttrParamValues[mNumCachedAttrs + 1 + c] = ToNewUTF8String(value);
-     c++;                                                      // rules!
+     mCachedAttrParamNames [nextAttrParamIndex] = ToNewUTF8String(name);
+     mCachedAttrParamValues[nextAttrParamIndex] = ToNewUTF8String(value);
+     nextAttrParamIndex++;
     }
   }
 
--- xulrunner-1.9.0.19.orig/layout/generic/nsContainerFrame.cpp
+++ xulrunner-1.9.0.19/layout/generic/nsContainerFrame.cpp
@@ -938,6 +938,8 @@
     return NS_OK; // nothing to reflow
 
   nsOverflowContinuationTracker tracker(aPresContext, this, PR_FALSE, PR_FALSE);
+  PRBool shouldReflowAllKids = aReflowState.ShouldReflowAllKids();
+
   for (nsIFrame* frame = overflowContainers->FirstChild(); frame;
        frame = frame->GetNextSibling()) {
     if (frame->GetPrevInFlow()->GetParent() != GetPrevInFlow()) {
@@ -945,7 +947,9 @@
       // it will get reflowed once it's been placed
       continue;
     }
-    if (NS_SUBTREE_DIRTY(frame)) {
+    // If the available vertical height has changed, we need to reflow
+    // even if the frame isn't dirty.
+    if (shouldReflowAllKids || NS_SUBTREE_DIRTY(frame)) {
       // Get prev-in-flow
       nsIFrame* prevInFlow = frame->GetPrevInFlow();
       NS_ASSERTION(prevInFlow,
@@ -1240,6 +1244,10 @@
                                      nsIAtom*        aPropID) const
 {
   NS_PRECONDITION(aPresContext && aPropID && aFrameList, "null ptr");
+  NS_PRECONDITION((aPropID != nsGkAtoms::overflowContainersProperty &&
+                   aPropID != nsGkAtoms::excessOverflowContainersProperty) ||
+                  IsFrameOfType(nsIFrame::eCanContainOverflowContainers),
+                  "this type of frame can't have overflow containers");
   nsresult rv = aPresContext->PropertyTable()->SetProperty(this, aPropID,
                   aFrameList, DestroyFrameList, nsnull);
   NS_ASSERTION(rv != NS_PROPTABLE_PROP_OVERWRITTEN, "existing framelist");
--- xulrunner-1.9.0.19.orig/layout/generic/nsFrameSetFrame.cpp
+++ xulrunner-1.9.0.19/layout/generic/nsFrameSetFrame.cpp
@@ -352,13 +352,19 @@
   NS_ENSURE_SUCCESS(result, result);
   result = ourContent->GetColSpec(&mNumCols, &colSpecs);
   NS_ENSURE_SUCCESS(result, result);
+
+  // Maximum value of mNumRows and mNumCols is NS_MAX_FRAMESET_SPEC_COUNT
+  PR_STATIC_ASSERT(NS_MAX_FRAMESET_SPEC_COUNT < UINT_MAX / sizeof(nscoord));
   mRowSizes  = new nscoord[mNumRows];
   mColSizes  = new nscoord[mNumCols];
   if (!mRowSizes || !mColSizes)
     return NS_ERROR_OUT_OF_MEMORY; 
 
+  // Ensure we can't overflow numCells
+  PR_STATIC_ASSERT(NS_MAX_FRAMESET_SPEC_COUNT < PR_INT32_MAX / NS_MAX_FRAMESET_SPEC_COUNT);
   PRInt32 numCells = mNumRows*mNumCols;
 
+  PR_STATIC_ASSERT(NS_MAX_FRAMESET_SPEC_COUNT < UINT_MAX / sizeof(nsHTMLFramesetBorderFrame*));
   mVerBorders    = new nsHTMLFramesetBorderFrame*[mNumCols];  // 1 more than number of ver borders
   if (!mVerBorders)
     return NS_ERROR_OUT_OF_MEMORY;
@@ -372,9 +378,15 @@
 
   for (int horX = 0; horX < mNumRows; horX++)
     mHorBorders[horX]    = nsnull;
-     
+ 
+  PR_STATIC_ASSERT(NS_MAX_FRAMESET_SPEC_COUNT
+                   < UINT_MAX / sizeof(PRInt32) / NS_MAX_FRAMESET_SPEC_COUNT); 
+  PR_STATIC_ASSERT(NS_MAX_FRAMESET_SPEC_COUNT
+                   < UINT_MAX / sizeof(nsFrameborder) / NS_MAX_FRAMESET_SPEC_COUNT); 
+  PR_STATIC_ASSERT(NS_MAX_FRAMESET_SPEC_COUNT
+                   < UINT_MAX / sizeof(nsBorderColor) / NS_MAX_FRAMESET_SPEC_COUNT); 
   mChildTypes = new PRInt32[numCells]; 
-  mChildFrameborder  = new nsFrameborder[numCells]; 
+  mChildFrameborder  = new nsFrameborder[numCells];
   mChildBorderColors  = new nsBorderColor[numCells]; 
   if (!mChildTypes || !mChildFrameborder || !mChildBorderColors)
     return NS_ERROR_OUT_OF_MEMORY;
@@ -547,6 +559,9 @@
                                           const nsFramesetSpec* aSpecs, 
                                           nscoord*              aValues)
 {
+  // aNumSpecs maximum value is NS_MAX_FRAMESET_SPEC_COUNT
+  PR_STATIC_ASSERT(NS_MAX_FRAMESET_SPEC_COUNT < UINT_MAX / sizeof(PRInt32));
+
   PRInt32  fixedTotal = 0;
   PRInt32  numFixed = 0;
   nsAutoArrayPtr<PRInt32> fixed(new PRInt32[aNumSpecs]);
@@ -1040,6 +1055,11 @@
   nsFrameborder           frameborder = GetFrameBorder();
 
   if (firstTime) {
+    // Check for overflow in memory allocations using mNumCols and mNumRows
+    // which have a maxium value of NS_MAX_FRAMESET_SPEC_COUNT.
+    PR_STATIC_ASSERT(NS_MAX_FRAMESET_SPEC_COUNT < UINT_MAX / sizeof(PRBool));
+    PR_STATIC_ASSERT(NS_MAX_FRAMESET_SPEC_COUNT < UINT_MAX / sizeof(nscolor));
+
     verBordersVis = new PRBool[mNumCols];
     NS_ENSURE_TRUE(verBordersVis, NS_ERROR_OUT_OF_MEMORY);
     verBorderColors = new nscolor[mNumCols];
@@ -1378,7 +1398,10 @@
     return;
   }
 
+  PR_STATIC_ASSERT(NS_MAX_FRAMESET_SPEC_COUNT < PR_INT32_MAX / NS_MAX_FRAMESET_SPEC_COUNT);
   PRInt32 numCells = mNumRows * mNumCols; // max number of cells
+  PR_STATIC_ASSERT(NS_MAX_FRAMESET_SPEC_COUNT
+                   < UINT_MAX / sizeof(PRInt32) / NS_MAX_FRAMESET_SPEC_COUNT); 
   nsAutoArrayPtr<PRInt32> childTypes(new PRInt32[numCells]);
   if (NS_UNLIKELY(!childTypes)) {
     return;
--- xulrunner-1.9.0.19.orig/layout/generic/nsTextFrame.h
+++ xulrunner-1.9.0.19/layout/generic/nsTextFrame.h
@@ -29,7 +29,7 @@
  *   Daniel Glazman <glazman@netscape.com>
  *   Neil Deakin <neil@mozdevgroup.com>
  *   Masayuki Nakano <masayuki@d-toybox.com>
- *   Mats Palmgren <mats.palmgren@bredband.net>
+ *   Mats Palmgren <matspal@gmail.com>
  *   Uri Bernstein <uriber@gmail.com>
  *   Stephen Blackheath <entangled.mooched.stephen@blacksapphire.com>
  *
@@ -315,9 +315,6 @@
   // boundary.
   PRInt32 GetInFlowContentLength();
 
-  // Clears out mTextRun from this frame and all other frames that hold a reference
-  // to it, then deletes the textrun.
-  void ClearTextRun();
   /**
    * Acquires the text run for this content, if necessary.
    * @param aRC the rendering context to use as a reference for creating
@@ -337,6 +334,12 @@
 
   gfxTextRun* GetTextRun() { return mTextRun; }
   void SetTextRun(gfxTextRun* aTextRun) { mTextRun = aTextRun; }
+  /**
+   * Clears out |mTextRun| from all frames that hold a reference to it,
+   * starting at |aStartContinuation|, or if it's nsnull, starting at |this|.
+   * Deletes |mTextRun| if all references were cleared and it's not cached.
+   */
+  void ClearTextRun(nsTextFrame* aStartContinuation);
 
   // Get the DOM content range mapped by this frame after excluding
   // whitespace subject to start-of-line and end-of-line trimming.
--- xulrunner-1.9.0.19.orig/layout/generic/nsImageFrame.cpp
+++ xulrunner-1.9.0.19/layout/generic/nsImageFrame.cpp
@@ -103,6 +103,7 @@
 #include "nsLayoutErrors.h"
 #include "nsBidiUtils.h"
 #include "nsBidiPresUtils.h"
+#include "nsIJSContextStack.h"
 
 #ifdef DEBUG
 #undef NOISY_IMAGE_LOADING
@@ -239,7 +240,20 @@
   if (mListener) {
     nsCOMPtr<nsIImageLoadingContent> imageLoader = do_QueryInterface(mContent);
     if (imageLoader) {
+      // Push a null JSContext on the stack so that code that runs
+      // within the below code doesn't think it's being called by
+      // JS. See bug 604262.
+      nsIThreadJSContextStack* stack = nsContentUtils::ThreadJSContextStack();
+      if (stack) {
+        stack->Push(nsnull);
+      }
+
       imageLoader->RemoveObserver(mListener);
+
+      if (stack) {
+        stack->Pop(nsnull);
+      }
+
     }
     
     reinterpret_cast<nsImageListener*>(mListener.get())->SetFrame(nsnull);
@@ -265,7 +279,22 @@
 
   nsCOMPtr<nsIImageLoadingContent> imageLoader = do_QueryInterface(aContent);
   NS_ENSURE_TRUE(imageLoader, NS_ERROR_UNEXPECTED);
-  imageLoader->AddObserver(mListener);
+
+  {
+    // Push a null JSContext on the stack so that code that runs
+    // within the below code doesn't think it's being called by
+    // JS. See bug 604262.
+    nsIThreadJSContextStack* stack = nsContentUtils::ThreadJSContextStack();
+    if (stack) {
+      stack->Push(nsnull);
+    }
+
+    imageLoader->AddObserver(mListener);
+
+    if (stack) {
+      stack->Pop(nsnull);
+    }
+  }
 
   nsPresContext *aPresContext = PresContext();
   
--- xulrunner-1.9.0.19.orig/layout/generic/nsPageContentFrame.h
+++ xulrunner-1.9.0.19/layout/generic/nsPageContentFrame.h
@@ -55,6 +55,11 @@
                      nsReflowStatus&      aStatus);
 
   virtual PRBool IsContainingBlock() const;
+  virtual PRBool IsFrameOfType(PRUint32 aFlags) const
+  {
+    return ViewportFrame::IsFrameOfType(aFlags &
+             ~(nsIFrame::eCanContainOverflowContainers));
+  }
 
   virtual void SetSharedPageData(nsSharedPageData* aPD) { mPD = aPD; }
 
--- xulrunner-1.9.0.19.orig/layout/generic/nsHTMLParts.h
+++ xulrunner-1.9.0.19/layout/generic/nsHTMLParts.h
@@ -263,6 +263,8 @@
 // in nsContentSink.h
 nsresult
 NS_NewHTMLParanoidFragmentSink(nsIFragmentContentSink** aInstancePtrResult);
+nsresult
+NS_NewHTMLParanoidFragmentSink2(nsIFragmentContentSink** aInstancePtrResult);
 void
 NS_HTMLParanoidFragmentSinkShutdown();
 #endif /* nsHTMLParts_h___ */
--- xulrunner-1.9.0.19.orig/layout/generic/nsInlineFrame.cpp
+++ xulrunner-1.9.0.19/layout/generic/nsInlineFrame.cpp
@@ -365,17 +365,7 @@
     }
   }
 
-  if (IsFrameTreeTooDeep(aReflowState, aMetrics)) {
-#ifdef DEBUG_kipp
-    {
-      extern char* nsPresShell_ReflowStackPointerTop;
-      char marker;
-      char* newsp = (char*) &marker;
-      printf("XXX: frame tree is too deep; approx stack size = %d\n",
-             nsPresShell_ReflowStackPointerTop - newsp);
-    }
-#endif
-    aStatus = NS_FRAME_COMPLETE;
+  if (IsFrameTreeTooDeep(aReflowState, aMetrics, aStatus)) {
     return NS_OK;
   }
 
--- xulrunner-1.9.0.19.orig/layout/generic/nsFirstLetterFrame.h
+++ xulrunner-1.9.0.19/layout/generic/nsFirstLetterFrame.h
@@ -42,12 +42,18 @@
 
 #include "nsHTMLContainerFrame.h"
 
+#define NS_FIRSTLETTER_FRAME_CID \
+ { 0x64e918c7, 0x786a, 0x4f5c,{0x93, 0xe0, 0x24, 0x59, 0x64, 0x31, 0xcf, 0x75}}
+
 #define nsFirstLetterFrameSuper nsHTMLContainerFrame
 
 class nsFirstLetterFrame : public nsFirstLetterFrameSuper {
 public:
   nsFirstLetterFrame(nsStyleContext* aContext) : nsHTMLContainerFrame(aContext) {}
 
+  // nsISupports overrides
+  NS_IMETHOD QueryInterface(const nsIID& aIID, void** aInstancePtr);
+
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
@@ -93,6 +99,15 @@
 
   nscoord GetFirstLetterBaseline() const { return mBaseline; }
 
+  // For floating first letter frames, create a continuation for aChild and
+  // place it in the correct place. aContinuation is an outparam for the
+  // continuation that is created. aIsFluid determines if the continuation is
+  // fluid or not.
+  nsresult CreateContinuationForFloatingParent(nsPresContext* aPresContext,
+                                               nsIFrame* aChild,
+                                               nsIFrame** aContinuation,
+                                               PRBool aIsFluid);
+
 protected:
   nscoord mBaseline;
 
--- xulrunner-1.9.0.19.orig/layout/generic/nsBlockFrame.cpp
+++ xulrunner-1.9.0.19/layout/generic/nsBlockFrame.cpp
@@ -908,17 +908,7 @@
   // and we may even delete the line with the line cursor.
   ClearLineCursor();
 
-  if (IsFrameTreeTooDeep(aReflowState, aMetrics)) {
-#ifdef DEBUG_kipp
-    {
-      extern char* nsPresShell_ReflowStackPointerTop;
-      char marker;
-      char* newsp = (char*) &marker;
-      printf("XXX: frame tree is too deep; approx stack size = %d\n",
-             nsPresShell_ReflowStackPointerTop - newsp);
-    }
-#endif
-    aStatus = NS_FRAME_COMPLETE;
+  if (IsFrameTreeTooDeep(aReflowState, aMetrics, aStatus)) {
     return NS_OK;
   }
 
--- xulrunner-1.9.0.19.orig/layout/xul/base/src/nsTextBoxFrame.cpp
+++ xulrunner-1.9.0.19/layout/xul/base/src/nsTextBoxFrame.cpp
@@ -819,7 +819,7 @@
     }
 
     if (InsertSeparatorBeforeAccessKey() &&
-        !NS_IS_SPACE(mTitle[offset - 1])) {
+        offset > 0 && !NS_IS_SPACE(mTitle[offset - 1])) {
         mTitle.Insert(' ', offset);
         offset++;
     }
--- xulrunner-1.9.0.19.orig/layout/xul/base/src/nsMenuFrame.h
+++ xulrunner-1.9.0.19/layout/xul/base/src/nsMenuFrame.h
@@ -228,6 +228,7 @@
 protected:
   friend class nsMenuTimerMediator;
   friend class nsASyncMenuInitialization;
+  friend class nsMenuAttributeChangedEvent;
 
   // initialize mPopupFrame to the first popup frame within aChildList. Returns
   // aChildList with the popup frame removed.
--- xulrunner-1.9.0.19.orig/layout/xul/base/src/nsMenuFrame.cpp
+++ xulrunner-1.9.0.19/layout/xul/base/src/nsMenuFrame.cpp
@@ -151,6 +151,37 @@
   PRBool mIsActivate;
 };
 
+class nsMenuAttributeChangedEvent : public nsRunnable
+{
+public:
+  nsMenuAttributeChangedEvent(nsIFrame* aFrame, nsIAtom* aAttr)
+  : mFrame(aFrame), mAttr(aAttr)
+  {
+  }
+
+  NS_IMETHOD Run()
+  {
+    nsMenuFrame* frame = static_cast<nsMenuFrame*>(mFrame.GetFrame());
+    NS_ENSURE_STATE(frame);
+    if (mAttr == nsGkAtoms::checked) {
+      frame->UpdateMenuSpecialState(frame->PresContext());
+    } else if (mAttr == nsGkAtoms::acceltext) {
+      // someone reset the accelText attribute,
+      // so clear the bit that says *we* set it
+      frame->AddStateBits(NS_STATE_ACCELTEXT_IS_DERIVED);
+      frame->BuildAcceleratorText();
+    } else if (mAttr == nsGkAtoms::key) {
+      frame->BuildAcceleratorText();
+    } else if (mAttr == nsGkAtoms::type || mAttr == nsGkAtoms::name) {
+      frame->UpdateMenuType(frame->PresContext());
+    }
+    return NS_OK;
+  }
+protected:
+  nsWeakFrame       mFrame;
+  nsCOMPtr<nsIAtom> mAttr;
+};
+
 //
 // NS_NewMenuFrame
 //
@@ -660,20 +691,16 @@
                               nsIAtom* aAttribute,
                               PRInt32 aModType)
 {
-  nsAutoString value;
-
-  if (aAttribute == nsGkAtoms::checked) {
-    if (mType != eMenuType_Normal)
-        UpdateMenuSpecialState(PresContext());
-  } else if (aAttribute == nsGkAtoms::acceltext) {
-    // someone reset the accelText attribute, so clear the bit that says *we* set it
-    AddStateBits(NS_STATE_ACCELTEXT_IS_DERIVED);
-    BuildAcceleratorText();
-  } else if (aAttribute == nsGkAtoms::key) {
-    BuildAcceleratorText();
-  } else if (aAttribute == nsGkAtoms::type || aAttribute == nsGkAtoms::name)
-    UpdateMenuType(PresContext());
 
+  if (aAttribute == nsGkAtoms::checked ||
+      aAttribute == nsGkAtoms::acceltext ||
+      aAttribute == nsGkAtoms::key ||
+      aAttribute == nsGkAtoms::type ||
+      aAttribute == nsGkAtoms::name) {
+    nsCOMPtr<nsIRunnable> event =
+      new nsMenuAttributeChangedEvent(this, aAttribute);
+    nsContentUtils::AddScriptRunner(event);
+  }
   return NS_OK;
 }
 
@@ -1214,8 +1241,6 @@
       PresContext()->PresShell()->
         FrameNeedsReflow(this, nsIPresShell::eTreeChange,
                          NS_FRAME_HAS_DIRTY_CHILDREN);
-
-      return NS_OK;
     }
   }
 
@@ -1247,8 +1272,6 @@
       PresContext()->PresShell()->
         FrameNeedsReflow(this, nsIPresShell::eTreeChange,
                          NS_FRAME_HAS_DIRTY_CHILDREN);
-
-      return NS_OK;
     }
   }
 
--- xulrunner-1.9.0.19.orig/layout/xul/base/src/tree/src/nsTreeBodyFrame.h
+++ xulrunner-1.9.0.19/layout/xul/base/src/tree/src/nsTreeBodyFrame.h
@@ -376,6 +376,8 @@
       InvalidateRow(aRow + aOrientation);
   }
 
+public:
+  static
   already_AddRefed<nsTreeColumn> GetColumnImpl(nsITreeColumn* aUnknownCol) {
     if (!aUnknownCol)
       return nsnull;
@@ -385,6 +387,8 @@
     return col;
   }
 
+protected:
+
   // Create a new timer. This method is used to delay various actions like
   // opening/closing folders or tree scrolling.
   // aID is type of the action, aFunc is the function to be called when
--- xulrunner-1.9.0.19.orig/layout/xul/base/src/tree/src/nsTreeContentView.h
+++ xulrunner-1.9.0.19/layout/xul/base/src/tree/src/nsTreeContentView.h
@@ -78,6 +78,8 @@
     NS_DECL_NSIMUTATIONOBSERVER_CONTENTREMOVED
     NS_DECL_NSIMUTATIONOBSERVER_NODEWILLBEDESTROYED
 
+    static PRBool CanTrustTreeSelection(nsISupports* aValue);
+
   protected:
     // Recursive methods which deal with serializing of nested content.
     void Serialize(nsIContent* aContent, PRInt32 aParentIndex, PRInt32* aIndex, nsVoidArray& aRows);
--- xulrunner-1.9.0.19.orig/layout/xul/base/src/tree/src/nsTreeSelection.cpp
+++ xulrunner-1.9.0.19/layout/xul/base/src/tree/src/nsTreeSelection.cpp
@@ -214,18 +214,40 @@
     return total;
   }
 
+  static void CollectRanges(nsTreeRange* aRange, nsTArray<PRInt32>& aRanges)
+  {
+    nsTreeRange* cur = aRange;
+    while (cur) {
+      aRanges.AppendElement(cur->mMin);
+      aRanges.AppendElement(cur->mMax);
+      cur = cur->mNext;
+    }
+  }
+  
+  static void InvalidateRanges(nsITreeBoxObject* aTree,
+                               nsTArray<PRInt32>& aRanges)
+  {
+    if (aTree) {
+      nsCOMPtr<nsITreeBoxObject> tree = aTree;
+      for (PRUint32 i = 0; i < aRanges.Length(); i += 2) {
+        aTree->InvalidateRange(aRanges[i], aRanges[i + 1]);
+      }
+    }
+  }
+
   void Invalidate() {
-    if (mSelection->mTree)
-      mSelection->mTree->InvalidateRange(mMin, mMax);
-    if (mNext)
-      mNext->Invalidate();
+    nsTArray<PRInt32> ranges;
+    CollectRanges(this, ranges);
+    InvalidateRanges(mSelection->mTree, ranges);
+    
   }
 
   void RemoveAllBut(PRInt32 aIndex) {
     if (aIndex >= mMin && aIndex <= mMax) {
 
       // Invalidate everything in this list.
-      mSelection->mFirstRange->Invalidate();
+      nsTArray<PRInt32> ranges;
+      CollectRanges(mSelection->mFirstRange, ranges);
 
       mMin = aIndex;
       mMax = aIndex;
@@ -241,6 +263,7 @@
         delete mSelection->mFirstRange;
         mSelection->mFirstRange = this;
       }
+      InvalidateRanges(mSelection->mTree, ranges);
     }
     else if (mNext)
       mNext->RemoveAllBut(aIndex);
@@ -275,6 +298,7 @@
 // QueryInterface implementation for nsBoxObject
 NS_INTERFACE_MAP_BEGIN(nsTreeSelection)
   NS_INTERFACE_MAP_ENTRY(nsITreeSelection)
+  NS_INTERFACE_MAP_ENTRY(nsINativeTreeSelection)
   NS_INTERFACE_MAP_ENTRY(nsISupports)
   NS_INTERFACE_MAP_ENTRY_DOM_CLASSINFO(TreeSelection)
 NS_INTERFACE_MAP_END
@@ -450,6 +474,7 @@
     if (mFirstRange) {
         mFirstRange->Invalidate();
         delete mFirstRange;
+        mFirstRange = nsnull;
     }
   }
 
@@ -700,7 +725,12 @@
 
 #define ADD_NEW_RANGE(macro_range, macro_selection, macro_start, macro_end) \
   { \
-    nsTreeRange* macro_new_range = new nsTreeRange(macro_selection, (macro_start), (macro_end)); \
+    PRInt32 start = macro_start; \
+    PRInt32 end = macro_end; \
+    if (start > end) { \
+      end = start; \
+    } \
+    nsTreeRange* macro_new_range = new nsTreeRange(macro_selection, start, end); \
     if (macro_range) \
       macro_range->Insert(macro_new_range); \
     else \
@@ -738,27 +768,27 @@
   // no selection, so nothing to do.
   if (!mFirstRange) return NS_OK;
 
-  nsTreeRange* newRange = nsnull;
-
   PRBool selChanged = PR_FALSE;
+  nsTreeRange* oldFirstRange = mFirstRange;
   nsTreeRange* curr = mFirstRange;
+  mFirstRange = nsnull;
   while (curr) {
     if (aCount > 0) {
       // inserting
       if (aIndex > curr->mMax) {
         // adjustment happens after the range, so no change
-        ADD_NEW_RANGE(newRange, this, curr->mMin, curr->mMax);
+        ADD_NEW_RANGE(mFirstRange, this, curr->mMin, curr->mMax);
       }
       else if (aIndex <= curr->mMin) {  
         // adjustment happens before the start of the range, so shift down
-        ADD_NEW_RANGE(newRange, this, curr->mMin + aCount, curr->mMax + aCount);
+        ADD_NEW_RANGE(mFirstRange, this, curr->mMin + aCount, curr->mMax + aCount);
         selChanged = PR_TRUE;
       }
       else {
         // adjustment happen inside the range.
         // break apart the range and create two ranges
-        ADD_NEW_RANGE(newRange, this, curr->mMin, aIndex - 1);
-        ADD_NEW_RANGE(newRange, this, aIndex + aCount, curr->mMax + aCount);
+        ADD_NEW_RANGE(mFirstRange, this, curr->mMin, aIndex - 1);
+        ADD_NEW_RANGE(mFirstRange, this, aIndex + aCount, curr->mMax + aCount);
         selChanged = PR_TRUE;
       }
     }
@@ -766,7 +796,7 @@
       // deleting
       if (aIndex > curr->mMax) {
         // adjustment happens after the range, so no change
-        ADD_NEW_RANGE(newRange, this, curr->mMin, curr->mMax);
+        ADD_NEW_RANGE(mFirstRange, this, curr->mMin, curr->mMax);
       }
       else {
         // remember, aCount is negative
@@ -775,31 +805,30 @@
         if (aIndex <= curr->mMin) {
           if (lastIndexOfAdjustment < curr->mMin) {
             // adjustment happens before the start of the range, so shift up
-            ADD_NEW_RANGE(newRange, this, curr->mMin + aCount, curr->mMax + aCount);
+            ADD_NEW_RANGE(mFirstRange, this, curr->mMin + aCount, curr->mMax + aCount);
           }
           else if (lastIndexOfAdjustment >= curr->mMax) {
             // adjustment contains the range.  remove the range by not adding it to the newRange
           }
           else {
             // adjustment starts before the range, and ends in the middle of it, so trim the range
-            ADD_NEW_RANGE(newRange, this, aIndex, curr->mMax + aCount)
+            ADD_NEW_RANGE(mFirstRange, this, aIndex, curr->mMax + aCount)
           }
         }
         else if (lastIndexOfAdjustment >= curr->mMax) {
          // adjustment starts in the middle of the current range, and contains the end of the range, so trim the range
-         ADD_NEW_RANGE(newRange, this, curr->mMin, aIndex - 1)
+         ADD_NEW_RANGE(mFirstRange, this, curr->mMin, aIndex - 1)
         }
         else {
           // range contains the adjustment, so shorten the range
-          ADD_NEW_RANGE(newRange, this, curr->mMin, curr->mMax + aCount)
+          ADD_NEW_RANGE(mFirstRange, this, curr->mMin, curr->mMax + aCount)
         }
       }
     }
     curr = curr->mNext;
   }
 
-  delete mFirstRange;
-  mFirstRange = newRange;
+  delete oldFirstRange;
 
   // Fire the select event
   if (selChanged)
--- xulrunner-1.9.0.19.orig/layout/xul/base/src/tree/src/nsTreeContentView.cpp
+++ xulrunner-1.9.0.19/layout/xul/base/src/tree/src/nsTreeContentView.cpp
@@ -47,6 +47,15 @@
 #include "nsIEventStateManager.h"
 #include "nsINodeInfo.h"
 #include "nsIXULSortService.h"
+#include "nsContentUtils.h"
+#include "nsTreeBodyFrame.h"
+#include "nsDOMError.h"
+
+#define NS_ENSURE_NATIVE_COLUMN(_col)                                \
+  nsRefPtr<nsTreeColumn> col = nsTreeBodyFrame::GetColumnImpl(_col); \
+  if (!col) {                                                        \
+    return NS_ERROR_INVALID_ARG;                                     \
+  }
 
 // A content model view implementation for the tree.
 
@@ -186,9 +195,22 @@
   return NS_OK;
 }
 
+PRBool
+nsTreeContentView::CanTrustTreeSelection(nsISupports* aValue)
+{
+  // Untrusted content is only allowed to specify known-good views
+  if (nsContentUtils::IsCallerTrustedForWrite())
+    return PR_TRUE;
+  nsCOMPtr<nsINativeTreeSelection> nativeTreeSel = do_QueryInterface(aValue);
+  return nativeTreeSel && NS_SUCCEEDED(nativeTreeSel->EnsureNative());
+}
+
 NS_IMETHODIMP
 nsTreeContentView::SetSelection(nsITreeSelection* aSelection)
 {
+  NS_ENSURE_TRUE(!aSelection || CanTrustTreeSelection(aSelection),
+                 NS_ERROR_DOM_SECURITY_ERR);
+
   mSelection = aSelection;
   if (!mSelection || !mUpdateSelection)
     return NS_OK;
@@ -239,7 +261,7 @@
 NS_IMETHODIMP
 nsTreeContentView::GetCellProperties(PRInt32 aRow, nsITreeColumn* aCol, nsISupportsArray* aProperties)
 {
-  NS_ENSURE_ARG_POINTER(aCol);
+  NS_ENSURE_NATIVE_COLUMN(aCol);
   NS_ENSURE_ARG_POINTER(aProperties);
   NS_PRECONDITION(aRow >= 0 && aRow < mRows.Count(), "bad row");
   if (aRow < 0 || aRow >= mRows.Count())
@@ -264,7 +286,7 @@
 NS_IMETHODIMP
 nsTreeContentView::GetColumnProperties(nsITreeColumn* aCol, nsISupportsArray* aProperties)
 {
-  NS_ENSURE_ARG_POINTER(aCol);
+  NS_ENSURE_NATIVE_COLUMN(aCol);
   NS_ENSURE_ARG_POINTER(aProperties);
   nsCOMPtr<nsIDOMElement> element;
   aCol->GetElement(getter_AddRefs(element));
@@ -417,7 +439,7 @@
 nsTreeContentView::GetImageSrc(PRInt32 aRow, nsITreeColumn* aCol, nsAString& _retval)
 {
   _retval.Truncate();
-  NS_ENSURE_ARG_POINTER(aCol);
+  NS_ENSURE_NATIVE_COLUMN(aCol);
   NS_PRECONDITION(aRow >= 0 && aRow < mRows.Count(), "bad row");
   if (aRow < 0 || aRow >= mRows.Count())
     return NS_ERROR_INVALID_ARG;   
@@ -438,7 +460,7 @@
 NS_IMETHODIMP
 nsTreeContentView::GetProgressMode(PRInt32 aRow, nsITreeColumn* aCol, PRInt32* _retval)
 {
-  NS_ENSURE_ARG_POINTER(aCol);
+  NS_ENSURE_NATIVE_COLUMN(aCol);
   NS_PRECONDITION(aRow >= 0 && aRow < mRows.Count(), "bad row");
   if (aRow < 0 || aRow >= mRows.Count())
     return NS_ERROR_INVALID_ARG;   
@@ -469,7 +491,7 @@
 nsTreeContentView::GetCellValue(PRInt32 aRow, nsITreeColumn* aCol, nsAString& _retval)
 {
   _retval.Truncate();
-  NS_ENSURE_ARG_POINTER(aCol);
+  NS_ENSURE_NATIVE_COLUMN(aCol);
   NS_PRECONDITION(aRow >= 0 && aRow < mRows.Count(), "bad row");
   if (aRow < 0 || aRow >= mRows.Count())
     return NS_ERROR_INVALID_ARG;   
@@ -491,7 +513,7 @@
 nsTreeContentView::GetCellText(PRInt32 aRow, nsITreeColumn* aCol, nsAString& _retval)
 {
   _retval.Truncate();
-  NS_ENSURE_ARG_POINTER(aCol);
+  NS_ENSURE_NATIVE_COLUMN(aCol);
   NS_PRECONDITION(aRow >= 0 && aRow < mRows.Count(), "bad row");
   NS_PRECONDITION(aCol, "bad column");
 
@@ -599,7 +621,7 @@
 NS_IMETHODIMP
 nsTreeContentView::CycleHeader(nsITreeColumn* aCol)
 {
-  NS_ENSURE_ARG_POINTER(aCol);
+  NS_ENSURE_NATIVE_COLUMN(aCol);
 
   if (!mRoot)
     return NS_OK;
@@ -649,7 +671,7 @@
 nsTreeContentView::IsEditable(PRInt32 aRow, nsITreeColumn* aCol, PRBool* _retval)
 {
   *_retval = PR_FALSE;
-  NS_ENSURE_ARG_POINTER(aCol);
+  NS_ENSURE_NATIVE_COLUMN(aCol);
   NS_PRECONDITION(aRow >= 0 && aRow < mRows.Count(), "bad row");
   if (aRow < 0 || aRow >= mRows.Count())
     return NS_ERROR_INVALID_ARG;   
@@ -674,6 +696,7 @@
 NS_IMETHODIMP
 nsTreeContentView::IsSelectable(PRInt32 aRow, nsITreeColumn* aCol, PRBool* _retval)
 {
+  NS_ENSURE_NATIVE_COLUMN(aCol);
   NS_PRECONDITION(aRow >= 0 && aRow < mRows.Count(), "bad row");
   if (aRow < 0 || aRow >= mRows.Count())
     return NS_ERROR_INVALID_ARG;   
@@ -698,7 +721,7 @@
 NS_IMETHODIMP
 nsTreeContentView::SetCellValue(PRInt32 aRow, nsITreeColumn* aCol, const nsAString& aValue)
 {
-  NS_ENSURE_ARG_POINTER(aCol);
+  NS_ENSURE_NATIVE_COLUMN(aCol);
   NS_PRECONDITION(aRow >= 0 && aRow < mRows.Count(), "bad row");
   if (aRow < 0 || aRow >= mRows.Count())
     return NS_ERROR_INVALID_ARG;   
@@ -719,7 +742,7 @@
 NS_IMETHODIMP
 nsTreeContentView::SetCellText(PRInt32 aRow, nsITreeColumn* aCol, const nsAString& aValue)
 {
-  NS_ENSURE_ARG_POINTER(aCol);
+  NS_ENSURE_NATIVE_COLUMN(aCol);
   NS_PRECONDITION(aRow >= 0 && aRow < mRows.Count(), "bad row");
   if (aRow < 0 || aRow >= mRows.Count())
     return NS_ERROR_INVALID_ARG;   
@@ -1046,11 +1069,14 @@
   }
   else if (childTag == nsGkAtoms::option) {
     PRInt32 parentIndex = FindContent(aContainer);
-    PRInt32 index = 0;
-    GetIndexInSubtree(aContainer, aChild, &index);
-    PRInt32 count = InsertRow(parentIndex, index, aChild);
-    if (mBoxObject)
-      mBoxObject->RowCountChanged(parentIndex + index + 1, count);
+
+    if (parentIndex >= 0) {
+      PRInt32 index = 0;
+      GetIndexInSubtree(aContainer, aChild, &index);
+      PRInt32 count = InsertRow(parentIndex, index, aChild);
+      if (mBoxObject)
+        mBoxObject->RowCountChanged(parentIndex + index + 1, count);
+    }
   }
 }
 
--- xulrunner-1.9.0.19.orig/layout/xul/base/src/tree/src/nsTreeSelection.h
+++ xulrunner-1.9.0.19/layout/xul/base/src/tree/src/nsTreeSelection.h
@@ -49,7 +49,7 @@
 class nsITreeBoxObject;
 struct nsTreeRange;
 
-class nsTreeSelection : public nsITreeSelection
+class nsTreeSelection : public nsINativeTreeSelection
 {
 public:
   nsTreeSelection(nsITreeBoxObject* aTree);
@@ -58,6 +58,9 @@
   NS_DECL_ISUPPORTS
   NS_DECL_NSITREESELECTION
 
+  // nsINativeTreeSelection: Untrusted code can use us
+  NS_IMETHOD EnsureNative() { return NS_OK; }
+
   friend struct nsTreeRange;
 
 protected:
--- xulrunner-1.9.0.19.orig/layout/xul/base/src/tree/public/nsITreeSelection.idl
+++ xulrunner-1.9.0.19/layout/xul/base/src/tree/public/nsITreeSelection.idl
@@ -151,3 +151,14 @@
    */
   readonly attribute long shiftSelectPivot;
 };
+
+/**
+ * The following interface is not scriptable and MUST NEVER BE MADE scriptable.
+ * Native treeselections implement it, and we use this to check whether a
+ * treeselection is native (and therefore suitable for use by untrusted content).
+ */
+[uuid(1bd59678-5cb3-4316-b246-31a91b19aabe)]
+interface nsINativeTreeSelection : nsITreeSelection
+{
+  [noscript] void ensureNative();
+};
--- xulrunner-1.9.0.19.orig/layout/reftests/mathml/reftest.list
+++ xulrunner-1.9.0.19/layout/reftests/mathml/reftest.list
@@ -1,6 +1,7 @@
 == mi-mathvariant-1.xhtml mi-mathvariant-1-ref.xhtml
 == mi-mathvariant-2.xhtml mi-mathvariant-2-ref.xhtml
-== table-width-1.xhtml table-width-1-ref.xhtml
-== overbar-width-1.xhtml overbar-width-1-ref.xhtml
 != non-spacing-accent-1.xhtml non-spacing-accent-1-ref.xhtml
+== overbar-width-1.xhtml overbar-width-1-ref.xhtml
+== quotes-1.xhtml quotes-1-ref.xhtml
 != stretchy-underbar-1.xhtml stretchy-underbar-1-ref.xhtml 
+== table-width-1.xhtml table-width-1-ref.xhtml
--- xulrunner-1.9.0.19.orig/layout/reftests/mathml/quotes-1-ref.xhtml
+++ xulrunner-1.9.0.19/layout/reftests/mathml/quotes-1-ref.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<p>:L_R</p>
+<p>:L_&#x201D;</p>
+<p>:&#x201C;_R</p>
+<p>:L_&#x201D;</p>
+<p>:&#x201C;_R</p>
+</body>
+</html>
--- xulrunner-1.9.0.19.orig/layout/reftests/mathml/quotes-1.xhtml
+++ xulrunner-1.9.0.19/layout/reftests/mathml/quotes-1.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<body onload="setTimeout(doTest, 0)">
+<p>:<ms xmlns="http://www.w3.org/1998/Math/MathML" lquote="L" rquote="R">_</ms></p>
+<p>:<ms id="m1" xmlns="http://www.w3.org/1998/Math/MathML">_</ms></p>
+<p>:<ms id="m2" xmlns="http://www.w3.org/1998/Math/MathML">_</ms></p>
+<p>:<ms id="m3" xmlns="http://www.w3.org/1998/Math/MathML" lquote="_">_</ms></p>
+<p>:<ms id="m4" xmlns="http://www.w3.org/1998/Math/MathML" rquote="_">_</ms></p>
+<script>
+function doTest() {
+  var m1 = document.getElementById("m1");
+  m1.setAttribute("lquote", "L");
+  var m2 = document.getElementById("m2");
+  m2.setAttribute("rquote", "R");
+  var m3 = document.getElementById("m3");
+  m3.setAttribute("lquote", "L");
+  var m4 = document.getElementById("m4");
+  m4.setAttribute("rquote", "R");
+  document.documentElement.removeAttribute('class');
+}
+</script>
+</body>
+</html>
--- xulrunner-1.9.0.19.orig/layout/style/nsCSSParser.cpp
+++ xulrunner-1.9.0.19/layout/style/nsCSSParser.cpp
@@ -79,6 +79,7 @@
 #include "nsILookAndFeel.h"
 #include "nsStyleUtil.h"
 #include "nsIPrincipal.h"
+#include "nsDOMError.h"
 
 #include "prprf.h"
 #include "math.h"
@@ -86,7 +87,7 @@
 //----------------------------------------------------------------------
 
 // Your basic top-down recursive descent style parser
-class CSSParserImpl : public nsICSSParser {
+class CSSParserImpl : public nsICSSParser_1_9 {
 public:
   CSSParserImpl();
   virtual ~CSSParserImpl();
@@ -112,6 +113,13 @@
                    PRUint32               aLineNumber,
                    PRBool                 aAllowUnsafeRules);
 
+  NS_IMETHOD ParseWithInitialSyntaxCheck(nsIUnicharInputStream* aInput,
+                                         nsIURI*       aSheetURL,
+                                         nsIURI*       aBaseURI,
+                                         nsIPrincipal* aSheetPrincipal,
+                                         PRUint32      aLineNumber,
+                                         PRBool        aAllowUnsafeRules);
+
   NS_IMETHOD ParseStyleAttribute(const nsAString&  aAttributeValue,
                                  nsIURI*           aDocURL,
                                  nsIURI*           aBaseURL,
@@ -180,6 +188,14 @@
       CSSParserImpl* mParser;
   };
 
+  nsresult Parse(nsIUnicharInputStream* aInput,
+                 nsIURI*                aSheetURI,
+                 nsIURI*                aBaseURI,
+                 nsIPrincipal*          aSheetPrincipal,
+                 PRUint32               aLineNumber,
+                 PRBool                 aAllowUnsafeRules,
+                 PRBool                 aCheckInitialSyntax);
+
   nsresult InitScanner(nsIUnicharInputStream* aInput, nsIURI* aSheetURI,
                        PRUint32 aLineNumber, nsIURI* aBaseURI,
                        nsIPrincipal* aSheetPrincipal);
@@ -203,7 +219,7 @@
   nsSubstring* NextIdent(nsresult& aErrorCode);
   void SkipUntil(nsresult& aErrorCode, PRUnichar aStopSymbol);
   void SkipRuleSet(nsresult& aErrorCode);
-  PRBool SkipAtRule(nsresult& aErrorCode);
+  void SkipAtRule(nsresult& aErrorCode);
   PRBool SkipDeclaration(nsresult& aErrorCode, PRBool aCheckForBraces);
   PRBool GetNonCloseParenToken(nsresult& aErrorCode, PRBool aSkipWS);
 
@@ -562,7 +578,7 @@
 {
 }
 
-NS_IMPL_ISUPPORTS1(CSSParserImpl, nsICSSParser)
+NS_IMPL_ISUPPORTS2(CSSParserImpl, nsICSSParser, nsICSSParser_1_9)
 
 CSSParserImpl::~CSSParserImpl()
 {
@@ -677,6 +693,7 @@
 }
 
 
+// Wrapper methods to preserve the as-shipped 1.9 API.
 NS_IMETHODIMP
 CSSParserImpl::Parse(nsIUnicharInputStream* aInput,
                      nsIURI*                aSheetURI,
@@ -685,6 +702,31 @@
                      PRUint32               aLineNumber,
                      PRBool                 aAllowUnsafeRules)
 {
+  return Parse(aInput, aSheetURI, aBaseURI, aSheetPrincipal,
+               aLineNumber, aAllowUnsafeRules, PR_FALSE);
+}
+
+NS_IMETHODIMP
+CSSParserImpl::ParseWithInitialSyntaxCheck(nsIUnicharInputStream* aInput,
+                                           nsIURI*       aSheetURI,
+                                           nsIURI*       aBaseURI,
+                                           nsIPrincipal* aSheetPrincipal,
+                                           PRUint32      aLineNumber,
+                                           PRBool        aAllowUnsafeRules)
+{
+  return Parse(aInput, aSheetURI, aBaseURI, aSheetPrincipal,
+               aLineNumber, aAllowUnsafeRules, PR_TRUE);
+}
+
+nsresult
+CSSParserImpl::Parse(nsIUnicharInputStream* aInput,
+                     nsIURI*                aSheetURI,
+                     nsIURI*                aBaseURI,
+                     nsIPrincipal*          aSheetPrincipal,
+                     PRUint32               aLineNumber,
+                     PRBool                 aAllowUnsafeRules,
+                     PRBool                 aCheckInitialSyntax)
+{
   NS_PRECONDITION(aSheetPrincipal, "Must have principal here!");
   
   NS_ASSERTION(nsnull != aBaseURI, "need base URL");
@@ -743,6 +785,7 @@
   mUnsafeRulesEnabled = aAllowUnsafeRules;
 
   nsCSSToken* tk = &mToken;
+  nsresult rv = NS_OK;
   for (;;) {
     // Get next non-whitespace token
     if (!GetToken(errorCode, PR_TRUE)) {
@@ -753,19 +796,29 @@
       continue; // legal here only
     }
     if (eCSSToken_AtKeyword == tk->mType) {
-      ParseAtRule(errorCode, AppendRuleToSheet, this);
-      continue;
-    }
-    UngetToken();
-    if (ParseRuleSet(errorCode, AppendRuleToSheet, this)) {
-      mSection = eCSSSection_General;
+      PRBool good = ParseAtRule(errorCode, AppendRuleToSheet, this);
+      if (!good && aCheckInitialSyntax) {
+        rv = NS_ERROR_DOM_SYNTAX_ERR;
+        break;
+      }
+    } else {
+      UngetToken();
+      if (ParseRuleSet(errorCode, AppendRuleToSheet, this)) {
+        mSection = eCSSSection_General;
+      } else if (aCheckInitialSyntax) {
+        rv = NS_ERROR_DOM_SYNTAX_ERR;
+        break;
+      }
     }
+    // If we get to this point we have successfully parsed one top-level
+    // construct, so stop bailing out on syntax errors.
+    aCheckInitialSyntax = PR_FALSE;
   }
   ReleaseScanner();
 
   mUnsafeRulesEnabled = PR_FALSE;
 
-  return NS_OK;
+  return rv;
 }
 
 /**
@@ -1202,31 +1255,28 @@
   return &mToken.mIdent;
 }
 
-PRBool CSSParserImpl::SkipAtRule(nsresult& aErrorCode)
+void CSSParserImpl::SkipAtRule(nsresult& aErrorCode)
 {
   for (;;) {
     if (!GetToken(aErrorCode, PR_TRUE)) {
       REPORT_UNEXPECTED_EOF(PESkipAtRuleEOF);
-      return PR_FALSE;
+      return;
     }
     if (eCSSToken_Symbol == mToken.mType) {
-      PRUnichar symbol = mToken.mSymbol;
-      if (symbol == ';') {
-        break;
-      }
-      if (symbol == '{') {
-        SkipUntil(aErrorCode, '}');
-        break;
-      } else if (symbol == '(') {
-        SkipUntil(aErrorCode, ')');
-      } else if (symbol == '[') {
-        SkipUntil(aErrorCode, ']');
+      switch (mToken.mSymbol) {
+      case ';': return;
+      case '{': SkipUntil(aErrorCode, '}'); return;
+      case '[': SkipUntil(aErrorCode, ']'); break;
+      case '(': SkipUntil(aErrorCode, ')'); break;
+      default: break;
       }
     }
   }
-  return PR_TRUE;
 }
 
+// Note: returns PR_FALSE if the rule had a syntax error, but consumes
+// the complete rule (or the complete construct to be skipped by error
+// recovery) regardless.
 PRBool CSSParserImpl::ParseAtRule(nsresult& aErrorCode, RuleAppendFunc aAppendFunc,
                                   void* aData)
 {
@@ -1282,7 +1332,8 @@
   }
 
   // Skip over unsupported at rule, don't advance section
-  return SkipAtRule(aErrorCode);
+  SkipAtRule(aErrorCode);
+  return PR_FALSE;
 }
 
 PRBool CSSParserImpl::ParseCharsetRule(nsresult& aErrorCode, RuleAppendFunc aAppendFunc,
@@ -1658,7 +1709,13 @@
 PRBool CSSParserImpl::ParsePageRule(nsresult& aErrorCode, RuleAppendFunc aAppendFunc, void* aData)
 {
   // XXX not yet implemented
-  return PR_FALSE;
+  // Report as an error, and skip, but *succeed*, so that a style
+  // sheet beginning with an @page rule will not be discarded by the
+  // "initial syntax is valid" check.
+  REPORT_UNEXPECTED_TOKEN(PEUnknownAtRule);
+  OUTPUT_ERROR();
+  SkipAtRule(aErrorCode);
+  return PR_TRUE;
 }
 
 void CSSParserImpl::SkipUntil(nsresult& aErrorCode, PRUnichar aStopSymbol)
--- xulrunner-1.9.0.19.orig/layout/style/nsICSSParser.h
+++ xulrunner-1.9.0.19/layout/style/nsICSSParser.h
@@ -60,6 +60,10 @@
 { 0xad4a3778, 0xdae0, 0x4640, \
  { 0xb2, 0x5a, 0x24, 0xff, 0x09, 0xc3, 0x70, 0xef } }
 
+#define NS_ICSS_PARSER_1_9_IID \
+{ 0x50be628d, 0x9273, 0x45c1,   \
+  { 0x9f, 0x25, 0xb4, 0xba, 0x71, 0x82, 0x45, 0xd5 } }
+
 // Rule processing function
 typedef void (*PR_CALLBACK RuleAppendFunc) (nsICSSRule* aRule, void* aData);
 
@@ -99,7 +103,7 @@
    * @param aBaseURI the URI to use for relative URI resolution
    * @param aSheetPrincipal the principal of the stylesheet.  This must match
    *                        the principal of the sheet passed to SetStyleSheet.
-   * @param aLineNumber the line number of the first line of the sheet.   
+   * @param aLineNumber the line number of the first line of the sheet.
    * @param aAllowUnsafeRules see aEnableUnsafeRules in
    *                          nsICSSLoader::LoadSheetSync
    */
@@ -172,6 +176,26 @@
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsICSSParser, NS_ICSS_PARSER_IID)
 
+class nsICSSParser_1_9 : public nsICSSParser {
+public:
+  NS_DECLARE_STATIC_IID_ACCESSOR(NS_ICSS_PARSER_1_9_IID)
+
+  /**
+   * Identical to nsICSSParser::Parse(), except that if there is a
+   * syntax error within the first top-level construct, the entire
+   * sheet is discarded and the return value is NS_ERROR_DOM_SYNTAX_ERR.
+   * See bug 524223.
+   */
+  NS_IMETHOD ParseWithInitialSyntaxCheck(nsIUnicharInputStream* aInput,
+                                         nsIURI*       aSheetURL,
+                                         nsIURI*       aBaseURI,
+                                         nsIPrincipal* aSheetPrincipal,
+                                         PRUint32      aLineNumber,
+                                         PRBool        aAllowUnsafeRules) = 0;
+};
+
+NS_DEFINE_STATIC_IID_ACCESSOR(nsICSSParser_1_9, NS_ICSS_PARSER_1_9_IID)
+
 nsresult
 NS_NewCSSParser(nsICSSParser** aInstancePtrResult);
 
--- xulrunner-1.9.0.19.orig/layout/style/nsCSSLoader.cpp
+++ xulrunner-1.9.0.19/layout/style/nsCSSLoader.cpp
@@ -68,6 +68,7 @@
 #include "nsITimelineService.h"
 #include "nsIHttpChannel.h"
 #include "nsIScriptError.h"
+#include "nsIConsoleService.h"
 #include "nsMimeTypes.h"
 #include "nsIAtom.h"
 #include "nsIDOM3Node.h"
@@ -89,6 +90,7 @@
 #include "nsIDOMCSSStyleSheet.h"
 #include "nsIDOMCSSImportRule.h"
 #include "nsContentErrors.h"
+#include "nsDOMError.h"
 
 #ifdef MOZ_LOGGING
 // #define FORCE_PR_LOG /* Allow logging in the release build */
@@ -165,6 +167,7 @@
     mWasAlternate(aIsAlternate),
     mAllowUnsafeRules(PR_FALSE),
     mUseSystemPrincipal(PR_FALSE),
+    mCheckInitialSyntax(PR_FALSE),
     mOwningElement(aOwningElement),
     mObserver(aObserver),
     mLoaderPrincipal(aLoaderPrincipal)
@@ -194,6 +197,7 @@
     mWasAlternate(PR_FALSE),
     mAllowUnsafeRules(PR_FALSE),
     mUseSystemPrincipal(PR_FALSE),
+    mCheckInitialSyntax(PR_FALSE),
     mOwningElement(nsnull),
     mObserver(aObserver),
     mLoaderPrincipal(aLoaderPrincipal)
@@ -236,6 +240,7 @@
     mWasAlternate(PR_FALSE),
     mAllowUnsafeRules(aAllowUnsafeRules),
     mUseSystemPrincipal(aUseSystemPrincipal),
+    mCheckInitialSyntax(PR_FALSE),
     mOwningElement(nsnull),
     mObserver(aObserver),
     mLoaderPrincipal(aLoaderPrincipal)
@@ -731,6 +736,76 @@
   return uri;
 }
 
+/* Subroutine of SheetLoadData::OnStreamComplete and CSSLoaderImpl::ParseSheet.
+ * Note that we can't just use nsContentUtils::ReportToConsole, because two
+ * of the messages were added after string freeze.
+ */
+void
+SheetLoadData::ReportMimeProblem(MimeProblem aProblem, nsIURI* aURI)
+{
+  nsCAutoString spec;
+  aURI->GetSpec(spec);
+  const nsAFlatString& specUTF16 = NS_ConvertUTF8toUTF16(spec);
+  const nsAFlatString& ctypeUTF16 = NS_ConvertASCIItoUTF16(mContentType);
+  const PRUnichar *strings[] = { specUTF16.get(), ctypeUTF16.get() };
+
+  PRUint32 errorFlag;
+  nsXPIDLString formattedMessage;
+  nsresult rv;
+
+  switch (aProblem) {
+  case MimeProblem_rejected:
+    errorFlag = nsIScriptError::errorFlag;
+    rv = nsContentUtils::FormatLocalizedString(nsContentUtils::eCSS_PROPERTIES,
+                                               "MimeNotCss",
+                                               strings, 2, formattedMessage);
+    if (NS_FAILED(rv)) return;
+    break;
+
+  case MimeProblem_quirksload:
+  case MimeProblem_quirksload_xd:
+    errorFlag = nsIScriptError::warningFlag;
+    rv = nsContentUtils::FormatLocalizedString(nsContentUtils::eCSS_PROPERTIES,
+                                               "MimeNotCssWarn",
+                                               strings, 2, formattedMessage);
+    if (NS_FAILED(rv)) return;
+    if (aProblem == MimeProblem_quirksload_xd) {
+      formattedMessage.AppendLiteral("  This cross-domain request will be "
+                                     "ignored by Gecko 2.0 (e.g. Firefox "
+                                     "4.0).");
+    }
+    break;
+
+  case MimeProblem_abandoned:
+    errorFlag = nsIScriptError::errorFlag;
+    formattedMessage.AppendLiteral("Cross-domain stylesheet ");
+    AppendUTF8toUTF16(spec, formattedMessage);
+    formattedMessage.AppendLiteral(", with improper MIME type, abandoned "
+                                   "because of syntax errors.");
+    break;
+  }
+
+  nsCOMPtr<nsIConsoleService> console =
+    do_GetService(NS_CONSOLESERVICE_CONTRACTID);
+  if (!console) return;
+
+  nsCOMPtr<nsIScriptError> errObj =
+    do_CreateInstance(NS_SCRIPTERROR_CONTRACTID);
+  if (!errObj) return;
+
+  nsCAutoString referrer;
+  nsCOMPtr<nsIURI> referrerURI = GetReferrerURI();
+  if (referrerURI)
+    referrerURI->GetSpec(referrer);
+
+  rv = errObj->Init(formattedMessage.get(),
+                    NS_ConvertUTF8toUTF16(referrer).get(),
+                    nsnull, 0, 0, errorFlag, "CSS Loader");
+  if (NS_FAILED(rv)) return;
+
+  console->LogMessage(errObj);
+}
+
 /*
  * Here we need to check that the load did not give us an http error
  * page and check the mimetype on the channel to make sure we're not
@@ -824,56 +899,56 @@
     }
   }
 
-  if (aDataStream) {
-    nsCAutoString contentType;
-    if (channel) {
-      channel->GetContentType(contentType);
-    }
-    
-    PRBool validType = contentType.EqualsLiteral("text/css") ||
-      contentType.EqualsLiteral(UNKNOWN_CONTENT_TYPE) ||
-      contentType.IsEmpty();
-                                          
-    if (!validType) {
-      nsCAutoString spec;
-      channelURI->GetSpec(spec);
-
-      const nsAFlatString& specUTF16 = NS_ConvertUTF8toUTF16(spec);
-      const nsAFlatString& ctypeUTF16 = NS_ConvertASCIItoUTF16(contentType);
-      const PRUnichar *strings[] = { specUTF16.get(), ctypeUTF16.get() };
-
-      const char *errorMessage;
-      PRUint32 errorFlag;
-
-      if (mLoader->mCompatMode == eCompatibility_NavQuirks) {
-        errorMessage = "MimeNotCssWarn";
-        errorFlag = nsIScriptError::warningFlag;
-      } else {
-        // Drop the data stream so that we do not load it
-        aDataStream = nsnull;
-
-        errorMessage = "MimeNotCss";
-        errorFlag = nsIScriptError::errorFlag;
-      }
-      nsCOMPtr<nsIURI> referrer = GetReferrerURI();
-      nsContentUtils::ReportToConsole(nsContentUtils::eCSS_PROPERTIES,
-                                      errorMessage,
-                                      strings, NS_ARRAY_LENGTH(strings),
-                                      referrer, EmptyString(), 0, 0, errorFlag,
-                                      "CSS Loader");
-    }
-  }
-  
   if (!aDataStream) {
     LOG_WARN(("  No data stream; bailing"));
     mLoader->SheetComplete(this, NS_ERROR_NOT_AVAILABLE);
     return NS_OK;
-  }    
+  }
+
+  if (channel) {
+    channel->GetContentType(mContentType);
+  }
+
+  // In standards mode, a style sheet must have one of these MIME
+  // types to be processed at all.  In quirks mode, we accept any
+  // MIME type, but only if the style sheet is same-origin with the
+  // requesting document or parent sheet, or (as a compatibility hack
+  // for 1.9.2 *only*), if the first thing in the file does appear
+  // to be a syntactically valid CSS construct.  See bug 524223.
+
+  PRBool validType = mContentType.EqualsLiteral("text/css") ||
+    mContentType.EqualsLiteral(UNKNOWN_CONTENT_TYPE) ||
+    mContentType.IsEmpty();
+
+  mCheckInitialSyntax = PR_FALSE;
+  if (!validType) {
+    MimeProblem problem = MimeProblem_rejected;
+
+    if (mLoader->mCompatMode == eCompatibility_NavQuirks) {
+      problem = MimeProblem_quirksload;
+      if (mLoaderPrincipal) {
+        PRBool subsumed;
+        result = mLoaderPrincipal->Subsumes(principal, &subsumed);
+        if (NS_FAILED(result) || !subsumed) {
+          problem = MimeProblem_quirksload_xd;
+          mCheckInitialSyntax = PR_TRUE;
+        }
+      }
+    }
+
+    ReportMimeProblem(problem, channelURI);
+    if (problem == MimeProblem_rejected) {
+      LOG_WARN(("  Ignoring sheet with improper MIME type %s",
+                mContentType.get()));
+      mLoader->SheetComplete(this, NS_ERROR_NOT_AVAILABLE);
+      return NS_OK;
+    }
+  }
 
   // Enough to set the URIs on mSheet, since any sibling datas we have share
   // the same mInner as mSheet and will thus get the same URI.
   mSheet->SetURIs(channelURI, originalURI, channelURI);
-  
+
   PRBool completed;
   return mLoader->ParseSheet(aDataStream, this, completed);
 }
@@ -1523,12 +1598,29 @@
   nsCOMPtr<nsIURI> sheetURI, baseURI;
   aLoadData->mSheet->GetSheetURI(getter_AddRefs(sheetURI));
   aLoadData->mSheet->GetBaseURI(getter_AddRefs(baseURI));
-  rv = parser->Parse(aStream, sheetURI, baseURI,
-                     aLoadData->mSheet->Principal(), aLoadData->mLineNumber,
-                     aLoadData->mAllowUnsafeRules);
+  if (aLoadData->mCheckInitialSyntax) {
+    nsCOMPtr<nsICSSParser_1_9> pext(do_QueryInterface(parser));
+    NS_ABORT_IF_FALSE(pext, "nsICSSParser_1_9 missing from parser impl");
+    rv = pext->ParseWithInitialSyntaxCheck(aStream, sheetURI, baseURI,
+                                           aLoadData->mSheet->Principal(),
+                                           aLoadData->mLineNumber,
+                                           aLoadData->mAllowUnsafeRules);
+  } else {
+    rv = parser->Parse(aStream, sheetURI, baseURI,
+                       aLoadData->mSheet->Principal(),
+                       aLoadData->mLineNumber,
+                       aLoadData->mAllowUnsafeRules);
+  }
   mParsingDatas.RemoveElementAt(mParsingDatas.Count() - 1);
   RecycleParser(parser);
 
+  if (rv == NS_ERROR_DOM_SYNTAX_ERR) {
+    NS_ASSERTION(aLoadData->mCheckInitialSyntax,
+                 "don't care about syntax errors but got told anyway");
+    aLoadData->ReportMimeProblem(SheetLoadData::MimeProblem_abandoned,
+                                 sheetURI);
+  }
+
   NS_ASSERTION(aLoadData->mPendingChildren == 0 || !aLoadData->mSyncLoad,
                "Sync load has leftover pending children!");
   
--- xulrunner-1.9.0.19.orig/layout/style/nsCSSLoader.h
+++ xulrunner-1.9.0.19/layout/style/nsCSSLoader.h
@@ -145,6 +145,15 @@
   NS_DECL_NSIRUNNABLE
   NS_DECL_NSIUNICHARSTREAMLOADEROBSERVER
 
+  enum MimeProblem {
+    MimeProblem_rejected,
+    MimeProblem_quirksload,
+    MimeProblem_quirksload_xd,
+    MimeProblem_abandoned
+  };
+
+  void ReportMimeProblem(MimeProblem aProblem, nsIURI* aURI);
+
   // Hold a ref to the CSSLoader so we can call back to it to let it
   // know the load finished
   CSSLoaderImpl*             mLoader; // strong ref
@@ -213,6 +222,10 @@
   // this sheet, no matter what the channel principal is.  Only true for sync
   // loads.
   PRPackedBool               mUseSystemPrincipal : 1;
+
+  // mCheckInitialSyntax is true if the CSS parser should abandon the sheet
+  // if there's a syntax error in its first full construct.  See bug 524223.
+  PRPackedBool               mCheckInitialSyntax : 1;
   
   // This is the element that imported the sheet.  Needed to get the
   // charset set on it.
@@ -223,6 +236,10 @@
 
   // The principal that identifies who started loading us.
   nsCOMPtr<nsIPrincipal> mLoaderPrincipal;
+
+  // The server-reported MIME type of the sheet.  Used primarily for
+  // diagnostics.
+  nsCString mContentType;
 };
 
 class nsURIAndPrincipalHashKey : public nsURIHashKey
--- xulrunner-1.9.0.19.orig/layout/style/test/redirect.sjs
+++ xulrunner-1.9.0.19/layout/style/test/redirect.sjs
@@ -0,0 +1,5 @@
+function handleRequest(request, response)
+{
+  response.setStatusLine(request.httpVersion, 301, "Moved Permanently");
+  response.setHeader("Location", request.queryString, false);
+}
--- xulrunner-1.9.0.19.orig/layout/style/test/Makefile.in
+++ xulrunner-1.9.0.19/layout/style/test/Makefile.in
@@ -97,6 +97,8 @@
 		test_bug405818.html \
 		test_bug412901.html \
 		test_compute_data_with_start_struct.html \
+		test_css_cross_domain.html \
+		test_css_cross_domain_miniparser.html \
 		test_dont_use_document_colors.html \
 		test_inherit_storage.html \
 		test_inherit_computation.html \
@@ -115,15 +117,13 @@
 		unstyled.css \
 		unstyled-frame.xml \
 		unstyled-frame.css \
-		redirect-1.css \
+		redirect.sjs \
 		post-redirect-1.css \
-		redirect-1.css^headers^ \
-		redirect-2.css \
 		post-redirect-2.css \
-		redirect-2.css^headers^ \
-		redirect-3.css \
-		redirect-3.css^headers^ \
 		post-redirect-3.css \
+		ccd-quirks.html \
+		ccd-standards.html \
+		ccd.sjs \
 		$(NULL)
 
 
--- xulrunner-1.9.0.19.orig/layout/style/test/test_css_cross_domain.html
+++ xulrunner-1.9.0.19/layout/style/test/test_css_cross_domain.html
@@ -0,0 +1,100 @@
+<!DOCTYPE HTML>
+<html>
+<!-- https://bugzilla.mozilla.org/show_bug.cgi?id=524223 -->
+<head>
+  <title>Test cross-domain CSS loading</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript"
+	  src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css"
+        href="/tests/SimpleTest/test.css"/>
+  <style type="text/css">
+    hr { border: none; clear: both }
+    .column {
+        margin: 10px;
+        float: left;
+    }
+    iframe {
+        width: 40px;
+        height: 680px;
+        border: none;
+        margin: 0;
+        padding: 0;
+    }
+    h2 { font-weight: normal; padding: 0 }
+    ol, h2 { font-size: 13px; line-height: 20px; }
+    ol { padding-left: 1em;
+         list-style-type: upper-roman }
+    ol ol { list-style-type: upper-alpha }
+    ol ol ol { list-style-type: decimal }
+  </style>
+</head>
+<body>
+<a target="_blank"
+   href="https://bugzilla.mozilla.org/show_bug.cgi?id=524223">Mozilla
+   Bug 524223</a>
+
+<hr/>
+
+<div class="column">
+<h2>&nbsp;</h2>
+<ol><li>text/css<ol><li>same origin<ol><li>valid</li>
+                                       <li>malformed</li>
+                                       <li>http error</li></ol></li>
+                  <li>cross origin<ol><li>valid</li>
+                                      <li>malformed</li>
+                                      <li>http error</li></ol></li>
+                  <li>same to cross<ol><li>valid</li>
+                                       <li>malformed</li>
+                                       <li>http error</li></ol></li>
+                  <li>cross to same<ol><li>valid</li>
+                                       <li>malformed</li>
+                                       <li>http error</li></ol></li></ol></li>
+    <li>text/html<ol><li>same origin<ol><li>valid</li>
+                                        <li>malformed</li>
+                                        <li>http error</li></ol></li>
+                     <li>cross origin<ol><li>valid</li>
+                                         <li>malformed</li>
+                                         <li>http error</li></ol></li>
+                     <li>same to cross<ol><li>valid</li>
+                                          <li>malformed</li>
+                                          <li>http error</li></ol></li>
+                     <li>cross to same<ol><li>valid</li>
+                                          <li>malformed</li>
+                                          <li>http error</li></ol></li></ol></li>
+</ol>
+</div>
+
+<div class="column">
+<h2>Quirks</h2>
+<iframe id="quirks" src="ccd-quirks.html"></iframe>
+</div>
+
+<div class="column">
+<h2>Standards</h2>
+<iframe id="standards" src="ccd-standards.html"></iframe>
+</div>
+
+<script type="application/javascript">
+
+/** Test for Bug 524223 **/
+function check_iframe(ifr) {
+    var doc = ifr.contentDocument;
+    var cases = doc.getElementsByTagName("p");
+    for (var i = 0; i < cases.length; i++) {
+	var color = doc.defaultView.getComputedStyle(cases[i], "")
+	    .getPropertyValue("background-color");
+
+	is(color, "rgb(0, 255, 0)", ifr.id + " " + cases[i].id);
+    }
+}
+
+SimpleTest.waitForExplicitFinish();
+window.onload = function() {
+    check_iframe(document.getElementById("quirks"));
+    check_iframe(document.getElementById("standards"));
+    SimpleTest.finish();
+};
+</script>
+</body>
+</html>
--- xulrunner-1.9.0.19.orig/layout/style/test/ccd-standards.html
+++ xulrunner-1.9.0.19/layout/style/test/ccd-standards.html
@@ -0,0 +1,123 @@
+<!doctype html>
+<html><head>
+<!-- baseline -->
+<style>
+body, html { margin: 0; padding: 0; overflow: hidden }
+div {
+  width: 60px;
+  height: 20px;
+  position: relative;
+}
+p {
+  position: absolute;
+  top: 2px; left: 2px;
+  width: 16px;
+  height: 16px;
+  margin: 0;
+  padding: 0;
+}
+p + p { left: 22px }
+
+#IA1i, #IA1l, #IA2i, #IA2l, #IB1i, #IB1l, #IB2i, #IB2l,
+#IC1i, #IC1l, #IC2i, #IC2l, #ID1i, #ID1l, #ID2i, #ID2l
+ { background-color: red }
+
+#JA1i, #JA1l, #JA2i, #JA2l, #JB1i, #JB1l, #JB2i, #JB2l,
+#JC1i, #JC1l, #JC2i, #JC2l, #JD1i, #JD1l, #JD2i, #JD2l
+ { background-color: lime }
+
+#IA3i, #IA3l, #IB3i, #IB3l, #IC3i, #IC3l, #ID3i, #ID3l,
+#JA3i, #JA3l, #JB3i, #JB3l, #JC3i, #JC3l, #JD3i, #JD3l
+ { background-color: lime }
+</style>
+
+<!-- @import rules -->
+<style>
+@import url("ccd.sjs?IA1is");
+@import url("ccd.sjs?IA2is");
+@import url("ccd.sjs?IA3is");
+@import url("http://example.org/tests/layout/style/test/ccd.sjs?IB1is");
+@import url("http://example.org/tests/layout/style/test/ccd.sjs?IB2is");
+@import url("http://example.org/tests/layout/style/test/ccd.sjs?IB3is");
+@import url("redirect.sjs?http://example.org/tests/layout/style/test/ccd.sjs?IC1is");
+@import url("redirect.sjs?http://example.org/tests/layout/style/test/ccd.sjs?IC2is");
+@import url("redirect.sjs?http://example.org/tests/layout/style/test/ccd.sjs?IC3is");
+@import url("http://example.org/tests/layout/style/test/redirect.sjs?ccd.sjs?ID1is");
+@import url("http://example.org/tests/layout/style/test/redirect.sjs?ccd.sjs?ID2is");
+@import url("http://example.org/tests/layout/style/test/redirect.sjs?ccd.sjs?ID3is");
+@import url("ccd.sjs?JA1is");
+@import url("ccd.sjs?JA2is");
+@import url("ccd.sjs?JA3is");
+@import url("http://example.org/tests/layout/style/test/ccd.sjs?JB1is");
+@import url("http://example.org/tests/layout/style/test/ccd.sjs?JB2is");
+@import url("http://example.org/tests/layout/style/test/ccd.sjs?JB3is");
+@import url("redirect.sjs?http://example.org/tests/layout/style/test/ccd.sjs?JC1is");
+@import url("redirect.sjs?http://example.org/tests/layout/style/test/ccd.sjs?JC2is");
+@import url("redirect.sjs?http://example.org/tests/layout/style/test/ccd.sjs?JC3is");
+@import url("http://example.org/tests/layout/style/test/redirect.sjs?http://localhost:8888/tests/layout/style/test/ccd.sjs?JD1is");
+@import url("http://example.org/tests/layout/style/test/redirect.sjs?http://localhost:8888/tests/layout/style/test/ccd.sjs?JD2is");
+@import url("http://example.org/tests/layout/style/test/redirect.sjs?http://localhost:8888/tests/layout/style/test/ccd.sjs?JD3is");
+</style>
+
+<!-- link directives -->
+<link rel="stylesheet" href="ccd.sjs?IA1ls">
+<link rel="stylesheet" href="ccd.sjs?IA2ls">
+<link rel="stylesheet" href="ccd.sjs?IA3ls">
+<link rel="stylesheet" href="http://example.org/tests/layout/style/test/ccd.sjs?IB1ls">
+<link rel="stylesheet" href="http://example.org/tests/layout/style/test/ccd.sjs?IB2ls">
+<link rel="stylesheet" href="http://example.org/tests/layout/style/test/ccd.sjs?IB3ls">
+<link rel="stylesheet" href="redirect.sjs?http://example.org/tests/layout/style/test/ccd.sjs?IC1ls">
+<link rel="stylesheet" href="redirect.sjs?http://example.org/tests/layout/style/test/ccd.sjs?IC2ls">
+<link rel="stylesheet" href="redirect.sjs?http://example.org/tests/layout/style/test/ccd.sjs?IC3ls">
+<link rel="stylesheet" href="http://example.org/tests/layout/style/test/redirect.sjs?ccd.sjs?ID1ls">
+<link rel="stylesheet" href="http://example.org/tests/layout/style/test/redirect.sjs?ccd.sjs?ID2ls">
+<link rel="stylesheet" href="http://example.org/tests/layout/style/test/redirect.sjs?ccd.sjs?ID3ls">
+<link rel="stylesheet" href="ccd.sjs?JA1ls">
+<link rel="stylesheet" href="ccd.sjs?JA2ls">
+<link rel="stylesheet" href="ccd.sjs?JA3ls">
+<link rel="stylesheet" href="http://example.org/tests/layout/style/test/ccd.sjs?JB1ls">
+<link rel="stylesheet" href="http://example.org/tests/layout/style/test/ccd.sjs?JB2ls">
+<link rel="stylesheet" href="http://example.org/tests/layout/style/test/ccd.sjs?JB3ls">
+<link rel="stylesheet" href="redirect.sjs?http://example.org/tests/layout/style/test/ccd.sjs?JC1ls">
+<link rel="stylesheet" href="redirect.sjs?http://example.org/tests/layout/style/test/ccd.sjs?JC2ls">
+<link rel="stylesheet" href="redirect.sjs?http://example.org/tests/layout/style/test/ccd.sjs?JC3ls">
+<link rel="stylesheet" href="http://example.org/tests/layout/style/test/redirect.sjs?http://localhost:8888/tests/layout/style/test/ccd.sjs?JD1ls">
+<link rel="stylesheet" href="http://example.org/tests/layout/style/test/redirect.sjs?http://localhost:8888/tests/layout/style/test/ccd.sjs?JD2ls">
+<link rel="stylesheet" href="http://example.org/tests/layout/style/test/redirect.sjs?http://localhost:8888/tests/layout/style/test/ccd.sjs?JD3ls">
+
+</head><body>
+<div></div>
+<div></div>
+<div><p id="IA1i"></p><p id="IA1l"></p></div>
+<div><p id="IA2i"></p><p id="IA2l"></p></div>
+<div><p id="IA3i"></p><p id="IA3l"></p></div>
+<div></div>
+<div><p id="IB1i"></p><p id="IB1l"></p></div>
+<div><p id="IB2i"></p><p id="IB2l"></p></div>
+<div><p id="IB3i"></p><p id="IB3l"></p></div>
+<div></div>
+<div><p id="IC1i"></p><p id="IC1l"></p></div>
+<div><p id="IC2i"></p><p id="IC2l"></p></div>
+<div><p id="IC3i"></p><p id="IC3l"></p></div>
+<div></div>
+<div><p id="ID1i"></p><p id="ID1l"></p></div>
+<div><p id="ID2i"></p><p id="ID2l"></p></div>
+<div><p id="ID3i"></p><p id="ID3l"></p></div>
+<div></div>
+<div></div>
+<div><p id="JA1i"></p><p id="JA1l"></p></div>
+<div><p id="JA2i"></p><p id="JA2l"></p></div>
+<div><p id="JA3i"></p><p id="JA3l"></p></div>
+<div></div>
+<div><p id="JB1i"></p><p id="JB1l"></p></div>
+<div><p id="JB2i"></p><p id="JB2l"></p></div>
+<div><p id="JB3i"></p><p id="JB3l"></p></div>
+<div></div>
+<div><p id="JC1i"></p><p id="JC1l"></p></div>
+<div><p id="JC2i"></p><p id="JC2l"></p></div>
+<div><p id="JC3i"></p><p id="JC3l"></p></div>
+<div></div>
+<div><p id="JD1i"></p><p id="JD1l"></p></div>
+<div><p id="JD2i"></p><p id="JD2l"></p></div>
+<div><p id="JD3i"></p><p id="JD3l"></p></div>
+</body></html>
--- xulrunner-1.9.0.19.orig/layout/style/test/test_bug397427.html
+++ xulrunner-1.9.0.19/layout/style/test/test_bug397427.html
@@ -9,13 +9,13 @@
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
   <style id="a">
-    @import url("redirect-1.css");
-    @import url("redirect-2.css");
+    @import url("redirect.sjs?http://example.org/tests/layout/style/test/post-redirect-1.css");
+    @import url("redirect.sjs?http://example.org/tests/layout/style/test/post-redirect-2.css");
     .test { color: red }
   </style>
   <link id="b" rel="stylesheet" href="http://example.com">
-  <link id="c" rel="stylesheet" href="redirect-2.css">
-  <link id="d" rel="stylesheet" href="redirect-3.css">
+  <link id="c" rel="stylesheet" href="redirect.sjs?http://example.org/tests/layout/style/test/post-redirect-2.css">
+  <link id="d" rel="stylesheet" href="redirect.sjs?http://example.org/tests/layout/style/test/post-redirect-3.css">
 </head>
 <body>
 <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=397427">Mozilla Bug 397427</a>
@@ -55,30 +55,30 @@
       "Redirect 3 did not get right base URI");
 
   var ruleList = $("a").sheet.cssRules;
-  
-  is(ruleList[0].styleSheet.href,
-     window.location.href.replace(/test_bug397427.html$/, "redirect-1.css"),
+
+  var redirHrefBase =
+    window.location.href.replace(/test_bug397427.html$/,
+      "redirect.sjs?http://example.org/tests/layout/style/test/post-");
+
+  is(ruleList[0].styleSheet.href, redirHrefBase + "redirect-1.css",
      "Unexpected href for imported sheet");
-  todo(ruleList[0].href == window.location.href.replace(/test_bug397427.html$/, "redirect-1.css"),
-       "Rule href should be absolute");
-  is(ruleList[1].styleSheet.href,
-     window.location.href.replace(/test_bug397427.html$/, "redirect-2.css"),
+  todo_is(ruleList[0].href, redirHrefBase + "redirect-1.css",
+     "Rule href should be absolute");
+  is(ruleList[1].styleSheet.href, redirHrefBase + "redirect-2.css",
      "Unexpected href for imported sheet");
-  todo(ruleList[1].href == window.location.href.replace(/test_bug397427.html$/, "redirect-2.css"),
-       "Rule href should be absolute");
+  todo_is(ruleList[1].href, redirHrefBase + "redirect-2.css",
+     "Rule href should be absolute");
 
   is($("b").href, "http://example.com/", "Unexpected href one");
   is($("b").href, $("b").sheet.href,
-     "Should have the same href when not redirecing");
+     "Should have the same href when not redirecting");
 
-  is($("c").href,
-     window.location.href.replace(/test_bug397427.html$/, "redirect-2.css"),
+  is($("c").href, redirHrefBase + "redirect-2.css",
      "Unexpected href two");
   is($("c").href, $("c").sheet.href,
      "Should have the same href when redirecting");
-     
-  is($("d").href,
-     window.location.href.replace(/test_bug397427.html$/, "redirect-3.css"),
+
+  is($("d").href, redirHrefBase + "redirect-3.css",
      "Unexpected href three");
   is($("d").href, $("d").sheet.href,
      "Should have the same href when redirecting again");
--- xulrunner-1.9.0.19.orig/layout/style/test/ccd.sjs
+++ xulrunner-1.9.0.19/layout/style/test/ccd.sjs
@@ -0,0 +1,74 @@
+const DEBUG_all_valid = false;
+const DEBUG_all_stub = false;
+
+function handleRequest(request, response)
+{
+    // Decode the query string to know what test we're doing.
+
+    // character 1: 'I' = text/css response, 'J' = text/html response
+    let responseCSS = (request.queryString[0] == 'I');
+
+    // character 2: redirection type - we only care about whether we're
+    // ultimately same-origin with the requesting document ('A', 'D') or
+    // not ('B', 'C').
+    let sameOrigin = (request.queryString[1] == 'A' ||
+		      request.queryString[1] == 'D');
+
+    // character 3: '1' = syntactically valid, '2' = invalid, '3' = http error
+    let malformed = (request.queryString[2] == '2');
+    let httpError = (request.queryString[2] == '3');
+
+    // character 4: loaded with <link> or @import (no action required)
+
+    // character 5: loading document mode: 'q' = quirks, 's' = standards
+    let quirksMode = (request.queryString[4] == 'q');
+
+    // Our response contains a CSS rule that selects an element whose
+    // ID is the first four characters of the query string.
+    let selector = '#' + request.queryString.substring(0,4);
+
+    // "Malformed" responses wrap the CSS rule in the construct
+    //     <html>{} ... </html>
+    // This mimics what the CSS parser might see if an actual HTML
+    // document were fed to it.  Because CSS parsers recover from
+    // errors by skipping tokens until they find something
+    // recognizable, a style rule appearing where I wrote '...' above
+    // will be honored!
+    let leader = (malformed ? '<html>{}' : '');
+    let trailer = (malformed ? '</html>' : '');
+
+    // Standards mode documents will ignore the style sheet if it is being
+    // served as text/html (regardless of its contents).  Quirks mode
+    // documents will ignore the style sheet if it is being served as
+    // text/html _and_ it is neither same-origin nor well-formed.
+    // Regardless, style sheets are ignored if they come as the body
+    // of an HTTP error response.
+    //
+    // Style sheets that should be ignored paint the element red; those
+    // that should be honored paint it lime.
+    let color = ((responseCSS || (quirksMode && (sameOrigin || !malformed)))
+    	      	 && !httpError) ? 'lime' : 'red';
+
+    // For debugging the test itself, we have the capacity to make every style
+    // sheet well-formed, or every style sheet do nothing.
+    if (DEBUG_all_valid) {
+	// In this mode, every test chip should turn blue.
+	response.setHeader('Content-Type', 'text/css');
+	response.write(selector + '{background-color:blue}\n');
+    } else if (DEBUG_all_stub) {
+	// In this mode, every test chip for a case where the true test
+	// sheet would be honored, should turn red.
+	response.setHeader('Content-Type', 'text/css');
+	response.write(selector + '{}\n');
+    } else {
+	// Normal operation.
+	if (httpError)
+	    response.setStatusLine(request.httpVersion, 500,
+				   "Internal Server Error");
+	response.setHeader('Content-Type',
+			   responseCSS ? 'text/css' : 'text/html');
+	response.write(leader + selector +
+		       '{background-color:' + color + '}' +
+		       trailer + '\n');
+    }
+}
--- xulrunner-1.9.0.19.orig/layout/style/test/test_css_cross_domain_miniparser.html
+++ xulrunner-1.9.0.19/layout/style/test/test_css_cross_domain_miniparser.html
@@ -0,0 +1,169 @@
+<!DOCTYPE HTML>
+<html>
+<!-- https://bugzilla.mozilla.org/show_bug.cgi?id=524223 -->
+<head>
+  <title>Test cross-domain CSS loading (invalid-initial rule)</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript"
+	  src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css"
+        href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank"
+   href="https://bugzilla.mozilla.org/show_bug.cgi?id=524223">Mozilla
+   Bug 524223</a>
+
+<hr>
+<script type="application/javascript">
+
+// XPCOM must die
+const utils = window.
+    QueryInterface(Components.interfaces.nsIInterfaceRequestor).
+    getInterface(Components.interfaces.nsIDOMWindowUtils).
+    QueryInterface(Components.interfaces.nsIDOMWindowUtils_1_9);
+
+function isValid(x) {
+  netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
+  return utils.cssInitialSyntaxIsValid(x);
+}
+
+// We generate a bunch of selector combinations programmatically.
+// We can't test prefixed element or attribute names (foo|bar)
+// because they'll be rejected without an @namespace declaration
+// in scope, and providing one would make the construct we're trying
+// to test not the first thing in the file.  We can, however, test
+// empty and * prefixes.
+const good_tu_selectors = [
+    "foo", "*", "|bar", "*|bar", "*|*"
+];
+
+const bad_tu_selectors = [
+    "|", "foo|", "foo|bar", "*|", "<html>", "<!"
+];
+
+const good_mod_selectors = [
+    "#foo", ".foo",
+
+    "[a]", "[a=b]", "[ a = b ]", "[a='b c']", "[ a = 'b c' ]",
+    "[|a=b]", "[ |a = b ]", "[|a='b c']", "[ |a = 'b c' ]",
+    "[*|a=b]", "[ *|a = b ]", "[*|a='b c']", "[ *|a = 'b c' ]",
+
+    ":hover", ":lang(en)", ":not( bar )", ":not([a='b c'])"
+    // we don't test pseudo-elements because honoring the last-thing-
+    // in-the-selector rule is too much trouble
+];
+
+const bad_mod_selectors = [
+    "#", "#*", "#@foo", ".", ".*", ".@foo",
+
+    "[", "[a", "[a=", "[a=b", "[a='b'",
+    "[]", "[a=]", "[a b]", "[a=b c]", "[a='b' c]", "[a=*]",
+    "[a| = b]", "[a|* = b]",
+    "[z|a=b]", "[ z|a = b ]", "[z|a='b c']", "[ z|a = 'b c' ]",
+
+    ":", ":*", "::*", ":::", ":::foo", ":::*", ":f([)", ":f[]"
+];
+
+// "good combinators" also includes grouping commas (to test selector lists).
+const good_combinators = [
+    " ", " + ", "+", "+ ", " +",
+    ",", ", ", " ,", " , "
+];
+
+const bad_combinators = [ "<", " < ", "< ", " <" ];
+
+function test_selector(good, s) {
+    var sheet = s + '{}';
+    if (good) {
+	ok(isValid(sheet), "expected valid: " + sheet);
+    } else {
+	ok(!isValid(sheet), "expected invalid: " + sheet);
+    }
+}
+
+function test_modified_selector(good, s, m) {
+    var c;
+    test_selector(good, s + m); // modified selector
+    for each (c in good_combinators) {
+	test_selector(good, s + c + m);
+	test_selector(good, m + c + s);
+    }
+    for each (c in bad_combinators) {
+	test_selector(false, s + c + m);
+	test_selector(false, m + c + s);
+    }
+}
+
+function test_selectors() {
+    var a, b;
+
+    // Isolated selector constructs
+    for each (a in good_tu_selectors) {
+	test_selector(true, a);
+    }
+    for each (a in good_mod_selectors) {
+	test_selector(true, a);
+    }
+    for each (a in bad_tu_selectors) {
+	test_selector(false, a);
+    }
+    for each (a in bad_mod_selectors) {
+	test_selector(false, a);
+    }
+
+    // Pairs of selectors
+    for each (a in good_tu_selectors) {
+	for each (b in good_mod_selectors) {
+	    test_modified_selector(true, a, b);
+	}
+    }
+
+    for each (a in good_tu_selectors) {
+	for each (b in bad_mod_selectors) {
+	    test_modified_selector(false, a, b);
+	}
+    }
+
+    for each (a in bad_tu_selectors) {
+	for each (b in good_mod_selectors) {
+	    test_modified_selector(false, a, b);
+	}
+    }
+}
+
+// Also exercise the declaration block and at-rule parsing a little.
+// We are far less picky about this since the grammar is far more lax.
+const good_sheets = [
+    "x{}", "x{ a : b }", "x{a:b}", "x { a: b }",
+    "x {a:b; c:d; e:f}", "x {a:b; c:d; e:f;}",
+    "x{", " x{a:b", // EOF closes brace groups
+    "x {a: 123 }", "x{a: [](){}<fnord>}", "x{a: url(!@#@$FJEC)}",
+
+    "@charset 'utf-8';",
+    "@media print { x { a: b; c:d; e:f; } }",
+    "@page { a:b; } x {c : d}"
+];
+
+const bad_sheets = [
+    "{}", "@charset",
+    "@foo;", "@foo 'bar';", "@foo { a: b; c:d; e:f; }", "@foo bar { baz }"
+    // syntax errors inside a declaration block with a valid selector
+    // are not trapped
+];
+
+function test_sheets() {
+    var a;
+    for each (a in good_sheets) {
+	ok(isValid(a), "expected valid: " + a);
+    }
+    for each (a in bad_sheets) {
+	ok(!isValid(a), "expected invalid: " + a);
+    }
+}
+
+test_selectors();
+test_sheets();
+</script>
+</body>
+</html>
--- xulrunner-1.9.0.19.orig/layout/style/test/ccd-quirks.html
+++ xulrunner-1.9.0.19/layout/style/test/ccd-quirks.html
@@ -0,0 +1,130 @@
+<!-- Intentionally in quirks mode. -->
+<html><head>
+<!-- baseline -->
+<style>
+body, html { margin: 0; padding: 0; overflow: hidden }
+div {
+  width: 60px;
+  height: 20px;
+  position: relative;
+}
+p {
+  position: absolute;
+  top: 2px; left: 2px;
+  width: 16px;
+  height: 16px;
+  margin: 0;
+  padding: 0;
+}
+p + p { left: 22px }
+
+#IA1i, #IA1l, #IA2i, #IA2l,
+#IB1i, #IB1l, #IB2i, #IB2l,
+#IC1i, #IC1l, #IC2i, #IC2l,
+#ID1i, #ID1l, #ID2i, #ID2l,
+
+#JA1i, #JA1l, #JA2i, #JA2l,
+#JD1i, #JD1l, #JD2i, #JD2l,
+#JB1i, #JB1l, #JC1i, #JC1l
+ { background-color: red }
+
+#IA3i, #IA3l, #IB3i, #IB3l,
+#IC3i, #IC3l, #ID3i, #ID3l,
+
+#JA3i, #JA3l, #JB3i, #JB3l,
+#JC3i, #JC3l, #JD3i, #JD3l,
+
+#JB2i, #JB2l, #JC2i, #JC2l
+ { background-color: lime }
+</style>
+
+<!-- @import rules -->
+<style>
+@import url("ccd.sjs?IA1iq");
+@import url("ccd.sjs?IA2iq");
+@import url("ccd.sjs?IA3iq");
+@import url("http://example.org/tests/layout/style/test/ccd.sjs?IB1iq");
+@import url("http://example.org/tests/layout/style/test/ccd.sjs?IB2iq");
+@import url("http://example.org/tests/layout/style/test/ccd.sjs?IB3iq");
+@import url("redirect.sjs?http://example.org/tests/layout/style/test/ccd.sjs?IC1iq");
+@import url("redirect.sjs?http://example.org/tests/layout/style/test/ccd.sjs?IC2iq");
+@import url("redirect.sjs?http://example.org/tests/layout/style/test/ccd.sjs?IC3iq");
+@import url("http://example.org/tests/layout/style/test/redirect.sjs?ccd.sjs?ID1iq");
+@import url("http://example.org/tests/layout/style/test/redirect.sjs?ccd.sjs?ID2iq");
+@import url("http://example.org/tests/layout/style/test/redirect.sjs?ccd.sjs?ID3iq");
+@import url("ccd.sjs?JA1iq");
+@import url("ccd.sjs?JA2iq");
+@import url("ccd.sjs?JA3iq");
+@import url("http://example.org/tests/layout/style/test/ccd.sjs?JB1iq");
+@import url("http://example.org/tests/layout/style/test/ccd.sjs?JB2iq");
+@import url("http://example.org/tests/layout/style/test/ccd.sjs?JB3iq");
+@import url("redirect.sjs?http://example.org/tests/layout/style/test/ccd.sjs?JC1iq");
+@import url("redirect.sjs?http://example.org/tests/layout/style/test/ccd.sjs?JC2iq");
+@import url("redirect.sjs?http://example.org/tests/layout/style/test/ccd.sjs?JC3iq");
+@import url("http://example.org/tests/layout/style/test/redirect.sjs?http://localhost:8888/tests/layout/style/test/ccd.sjs?JD1iq");
+@import url("http://example.org/tests/layout/style/test/redirect.sjs?http://localhost:8888/tests/layout/style/test/ccd.sjs?JD2iq");
+@import url("http://example.org/tests/layout/style/test/redirect.sjs?http://localhost:8888/tests/layout/style/test/ccd.sjs?JD3iq");
+</style>
+
+<!-- link directives -->
+<link rel="stylesheet" href="ccd.sjs?IA1lq">
+<link rel="stylesheet" href="ccd.sjs?IA2lq">
+<link rel="stylesheet" href="ccd.sjs?IA3lq">
+<link rel="stylesheet" href="http://example.org/tests/layout/style/test/ccd.sjs?IB1lq">
+<link rel="stylesheet" href="http://example.org/tests/layout/style/test/ccd.sjs?IB2lq">
+<link rel="stylesheet" href="http://example.org/tests/layout/style/test/ccd.sjs?IB3lq">
+<link rel="stylesheet" href="redirect.sjs?http://example.org/tests/layout/style/test/ccd.sjs?IC1lq">
+<link rel="stylesheet" href="redirect.sjs?http://example.org/tests/layout/style/test/ccd.sjs?IC2lq">
+<link rel="stylesheet" href="redirect.sjs?http://example.org/tests/layout/style/test/ccd.sjs?IC3lq">
+<link rel="stylesheet" href="http://example.org/tests/layout/style/test/redirect.sjs?ccd.sjs?ID1lq">
+<link rel="stylesheet" href="http://example.org/tests/layout/style/test/redirect.sjs?ccd.sjs?ID2lq">
+<link rel="stylesheet" href="http://example.org/tests/layout/style/test/redirect.sjs?ccd.sjs?ID3lq">
+<link rel="stylesheet" href="ccd.sjs?JA1lq">
+<link rel="stylesheet" href="ccd.sjs?JA2lq">
+<link rel="stylesheet" href="ccd.sjs?JA3lq">
+<link rel="stylesheet" href="http://example.org/tests/layout/style/test/ccd.sjs?JB1lq">
+<link rel="stylesheet" href="http://example.org/tests/layout/style/test/ccd.sjs?JB2lq">
+<link rel="stylesheet" href="http://example.org/tests/layout/style/test/ccd.sjs?JB3lq">
+<link rel="stylesheet" href="redirect.sjs?http://example.org/tests/layout/style/test/ccd.sjs?JC1lq">
+<link rel="stylesheet" href="redirect.sjs?http://example.org/tests/layout/style/test/ccd.sjs?JC2lq">
+<link rel="stylesheet" href="redirect.sjs?http://example.org/tests/layout/style/test/ccd.sjs?JC3lq">
+<link rel="stylesheet" href="http://example.org/tests/layout/style/test/redirect.sjs?http://localhost:8888/tests/layout/style/test/ccd.sjs?JD1lq">
+<link rel="stylesheet" href="http://example.org/tests/layout/style/test/redirect.sjs?http://localhost:8888/tests/layout/style/test/ccd.sjs?JD2lq">
+<link rel="stylesheet" href="http://example.org/tests/layout/style/test/redirect.sjs?http://localhost:8888/tests/layout/style/test/ccd.sjs?JD3lq">
+
+</head><body>
+<div></div>
+<div></div>
+<div><p id="IA1i"></p><p id="IA1l"></p></div>
+<div><p id="IA2i"></p><p id="IA2l"></p></div>
+<div><p id="IA3i"></p><p id="IA3l"></p></div>
+<div></div>
+<div><p id="IB1i"></p><p id="IB1l"></p></div>
+<div><p id="IB2i"></p><p id="IB2l"></p></div>
+<div><p id="IB3i"></p><p id="IB3l"></p></div>
+<div></div>
+<div><p id="IC1i"></p><p id="IC1l"></p></div>
+<div><p id="IC2i"></p><p id="IC2l"></p></div>
+<div><p id="IC3i"></p><p id="IC3l"></p></div>
+<div></div>
+<div><p id="ID1i"></p><p id="ID1l"></p></div>
+<div><p id="ID2i"></p><p id="ID2l"></p></div>
+<div><p id="ID3i"></p><p id="ID3l"></p></div>
+<div></div>
+<div></div>
+<div><p id="JA1i"></p><p id="JA1l"></p></div>
+<div><p id="JA2i"></p><p id="JA2l"></p></div>
+<div><p id="JA3i"></p><p id="JA3l"></p></div>
+<div></div>
+<div><p id="JB1i"></p><p id="JB1l"></p></div>
+<div><p id="JB2i"></p><p id="JB2l"></p></div>
+<div><p id="JB3i"></p><p id="JB3l"></p></div>
+<div></div>
+<div><p id="JC1i"></p><p id="JC1l"></p></div>
+<div><p id="JC2i"></p><p id="JC2l"></p></div>
+<div><p id="JC3i"></p><p id="JC3l"></p></div>
+<div></div>
+<div><p id="JD1i"></p><p id="JD1l"></p></div>
+<div><p id="JD2i"></p><p id="JD2l"></p></div>
+<div><p id="JD3i"></p><p id="JD3l"></p></div>
+</body></html>
--- xulrunner-1.9.0.19.orig/layout/svg/base/src/nsSVGImageFrame.cpp
+++ xulrunner-1.9.0.19/layout/svg/base/src/nsSVGImageFrame.cpp
@@ -48,6 +48,7 @@
 #include "gfxContext.h"
 #include "nsIInterfaceRequestorUtils.h"
 #include "nsIImage.h"
+#include "nsIJSContextStack.h"
 
 class nsSVGImageFrame;
 
@@ -149,7 +150,19 @@
   if (mListener) {
     nsCOMPtr<nsIImageLoadingContent> imageLoader = do_QueryInterface(mContent);
     if (imageLoader) {
+      // Push a null JSContext on the stack so that code that runs
+      // within the below code doesn't think it's being called by
+      // JS. See bug 604262.
+      nsIThreadJSContextStack* stack = nsContentUtils::ThreadJSContextStack();
+      if (stack) {
+        stack->Push(nsnull);
+      }
+
       imageLoader->RemoveObserver(mListener);
+
+      if (stack) {
+        stack->Pop(nsnull);
+      }
     }
     reinterpret_cast<nsSVGImageListener*>(mListener.get())->SetFrame(nsnull);
   }
@@ -168,8 +181,21 @@
   if (!mListener) return NS_ERROR_OUT_OF_MEMORY;
   nsCOMPtr<nsIImageLoadingContent> imageLoader = do_QueryInterface(mContent);
   NS_ENSURE_TRUE(imageLoader, NS_ERROR_UNEXPECTED);
+
+  // Push a null JSContext on the stack so that code that runs within
+  // the below code doesn't think it's being called by JS. See bug
+  // 604262.
+  nsIThreadJSContextStack* stack = nsContentUtils::ThreadJSContextStack();
+  if (stack) {
+    stack->Push(nsnull);
+  }
+
   imageLoader->AddObserver(mListener);
 
+  if (stack) {
+    stack->Pop(nsnull);
+  }
+
   return NS_OK; 
 }
 
--- xulrunner-1.9.0.19.orig/layout/build/nsLayoutCID.h
+++ xulrunner-1.9.0.19/layout/build/nsLayoutCID.h
@@ -225,4 +225,13 @@
 // {93ad72a6-02cd-4716-9626-d47d5ec275ec}
 #define NS_DOMJSON_CID \
 { 0x93ad72a6, 0x02cd, 0x4716, { 0x96, 0x26, 0xd4, 0x7d, 0x5e, 0xc2, 0x75, 0xec } }
+
+// {762C4AE7-B923-422F-B97E-B9BFC1EF7BF0}
+#define NS_ICONTENTUTILS_CID \
+{ 0x762C4AE7, 0xB923, 0x422F, { 0xB9, 0x7E, 0xB9, 0xBF, 0xC1, 0xEF, 0x7B, 0xF0 } }
+
+// {7f5fef90-44bf-4d5c-a9fa-884eb7e7cdee}
+#define NS_ICONTENTUTILS2_CID \
+{ 0x7f5fef90, 0x44bf, 0x4d5c, { 0xa9, 0xfa, 0x88, 0x4e, 0xb7, 0xe7, 0xcd, 0xee } }
+
 #endif /* nsLayoutCID_h__ */
--- xulrunner-1.9.0.19.orig/layout/build/nsLayoutModule.cpp
+++ xulrunner-1.9.0.19/layout/build/nsLayoutModule.cpp
@@ -100,6 +100,7 @@
 #include "nsILanguageAtomService.h"
 #include "nsStyleSheetService.h"
 #include "nsXULPopupManager.h"
+#include "nsIContentUtils.h"
 
 // Transformiix stuff
 #include "nsXPathEvaluator.h"
@@ -499,9 +500,11 @@
 MAKE_CTOR(CreateHTMLFragmentSink,         nsIFragmentContentSink,      NS_NewHTMLFragmentContentSink)
 MAKE_CTOR(CreateHTMLFragmentSink2,        nsIFragmentContentSink,      NS_NewHTMLFragmentContentSink2)
 MAKE_CTOR(CreateHTMLParanoidFragmentSink, nsIFragmentContentSink,      NS_NewHTMLParanoidFragmentSink)
+MAKE_CTOR(CreateHTMLParanoidFragmentSink2,nsIFragmentContentSink,      NS_NewHTMLParanoidFragmentSink2)
 MAKE_CTOR(CreateXMLFragmentSink,          nsIFragmentContentSink,      NS_NewXMLFragmentContentSink)
 MAKE_CTOR(CreateXMLFragmentSink2,         nsIFragmentContentSink,      NS_NewXMLFragmentContentSink2)
 MAKE_CTOR(CreateXHTMLParanoidFragmentSink,nsIFragmentContentSink,      NS_NewXHTMLParanoidFragmentSink)
+MAKE_CTOR(CreateXHTMLParanoidFragmentSink2,nsIFragmentContentSink,     NS_NewXHTMLParanoidFragmentSink2)
 MAKE_CTOR(CreateSanitizingHTMLSerializer, nsIContentSerializer,        NS_NewSanitizingHTMLSerializer)
 MAKE_CTOR(CreateXBLService,               nsIXBLService,               NS_NewXBLService)
 MAKE_CTOR(CreateContentPolicy,            nsIContentPolicy,            NS_NewContentPolicy)
@@ -530,6 +533,9 @@
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsSyncLoadService)
 MAKE_CTOR(CreatePluginDocument,           nsIDocument,                 NS_NewPluginDocument)
 
+NS_GENERIC_FACTORY_CONSTRUCTOR(nsIContentUtils)
+NS_GENERIC_FACTORY_CONSTRUCTOR(nsIContentUtils2)
+
 #ifdef MOZ_ENABLE_CANVAS
 MAKE_CTOR(CreateCanvasRenderingContext2D, nsIDOMCanvasRenderingContext2D, NS_NewCanvasRenderingContext2D)
 #endif
@@ -1117,6 +1123,11 @@
     NS_HTMLPARANOIDFRAGMENTSINK_CONTRACTID,
     CreateHTMLParanoidFragmentSink },
 
+  { "html paranoid fragment sink 2",
+    NS_HTMLPARANOIDFRAGMENTSINK2_CID,
+    NS_HTMLPARANOIDFRAGMENTSINK2_CONTRACTID,
+    CreateHTMLParanoidFragmentSink2 },
+
   { "HTML sanitizing content serializer",
     MOZ_SANITIZINGHTMLSERIALIZER_CID,
     MOZ_SANITIZINGHTMLSERIALIZER_CONTRACTID,
@@ -1137,6 +1148,11 @@
     NS_XHTMLPARANOIDFRAGMENTSINK_CONTRACTID,
     CreateXHTMLParanoidFragmentSink },
 
+  { "xhtml paranoid fragment sink 2",
+    NS_XHTMLPARANOIDFRAGMENTSINK2_CID,
+    NS_XHTMLPARANOIDFRAGMENTSINK2_CONTRACTID,
+    CreateXHTMLParanoidFragmentSink2 },
+
   { "XBL Service",
     NS_XBLSERVICE_CID,
     "@mozilla.org/xbl;1",
@@ -1379,6 +1395,16 @@
       "@mozilla.org/textservices/textservicesdocument;1",
       nsTextServicesDocumentConstructor },
 #endif
+
+    { "Content Utils",
+      NS_ICONTENTUTILS_CID,
+      "@mozilla.org/content/contentutils;1",
+      nsIContentUtilsConstructor },
+
+    { "Content Utils 2",
+      NS_ICONTENTUTILS2_CID,
+      "@mozilla.org/content/contentutils2;1",
+      nsIContentUtils2Constructor },
 };
 
 NS_IMPL_NSGETMODULE_WITH_CTOR(nsLayoutModule, gComponents, Initialize)
--- xulrunner-1.9.0.19.orig/layout/base/nsFrameManager.cpp
+++ xulrunner-1.9.0.19/layout/base/nsFrameManager.cpp
@@ -22,6 +22,7 @@
  * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
+ *   Mats Palmgren <matspal@gmail.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either of the GNU General Public License Version 2 or later (the "GPL"),
@@ -912,12 +913,14 @@
 nsFrameManager::ReParentStyleContext(nsIFrame* aFrame)
 {
   if (nsGkAtoms::placeholderFrame == aFrame->GetType()) {
-    // Also reparent the out-of-flow
+    // Also reparent the out-of-flow and all its continuations.
     nsIFrame* outOfFlow =
       nsPlaceholderFrame::GetRealFrameForPlaceholder(aFrame);
     NS_ASSERTION(outOfFlow, "no out-of-flow frame");
-
-    ReParentStyleContext(outOfFlow);
+    do {
+      ReParentStyleContext(outOfFlow);
+    } while ((outOfFlow = outOfFlow->GetNextContinuation()) &&
+             (outOfFlow->GetStateBits() & NS_FRAME_IS_OVERFLOW_CONTAINER));
   }
 
   // DO NOT verify the style tree before reparenting.  The frame
@@ -1391,10 +1394,13 @@
 
               // |nsFrame::GetParentStyleContextFrame| checks being out
               // of flow so that this works correctly.
-              ReResolveStyleContext(aPresContext, outOfFlowFrame,
-                                    content, aChangeList,
-                                    NS_SubtractHint(aMinChange,
-                                                    nsChangeHint_ReflowFrame));
+              do {
+                ReResolveStyleContext(aPresContext, outOfFlowFrame,
+                                      content, aChangeList,
+                                      NS_SubtractHint(aMinChange,
+                                                      nsChangeHint_ReflowFrame));
+              } while ((outOfFlowFrame = outOfFlowFrame->GetNextContinuation()) &&
+                       (outOfFlowFrame->GetStateBits() & NS_FRAME_IS_OVERFLOW_CONTAINER));
 
               // reresolve placeholder's context under the same parent
               // as the out-of-flow frame
--- xulrunner-1.9.0.19.orig/layout/base/nsPresShell.cpp
+++ xulrunner-1.9.0.19/layout/base/nsPresShell.cpp
@@ -2659,6 +2659,8 @@
 PresShell::NotifyDestroyingFrame(nsIFrame* aFrame)
 {
   if (!mIgnoreFrameDestruction) {
+    mPresContext->StopImagesFor(aFrame);
+
     mFrameConstructor->NotifyDestroyingFrame(aFrame);
 
     for (PRInt32 idx = mDirtyRoots.Count(); idx; ) {
--- xulrunner-1.9.0.19.orig/layout/base/nsCSSFrameConstructor.cpp
+++ xulrunner-1.9.0.19/layout/base/nsCSSFrameConstructor.cpp
@@ -9323,6 +9323,33 @@
   return res;
 }
 
+static void
+DoDeletingFrameSubtree(nsFrameManager* aFrameManager,
+                       nsVoidArray&    aDestroyQueue,
+                       nsIFrame*       aRemovedFrame,
+                       nsIFrame*       aFrame);
+
+static void
+DoDeletingOverflowContainers(nsFrameManager* aFrameManager,
+                             nsVoidArray&    aDestroyQueue,
+                             nsIFrame*       aRemovedFrame,
+                             nsIFrame*       aFrame)
+{
+  // The invariant that "continuing frames should be found as part of the
+  // walk over the top-most frame's continuing frames" does not hold for
+  // out-of-flow overflow containers, so we need to walk them too.
+  // Note that DoDeletingFrameSubtree() skips the child lists where
+  // overflow containers live so we won't process them twice.
+  const PRBool orphanSubtree = aRemovedFrame == aFrame;
+  for (nsIFrame* next = aFrame->GetNextContinuation();
+       next && (next->GetStateBits() & NS_FRAME_IS_OVERFLOW_CONTAINER);
+       next = next->GetNextContinuation()) {
+    DoDeletingFrameSubtree(aFrameManager, aDestroyQueue,
+                           orphanSubtree ? next : aRemovedFrame,
+                           next);
+  }
+}
+
 /**
  * Called when a frame subtree is about to be deleted. Two important
  * things happen:
@@ -9346,7 +9373,7 @@
  *            the same as aRemovedFrame, but as we recurse down the tree
  *            this changes
  */
-static nsresult
+static void
 DoDeletingFrameSubtree(nsFrameManager* aFrameManager,
                        nsVoidArray&    aDestroyQueue,
                        nsIFrame*       aRemovedFrame,
@@ -9366,10 +9393,15 @@
     // Walk aFrame's normal flow child frames looking for placeholder frames.
     nsIFrame* childFrame = aFrame->GetFirstChild(childListName);
     for (; childFrame; childFrame = childFrame->GetNextSibling()) {
+      if (childFrame->GetStateBits() & NS_FRAME_OUT_OF_FLOW) {
+        NS_ASSERTION(childListName == nsGkAtoms::overflowContainersList ||
+                     childListName == nsGkAtoms::excessOverflowContainersList,
+                     "out-of-flow on wrong child list");
+        continue;
+      }
       if (NS_LIKELY(nsGkAtoms::placeholderFrame != childFrame->GetType())) {
         DoDeletingFrameSubtree(aFrameManager, aDestroyQueue,
                                aRemovedFrame, childFrame);
-
       } else {
         nsIFrame* outOfFlowFrame =
           nsPlaceholderFrame::GetRealFrameForPlaceholder(childFrame);
@@ -9391,24 +9423,28 @@
           // Recurse into the out-of-flow, it is now the aRemovedFrame.
           DoDeletingFrameSubtree(aFrameManager, aDestroyQueue,
                                  outOfFlowFrame, outOfFlowFrame);
+          DoDeletingOverflowContainers(aFrameManager, aDestroyQueue,
+                                       outOfFlowFrame, outOfFlowFrame);
         }
         else {
           // Also recurse into the out-of-flow when it's a descendant of aRemovedFrame
           // since we don't walk those lists, see |childListName| increment below.
           DoDeletingFrameSubtree(aFrameManager, aDestroyQueue,
                                  aRemovedFrame, outOfFlowFrame);
+          DoDeletingOverflowContainers(aFrameManager, aDestroyQueue,
+                                       aRemovedFrame, outOfFlowFrame);
         }
       }
     }
 
     // Move to next child list but skip lists with frames we should have
-    // a placeholder for.
+    // a placeholder for.  Note that we only process in-flow overflow
+    // containers on the overflowContainersList/excessOverflowContainersList,
+    // out-of-flows are reached through the next-in-flow chain (bug 468563).
     do {
       childListName = aFrame->GetAdditionalChildListName(childListIndex++);
     } while (IsOutOfFlowList(childListName));
   } while (childListName);
-
-  return NS_OK;
 }
 
 /**
@@ -9442,6 +9478,10 @@
     // recursing over a subtree, because those continuing frames should be
     // found as part of the walk over the top-most frame's continuing frames.
     // Walking them again will make this an N^2/2 algorithm.
+    // The above is true for normal child next-in-flows but not overflow
+    // containers which we do walk because they *can* escape the subtree
+    // we're deleting.  We skip [excess]overflowContainersList where
+    // they live to avoid processing them more than once.
     aFrame = aFrame->GetNextContinuation();
   } while (aFrame);
 
@@ -9776,13 +9816,15 @@
       if (!(child->GetStateBits() & NS_FRAME_OUT_OF_FLOW)
           || (child->GetStateBits() & NS_FRAME_IS_OVERFLOW_CONTAINER)) {
         // only do frames that don't have placeholders
-        if (nsGkAtoms::placeholderFrame == child->GetType()) { // placeholder
-          // get out of flow frame and start over there
+        if (nsGkAtoms::placeholderFrame == child->GetType()) {
+          // do the out-of-flow frame and its continuations
           nsIFrame* outOfFlowFrame =
             nsPlaceholderFrame::GetRealFrameForPlaceholder(child);
-
-          DoApplyRenderingChangeToTree(outOfFlowFrame, aViewManager,
-                                       aFrameManager, aChange);
+          do {
+            DoApplyRenderingChangeToTree(outOfFlowFrame, aViewManager,
+                                         aFrameManager, aChange);
+          } while ((outOfFlowFrame = outOfFlowFrame->GetNextContinuation()) &&
+                   (outOfFlowFrame->GetStateBits() & NS_FRAME_IS_OVERFLOW_CONTAINER));
         }
         else {  // regular frame
           UpdateViewsForTree(child, aViewManager, aFrameManager, aChange);
@@ -10338,7 +10380,10 @@
     NS_ASSERTION(mUpdateCount == 1, "Odd update count");
   }
   NS_UnsuppressFocusEvent();
-  --mUpdateCount;
+  // Negative update counts don't make sense
+  if (mUpdateCount > 0) {
+    --mUpdateCount;
+  }
 }
 
 void
--- xulrunner-1.9.0.19.orig/layout/base/nsBidiPresUtils.cpp
+++ xulrunner-1.9.0.19/layout/base/nsBidiPresUtils.cpp
@@ -52,8 +52,10 @@
 #include "nsHTMLContainerFrame.h"
 #include "nsInlineFrame.h"
 #include "nsPlaceholderFrame.h"
+#include "nsFirstLetterFrame.h"
 
 static NS_DEFINE_IID(kInlineFrameCID, NS_INLINE_FRAME_CID);
+static NS_DEFINE_IID(kFirstLetterFrameCID, NS_FIRSTLETTER_FRAME_CID);
 
 static const PRUnichar kSpace            = 0x0020;
 static const PRUnichar kLineSeparator    = 0x2028;
@@ -197,41 +199,26 @@
 
   nsIFrame* parent = aFrame->GetParent();
   NS_ASSERTION(parent, "Couldn't get frame parent in nsBidiPresUtils::CreateBidiContinuation");
-  
-  nsresult rv = presShell->FrameConstructor()->
-    CreateContinuingFrame(presContext, aFrame, parent, aNewFrame, PR_FALSE);
-  if (NS_FAILED(rv)) {
-    return rv;
-  }
 
+  nsresult rv = NS_OK;
+  
   // Have to special case floating first letter frames because the continuation
   // doesn't go in the first letter frame. The continuation goes with the rest
   // of the text that the first letter frame was made out of.
   if (parent->GetType() == nsGkAtoms::letterFrame &&
       parent->GetStyleDisplay()->IsFloating()) {
-    nsIFrame* oldParent = parent;
-    nsPlaceholderFrame* placeholderFrame =
-      presShell->FrameManager()->GetPlaceholderFrameFor(parent);
-    parent = placeholderFrame->GetParent();
-
-    (*aNewFrame)->SetParent(parent);
-    nsHTMLContainerFrame::ReparentFrameView(aFrame->PresContext(), *aNewFrame,
-                                            oldParent, parent);
-
-    // The continuation will have gotten the first letter style from it's prev
-    // continuation, so we need to repair the style context so it doesn't have
-    // the first letter styling.
-    nsStyleContext* parentSC = oldParent->GetStyleContext()->GetParent();
-    if (parentSC) {
-      nsRefPtr<nsStyleContext> newSC;
-      newSC = presShell->StyleSet()->ResolveStyleForNonElement(parentSC);
-      if (newSC) {
-        (*aNewFrame)->SetStyleContext(newSC);
-      }
+    nsFirstLetterFrame* letterFrame;
+    parent->QueryInterface(kFirstLetterFrameCID, (void**)&letterFrame);
+    if (letterFrame) {
+      rv = letterFrame->CreateContinuationForFloatingParent(
+             presContext, aFrame, aNewFrame, PR_FALSE);
+      return rv;
     }
+  }
 
-    // The list name nsGkAtoms::nextBidi would indicate we don't want reflow
-    rv = parent->InsertFrames(nsGkAtoms::nextBidi, placeholderFrame, *aNewFrame);
+  rv = presShell->FrameConstructor()->
+    CreateContinuingFrame(presContext, aFrame, parent, aNewFrame, PR_FALSE);
+  if (NS_FAILED(rv)) {
     return rv;
   }
 
--- xulrunner-1.9.0.19.orig/layout/base/nsPresContext.cpp
+++ xulrunner-1.9.0.19/layout/base/nsPresContext.cpp
@@ -227,8 +227,6 @@
 
 nsPresContext::~nsPresContext()
 {
-  mImageLoaders.Enumerate(destroy_loads, nsnull);
-
   NS_PRECONDITION(!mShell, "Presshell forgot to clear our mShell pointer");
   SetShell(nsnull);
 
@@ -333,9 +331,6 @@
   // NS_RELEASE(tmp->mLookAndFeel); // a service
   // NS_RELEASE(tmp->mLangGroup); // an atom
 
-  tmp->mImageLoaders.Enumerate(destroy_loads, nsnull);
-  tmp->mImageLoaders.Clear();
-
   // NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mTheme); // a service
   // NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mLangService); // a service
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mPrintSettings);
@@ -910,6 +905,13 @@
         UpdateCharSet(doc->GetDocumentCharacterSet());
       }
     }
+  } else {
+    // Destroy image loaders now that the presshell is going away.
+    // This is important since imageloaders can have pointers to frames and
+    // we don't want those pointers to outlive the destruction of the frame
+    // arena.
+    mImageLoaders.Enumerate(destroy_loads, nsnull);
+    mImageLoaders.Clear();
   }
 }
 
@@ -1170,6 +1172,8 @@
 imgIRequest*
 nsPresContext::LoadImage(imgIRequest* aImage, nsIFrame* aTargetFrame)
 {
+  NS_ASSERTION(mShell, "Shouldn't load image after the shell is gone");
+ 
   // look and see if we have a loader for the target frame.
   nsCOMPtr<nsImageLoader> loader;
   mImageLoaders.Get(aTargetFrame, getter_AddRefs(loader));
--- xulrunner-1.9.0.19.orig/layout/mathml/crashtests/crashtests.list
+++ xulrunner-1.9.0.19/layout/mathml/crashtests/crashtests.list
@@ -41,3 +41,4 @@
 load 420420-1.xhtml
 load 463763-1.xhtml
 load 463763-2.xhtml
+load 476547-1.xhtml
--- xulrunner-1.9.0.19.orig/layout/mathml/crashtests/476547-1.xhtml
+++ xulrunner-1.9.0.19/layout/mathml/crashtests/476547-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="quotes: '&lt;1&gt;' '';">
+<body onload="document.getElementById('ms').setAttribute('lquote', '');" style="direction: rtl;">
+<span><ms id="ms" xmlns="http://www.w3.org/1998/Math/MathML"><mstyle/></ms></span>
+</body>
+</html>
--- xulrunner-1.9.0.19.orig/layout/mathml/base/src/nsMathMLTokenFrame.cpp
+++ xulrunner-1.9.0.19/layout/mathml/base/src/nsMathMLTokenFrame.cpp
@@ -139,7 +139,7 @@
   if (NS_FAILED(rv))
     return rv;
 
-  SetQuotes();
+  SetQuotes(PR_FALSE);
   ProcessTextData();
   return rv;
 }
@@ -259,7 +259,7 @@
 {
   if (nsGkAtoms::lquote_ == aAttribute ||
       nsGkAtoms::rquote_ == aAttribute) {
-    SetQuotes();
+    SetQuotes(PR_TRUE);
   }
 
   return nsMathMLContainerFrame::
@@ -378,57 +378,44 @@
 // So the main idea in this code is to see if there are lquote and 
 // rquote attributes. If these are there, we ovewrite the default
 // quotes in the text frames.
+// XXX this is somewhat bogus, we probably should map lquote and rquote
+// to 'content' style rules
 //
 // But what if the mathml.css file wasn't loaded? 
 // We also check that we are not relying on null pointers...
 
 static void
-SetQuote(nsIFrame*       aFrame, 
-         nsString&       aValue)
+SetQuote(nsIFrame* aFrame, nsString& aValue, PRBool aNotify)
 {
-  nsIFrame* textFrame;
-  do {
-    // walk down the hierarchy of first children because they could be wrapped
-    textFrame = aFrame->GetFirstChild(nsnull);
-    if (textFrame) {
-      if (textFrame->GetType() == nsGkAtoms::textFrame)
-        break;
-    }
-    aFrame = textFrame;
-  } while (textFrame);
-  if (textFrame) {
-    nsIContent* quoteContent = textFrame->GetContent();
-    if (quoteContent && quoteContent->IsNodeOfType(nsINode::eTEXT)) {
-      quoteContent->SetText(aValue, PR_FALSE); // no notify since we don't want a reflow yet
-    }
-  }
+  if (!aFrame)
+    return;
+
+  nsIFrame* textFrame = aFrame->GetFirstChild(nsnull);
+  if (!textFrame)
+    return;
+
+  nsIContent* quoteContent = textFrame->GetContent();
+  if (!quoteContent->IsNodeOfType(nsINode::eTEXT))
+    return;
+
+  quoteContent->SetText(aValue, aNotify);
 }
 
 void
-nsMathMLTokenFrame::SetQuotes()
+nsMathMLTokenFrame::SetQuotes(PRBool aNotify)
 {
   if (mContent->Tag() != nsGkAtoms::ms_)
     return;
 
-  nsIFrame* rightFrame = nsnull;
-  nsIFrame* baseFrame = nsnull;
-  nsIFrame* leftFrame = mFrames.FirstChild();
-  if (leftFrame)
-    baseFrame = leftFrame->GetNextSibling();
-  if (baseFrame)
-    rightFrame = baseFrame->GetNextSibling();
-  if (!leftFrame || !baseFrame || !rightFrame)
-    return;
-
   nsAutoString value;
   // lquote
   if (GetAttribute(mContent, mPresentationData.mstyle,
                    nsGkAtoms::lquote_, value)) {
-    SetQuote(leftFrame, value);
+    SetQuote(nsLayoutUtils::GetBeforeFrame(this), value, aNotify);
   }
   // rquote
   if (GetAttribute(mContent, mPresentationData.mstyle,
                    nsGkAtoms::rquote_, value)) {
-    SetQuote(rightFrame, value);
+    SetQuote(nsLayoutUtils::GetAfterFrame(this), value, aNotify);
   }
 }
--- xulrunner-1.9.0.19.orig/layout/mathml/base/src/nsMathMLTokenFrame.h
+++ xulrunner-1.9.0.19/layout/mathml/base/src/nsMathMLTokenFrame.h
@@ -100,7 +100,7 @@
   PRBool SetTextStyle();
 
   // helper to set the quotes of <ms>
-  void SetQuotes();
+  void SetQuotes(PRBool aNotify);
 };
 
 #endif /* nsMathMLTokentFrame_h___ */
--- xulrunner-1.9.0.19.orig/layout/forms/nsComboboxControlFrame.cpp
+++ xulrunner-1.9.0.19/layout/forms/nsComboboxControlFrame.cpp
@@ -90,6 +90,7 @@
 #include "nsDisplayList.h"
 #include "nsITheme.h"
 #include "nsThemeConstants.h"
+#include "nsPLDOMEvent.h"
 
 NS_IMETHODIMP
 nsComboboxControlFrame::RedisplayTextEvent::Run()
@@ -1485,18 +1486,9 @@
 void nsComboboxControlFrame::FireValueChangeEvent()
 {
   // Fire ValueChange event to indicate data value of combo box has changed
-  nsCOMPtr<nsIDOMEvent> event;
-  nsPresContext* presContext = PresContext();
-  if (NS_SUCCEEDED(nsEventDispatcher::CreateEvent(presContext, nsnull,
-                                                  NS_LITERAL_STRING("Events"),
-                                                  getter_AddRefs(event)))) {
-    event->InitEvent(NS_LITERAL_STRING("ValueChange"), PR_TRUE, PR_TRUE);
-
-    nsCOMPtr<nsIPrivateDOMEvent> privateEvent(do_QueryInterface(event));
-    privateEvent->SetTrusted(PR_TRUE);
-    nsEventDispatcher::DispatchDOMEvent(mContent, nsnull, event, nsnull,
-                                        nsnull);
-  }
+  nsCOMPtr<nsIDOMNode> node = do_QueryInterface(mContent);
+  nsContentUtils::AddScriptRunner(new nsPLDOMEvent(node,
+                                  NS_LITERAL_STRING("ValueChange")));
 }
 
 void
--- xulrunner-1.9.0.19.orig/layout/forms/nsIsIndexFrame.cpp
+++ xulrunner-1.9.0.19/layout/forms/nsIsIndexFrame.cpp
@@ -60,7 +60,6 @@
 #include "nsIComponentManager.h"
 #include "nsHTMLParts.h"
 #include "nsLinebreakConverter.h"
-#include "nsILinkHandler.h"
 #include "nsIHTMLDocument.h"
 #include "nsXPIDLString.h"
 #include "nsReadableUtils.h"
@@ -348,8 +347,6 @@
   // End ProcessAsURLEncoded
 
   // make the url string
-  nsILinkHandler *handler = aPresContext->GetLinkHandler();
-
   nsAutoString href;
 
   // Get the document.
@@ -427,10 +424,9 @@
                      flatDocCharset.get(), baseURI);
   if (NS_FAILED(result)) return result;
 
-  // Now pass on absolute url to the click handler
-  if (handler) {
-    handler->OnLinkClick(mContent, uri, nsnull);
-  }
+  // Now pretend we're triggering a link
+  nsContentUtils::TriggerLink(mContent, aPresContext, uri,
+                              EmptyString(), PR_TRUE, PR_TRUE);
   return result;
 }
 
--- xulrunner-1.9.0.19.orig/layout/forms/nsTextControlFrame.h
+++ xulrunner-1.9.0.19/layout/forms/nsTextControlFrame.h
@@ -194,7 +194,7 @@
    * @return whether this is a password ontrol
    */
   PRBool IsPasswordTextControl() const;
-  void FireOnInput();
+  void FireOnInput(PRBool aTrusted);
   void SetValueChanged(PRBool aValueChanged);
   /** Called when the frame is focused, to remember the value for onChange. */
   nsresult InitFocusedValue();
--- xulrunner-1.9.0.19.orig/layout/forms/nsTextControlFrame.cpp
+++ xulrunner-1.9.0.19/layout/forms/nsTextControlFrame.cpp
@@ -500,7 +500,11 @@
   mFrame->SetValueChanged(PR_TRUE);
 
   // Fire input event
-  mFrame->FireOnInput();
+  nsCOMPtr<nsIEditor_MOZILLA_1_9_2_BRANCH> editor192 = do_QueryInterface(editor);
+  NS_ASSERTION(editor192, "Something is very wrong!");
+  PRBool trusted = PR_FALSE;
+  editor192->GetLastKeypressEventTrusted(&trusted);
+  mFrame->FireOnInput(trusted);
 
   return NS_OK;
 }
@@ -2522,14 +2526,14 @@
 
 // this is where we propagate a content changed event
 void
-nsTextControlFrame::FireOnInput()
+nsTextControlFrame::FireOnInput(PRBool aTrusted)
 {
   if (!mNotifyOnInput)
     return; // if notification is turned off, do nothing
   
   // Dispatch the "input" event
   nsEventStatus status = nsEventStatus_eIgnore;
-  nsUIEvent event(PR_TRUE, NS_FORM_INPUT, 0);
+  nsUIEvent event(aTrusted, NS_FORM_INPUT, 0);
 
   // Have the content handle the event, propagating it according to normal
   // DOM rules.
--- xulrunner-1.9.0.19.orig/js/src/jsobj.c
+++ xulrunner-1.9.0.19/js/src/jsobj.c
@@ -342,9 +342,7 @@
 #if JS_HAS_GETTER_SETTER
     JSObject *obj2;
     JSProperty *prop;
-    uintN attrs;
 #endif
-    jsval val;
 
     JS_CHECK_RECURSION(cx, return NULL);
 
@@ -369,44 +367,60 @@
 
         ok = JS_TRUE;
         for (i = 0, length = ida->length; i < length; i++) {
+            JSTempValueRooter v;
+            JSTempValueRooter setter;
+            PRBool hasGetter, hasSetter;
+
             id = ida->vector[i];
+            JS_PUSH_SINGLE_TEMP_ROOT(cx, JSVAL_VOID, &v);
 #if JS_HAS_GETTER_SETTER
             ok = OBJ_LOOKUP_PROPERTY(cx, obj, id, &obj2, &prop);
             if (!ok)
-                break;
+                goto brk;
             if (!prop)
-                continue;
-            ok = OBJ_GET_ATTRIBUTES(cx, obj2, id, prop, &attrs);
-            if (ok) {
-                if (OBJ_IS_NATIVE(obj2) &&
-                    (attrs & (JSPROP_GETTER | JSPROP_SETTER))) {
-                    val = JSVAL_NULL;
-                    if (attrs & JSPROP_GETTER)
-                        val = (jsval) ((JSScopeProperty*)prop)->getter;
-                    if (attrs & JSPROP_SETTER) {
-                        if (val != JSVAL_NULL) {
-                            /* Mark the getter, then set val to setter. */
-                            ok = (MarkSharpObjects(cx, JSVAL_TO_OBJECT(val),
-                                                   NULL)
-                                  != NULL);
-                        }
-                        val = (jsval) ((JSScopeProperty*)prop)->setter;
-                    }
-                } else {
-                    ok = OBJ_GET_PROPERTY(cx, obj, id, &val);
+                goto cont;
+            JS_PUSH_SINGLE_TEMP_ROOT(cx, JSVAL_VOID, &setter);
+            if (!OBJ_IS_NATIVE(obj2)) {
+                OBJ_DROP_PROPERTY(cx, obj2, prop);
+                hasGetter = hasSetter = PR_FALSE;
+            } else {
+                JSScopeProperty *sprop = (JSScopeProperty *) prop;
+                uintN attrs = sprop->attrs;
+                hasGetter = (attrs & JSPROP_GETTER);
+                hasSetter = (attrs & JSPROP_SETTER);
+                if (hasGetter)
+                    v.u.value = (jsval) ((JSScopeProperty*)sprop)->getter;
+                if (hasSetter)
+                    setter.u.value = (jsval) ((JSScopeProperty*)sprop)->setter;
+                JS_UNLOCK_OBJ(cx, obj2);
+            }
+            if (hasSetter) {
+                /* Mark the getter, then set value to setter. */
+                if (hasGetter && !JSVAL_IS_PRIMITIVE(v.u.value)) {
+                    ok = !!MarkSharpObjects(cx, JSVAL_TO_OBJECT(v.u.value), NULL);
                 }
+                if (ok)
+                    v.u.value = setter.u.value;
+            } else if (!hasGetter) {
+                ok = OBJ_GET_PROPERTY(cx, obj, id, &(v.u.value));
             }
-            OBJ_DROP_PROPERTY(cx, obj2, prop);
+            JS_POP_TEMP_ROOT(cx, &setter);
 #else
-            ok = OBJ_GET_PROPERTY(cx, obj, id, &val);
+            ok = OBJ_GET_PROPERTY(cx, obj, id, &(v.u.value));
 #endif
             if (!ok)
-                break;
-            if (!JSVAL_IS_PRIMITIVE(val) &&
-                !MarkSharpObjects(cx, JSVAL_TO_OBJECT(val), NULL)) {
+                goto brk;
+            if (!JSVAL_IS_PRIMITIVE(v.u.value) &&
+                !MarkSharpObjects(cx, JSVAL_TO_OBJECT(v.u.value), NULL)) {
                 ok = JS_FALSE;
-                break;
+                goto brk;
             }
+            cont:
+                JS_POP_TEMP_ROOT(cx, &v);
+                continue;
+            brk:
+                JS_POP_TEMP_ROOT(cx, &v);
+                break;
         }
         if (!ok || !idap)
             JS_DestroyIdArray(cx, ida);
@@ -617,7 +631,7 @@
     JSHashEntry *he;
     JSIdArray *ida;
     jschar *chars, *ochars, *vsharp;
-    const jschar *idstrchars, *vchars;
+    const jschar *vchars;
     size_t nchars, idstrlength, gsoplength, vlength, vsharplength, curlen;
     char *comma;
     jsint i, j, length, valcnt;
@@ -738,13 +752,9 @@
 
         valcnt = 0;
         if (prop) {
-            ok = OBJ_GET_ATTRIBUTES(cx, obj2, id, prop, &attrs);
-            if (!ok) {
-                OBJ_DROP_PROPERTY(cx, obj2, prop);
-                goto error;
-            }
-            if (OBJ_IS_NATIVE(obj2) &&
-                (attrs & (JSPROP_GETTER | JSPROP_SETTER))) {
+            if (OBJ_IS_NATIVE(obj2)) {
+                JSScopeProperty *sprop = (JSScopeProperty *) prop;
+                attrs = sprop->attrs;
                 if (attrs & JSPROP_GETTER) {
                     val[valcnt] = (jsval) ((JSScopeProperty *)prop)->getter;
                     gsopold[valcnt] =
@@ -763,13 +773,18 @@
 
                     valcnt++;
                 }
+                JS_UNLOCK_OBJ(cx, obj2);
             } else {
+                OBJ_DROP_PROPERTY(cx, obj2, prop);
+            }
+            if (!valcnt) {
                 valcnt = 1;
                 gsop[0] = NULL;
                 gsopold[0] = NULL;
                 ok = OBJ_GET_PROPERTY(cx, obj, id, &val[0]);
+                if (!ok)
+                    goto error;
             }
-            OBJ_DROP_PROPERTY(cx, obj2, prop);
         }
 
 #else  /* !JS_HAS_GETTER_SETTER */
@@ -784,12 +799,11 @@
         gsop[0] = NULL;
         gsopold[0] = NULL;
         ok = OBJ_GET_PROPERTY(cx, obj, id, &val[0]);
-
-#endif /* !JS_HAS_GETTER_SETTER */
-
         if (!ok)
             goto error;
 
+#endif /* !JS_HAS_GETTER_SETTER */
+
         /*
          * If id is a string that's not an identifier, then it needs to be
          * quoted.  Also, negative integer ids must be quoted.
@@ -804,7 +818,7 @@
             }
             *vp = STRING_TO_JSVAL(idstr);               /* local root */
         }
-        JSSTRING_CHARS_AND_LENGTH(idstr, idstrchars, idstrlength);
+        idstrlength = JSSTRING_LENGTH(idstr);
 
         for (j = 0; j < valcnt; j++) {
             /* Convert val[j] to its canonical source form. */
@@ -846,6 +860,7 @@
                         gsop[j] = gsopold[j];
                     }
                     js_LeaveSharpObject(cx, NULL);
+                    vchars = JSSTRING_CHARS(valstr);
                 }
             }
 #endif
@@ -936,6 +951,7 @@
             }
             comma = ", ";
 
+            const jschar *idstrchars = JSSTRING_CHARS(idstr);
             if (needOldStyleGetterSetter) {
                 js_strncpy(&chars[nchars], idstrchars, idstrlength);
                 nchars += idstrlength;
@@ -3367,9 +3383,12 @@
                         }
                         scope = OBJ_SCOPE(obj2);
                         if (!MAP_IS_NATIVE(&scope->map)) {
+                            JSTempValueRooter root;
                             /* Whoops, newresolve handed back a foreign obj2. */
                             JS_ASSERT(obj2 != obj);
+                            JS_PUSH_SINGLE_TEMP_ROOT(cx, obj2, &root);
                             ok = OBJ_LOOKUP_PROPERTY(cx, obj2, id, objp, propp);
+                            JS_POP_TEMP_ROOT(cx, &root);
                             if (!ok || *propp)
                                 goto cleanup;
                             JS_LOCK_OBJ(cx, obj2);
@@ -3433,7 +3452,12 @@
         if (!proto)
             break;
         if (!OBJ_IS_NATIVE(proto)) {
-            if (!OBJ_LOOKUP_PROPERTY(cx, proto, id, objp, propp))
+            JSTempValueRooter root;
+            JSBool rv;
+            JS_PUSH_SINGLE_TEMP_ROOT(cx, proto, &root);
+            rv = OBJ_LOOKUP_PROPERTY(cx, proto, id, objp, propp);
+            JS_POP_TEMP_ROOT(cx, &root);
+            if (!rv)
                 return -1;
             return protoIndex + 1;
         }
@@ -5209,6 +5233,12 @@
     return JS_FALSE;
 }
 
+JS_FRIEND_API(void)
+js_SetObjectWeakRoot(JSContext *cx, JSObject *obj)
+{
+    cx->weakRoots.newborn[GCX_OBJECT] = obj;
+}
+
 #ifdef DEBUG
 
 /* Routines to print out values during debugging. */
--- xulrunner-1.9.0.19.orig/js/src/jsobj.h
+++ xulrunner-1.9.0.19/js/src/jsobj.h
@@ -711,6 +711,9 @@
 extern JS_FRIEND_API(JSBool)
 js_GetterOnlyPropertyStub(JSContext *cx, JSObject *obj, jsval id, jsval *vp);
 
+extern JS_FRIEND_API(void)
+js_SetObjectWeakRoot(JSContext *cx, JSObject *obj);
+
 JS_END_EXTERN_C
 
 #endif /* jsobj_h___ */
--- xulrunner-1.9.0.19.orig/js/src/jsopcode.c
+++ xulrunner-1.9.0.19/js/src/jsopcode.c
@@ -441,13 +441,18 @@
 static ptrdiff_t
 SprintPut(Sprinter *sp, const char *s, size_t len)
 {
-    ptrdiff_t offset;
-    char *bp;
+    ptrdiff_t offset = sp->size; /* save old size */
+    char *bp = sp->base;         /* save old base */
 
     /* Allocate space for s, including the '\0' at the end. */
     if (!SprintEnsureBuffer(sp, len))
         return -1;
 
+    if (sp->base != bp &&               /* buffer was realloc'ed */
+        s >= bp && s < bp + offset) {   /* s was within the buffer */
+        s = sp->base + (s - bp);        /* this is where it lives now */
+    }
+
     /* Advance offset and copy s into sp's buffer. */
     offset = sp->offset;
     sp->offset += len;
--- xulrunner-1.9.0.19.orig/js/src/Makefile.in
+++ xulrunner-1.9.0.19/js/src/Makefile.in
@@ -48,6 +48,7 @@
 LIBRARY_NAME	= mozjs
 LIB_IS_C_ONLY	= 1
 GRE_MODULE	= 1
+SO_VERSION	= 1d
 
 ifdef GNU_CC
 ifdef INTEL_CC
@@ -77,6 +78,16 @@
 RESFILE		= js$(MOZ_BITS)40.res
 endif
 
+ifdef ENABLE_JS_BINARY
+SIMPLE_PROGRAMS	= js
+PROG_LIBS	= -L. $(MOZ_JS_LIBS) $(NSPR_LIBS)
+$(SIMPLE_PROGRAMS): $(DLL_PREFIX)$(LIBRARY_NAME)$(DLL_SUFFIX)
+ifdef HAVE_READLINE
+PROG_LIBS	+= $(READLINE_LIBS)
+DEFINES		= -DEDITLINE
+endif
+endif
+
 PACKAGE_FILE = js.pkg
 
 # JavaScript must be built shared, even for static builds, as it is used by
--- xulrunner-1.9.0.19.orig/js/src/jsemit.c
+++ xulrunner-1.9.0.19/js/src/jsemit.c
@@ -5833,7 +5833,7 @@
       case TOK_FILTER:
         if (!js_EmitTree(cx, cg, pn->pn_left))
             return JS_FALSE;
-        jmp = js_Emit3(cx, cg, JSOP_FILTER, 0, 0);
+        jmp = EmitJump(cx, cg, JSOP_FILTER, 0);
         if (jmp < 0)
             return JS_FALSE;
         top = CG_OFFSET(cg);
--- xulrunner-1.9.0.19.orig/js/src/jsinterp.c
+++ xulrunner-1.9.0.19/js/src/jsinterp.c
@@ -1851,6 +1851,7 @@
     JSObject *obj, *obj2, *proto, *parent;
     jsval lval, rval;
     JSClass *clasp;
+    JSTempValueRooter tvr;
 
     fun = NULL;
     obj2 = NULL;
@@ -1897,10 +1898,13 @@
     if (!obj)
         return JS_FALSE;
 
+    JS_PUSH_SINGLE_TEMP_ROOT(cx, obj, &tvr);
+
     /* Now we have an object with a constructor method; call it. */
     vp[1] = OBJECT_TO_JSVAL(obj);
     if (!js_Invoke(cx, argc, vp, JSINVOKE_CONSTRUCT)) {
         cx->weakRoots.newborn[GCX_OBJECT] = NULL;
+        JS_POP_TEMP_ROOT(cx, &tvr);
         return JS_FALSE;
     }
 
@@ -1912,12 +1916,14 @@
             JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
                                  JSMSG_BAD_NEW_RESULT,
                                  js_ValueToPrintableString(cx, rval));
+            JS_POP_TEMP_ROOT(cx, &tvr);
             return JS_FALSE;
         }
         *vp = OBJECT_TO_JSVAL(obj);
     }
 
     JS_RUNTIME_METER(cx->runtime, constructs);
+    JS_POP_TEMP_ROOT(cx, &tvr);
     return JS_TRUE;
 }
 
@@ -6808,6 +6814,9 @@
         JSTryNote *tn, *tnlimit;
         uint32 offset;
 
+        /* Restore atoms local in case we will resume. */
+        atoms = script->atomMap.vector;
+
         /* Call debugger throw hook if set. */
         handler = cx->debugHooks->throwHook;
         if (handler) {
--- xulrunner-1.9.0.19.orig/js/src/jsstr.c
+++ xulrunner-1.9.0.19/js/src/jsstr.c
@@ -991,9 +991,7 @@
         vp[2] = STRING_TO_JSVAL(str2);
     }
 
-    text = JSSTRING_CHARS(str);
     textlen = (jsint) JSSTRING_LENGTH(str);
-    pat = JSSTRING_CHARS(str2);
     patlen = (jsint) JSSTRING_LENGTH(str2);
 
     if (argc > 1) {
@@ -1015,6 +1013,8 @@
         return JS_TRUE;
     }
 
+    text = JSSTRING_CHARS(str);
+    pat = JSSTRING_CHARS(str2);
     /* XXX tune the BMH threshold (512) */
     if (textlen - i >= 512 && (jsuint)(patlen - 2) <= BMH_PATLEN_MAX - 2) {
         index = js_BoyerMooreHorspool(text, textlen, pat, patlen, i);
@@ -1050,14 +1050,12 @@
     jsdouble d;
 
     NORMALIZE_THIS(cx, vp, str);
-    text = JSSTRING_CHARS(str);
     textlen = (jsint) JSSTRING_LENGTH(str);
 
     str2 = js_ValueToString(cx, vp[2]);
     if (!str2)
         return JS_FALSE;
     vp[2] = STRING_TO_JSVAL(str2);
-    pat = JSSTRING_CHARS(str2);
     patlen = (jsint) JSSTRING_LENGTH(str2);
 
     if (argc > 1) {
@@ -1084,6 +1082,8 @@
         return JS_TRUE;
     }
 
+    text = JSSTRING_CHARS(str);
+    pat = JSSTRING_CHARS(str2);
     j = 0;
     while (i >= 0) {
         /* Don't assume that text is NUL-terminated: it could be dependent. */
@@ -1708,8 +1708,6 @@
     if ((size_t)i > length)
         return -1;
 
-    chars = JSSTRING_CHARS(str);
-
     /*
      * Match a regular expression against the separator at or above index i.
      * Call js_ExecuteRegExp with true for the test argument.  On successful
@@ -1769,6 +1767,8 @@
     if (sep->length == 0)
         return ((size_t)i == length) ? -1 : i + 1;
 
+    chars = JSSTRING_CHARS(str);
+
     /*
      * Now that we know sep is non-empty, search starting at i in str for an
      * occurrence of all of sep's chars.  If we find them, return the index of
@@ -1811,6 +1811,7 @@
         v = STRING_TO_JSVAL(str);
         ok = OBJ_SET_PROPERTY(cx, arrayobj, INT_TO_JSID(0), &v);
     } else {
+        JSString *str2 = NULL;
         if (JSVAL_IS_REGEXP(cx, vp[2])) {
             re = (JSRegExp *) JS_GetPrivate(cx, JSVAL_TO_OBJECT(vp[2]));
             sep = &tmp;
@@ -1819,20 +1820,11 @@
             sep->chars = NULL;
             sep->length = 0;
         } else {
-            JSString *str2 = js_ValueToString(cx, vp[2]);
+            str2 = js_ValueToString(cx, vp[2]);
             if (!str2)
                 return JS_FALSE;
             vp[2] = STRING_TO_JSVAL(str2);
-
-            /*
-             * Point sep at a local copy of str2's header because find_split
-             * will modify sep->length.
-             */
-            JSSTRING_CHARS_AND_LENGTH(str2, tmp.chars, tmp.length);
-            sep = &tmp;
-            re = NULL;
         }
-
         /* Use the second argument as the split limit, if given. */
         limited = (argc > 1) && !JSVAL_IS_VOID(vp[3]);
         limit = 0; /* Avoid warning. */
@@ -1847,6 +1839,16 @@
                 limit = 1 + JSSTRING_LENGTH(str);
         }
 
+        if (str2) {
+            /*
+             * Point sep at a local copy of str2's header because find_split
+             * will modify sep->length.
+             */
+            JSSTRING_CHARS_AND_LENGTH(str2, tmp.chars, tmp.length);
+            sep = &tmp;
+            re = NULL;
+        }
+
         len = i = 0;
         while ((j = find_split(cx, str, re, &i, sep)) >= 0) {
             if (limited && len >= limit)
--- xulrunner-1.9.0.19.orig/js/src/jsgc.c
+++ xulrunner-1.9.0.19/js/src/jsgc.c
@@ -3519,6 +3519,7 @@
             JS_LOCK_GC(rt);
             JS_UNKEEP_ATOMS(rt);
             JS_POP_TEMP_ROOT(cx, &tvr);
+            cx->weakRoots = savedWeakRoots;
         } else if (gckind == GC_LAST_CONTEXT && rt->gcPoke) {
             /*
              * On shutdown iterate until JSGC_END callback stops creating
--- xulrunner-1.9.0.19.orig/js/src/jsapi.c
+++ xulrunner-1.9.0.19/js/src/jsapi.c
@@ -1554,7 +1554,7 @@
                 if (!atom)
                     return JS_FALSE;
                 if (idstr == ATOM_TO_STRING(atom)) {
-                    stdnm = &standard_class_names[i];
+                    stdnm = &object_prototype_names[i];
                     break;
                 }
             }
@@ -5602,7 +5602,7 @@
     CHECK_REQUEST(cx);
     /* No locking required, cx is thread-private and input must be live. */
     res = &cx->regExpStatics;
-    res->input = input;
+    res->pendingInput = input;
     res->multiline = multiline;
     cx->runtime->gcPoke = JS_TRUE;
 }
@@ -5614,15 +5614,7 @@
 
     /* No locking required, cx is thread-private and input must be live. */
     res = &cx->regExpStatics;
-    res->input = NULL;
-    res->multiline = JS_FALSE;
-    res->parenCount = 0;
-    res->lastMatch = res->lastParen = js_EmptySubString;
-    res->leftContext = res->rightContext = js_EmptySubString;
-    if (res->moreParens) {
-        JS_free(cx, res->moreParens);
-        res->moreParens = NULL;
-    }
+    clearJSRegExpStatics(cx, res);
     cx->runtime->gcPoke = JS_TRUE;
 }
 
@@ -5634,6 +5626,7 @@
     /* No locking required, cx is thread-private and input must be live. */
     res = &cx->regExpStatics;
     res->input = NULL;
+    res->pendingInput = NULL;
     cx->runtime->gcPoke = JS_TRUE;
 }
 
--- xulrunner-1.9.0.19.orig/js/src/jsarray.c
+++ xulrunner-1.9.0.19/js/src/jsarray.c
@@ -619,9 +619,17 @@
 
     if (OBJ_IS_DENSE_ARRAY(cx, obj)) {
         /* Don't reallocate if we're not actually shrinking our slots. */
-        jsuint oldsize = ARRAY_DENSE_LENGTH(obj);
-        if (oldsize >= newlen && !ResizeSlots(cx, obj, oldsize, newlen))
-            return JS_FALSE;
+        jsuint capacity = ARRAY_DENSE_LENGTH(obj);
+        if (capacity > newlen) {
+            jsuint numNonHolesRemoved = 0;
+            jsval *slots;
+            for (slots = obj->dslots + newlen; slots < obj->dslots + capacity; slots++)
+                if (*slots != JSVAL_HOLE)
+                    numNonHolesRemoved++;
+            if (!ResizeSlots(cx, obj, capacity, newlen))
+                return JS_FALSE;
+            obj->fslots[JSSLOT_ARRAY_COUNT] -= numNonHolesRemoved;
+        }
     } else if (oldlen - newlen < (1 << 24)) {
         do {
             --oldlen;
@@ -687,6 +695,8 @@
          obj->dslots[i] == JSVAL_HOLE))
     {
         JSObject *proto = STOBJ_GET_PROTO(obj);
+        JSTempValueRooter root;
+        JSBool rv;
 
         if (!proto) {
             *objp = NULL;
@@ -694,7 +704,10 @@
             return JS_TRUE;
         }
 
-        return OBJ_LOOKUP_PROPERTY(cx, proto, id, objp, propp);
+        JS_PUSH_SINGLE_TEMP_ROOT(cx, proto, &root);
+        rv = OBJ_LOOKUP_PROPERTY(cx, proto, id, objp, propp);
+        JS_POP_TEMP_ROOT(cx, &root);
+        return rv;
     }
 
     /* FIXME 417501: threadsafety: could race with a lookup on another thread.
@@ -2896,7 +2909,8 @@
     jsval *argv, *elemroot, *invokevp, *sp;
     JSBool ok, cond, hole;
     JSObject *callable, *thisp, *newarr;
-    jsint start, end, step, i;
+    jsuint start, end, i;
+    jsint step;
     void *mark;
 
     obj = JS_THIS_OBJECT(cx, vp);
--- xulrunner-1.9.0.19.orig/js/src/jsxml.c
+++ xulrunner-1.9.0.19/js/src/jsxml.c
@@ -6067,7 +6067,8 @@
     nameqn = ToXMLName(cx, name, &funid);
     if (!nameqn)
         return JS_FALSE;
-    vp[2] = OBJECT_TO_JSVAL(nameqn->object);
+    if (argc)
+        vp[2] = OBJECT_TO_JSVAL(nameqn->object);
 
     if (funid)
         return xml_list_helper(cx, xml, vp) != NULL;
@@ -7050,7 +7051,7 @@
     ns = (JSXMLNamespace *) JS_GetPrivate(cx, nsobj);
     ns->declared = JS_TRUE;
 
-    qnargv[0] = vp[2] = OBJECT_TO_JSVAL(nsobj);
+    qnargv[0] = OBJECT_TO_JSVAL(nsobj);
     qnargv[1] = OBJECT_TO_JSVAL(xml->name->object);
     qnobj = js_ConstructObject(cx, &js_QNameClass.base, NULL, NULL, 2, qnargv);
     if (!qnobj)
--- xulrunner-1.9.0.19.orig/js/src/jsapi.h
+++ xulrunner-1.9.0.19/js/src/jsapi.h
@@ -138,34 +138,6 @@
 #define JSFUN_DISJOINT_FLAGS(f) ((f) & 0x0f)
 #define JSFUN_GSFLAGS(f)        ((f) & (JSFUN_GETTER | JSFUN_SETTER))
 
-#ifdef MOZILLA_1_8_BRANCH
-
-/*
- * Squeeze three more bits into existing 8-bit flags by taking advantage of
- * the invalid combination (JSFUN_GETTER | JSFUN_SETTER).
- */
-#define JSFUN_GETTER_TEST(f)       (JSFUN_GSFLAGS(f) == JSFUN_GETTER)
-#define JSFUN_SETTER_TEST(f)       (JSFUN_GSFLAGS(f) == JSFUN_SETTER)
-#define JSFUN_FLAGS_TEST(f,t)      (JSFUN_GSFLAGS(~(f)) ? (f) & (t) : 0)
-#define JSFUN_BOUND_METHOD_TEST(f) JSFUN_FLAGS_TEST(f, JSFUN_BOUND_METHOD)
-#define JSFUN_HEAVYWEIGHT_TEST(f)  JSFUN_FLAGS_TEST(f, JSFUN_HEAVYWEIGHT)
-
-#define JSFUN_GSFLAG2ATTR(f)       (JSFUN_GETTER_TEST(f) ? JSPROP_GETTER :    \
-                                    JSFUN_SETTER_TEST(f) ? JSPROP_SETTER : 0)
-
-#define JSFUN_THISP_FLAGS(f)    (JSFUN_GSFLAGS(~(f)) ? 0 :                    \
-                                 (f) & JSFUN_THISP_PRIMITIVE)
-#define JSFUN_THISP_TEST(f,t)   ((f) == (t) || (f) == JSFUN_THISP_PRIMITIVE)
-
-#define JSFUN_THISP_STRING      0x30    /* |this| may be a primitive string */
-#define JSFUN_THISP_NUMBER      0x70    /* |this| may be a primitive number */
-#define JSFUN_THISP_BOOLEAN     0xb0    /* |this| may be a primitive boolean */
-#define JSFUN_THISP_PRIMITIVE   0xf0    /* |this| may be any primitive value */
-
-#define JSFUN_FLAGS_MASK        0xf8    /* overlay JSFUN_* attributes */
-
-#else
-
 #define JSFUN_GETTER_TEST(f)       ((f) & JSFUN_GETTER)
 #define JSFUN_SETTER_TEST(f)       ((f) & JSFUN_SETTER)
 #define JSFUN_BOUND_METHOD_TEST(f) ((f) & JSFUN_BOUND_METHOD)
@@ -191,8 +163,6 @@
                                            instead of defaulting to class gsops
                                            for property holding function */
 
-#endif
-
 /*
  * Re-use JSFUN_LAMBDA, which applies only to scripted functions, for use in
  * JSFunctionSpec arrays that specify generic native prototype methods, i.e.,
@@ -1433,11 +1403,6 @@
 struct JSFunctionSpec {
     const char      *name;
     JSNative        call;
-#ifdef MOZILLA_1_8_BRANCH
-    uint8           nargs;
-    uint8           flags;
-    uint16          extra;
-#else
     uint16          nargs;
     uint16          flags;
 
@@ -1448,7 +1413,6 @@
      *                  If fast native, minimum required argc.
      */
     uint32          extra;
-#endif
 };
 
 /*
--- xulrunner-1.9.0.19.orig/js/src/jsregexp.c
+++ xulrunner-1.9.0.19/js/src/jsregexp.c
@@ -2746,7 +2746,7 @@
     jsbytecode *nextpc, *testpc;
     REOp nextop;
     RECapture *cap;
-    REProgState *curState;
+    REProgState *curState=NULL;
     const jschar *startcp;
     size_t parenIndex, k;
     size_t parenSoFar = 0;
@@ -2869,7 +2869,8 @@
                 if (!result)
                     result = x;
 
-                --gData->stateStackTop;
+                if(gData->stateStackTop)
+                    --gData->stateStackTop;
                 pc += GET_OFFSET(pc);
                 op = (REOp) *pc++;
                 continue;
@@ -2885,7 +2886,8 @@
                 if (!result)
                     result = x;
 
-                --gData->stateStackTop;
+                if(gData->stateStackTop)
+                    --gData->stateStackTop;
                 op = (REOp) *pc++;
                 continue;
 
@@ -2962,7 +2964,8 @@
                 continue;
 
               case REOP_ASSERTTEST:
-                --gData->stateStackTop;
+                if(gData->stateStackTop)
+                    --gData->stateStackTop;
                 --curState;
                 x->cp = gData->cpbegin + curState->index;
                 gData->backTrackSP =
@@ -2974,7 +2977,8 @@
                 break;
 
               case REOP_ASSERTNOTTEST:
-                --gData->stateStackTop;
+                if(gData->stateStackTop)
+                    --gData->stateStackTop;
                 --curState;
                 x->cp = gData->cpbegin + curState->index;
                 gData->backTrackSP =
@@ -3050,7 +3054,8 @@
               case REOP_REPEAT:
                 --curState;
                 do {
-                    --gData->stateStackTop;
+                    if(gData->stateStackTop)
+                        --gData->stateStackTop;
                     if (!result) {
                         /* Failed, see if we have enough children. */
                         if (curState->u.quantifier.min == 0)
@@ -3138,14 +3143,16 @@
                                             pc, x, x->cp, 0, 0)) {
                         goto bad;
                     }
-                    --gData->stateStackTop;
+                    if(gData->stateStackTop)
+                        --gData->stateStackTop;
                     pc = pc + GET_OFFSET(pc);
                     op = (REOp) *pc++;
                 }
                 continue;
 
               case REOP_MINIMALREPEAT:
-                --gData->stateStackTop;
+                if(gData->stateStackTop)
+                    --gData->stateStackTop;
                 --curState;
 
                 re_debug("{%d,%d}", curState->u.quantifier.min,
@@ -3199,7 +3206,8 @@
                                         parenSoFar - curState->parenSoFar)) {
                     goto bad;
                 }
-                --gData->stateStackTop;
+                if(gData->stateStackTop)
+                    --gData->stateStackTop;
                 pc = pc + GET_OFFSET(pc);
                 op = (REOp) *pc++;
                 JS_ASSERT(op < REOP_LIMIT);
@@ -3242,6 +3250,7 @@
             op = (REOp) backTrackData->backtrack_op;
             JS_ASSERT(op < REOP_LIMIT);
             gData->stateStackTop = backTrackData->saveStateStackTop;
+
             JS_ASSERT(gData->stateStackTop);
 
             memcpy(gData->stateStack, backTrackData + 1,
@@ -3370,6 +3379,21 @@
     return NULL;
 }
 
+void
+clearJSRegExpStatics(JSContext *cx, JSRegExpStatics *statics)
+{
+    statics->input = NULL;
+    statics->pendingInput = NULL;
+    statics->multiline = JS_FALSE;
+    statics->parenCount = 0;
+    statics->lastMatch = statics->lastParen = js_EmptySubString;
+    statics->leftContext = statics->rightContext = js_EmptySubString;
+    if (statics->moreParens) {
+        JS_free(cx, statics->moreParens);
+        statics->moreParens = NULL;
+    }
+}
+
 JSBool
 js_ExecuteRegExp(JSContext *cx, JSRegExp *re, JSString *str, size_t *indexp,
                  JSBool test, jsval *rval)
@@ -3381,7 +3405,7 @@
     size_t i, length, start;
     JSSubString *morepar;
     JSBool ok;
-    JSRegExpStatics *res;
+    JSRegExpStatics *res = NULL;
     ptrdiff_t matchlen;
     uintN num, morenum;
     JSString *parstr, *matchstr;
@@ -3483,7 +3507,7 @@
     }
 
     res = &cx->regExpStatics;
-    res->input = str;
+    res->pendingInput = res->input = str;
     res->parenCount = re->parenCount;
     if (re->parenCount == 0) {
         res->lastParen = js_EmptySubString;
@@ -3586,6 +3610,8 @@
     res->rightContext.length = gData.cpend - ep;
 
 out:
+    if (!ok && res)
+        clearJSRegExpStatics(cx, res);
     JS_FinishArenaPool(&gData.pool);
     return ok;
 }
@@ -3709,10 +3735,11 @@
 
 JS_FRIEND_API(void)
 js_SaveAndClearRegExpStatics(JSContext *cx, JSRegExpStatics *statics,
-                             JSTempValueRooter *tvr)
+                             JSTempValueRooter *tvr, JSTempValueRooter *tvr2)
 {
     *statics = cx->regExpStatics;
     JS_PUSH_TEMP_ROOT_STRING(cx, statics->input, tvr);
+    JS_PUSH_TEMP_ROOT_STRING(cx, statics->pendingInput, tvr2);
     /*
      * Prevent JS_ClearRegExpStatics from freeing moreParens, since we've only
      * moved it elsewhere (into statics->moreParens).
@@ -3723,11 +3750,12 @@
 
 JS_FRIEND_API(void)
 js_RestoreRegExpStatics(JSContext *cx, JSRegExpStatics *statics,
-                        JSTempValueRooter *tvr)
+                        JSTempValueRooter *tvr, JSTempValueRooter *tvr2)
 {
     /* Clear/free any new JSRegExpStatics data before clobbering. */
     JS_ClearRegExpStatics(cx);
     cx->regExpStatics = *statics;
+    JS_POP_TEMP_ROOT(cx, tvr2);
     JS_POP_TEMP_ROOT(cx, tvr);
 }
 
@@ -3738,6 +3766,8 @@
 
     if (res->input)
         JS_CALL_STRING_TRACER(trc, res->input, "res->input");
+    if (res->pendingInput)
+        JS_CALL_STRING_TRACER(trc, res->pendingInput, "res->pendingInput");
 }
 
 void
@@ -3760,8 +3790,8 @@
     slot = JSVAL_TO_INT(id);
     switch (slot) {
       case REGEXP_STATIC_INPUT:
-        *vp = res->input ? STRING_TO_JSVAL(res->input)
-                         : JS_GetEmptyStringValue(cx);
+        *vp = res->pendingInput ? STRING_TO_JSVAL(res->pendingInput)
+                                : JS_GetEmptyStringValue(cx);
         return JS_TRUE;
       case REGEXP_STATIC_MULTILINE:
         *vp = BOOLEAN_TO_JSVAL(res->multiline);
@@ -3803,7 +3833,7 @@
             !JS_ConvertValue(cx, *vp, JSTYPE_STRING, vp)) {
             return JS_FALSE;
         }
-        res->input = JSVAL_TO_STRING(*vp);
+        res->pendingInput = JSVAL_TO_STRING(*vp);
     } else if (JSVAL_TO_INT(id) == REGEXP_STATIC_MULTILINE) {
         if (!JSVAL_IS_BOOLEAN(*vp) &&
             !JS_ConvertValue(cx, *vp, JSTYPE_BOOLEAN, vp)) {
@@ -4193,7 +4223,7 @@
 
     /* Now that obj is unlocked, it's safe to (potentially) grab the GC lock. */
     if (argc == 0) {
-        str = cx->regExpStatics.input;
+        str = cx->regExpStatics.pendingInput;
         if (!str) {
             const char *bytes = js_GetStringBytes(cx, re->source);
 
--- xulrunner-1.9.0.19.orig/js/src/jslock.c
+++ xulrunner-1.9.0.19/js/src/jslock.c
@@ -48,6 +48,8 @@
 #include "jspubtd.h"
 #include "jsutil.h" /* Added by JSIFY */
 #include "jstypes.h"
+#include "jsapi.h"
+#include "jsarray.h"
 #include "jsbit.h"
 #include "jscntxt.h"
 #include "jsdtoa.h"
@@ -355,7 +357,10 @@
     obj = scope->object;
     if (obj) {
         nslots = scope->map.freeslot;
-        for (i = 0; i != nslots; ++i) {
+        i = (STOBJ_GET_CLASS(obj) == &js_SlowArrayClass)
+            ? JSSLOT_PRIVATE + 1
+            : JSSLOT_PRIVATE;
+        for (; i < nslots; ++i) {
             v = STOBJ_GET_SLOT(obj, i);
             if (JSVAL_IS_STRING(v) &&
                 !js_MakeStringImmutable(cx, JSVAL_TO_STRING(v))) {
--- xulrunner-1.9.0.19.orig/js/src/jsscan.c
+++ xulrunner-1.9.0.19/js/src/jsscan.c
@@ -1088,6 +1088,7 @@
                 c = GetChar(ts);
             } while (JS_ISXMLSPACE(c));
             UngetChar(ts, c);
+            tp->pos.end.lineno = ts->lineno;
             tt = TOK_XMLSPACE;
             goto out;
         }
--- xulrunner-1.9.0.19.orig/js/src/js.c
+++ xulrunner-1.9.0.19/js/src/js.c
@@ -132,8 +132,8 @@
 
 #ifdef EDITLINE
 JS_BEGIN_EXTERN_C
-extern char     *readline(const char *prompt);
-extern void     add_history(char *line);
+extern JS_EXPORT_API(char)     *readline(const char *prompt);
+extern JS_EXPORT_API(void)     add_history(char *line);
 JS_END_EXTERN_C
 #endif
 
--- xulrunner-1.9.0.19.orig/js/src/jsparse.c
+++ xulrunner-1.9.0.19/js/src/jsparse.c
@@ -800,7 +800,7 @@
 }
 
 static JSBool
-ReportBadReturn(JSContext *cx, JSTreeContext *tc, uintN flags, uintN errnum,
+ReportBadReturn(JSContext *cx, JSTreeContext *tc, JSParseNode *pn, uintN flags, uintN errnum,
                 uintN anonerrnum)
 {
     const char *name;
@@ -812,7 +812,7 @@
         errnum = anonerrnum;
         name = NULL;
     }
-    return js_ReportCompileErrorNumber(cx, TS(tc->parseContext), NULL, flags,
+    return js_ReportCompileErrorNumber(cx, TS(tc->parseContext), pn, flags,
                                        errnum, name);
 }
 
@@ -821,7 +821,7 @@
 {
     JS_ASSERT(tc->flags & TCF_IN_FUNCTION);
     return HasFinalReturn(pn) == ENDS_IN_RETURN ||
-           ReportBadReturn(cx, tc, JSREPORT_WARNING | JSREPORT_STRICT,
+           ReportBadReturn(cx, tc, pn, JSREPORT_WARNING | JSREPORT_STRICT,
                            JSMSG_NO_RETURN_VALUE, JSMSG_ANON_NO_RETURN_VALUE);
 }
 
@@ -856,7 +856,7 @@
                 pn = NULL;
             } else {
                 if (tc->flags & TCF_FUN_IS_GENERATOR) {
-                    ReportBadReturn(cx, tc, JSREPORT_ERROR,
+                    ReportBadReturn(cx, tc, pn, JSREPORT_ERROR,
                                     JSMSG_BAD_GENERATOR_RETURN,
                                     JSMSG_BAD_ANON_GENERATOR_RETURN);
                     pn = NULL;
@@ -1839,7 +1839,13 @@
         /* FALL THROUGH */
       case TOK_DOT:
       case TOK_LB:
-        pn->pn_op = JSOP_SETNAME;
+        /*
+         * We may be called on a name node that has already been specialized,
+         * in the very weird and ECMA-262-required "for (var [x] = i in o) ..."
+         * case. See bug 558633.
+         */
+        if (!(js_CodeSpec[pn->pn_op].format & JOF_SET))
+            pn->pn_op = JSOP_SETNAME;
         break;
 
 #if JS_HAS_LVALUE_RETURN
@@ -2292,7 +2298,7 @@
 
     if ((~tc->flags & (TCF_RETURN_EXPR | TCF_FUN_IS_GENERATOR)) == 0) {
         /* As in Python (see PEP-255), disallow return v; in generators. */
-        ReportBadReturn(cx, tc, JSREPORT_ERROR,
+        ReportBadReturn(cx, tc, pn, JSREPORT_ERROR,
                         JSMSG_BAD_GENERATOR_RETURN,
                         JSMSG_BAD_ANON_GENERATOR_RETURN);
         return NULL;
@@ -2300,7 +2306,7 @@
 
     if (JS_HAS_STRICT_OPTION(cx) &&
         (~tc->flags & (TCF_RETURN_EXPR | TCF_RETURN_VOID)) == 0 &&
-        !ReportBadReturn(cx, tc, JSREPORT_WARNING | JSREPORT_STRICT,
+        !ReportBadReturn(cx, tc, pn, JSREPORT_WARNING | JSREPORT_STRICT,
                          JSMSG_NO_RETURN_VALUE,
                          JSMSG_ANON_NO_RETURN_VALUE)) {
         return NULL;
--- xulrunner-1.9.0.19.orig/js/src/jsregexp.h
+++ xulrunner-1.9.0.19/js/src/jsregexp.h
@@ -54,6 +54,7 @@
 
 struct JSRegExpStatics {
     JSString    *input;         /* input string to match (perl $_, GC root) */
+    JSString    *pendingInput;  /* pending input string to match */
     JSBool      multiline;      /* whether input contains newlines (perl $*) */
     uint16      parenCount;     /* number of valid elements in parens[] */
     uint16      moreLength;     /* number of allocated elements in moreParens */
@@ -65,13 +66,15 @@
     JSSubString rightContext;   /* input to right of last match (perl $') */
 };
 
+extern void clearJSRegExpStatics(JSContext *cx, JSRegExpStatics *statics);
+
 extern JS_FRIEND_API(void)
 js_SaveAndClearRegExpStatics(JSContext *cx, JSRegExpStatics *statics,
-                             JSTempValueRooter *tvr);
+                             JSTempValueRooter *tvr, JSTempValueRooter *tvr2);
 
 extern JS_FRIEND_API(void)
 js_RestoreRegExpStatics(JSContext *cx, JSRegExpStatics *statics,
-                        JSTempValueRooter *tvr);
+                        JSTempValueRooter *tvr, JSTempValueRooter *tvr2);
 
 /*
  * This struct holds a bitmap representation of a class from a regexp.
--- xulrunner-1.9.0.19.orig/js/src/jsdbgapi.c
+++ xulrunner-1.9.0.19/js/src/jsdbgapi.c
@@ -789,17 +789,18 @@
             attrs = sprop->attrs;
             flags = sprop->flags;
             shortid = sprop->shortid;
+            JS_UNLOCK_OBJ(cx, pobj);
         } else {
+            OBJ_DROP_PROPERTY(cx, pobj, prop);
+
             if (!OBJ_GET_PROPERTY(cx, pobj, propid, &value) ||
                 !OBJ_GET_ATTRIBUTES(cx, pobj, propid, prop, &attrs)) {
-                OBJ_DROP_PROPERTY(cx, pobj, prop);
                 return JS_FALSE;
             }
             getter = setter = NULL;
             flags = 0;
             shortid = 0;
         }
-        OBJ_DROP_PROPERTY(cx, pobj, prop);
 
         /* Recall that obj is native, whether or not pobj is native. */
         if (!js_DefineNativeProperty(cx, obj, propid, value, getter, setter,
--- xulrunner-1.9.0.19.orig/js/src/liveconnect/jsj_JavaObject.c
+++ xulrunner-1.9.0.19/js/src/liveconnect/jsj_JavaObject.c
@@ -841,6 +841,7 @@
             *objp = obj;
             *propp = (JSProperty*)1;
         }
+        js_SetObjectWeakRoot(cx, *objp);
     } else {
         *objp = NULL;
         *propp = NULL;
--- xulrunner-1.9.0.19.orig/js/src/liveconnect/Makefile.in
+++ xulrunner-1.9.0.19/js/src/liveconnect/Makefile.in
@@ -63,6 +63,8 @@
 		  caps \
 		  necko \
 		  string \
+		  plugin \
+		  oji \
 		  $(NULL)
 
 CSRCS		= \
--- xulrunner-1.9.0.19.orig/js/src/liveconnect/jsj_JavaClass.c
+++ xulrunner-1.9.0.19/js/src/liveconnect/jsj_JavaClass.c
@@ -321,6 +321,7 @@
     if (lookup_static_member_by_id(cx, jEnv, obj, NULL, id, NULL)) {
         *objp = obj;
         *propp = (JSProperty*)1;
+        js_SetObjectWeakRoot(cx, obj);
     } else {
         *objp = NULL;
         *propp = NULL;
--- xulrunner-1.9.0.19.orig/js/src/liveconnect/nsCLiveconnect.cpp
+++ xulrunner-1.9.0.19/js/src/liveconnect/nsCLiveconnect.cpp
@@ -63,6 +63,8 @@
 #include "nsISecurityContext.h"
 #include "nsIServiceManager.h"
 #include "nsIJSContextStack.h"
+#include "nsJVMManager.h"
+#include "nsIPluginInstancePeer2.h"
 
 PR_BEGIN_EXTERN_C
 
@@ -220,6 +222,48 @@
     JS_EndRequest(mContext);
 }
 
+// nsILiveconnect methods (which constitute OJI's Java-to-JavaScript API) may
+// call back into Java (using the OJI plugin's implementation of the
+// nsISecureEnv interface).  But these nsISecureEnv methods assume there is
+// JavaScript on the stack, and Java code can call nsILiveconnect methods
+// "spontaneously" (without any JavaScript on the stack).  So the
+// nsCLiveconnect methods below (those that implement the nsILiveconnect
+// interface) always create an AutoPushJSContext object, which guarantees the
+// presence on the JavaScript stack of at least a dummy frame with a principal.
+//
+// Ordinarily we rely on jsj_enter_js() to tell us which JSContext to pass to
+// the AutoPushJSContext constructor, and really only need to create an
+// AutoPushJSContext object after jsj_enter_js() has returned.  But the first
+// time jsj_enter_js() is called we initialize a bunch of Java classes and
+// their methods and fields (in jsj.c's init_netscape_java_classes() and
+// init_java_VM_reflection()).  This involves calling into Java, and thus
+// using the plugin's nsISecureEnv methods -- which assume there is JavaScript
+// on the stack.
+//
+// So to deal with this edge case (to make sure jsj_enter_js() behaves
+// properly the first time it's called) we need to create an AutoPushJSContext
+// object *before* calling jsj_enter_js() -- which requires that we know which
+// JSContex to pass to the AutoPushJSContext constructor before the call to
+// jsj_enter_js();
+//
+// That's what this function does -- it tells us which JSContext the call to
+// jsj_enter_js() will return (as a result of indirectly calling
+// map_jsj_thread_to_js_context_impl() in lcglue.cpp).
+static JSContext* JSContextForPluginInstance(nsIPluginInstance* pluginInstance)
+{
+    JSContext* context = NULL;
+	if (pluginInstance) {
+        nsCOMPtr<nsIPluginInstancePeer> pluginPeer;
+        if (NS_SUCCEEDED(pluginInstance->GetPeer(getter_AddRefs(pluginPeer)))) {
+            nsresult rv;
+            nsCOMPtr<nsIPluginInstancePeer2> pluginPeer2 = do_QueryInterface(pluginPeer, &rv);
+            if (NS_SUCCEEDED(rv)) {
+                pluginPeer2->GetJSContext(&context);
+            }
+        }
+    }
+    return context;
+}
 
 ////////////////////////////////////////////////////////////////////////////
 // from nsISupports and AggregatedQueryInterface:
@@ -266,13 +310,17 @@
     JSBool             dummy_bool     = PR_FALSE;
     JSErrorReporter    saved_state    = NULL;
 
-    jsj_env = jsj_enter_js(jEnv, mJavaClient, NULL, &cx, NULL, &saved_state, principalsArray, numPrincipals, securitySupports);
-    if (!jsj_env)
+    cx = JSContextForPluginInstance(reinterpret_cast<nsIPluginInstance*>(mJavaClient));
+    if (!cx)
         return NS_ERROR_FAILURE;
 
     AutoPushJSContext autopush(securitySupports, cx);
     if (NS_FAILED(autopush.ResultOfPush()))
-        goto done;
+        return NS_ERROR_FAILURE;
+
+    jsj_env = jsj_enter_js(jEnv, mJavaClient, NULL, &cx, NULL, &saved_state, principalsArray, numPrincipals, securitySupports);
+    if (!jsj_env)
+        return NS_ERROR_FAILURE;
 
     if (!name) {
         JS_ReportError(cx, "illegal null member name");
@@ -324,14 +372,18 @@
     JSBool             dummy_bool     = PR_FALSE;
     JSErrorReporter    saved_state    = NULL;
 
+    cx = JSContextForPluginInstance(reinterpret_cast<nsIPluginInstance*>(mJavaClient));
+    if (!cx)
+        return NS_ERROR_FAILURE;
+
+    AutoPushJSContext autopush(securitySupports, cx);
+    if (NS_FAILED(autopush.ResultOfPush()))
+        return NS_ERROR_FAILURE;
+
     jsj_env = jsj_enter_js(jEnv, mJavaClient, NULL, &cx, NULL, &saved_state, principalsArray, numPrincipals, securitySupports);
     if (!jsj_env)
        return NS_ERROR_FAILURE;
 
-    AutoPushJSContext autopush(securitySupports, cx);
-    if (NS_FAILED(autopush.ResultOfPush()))
-        goto done;
-    
     // =-= sudu: check to see if slot can be passed in as is.
     //           Should it be converted to a jsint?
     if (!JS_GetElement(cx, js_obj, slot, &js_val))
@@ -374,14 +426,18 @@
     jsval              js_val;
     JSErrorReporter    saved_state    = NULL;
 
-    jsj_env = jsj_enter_js(jEnv, mJavaClient, NULL, &cx, NULL, &saved_state, principalsArray, numPrincipals, securitySupports);
-    if (!jsj_env)
+    cx = JSContextForPluginInstance(reinterpret_cast<nsIPluginInstance*>(mJavaClient));
+    if (!cx)
         return NS_ERROR_FAILURE;
 
     AutoPushJSContext autopush(securitySupports, cx);
     if (NS_FAILED(autopush.ResultOfPush()))
-        goto done;
-    
+        return NS_ERROR_FAILURE;
+
+    jsj_env = jsj_enter_js(jEnv, mJavaClient, NULL, &cx, NULL, &saved_state, principalsArray, numPrincipals, securitySupports);
+    if (!jsj_env)
+        return NS_ERROR_FAILURE;
+
     if (!name) {
         JS_ReportError(cx, "illegal null member name");
         goto done;
@@ -424,14 +480,18 @@
     jsval              js_val;
     JSErrorReporter    saved_state    = NULL;
 
-    jsj_env = jsj_enter_js(jEnv, mJavaClient, NULL, &cx, NULL, &saved_state, principalsArray, numPrincipals, securitySupports);
-    if (!jsj_env)
+    cx = JSContextForPluginInstance(reinterpret_cast<nsIPluginInstance*>(mJavaClient));
+    if (!cx)
         return NS_ERROR_FAILURE;
 
     AutoPushJSContext autopush(securitySupports, cx);
     if (NS_FAILED(autopush.ResultOfPush()))
-        goto done;
-    
+        return NS_ERROR_FAILURE;
+
+    jsj_env = jsj_enter_js(jEnv, mJavaClient, NULL, &cx, NULL, &saved_state, principalsArray, numPrincipals, securitySupports);
+    if (!jsj_env)
+        return NS_ERROR_FAILURE;
+
     if (!jsj_ConvertJavaObjectToJSValue(cx, jEnv, java_obj, &js_val))
         goto done;
     JS_SetElement(cx, js_obj, slot, &js_val);
@@ -465,14 +525,18 @@
     jsval              js_val;
     JSErrorReporter    saved_state    = NULL;
 
-    jsj_env = jsj_enter_js(jEnv, mJavaClient, NULL, &cx, NULL, &saved_state, principalsArray, numPrincipals, securitySupports);
-    if (!jsj_env)
+    cx = JSContextForPluginInstance(reinterpret_cast<nsIPluginInstance*>(mJavaClient));
+    if (!cx)
         return NS_ERROR_FAILURE;
 
     AutoPushJSContext autopush(securitySupports, cx);
     if (NS_FAILED(autopush.ResultOfPush()))
-        goto done;
-    
+        return NS_ERROR_FAILURE;
+
+    jsj_env = jsj_enter_js(jEnv, mJavaClient, NULL, &cx, NULL, &saved_state, principalsArray, numPrincipals, securitySupports);
+    if (!jsj_env)
+        return NS_ERROR_FAILURE;
+
     if (!name) {
         JS_ReportError(cx, "illegal null member name");
         goto done;
@@ -519,15 +583,20 @@
     JSErrorReporter    saved_state    = NULL;
     jobject            result         = NULL;
 
+    cx = JSContextForPluginInstance(reinterpret_cast<nsIPluginInstance*>(mJavaClient));
+    if (!cx)
+        return NS_ERROR_FAILURE;
+
+    AutoPushJSContext autopush(securitySupports, cx);
+    if (NS_FAILED(autopush.ResultOfPush()))
+        return NS_ERROR_FAILURE;
+
     jsj_env = jsj_enter_js(jEnv, mJavaClient, NULL, &cx, NULL, &saved_state, principalsArray, numPrincipals, securitySupports);
     if (!jsj_env)
         return NS_ERROR_FAILURE;
 
     result = NULL;
-    AutoPushJSContext autopush(securitySupports, cx);
-    if (NS_FAILED(autopush.ResultOfPush()))
-        goto done;
-    
+
     if (!name) {
         JS_ReportError(cx, "illegal null JavaScript function name");
         goto done;
@@ -601,15 +670,20 @@
     JSPrincipals      *principals     = NULL;
     JSBool             eval_succeeded = PR_FALSE;
 
+    cx = JSContextForPluginInstance(reinterpret_cast<nsIPluginInstance*>(mJavaClient));
+    if (!cx)
+        return NS_ERROR_FAILURE;
+
+    AutoPushJSContext autopush(securitySupports, cx);
+    if (NS_FAILED(autopush.ResultOfPush()))
+        return NS_ERROR_FAILURE;
+
     jsj_env = jsj_enter_js(jEnv, mJavaClient, NULL, &cx, NULL, &saved_state, principalsArray, numPrincipals, securitySupports);
     if (!jsj_env)
        return NS_ERROR_FAILURE;
 
     result = NULL;
-    AutoPushJSContext autopush(securitySupports, cx);
-    if (NS_FAILED(autopush.ResultOfPush()))
-        goto done;
-    
+
     if (!script) {
         JS_ReportError(cx, "illegal null string eval argument");
         goto done;
@@ -672,15 +746,20 @@
     JSJavaThreadState *jsj_env        = NULL;
     JSObjectHandle    *handle         = NULL;
 
+    cx = JSContextForPluginInstance(reinterpret_cast<nsIPluginInstance*>(mJavaClient));
+    if (!cx)
+        return NS_ERROR_FAILURE;
+
+    AutoPushJSContext autopush(securitySupports, cx);
+    if (NS_FAILED(autopush.ResultOfPush()))
+        return NS_ERROR_FAILURE;
+
     jsj_env = jsj_enter_js(jEnv, mJavaClient, NULL, &cx, NULL, &saved_state, principalsArray, numPrincipals, securitySupports);
     if (!jsj_env)
        return NS_ERROR_FAILURE;
 
     err_msg = NULL;
-    AutoPushJSContext autopush(securitySupports, cx);
-    if (NS_FAILED(autopush.ResultOfPush()))
-        goto done;
-    
+
     js_obj = JSJ_callbacks->map_java_object_to_js_object(jEnv, mJavaClient, &err_msg);
     if (!js_obj) {
         if (err_msg) {
@@ -753,14 +832,19 @@
     jstring            result         = NULL;
     JSString          *jsstr          = NULL;
 
+    cx = JSContextForPluginInstance(reinterpret_cast<nsIPluginInstance*>(mJavaClient));
+    if (!cx)
+        return NS_ERROR_FAILURE;
+
+    AutoPushJSContext autopush(nsnull, cx);
+    if (NS_FAILED(autopush.ResultOfPush()))
+        return NS_ERROR_FAILURE;
+
     jsj_env = jsj_enter_js(jEnv, mJavaClient, NULL, &cx, NULL, &saved_state, NULL, 0, NULL );
     if (!jsj_env)
        return NS_ERROR_FAILURE;
 
     result = NULL;
-    AutoPushJSContext autopush(nsnull, cx);
-    if (NS_FAILED(autopush.ResultOfPush()))
-        return NS_ERROR_FAILURE;
 
     jsstr = JS_ValueToString(cx, OBJECT_TO_JSVAL(js_obj));
     if (jsstr)
--- xulrunner-1.9.0.19.orig/js/src/liveconnect/jsj_JavaArray.c
+++ xulrunner-1.9.0.19/js/src/liveconnect/jsj_JavaArray.c
@@ -254,6 +254,7 @@
     if (access_java_array_element(cx, jEnv, obj, id, NULL, JS_FALSE)) {
         *objp = obj;
         *propp = (JSProperty*)1;
+        js_SetObjectWeakRoot(cx, obj);
     } else {
         *objp = NULL;
         *propp = NULL;
--- xulrunner-1.9.0.19.orig/js/src/xpconnect/idl/nsIXPConnect.idl
+++ xulrunner-1.9.0.19/js/src/xpconnect/idl/nsIXPConnect.idl
@@ -606,9 +606,9 @@
                                  in JSObjectPtr  aNewParent,
                                  in nsISupports  aCOMObj);
     void
-    reparentScopeAwareWrappers(in JSContextPtr aJSContext,
-                               in JSObjectPtr  aOldScope,
-                               in JSObjectPtr  aNewScope);
+    moveWrappers(in JSContextPtr aJSContext,
+                 in JSObjectPtr  aOldScope,
+                 in JSObjectPtr  aNewScope);
 
     void clearAllWrappedNativeSecurityPolicies();
 
--- xulrunner-1.9.0.19.orig/js/src/xpconnect/src/nsXPConnect.cpp
+++ xulrunner-1.9.0.19/js/src/xpconnect/src/nsXPConnect.cpp
@@ -1523,11 +1523,11 @@
     return JS_DHASH_NEXT;
 }
 
-/* void reparentScopeAwareWrappers(in JSContextPtr aJSContext, in JSObjectPtr  aOldScope, in JSObjectPtr  aNewScope); */
+/* void moveWrappers(in JSContextPtr aJSContext, in JSObjectPtr  aOldScope, in JSObjectPtr  aNewScope); */
 NS_IMETHODIMP
-nsXPConnect::ReparentScopeAwareWrappers(JSContext *aJSContext,
-                                        JSObject *aOldScope,
-                                        JSObject *aNewScope)
+nsXPConnect::MoveWrappers(JSContext *aJSContext,
+                          JSObject *aOldScope,
+                          JSObject *aNewScope)
 {
     XPCCallContext ccx(NATIVE_CALLER, aJSContext);
     if(!ccx.IsValid())
@@ -1585,35 +1585,41 @@
         if(NS_FAILED(rv))
             return NS_ERROR_FAILURE;
 
+        JSObject *newParent = aOldScope;
+
         // If the wrapper doesn't want precreate, then we don't need to
         // worry about reparenting it.
         if(!sciWrapper.GetFlags().WantPreCreate())
             continue;
 
-        JSObject *newParent = aOldScope;
         rv = sciWrapper.GetCallback()->PreCreate(identity, ccx, aOldScope,
                                                  &newParent);
         if(NS_FAILED(rv))
             return rv;
 
-        if(newParent != aOldScope)
+        if(newParent == aOldScope)
         {
-            // The wrapper returned a new parent. If the new parent is in
-            // a different scope, then we need to reparent it, otherwise,
-            // the old scope is fine.
-
-            XPCWrappedNativeScope *betterScope =
-                XPCWrappedNativeScope::FindInJSObjectScope(ccx, newParent);
-            if(betterScope == oldScope)
-                continue;
-
-            NS_ASSERTION(betterScope == newScope, "Weird scope returned");
+            // The old scope still works for this wrapper. We have to assume
+            // that the wrapper will continue to return the old scope from
+            // PreCreate, so don't move it.
+            continue;
         }
-        else
+
+        // The wrapper returned a new parent. If the new parent is in
+        // a different scope, then we need to reparent it, otherwise,
+        // the old scope is fine.
+
+        XPCWrappedNativeScope *betterScope =
+            XPCWrappedNativeScope::FindInJSObjectScope(ccx, newParent);
+        if(betterScope == oldScope)
         {
-            // The old scope still works for this wrapper.
-            continue;
+            // The wrapper asked for a different object, but that object
+            // was in the same scope. We assume here that the new parent
+            // simply hasn't been reparented yet.
+            newParent = nsnull;
         }
+        else
+            NS_ASSERTION(betterScope == newScope, "Weird scope returned");
 
         // Now, reparent the wrapper, since we know that it wants to be
         // reparented.
--- xulrunner-1.9.0.19.orig/js/src/xpconnect/src/xpcwrappednative.cpp
+++ xulrunner-1.9.0.19/js/src/xpconnect/src/xpcwrappednative.cpp
@@ -1299,7 +1299,7 @@
 
     // Now we can just fix up the parent and return the wrapper
 
-    if(!JS_SetParent(ccx, wrapper->GetFlatJSObject(), aNewParent))
+    if(aNewParent && !JS_SetParent(ccx, wrapper->GetFlatJSObject(), aNewParent))
     {
         NS_RELEASE(wrapper);
         return NS_ERROR_FAILURE;
--- xulrunner-1.9.0.19.orig/js/src/xpconnect/src/xpcwrappedjsclass.cpp
+++ xulrunner-1.9.0.19/js/src/xpconnect/src/xpcwrappedjsclass.cpp
@@ -263,6 +263,28 @@
     jsid funid;
     jsval fun;
 
+    // Don't call the actual function on a content object. We'll determine
+    // whether or not a content object is capable of implementing the
+    // interface (i.e. whether the interface is scriptable) and most content
+    // objects don't have QI implementations anyway. Also see bug 503926.
+    if(!STOBJ_IS_SYSTEM(JS_GetGlobalForObject(ccx, jsobj)))
+    {
+        nsCOMPtr<nsIPrincipal> objprin;
+        nsIScriptSecurityManager *ssm = XPCWrapper::GetSecurityManager();
+        if(ssm)
+        {
+            nsresult rv = ssm->GetObjectPrincipal(ccx, jsobj, getter_AddRefs(objprin));
+            NS_ENSURE_SUCCESS(rv, nsnull);
+
+            PRBool isSystem;
+            rv = ssm->IsSystemPrincipal(objprin, &isSystem);
+            NS_ENSURE_SUCCESS(rv, nsnull);
+
+            if(!isSystem)
+                return nsnull;
+        }
+    }
+
     // check upfront for the existence of the function property
     funid = mRuntime->GetStringID(XPCJSRuntime::IDX_QUERY_INTERFACE);
     if(!OBJ_GET_PROPERTY(cx, jsobj, funid, &fun) || JSVAL_IS_PRIMITIVE(fun))
@@ -1207,6 +1229,17 @@
     xpcc->SetException(nsnull);
     ccx.GetThreadData()->SetException(nsnull);
 
+    if(XPCPerThreadData::IsMainThread(ccx))
+    {
+        ssm = XPCWrapper::GetSecurityManager();
+        if(ssm && !PushObjectPrincipal(cx, obj, ssm, &popPrincipal))
+        {
+            JS_ReportOutOfMemory(cx);
+            retval = NS_ERROR_OUT_OF_MEMORY;
+            goto pre_call_clean_up;
+        }
+    }
+
     // We use js_AllocStack, js_Invoke, and js_FreeStack so that the gcthings
     // we use as args will be rooted by the engine as we do conversions and
     // prepare to do the function call. This adds a fair amount of complexity,
@@ -1548,17 +1581,6 @@
 
     JS_ClearPendingException(cx);
 
-    if(XPCPerThreadData::IsMainThread(ccx))
-    {
-        ssm = XPCWrapper::GetSecurityManager();
-        if(ssm && !PushObjectPrincipal(cx, obj, ssm, &popPrincipal))
-        {
-            JS_ReportOutOfMemory(cx);
-            retval = NS_ERROR_OUT_OF_MEMORY;
-            goto done;
-        }
-    }
-
     if(XPT_MD_IS_GETTER(info->flags))
         success = JS_GetProperty(cx, obj, name, &result);
     else if(XPT_MD_IS_SETTER(info->flags))
@@ -1595,9 +1617,6 @@
         }
     }
 
-    if(popPrincipal)
-        ssm->PopContextPrincipal(ccx);
-
     if(!success)
     {
         PRBool forceReport;
@@ -1817,6 +1836,9 @@
     if(sp)
         js_FreeStack(cx, mark);
 
+    if(popPrincipal)
+        ssm->PopContextPrincipal(ccx);
+
 #ifdef DEBUG_stats_jband
     endTime = PR_IntervalNow();
     printf("%s::%s %d ( c->js ) \n", GetInterfaceName(), info->GetName(), PR_IntervalToMilliseconds(endTime-startTime));
--- xulrunner-1.9.0.19.orig/js/src/xpconnect/src/xpc.msg
+++ xulrunner-1.9.0.19/js/src/xpconnect/src/xpc.msg
@@ -182,6 +182,7 @@
 XPC_MSG_DEF(NS_ERROR_IN_PROGRESS                    , "The requested action could not be completed while the object is busy")
 XPC_MSG_DEF(NS_ERROR_ALREADY_OPENED                 , "Channel is already open")
 XPC_MSG_DEF(NS_ERROR_INVALID_CONTENT_ENCODING       , "The content encoding of the source document is incorrect")
+XPC_MSG_DEF(NS_ERROR_CORRUPTED_CONTENT              , "Corrupted content was received from server")
 XPC_MSG_DEF(NS_ERROR_ALREADY_CONNECTED              , "The connection is already established")
 XPC_MSG_DEF(NS_ERROR_NOT_CONNECTED                  , "The connection does not exist")
 XPC_MSG_DEF(NS_ERROR_CONNECTION_REFUSED             , "The connection was refused")
--- xulrunner-1.9.0.19.orig/js/src/xpconnect/src/XPCSafeJSObjectWrapper.cpp
+++ xulrunner-1.9.0.19/js/src/xpconnect/src/XPCSafeJSObjectWrapper.cpp
@@ -410,13 +410,18 @@
     return JS_FALSE;
   }
 
+  JSObject *scopeobj = JS_GetGlobalForObject(cx, unsafeObj);
+  OBJ_TO_INNER_OBJECT(cx, scopeobj);
+  if (!scopeobj) {
+    return JS_FALSE;
+  }
+
   // If we either have no scripted function in the requested slot yet,
   // or if the scope of the unsafeObj changed since we compiled the
   // scripted function, re-compile to make sure the scripted function
   // is properly scoped etc.
   if (JSVAL_IS_VOID(*scriptedFunVal) ||
-      JS_GetGlobalForObject(cx, unsafeObj) !=
-      JS_GetGlobalForObject(cx, JSVAL_TO_OBJECT(*scriptedFunVal))) {
+      scopeobj != JS_GetGlobalForObject(cx, JSVAL_TO_OBJECT(*scriptedFunVal))) {
     // Check whether we have a cached principal or not.
     jsval pv;
     if (!::JS_GetReservedSlot(cx, obj, XPC_SJOW_SLOT_PRINCIPAL, &pv)) {
@@ -443,8 +448,7 @@
 
     JSFunction *scriptedFun =
       ::JS_CompileFunctionForPrincipals(cx,
-                                        JS_GetGlobalForObject(cx, unsafeObj),
-                                        jsprin, nsnull, 0, nsnull,
+                                        scopeobj, jsprin, nsnull, 0, nsnull,
                                         funScript.get(), funScript.Length(),
                                         "XPCSafeJSObjectWrapper.cpp",
                                         __LINE__);
@@ -525,10 +529,10 @@
                    jsval *argv, jsval *rval)
 {
   JSRegExpStatics statics;
-  JSTempValueRooter tvr;
-  js_SaveAndClearRegExpStatics(cx, &statics, &tvr);
+  JSTempValueRooter tvr, tvr2;
+  js_SaveAndClearRegExpStatics(cx, &statics, &tvr, &tvr2);
   JSBool ok = ::JS_CallFunctionValue(cx, obj, fval, argc, argv, rval);
-  js_RestoreRegExpStatics(cx, &statics, &tvr);
+  js_RestoreRegExpStatics(cx, &statics, &tvr, &tvr2);
   return ok;
 }
 
--- xulrunner-1.9.0.19.orig/js/src/xpconnect/shell/Makefile.in
+++ xulrunner-1.9.0.19/js/src/xpconnect/shell/Makefile.in
@@ -61,7 +61,9 @@
 LIBS		= \
 		$(DIST)/lib/$(LIB_PREFIX)xpcomglue_s.$(LIB_SUFFIX) \
 		$(MOZ_JS_LIBS) \
+		-Wl,--no-as-needed \
 		$(XPCOM_LIBS) \
+		-Wl,--as-needed \
 		$(NSPR_LIBS) \
 		$(NULL)
 
@@ -84,7 +86,7 @@
 # look at mozilla/js/src/editline, which is license-free (but not part
 # of the mozilla build.)
 #
-ifdef JS_READLINE
+ifdef HAVE_READLINE
 DEFINES += -DEDITLINE
-LIBS += -lreadline $(JS_READLINE_EXTRA_LIBS)
+LIBS += $(READLINE_LIBS)
 endif
--- xulrunner-1.9.0.19.orig/js/src/xpconnect/shell/xpcshell.cpp
+++ xulrunner-1.9.0.19/js/src/xpconnect/shell/xpcshell.cpp
@@ -575,13 +575,8 @@
 } JSShellErrNum;
 
 JSErrorFormatString jsShell_ErrorFormatString[JSErr_Limit] = {
-#if JS_HAS_DFLT_MSG_STRINGS
 #define MSG_DEF(name, number, count, exception, format) \
     { format, count } ,
-#else
-#define MSG_DEF(name, number, count, exception, format) \
-    { NULL, count } ,
-#endif
 #include "jsshell.msg"
 #undef MSG_DEF
 };
@@ -597,8 +592,8 @@
 
 #ifdef EDITLINE
 extern "C" {
-extern char     *readline(const char *prompt);
-extern void     add_history(char *line);
+extern JS_EXPORT_API(char)     *readline(const char *prompt);
+extern JS_EXPORT_API(void)     add_history(char *line);
 }
 #endif
 
--- xulrunner-1.9.0.19.orig/js/tests/e4x/Regress/regress-561031.js
+++ xulrunner-1.9.0.19/js/tests/e4x/Regress/regress-561031.js
@@ -0,0 +1,1830 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributor: Gary Kwong
+ */
+
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {} catch(e) {}
+try {
+    if (2 == 0) { } else { [].(0); }
+} catch (e) {}
+reportCompare(0, 0, "ok");
--- xulrunner-1.9.0.19.orig/editor/idl/nsIEditor.idl
+++ xulrunner-1.9.0.19/editor/idl/nsIEditor.idl
@@ -568,3 +568,14 @@
   /* checks if a node is read-only or not */
   [notxpcom] boolean isModifiableNode(in nsIDOMNode aNode);
 };
+
+[uuid(a9ddee78-f5d2-43f1-9d91-d2124ba40d81)]
+interface nsIEditor_MOZILLA_1_9_2_BRANCH : nsISupports
+{
+  /**
+   * Will be set to true if the last keypress event that the editor has handled
+   * has been trusted.  The value will only be valid when the edit action listeners
+   * are being called, and will throw upon access at all other times.
+   */
+  readonly attribute boolean lastKeypressEventTrusted;
+};
--- xulrunner-1.9.0.19.orig/editor/libeditor/html/nsHTMLEditor.h
+++ xulrunner-1.9.0.19/editor/libeditor/html/nsHTMLEditor.h
@@ -640,10 +640,12 @@
                                         nsCOMPtr<nsIDOMNode> *outStartNode,
                                         nsCOMPtr<nsIDOMNode> *outEndNode,
                                         PRInt32 *outStartOffset,
-                                        PRInt32 *outEndOffset);
+                                        PRInt32 *outEndOffset,
+                                        PRBool aTrustedInput);
   nsresult   ParseFragment(const nsAString & aStr, nsTArray<nsString> &aTagStack,
                            nsIDocument* aTargetDoc,
-                           nsCOMPtr<nsIDOMNode> *outNode);
+                           nsCOMPtr<nsIDOMNode> *outNode,
+                           PRBool aTrustedInput);
   nsresult   CreateListOfNodesToPaste(nsIDOMNode  *aFragmentAsNode,
                                       nsCOMArray<nsIDOMNode>& outNodeList,
                                       nsIDOMNode *aStartNode,
@@ -766,6 +768,23 @@
   nsresult HasStyleOrIdOrClass(nsIDOMElement * aElement, PRBool *aHasStyleOrIdOrClass);
   nsresult RemoveElementIfNoStyleOrIdOrClass(nsIDOMElement * aElement, nsIAtom * aTag);
 
+  // This function is used to insert a string of HTML input optionally with some
+  // context information into the editable field.  The HTML input either comes
+  // from a transferable object created as part of a drop/paste operation, or from
+  // the InsertHTML method.  We may want the HTML input to be sanitized (for example,
+  // if it's coming from a transferable object), in which case aTrustedInput should
+  // be set to false, otherwise, the caller should set it to true, which means that
+  // the HTML will be inserted in the DOM verbatim.
+  nsresult DoInsertHTMLWithContext(const nsAString& aInputString,
+                                   const nsAString& aContextStr,
+                                   const nsAString& aInfoStr,
+                                   const nsAString& aFlavor,
+                                   nsIDOMDocument* aSourceDoc,
+                                   nsIDOMNode* aDestNode,
+                                   PRInt32 aDestOffset,
+                                   PRBool aDeleteSelection,
+                                   PRBool aTrustedInput);
+
 // Data members
 protected:
 
--- xulrunner-1.9.0.19.orig/editor/libeditor/html/Makefile.in
+++ xulrunner-1.9.0.19/editor/libeditor/html/Makefile.in
@@ -64,6 +64,7 @@
 		  widget \
 		  view \
 		  webshell \
+		  caps \
 		  $(NULL)
 
 # Building the full blown HTML Editor  so add its source files and objects:
--- xulrunner-1.9.0.19.orig/editor/libeditor/html/nsHTMLDataTransfer.cpp
+++ xulrunner-1.9.0.19/editor/libeditor/html/nsHTMLDataTransfer.cpp
@@ -134,6 +134,7 @@
 #include "nsIPrefService.h"
 #include "nsIContentFilter.h"
 #include "nsEventDispatcher.h"
+#include "nsIPrincipal.h"
 
 const PRUnichar nbsp = 160;
 
@@ -272,6 +273,22 @@
                                     PRInt32 aDestOffset,
                                     PRBool aDeleteSelection)
 {
+  return DoInsertHTMLWithContext(aInputString, aContextStr, aInfoStr,
+      aFlavor, aSourceDoc, aDestNode, aDestOffset, aDeleteSelection,
+      PR_TRUE);
+}
+
+nsresult
+nsHTMLEditor::DoInsertHTMLWithContext(const nsAString & aInputString,
+                                      const nsAString & aContextStr,
+                                      const nsAString & aInfoStr,
+                                      const nsAString & aFlavor,
+                                      nsIDOMDocument *aSourceDoc,
+                                      nsIDOMNode *aDestNode,
+                                      PRInt32 aDestOffset,
+                                      PRBool aDeleteSelection,
+                                      PRBool aTrustedInput)
+{
   if (!mRules) return NS_ERROR_NOT_INITIALIZED;
 
   // force IME commit; set up rules sniffing and batching
@@ -294,7 +311,8 @@
                                    address_of(streamStartParent),
                                    address_of(streamEndParent),
                                    &streamStartOffset,
-                                   &streamEndOffset);
+                                   &streamEndOffset,
+                                   aTrustedInput);
   NS_ENSURE_SUCCESS(res, res);
 
   nsCOMPtr<nsIDOMNode> targetNode, tempNode;
@@ -1271,6 +1289,25 @@
 #ifdef DEBUG_clipboard
     printf("Got flavor [%s]\n", bestFlavor);
 #endif
+
+    // Try to determine whether we should use a sanitizing fragment sink
+    PRBool isSafe = PR_FALSE;
+    if (aSourceDoc) {
+      nsCOMPtr<nsIDOMDocument> destdomdoc;
+      rv = GetDocument(getter_AddRefs(destdomdoc));
+      NS_ENSURE_SUCCESS(rv, rv);
+      nsCOMPtr<nsIDocument> destdoc = do_QueryInterface(destdomdoc);
+      NS_ASSERTION(destdoc, "Where is our destination doc?");
+      nsCOMPtr<nsIDocument> srcdoc = do_QueryInterface(aSourceDoc);
+      NS_ASSERTION(srcdoc, "Where is our source doc?");
+
+      nsIPrincipal* srcPrincipal = srcdoc->NodePrincipal();
+      nsIPrincipal* destPrincipal = destdoc->NodePrincipal();
+      NS_ASSERTION(srcPrincipal && destPrincipal, "How come we don't have a principal?");
+      rv = srcPrincipal->Subsumes(destPrincipal, &isSafe);
+      NS_ENSURE_SUCCESS(rv, rv);
+    }
+
     if (0 == nsCRT::strcmp(bestFlavor, kNativeHTMLMime))
     {
       // note cf_html uses utf8, hence use length = len, not len/2 as in flavors below
@@ -1286,11 +1323,12 @@
         if (NS_SUCCEEDED(rv) && !cffragment.IsEmpty())
         {
           nsAutoEditBatch beginBatching(this);
-          rv = InsertHTMLWithContext(cffragment,
-                                     cfcontext, cfselection, flavor,
-                                     aSourceDoc,
-                                     aDestinationNode, aDestOffset,
-                                     aDoDeleteSelection);
+          rv = DoInsertHTMLWithContext(cffragment,
+                                       cfcontext, cfselection, flavor,
+                                       aSourceDoc,
+                                       aDestinationNode, aDestOffset,
+                                       aDoDeleteSelection,
+                                       isSafe);
         }
       }
     }
@@ -1304,11 +1342,12 @@
         NS_ASSERTION(text.Length() <= (len/2), "Invalid length!");
         stuffToPaste.Assign(text.get(), len / 2);
         nsAutoEditBatch beginBatching(this);
-        rv = InsertHTMLWithContext(stuffToPaste,
-                                   aContextStr, aInfoStr, flavor,
-                                   aSourceDoc,
-                                   aDestinationNode, aDestOffset,
-                                   aDoDeleteSelection);
+        rv = DoInsertHTMLWithContext(stuffToPaste,
+                                     aContextStr, aInfoStr, flavor,
+                                     aSourceDoc,
+                                     aDestinationNode, aDestOffset,
+                                     aDoDeleteSelection,
+                                     isSafe);
       }
     }
     else if (0 == nsCRT::strcmp(bestFlavor, kUnicodeMime))
@@ -1374,11 +1413,12 @@
             nsAutoEditBatch beginBatching(this);
 
             const nsAFlatString& empty = EmptyString();
-            rv = InsertHTMLWithContext(stuffToPaste,
-                                       empty, empty, flavor, 
-                                       aSourceDoc,
-                                       aDestinationNode, aDestOffset,
-                                       aDoDeleteSelection);
+            rv = DoInsertHTMLWithContext(stuffToPaste,
+                                         empty, empty, flavor, 
+                                         aSourceDoc,
+                                         aDestinationNode, aDestOffset,
+                                         aDoDeleteSelection,
+                                         isSafe);
           }
         }
       }
@@ -1428,11 +1468,12 @@
           AppendUTF8toUTF16(urltext, stuffToPaste);
           stuffToPaste.AppendLiteral("\" alt=\"\" >");
           nsAutoEditBatch beginBatching(this);
-          rv = InsertHTMLWithContext(stuffToPaste, EmptyString(), EmptyString(), 
-                                     NS_LITERAL_STRING(kFileMime),
-                                     aSourceDoc,
-                                     aDestinationNode, aDestOffset,
-                                     aDoDeleteSelection);
+          rv = DoInsertHTMLWithContext(stuffToPaste, EmptyString(), EmptyString(), 
+                                       NS_LITERAL_STRING(kFileMime),
+                                       aSourceDoc,
+                                       aDestinationNode, aDestOffset,
+                                       aDoDeleteSelection,
+                                       isSafe);
         }
       }
     }
@@ -2509,7 +2550,8 @@
                                                   nsCOMPtr<nsIDOMNode> *outStartNode,
                                                   nsCOMPtr<nsIDOMNode> *outEndNode,
                                                   PRInt32 *outStartOffset,
-                                                  PRInt32 *outEndOffset)
+                                                  PRInt32 *outEndOffset,
+                                                  PRBool aTrustedInput)
 {
   if (!outFragNode || !outStartNode || !outEndNode) 
     return NS_ERROR_NULL_POINTER;
@@ -2529,7 +2571,8 @@
   nsCOMPtr<nsIDOMNode> contextLeaf, junk;
   if (!aContextStr.IsEmpty())
   {
-    res = ParseFragment(aContextStr, tagStack, doc, address_of(contextAsNode));
+    res = ParseFragment(aContextStr, tagStack, doc, address_of(contextAsNode),
+                        aTrustedInput);
     NS_ENSURE_SUCCESS(res, res);
     NS_ENSURE_TRUE(contextAsNode, NS_ERROR_FAILURE);
 
@@ -2549,7 +2592,7 @@
   NS_ENSURE_SUCCESS(res, res);
 
   // create fragment for pasted html
-  res = ParseFragment(aInputString, tagStack, doc, outFragNode);
+  res = ParseFragment(aInputString, tagStack, doc, outFragNode, aTrustedInput);
   NS_ENSURE_SUCCESS(res, res);
   NS_ENSURE_TRUE(*outFragNode, NS_ERROR_FAILURE);
 
@@ -2611,7 +2654,8 @@
 nsresult nsHTMLEditor::ParseFragment(const nsAString & aFragStr,
                                      nsTArray<nsString> &aTagStack,
                                      nsIDocument* aTargetDocument,
-                                     nsCOMPtr<nsIDOMNode> *outNode)
+                                     nsCOMPtr<nsIDOMNode> *outNode,
+                                     PRBool aTrustedInput)
 {
   // figure out if we are parsing full context or not
   PRBool bContext = aTagStack.IsEmpty();
@@ -2624,10 +2668,27 @@
 
   // create the html fragment sink
   nsCOMPtr<nsIContentSink> sink;
-  if (bContext)
-    sink = do_CreateInstance(NS_HTMLFRAGMENTSINK2_CONTRACTID);
-  else
-    sink = do_CreateInstance(NS_HTMLFRAGMENTSINK_CONTRACTID);
+  if (aTrustedInput) {
+    if (bContext)
+      sink = do_CreateInstance(NS_HTMLFRAGMENTSINK2_CONTRACTID);
+    else
+      sink = do_CreateInstance(NS_HTMLFRAGMENTSINK_CONTRACTID);
+  } else {
+    if (bContext)
+      sink = do_CreateInstance(NS_HTMLPARANOIDFRAGMENTSINK2_CONTRACTID);
+    else
+      sink = do_CreateInstance(NS_HTMLPARANOIDFRAGMENTSINK_CONTRACTID);
+
+    nsCOMPtr<nsIParanoidFragmentContentSink> paranoidSink(do_QueryInterface(sink));
+    NS_ASSERTION(paranoidSink, "Our content sink is paranoid");
+    if (bContext) {
+      // Allow comments for the context to catch our placeholder cookie
+      paranoidSink->AllowComments();
+    } else {
+      // Allow style elements and attributes for the actual content
+      paranoidSink->AllowStyles();
+    }
+  }
 
   NS_ENSURE_TRUE(sink, NS_ERROR_FAILURE);
   nsCOMPtr<nsIFragmentContentSink> fragSink(do_QueryInterface(sink));
--- xulrunner-1.9.0.19.orig/editor/libeditor/base/nsEditor.h
+++ xulrunner-1.9.0.19/editor/libeditor/base/nsEditor.h
@@ -86,6 +86,7 @@
 class nsIFile;
 class nsISelectionController;
 class nsIDOMEventTarget;
+class nsIDOMNSEvent;
 
 #define kMOZEditorBogusNodeAttr NS_LITERAL_STRING("_moz_editor_bogus_node")
 #define kMOZEditorBogusNodeValue NS_LITERAL_STRING("TRUE")
@@ -99,7 +100,8 @@
                  public nsIEditorIMESupport,
                  public nsSupportsWeakReference,
                  public nsIPhonetic,
-                 public nsStubMutationObserver
+                 public nsStubMutationObserver,
+                 public nsIEditor_MOZILLA_1_9_2_BRANCH
 {
 public:
 
@@ -157,6 +159,9 @@
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTINSERTED
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTREMOVED
 
+  // nsIEditor_MOZILLA_1_9_2_BRANCH
+  NS_DECL_NSIEDITOR_MOZILLA_1_9_2_BRANCH
+
 public:
 
   
@@ -195,6 +200,29 @@
   */
   nsresult CreateHTMLContent(const nsAString& aTag, nsIContent** aContent);
 
+  void BeginKeypressHandling() { mLastKeypressEventWasTrusted = eTriTrue; }
+  void BeginKeypressHandling(nsIDOMNSEvent* aEvent);
+  void EndKeypressHandling() { mLastKeypressEventWasTrusted = eTriUnset; }
+
+  class FireTrustedInputEvent {
+  public:
+    explicit FireTrustedInputEvent(nsEditor* aSelf, PRBool aActive = PR_TRUE)
+      : mEditor(aSelf)
+      , mShouldAct(aActive && mEditor->mLastKeypressEventWasTrusted == eTriUnset) {
+      if (mShouldAct) {
+        mEditor->BeginKeypressHandling();
+      }
+    }
+    ~FireTrustedInputEvent() {
+      if (mShouldAct) {
+        mEditor->EndKeypressHandling();
+      }
+    }
+  private:
+    nsEditor* mEditor;
+    PRBool mShouldAct;
+  };
+
 protected:
   nsCString mContentMIMEType;       // MIME type of the doc we are editing.
 
@@ -642,6 +670,8 @@
   nsCOMPtr<nsIDOMEventListener> mDragListenerP;
   nsCOMPtr<nsIDOMEventListener> mFocusListenerP;
 
+  Tristate mLastKeypressEventWasTrusted;
+
   friend PRBool NSCanUnload(nsISupports* serviceMgr);
   friend class nsAutoTxnsConserveSelection;
   friend class nsAutoSelectionReset;
--- xulrunner-1.9.0.19.orig/editor/libeditor/base/nsEditor.cpp
+++ xulrunner-1.9.0.19/editor/libeditor/base/nsEditor.cpp
@@ -113,6 +113,7 @@
 #include "nsINameSpaceManager.h"
 #include "nsIHTMLDocument.h"
 #include "nsIParserService.h"
+#include "nsIDOMNSEvent.h"
 
 #define NS_ERROR_EDITOR_NO_SELECTION NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_EDITOR,1)
 #define NS_ERROR_EDITOR_NO_TEXTNODE  NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_EDITOR,2)
@@ -155,6 +156,7 @@
 ,  mDocDirtyState(-1)
 ,  mDocWeak(nsnull)
 ,  mPhonetic(nsnull)
+,  mLastKeypressEventWasTrusted(eTriUnset)
 {
   //initialize member variables here
 }
@@ -168,8 +170,8 @@
   NS_IF_RELEASE(mViewManager);
 }
 
-NS_IMPL_ISUPPORTS5(nsEditor, nsIEditor, nsIEditorIMESupport,
-                   nsISupportsWeakReference, nsIPhonetic, nsIMutationObserver)
+NS_IMPL_ISUPPORTS6(nsEditor, nsIEditor, nsIEditorIMESupport,
+                   nsISupportsWeakReference, nsIPhonetic, nsIMutationObserver, nsIEditor_MOZILLA_1_9_2_BRANCH)
 
 #ifdef XP_MAC
 #pragma mark -
@@ -906,12 +908,12 @@
     mPlaceHolderName = aName;
     nsCOMPtr<nsISelection> selection;
     nsresult res = GetSelection(getter_AddRefs(selection));
-    if (NS_FAILED(res)) return res;
-    mSelState = new nsSelectionState();
-    if (!mSelState)
-      return NS_ERROR_OUT_OF_MEMORY;
-
-    mSelState->SaveSelection(selection);
+    if (NS_SUCCEEDED(res)) {
+      mSelState = new nsSelectionState();
+      if (mSelState) {
+        mSelState->SaveSelection(selection);
+      }
+    }
   }
   mPlaceHolderBatch++;
 
@@ -5369,3 +5371,28 @@
 {
   return PR_TRUE;
 }
+
+NS_IMETHODIMP
+nsEditor::GetLastKeypressEventTrusted(PRBool *aWasTrusted)
+{
+  NS_ENSURE_ARG_POINTER(aWasTrusted);
+
+  if (mLastKeypressEventWasTrusted == eTriUnset) {
+    return NS_ERROR_UNEXPECTED;
+  }
+
+  *aWasTrusted = (mLastKeypressEventWasTrusted == eTriTrue);
+  return NS_OK;
+}
+
+void
+nsEditor::BeginKeypressHandling(nsIDOMNSEvent* aEvent)
+{
+  NS_ASSERTION(mLastKeypressEventWasTrusted == eTriUnset, "How come our status is not clear?");
+
+  if (aEvent) {
+    PRBool isTrusted = PR_FALSE;
+    aEvent->GetIsTrusted(&isTrusted);
+    mLastKeypressEventWasTrusted = isTrusted ? eTriTrue : eTriFalse;
+  }
+}
--- xulrunner-1.9.0.19.orig/editor/libeditor/text/nsTextEditRules.cpp
+++ xulrunner-1.9.0.19/editor/libeditor/text/nsTextEditRules.cpp
@@ -211,6 +211,12 @@
   
   nsAutoLockRulesSniffing lockIt(this);
   mDidExplicitlySetInterline = PR_FALSE;
+  if (!mActionNesting)
+  {
+    // let rules remember the top level action
+    mTheAction = action;
+  }
+  mActionNesting++;
   
   // get the selection and cache the position before editing
   nsCOMPtr<nsISelection> selection;
@@ -221,12 +227,6 @@
   selection->GetAnchorNode(getter_AddRefs(mCachedSelectionNode));
   selection->GetAnchorOffset(&mCachedSelectionOffset);
 
-  if (!mActionNesting)
-  {
-    // let rules remember the top level action
-    mTheAction = action;
-  }
-  mActionNesting++;
   return NS_OK;
 }
 
--- xulrunner-1.9.0.19.orig/editor/libeditor/text/nsPlaintextDataTransfer.cpp
+++ xulrunner-1.9.0.19/editor/libeditor/text/nsPlaintextDataTransfer.cpp
@@ -115,6 +115,8 @@
                                                             PRInt32 aDestOffset,
                                                             PRBool aDoDeleteSelection)
 {
+  FireTrustedInputEvent trusted(this);
+
   nsresult rv = NS_OK;
   char* bestFlavor = nsnull;
   nsCOMPtr<nsISupports> genericDataObj;
--- xulrunner-1.9.0.19.orig/editor/libeditor/text/nsEditorEventListeners.cpp
+++ xulrunner-1.9.0.19/editor/libeditor/text/nsEditorEventListeners.cpp
@@ -72,6 +72,20 @@
 
 //#define DEBUG_IME
 
+class nsAutoEditorKeypressOperation {
+public:
+  nsAutoEditorKeypressOperation(nsEditor *aEditor, nsIDOMNSEvent *aEvent)
+    : mEditor(aEditor) {
+    mEditor->BeginKeypressHandling(aEvent);
+  }
+  ~nsAutoEditorKeypressOperation() {
+    mEditor->EndKeypressHandling();
+  }
+
+private:
+  nsEditor *mEditor;
+};
+
 /*
  * nsTextEditorKeyListener implementation
  */
@@ -116,6 +130,10 @@
 nsresult
 nsTextEditorKeyListener::KeyPress(nsIDOMEvent* aKeyEvent)
 {
+  // Transfer the event's trusted-ness to our editor
+  nsCOMPtr<nsIDOMNSEvent> NSEvent = do_QueryInterface(aKeyEvent);
+  nsAutoEditorKeypressOperation operation(static_cast<nsEditor*> (mEditor), NSEvent);
+
   // DOM event handling happens in two passes, the client pass and the system
   // pass.  We do all of our processing in the system pass, to allow client
   // handlers the opportunity to cancel events and prevent typing in the editor.
@@ -867,6 +885,11 @@
 #ifdef DEBUG_IME
    printf("nsTextEditorCompositionListener::HandleEndComposition\n");
 #endif
+
+  // Transfer the event's trusted-ness to our editor
+  nsCOMPtr<nsIDOMNSEvent> NSEvent = do_QueryInterface(aCompositionEvent);
+  nsAutoEditorKeypressOperation operation(static_cast<nsEditor*> (mEditor), NSEvent);
+
    return mEditor->EndComposition();
 }
 
--- xulrunner-1.9.0.19.orig/editor/libeditor/text/nsPlaintextEditor.cpp
+++ xulrunner-1.9.0.19/editor/libeditor/text/nsPlaintextEditor.cpp
@@ -643,6 +643,8 @@
 
   nsresult result;
 
+  FireTrustedInputEvent trusted(this, aAction != eNone);
+
   // delete placeholder txns merge.
   nsAutoPlaceHolderBatch batch(this, nsGkAtoms::DeleteTxnName);
   nsAutoRules beginRulesSniffing(this, kOpDeleteSelection, aAction);
@@ -1091,6 +1093,8 @@
 NS_IMETHODIMP 
 nsPlaintextEditor::Undo(PRUint32 aCount)
 {
+  FireTrustedInputEvent trusted(this);
+
   nsAutoUpdateViewBatch beginViewBatching(this);
 
   ForceCompositionEnd();
@@ -1115,6 +1119,8 @@
 NS_IMETHODIMP 
 nsPlaintextEditor::Redo(PRUint32 aCount)
 {
+  FireTrustedInputEvent trusted(this);
+
   nsAutoUpdateViewBatch beginViewBatching(this);
 
   ForceCompositionEnd();
@@ -1189,6 +1195,8 @@
 
 NS_IMETHODIMP nsPlaintextEditor::Cut()
 {
+  FireTrustedInputEvent trusted(this);
+
   PRBool preventDefault;
   nsresult rv = FireClipboardEvent(NS_CUT, &preventDefault);
   if (NS_FAILED(rv) || preventDefault)
--- xulrunner-1.9.0.19.orig/editor/libeditor/text/crashtests/crashtests.list
+++ xulrunner-1.9.0.19/editor/libeditor/text/crashtests/crashtests.list
@@ -0,0 +1 @@
+load 580151-1.xhtml
--- xulrunner-1.9.0.19.orig/editor/libeditor/text/crashtests/580151-1.xhtml
+++ xulrunner-1.9.0.19/editor/libeditor/text/crashtests/580151-1.xhtml
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+var t;
+
+function boom()
+{
+  var b = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+  t = document.createElementNS("http://www.w3.org/1999/xhtml", "textarea");
+  b.appendChild(t);
+  document.removeChild(document.documentElement)
+  document.appendChild(b)
+  document.removeChild(document.documentElement)
+  var ns = document.createElementNS("http://www.w3.org/1999/xhtml", "script");
+  var nt = document.createTextNode("t.appendChild(document.createTextNode(' '));");
+  ns.appendChild(nt);
+  b.appendChild(ns);
+  document.appendChild(b);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
--- xulrunner-1.9.0.19.orig/editor/composer/src/nsEditingSession.h
+++ xulrunner-1.9.0.19/editor/composer/src/nsEditingSession.h
@@ -167,6 +167,9 @@
   PRUint32        mBaseCommandControllerId;
   PRUint32        mDocStateControllerId;
   PRUint32        mHTMLCommandControllerId;
+
+  // Make sure the docshell we use is safe
+  nsWeakPtr       mDocShell;
 };
 
 
--- xulrunner-1.9.0.19.orig/editor/composer/src/nsEditingSession.cpp
+++ xulrunner-1.9.0.19/editor/composer/src/nsEditingSession.cpp
@@ -1058,9 +1058,10 @@
           if (NS_FAILED(rv)) return rv;
 
           mEditorStatus = eEditorCreationInProgress;
+          mDocShell = do_GetWeakReference(docShell);
           mLoadBlankDocTimer->InitWithFuncCallback(
                                           nsEditingSession::TimerCallback,
-                                          (void*)docShell,
+                                          static_cast<void*> (mDocShell.get()),
                                           10, nsITimer::TYPE_ONE_SHOT);
         }
       }
@@ -1073,7 +1074,7 @@
 void
 nsEditingSession::TimerCallback(nsITimer* aTimer, void* aClosure)
 {
-  nsCOMPtr<nsIDocShell> docShell = (nsIDocShell*)aClosure;
+  nsCOMPtr<nsIDocShell> docShell = do_QueryReferent(static_cast<nsIWeakReference*> (aClosure));
   if (docShell)
   {
     nsCOMPtr<nsIWebNavigation> webNav(do_QueryInterface(docShell));
--- xulrunner-1.9.0.19.orig/xpcom/io/nsLocalFileUnix.h
+++ xulrunner-1.9.0.19/xpcom/io/nsLocalFileUnix.h
@@ -113,7 +113,11 @@
     ~nsLocalFile() {}
 
 protected:
+#ifdef HAVE_STAT64
+    struct stat64 mCachedStat;
+#else
     struct stat  mCachedStat;
+#endif
     nsCString    mPath;
     PRPackedBool mHaveCachedStat;
 
--- xulrunner-1.9.0.19.orig/xpcom/io/nsAppFileLocationProvider.cpp
+++ xulrunner-1.9.0.19/xpcom/io/nsAppFileLocationProvider.cpp
@@ -99,6 +99,8 @@
 #define NS_MACOSX_USER_PLUGIN_DIR   "OSXUserPlugins"
 #define NS_MACOSX_LOCAL_PLUGIN_DIR  "OSXLocalPlugins"
 #define NS_MAC_CLASSIC_PLUGIN_DIR   "MacSysPlugins"
+#elif XP_UNIX
+#define NS_SYSTEM_PLUGINS_DIR       "SysPlugins"
 #endif
 
 #define DEFAULTS_DIR_NAME           NS_LITERAL_CSTRING("defaults")
@@ -254,6 +256,13 @@
         if (NS_SUCCEEDED(rv))
             rv = localFile->AppendRelativeNativePath(PLUGINS_DIR_NAME);
     }
+#ifdef XP_UNIX
+    else if (nsCRT::strcmp(prop, NS_SYSTEM_PLUGINS_DIR) == 0) {
+        static const char *const sysLPlgDir = "/usr/lib/mozilla/plugins";
+        rv = NS_NewNativeLocalFile(nsDependentCString(sysLPlgDir),
+                                   PR_FALSE, getter_AddRefs(localFile));
+    }
+#endif
 #endif
     else if (nsCRT::strcmp(prop, NS_APP_SEARCH_DIR) == 0)
     {
@@ -596,7 +605,7 @@
 
         *_retval = new nsAppDirectoryEnumerator(this, keys);
 #else
-        static const char* keys[] = { nsnull, NS_USER_PLUGINS_DIR, NS_APP_PLUGINS_DIR, nsnull };
+        static const char* keys[] = { nsnull, NS_USER_PLUGINS_DIR, NS_APP_PLUGINS_DIR, NS_SYSTEM_PLUGINS_DIR, nsnull };
         if (!keys[0] && !(keys[0] = PR_GetEnv("MOZ_PLUGIN_PATH"))) {
             static const char nullstr = 0;
             keys[0] = &nullstr;
--- xulrunner-1.9.0.19.orig/xpcom/io/nsLocalFileUnix.cpp
+++ xulrunner-1.9.0.19/xpcom/io/nsLocalFileUnix.cpp
@@ -280,12 +280,21 @@
 
 nsresult 
 nsLocalFile::FillStatCache() {
+#ifdef HAVE_STAT64
+    if (stat64(mPath.get(), &mCachedStat) == -1) {
+        // try lstat it may be a symlink
+        if (lstat64(mPath.get(), &mCachedStat) == -1) {
+            return NSRESULT_FOR_ERRNO();
+        }
+    }
+#else
     if (stat(mPath.get(), &mCachedStat) == -1) {
         // try lstat it may be a symlink
         if (lstat(mPath.get(), &mCachedStat) == -1) {
             return NSRESULT_FOR_ERRNO();
         }
     }
+#endif
     mHaveCachedStat = PR_TRUE;
     return NS_OK;
 }
@@ -1109,9 +1118,12 @@
     }
 #endif
 
-    /* XXX autoconf for and use stat64 if available */
     if (!S_ISDIR(mCachedStat.st_mode)) {
+#ifdef HAVE_STAT64
+        *aFileSize = mCachedStat.st_size;
+#else
         LL_UI2L(*aFileSize, (PRUint32)mCachedStat.st_size);
+#endif
     }
     return NS_OK;
 }
@@ -1136,11 +1148,17 @@
     CHECK_mPath();
     NS_ENSURE_ARG(aFileSize);
 
+#ifdef HAVE_LSTAT64
+    struct stat64 sbuf;
+    if (lstat64(mPath.get(), &sbuf) == -1)
+        return NSRESULT_FOR_ERRNO();
+    *aFileSize = sbuf.st_size;
+#else
     struct stat sbuf;
     if (lstat(mPath.get(), &sbuf) == -1)
         return NSRESULT_FOR_ERRNO();
-    /* XXX autoconf for and use lstat64 if available */
     LL_UI2L(*aFileSize, (PRUint32)sbuf.st_size);
+#endif
     return NS_OK;
 }
 
@@ -1310,7 +1328,46 @@
         *_retval = PR_TRUE;
         return NS_OK;
     }
-    
+
+    // Check extension (bug 663899). On certain platforms, the file
+    // extension may cause the OS to treat it as executable regardless of
+    // the execute bit, such as .jar on Mac OS X. We borrow the code from
+    // nsLocalFileWin, slightly modified.
+
+    // Don't be fooled by symlinks.
+    PRBool symLink;
+    nsresult rv = IsSymlink(&symLink);
+    if (NS_FAILED(rv))
+        return rv;
+
+    nsAutoString path;
+    if (symLink)
+        GetTarget(path);
+    else
+        GetPath(path);
+
+    PRInt32 dotIdx = path.RFindChar(PRUnichar('.'));
+    if (dotIdx != kNotFound) {
+        // Convert extension to lower case.
+        PRUnichar *p = path.BeginWriting();
+        for(p += dotIdx + 1; *p; p++)
+            *p +=  (*p >= L'A' && *p <= L'Z') ? 'a' - 'A' : 0; 
+        
+        // Search for any of the set of executable extensions.
+        static const char * const executableExts[] = {
+            "air",         // Adobe AIR installer
+            "jar"};        // java application bundle
+        nsDependentSubstring ext = Substring(path, dotIdx + 1);
+        for (int i = 0; i < NS_ARRAY_LENGTH(executableExts); i++) {
+            if (ext.EqualsASCII(executableExts[i])) {
+                // Found a match.  Set result and quit.
+                *_retval = PR_TRUE;
+                return NS_OK;
+            }
+        }
+    }
+
+    // Failing that, check the execute bit.
     *_retval = (stat(mPath.get(), &buf) == 0);
     if (*_retval || errno == EACCES) {
         *_retval = *_retval && (buf.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH ));
--- xulrunner-1.9.0.19.orig/xpcom/glue/nsCOMArray.cpp
+++ xulrunner-1.9.0.19/xpcom/glue/nsCOMArray.cpp
@@ -55,11 +55,7 @@
 
 nsCOMArray_base::~nsCOMArray_base()
 {
-    PRInt32 count = Count(), i;
-    for (i = 0; i < count; ++i) {
-        nsISupports* obj = ObjectAt(i);
-        NS_IF_RELEASE(obj);
-    }                        
+  Clear();
 }
 
 PRInt32
@@ -135,9 +131,10 @@
 {
     if (PRUint32(aIndex) < PRUint32(Count())) {
         nsISupports* element = ObjectAt(aIndex);
-        NS_IF_RELEASE(element);
 
-        return mArray.RemoveElementAt(aIndex);
+        PRBool result = mArray.RemoveElementAt(aIndex);
+        NS_IF_RELEASE(element);
+        return result;
     }
 
     return PR_FALSE;
@@ -155,7 +152,9 @@
 void
 nsCOMArray_base::Clear()
 {
-    mArray.EnumerateForwards(ReleaseObjects, nsnull);
+    nsAutoVoidArray objects;
+    objects = mArray;
     mArray.Clear();
+    objects.EnumerateForwards(ReleaseObjects, nsnull);
 }
 
--- xulrunner-1.9.0.19.orig/xpcom/glue/nsThreadUtils.cpp
+++ xulrunner-1.9.0.19/xpcom/glue/nsThreadUtils.cpp
@@ -187,24 +187,27 @@
 }
 #endif // XPCOM_GLUE_AVOID_NSPR
 
+inline PRBool
+hasPendingEvents(nsIThread *thread)
+{
+  PRBool val;
+  return NS_SUCCEEDED(thread->HasPendingEvents(&val)) && val;
+}
+
 PRBool
 NS_HasPendingEvents(nsIThread *thread)
 {
-#ifdef MOZILLA_INTERNAL_API
   if (!thread) {
+#ifndef MOZILLA_INTERNAL_API
+    nsCOMPtr<nsIThread> current;
+    NS_GetCurrentThread(getter_AddRefs(current));
+    return hasPendingEvents(current);
+#else
     thread = NS_GetCurrentThread();
     NS_ENSURE_TRUE(thread, PR_FALSE);
-  }
-#else
-  nsCOMPtr<nsIThread> current;
-  if (!thread) {
-    NS_GetCurrentThread(getter_AddRefs(current));
-    NS_ENSURE_TRUE(current, PR_FALSE);
-    thread = current.get();
-  }
 #endif
-  PRBool val;
-  return NS_SUCCEEDED(thread->HasPendingEvents(&val)) && val;
+  }
+  return hasPendingEvents(thread);
 }
 
 PRBool
--- xulrunner-1.9.0.19.orig/xpcom/glue/nsTextFormatter.cpp
+++ xulrunner-1.9.0.19/xpcom/glue/nsTextFormatter.cpp
@@ -920,7 +920,7 @@
 		return -1;
 	    }
 
-	    ap = nas[i-1].ap;
+	    VARARGS_ASSIGN(ap, nas[i-1].ap);
 	    dolPt = fmt;
 	    c = *fmt++;
 	}
--- xulrunner-1.9.0.19.orig/xpcom/glue/nsVoidArray.h
+++ xulrunner-1.9.0.19/xpcom/glue/nsVoidArray.h
@@ -193,6 +193,12 @@
     SetArray(reinterpret_cast<Impl*>(mAutoBuf), kAutoBufSize, 0, PR_FALSE,
              PR_TRUE);
   }
+
+  nsAutoVoidArray& operator=(const nsVoidArray& other)
+  {
+    nsVoidArray::operator=(other);
+    return *this;
+  }
   
 protected:
   // The internal storage
--- xulrunner-1.9.0.19.orig/xpcom/glue/standalone/Makefile.in
+++ xulrunner-1.9.0.19/xpcom/glue/standalone/Makefile.in
@@ -62,7 +62,7 @@
 ifneq (,$(filter WINNT WINCE,$(OS_ARCH)))
 LINKSRC = nsGlueLinkingWin.cpp
 endif
-ifneq (,$(filter AIX DragonFly FreeBSD Linux NetBSD OpenBSD SunOS,$(OS_ARCH)))
+ifneq (,$(filter AIX DragonFly FreeBSD GNU GNU_% Linux NetBSD OpenBSD SunOS,$(OS_ARCH)))
 LINKSRC = nsGlueLinkingDlopen.cpp
 endif
 ifeq (OS2,$(OS_ARCH))
--- xulrunner-1.9.0.19.orig/xpcom/glue/standalone/nsGlueLinkingDlopen.cpp
+++ xulrunner-1.9.0.19/xpcom/glue/standalone/nsGlueLinkingDlopen.cpp
@@ -86,19 +86,21 @@
 GetFrozenFunctionsFunc
 XPCOMGlueLoad(const char *xpcomFile)
 {
-    char xpcomDir[MAXPATHLEN];
-    if (realpath(xpcomFile, xpcomDir)) {
-        char *lastSlash = strrchr(xpcomDir, '/');
-        if (lastSlash) {
-            *lastSlash = '\0';
+    char xulFile[MAXPATHLEN];
+    char *lastSlash = strrchr(xpcomFile, '/');
+    if (!lastSlash) {
+        snprintf(xulFile, MAXPATHLEN, "./%s", xpcomFile);
+        return XPCOMGlueLoad(xulFile);
+    }
+    *lastSlash = '\0';
 
-            XPCOMGlueLoadDependentLibs(xpcomDir, ReadDependentCB);
+    XPCOMGlueLoadDependentLibs(xpcomFile, ReadDependentCB);
 
-            snprintf(lastSlash, MAXPATHLEN - strlen(xpcomDir), "/" XUL_DLL);
+    snprintf(xulFile, MAXPATHLEN - strlen(xpcomFile), "%s/" XUL_DLL, xpcomFile);
 
-            sXULLibHandle = dlopen(xpcomDir, RTLD_GLOBAL | RTLD_LAZY);
-        }
-    }
+    sXULLibHandle = dlopen(xulFile, RTLD_GLOBAL | RTLD_LAZY);
+
+    *lastSlash = '/';
 
     // RTLD_DEFAULT is not defined in non-GNU toolchains, and it is
     // (void*) 0 in any case.
--- xulrunner-1.9.0.19.orig/xpcom/build/nsXPComInit.cpp
+++ xulrunner-1.9.0.19/xpcom/build/nsXPComInit.cpp
@@ -289,6 +289,23 @@
 static PRBool CheckUpdateFile()
 {
     nsresult rv;
+    nsCOMPtr<nsIFile> compregFile;
+    rv = nsDirectoryService::gService->Get(NS_XPCOM_COMPONENT_REGISTRY_FILE,
+                                           NS_GET_IID(nsIFile),
+                                           getter_AddRefs(compregFile));
+
+    if (NS_FAILED(rv)) {
+        NS_WARNING("Getting NS_XPCOM_COMPONENT_REGISTRY_FILE failed");
+        return PR_FALSE;
+    }
+
+    PRBool exists;
+    if (NS_FAILED(compregFile->Exists(&exists)) || !exists)
+        return PR_TRUE;
+
+    PRInt64 compregModTime;
+    compregFile->GetLastModifiedTime(&compregModTime);
+
     nsCOMPtr<nsIFile> file;
     rv = nsDirectoryService::gService->Get(NS_XPCOM_CURRENT_PROCESS_DIR, 
                                            NS_GET_IID(nsIFile), 
@@ -301,28 +318,39 @@
 
     file->AppendNative(nsDependentCString(".autoreg"));
     
-    PRBool exists;
     file->Exists(&exists);
     if (!exists)
-        return PR_FALSE;
+        goto next;
 
-    nsCOMPtr<nsIFile> compregFile;
-    rv = nsDirectoryService::gService->Get(NS_XPCOM_COMPONENT_REGISTRY_FILE,
+    PRInt64 autoregModTime;
+    file->GetLastModifiedTime(&autoregModTime);
+
+    if (LL_CMP(autoregModTime, >, compregModTime))
+        return PR_TRUE;
+
+next:
+    nsCOMPtr<nsIFile> greFile;
+    rv = nsDirectoryService::gService->Get(NS_GRE_DIR,
                                            NS_GET_IID(nsIFile),
-                                           getter_AddRefs(compregFile));
+                                           getter_AddRefs(greFile));
 
-    
     if (NS_FAILED(rv)) {
-        NS_WARNING("Getting NS_XPCOM_COMPONENT_REGISTRY_FILE failed");
+        NS_WARNING("Getting NS_GRE_DIR failed");
         return PR_FALSE;
     }
 
-    if (NS_FAILED(compregFile->Exists(&exists)) || !exists)
-        return PR_TRUE;
+    greFile->AppendNative(nsDependentCString(".autoreg"));
 
-    PRInt64 compregModTime, autoregModTime;
-    compregFile->GetLastModifiedTime(&compregModTime);
-    file->GetLastModifiedTime(&autoregModTime);
+    PRBool equals;
+    rv = greFile->Equals(file, &equals);
+    if (NS_SUCCEEDED(rv) && equals)
+        return PR_FALSE;
+
+    greFile->Exists(&exists);
+    if (!exists)
+        return PR_FALSE;
+
+    greFile->GetLastModifiedTime(&autoregModTime);
 
     return LL_CMP(autoregModTime, >, compregModTime);
 }
--- xulrunner-1.9.0.19.orig/xpcom/reflect/xptcall/src/md/unix/xptcstubs_linux_m68k.cpp
+++ xulrunner-1.9.0.19/xpcom/reflect/xptcall/src/md/unix/xptcstubs_linux_m68k.cpp
@@ -38,6 +38,7 @@
 /* Implement shared vtbl methods. */
 
 #include "xptcprivate.h"
+#include "xptiprivate.h"
 
 extern "C" {
     nsresult
@@ -47,7 +48,6 @@
 
         nsXPTCMiniVariant paramBuffer[PARAM_BUFFER_COUNT];
         nsXPTCMiniVariant* dispatchParams = NULL;
-        nsIInterfaceInfo* iface_info = NULL;
         const nsXPTMethodInfo* info;
         PRUint8 paramCount;
         PRUint8 i;
@@ -55,11 +55,8 @@
 
         NS_ASSERTION(self,"no self");
 
-        self->GetInterfaceInfo(&iface_info);
-        NS_ASSERTION(iface_info,"no interface info");
-
-        iface_info->GetMethodInfo(PRUint16(methodIndex), &info);
-        NS_ASSERTION(info,"no interface info");
+        self->mEntry->GetMethodInfo(PRUint16(methodIndex), &info);
+        NS_ASSERTION(info,"no method info");
 
         paramCount = info->GetParamCount();
 
@@ -107,9 +104,7 @@
             }
         }
 
-        result = self->CallMethod((PRUint16)methodIndex, info, dispatchParams);
-
-        NS_RELEASE(iface_info);
+        result = self->mOuter->CallMethod((PRUint16)methodIndex, info, dispatchParams);
 
         if(dispatchParams != paramBuffer)
             delete [] dispatchParams;
--- xulrunner-1.9.0.19.orig/xpcom/reflect/xptcall/src/md/unix/Makefile.in
+++ xulrunner-1.9.0.19/xpcom/reflect/xptcall/src/md/unix/Makefile.in
@@ -64,7 +64,7 @@
 #
 # Lots of Unixish x86 flavors
 #
-ifneq (,$(filter FreeBSD NetBSD OpenBSD BSD_OS Darwin,$(OS_ARCH)))
+ifneq (,$(filter FreeBSD NetBSD OpenBSD BSD_OS Darwin GNU,$(OS_ARCH)))
 ifeq (86,$(findstring 86,$(OS_TEST)))
 CPPSRCS		:= xptcinvoke_unixish_x86.cpp xptcstubs_unixish_x86.cpp
 ifeq (Darwin,$(OS_ARCH))
@@ -222,12 +222,13 @@
 # Linux/HPPA/gcc
 #
 ifeq ($(OS_ARCH),Linux)
-ifneq (,$(filter hppa2.0 hppa1.1,$(OS_TEST)))
+ifneq (,$(filter hppa hppa2.0 hppa1.1,$(OS_TEST)))
 ifndef GNU_CXX
 $(error Unknown C++ compiler, xptcall assembly will probably be incorrect.)
 else
 CPPSRCS		:= xptcinvoke_pa32.cpp xptcstubs_pa32.cpp
 ASFILES		:= xptcstubs_asm_parisc_linux.s xptcinvoke_asm_parisc_linux.s
+MOZ_OPTIMIZE_FLAGS	:= -O0
 endif
 endif
 endif
@@ -276,11 +277,7 @@
 ifneq (,$(findstring mips, $(OS_TEST)))
 CPPSRCS		:= xptcinvoke_mips.cpp xptcstubs_mips.cpp
 ASFILES		:= xptcinvoke_asm_mips.s xptcstubs_asm_mips.s
-#xptcstubs_mips.cpp
-# xptcstubs_asm_mips.s
-ifdef GNU_CC
-ASFLAGS		+= $(INCLUDES) -x assembler-with-cpp -D__GNUC__
-endif
+ASFLAGS		+= -I$(PUBLIC) -x assembler-with-cpp
 endif
 endif
 
@@ -466,10 +463,7 @@
 
 ifeq ($(OS_ARCH),Linux)
 ifneq (,$(findstring mips, $(OS_TEST)))
-xptcstubs_asm_mips.o: xptcstubs_asm_mips.s.m4 $(PUBLIC)/xptcstubsdef.inc
-	m4 $(INCLUDES) $< > ./xptcstubs_asm_mips.s && \
-	$(AS) -o $@ $(ASFLAGS) $(AS_DASH_C_FLAG) ./xptcstubs_asm_mips.s
-	$(RM) -f ./xptcstubs_asm_mips.s
+xptcstubs_asm_mips.o: $(PUBLIC)/xptcstubsdef.inc
 endif
 endif
 
--- xulrunner-1.9.0.19.orig/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_asm_mips.s
+++ xulrunner-1.9.0.19/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_asm_mips.s
@@ -24,6 +24,7 @@
  * Contributor(s):
  *   Brendan Eich     <brendan@mozilla.org>
  *   Stuart Parmenter <pavlov@netscape.com>
+ *   Thiemo Seufer    <seufer@csv.ica.uni-stuttgart.de>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -44,139 +45,123 @@
 #include <sys/regdef.h>
 #include <sys/asm.h>
 
-.text
-.globl  invoke_count_words
-.globl	invoke_copy_to_stack 
-
-# We need a variable number of words allocated from the stack for copies of
-# the params, and this space must come between the high frame (where ra, gp,
-# and s0 are saved) and the low frame (where a0-a3 are saved by the callee
-# functions we invoke). 
-
-LOCALSZ=4		# s0, s1, ra, gp
-NARGSAVE=4		# a0, a1, a2, a3
-HIFRAMESZ=(LOCALSZ*SZREG)
-LOFRAMESZ=(NARGSAVE*SZREG)
-FRAMESZ=(HIFRAMESZ+LOFRAMESZ+ALSZ)&ALMASK
-
-# XXX these 2*SZREG, etc. are very magic -- we *know* that ALSZ&ALMASK cause
-# FRAMESZ to be 0 mod 8, in this case to be 16 and not 12.
-RAOFF=FRAMESZ - (2*SZREG)
-GPOFF=FRAMESZ - (3*SZREG)
-S0OFF=FRAMESZ - (4*SZREG)
-S1OFF=FRAMESZ - (5*SZREG)
-
-# These are not magic -- they are just our argsave slots in the caller frame.
-A0OFF=FRAMESZ
-A1OFF=FRAMESZ + (1*SZREG)
-A2OFF=FRAMESZ + (2*SZREG)
-A3OFF=FRAMESZ + (3*SZREG)
-
-	#	
-	# _XPTC_InvokeByIndex(that, methodIndex, paramCount, params)
-	#                      a0       a1          a2         a3
-
-NESTED(_XPTC_InvokeByIndex, FRAMESZ, ra)
-
-	.set	noreorder
-	.cpload	t9
-	.set	reorder
-
+# NARGSAVE is the argument space in the callers frame, including extra
+# 'shadowed' space for the argument registers. The minimum of 4
+# argument slots is sometimes predefined in the header files.
+#ifndef NARGSAVE
+#define NARGSAVE 4
+#endif
+
+#define LOCALSZ 3	/* gp, fp, ra */
+#define FRAMESZ ((((NARGSAVE+LOCALSZ)*SZREG)+ALSZ)&ALMASK)
+
+#define RAOFF (FRAMESZ - (1*SZREG))
+#define FPOFF (FRAMESZ - (2*SZREG))
+#define GPOFF (FRAMESZ - (3*SZREG))
+
+#define A0OFF (FRAMESZ + (0*SZREG))
+#define A1OFF (FRAMESZ + (1*SZREG))
+#define A2OFF (FRAMESZ + (2*SZREG))
+#define A3OFF (FRAMESZ + (3*SZREG))
+
+	.text
+
+#	
+# _NS_InvokeByIndex_P(that, methodIndex, paramCount, params)
+#                      a0       a1          a2         a3
+
+	.globl	_NS_InvokeByIndex_P
+	.align	2
+	.type	_NS_InvokeByIndex_P,@function
+	.ent	_NS_InvokeByIndex_P,0
+	.frame	fp, FRAMESZ, ra
+_NS_InvokeByIndex_P:
+	SETUP_GP
 	subu	sp, FRAMESZ
 
-	# specify the save register mask -- XXX do we want the a0-a3 here, given
-	# our "split" frame where the args are saved below a dynamicly allocated
-	# region under the high frame?
-	#
-	# 10010000000000010000000011110000
-	.mask 0x900100F0, -((NARGSAVE+LOCALSZ)*SZREG)
-
-	# thou shalt not use .cprestore if yer frame has variable size...
-	# .cprestore GPOFF
-
-	REG_S	ra, RAOFF(sp)
-
-	# this happens automatically with .cprestore, but we cannot use that op...
-	REG_S	gp, GPOFF(sp)
-	REG_S	s0, S0OFF(sp)
-	REG_S	s1, S1OFF(sp)
-
-	REG_S	a0, A0OFF(sp)
-	REG_S	a1, A1OFF(sp)
-	REG_S	a2, A2OFF(sp)
-	REG_S	a3, A3OFF(sp)
+	# specify the save register mask for gp, fp, ra, a3 - a0
+	.mask 0xD00000F0, RAOFF-FRAMESZ
 
-	# invoke_count_words(paramCount, params)
-	move	a0, a2
-	move	a1, a3
+	sw	ra, RAOFF(sp)
+	sw	fp, FPOFF(sp)
 
-	jal	invoke_count_words
-	lw	gp, GPOFF(sp)
+	# we can't use .cprestore in a variable stack frame
+	sw	gp, GPOFF(sp)
 
-	# save the old sp so we can pop the param area and any "low frame"
-	# needed as an argsave area below the param block for callees that
-	# we invoke.
-	move	s0, sp
-
-	REG_L	a1, A2OFF(sp)	# a1 = paramCount
-	REG_L	a2, A3OFF(sp)	# a2 = params
-
-	# we define a word as 4 bytes, period end of story!
-	sll	v0, 2		# 4 bytes * result of invoke_copy_words
-	subu	v0, LOFRAMESZ	# but we take back the argsave area built into
-				# our stack frame -- SWEET!
-	subu	sp, sp, v0	# make room
-	move	a0, sp		# a0 = param stack address
-	move	s1, a0		# save it for later -- it should be safe here
-
-	# the old sp is still saved in s0, but we now need another argsave
-	# area ("low frame") for the invoke_copy_to_stack call.
-	subu	sp, sp, LOFRAMESZ
+	sw	a0, A0OFF(sp)
+	sw	a1, A1OFF(sp)
+	sw	a2, A2OFF(sp)
+	sw	a3, A3OFF(sp)
+
+	# save bottom of fixed frame
+	move	fp, sp
+
+	# extern "C" uint32
+	# invoke_count_words(PRUint32 paramCount, nsXPTCVariant* s);
+	la	t9, invoke_count_words
+	move	a0, a2
+	move	a1, a3
+	jalr	t9
+	lw  	gp, GPOFF(fp)
 
-	# copy the param into the stack areas
+	# allocate variable stack, with a size of:
+	# wordsize (of 4 bytes) * result (already aligned to dword)
+	# but a minimum of 16 byte
+	sll	v0, 2
+	slt	t0, v0, 16
+	beqz	t0, 1f
+	li	v0, 16
+1:	subu	sp, v0
+
+	# let a0 point to the bottom of the variable stack, allocate
+	# another fixed stack for:
+	# extern "C" void
 	# invoke_copy_to_stack(PRUint32* d, PRUint32 paramCount,
-	#                      nsXPTCVariant* s)
-	jal     invoke_copy_to_stack
-	lw  	gp, GPOFF(s0)
-
-	move	sp, s0		# get orig sp back, popping params and argsave
-
-	REG_L	a0, A0OFF(sp)	# a0 = set "that" to be "this"
-	REG_L	a1, A1OFF(sp)	# a1 = methodIndex
-
-	# t1 = methodIndex * 4
-	# (use shift instead of mult)
-	sll	t1, a1, 2
-
-	# calculate the function we need to jump to,
-	# which must then be saved in t9
+	#		       nsXPTCVariant* s);
+	la	t9, invoke_copy_to_stack
+	move	a0, sp
+	lw	a1, A2OFF(fp)
+	lw	a2, A3OFF(fp)
+	subu	sp, 16
+	jalr	t9
+	lw  	gp, GPOFF(fp)
+
+	# back to the variable stack frame
+	addu	sp, 16
+
+	# calculate the function we need to jump to, which must then be
+	# stored in t9
+	lw	a0, A0OFF(fp)	# a0 = set "that" to be "this"
+	lw	t0, A1OFF(fp)	# a1 = methodIndex
 	lw	t9, 0(a0)
-	addu	t9, t9, t1
-	lw	t9, 8(t9)
-
-	# a1..a3 and f13..f14 should now be set to what
-	# invoke_copy_to_stack told us. skip a0 and f12
-	# because that is the "this" pointer
-
-	REG_L	a1, 1*SZREG(s1)
-	REG_L	a2, 2*SZREG(s1)
-	REG_L	a3, 3*SZREG(s1)
-
-	l.d	$f13, 8(s1)
-	l.d	$f14, 16(s1)
-
-	# Create the stack pointer for the function, which must have 4 words
-	# of space for callee-saved args.  invoke_count_words allocated space
-        # for a0 starting at s1, so we just move s1 into sp.
-	move	sp, s1
+	# t0 = methodIndex << PTRLOG
+	sll	t0, t0, PTRLOG
+	addu	t9, t0
+#if defined(__GXX_ABI_VERSION) && __GXX_ABI_VERSION >= 100 /* G++ V3 ABI */
+	lw	t9, (t9)
+#else /* not G++ V3 ABI */
+	lw	t9, 2*PTRSIZE(t9)
+#endif /* G++ V3 ABI */
+
+	# Set a1-a3 to what invoke_copy_to_stack told us. a0 is already
+	# the "this" pointer. We don't have to care about floating
+	# point arguments, the non-FP "this" pointer as first argument
+	# means they'll never be used.
+	lw	a1, 1*SZREG(sp)
+	lw	a2, 2*SZREG(sp)
+	lw	a3, 3*SZREG(sp)
+
+	jalr	t9
+	# Micro-optimization: There's no gp usage below this point, so
+	# we don't reload.
+	# lw	gp, GPOFF(fp)
 
-	jalr	ra, t9
-	lw	gp, GPOFF(s0)
+	# leave variable stack frame
+	move	sp, fp
 
-	move	sp, s0
+	lw	ra, RAOFF(sp)
+	lw	fp, FPOFF(sp)
 
-	REG_L	ra, RAOFF(sp)
-	REG_L	s0, S0OFF(sp)
-	addu	sp, FRAMESZ
+	addiu	sp, FRAMESZ
 	j	ra
-.end _XPTC_InvokeByIndex
+END(_NS_InvokeByIndex_P)
--- xulrunner-1.9.0.19.orig/xpcom/reflect/xptcall/src/md/unix/xptcstubs_asm_mips.s
+++ xulrunner-1.9.0.19/xpcom/reflect/xptcall/src/md/unix/xptcstubs_asm_mips.s
@@ -0,0 +1,142 @@
+/* -*- Mode: asm; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * Version: MPL 1.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ * Netscape Communications Corp, Inc.
+ * Portions created by the Initial Developer are Copyright (C) 2001
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Stuart Parmenter <pavlov@netscape.com>
+ *   Chris Waterson   <waterson@netscape.com>
+ *   Thiemo Seufer    <seufer@csv.ica.uni-stuttgart.de>
+ */
+
+/* This code is for MIPS using the O32 ABI. */
+
+#include <sys/regdef.h>
+#include <sys/asm.h>
+
+# NARGSAVE is the argument space in the callers frame, including extra
+# 'shadowed' space for the argument registers. The minimum of 4
+# argument slots is sometimes predefined in the header files.
+#ifndef NARGSAVE
+#define NARGSAVE 4
+#endif
+
+#define LOCALSZ 2	/* gp, ra */
+#define FRAMESZ ((((NARGSAVE+LOCALSZ)*SZREG)+ALSZ)&ALMASK)
+
+#define RAOFF (FRAMESZ - (1*SZREG))
+#define GPOFF (FRAMESZ - (2*SZREG))
+
+#define A0OFF (FRAMESZ + (0*SZREG))
+#define A1OFF (FRAMESZ + (1*SZREG))
+#define A2OFF (FRAMESZ + (2*SZREG))
+#define A3OFF (FRAMESZ + (3*SZREG))
+
+	.text
+
+#if defined(__GXX_ABI_VERSION) && __GXX_ABI_VERSION >= 100 /* G++ V3 ABI */
+#define STUB_ENTRY(x)						\
+	.if x < 10;						\
+	.globl	_ZN14nsXPTCStubBase5Stub ##x ##Ev;		\
+	.type	_ZN14nsXPTCStubBase5Stub ##x ##Ev,@function;	\
+	.aent	_ZN14nsXPTCStubBase5Stub ##x ##Ev,0;		\
+_ZN14nsXPTCStubBase5Stub ##x ##Ev:;				\
+	SETUP_GP;						\
+	li	t0,x;						\
+	b	sharedstub;					\
+	.elseif x < 100;					\
+	.globl	_ZN14nsXPTCStubBase6Stub ##x ##Ev;		\
+	.type	_ZN14nsXPTCStubBase6Stub ##x ##Ev,@function;	\
+	.aent	_ZN14nsXPTCStubBase6Stub ##x ##Ev,0;		\
+_ZN14nsXPTCStubBase6Stub ##x ##Ev:;				\
+	SETUP_GP;						\
+	li	t0,x;						\
+	b	sharedstub;					\
+	.elseif x < 1000;					\
+	.globl	_ZN14nsXPTCStubBase7Stub ##x ##Ev;		\
+	.type	_ZN14nsXPTCStubBase7Stub ##x ##Ev,@function;	\
+	.aent	_ZN14nsXPTCStubBase7Stub ##x ##Ev,0;		\
+_ZN14nsXPTCStubBase7Stub ##x ##Ev:;				\
+	SETUP_GP;						\
+	li	t0,x;						\
+	b	sharedstub;					\
+	.else;							\
+	.err;							\
+	.endif
+#else /* not G++ V3 ABI */
+#define STUB_ENTRY(x)						\
+	.globl	Stub ##x ##__14nsXPTCStubBase;			\
+	.type	Stub ##x ##__14nsXPTCStubBase,@function;	\
+	.aent	Stub ##x ##__14nsXPTCStubBase,0;		\
+Stub ##x ##__14nsXPTCStubBase:;					\
+	SETUP_GP;						\
+	li	t0,x;						\
+	b	sharedstub
+#endif /* G++ V3 ABI */
+
+# SENTINEL_ENTRY is handled in the cpp file.
+#define SENTINEL_ENTRY(x)
+
+#
+# open a dummy frame for the function entries
+#
+	.align	2
+	.type	dummy,@function
+	.ent	dummy, 0
+	.frame	sp, FRAMESZ, ra 
+dummy:
+	SETUP_GP
+
+#include "xptcstubsdef.inc"
+
+sharedstub:
+	subu	sp, FRAMESZ
+
+	# specify the save register mask for gp, ra, a0-a3
+	.mask 0x900000F0, RAOFF-FRAMESZ
+
+	sw	ra, RAOFF(sp)
+	SAVE_GP(GPOFF)
+
+	# Micro-optimization: a0 is already loaded, and its slot gets
+	# ignored by PrepareAndDispatch, so no need to save it here.
+	# sw	a0, A0OFF(sp)
+	sw	a1, A1OFF(sp)
+	sw	a2, A2OFF(sp)
+	sw	a3, A3OFF(sp)
+
+	la	t9, PrepareAndDispatch
+
+	# t0 is methodIndex
+	move	a1, t0
+	# have a2 point to the begin of the argument space on stack
+	addiu	a2, sp, FRAMESZ
+
+	# PrepareAndDispatch(that, methodIndex, args)
+	jalr	t9
+
+	# Micro-optimization: Using jalr explicitly has the side-effect
+	# of not triggering .cprestore. This is ok because we have no
+	# gp reference below this point. It also allows better
+	# instruction sscheduling.
+	# lw	gp, GPOFF(fp)
+ 
+ 	lw	ra, RAOFF(sp)
+	addiu	sp, FRAMESZ
+	j	ra
+	END(dummy)
--- xulrunner-1.9.0.19.orig/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_linux_m68k.cpp
+++ xulrunner-1.9.0.19/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_linux_m68k.cpp
@@ -128,8 +128,8 @@
     }
 }
 
-XPTC_PUBLIC_API(nsresult)
-XPTC_InvokeByIndex(nsISupports* that, PRUint32 methodIndex,
+EXPORT_XPCOM_API(nsresult)
+NS_InvokeByIndex_P(nsISupports* that, PRUint32 methodIndex,
                    PRUint32 paramCount, nsXPTCVariant* params)
 {
     PRUint32 result, n;
--- xulrunner-1.9.0.19.orig/xpcom/reflect/xptcall/src/md/unix/xptc_platforms_unixish_x86.h
+++ xulrunner-1.9.0.19/xpcom/reflect/xptcall/src/md/unix/xptc_platforms_unixish_x86.h
@@ -67,7 +67,7 @@
 *
 */
 
-#if defined(LINUX) || (defined(__GLIBC__) && defined(__FreeBSD_kernel__))
+#if defined(LINUX) || (defined(__GLIBC__) && (defined(__FreeBSD_kernel__) || defined(__GNU__)))
 
 #if (__GNUC__ == 2) && (__GNUC_MINOR__ <= 7)
 /* Old gcc 2.7.x.x.  What does gcc 2.8.x do?? */
--- xulrunner-1.9.0.19.orig/xpcom/reflect/xptcall/src/md/unix/xptcstubs_mips.cpp
+++ xulrunner-1.9.0.19/xpcom/reflect/xptcall/src/md/unix/xptcstubs_mips.cpp
@@ -39,6 +39,7 @@
  * ***** END LICENSE BLOCK ***** */
 
 #include "xptcprivate.h"
+#include "xptiprivate.h"
 
 /*
  * This is for MIPS O32 ABI
@@ -54,7 +55,6 @@
 
     nsXPTCMiniVariant paramBuffer[PARAM_BUFFER_COUNT];
     nsXPTCMiniVariant* dispatchParams = NULL;
-    nsIInterfaceInfo* iface_info = NULL;
     const nsXPTMethodInfo* info;
     PRUint8 paramCount;
     PRUint8 i;
@@ -62,11 +62,8 @@
 
     NS_ASSERTION(self,"no self");
 
-    self->GetInterfaceInfo(&iface_info);
-    NS_ASSERTION(iface_info,"no interface info");
-
-    iface_info->GetMethodInfo(PRUint16(methodIndex), &info);
-    NS_ASSERTION(info,"no interface info");
+    self->mEntry->GetMethodInfo(PRUint16(methodIndex), &info);
+    NS_ASSERTION(info,"no method info");
 
     paramCount = info->GetParamCount();
 
@@ -109,9 +106,7 @@
         }
     }
 
-    result = self->CallMethod((PRUint16)methodIndex, info, dispatchParams);
-
-    NS_RELEASE(iface_info);
+    result = self->mOuter->CallMethod((PRUint16)methodIndex, info, dispatchParams);
 
     if(dispatchParams != paramBuffer)
         delete [] dispatchParams;
--- xulrunner-1.9.0.19.orig/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_mips.cpp
+++ xulrunner-1.9.0.19/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_mips.cpp
@@ -24,6 +24,7 @@
  * Contributor(s):
  *   Stuart Parmenter <pavlov@netscape.com>
  *   Brendan Eich     <brendan@mozilla.org>
+ *   Thiemo Seufer    <seufer@csv.ica.uni-stuttgart.de>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either of the GNU General Public License Version 2 or later (the "GPL"),
@@ -52,10 +53,8 @@
     // Count a word for a0 even though it's never stored or loaded
     // We do this only for alignment of register pairs.
     PRUint32 result = 1;
-    for (PRUint32 i = 0; i < paramCount; i++, s++)
+    for (PRUint32 i = 0; i < paramCount; i++, result++, s++)
     {
-        result++;
-
         if (s->IsPtrData())
             continue;
 
@@ -68,6 +67,9 @@
 		result++;
 	    result++;
 	    break;
+
+        default:
+            break;
         }
     }
     return (result + 1) & ~(PRUint32)1;
@@ -88,8 +90,6 @@
             continue;
         }
 
-        *((void**)d) = s->val.p;
-
         switch(s->type)
         {
         case nsXPTType::T_I64    :
@@ -104,19 +104,20 @@
             if ((PRWord)d & 4) d++;
             *((double*)   d) = s->val.d;      d++;
             break;
+        default:
+            *((void**)d) = s->val.p;
+            break;
         }
     }
 }
 
-extern "C" nsresult _XPTC_InvokeByIndex(nsISupports* that, PRUint32 methodIndex,
+extern "C" nsresult _NS_InvokeByIndex_P(nsISupports* that, PRUint32 methodIndex,
                                         PRUint32 paramCount,
                                         nsXPTCVariant* params);
 
-extern "C"
-XPTC_PUBLIC_API(nsresult)
-XPTC_InvokeByIndex(nsISupports* that, PRUint32 methodIndex,
+EXPORT_XPCOM_API(nsresult)
+NS_InvokeByIndex_P(nsISupports* that, PRUint32 methodIndex,
                    PRUint32 paramCount, nsXPTCVariant* params)
 {
-    return _XPTC_InvokeByIndex(that, methodIndex, paramCount, params);
-}    
-
+    return _NS_InvokeByIndex_P(that, methodIndex, paramCount, params);
+}
--- xulrunner-1.9.0.19.orig/xpcom/string/src/nsTSubstring.cpp
+++ xulrunner-1.9.0.19/xpcom/string/src/nsTSubstring.cpp
@@ -36,6 +36,8 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
+#include <prlog.h>
+
 nsTSubstring_CharT::nsTSubstring_CharT( char_type *data, size_type length,
                                         PRUint32 flags)
 #ifdef MOZ_V1_STRING_ABI
@@ -80,10 +82,13 @@
 
     size_type curCapacity = Capacity();
 
-    // If |capacity > size_type(-1)/2|, then our doubling algorithm may not be
+    // If |capacity > kMaxCapacity|, then our doubling algorithm may not be
     // able to allocate it.  Just bail out in cases like that.  We don't want
     // to be allocating 2GB+ strings anyway.
-    if (capacity > size_type(-1)/2) {
+    PR_STATIC_ASSERT((sizeof(nsStringBuffer) & 0x1) == 0);
+    const size_type kMaxCapacity =
+      (size_type(-1)/2 - sizeof(nsStringBuffer)) / sizeof(char_type) - 2;
+    if (capacity > kMaxCapacity) {
       // Also assert for |capacity| equal to |size_type(-1)|, since we use that value to
       // flag immutability.
       NS_ASSERTION(capacity != size_type(-1), "Bogus capacity");
@@ -101,15 +106,15 @@
           return PR_TRUE;
         }
 
-        if (curCapacity > 0)
-          {
-            // use doubling algorithm when forced to increase available
-            // capacity.
-            PRUint32 temp = curCapacity;
-            while (temp < capacity)
-              temp <<= 1;
-            capacity = temp;
-          }
+        if (curCapacity > 0) {
+          // Use doubling algorithm when forced to increase available capacity.
+          size_type temp = curCapacity;
+          while (temp < capacity)
+            temp <<= 1;
+          NS_ASSERTION(NS_MIN(temp, kMaxCapacity) >= capacity,
+                       "should have hit the early return at the top");
+          capacity = NS_MIN(temp, kMaxCapacity);
+        }
       }
 
     //
--- xulrunner-1.9.0.19.orig/xpcom/string/src/nsSubstring.cpp
+++ xulrunner-1.9.0.19/xpcom/string/src/nsSubstring.cpp
@@ -205,6 +205,9 @@
 nsStringBuffer::Alloc(size_t size)
   {
     NS_ASSERTION(size != 0, "zero capacity allocation not allowed");
+    NS_ASSERTION(sizeof(nsStringBuffer) + size <= size_t(PRUint32(-1)) &&
+                 sizeof(nsStringBuffer) + size > size,
+                 "mStorageSize will truncate");
 
     nsStringBuffer *hdr =
         (nsStringBuffer *) malloc(sizeof(nsStringBuffer) + size);
@@ -225,12 +228,15 @@
     STRING_STAT_INCREMENT(Realloc);
 
     NS_ASSERTION(size != 0, "zero capacity allocation not allowed");
+    NS_ASSERTION(sizeof(nsStringBuffer) + size <= size_t(PRUint32(-1)) &&
+                 sizeof(nsStringBuffer) + size > size,
+                 "mStorageSize will truncate");
 
     // no point in trying to save ourselves if we hit this assertion
     NS_ASSERTION(!hdr->IsReadonly(), "|Realloc| attempted on readonly string");
 
     // Treat this as a release and addref for refcounting purposes, since we
-    // just asserted that the refcound is 1.  If we don't do that, refcount
+    // just asserted that the refcount is 1.  If we don't do that, refcount
     // logging will claim we've leaked all sorts of stuff.
     NS_LOG_RELEASE(hdr, 0, "nsStringBuffer");
     
--- xulrunner-1.9.0.19.orig/testing/crashtest/crashtests.list
+++ xulrunner-1.9.0.19/testing/crashtest/crashtests.list
@@ -25,6 +25,7 @@
 
 include ../../editor/libeditor/html/crashtests/crashtests.list
 include ../../editor/libeditor/base/crashtests/crashtests.list
+include ../../editor/libeditor/text/crashtests/crashtests.list
 include ../../editor/composer/src/crashtests/crashtests.list
 
 include ../../intl/lwbrk/src/crashtests/crashtests.list
--- xulrunner-1.9.0.19.orig/security/manager/ssl/src/nsNSSCallbacks.cpp
+++ xulrunner-1.9.0.19/security/manager/ssl/src/nsNSSCallbacks.cpp
@@ -73,6 +73,7 @@
 #include "cert.h"
 #include "ocsp.h"
 #include "nssb64.h"
+#include "secerr.h"
 
 static NS_DEFINE_CID(kNSSComponentCID, NS_NSSCOMPONENT_CID);
 NSSCleanupAutoPtrClass(CERTCertificate, CERT_DestroyCertificate)
@@ -951,10 +952,134 @@
   PR_Free(signer);
 }
 
+struct nsSerialBinaryBlacklistEntry
+{
+  unsigned int len;
+  const char *binary_serial;
+};
+
+// bug 642395
+static struct nsSerialBinaryBlacklistEntry myUTNBlacklistEntries[] = {
+  { 17, "\x00\x92\x39\xd5\x34\x8f\x40\xd1\x69\x5a\x74\x54\x70\xe1\xf2\x3f\x43" },
+  { 17, "\x00\xd8\xf3\x5f\x4e\xb7\x87\x2b\x2d\xab\x06\x92\xe3\x15\x38\x2f\xb0" },
+  { 16, "\x72\x03\x21\x05\xc5\x0c\x08\x57\x3d\x8e\xa5\x30\x4e\xfe\xe8\xb0" },
+  { 17, "\x00\xb0\xb7\x13\x3e\xd0\x96\xf9\xb5\x6f\xae\x91\xc8\x74\xbd\x3a\xc0" },
+  { 16, "\x39\x2a\x43\x4f\x0e\x07\xdf\x1f\x8a\xa3\x05\xde\x34\xe0\xc2\x29" },
+  { 16, "\x3e\x75\xce\xd4\x6b\x69\x30\x21\x21\x88\x30\xae\x86\xa8\x2a\x71" },
+  { 17, "\x00\xe9\x02\x8b\x95\x78\xe4\x15\xdc\x1a\x71\x0a\x2b\x88\x15\x44\x47" },
+  { 17, "\x00\xd7\x55\x8f\xda\xf5\xf1\x10\x5b\xb2\x13\x28\x2b\x70\x77\x29\xa3" },
+  { 16, "\x04\x7e\xcb\xe9\xfc\xa5\x5f\x7b\xd0\x9e\xae\x36\xe1\x0c\xae\x1e" },
+  { 17, "\x00\xf5\xc8\x6a\xf3\x61\x62\xf1\x3a\x64\xf5\x4f\x6d\xc9\x58\x7c\x06" },
+  { 0, 0 } // end marker
+};
+
+// Call this if we have already decided that a cert should be treated as INVALID,
+// in order to check if we to worsen the error to REVOKED.
+PRErrorCode
+PSM_SSL_DigiNotarTreatAsRevoked(CERTCertificate * serverCert,
+                                CERTCertList * serverCertChain)
+{
+  // If any involved cert was issued by DigiNotar, 
+  // and serverCert was issued after 01-JUL-2011,
+  // then worsen the error to revoked.
+  
+  PRTime cutoff = 0;
+  PRStatus status = PR_ParseTimeString("01-JUL-2011 00:00", PR_TRUE, &cutoff);
+  if (status != PR_SUCCESS) {
+    NS_ASSERTION(status == PR_SUCCESS, "PR_ParseTimeString failed");
+    // be safe, assume it's afterwards, keep going
+  } else {
+    PRTime notBefore = 0, notAfter = 0;
+    if (CERT_GetCertTimes(serverCert, &notBefore, &notAfter) == SECSuccess &&
+           notBefore < cutoff) {
+      // no worsening for certs issued before the cutoff date
+      return 0;
+    }
+  }
+  
+  for (CERTCertListNode *node = CERT_LIST_HEAD(serverCertChain);
+       !CERT_LIST_END(node, serverCertChain);
+       node = CERT_LIST_NEXT(node)) {
+    if (node->cert->issuerName &&
+        strstr(node->cert->issuerName, "CN=DigiNotar")) {
+      return SEC_ERROR_REVOKED_CERTIFICATE;
+    }
+  }
+  
+  return 0;
+}
+
+// Call this only if a cert has been reported by NSS as VALID
+PRErrorCode
+PSM_SSL_BlacklistDigiNotar(CERTCertificate * serverCert,
+                           CERTCertList * serverCertChain)
+{
+  PRBool isDigiNotarIssuedCert = PR_FALSE;
+
+  for (CERTCertListNode *node = CERT_LIST_HEAD(serverCertChain);
+       !CERT_LIST_END(node, serverCertChain);
+       node = CERT_LIST_NEXT(node)) {
+    if (!node->cert->issuerName)
+      continue;
+
+    if (strstr(node->cert->issuerName, "CN=DigiNotar")) {
+      isDigiNotarIssuedCert = PR_TRUE;
+    }
+  }
+
+  if (isDigiNotarIssuedCert) {
+    // let's see if we want to worsen the error code to revoked.
+    PRErrorCode revoked_code = PSM_SSL_DigiNotarTreatAsRevoked(serverCert, serverCertChain);
+    return (revoked_code != 0) ? revoked_code : SEC_ERROR_UNTRUSTED_ISSUER;
+  }
+
+  return 0;
+}
+
+
 SECStatus PR_CALLBACK AuthCertificateCallback(void* client_data, PRFileDesc* fd,
                                               PRBool checksig, PRBool isServer) {
   nsNSSShutDownPreventionLock locker;
 
+  CERTCertificate *serverCert = SSL_PeerCertificate(fd);
+  if (serverCert && 
+      serverCert->serialNumber.data &&
+      !strcmp(serverCert->issuerName, 
+        "CN=UTN-USERFirst-Hardware,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US")) {
+
+    unsigned char *server_cert_comparison_start = (unsigned char*)serverCert->serialNumber.data;
+    unsigned int server_cert_comparison_len = serverCert->serialNumber.len;
+
+    while (server_cert_comparison_len) {
+      if (*server_cert_comparison_start != 0)
+        break;
+
+      ++server_cert_comparison_start;
+      --server_cert_comparison_len;
+    }
+
+    nsSerialBinaryBlacklistEntry *walk = myUTNBlacklistEntries;
+    for ( ; walk && walk->len; ++walk) {
+
+      unsigned char *locked_cert_comparison_start = (unsigned char*)walk->binary_serial;
+      unsigned int locked_cert_comparison_len = walk->len;
+      
+      while (locked_cert_comparison_len) {
+        if (*locked_cert_comparison_start != 0)
+          break;
+        
+        ++locked_cert_comparison_start;
+        --locked_cert_comparison_len;
+      }
+
+      if (server_cert_comparison_len == locked_cert_comparison_len &&
+          !memcmp(server_cert_comparison_start, locked_cert_comparison_start, locked_cert_comparison_len)) {
+        PR_SetError(SEC_ERROR_REVOKED_CERTIFICATE, 0);
+        return SECFailure;
+      }
+    }
+  }
+  
   // first the default action
   SECStatus rv = SSL_AuthCertificate(CERT_GetDefaultCertDB(), fd, checksig, isServer);
 
@@ -962,7 +1087,6 @@
   // complete chain at any time it might need it.
   // But we keep only those CA certs in the temp db, that we didn't already know.
   
-  CERTCertificate *serverCert = SSL_PeerCertificate(fd);
   CERTCertificateCleaner serverCertCleaner(serverCert);
 
   if (serverCert) {
@@ -974,14 +1098,37 @@
       nsc = new nsNSSCertificate(serverCert);
     }
 
+    CERTCertList *certList = nsnull;
+    certList = CERT_GetCertChainFromCert(serverCert, PR_Now(), certUsageSSLCA);
+    if (!certList) {
+      rv = SECFailure;
+    } else {
+      PRErrorCode blacklistErrorCode;
+      if (rv == SECSuccess) { // PSM_SSL_PKIX_AuthCertificate said "valid cert"
+        blacklistErrorCode = PSM_SSL_BlacklistDigiNotar(serverCert, certList);
+      } else { // PSM_SSL_PKIX_AuthCertificate said "invalid cert"
+        PRErrorCode savedErrorCode = PORT_GetError();
+        // Check if we want to worsen the error code to "revoked".
+        blacklistErrorCode = PSM_SSL_DigiNotarTreatAsRevoked(serverCert, certList);
+        if (blacklistErrorCode == 0) {
+          // we don't worsen the code, let's keep the original error code from NSS
+          PORT_SetError(savedErrorCode);
+        }
+      }
+
+      if (blacklistErrorCode != 0) {
+        infoObject->SetCertIssuerBlacklisted();
+        PORT_SetError(blacklistErrorCode);
+        rv = SECFailure;
+      }
+    }
+
     if (SECSuccess == rv) {
       if (nsc) {
         PRBool dummyIsEV;
         nsc->GetIsExtendedValidation(&dummyIsEV); // the nsc object will cache the status
       }
     
-      CERTCertList *certList = CERT_GetCertChainFromCert(serverCert, PR_Now(), certUsageSSLCA);
-
       nsCOMPtr<nsINSSComponent> nssComponent;
       
       for (CERTCertListNode *node = CERT_LIST_HEAD(certList);
@@ -1017,6 +1164,9 @@
         }
       }
 
+    }
+
+    if (certList) {
       CERT_DestroyCertList(certList);
     }
 
--- xulrunner-1.9.0.19.orig/security/manager/ssl/src/nsIdentityChecking.cpp
+++ xulrunner-1.9.0.19/security/manager/ssl/src/nsIdentityChecking.cpp
@@ -117,18 +117,6 @@
     nsnull
   },
   {
-    // E=info@diginotar.nl,CN=DigiNotar Root CA,O=DigiNotar,C=NL
-    "2.16.528.1.1001.1.1.1.12.6.1.1.1",
-    "DigiNotar EV OID",
-    SEC_OID_UNKNOWN,
-    "C0:60:ED:44:CB:D8:81:BD:0E:F8:6C:0B:A2:87:DD:CF:81:67:47:8C",
-    "MF8xCzAJBgNVBAYTAk5MMRIwEAYDVQQKEwlEaWdpTm90YXIxGjAYBgNVBAMTEURp"
-    "Z2lOb3RhciBSb290IENBMSAwHgYJKoZIhvcNAQkBFhFpbmZvQGRpZ2lub3Rhci5u"
-    "bA==",
-    "DHbanJEMTiye/hXQWJM8TA==",
-    nsnull
-  },
-  {
     // CN=SwissSign Gold CA - G2,O=SwissSign AG,C=CH
     "2.16.756.1.89.1.2.1.1",
     "SwissSign EV OID",
--- xulrunner-1.9.0.19.orig/security/manager/ssl/src/nsNSSIOLayer.cpp
+++ xulrunner-1.9.0.19/security/manager/ssl/src/nsNSSIOLayer.cpp
@@ -59,6 +59,7 @@
 #include "nsDateTimeFormatCID.h"
 #include "nsIClientAuthDialogs.h"
 #include "nsICertOverrideService.h"
+#include "nsIBadCertListener.h"
 #include "nsIBadCertListener2.h"
 #include "nsISSLErrorListener.h"
 #include "nsIObjectInputStream.h"
@@ -217,7 +218,8 @@
     mHandshakeInProgress(PR_FALSE),
     mAllowTLSIntoleranceTimeout(PR_TRUE),
     mHandshakeStartTime(0),
-    mPort(0)
+    mPort(0),
+    mIsCertIssuerBlacklisted(PR_FALSE)
 {
   mThreadData = new nsSSLSocketThreadData;
 }
@@ -751,6 +753,20 @@
   }
 }
 
+void nsNSSSocketInfo::SetBadCertUIStatus(nsNSSSocketInfo::BadCertUIStatusType aNewStatus)
+{
+  if (mBadCertUIStatus == bcuis_active &&
+      aNewStatus == bcuis_was_shown)
+  {
+    // we were blocked and going back to unblocked,
+    // so let's reset the handshake start time, in order to ensure
+    // we do not count the amount of time while the UI was shown.
+    mHandshakeStartTime = PR_IntervalNow();
+  }
+
+  mBadCertUIStatus = aNewStatus;
+}
+
 void nsNSSSocketInfo::SetAllowTLSIntoleranceTimeout(PRBool aAllow)
 {
   mAllowTLSIntoleranceTimeout = aAllow;
@@ -760,7 +776,8 @@
 
 PRBool nsNSSSocketInfo::HandshakeTimeout()
 {
-  if (!mHandshakeInProgress || !mAllowTLSIntoleranceTimeout)
+  if (!mHandshakeInProgress || !mAllowTLSIntoleranceTimeout ||
+      mBadCertUIStatus == bcuis_active)
     return PR_FALSE;
 
   return ((PRIntervalTime)(PR_IntervalNow() - mHandshakeStartTime)
@@ -1613,6 +1630,37 @@
   return PR_FALSE;
 }
 
+static PRBool
+isClosedConnectionAfterBadCertUIWasShown(PRInt32 bytesTransfered,
+                                         PRBool wasReading,
+                                         PRInt32 err,
+                                         nsNSSSocketInfo::BadCertUIStatusType aBadCertUIStatus)
+{
+  if (aBadCertUIStatus != nsNSSSocketInfo::bcuis_not_shown)
+  {
+    // Bad cert UI was shown for this socket.
+    // Server timeout possible.
+    // Retry on a simple connection close.
+
+    if (wasReading && 0 == bytesTransfered)
+      return PR_TRUE;
+
+    if (0 > bytesTransfered)
+    {
+      switch (err)
+      {
+        case PR_CONNECT_RESET_ERROR:
+        case PR_END_OF_FILE_ERROR:
+          return PR_TRUE;
+        default:
+          break;
+      }
+    }
+  }
+
+  return PR_FALSE;
+}
+
 PRInt32
 nsSSLThread::checkHandshake(PRInt32 bytesTransfered, 
                             PRBool wasReading,
@@ -1664,6 +1712,12 @@
         return bytesTransfered;
       }
 
+      wantRetry =
+        isClosedConnectionAfterBadCertUIWasShown(bytesTransfered,
+                                                 wasReading,
+                                                 err,
+                                                 socketInfo->GetBadCertUIStatus());
+
       if (!wantRetry // no decision yet
           && isTLSIntoleranceError(err, socketInfo->GetHasCleartextPhase()))
       {
@@ -1681,6 +1735,12 @@
   {
     if (handleHandshakeResultNow)
     {
+      wantRetry =
+        isClosedConnectionAfterBadCertUIWasShown(bytesTransfered,
+                                                 wasReading,
+                                                 0,
+                                                 socketInfo->GetBadCertUIStatus());
+
       if (!wantRetry // no decision yet
           && !socketInfo->GetHasCleartextPhase()) // mirror PR_CONNECT_RESET_ERROR treament
       {
@@ -2912,6 +2972,10 @@
                                  PR_Now(), (void*)infoObject, 
                                  verify_log, NULL);
 
+    if (infoObject->IsCertIssuerBlacklisted()) {
+      collected_errors |= nsICertOverrideService::ERROR_UNTRUSTED;
+    }
+
     // We ignore the result code of the cert verification.
     // Either it is a failure, which is expected, and we'll process the
     //                         verify log below.
@@ -3042,6 +3106,48 @@
         rv = proxy_bcl->NotifyCertProblem(csi, status, hostWithPortString, 
                                           &suppressMessage);
       }
+    } else {
+      nsCOMPtr<nsIBadCertListener> handler = do_GetInterface(callbacks);
+      nsIBadCertListener *badCertHandler = nsnull;
+      if (handler) {
+        NS_GetProxyForObject(NS_PROXY_TO_MAIN_THREAD,
+                             NS_GET_IID(nsIBadCertListener),
+                             handler,
+                             NS_PROXY_SYNC,
+                             (void**)&badCertHandler);
+      }
+      if (!badCertHandler) {
+        getNSSDialogs((void**)&badCertHandler,
+                      NS_GET_IID(nsIBadCertListener),
+                      NS_BADCERTLISTENER_CONTRACTID);
+      }
+      if (badCertHandler) {
+        PRBool retVal = PR_TRUE;
+        PRInt16 addType = nsIBadCertListener::UNINIT_ADD_FLAG;
+        nsIInterfaceRequestor *csi = static_cast<nsIInterfaceRequestor*>(infoObject);
+        infoObject->SetBadCertUIStatus(nsNSSSocketInfo::bcuis_active);
+        if (remaining_display_errors & nsICertOverrideService::ERROR_UNTRUSTED) {
+          rv = badCertHandler->ConfirmUnknownIssuer(csi, ix509, &addType, &retVal);
+          if (NS_FAILED(rv)) retVal = PR_FALSE;
+        }
+        if (retVal && (remaining_display_errors & nsICertOverrideService::ERROR_MISMATCH)) {
+          rv = badCertHandler->ConfirmMismatchDomain(csi, hostString, ix509, &retVal);
+          if (NS_FAILED(rv)) retVal = PR_FALSE;
+        }
+        if (retVal && (remaining_display_errors & nsICertOverrideService::ERROR_TIME)) {
+          rv = badCertHandler->ConfirmCertExpired(csi, ix509, &retVal);
+          if (NS_FAILED(rv)) retVal = PR_FALSE;
+        }
+        if (overrideService && retVal && addType != nsIBadCertListener::UNINIT_ADD_FLAG) {
+          overrideService->RememberValidityOverride(hostString, port, ix509,
+                                    nsICertOverrideService::ERROR_UNTRUSTED,
+                                    addType == nsIBadCertListener::ADD_TRUSTED_FOR_SESSION);
+        }
+        infoObject->SetBadCertUIStatus(nsNSSSocketInfo::bcuis_was_shown);
+        if (retVal)
+          return SECSuccess;
+        suppressMessage = PR_TRUE;
+      }
     }
   }
 
--- xulrunner-1.9.0.19.orig/security/manager/ssl/src/nsNSSCallbacks.h
+++ xulrunner-1.9.0.19/security/manager/ssl/src/nsNSSCallbacks.h
@@ -53,6 +53,9 @@
 SECStatus PR_CALLBACK AuthCertificateCallback(void* client_data, PRFileDesc* fd,
                                               PRBool checksig, PRBool isServer);
 
+PRErrorCode PSM_SSL_BlacklistDigiNotar(CERTCertificate * serverCert,
+                                       CERTCertList * serverCertChain);
+
 SECStatus RegisterMyOCSPAIAInfoCallback();
 SECStatus UnregisterMyOCSPAIAInfoCallback();
 
--- xulrunner-1.9.0.19.orig/security/manager/ssl/src/nsNSSIOLayer.h
+++ xulrunner-1.9.0.19/security/manager/ssl/src/nsNSSIOLayer.h
@@ -185,6 +185,13 @@
 
   void SetAllowTLSIntoleranceTimeout(PRBool aAllow);
 
+  enum BadCertUIStatusType {
+    bcuis_not_shown, bcuis_active, bcuis_was_shown
+  };
+
+  void SetBadCertUIStatus(BadCertUIStatusType aNewStatus);
+  BadCertUIStatusType GetBadCertUIStatus() { return mBadCertUIStatus; }
+
   nsresult GetExternalErrorReporting(PRBool* state);
   nsresult SetExternalErrorReporting(PRBool aState);
 
@@ -197,6 +204,12 @@
   
   PRStatus CloseSocketAndDestroy();
   
+  PRBool IsCertIssuerBlacklisted() const {
+    return mIsCertIssuerBlacklisted;
+  }
+  void SetCertIssuerBlacklisted() {
+    mIsCertIssuerBlacklisted = PR_TRUE;
+  }
 protected:
   nsCOMPtr<nsIInterfaceRequestor> mCallbacks;
   PRFileDesc* mFd;
@@ -220,9 +233,11 @@
   PRPackedBool mHasCleartextPhase;
   PRPackedBool mHandshakeInProgress;
   PRPackedBool mAllowTLSIntoleranceTimeout;
+  BadCertUIStatusType mBadCertUIStatus;
   PRIntervalTime mHandshakeStartTime;
   PRInt32 mPort;
   nsXPIDLCString mHostName;
+  PRErrorCode mIsCertIssuerBlacklisted;
 
   /* SSL Status */
   nsRefPtr<nsSSLStatus> mSSLStatus;
--- xulrunner-1.9.0.19.orig/security/manager/ssl/public/Makefile.in
+++ xulrunner-1.9.0.19/security/manager/ssl/public/Makefile.in
@@ -59,6 +59,7 @@
     $(NULL)
 
 XPIDLSRCS = \
+    nsIBadCertListener.idl \
     nsIBadCertListener2.idl \
     nsISSLErrorListener.idl \
     nsIIdentityInfo.idl \
--- xulrunner-1.9.0.19.orig/security/manager/ssl/public/nsIBadCertListener.idl
+++ xulrunner-1.9.0.19/security/manager/ssl/public/nsIBadCertListener.idl
@@ -0,0 +1,155 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ *
+ * ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ * Netscape Communications Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 1998
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Javier Delgadillo <javi@netscape.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "nsISupports.idl"
+
+interface nsIX509Cert;
+interface nsIInterfaceRequestor;
+
+/**
+ * Functions that display warnings for problems with web site trust.
+ *
+ * @status FROZEN
+ */
+[scriptable, uuid(86960956-edb0-11d4-998b-00b0d02354a0)]
+interface nsIBadCertListener : nsISupports {
+
+  /**
+   *  No decision was made by the user, whether to trust a cert.
+   */
+  const short UNINIT_ADD_FLAG = -1;
+
+  /**
+   *  The user decided to add trust to a certificate temporarily
+   *  for the current application session only.
+   */
+  const short ADD_TRUSTED_FOR_SESSION = 1;
+
+  /**
+   *  The user decided to add trust to a certificate permanently.
+   */
+  const short ADD_TRUSTED_PERMANENTLY = 2;
+
+  /**
+   *  Inform the user there are problems with the trust of a certificate,
+   *  and request a decision from the user.
+   *  The UI should offer the user a way to look at the certificate in detail.
+   *  The following is a sample UI message to be shown to the user:
+   *
+   *    Unable to verify the identity of %S as a trusted site.
+   *    Possible reasons for this error:
+   *    - Your browser does not recognize the Certificate Authority 
+   *      that issued the site's certificate.
+   *    - The site's certificate is incomplete due to a 
+   *      server misconfiguration.
+   *    - You are connected to a site pretending to be %S, 
+   *      possibly to obtain your confidential information.
+   *    Please notify the site's webmaster about this problem.
+   *    Before accepting this certificate, you should examine this site's 
+   *      certificate carefully. Are you willing to to accept this certificate 
+   *      for the purpose of identifying the Web site %S?
+   *    o Accept this certificate permanently
+   *    x Accept this certificate temporarily for this session
+   *    o Do not accept this certificate and do not connect to this Web site
+   *
+   *  @param socketInfo A network communication context that can be used to obtain more information
+   *                    about the active connection.
+   *  @param cert The certificate that is not trusted and that is having the problem.
+   *  @param certAddType The user's trust decision. See constants defined above.
+   *
+   *  @return true if the user decided to connect anyway, false if the user decided to not connect
+   */
+  boolean confirmUnknownIssuer(in nsIInterfaceRequestor socketInfo, 
+                               in nsIX509Cert cert,
+                               out short certAddType);
+
+  /**
+   *  Inform the user there are problems with the trust of a certificate,
+   *  and request a decision from the user.
+   *  The hostname mentioned in the server's certificate is not the hostname
+   *  that was used as a destination address for the current connection.
+   *
+   *  @param socketInfo A network communication context that can be used to obtain more information
+   *                    about the active connection.
+   *  @param targetURL The URL that was used to open the current connection.
+   *  @param cert The certificate that was presented by the server.
+   *
+   *  @return true if the user decided to connect anyway, false if the user decided to not connect
+   */
+  boolean confirmMismatchDomain(in nsIInterfaceRequestor socketInfo,
+                                in AUTF8String targetURL,
+                                in nsIX509Cert cert);
+
+  /**
+   *  Inform the user there are problems with the trust of a certificate,
+   *  and request a decision from the user.
+   *  The certificate presented by the server is no longer valid because 
+   *  the validity period has expired.
+   *
+   *  @param socketInfo A network communication context that can be used to obtain more information
+   *                    about the active connection.
+   *  @param cert The certificate that was presented by the server.
+   *
+   *  @return true if the user decided to connect anyway, false if the user decided to not connect
+   */
+  boolean confirmCertExpired(in nsIInterfaceRequestor socketInfo,
+                             in nsIX509Cert cert);
+
+  /**
+   *  Inform the user there are problems with the trust of a certificate,
+   *  and request a decision from the user.
+   *  The Certificate Authority (CA) that issued the server's certificate has issued a 
+   *  Certificate Revocation List (CRL). 
+   *  However, the application does not have a current version of the CA's CRL.
+   *  Due to the application configuration, the application disallows the connection
+   *  to the remote site.
+   *
+   *  @param socketInfo A network communication context that can be used to obtain more information
+   *                    about the active connection.
+   *  @param targetURL The URL that was used to open the current connection.
+   *  @param cert The certificate that was presented by the server.
+   */
+  void notifyCrlNextupdate(in nsIInterfaceRequestor socketInfo,
+                           in AUTF8String targetURL, in nsIX509Cert cert);
+
+};
+
+%{C++
+#define NS_BADCERTLISTENER_CONTRACTID "@mozilla.org/nsBadCertListener;1"
+%}
--- xulrunner-1.9.0.19.orig/xpfe/components/intl/nsCharsetMenu.cpp
+++ xulrunner-1.9.0.19/xpfe/components/intl/nsCharsetMenu.cpp
@@ -1252,6 +1252,10 @@
   NS_TIMELINE_START_TIMER("nsCharsetMenu::InitMoreSubmenus");
 
   nsresult res = NS_OK;
+ 
+  // remove charsets "not for browser"
+  res = RemoveFlaggedCharsets(aDecs, NS_LITERAL_STRING(".notForBrowser"));
+  if (NS_FAILED(res)) return res;
 
   nsCOMPtr<nsIRDFContainer> container1;
   nsCOMPtr<nsIRDFContainer> container2;
--- xulrunner-1.9.0.19.orig/xpfe/appshell/src/Makefile.in
+++ xulrunner-1.9.0.19/xpfe/appshell/src/Makefile.in
@@ -86,7 +86,6 @@
 		nsAppShellWindowEnumerator.cpp \
 		nsWebShellWindow.cpp \
 		nsWindowMediator.cpp \
-		nsAbout.cpp \
 		nsAppShellFactory.cpp \
 		$(NULL)
 
--- xulrunner-1.9.0.19.orig/xpfe/appshell/src/nsAppShellFactory.cpp
+++ xulrunner-1.9.0.19/xpfe/appshell/src/nsAppShellFactory.cpp
@@ -40,7 +40,6 @@
 #include "nscore.h"
 #include "nsIComponentManager.h"
 #include "nsIWindowMediator.h"
-#include "nsAbout.h"
 #include "nsIGenericFactory.h"
 
 #include "nsIAppShellService.h"
@@ -63,11 +62,6 @@
     NS_WINDOWMEDIATOR_CID,
     NS_WINDOWMEDIATOR_CONTRACTID,
     nsWindowMediatorConstructor,
-  },
-  { "kAboutModuleCID",
-    NS_ABOUT_CID,
-    NS_ABOUT_MODULE_CONTRACTID_PREFIX,
-    nsAbout::Create,
   }
 };
 
