diff -Nru thunderbird-1000~31.4.0+build1/debian/changelog thunderbird-1000~31.6.0+build1/debian/changelog
--- thunderbird-1000~31.4.0+build1/debian/changelog	2015-01-28 17:17:50.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/debian/changelog	2015-04-13 12:34:26.000000000 +0000
@@ -1,8 +1,22 @@
-thunderbird (1:1000~31.4.0+build1-0ubuntu1~20150128.1717) vivid; urgency=medium
+thunderbird (1:1000~31.6.0+build1-0ubuntu1~20150413.1234) vivid; urgency=medium
 
   * [CI Build] thunderbird with KDE integration
 
- -- Debian CI <null@debian.org>  Wed, 28 Jan 2015 17:17:50 +0000
+ -- Debian CI <null@debian.org>  Mon, 13 Apr 2015 12:34:26 +0000
+
+thunderbird (1:31.6.0+build1-0ubuntu1) vivid; urgency=medium
+
+  * New upstream stable release (THUNDERBIRD_31_6_0_BUILD1)
+    - see USN-2552-1
+
+ -- Chris Coulson <chris.coulson@canonical.com>  Mon, 30 Mar 2015 19:25:32 +0100
+
+thunderbird (1:31.5.0+build1-0ubuntu1) vivid; urgency=medium
+
+  * New upstream stable release (THUNDERBIRD_31_5_0_BUILD1)
+    - see USN-2506-1
+
+ -- Chris Coulson <chris.coulson@canonical.com>  Mon, 23 Feb 2015 16:45:26 +0000
 
 thunderbird (1:31.4.0+build1-0ubuntu1) vivid; urgency=medium
 
diff -Nru thunderbird-1000~31.4.0+build1/debian/patches/mozilla-kde.patch thunderbird-1000~31.6.0+build1/debian/patches/mozilla-kde.patch
--- thunderbird-1000~31.4.0+build1/debian/patches/mozilla-kde.patch	2015-01-28 17:17:37.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/debian/patches/mozilla-kde.patch	2015-04-13 12:34:16.000000000 +0000
@@ -1,7 +1,7 @@
-Index: thunderbird-1000~31.4.0+build1/mozilla/modules/libpref/src/Makefile.in
+Index: thunderbird-1000~31.6.0+build1/mozilla/modules/libpref/src/Makefile.in
 ===================================================================
---- thunderbird-1000~31.4.0+build1.orig/mozilla/modules/libpref/src/Makefile.in
-+++ thunderbird-1000~31.4.0+build1/mozilla/modules/libpref/src/Makefile.in
+--- thunderbird-1000~31.6.0+build1.orig/mozilla/modules/libpref/src/Makefile.in
++++ thunderbird-1000~31.6.0+build1/mozilla/modules/libpref/src/Makefile.in
 @@ -26,6 +26,8 @@ grepref_files += $(topsrcdir)/mobile/and
  endif
  endif
@@ -11,10 +11,10 @@
  greprefs.js: $(grepref_files)
  	$(call py_action,preprocessor,$(PREF_PPFLAGS) $(DEFINES) $(ACDEFINES) $(XULPPFLAGS) $^ -o $@)
  
-Index: thunderbird-1000~31.4.0+build1/mozilla/modules/libpref/src/Preferences.cpp
+Index: thunderbird-1000~31.6.0+build1/mozilla/modules/libpref/src/Preferences.cpp
 ===================================================================
---- thunderbird-1000~31.4.0+build1.orig/mozilla/modules/libpref/src/Preferences.cpp
-+++ thunderbird-1000~31.4.0+build1/mozilla/modules/libpref/src/Preferences.cpp
+--- thunderbird-1000~31.6.0+build1.orig/mozilla/modules/libpref/src/Preferences.cpp
++++ thunderbird-1000~31.6.0+build1/mozilla/modules/libpref/src/Preferences.cpp
 @@ -32,6 +32,7 @@
  #include "nsXPCOMCID.h"
  #include "nsAutoPtr.h"
@@ -83,10 +83,10 @@
    rv = pref_LoadPrefsInDir(defaultPrefDir, specialFiles, ArrayLength(specialFiles));
    if (NS_FAILED(rv))
      NS_WARNING("Error parsing application default preferences.");
-Index: thunderbird-1000~31.4.0+build1/mozilla/python/mozbuild/mozpack/chrome/flags.py
+Index: thunderbird-1000~31.6.0+build1/mozilla/python/mozbuild/mozpack/chrome/flags.py
 ===================================================================
---- thunderbird-1000~31.4.0+build1.orig/mozilla/python/mozbuild/mozpack/chrome/flags.py
-+++ thunderbird-1000~31.4.0+build1/mozilla/python/mozbuild/mozpack/chrome/flags.py
+--- thunderbird-1000~31.6.0+build1.orig/mozilla/python/mozbuild/mozpack/chrome/flags.py
++++ thunderbird-1000~31.6.0+build1/mozilla/python/mozbuild/mozpack/chrome/flags.py
 @@ -213,6 +213,7 @@ class Flags(OrderedDict):
          'platform': Flag,
          'xpcnativewrappers': Flag,
@@ -95,10 +95,10 @@
      }
      RE = re.compile(r'([!<>=]+)')
  
-Index: thunderbird-1000~31.4.0+build1/mozilla/python/mozbuild/mozpack/chrome/manifest.py
+Index: thunderbird-1000~31.6.0+build1/mozilla/python/mozbuild/mozpack/chrome/manifest.py
 ===================================================================
---- thunderbird-1000~31.4.0+build1.orig/mozilla/python/mozbuild/mozpack/chrome/manifest.py
-+++ thunderbird-1000~31.4.0+build1/mozilla/python/mozbuild/mozpack/chrome/manifest.py
+--- thunderbird-1000~31.6.0+build1.orig/mozilla/python/mozbuild/mozpack/chrome/manifest.py
++++ thunderbird-1000~31.6.0+build1/mozilla/python/mozbuild/mozpack/chrome/manifest.py
 @@ -35,6 +35,7 @@ class ManifestEntry(object):
          'abi',
          'xpcnativewrappers',
@@ -107,20 +107,20 @@
      ]
  
      def __init__(self, base, *flags):
-Index: thunderbird-1000~31.4.0+build1/mozilla/toolkit/components/downloads/Makefile.in
+Index: thunderbird-1000~31.6.0+build1/mozilla/toolkit/components/downloads/Makefile.in
 ===================================================================
---- thunderbird-1000~31.4.0+build1.orig/mozilla/toolkit/components/downloads/Makefile.in
-+++ thunderbird-1000~31.4.0+build1/mozilla/toolkit/components/downloads/Makefile.in
+--- thunderbird-1000~31.6.0+build1.orig/mozilla/toolkit/components/downloads/Makefile.in
++++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/components/downloads/Makefile.in
 @@ -6,4 +6,4 @@
  include $(topsrcdir)/config/rules.mk
  
  CXXFLAGS += $(TK_CFLAGS)
 -
 +LOCAL_INCLUDES += -I$(topsrcdir)/toolkit/xre
-Index: thunderbird-1000~31.4.0+build1/mozilla/toolkit/components/downloads/nsDownloadManager.cpp
+Index: thunderbird-1000~31.6.0+build1/mozilla/toolkit/components/downloads/nsDownloadManager.cpp
 ===================================================================
---- thunderbird-1000~31.4.0+build1.orig/mozilla/toolkit/components/downloads/nsDownloadManager.cpp
-+++ thunderbird-1000~31.4.0+build1/mozilla/toolkit/components/downloads/nsDownloadManager.cpp
+--- thunderbird-1000~31.6.0+build1.orig/mozilla/toolkit/components/downloads/nsDownloadManager.cpp
++++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/components/downloads/nsDownloadManager.cpp
 @@ -48,6 +48,10 @@
  #endif
  #endif
@@ -160,10 +160,10 @@
  
  #if defined(XP_WIN) || defined(XP_MACOSX) || defined(MOZ_WIDGET_ANDROID) || defined(MOZ_WIDGET_GTK)
        nsCOMPtr<nsIFileURL> fileURL = do_QueryInterface(mTarget);
-Index: thunderbird-1000~31.4.0+build1/mozilla/toolkit/content/jar.mn
+Index: thunderbird-1000~31.6.0+build1/mozilla/toolkit/content/jar.mn
 ===================================================================
---- thunderbird-1000~31.4.0+build1.orig/mozilla/toolkit/content/jar.mn
-+++ thunderbird-1000~31.4.0+build1/mozilla/toolkit/content/jar.mn
+--- thunderbird-1000~31.6.0+build1.orig/mozilla/toolkit/content/jar.mn
++++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/content/jar.mn
 @@ -63,6 +63,8 @@ toolkit.jar:
     content/global/bindings/colorpicker.xml     (widgets/colorpicker.xml)
     content/global/bindings/datetimepicker.xml  (widgets/datetimepicker.xml)
@@ -182,10 +182,10 @@
     content/global/bindings/progressmeter.xml   (widgets/progressmeter.xml)
     content/global/bindings/radio.xml           (widgets/radio.xml)
     content/global/bindings/remote-browser.xml  (widgets/remote-browser.xml)
-Index: thunderbird-1000~31.4.0+build1/mozilla/toolkit/content/widgets/dialog-kde.xml
+Index: thunderbird-1000~31.6.0+build1/mozilla/toolkit/content/widgets/dialog-kde.xml
 ===================================================================
 --- /dev/null
-+++ thunderbird-1000~31.4.0+build1/mozilla/toolkit/content/widgets/dialog-kde.xml
++++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/content/widgets/dialog-kde.xml
 @@ -0,0 +1,449 @@
 +<?xml version="1.0"?>
 +<!-- This Source Code Form is subject to the terms of the Mozilla Public
@@ -636,10 +636,10 @@
 +  </binding>
 +
 +</bindings>
-Index: thunderbird-1000~31.4.0+build1/mozilla/toolkit/content/widgets/preferences-kde.xml
+Index: thunderbird-1000~31.6.0+build1/mozilla/toolkit/content/widgets/preferences-kde.xml
 ===================================================================
 --- /dev/null
-+++ thunderbird-1000~31.4.0+build1/mozilla/toolkit/content/widgets/preferences-kde.xml
++++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/content/widgets/preferences-kde.xml
 @@ -0,0 +1,1333 @@
 +<?xml version="1.0"?>
 +
@@ -1974,10 +1974,10 @@
 +#    PrefWindow II  (???)
 +#    PrefWindow I   (June 4, 1999)
 +#
-Index: thunderbird-1000~31.4.0+build1/mozilla/toolkit/system/unixproxy/nsUnixSystemProxySettings.cpp
+Index: thunderbird-1000~31.6.0+build1/mozilla/toolkit/system/unixproxy/nsUnixSystemProxySettings.cpp
 ===================================================================
---- thunderbird-1000~31.4.0+build1.orig/mozilla/toolkit/system/unixproxy/nsUnixSystemProxySettings.cpp
-+++ thunderbird-1000~31.4.0+build1/mozilla/toolkit/system/unixproxy/nsUnixSystemProxySettings.cpp
+--- thunderbird-1000~31.6.0+build1.orig/mozilla/toolkit/system/unixproxy/nsUnixSystemProxySettings.cpp
++++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/system/unixproxy/nsUnixSystemProxySettings.cpp
 @@ -19,6 +19,8 @@
  #include "nsInterfaceHashtable.h"
  #include "mozilla/Attributes.h"
@@ -2035,10 +2035,10 @@
 +  return NS_OK;
 +}
 +
-Index: thunderbird-1000~31.4.0+build1/mozilla/toolkit/xre/moz.build
+Index: thunderbird-1000~31.6.0+build1/mozilla/toolkit/xre/moz.build
 ===================================================================
---- thunderbird-1000~31.4.0+build1.orig/mozilla/toolkit/xre/moz.build
-+++ thunderbird-1000~31.4.0+build1/mozilla/toolkit/xre/moz.build
+--- thunderbird-1000~31.6.0+build1.orig/mozilla/toolkit/xre/moz.build
++++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/xre/moz.build
 @@ -48,7 +48,9 @@ elif CONFIG['MOZ_WIDGET_TOOLKIT'] == 'qt
          'nsQAppInstance.cpp',
      ]
@@ -2049,10 +2049,10 @@
          'nsNativeAppSupportUnix.cpp',
      ]
  else:
-Index: thunderbird-1000~31.4.0+build1/mozilla/toolkit/xre/nsKDEUtils.cpp
+Index: thunderbird-1000~31.6.0+build1/mozilla/toolkit/xre/nsKDEUtils.cpp
 ===================================================================
 --- /dev/null
-+++ thunderbird-1000~31.4.0+build1/mozilla/toolkit/xre/nsKDEUtils.cpp
++++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/xre/nsKDEUtils.cpp
 @@ -0,0 +1,339 @@
 +/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
 +/* This Source Code Form is subject to the terms of the Mozilla Public
@@ -2393,10 +2393,10 @@
 +    fputs( "\\E\n", commandFile ); // done as \E, so it cannot happen in normal data
 +    fflush( commandFile );
 +    }
-Index: thunderbird-1000~31.4.0+build1/mozilla/toolkit/xre/nsKDEUtils.h
+Index: thunderbird-1000~31.6.0+build1/mozilla/toolkit/xre/nsKDEUtils.h
 ===================================================================
 --- /dev/null
-+++ thunderbird-1000~31.4.0+build1/mozilla/toolkit/xre/nsKDEUtils.h
++++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/xre/nsKDEUtils.h
 @@ -0,0 +1,48 @@
 +/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 +/* This Source Code Form is subject to the terms of the Mozilla Public
@@ -2446,20 +2446,20 @@
 +    };
 +
 +#endif // nsKDEUtils
-Index: thunderbird-1000~31.4.0+build1/mozilla/uriloader/exthandler/Makefile.in
+Index: thunderbird-1000~31.6.0+build1/mozilla/uriloader/exthandler/Makefile.in
 ===================================================================
---- thunderbird-1000~31.4.0+build1.orig/mozilla/uriloader/exthandler/Makefile.in
-+++ thunderbird-1000~31.4.0+build1/mozilla/uriloader/exthandler/Makefile.in
+--- thunderbird-1000~31.6.0+build1.orig/mozilla/uriloader/exthandler/Makefile.in
++++ thunderbird-1000~31.6.0+build1/mozilla/uriloader/exthandler/Makefile.in
 @@ -11,4 +11,5 @@ include $(topsrcdir)/config/rules.mk
  
  ifneq (,$(filter qt gtk2 gtk3, $(MOZ_WIDGET_TOOLKIT)))
  CXXFLAGS += $(TK_CFLAGS) $(MOZ_DBUS_GLIB_CFLAGS)
 +LOCAL_INCLUDES += -I$(topsrcdir)/toolkit/xre
  endif
-Index: thunderbird-1000~31.4.0+build1/mozilla/uriloader/exthandler/moz.build
+Index: thunderbird-1000~31.6.0+build1/mozilla/uriloader/exthandler/moz.build
 ===================================================================
---- thunderbird-1000~31.4.0+build1.orig/mozilla/uriloader/exthandler/moz.build
-+++ thunderbird-1000~31.4.0+build1/mozilla/uriloader/exthandler/moz.build
+--- thunderbird-1000~31.6.0+build1.orig/mozilla/uriloader/exthandler/moz.build
++++ thunderbird-1000~31.6.0+build1/mozilla/uriloader/exthandler/moz.build
 @@ -85,7 +85,9 @@ else:
  
  if CONFIG['MOZ_ENABLE_GTK']:
@@ -2470,10 +2470,10 @@
          'unix/nsMIMEInfoUnix.cpp',
      ]
  elif CONFIG['MOZ_WIDGET_TOOLKIT'] == 'android':
-Index: thunderbird-1000~31.4.0+build1/mozilla/uriloader/exthandler/unix/nsCommonRegistry.cpp
+Index: thunderbird-1000~31.6.0+build1/mozilla/uriloader/exthandler/unix/nsCommonRegistry.cpp
 ===================================================================
 --- /dev/null
-+++ thunderbird-1000~31.4.0+build1/mozilla/uriloader/exthandler/unix/nsCommonRegistry.cpp
++++ thunderbird-1000~31.6.0+build1/mozilla/uriloader/exthandler/unix/nsCommonRegistry.cpp
 @@ -0,0 +1,54 @@
 +/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 +/* This Source Code Form is subject to the terms of the Mozilla Public
@@ -2529,10 +2529,10 @@
 +        return nsKDERegistry::GetFromType( aMIMEType );
 +    return nsGNOMERegistry::GetFromType( aMIMEType );
 +}
-Index: thunderbird-1000~31.4.0+build1/mozilla/uriloader/exthandler/unix/nsCommonRegistry.h
+Index: thunderbird-1000~31.6.0+build1/mozilla/uriloader/exthandler/unix/nsCommonRegistry.h
 ===================================================================
 --- /dev/null
-+++ thunderbird-1000~31.4.0+build1/mozilla/uriloader/exthandler/unix/nsCommonRegistry.h
++++ thunderbird-1000~31.6.0+build1/mozilla/uriloader/exthandler/unix/nsCommonRegistry.h
 @@ -0,0 +1,23 @@
 +/* This Source Code Form is subject to the terms of the Mozilla Public
 + * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -2557,10 +2557,10 @@
 +
 +  static already_AddRefed<nsMIMEInfoBase> GetFromType(const nsACString& aMIMEType);
 +};
-Index: thunderbird-1000~31.4.0+build1/mozilla/uriloader/exthandler/unix/nsKDERegistry.cpp
+Index: thunderbird-1000~31.6.0+build1/mozilla/uriloader/exthandler/unix/nsKDERegistry.cpp
 ===================================================================
 --- /dev/null
-+++ thunderbird-1000~31.4.0+build1/mozilla/uriloader/exthandler/unix/nsKDERegistry.cpp
++++ thunderbird-1000~31.6.0+build1/mozilla/uriloader/exthandler/unix/nsKDERegistry.cpp
 @@ -0,0 +1,88 @@
 +/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 +/* This Source Code Form is subject to the terms of the Mozilla Public
@@ -2650,10 +2650,10 @@
 +        }
 +    return nullptr;
 +}
-Index: thunderbird-1000~31.4.0+build1/mozilla/uriloader/exthandler/unix/nsKDERegistry.h
+Index: thunderbird-1000~31.6.0+build1/mozilla/uriloader/exthandler/unix/nsKDERegistry.h
 ===================================================================
 --- /dev/null
-+++ thunderbird-1000~31.4.0+build1/mozilla/uriloader/exthandler/unix/nsKDERegistry.h
++++ thunderbird-1000~31.6.0+build1/mozilla/uriloader/exthandler/unix/nsKDERegistry.h
 @@ -0,0 +1,29 @@
 +/* This Source Code Form is subject to the terms of the Mozilla Public
 + * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -2684,10 +2684,10 @@
 +  static already_AddRefed<nsMIMEInfoBase> GetFromHelper(const nsTArray<nsCString>& command);
 +
 +};
-Index: thunderbird-1000~31.4.0+build1/mozilla/uriloader/exthandler/unix/nsMIMEInfoUnix.cpp
+Index: thunderbird-1000~31.6.0+build1/mozilla/uriloader/exthandler/unix/nsMIMEInfoUnix.cpp
 ===================================================================
---- thunderbird-1000~31.4.0+build1.orig/mozilla/uriloader/exthandler/unix/nsMIMEInfoUnix.cpp
-+++ thunderbird-1000~31.4.0+build1/mozilla/uriloader/exthandler/unix/nsMIMEInfoUnix.cpp
+--- thunderbird-1000~31.6.0+build1.orig/mozilla/uriloader/exthandler/unix/nsMIMEInfoUnix.cpp
++++ thunderbird-1000~31.6.0+build1/mozilla/uriloader/exthandler/unix/nsMIMEInfoUnix.cpp
 @@ -15,7 +15,7 @@
  #endif
  
@@ -2764,10 +2764,10 @@
    if (mimeInfo) {
      nsAutoCString type;
      mimeInfo->GetType(type);
-Index: thunderbird-1000~31.4.0+build1/mozilla/uriloader/exthandler/unix/nsOSHelperAppService.cpp
+Index: thunderbird-1000~31.6.0+build1/mozilla/uriloader/exthandler/unix/nsOSHelperAppService.cpp
 ===================================================================
---- thunderbird-1000~31.4.0+build1.orig/mozilla/uriloader/exthandler/unix/nsOSHelperAppService.cpp
-+++ thunderbird-1000~31.4.0+build1/mozilla/uriloader/exthandler/unix/nsOSHelperAppService.cpp
+--- thunderbird-1000~31.6.0+build1.orig/mozilla/uriloader/exthandler/unix/nsOSHelperAppService.cpp
++++ thunderbird-1000~31.6.0+build1/mozilla/uriloader/exthandler/unix/nsOSHelperAppService.cpp
 @@ -15,7 +15,7 @@
  #include "nsOSHelperAppService.h"
  #include "nsMIMEInfoUnix.h"
@@ -2813,10 +2813,10 @@
      if (gnomeInfo && gnomeInfo->HasExtensions()) {
        LOG(("Got MIMEInfo from GNOME registry, and it has extensions set\n"));
        return gnomeInfo.forget();
-Index: thunderbird-1000~31.4.0+build1/mozilla/widget/gtk/Makefile.in
+Index: thunderbird-1000~31.6.0+build1/mozilla/widget/gtk/Makefile.in
 ===================================================================
---- thunderbird-1000~31.4.0+build1.orig/mozilla/widget/gtk/Makefile.in
-+++ thunderbird-1000~31.4.0+build1/mozilla/widget/gtk/Makefile.in
+--- thunderbird-1000~31.6.0+build1.orig/mozilla/widget/gtk/Makefile.in
++++ thunderbird-1000~31.6.0+build1/mozilla/widget/gtk/Makefile.in
 @@ -8,6 +8,8 @@ include $(topsrcdir)/config/rules.mk
  CFLAGS          += $(MOZ_STARTUP_NOTIFICATION_CFLAGS)
  CXXFLAGS        += $(MOZ_CAIRO_CFLAGS) $(MOZ_STARTUP_NOTIFICATION_CFLAGS)
@@ -2826,10 +2826,10 @@
  CFLAGS          += $(TK_CFLAGS)
  CXXFLAGS        += $(TK_CFLAGS)
  
-Index: thunderbird-1000~31.4.0+build1/mozilla/widget/gtk/nsFilePicker.cpp
+Index: thunderbird-1000~31.6.0+build1/mozilla/widget/gtk/nsFilePicker.cpp
 ===================================================================
---- thunderbird-1000~31.4.0+build1.orig/mozilla/widget/gtk/nsFilePicker.cpp
-+++ thunderbird-1000~31.4.0+build1/mozilla/widget/gtk/nsFilePicker.cpp
+--- thunderbird-1000~31.6.0+build1.orig/mozilla/widget/gtk/nsFilePicker.cpp
++++ thunderbird-1000~31.6.0+build1/mozilla/widget/gtk/nsFilePicker.cpp
 @@ -6,6 +6,7 @@
  #include "mozilla/Types.h"
  
@@ -3111,10 +3111,10 @@
 +    return NS_OK;
 +    }
 +
-Index: thunderbird-1000~31.4.0+build1/mozilla/widget/gtk/nsFilePicker.h
+Index: thunderbird-1000~31.6.0+build1/mozilla/widget/gtk/nsFilePicker.h
 ===================================================================
---- thunderbird-1000~31.4.0+build1.orig/mozilla/widget/gtk/nsFilePicker.h
-+++ thunderbird-1000~31.4.0+build1/mozilla/widget/gtk/nsFilePicker.h
+--- thunderbird-1000~31.6.0+build1.orig/mozilla/widget/gtk/nsFilePicker.h
++++ thunderbird-1000~31.6.0+build1/mozilla/widget/gtk/nsFilePicker.h
 @@ -71,6 +71,12 @@ protected:
  
  private:
@@ -3128,20 +3128,20 @@
  };
  
  #endif
-Index: thunderbird-1000~31.4.0+build1/mozilla/xpcom/components/Makefile.in
+Index: thunderbird-1000~31.6.0+build1/mozilla/xpcom/components/Makefile.in
 ===================================================================
---- thunderbird-1000~31.4.0+build1.orig/mozilla/xpcom/components/Makefile.in
-+++ thunderbird-1000~31.4.0+build1/mozilla/xpcom/components/Makefile.in
+--- thunderbird-1000~31.6.0+build1.orig/mozilla/xpcom/components/Makefile.in
++++ thunderbird-1000~31.6.0+build1/mozilla/xpcom/components/Makefile.in
 @@ -7,4 +7,5 @@ include $(topsrcdir)/config/rules.mk
  
  ifdef MOZ_WIDGET_GTK
  CXXFLAGS        += $(TK_CFLAGS)
 +LOCAL_INCLUDES += -I$(topsrcdir)/toolkit/xre
  endif
-Index: thunderbird-1000~31.4.0+build1/mozilla/xpcom/components/ManifestParser.cpp
+Index: thunderbird-1000~31.6.0+build1/mozilla/xpcom/components/ManifestParser.cpp
 ===================================================================
---- thunderbird-1000~31.4.0+build1.orig/mozilla/xpcom/components/ManifestParser.cpp
-+++ thunderbird-1000~31.4.0+build1/mozilla/xpcom/components/ManifestParser.cpp
+--- thunderbird-1000~31.6.0+build1.orig/mozilla/xpcom/components/ManifestParser.cpp
++++ thunderbird-1000~31.6.0+build1/mozilla/xpcom/components/ManifestParser.cpp
 @@ -36,6 +36,7 @@
  #include "nsIScriptError.h"
  #include "nsIXULAppInfo.h"
@@ -3218,10 +3218,10 @@
  #ifdef MOZ_WIDGET_ANDROID
          stTablet == eBad ||
  #endif
-Index: thunderbird-1000~31.4.0+build1/mozilla/xpcom/io/nsLocalFileUnix.cpp
+Index: thunderbird-1000~31.6.0+build1/mozilla/xpcom/io/nsLocalFileUnix.cpp
 ===================================================================
---- thunderbird-1000~31.4.0+build1.orig/mozilla/xpcom/io/nsLocalFileUnix.cpp
-+++ thunderbird-1000~31.4.0+build1/mozilla/xpcom/io/nsLocalFileUnix.cpp
+--- thunderbird-1000~31.6.0+build1.orig/mozilla/xpcom/io/nsLocalFileUnix.cpp
++++ thunderbird-1000~31.6.0+build1/mozilla/xpcom/io/nsLocalFileUnix.cpp
 @@ -48,6 +48,7 @@
  #ifdef MOZ_WIDGET_GTK
  #include "nsIGIOService.h"
diff -Nru thunderbird-1000~31.4.0+build1/l10n/changesets thunderbird-1000~31.6.0+build1/l10n/changesets
--- thunderbird-1000~31.4.0+build1/l10n/changesets	2015-01-12 17:59:58.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/l10n/changesets	2015-03-30 18:20:03.000000000 +0000
@@ -1,55 +1,55 @@
-ar 1404:aa0844f79c69
-ast 1286:0ed3254065e7
-be 1622:2f450428f4c2
-bg 884:4d53807a9f49
-bn-BD 842:e7af3bebad8c
-br 1007:2fb01f150b9d
-ca 2230:cdd430582148
-cs 3503:1cfd0a866eb7
-da 1877:50135f40f1c1
-de 4499:233414b839af
-el 1167:09fc5c4d8731
-en-GB 1718:5db156818222
-es-AR 2398:92e68e5ca0f6
-es-ES 3763:13f3584ce58f
-et 1603:8d95a016e094
-eu 1349:bc2e1bc4f572
-fi 2043:8bb3b446d2e2
-fr 6658:73cd1ecb4a88
-fy-NL 2301:91ca6f20a00c
-ga-IE 1554:839671b36181
-gd 1437:65de568b3366
-gl 2874:8e6aaf3db78e
-he 1302:0be21ed39543
-hr 1600:7937e6daa524
-hu 1966:f3bfc9a66ec3
-hy-AM 955:c49cf80ae6b7
-id 1435:e88f032284b3
-is 1139:d00353faa278
-it 4913:bc9b9faae0d8
-ja 2130:5130ead14cb1
-ja-JP-mac 1786:91bfe433fc3c
-ko 1767:35601c093bf5
-lt 2691:d53274d9fe6c
-nb-NO 2478:af6e40209a66
-nl 5146:efee29bbb3a5
-nn-NO 1381:6c224f451666
-pa-IN 1686:74ebf51fccfa
-pl 6446:ed970635fdcf
-pt-BR 1750:ab156e7eb2a3
-pt-PT 3007:d8bb78b7903e
-rm 1115:67e82d112ca1
-ro 1250:9b0adbff1ce4
-ru 3785:5f329b7ae6e4
-si 1137:900dbb5b8476
-sk 1889:3d5dfea53790
-sl 1919:5ef84a9c032c
-sq 1666:6bd7513468b7
-sr 916:8d1f1c75d09a
-sv-SE 4387:5115715fd3fd
-ta-LK 672:f6c2da5f4d96
-tr 1807:10d4aa9e537b
-uk 2576:218e8200cc76
-vi 861:188b1485591a
-zh-CN 2164:daaa3b7ff200
-zh-TW 2460:bf50d4cde638
+ar 1487:f416ea58a983
+ast 1306:e17f7e160779
+be 1659:e2623773946b
+bg 929:a28f4430e422
+bn-BD 861:9b4fa1d10a6b
+br 1112:81ea70867cc6
+ca 2323:ebd3e85eb6a1
+cs 3620:ec608661964c
+da 1990:cb12975b43e5
+de 4646:ac27a096ed3a
+el 1186:103f04a07e84
+en-GB 1828:f1feab925152
+es-AR 2484:a4622915d00a
+es-ES 3912:a08018732b1e
+et 1687:a52929a07a55
+eu 1442:38e0d94e6e28
+fi 2126:b6855e76e5ef
+fr 6822:845b998ae4d1
+fy-NL 2404:1be4bbfbac2d
+ga-IE 1610:e0f38f404f36
+gd 1526:e3a7f2f2d8e1
+gl 2955:6df337019a32
+he 1343:d97f514ff3db
+hr 1653:4e885fdf702b
+hu 2068:6fc10929da9f
+hy-AM 1040:9ad91cd802ec
+id 1544:3258fa43d9ae
+is 1218:1a0083ae1cd7
+it 5162:539c5aadc7f8
+ja 2226:25c48f0c86e1
+ja-JP-mac 1858:e52f79399c28
+ko 1844:d27bcadb598f
+lt 2801:d7393fcd85c5
+nb-NO 2566:7a28b024a67b
+nl 5357:b210bb31aaf4
+nn-NO 1437:7ed725eb11d6
+pa-IN 1765:7ce50e7ce9d1
+pl 6745:e5574cac9df9
+pt-BR 1901:dd97952b4db1
+pt-PT 3119:cb4a2b46e3eb
+rm 1187:fa2007eae521
+ro 1357:703958f88d90
+ru 3915:f55bff9568d8
+si 1228:424edd73ef11
+sk 1973:f91e9e3327bf
+sl 2102:f2533bdf2265
+sq 1756:550a0b95b492
+sr 978:77ae30e87dc4
+sv-SE 4507:311eaa328c6e
+ta-LK 674:84409119cc22
+tr 1949:bba97da26247
+uk 2715:4a00689617fd
+vi 879:0ed66566283c
+zh-CN 2248:a7c7c021ab34
+zh-TW 2547:e827b710553e
diff -Nru thunderbird-1000~31.4.0+build1/ldap/xpcom/src/nsLDAPOperation.cpp thunderbird-1000~31.6.0+build1/ldap/xpcom/src/nsLDAPOperation.cpp
--- thunderbird-1000~31.4.0+build1/ldap/xpcom/src/nsLDAPOperation.cpp	2015-01-12 17:29:35.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/ldap/xpcom/src/nsLDAPOperation.cpp	2015-03-30 17:31:41.000000000 +0000
@@ -283,6 +283,10 @@
            ("nsLDAPOperation::SimpleBind(): called; bindName = '%s'; ",
             bindName.get()));
 
+    // this (nsLDAPOperation) may be released by RemovePendingOperation()
+    // See https://bugzilla.mozilla.org/show_bug.cgi?id=1063829.
+    nsRefPtr<nsLDAPOperation> kungFuDeathGrip = this;
+
     // If this is a second try at binding, remove the operation from pending ops
     // because msg id has changed...
     if (originalMsgID)
diff -Nru thunderbird-1000~31.4.0+build1/mail/app/profile/all-thunderbird.js thunderbird-1000~31.6.0+build1/mail/app/profile/all-thunderbird.js
--- thunderbird-1000~31.4.0+build1/mail/app/profile/all-thunderbird.js	2015-01-12 17:29:35.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mail/app/profile/all-thunderbird.js	2015-03-30 17:31:41.000000000 +0000
@@ -80,19 +80,11 @@
 
 // Non-release builds (Nightly, Aurora, etc.) have been switched over to aus4.mozilla.org.
 // This condition protects us against accidentally using it for release builds.
-#ifndef RELEASE_BUILD
 pref("app.update.certs.1.issuerName", "CN=DigiCert Secure Server CA,O=DigiCert Inc,C=US");
 pref("app.update.certs.1.commonName", "aus4.mozilla.org");
 
 pref("app.update.certs.2.issuerName", "CN=Thawte SSL CA,O=\"Thawte, Inc.\",C=US");
 pref("app.update.certs.2.commonName", "aus4.mozilla.org");
-#else
-pref("app.update.certs.1.issuerName", "CN=Thawte SSL CA,O=\"Thawte, Inc.\",C=US");
-pref("app.update.certs.1.commonName", "aus3.mozilla.org");
-
-pref("app.update.certs.2.issuerName", "CN=DigiCert Secure Server CA,O=DigiCert Inc,C=US");
-pref("app.update.certs.2.commonName", "aus3.mozilla.org");
-#endif
 
 // Whether or not app updates are enabled
 pref("app.update.enabled", true);               
@@ -121,11 +113,7 @@
 pref("app.update.staging.enabled", true);
 
 // Update service URL:
-#ifndef RELEASE_BUILD
 pref("app.update.url", "https://aus4.mozilla.org/update/3/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/update.xml");
-#else
-pref("app.update.url", "https://aus3.mozilla.org/update/3/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/update.xml");
-#endif
 
 // URL user can browse to manually if for some reason all update installation
 // attempts fail.
diff -Nru thunderbird-1000~31.4.0+build1/mail/components/compose/content/addressingWidgetOverlay.js thunderbird-1000~31.6.0+build1/mail/components/compose/content/addressingWidgetOverlay.js
--- thunderbird-1000~31.4.0+build1/mail/components/compose/content/addressingWidgetOverlay.js	2015-01-12 17:29:34.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mail/components/compose/content/addressingWidgetOverlay.js	2015-03-30 17:31:38.000000000 +0000
@@ -785,7 +785,9 @@
 
 function awRecipientTextCommand(enterEvent, element)
 {
-  awReturnHit(element);
+  // Only add new row when enter was hit (not for tab/autocomplete select).
+  if (enterEvent)
+    awReturnHit(element);
 }
 
 function awRecipientKeyPress(event, element)
diff -Nru thunderbird-1000~31.4.0+build1/mail/config/version.txt thunderbird-1000~31.6.0+build1/mail/config/version.txt
--- thunderbird-1000~31.4.0+build1/mail/config/version.txt	2015-01-12 17:29:34.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mail/config/version.txt	2015-03-30 17:31:39.000000000 +0000
@@ -1 +1 @@
-31.4.0
+31.6.0
diff -Nru thunderbird-1000~31.4.0+build1/mail/test/mozmill/cloudfile/test-cloudfile-attachment-urls.js thunderbird-1000~31.6.0+build1/mail/test/mozmill/cloudfile/test-cloudfile-attachment-urls.js
--- thunderbird-1000~31.4.0+build1/mail/test/mozmill/cloudfile/test-cloudfile-attachment-urls.js	2015-01-12 17:29:34.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mail/test/mozmill/cloudfile/test-cloudfile-attachment-urls.js	2015-03-30 17:31:39.000000000 +0000
@@ -476,11 +476,10 @@
   let cw = prepare_some_attachments_and_reply(aText, kFiles);
   let [root, list, urls] = wait_for_attachment_urls(cw, kFiles.length);
 
-  // So, we should have the root, followed by a br
-  let br = root.nextSibling;
-  assert_equals(br.localName, "br",
-                "The attachment URL containment node should be followed by " +
-                " a br");
+  // If there's any text written, then there's only a single break between the
+  // end of the text and the reply. Otherwise, there are two breaks.
+  let br = aText.length > 1 ? assert_next_nodes("br", root, 2)
+                            : assert_next_nodes("br", root, 1);
 
   // ... which is followed by a div with a class of "moz-cite-prefix".
   let div = br.nextSibling;
diff -Nru thunderbird-1000~31.4.0+build1/mail/themes/windows/mail/chat-aero.css thunderbird-1000~31.6.0+build1/mail/themes/windows/mail/chat-aero.css
--- thunderbird-1000~31.4.0+build1/mail/themes/windows/mail/chat-aero.css	2015-01-12 17:29:34.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mail/themes/windows/mail/chat-aero.css	2015-03-30 17:31:41.000000000 +0000
@@ -267,12 +267,12 @@
   -moz-image-region: rect(1px 53px 17px 37px);
 }
 
-toolbar:-moz-lwtheme-darktext #button-add-buddy,
-toolbar:-moz-lwtheme-darktext #button-add-buddy[disabled],
-toolbar:-moz-lwtheme-darktext #button-join-chat,
-toolbar:-moz-lwtheme-darktext #button-join-chat[disabled],
-toolbar:-moz-lwtheme-darktext #button-chat-accounts,
-toolbar:-moz-lwtheme-darktext #button-chat-accounts[disabled] {
+toolbar[brighttext] #button-add-buddy,
+toolbar[brighttext] #button-add-buddy[disabled],
+toolbar[brighttext] #button-join-chat,
+toolbar[brighttext] #button-join-chat[disabled],
+toolbar[brighttext] #button-chat-accounts,
+toolbar[brighttext] #button-chat-accounts[disabled] {
   list-style-image: url("chrome://messenger/skin/icons/chat-toolbar-inverted.png");
 }
 
diff -Nru thunderbird-1000~31.4.0+build1/mailnews/compose/src/nsMsgCompose.cpp thunderbird-1000~31.6.0+build1/mailnews/compose/src/nsMsgCompose.cpp
--- thunderbird-1000~31.4.0+build1/mailnews/compose/src/nsMsgCompose.cpp	2015-01-12 17:29:34.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mailnews/compose/src/nsMsgCompose.cpp	2015-03-30 17:31:39.000000000 +0000
@@ -650,6 +650,10 @@
       m_identity->GetReplyOnTop(&reply_on_top);
       if (reply_on_top == 1)
       {
+        // HTML editor eats one line break
+        if (aHTMLEditor)
+          textEditor->InsertLineBreak();
+
         // add one newline if a signature comes before the quote, two otherwise
         bool includeSignature = true;
         bool sig_bottom = true;
diff -Nru thunderbird-1000~31.4.0+build1/mailnews/db/gloda/modules/index_msg.js thunderbird-1000~31.6.0+build1/mailnews/db/gloda/modules/index_msg.js
--- thunderbird-1000~31.4.0+build1/mailnews/db/gloda/modules/index_msg.js	2015-01-12 17:29:34.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mailnews/db/gloda/modules/index_msg.js	2015-03-30 17:31:40.000000000 +0000
@@ -2787,6 +2787,10 @@
         return;
       if (!GlodaMsgIndexer.shouldIndexFolder(aFolderItem))
         return;
+      // Only reset priority if folder Special Use changes.
+      if ((aOldValue & Ci.nsMsgFolderFlags.SpecialUse) ==
+          (aNewValue & Ci.nsMsgFolderFlags.SpecialUse))
+        return;
       GlodaMsgIndexer.resetFolderIndexingPriority(aFolderItem);
     },
     OnItemBoolPropertyChanged: function gloda_indexer_OnItemBoolPropertyChanged(
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/browser/app/blocklist.xml thunderbird-1000~31.6.0+build1/mozilla/browser/app/blocklist.xml
--- thunderbird-1000~31.4.0+build1/mozilla/browser/app/blocklist.xml	2015-01-12 17:51:32.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/browser/app/blocklist.xml	2015-03-30 18:03:37.000000000 +0000
@@ -1,5 +1,5 @@
 <?xml version="1.0"?>
-<blocklist xmlns="http://www.mozilla.org/2006/addons-blocklist" lastupdate="1419896968000">
+<blocklist xmlns="http://www.mozilla.org/2006/addons-blocklist" lastupdate="1425509726000">
   <emItems>
       <emItem  blockID="i58" id="webmaster@buzzzzvideos.info">
                         <versionRange  minVersion="0" maxVersion="*">
@@ -73,6 +73,14 @@
                     <prefs>
               </prefs>
     </emItem>
+      <emItem  blockID="i862" id="{CA8C84C6-3918-41b1-BE77-049B2BDD887C}">
+                        <versionRange  minVersion="0" maxVersion="*" severity="1">
+                    </versionRange>
+                    <prefs>
+                  <pref>browser.startup.homepage</pref>
+                  <pref>browser.search.defaultenginename</pref>
+              </prefs>
+    </emItem>
       <emItem  blockID="i430" id="1chtw@facebook.com">
                         <versionRange  minVersion="0" maxVersion="*" severity="3">
                     </versionRange>
@@ -121,8 +129,8 @@
                     <prefs>
               </prefs>
     </emItem>
-      <emItem  blockID="i810" id="{41339ee8-61ed-489d-b049-01e41fd5d7e0}">
-                        <versionRange  minVersion="0" maxVersion="*" severity="3">
+      <emItem  blockID="i364" id="{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}">
+                        <versionRange  minVersion="0" maxVersion="*" severity="1">
                     </versionRange>
                     <prefs>
               </prefs>
@@ -177,12 +185,10 @@
                     <prefs>
               </prefs>
     </emItem>
-      <emItem  blockID="i758" id="toolbar10853@findwide.com">
+      <emItem  blockID="i672" id="/^(saamazon@mybrowserbar\.com)|(saebay@mybrowserbar\.com)$/">
                         <versionRange  minVersion="0" maxVersion="*" severity="1">
                     </versionRange>
                     <prefs>
-                  <pref>browser.startup.homepage</pref>
-                  <pref>browser.search.defaultenginename</pref>
               </prefs>
     </emItem>
       <emItem  blockID="i668" id="/^(matchersite(pro(srcs?)?)?\@matchersite(pro(srcs?)?)?\.com)|((pro)?sitematcher(_srcs?|pro|site|sitesrc|-generic)?\@(pro)?sitematcher(_srcs?|pro|site|sitesrc|-generic)?\.com)$/">
@@ -221,6 +227,26 @@
                     <prefs>
               </prefs>
     </emItem>
+      <emItem  blockID="i858" id="fftoolbar2014@etech.com">
+                        <versionRange  minVersion="0" maxVersion="*" severity="1">
+                    </versionRange>
+                    <prefs>
+                  <pref>browser.startup.homepage</pref>
+                  <pref>browser.search.defaultenginename</pref>
+              </prefs>
+    </emItem>
+      <emItem  blockID="i854" id="/^(7tG@zEb\.net|ru@gfK0J\.edu)$/">
+                        <versionRange  minVersion="0" maxVersion="*" severity="3">
+                    </versionRange>
+                    <prefs>
+              </prefs>
+    </emItem>
+      <emItem  blockID="i850" id="P2@D.edu">
+                        <versionRange  minVersion="0" maxVersion="*" severity="1">
+                    </versionRange>
+                    <prefs>
+              </prefs>
+    </emItem>
       <emItem  blockID="i554" id="lightningnewtab@gmail.com">
                         <versionRange  minVersion="0" maxVersion="*" severity="1">
                     </versionRange>
@@ -269,6 +295,12 @@
                     <prefs>
               </prefs>
     </emItem>
+      <emItem  blockID="i856" id="/^({94d62e35-4b43-494c-bf52-ba5935df36ef}|firefox@advanceelite\.com|{bb7b7a60-f574-47c2-8a0b-4c56f2da9802})$/">
+                        <versionRange  minVersion="0" maxVersion="*" severity="3">
+                    </versionRange>
+                    <prefs>
+              </prefs>
+    </emItem>
       <emItem  blockID="i482" id="brasilescapeeight@facebook.com">
                         <versionRange  minVersion="0" maxVersion="*" severity="3">
                     </versionRange>
@@ -345,10 +377,6 @@
                     <prefs>
               </prefs>
     </emItem>
-      <emItem  blockID="i48" id="admin@youtubespeedup.com">
-                          <prefs>
-              </prefs>
-    </emItem>
       <emItem  blockID="i344" id="lrcsTube@hansanddeta.com">
                         <versionRange  minVersion="0" maxVersion="*" severity="1">
                     </versionRange>
@@ -453,6 +481,12 @@
                     <prefs>
               </prefs>
     </emItem>
+      <emItem  blockID="i848" id="bcVX5@nQm9l.org">
+                        <versionRange  minVersion="0" maxVersion="*" severity="1">
+                    </versionRange>
+                    <prefs>
+              </prefs>
+    </emItem>
       <emItem  blockID="i431" id="chinaescapeone@facebook.com">
                         <versionRange  minVersion="0" maxVersion="*" severity="3">
                     </versionRange>
@@ -492,6 +526,14 @@
                     <prefs>
               </prefs>
     </emItem>
+      <emItem  blockID="i768" id="{f2548724-373f-45fe-be6a-3a85e87b7711}">
+                        <versionRange  minVersion="0" maxVersion="*" severity="3">
+                    </versionRange>
+                    <prefs>
+                  <pref>browser.startup.homepage</pref>
+                  <pref>browser.search.defaultenginename</pref>
+              </prefs>
+    </emItem>
       <emItem  blockID="i172" id="info@bflix.info">
                         <versionRange  minVersion="0" maxVersion="*" severity="3">
                     </versionRange>
@@ -630,6 +672,14 @@
                     <prefs>
               </prefs>
     </emItem>
+      <emItem  blockID="i844" id=" e9d197d59f2f45f382b1aa5c14d82@8706aaed9b904554b5cb7984e9.com">
+                        <versionRange  minVersion="0" maxVersion="*" severity="1">
+                    </versionRange>
+                    <prefs>
+                  <pref>browser.startup.homepage</pref>
+                  <pref>browser.search.defaultenginename</pref>
+              </prefs>
+    </emItem>
       <emItem  blockID="i770" id="{8dc5c42e-9204-2a64-8b97-fa94ff8a241f}">
                         <versionRange  minVersion="0" maxVersion="*" severity="3">
                     </versionRange>
@@ -702,6 +752,12 @@
                     <prefs>
               </prefs>
     </emItem>
+      <emItem  blockID="i340" id="chiang@programmer.net">
+                        <versionRange  minVersion="0" maxVersion="*" severity="3">
+                    </versionRange>
+                    <prefs>
+              </prefs>
+    </emItem>
       <emItem  blockID="i99" id="pfzPXmnzQRXX6@2iABkVe.com">
                         <versionRange  minVersion="0" maxVersion="*">
                     </versionRange>
@@ -802,10 +858,8 @@
                     <prefs>
               </prefs>
     </emItem>
-      <emItem  blockID="i672" id="/^(saamazon@mybrowserbar\.com)|(saebay@mybrowserbar\.com)$/">
-                        <versionRange  minVersion="0" maxVersion="*" severity="1">
-                    </versionRange>
-                    <prefs>
+      <emItem  blockID="i48" id="admin@youtubespeedup.com">
+                          <prefs>
               </prefs>
     </emItem>
       <emItem  blockID="i218" id="ffxtlbr@claro.com">
@@ -866,6 +920,12 @@
                     <prefs>
               </prefs>
     </emItem>
+      <emItem  blockID="i816" id="noOpus@outlook.com">
+                        <versionRange  minVersion="0" maxVersion="*" severity="3">
+                    </versionRange>
+                    <prefs>
+              </prefs>
+    </emItem>
       <emItem  blockID="i528" id="008abed2-b43a-46c9-9a5b-a771c87b82da@1ad61d53-2bdc-4484-a26b-b888ecae1906.com">
                         <versionRange  minVersion="0" maxVersion="*" severity="1">
                     </versionRange>
@@ -948,6 +1008,12 @@
                     <prefs>
               </prefs>
     </emItem>
+      <emItem  blockID="i822" id="{6af08a71-380e-42dd-9312-0111d2bc0630}">
+                        <versionRange  minVersion="0" maxVersion="*" severity="3">
+                    </versionRange>
+                    <prefs>
+              </prefs>
+    </emItem>
       <emItem  blockID="i490" id="now.msn.com@services.mozilla.org">
                         <versionRange  minVersion="0" maxVersion="*" severity="3">
                     </versionRange>
@@ -968,6 +1034,18 @@
                     <prefs>
               </prefs>
     </emItem>
+      <emItem  blockID="i91" id="crossriderapp4926@crossrider.com">
+                        <versionRange  minVersion="0" maxVersion="0.81.43" severity="1">
+                    </versionRange>
+                    <prefs>
+              </prefs>
+    </emItem>
+      <emItem  blockID="i700" id="2bbadf1f-a5af-499f-9642-9942fcdb7c76@f05a14cc-8842-4eee-be17-744677a917ed.com">
+                        <versionRange  minVersion="0" maxVersion="*" severity="1">
+                    </versionRange>
+                    <prefs>
+              </prefs>
+    </emItem>
       <emItem  blockID="i696" id="/^({fa95f577-07cb-4470-ac90-e843f5f83c52}|ffxtlbr@speedial\.com)$/">
                         <versionRange  minVersion="0" maxVersion="*" severity="1">
                     </versionRange>
@@ -1012,14 +1090,14 @@
                     <prefs>
               </prefs>
     </emItem>
-      <emItem  blockID="i497" id="{872b5b88-9db5-4310-bdd0-ac189557e5f5}">
-                        <versionRange  minVersion="0" maxVersion="*" severity="1">
+      <emItem  blockID="i76" id="crossriderapp3924@crossrider.com">
+                        <versionRange  minVersion="0" maxVersion="*">
                     </versionRange>
                     <prefs>
               </prefs>
     </emItem>
-      <emItem  blockID="i76" id="crossriderapp3924@crossrider.com">
-                        <versionRange  minVersion="0" maxVersion="*">
+      <emItem  blockID="i836" id="hansin@topvest.id">
+                        <versionRange  minVersion="0" maxVersion="*" severity="3">
                     </versionRange>
                     <prefs>
               </prefs>
@@ -1112,6 +1190,12 @@
                     <prefs>
               </prefs>
     </emItem>
+      <emItem  blockID="i812" id="{1e4ea5fc-09e5-4f45-a43b-c048304899fc}">
+                        <versionRange  minVersion="0" maxVersion="*" severity="3">
+                    </versionRange>
+                    <prefs>
+              </prefs>
+    </emItem>
       <emItem  blockID="i710" id="{e0352044-1439-48ba-99b6-b05ed1a4d2de}">
                         <versionRange  minVersion="0" maxVersion="*" severity="3">
                     </versionRange>
@@ -1160,7 +1244,7 @@
                     <prefs>
               </prefs>
     </emItem>
-      <emItem  blockID="i354" id="{c0c2693d-2ee8-47b4-9df7-b67a0ee31988}">
+      <emItem  blockID="i497" id="{872b5b88-9db5-4310-bdd0-ac189557e5f5}">
                         <versionRange  minVersion="0" maxVersion="*" severity="1">
                     </versionRange>
                     <prefs>
@@ -1311,12 +1395,10 @@
                     <prefs>
               </prefs>
     </emItem>
-      <emItem  blockID="i768" id="{f2548724-373f-45fe-be6a-3a85e87b7711}">
+      <emItem  blockID="i870" id="M1uwW0@47z8gRpK8sULXXLivB.com">
                         <versionRange  minVersion="0" maxVersion="*" severity="3">
                     </versionRange>
                     <prefs>
-                  <pref>browser.startup.homepage</pref>
-                  <pref>browser.search.defaultenginename</pref>
               </prefs>
     </emItem>
       <emItem  blockID="i246" id="support@vide1flash2.com">
@@ -1349,6 +1431,12 @@
                     <prefs>
               </prefs>
     </emItem>
+      <emItem  blockID="i820" id="{aab02ab1-33cf-4dfa-8a9f-f4e60e976d27}">
+                        <versionRange  minVersion="0" maxVersion="*" severity="3">
+                    </versionRange>
+                    <prefs>
+              </prefs>
+    </emItem>
       <emItem  blockID="i692" id="/^(j003-lqgrmgpcekslhg|SupraSavings|j003-dkqonnnthqjnkq|j003-kaggrpmirxjpzh)@jetpack$/">
                         <versionRange  minVersion="0" maxVersion="*" severity="1">
                     </versionRange>
@@ -1487,12 +1575,38 @@
                     <prefs>
               </prefs>
     </emItem>
+      <emItem  blockID="i846" id="PDVDZDW52397720@XDDWJXW57740856.com">
+                        <versionRange  minVersion="0" maxVersion="*" severity="1">
+                    </versionRange>
+                    <prefs>
+                  <pref>browser.startup.homepage</pref>
+                  <pref>browser.search.defaultenginename</pref>
+              </prefs>
+    </emItem>
+      <emItem  blockID="i354" id="{c0c2693d-2ee8-47b4-9df7-b67a0ee31988}">
+                        <versionRange  minVersion="0" maxVersion="*" severity="1">
+                    </versionRange>
+                    <prefs>
+              </prefs>
+    </emItem>
       <emItem  blockID="i726" id="{d87d56b2-1379-49f4-b081-af2850c79d8e}">
                         <versionRange  minVersion="0" maxVersion="*" severity="3">
                     </versionRange>
                     <prefs>
               </prefs>
     </emItem>
+      <emItem  blockID="i872" id="search-snacks@search-snacks.com">
+                        <versionRange  minVersion="0" maxVersion="*" severity="1">
+                    </versionRange>
+                    <prefs>
+              </prefs>
+    </emItem>
+      <emItem  blockID="i852" id="6lIy@T.edu">
+                        <versionRange  minVersion="0" maxVersion="*" severity="1">
+                    </versionRange>
+                    <prefs>
+              </prefs>
+    </emItem>
       <emItem  blockID="i505" id="extacylife@a.com">
                         <versionRange  minVersion="0" maxVersion="*" severity="3">
                     </versionRange>
@@ -1773,7 +1887,7 @@
                     <prefs>
               </prefs>
     </emItem>
-      <emItem  blockID="i70" id="psid-vhvxQHMZBOzUZA@jetpack">
+      <emItem  blockID="i543" id="{badea1ae-72ed-4f6a-8c37-4db9a4ac7bc9}">
                         <versionRange  minVersion="0" maxVersion="*" severity="1">
                     </versionRange>
                     <prefs>
@@ -1785,6 +1899,12 @@
                     <prefs>
               </prefs>
     </emItem>
+      <emItem  blockID="i840" id="{4889ddce-7a83-45e6-afc9-1e4f1149fff4}">
+                        <versionRange  minVersion="0" maxVersion="*" severity="3">
+                    </versionRange>
+                    <prefs>
+              </prefs>
+    </emItem>
       <emItem  blockID="i532" id="249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com">
                         <versionRange  minVersion="0" maxVersion="*" severity="1">
                     </versionRange>
@@ -1823,12 +1943,10 @@
                     <prefs>
               </prefs>
     </emItem>
-      <emItem  blockID="i760" id="toolbar11093@freshy.com">
-                        <versionRange  minVersion="0" maxVersion="*" severity="1">
+      <emItem  blockID="i818" id="contentarget@maildrop.cc">
+                        <versionRange  minVersion="0" maxVersion="*" severity="3">
                     </versionRange>
                     <prefs>
-                  <pref>browser.startup.homepage</pref>
-                  <pref>browser.search.defaultenginename</pref>
               </prefs>
     </emItem>
       <emItem  blockID="i142" id="{a3a5c777-f583-4fef-9380-ab4add1bc2a8}">
@@ -1866,8 +1984,8 @@
                     <prefs>
               </prefs>
     </emItem>
-      <emItem  blockID="i364" id="{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}">
-                        <versionRange  minVersion="0" maxVersion="*" severity="1">
+      <emItem  blockID="i810" id="{41339ee8-61ed-489d-b049-01e41fd5d7e0}">
+                        <versionRange  minVersion="0" maxVersion="*" severity="3">
                     </versionRange>
                     <prefs>
               </prefs>
@@ -1890,6 +2008,12 @@
                     <prefs>
               </prefs>
     </emItem>
+      <emItem  blockID="i842" id="{746505DC-0E21-4667-97F8-72EA6BCF5EEF}">
+                        <versionRange  minVersion="0" maxVersion="*" severity="1">
+                    </versionRange>
+                    <prefs>
+              </prefs>
+    </emItem>
       <emItem  blockID="i552" id="jid0-O6MIff3eO5dIGf5Tcv8RsJDKxrs@jetpack">
                         <versionRange  minVersion="0" maxVersion="*" severity="3">
                     </versionRange>
@@ -1978,14 +2102,22 @@
                     <prefs>
               </prefs>
     </emItem>
+      <emItem  blockID="i874" id="/^toolbar[0-9]*@findwide\.com$/">
+                        <versionRange  minVersion="0" maxVersion="*" severity="1">
+                    </versionRange>
+                    <prefs>
+                  <pref>browser.startup.homepage</pref>
+                  <pref>browser.search.defaultenginename</pref>
+              </prefs>
+    </emItem>
       <emItem  blockID="i588" id="quick_start@gmail.com">
                         <versionRange  minVersion="0" maxVersion="*" severity="3">
                     </versionRange>
                     <prefs>
               </prefs>
     </emItem>
-      <emItem  blockID="i340" id="chiang@programmer.net">
-                        <versionRange  minVersion="0" maxVersion="*" severity="3">
+      <emItem  blockID="i866" id="faststartff@gmail.com">
+                        <versionRange  minVersion="0" maxVersion="*" severity="1">
                     </versionRange>
                     <prefs>
               </prefs>
@@ -2008,8 +2140,8 @@
                     <prefs>
               </prefs>
     </emItem>
-      <emItem  blockID="i700" id="2bbadf1f-a5af-499f-9642-9942fcdb7c76@f05a14cc-8842-4eee-be17-744677a917ed.com">
-                        <versionRange  minVersion="0" maxVersion="*" severity="1">
+      <emItem  blockID="i838" id="{87b5a11e-3b54-42d2-9102-0a7cb1f79ebf}">
+                        <versionRange  minVersion="0" maxVersion="*" severity="3">
                     </versionRange>
                     <prefs>
               </prefs>
@@ -2057,8 +2189,22 @@
                     <prefs>
               </prefs>
     </emItem>
-      <emItem  blockID="i91" id="crossriderapp4926@crossrider.com">
-                        <versionRange  minVersion="0" maxVersion="0.81.43" severity="1">
+      <emItem  blockID="i868" id="{6e7f6f9f-8ce6-4611-add2-05f0f7049ee6}">
+                        <versionRange  minVersion="0" maxVersion="*" severity="1">
+                    </versionRange>
+                    <prefs>
+              </prefs>
+    </emItem>
+      <emItem  blockID="i864" id="{0A92F062-6AC6-8180-5881-B6E0C0DC2CC5}">
+                        <versionRange  minVersion="0" maxVersion="*" severity="1">
+                    </versionRange>
+                    <prefs>
+                  <pref>browser.startup.homepage</pref>
+                  <pref>browser.search.defaultenginename</pref>
+              </prefs>
+    </emItem>
+      <emItem  blockID="i814" id="liiros@facebook.com">
+                        <versionRange  minVersion="0" maxVersion="*" severity="3">
                     </versionRange>
                     <prefs>
               </prefs>
@@ -2216,7 +2362,7 @@
                     <prefs>
               </prefs>
     </emItem>
-      <emItem  blockID="i543" id="{badea1ae-72ed-4f6a-8c37-4db9a4ac7bc9}">
+      <emItem  blockID="i70" id="psid-vhvxQHMZBOzUZA@jetpack">
                         <versionRange  minVersion="0" maxVersion="*" severity="1">
                     </versionRange>
                     <prefs>
@@ -2762,6 +2908,30 @@
                   <match name="filename" exp="(NPSWF32.*\.dll)|(Flash\ Player\.plugin)" />                      <versionRange  minVersion="14.0" maxVersion="15.0.0.242" severity="0" vulnerabilitystatus="1"></versionRange>
                             <infoURL>https://get.adobe.com/flashplayer/</infoURL>
           </pluginItem>
+      <pluginItem  blockID="p824">
+                  <match name="filename" exp="(NPSWF32.*\.dll)|(Flash\ Player\.plugin)" />                      <versionRange  minVersion="13.0.0.259" maxVersion="13.0.0.263" severity="0" vulnerabilitystatus="1"></versionRange>
+                            <infoURL>https://get.adobe.com/flashplayer/</infoURL>
+          </pluginItem>
+      <pluginItem  os="Linux" blockID="p826">
+                  <match name="filename" exp="libflashplayer\.so" />                      <versionRange  minVersion="11.2.202.425" maxVersion="11.2.202.439" severity="0" vulnerabilitystatus="1"></versionRange>
+                            <infoURL>https://get.adobe.com/flashplayer/</infoURL>
+          </pluginItem>
+      <pluginItem  blockID="p828">
+                  <match name="filename" exp="(NPSWF32.*\.dll)|(Flash\ Player\.plugin)" />                      <versionRange  minVersion="15.0.0.243" maxVersion="16.0.0.287" severity="0" vulnerabilitystatus="1"></versionRange>
+                            <infoURL>https://get.adobe.com/flashplayer/</infoURL>
+          </pluginItem>
+      <pluginItem  os="Linux" blockID="p830">
+                  <match name="filename" exp="libflashplayer\.so" />                      <versionRange  minVersion="11.2.202.439" maxVersion="11.2.202.441" severity="0" vulnerabilitystatus="1"></versionRange>
+                            <infoURL>https://get.adobe.com/flashplayer/</infoURL>
+          </pluginItem>
+      <pluginItem  blockID="p832">
+                  <match name="filename" exp="(NPSWF32.*\.dll)|(Flash\ Player\.plugin)" />                      <versionRange  minVersion="16.0.0.295" maxVersion="16.0.0.304" severity="0" vulnerabilitystatus="1"></versionRange>
+                            <infoURL>https://get.adobe.com/flashplayer/</infoURL>
+          </pluginItem>
+      <pluginItem  blockID="p834">
+                  <match name="filename" exp="(NPSWF32.*\.dll)|(Flash\ Player\.plugin)" />                      <versionRange  minVersion="13.0.0.263" maxVersion="13.0.0.268" severity="0" vulnerabilitystatus="1"></versionRange>
+                            <infoURL>https://get.adobe.com/flashplayer/</infoURL>
+          </pluginItem>
     </pluginItems>
 
   <gfxItems>
@@ -2813,4 +2983,5 @@
     </gfxItems>
 
 
+
 </blocklist>
\ No newline at end of file
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/browser/config/version.txt thunderbird-1000~31.6.0+build1/mozilla/browser/config/version.txt
--- thunderbird-1000~31.4.0+build1/mozilla/browser/config/version.txt	2015-01-12 17:51:32.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/browser/config/version.txt	2015-03-30 18:03:38.000000000 +0000
@@ -1 +1 @@
-31.3.0esr
+31.6.0esrpre
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/browser/devtools/app-manager/app-projects.js thunderbird-1000~31.6.0+build1/mozilla/browser/devtools/app-manager/app-projects.js
--- thunderbird-1000~31.4.0+build1/mozilla/browser/devtools/app-manager/app-projects.js	2015-01-12 17:51:18.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/browser/devtools/app-manager/app-projects.js	2015-03-30 18:03:38.000000000 +0000
@@ -61,6 +61,8 @@
   add: function(project) {
     let deferred = promise.defer();
 
+    project = JSON.parse(JSON.stringify(project));
+
     if (!project.location) {
       // We need to make sure this object has a `.location` property.
       deferred.reject("Missing location property on project object.");
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/caps/src/nsScriptSecurityManager.cpp thunderbird-1000~31.6.0+build1/mozilla/caps/src/nsScriptSecurityManager.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/caps/src/nsScriptSecurityManager.cpp	2015-01-12 17:51:19.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/caps/src/nsScriptSecurityManager.cpp	2015-03-30 18:03:40.000000000 +0000
@@ -770,12 +770,31 @@
     NS_ENSURE_SUCCESS(rv, rv);
     if (hasFlags) {
         if (aFlags & nsIScriptSecurityManager::ALLOW_CHROME) {
+
+            // For now, don't change behavior for resource:// or moz-icon:// and
+            // just allow them.
             if (!targetScheme.EqualsLiteral("chrome")) {
-                // for now don't change behavior for resource: or moz-icon:
                 return NS_OK;
             }
 
-            // allow load only if chrome package is whitelisted
+            // Allow a URI_IS_UI_RESOURCE source to link to a URI_IS_UI_RESOURCE
+            // target if ALLOW_CHROME is set.
+            //
+            // ALLOW_CHROME is a flag that we pass on all loads _except_ docshell
+            // loads (since docshell loads run the loaded content with its origin
+            // principal). So we're effectively allowing resource://, chrome://,
+            // and moz-icon:// source URIs to load resource://, chrome://, and
+            // moz-icon:// files, so long as they're not loading it as a document.
+            bool sourceIsUIResource;
+            rv = NS_URIChainHasFlags(sourceBaseURI,
+                                     nsIProtocolHandler::URI_IS_UI_RESOURCE,
+                                     &sourceIsUIResource);
+            NS_ENSURE_SUCCESS(rv, rv);
+            if (sourceIsUIResource) {
+                return NS_OK;
+            }
+
+            // Allow the load only if the chrome package is whitelisted.
             nsCOMPtr<nsIXULChromeRegistry> reg(do_GetService(
                                                  NS_CHROMEREGISTRY_CONTRACTID));
             if (reg) {
@@ -787,17 +806,14 @@
             }
         }
 
-        // resource: and chrome: are equivalent, securitywise
-        // That's bogus!!  Fix this.  But watch out for
-        // the view-source stylesheet?
-        bool sourceIsChrome;
-        rv = NS_URIChainHasFlags(sourceBaseURI,
-                                 nsIProtocolHandler::URI_IS_UI_RESOURCE,
-                                 &sourceIsChrome);
-        NS_ENSURE_SUCCESS(rv, rv);
-        if (sourceIsChrome) {
+        // Special-case the hidden window: it's allowed to load
+        // URI_IS_UI_RESOURCE no matter what.  Bug 1145470 tracks removing this.
+        nsAutoCString sourceSpec;
+        if (NS_SUCCEEDED(sourceBaseURI->GetSpec(sourceSpec)) &&
+            sourceSpec.EqualsLiteral("resource://gre-resources/hiddenWindow.html")) {
             return NS_OK;
         }
+
         if (reportErrors) {
             ReportError(nullptr, errorTag, sourceURI, aTargetURI);
         }
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/config/milestone.txt thunderbird-1000~31.6.0+build1/mozilla/config/milestone.txt
--- thunderbird-1000~31.4.0+build1/mozilla/config/milestone.txt	2015-01-12 17:51:32.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/config/milestone.txt	2015-03-30 18:03:40.000000000 +0000
@@ -10,4 +10,4 @@
 # hardcoded milestones in the tree from these two files.
 #--------------------------------------------------------
 
-31.4.0
+31.6.0
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/content/base/test/test_bug382113.html thunderbird-1000~31.6.0+build1/mozilla/content/base/test/test_bug382113.html
--- thunderbird-1000~31.4.0+build1/mozilla/content/base/test/test_bug382113.html	2015-01-12 17:51:20.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/content/base/test/test_bug382113.html	2015-03-30 18:03:40.000000000 +0000
@@ -7,6 +7,19 @@
   <title>Test for Bug 382113</title>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>        
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+  <script class="testbody" type="application/javascript">
+
+    SimpleTest.waitForExplicitFinish();
+    var childGotOnload = false;
+    var objectGotOnload = false;
+
+    /** Test for Bug 100533 **/
+    function checkEvents() {
+      is(childGotOnload, true, "Child got load event");
+      is(objectGotOnload, true, "Object got load event");
+      SimpleTest.finish();
+    }
+  </script>
 </head>
 <body onload="checkEvents()">
 <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=382113">Mozilla Bug 382113</a>
@@ -16,22 +29,6 @@
           onload="objectGotOnload = true;"></object>
 </div>
 <pre id="test">
-
-
-<script class="testbody" type="application/javascript">
-
-SimpleTest.waitForExplicitFinish();
-var childGotOnload = false;
-var objectGotOnload = false;
-
-/** Test for Bug 100533 **/
-function checkEvents() {
-  is(childGotOnload, true, "Child got load event");
-  is(objectGotOnload, true, "Object got load event");
-  SimpleTest.finish();
-}
-</script>
-
 </pre>
 </body>
 </html>
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/content/canvas/src/WebGLContextGL.cpp thunderbird-1000~31.6.0+build1/mozilla/content/canvas/src/WebGLContextGL.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/content/canvas/src/WebGLContextGL.cpp	2015-01-12 17:51:21.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/content/canvas/src/WebGLContextGL.cpp	2015-03-30 18:03:41.000000000 +0000
@@ -46,6 +46,7 @@
 #include "mozilla/dom/ImageData.h"
 #include "mozilla/dom/ToJSValue.h"
 #include "mozilla/Endian.h"
+#include "mozilla/fallible.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
@@ -3644,7 +3645,12 @@
         else
         {
             size_t convertedDataSize = height * dstStride;
-            convertedData = new uint8_t[convertedDataSize];
+            convertedData = (uint8_t*)moz_malloc(convertedDataSize);
+            if (!convertedData) {
+                ErrorOutOfMemory("texImage2D: Ran out of memory when allocating"
+                                 " a buffer for doing format conversion.");
+                return;
+            }
             ConvertImage(width, height, srcStride, dstStride,
                         static_cast<uint8_t*>(data), convertedData,
                         actualSrcFormat, srcPremultiplied,
@@ -3794,7 +3800,12 @@
 
     if (!noConversion) {
         size_t convertedDataSize = height * dstStride;
-        convertedData = new uint8_t[convertedDataSize];
+        convertedData = (uint8_t*)moz_malloc(convertedDataSize);
+        if (!convertedData) {
+            ErrorOutOfMemory("texImage2D: Ran out of memory when allocating"
+                             " a buffer for doing format conversion.");
+            return;
+        }
         ConvertImage(width, height, srcStride, dstStride,
                     static_cast<const uint8_t*>(data), convertedData,
                     actualSrcFormat, srcPremultiplied,
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/content/html/content/public/HTMLMediaElement.h thunderbird-1000~31.6.0+build1/mozilla/content/html/content/public/HTMLMediaElement.h
--- thunderbird-1000~31.4.0+build1/mozilla/content/html/content/public/HTMLMediaElement.h	2015-01-12 17:51:21.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/content/html/content/public/HTMLMediaElement.h	2015-03-30 18:03:41.000000000 +0000
@@ -534,7 +534,7 @@
 
   void SetMozAudioChannelType(AudioChannel aValue, ErrorResult& aRv);
 
-  TextTrackList* TextTracks();
+  TextTrackList* GetTextTracks();
 
   already_AddRefed<TextTrack> AddTextTrack(TextTrackKind aKind,
                                            const nsAString& aLabel,
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/content/html/content/src/HTMLFormElement.cpp thunderbird-1000~31.6.0+build1/mozilla/content/html/content/src/HTMLFormElement.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/content/html/content/src/HTMLFormElement.cpp	2015-01-12 17:51:21.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/content/html/content/src/HTMLFormElement.cpp	2015-03-30 18:03:41.000000000 +0000
@@ -2056,14 +2056,15 @@
       index = 0;
     }
     radio = HTMLInputElement::FromContentOrNull(radioGroup->Item(index));
-    if (!radio)
-      continue;
-
-    isRadio = radio->GetType() == NS_FORM_INPUT_RADIO;
-    if (!isRadio)
+    isRadio = radio && radio->GetType() == NS_FORM_INPUT_RADIO;
+    if (!isRadio) {
       continue;
+    }
 
-  } while ((radio->Disabled() && radio != currentRadio) || !isRadio);
+    nsAutoString name;
+    radio->GetName(name);
+    isRadio = aName.Equals(name);
+  } while (!isRadio || (radio->Disabled() && radio != currentRadio));
 
   NS_IF_ADDREF(*aRadioOut = radio);
   return NS_OK;
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/content/html/content/src/HTMLMediaElement.cpp thunderbird-1000~31.6.0+build1/mozilla/content/html/content/src/HTMLMediaElement.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/content/html/content/src/HTMLMediaElement.cpp	2015-01-12 17:51:21.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/content/html/content/src/HTMLMediaElement.cpp	2015-03-30 18:03:41.000000000 +0000
@@ -3892,11 +3892,11 @@
   return NS_OK;
 }
 
-/* readonly attribute TextTrackList textTracks; */
+/* readonly attribute TextTrackList? textTracks; */
 TextTrackList*
-HTMLMediaElement::TextTracks()
+HTMLMediaElement::GetTextTracks()
 {
-  return GetOrCreateTextTrackManager()->TextTracks();
+  return GetOrCreateTextTrackManager()->GetTextTracks();
 }
 
 already_AddRefed<TextTrack>
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/content/html/content/src/HTMLTrackElement.cpp thunderbird-1000~31.6.0+build1/mozilla/content/html/content/src/HTMLTrackElement.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/content/html/content/src/HTMLTrackElement.cpp	2015-01-12 17:51:21.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/content/html/content/src/HTMLTrackElement.cpp	2015-03-30 18:03:41.000000000 +0000
@@ -153,13 +153,12 @@
     kind = TextTrackKind::Subtitles;
   }
 
-  bool hasHadScriptObject = true;
-  nsIScriptGlobalObject* scriptObject =
-    OwnerDoc()->GetScriptHandlingObject(hasHadScriptObject);
+  nsISupports* parentObject =
+    OwnerDoc()->GetParentObject();
 
-  NS_ENSURE_TRUE_VOID(scriptObject || !hasHadScriptObject);
+  NS_ENSURE_TRUE_VOID(parentObject);
 
-  nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(scriptObject);
+  nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(parentObject);
   mTrack = new TextTrack(window, kind, label, srcLang,
                          TextTrackMode::Disabled,
                          TextTrackReadyState::NotLoaded,
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/content/html/content/src/TextTrackManager.cpp thunderbird-1000~31.6.0+build1/mozilla/content/html/content/src/TextTrackManager.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/content/html/content/src/TextTrackManager.cpp	2015-01-12 17:51:21.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/content/html/content/src/TextTrackManager.cpp	2015-03-30 18:03:41.000000000 +0000
@@ -91,13 +91,12 @@
   : mMediaElement(aMediaElement)
   , performedTrackSelection(false)
 {
-  bool hasHadScriptObject = true;
-  nsIScriptGlobalObject* scriptObject =
-    mMediaElement->OwnerDoc()->GetScriptHandlingObject(hasHadScriptObject);
+  nsISupports* parentObject =
+    mMediaElement->OwnerDoc()->GetParentObject();
 
-  NS_ENSURE_TRUE_VOID(scriptObject || !hasHadScriptObject);
+  NS_ENSURE_TRUE_VOID(parentObject);
 
-  nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(scriptObject);
+  nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(parentObject);
   mNewCues = new TextTrackCueList(window);
   mTextTracks = new TextTrackList(window, this);
   mPendingTextTracks = new TextTrackList(window, this);
@@ -111,7 +110,7 @@
 }
 
 TextTrackList*
-TextTrackManager::TextTracks() const
+TextTrackManager::GetTextTracks() const
 {
   return mTextTracks;
 }
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/content/html/content/src/TextTrackManager.h thunderbird-1000~31.6.0+build1/mozilla/content/html/content/src/TextTrackManager.h
--- thunderbird-1000~31.4.0+build1/mozilla/content/html/content/src/TextTrackManager.h	2015-01-12 17:51:21.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/content/html/content/src/TextTrackManager.h	2015-03-30 18:03:41.000000000 +0000
@@ -43,7 +43,7 @@
 
   TextTrackManager(HTMLMediaElement *aMediaElement);
 
-  TextTrackList* TextTracks() const;
+  TextTrackList* GetTextTracks() const;
   already_AddRefed<TextTrack> AddTextTrack(TextTrackKind aKind,
                                            const nsAString& aLabel,
                                            const nsAString& aLanguage,
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/content/html/content/test/forms/test_input_radio_radiogroup.html thunderbird-1000~31.6.0+build1/mozilla/content/html/content/test/forms/test_input_radio_radiogroup.html
--- thunderbird-1000~31.4.0+build1/mozilla/content/html/content/test/forms/test_input_radio_radiogroup.html	2015-01-12 17:51:21.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/content/html/content/test/forms/test_input_radio_radiogroup.html	2015-03-30 18:03:41.000000000 +0000
@@ -14,16 +14,30 @@
 <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=343444">Mozilla Bug 343444</a>
 <p id="display"></p>
 <form>
-  <input type="radio" name="testradio" id="start"></input>
-  <input type="text"  name="testradio"></input>
-  <input type="text"  name="testradio"></input>
-  <input type="radio" name="testradio"></input>
-  <input type="text"  name="testradio"></input>
-  <input type="radio" name="testradio"></input>
-  <input type="text"  name="testradio"></input>
-  <input type="radio" name="testradio"></input>
-  <input type="radio" name="testradio"></input>
-  <input type="text"  name="testradio"></input>
+  <fieldset id="testradio">
+    <input type="radio" name="testradio" id="start"></input>
+    <input type="text"  name="testradio"></input>
+    <input type="text"  name="testradio"></input>
+    <input type="radio" name="testradio"></input>
+    <input type="text"  name="testradio"></input>
+    <input type="radio" name="testradio"></input>
+    <input type="text"  name="testradio"></input>
+    <input type="radio" name="testradio"></input>
+    <input type="radio" name="testradio"></input>
+    <input type="text"  name="testradio"></input>
+  </fieldset>
+
+  <fieldset>
+    <input type="radio" name="testtwo" id="start2"></input>
+    <input type="radio" name="testtwo"></input>
+    <input type="radio" name="error" id="testtwo"></input>
+    <input type="radio" name="testtwo" id="end"></input>
+  </fieldset>
+
+  <fieldset>
+    <input type="radio" name="testthree" id="start3"></input>
+    <input type="radio" name="errorthree" id="testthree"></input>
+  </fieldset>
 </form>
 <script class="testbody" type="text/javascript">
 /** Test for Bug 343444 **/
@@ -31,11 +45,24 @@
 var count=0;
 while (count < 2) {
   sendKey("DOWN");
-  ok(document.activeElement.type == "radio", "radioGroup should ignore non-radio input fields");
+  is(document.activeElement.type, "radio", "radioGroup should ignore non-radio input fields");
   if (document.activeElement.id == "start") {
     count++;
   }
 }
+
+document.getElementById("start2").focus();
+count = 0;
+while (count < 3) {
+  is(document.activeElement.name, "testtwo",
+     "radioGroup should only contain elements with the same @name")
+  sendKey("DOWN");
+  count++;
+}
+
+document.getElementById("start3").focus();
+sendKey("DOWN");
+is(document.activeElement.name, "testthree", "we don't have an infinite-loop");
 </script>
 </pre>
 </body>
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/content/media/gstreamer/GStreamerFormatHelper.cpp thunderbird-1000~31.6.0+build1/mozilla/content/media/gstreamer/GStreamerFormatHelper.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/content/media/gstreamer/GStreamerFormatHelper.cpp	2015-01-12 17:51:21.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/content/media/gstreamer/GStreamerFormatHelper.cpp	2015-03-30 18:03:42.000000000 +0000
@@ -8,6 +8,7 @@
 #include "nsCharSeparatedTokenizer.h"
 #include "nsString.h"
 #include "GStreamerLoader.h"
+#include "mozilla/Preferences.h"
 
 #define ENTRY_FORMAT(entry) entry[0]
 #define ENTRY_CAPS(entry) entry[1]
@@ -64,6 +65,10 @@
   {"audio/mpeg", "audio/mpeg, layer=(int)3"}
 };
 
+static char const * const sPluginBlacklist[] = {
+  "flump3dec",
+};
+
 GStreamerFormatHelper::GStreamerFormatHelper()
   : mFactories(nullptr),
     mCookie(static_cast<uint32_t>(-1))
@@ -203,13 +208,46 @@
   return caps;
 }
 
+/* static */ bool
+GStreamerFormatHelper::IsBlacklistEnabled()
+{
+  static bool sBlacklistEnabled;
+  static bool sBlacklistEnabledCached = false;
+
+  if (!sBlacklistEnabledCached) {
+    Preferences::AddBoolVarCache(&sBlacklistEnabled,
+                                 "media.gstreamer.enable-blacklist", true);
+    sBlacklistEnabledCached = true;
+  }
+
+  return sBlacklistEnabled;
+}
+
+/* static */ bool
+GStreamerFormatHelper::IsPluginFeatureBlacklisted(GstPluginFeature *aFeature)
+{
+  if (!IsBlacklistEnabled()) {
+    return false;
+  }
+
+  const gchar *factoryName =
+    gst_plugin_feature_get_name(aFeature);
+
+  for (unsigned int i = 0; i < G_N_ELEMENTS(sPluginBlacklist); i++) {
+    if (!strcmp(factoryName, sPluginBlacklist[i])) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
 static gboolean FactoryFilter(GstPluginFeature *aFeature, gpointer)
 {
   if (!GST_IS_ELEMENT_FACTORY(aFeature)) {
     return FALSE;
   }
 
-  // TODO _get_klass doesn't exist in 1.0
   const gchar *className =
     gst_element_factory_get_klass(GST_ELEMENT_FACTORY_CAST(aFeature));
 
@@ -217,7 +255,9 @@
     return FALSE;
   }
 
-  return gst_plugin_feature_get_rank(aFeature) >= GST_RANK_MARGINAL;
+  return
+    gst_plugin_feature_get_rank(aFeature) >= GST_RANK_MARGINAL &&
+    !GStreamerFormatHelper::IsPluginFeatureBlacklisted(aFeature);
 }
 
 /**
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/content/media/gstreamer/GStreamerFormatHelper.h thunderbird-1000~31.6.0+build1/mozilla/content/media/gstreamer/GStreamerFormatHelper.h
--- thunderbird-1000~31.4.0+build1/mozilla/content/media/gstreamer/GStreamerFormatHelper.h	2015-01-12 17:51:21.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/content/media/gstreamer/GStreamerFormatHelper.h	2015-03-30 18:03:42.000000000 +0000
@@ -29,6 +29,9 @@
     bool CanHandleContainerCaps(GstCaps* aCaps);
     bool CanHandleCodecCaps(GstCaps* aCaps);
 
+    static bool IsBlacklistEnabled();
+    static bool IsPluginFeatureBlacklisted(GstPluginFeature *aFeature);
+
     static GstCaps* ConvertFormatsToCaps(const char* aMIMEType,
                                          const nsAString* aCodecs);
 
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/content/media/gstreamer/GStreamerFunctionList.h thunderbird-1000~31.6.0+build1/mozilla/content/media/gstreamer/GStreamerFunctionList.h
--- thunderbird-1000~31.4.0+build1/mozilla/content/media/gstreamer/GStreamerFunctionList.h	2015-01-12 17:51:21.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/content/media/gstreamer/GStreamerFunctionList.h	2015-03-30 18:03:42.000000000 +0000
@@ -62,6 +62,7 @@
 GST_FUNC(LIBGSTREAMER, gst_pipeline_get_bus)
 GST_FUNC(LIBGSTREAMER, gst_pipeline_get_type)
 GST_FUNC(LIBGSTREAMER, gst_plugin_feature_get_rank)
+GST_FUNC(LIBGSTREAMER, gst_plugin_feature_get_type)
 GST_FUNC(LIBGSTREAMER, gst_registry_feature_filter)
 GST_FUNC(LIBGSTREAMER, gst_registry_get_feature_list_cookie)
 GST_FUNC(LIBGSTREAMER, gst_segment_init)
@@ -88,6 +89,7 @@
 GST_FUNC(LIBGSTREAMER, gst_pad_alloc_buffer)
 GST_FUNC(LIBGSTREAMER, gst_pad_get_negotiated_caps)
 GST_FUNC(LIBGSTREAMER, gst_pad_set_bufferalloc_function)
+GST_FUNC(LIBGSTREAMER, gst_plugin_feature_get_name)
 GST_FUNC(LIBGSTREAMER, gst_registry_get_default)
 GST_FUNC(LIBGSTREAMER, gst_segment_set_newsegment)
 GST_FUNC(LIBGSTVIDEO, gst_video_format_get_component_height)
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/content/media/gstreamer/GStreamerReader.cpp thunderbird-1000~31.6.0+build1/mozilla/content/media/gstreamer/GStreamerReader.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/content/media/gstreamer/GStreamerReader.cpp	2015-01-12 17:51:21.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/content/media/gstreamer/GStreamerReader.cpp	2015-03-30 18:03:42.000000000 +0000
@@ -194,6 +194,9 @@
   g_signal_connect(G_OBJECT(mPlayBin), "element-added",
                    G_CALLBACK(GStreamerReader::PlayElementAddedCb), this);
 
+  g_signal_connect(G_OBJECT(mPlayBin), "element-added",
+                   G_CALLBACK(GStreamerReader::ElementAddedCb), this);
+
   return NS_OK;
 }
 
@@ -213,6 +216,47 @@
   return GST_BUS_PASS;
 }
 
+void GStreamerReader::ElementAddedCb(GstBin *aPlayBin,
+                                     GstElement *aElement,
+                                     gpointer aUserData)
+{
+  const gchar *name =
+    gst_plugin_feature_get_name(GST_PLUGIN_FEATURE(gst_element_get_factory(aElement)));
+
+  if (!strcmp(name, "uridecodebin")) {
+    g_signal_connect(G_OBJECT(aElement), "autoplug-sort",
+                     G_CALLBACK(GStreamerReader::ElementFilterCb), aUserData);
+  }
+}
+
+GValueArray *GStreamerReader::ElementFilterCb(GstURIDecodeBin *aBin,
+                                              GstPad *aPad,
+                                              GstCaps *aCaps,
+                                              GValueArray *aFactories,
+                                              gpointer aUserData)
+{
+  return ((GStreamerReader*)aUserData)->ElementFilter(aBin, aPad, aCaps, aFactories);
+}
+
+GValueArray *GStreamerReader::ElementFilter(GstURIDecodeBin *aBin,
+                                            GstPad *aPad,
+                                            GstCaps *aCaps,
+                                            GValueArray *aFactories)
+{
+  GValueArray *filtered = g_value_array_new(aFactories->n_values);
+
+  for (unsigned int i = 0; i < aFactories->n_values; i++) {
+    GValue *value = &aFactories->values[i];
+    GstPluginFeature *factory = GST_PLUGIN_FEATURE(g_value_peek_pointer(value));
+
+    if (!GStreamerFormatHelper::IsPluginFeatureBlacklisted(factory)) {
+      g_value_array_append(filtered, value);
+    }
+  }
+
+  return filtered;
+}
+
 void GStreamerReader::PlayBinSourceSetupCb(GstElement* aPlayBin,
                                            GParamSpec* pspec,
                                            gpointer aUserData)
@@ -1128,7 +1172,7 @@
  * This callback is called while the pipeline is automatically built, after a
  * new element has been added to the pipeline. We use it to find the
  * uridecodebin instance used by playbin and connect to it to apply our
- * whitelist.
+ * blacklist.
  */
 void
 GStreamerReader::PlayElementAddedCb(GstBin *aBin, GstElement *aElement,
@@ -1165,9 +1209,8 @@
 
 /**
  * This is called by uridecodebin (running inside playbin), after it has found
- * candidate factories to continue decoding the stream. We apply the whitelist
- * here, allowing only demuxers and decoders that output the formats we want to
- * support.
+ * candidate factories to continue decoding the stream. We apply the blacklist
+ * here, disallowing known-crashy plugins.
  */
 GValueArray*
 GStreamerReader::AutoplugSortCb(GstElement* aElement, GstPad* aPad,
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/content/media/gstreamer/GStreamerReader.h thunderbird-1000~31.6.0+build1/mozilla/content/media/gstreamer/GStreamerReader.h
--- thunderbird-1000~31.4.0+build1/mozilla/content/media/gstreamer/GStreamerReader.h	2015-01-12 17:51:21.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/content/media/gstreamer/GStreamerReader.h	2015-03-30 18:03:42.000000000 +0000
@@ -25,6 +25,8 @@
 #include "ImageContainer.h"
 #include "nsRect.h"
 
+struct GstURIDecodeBin;
+
 namespace mozilla {
 
 namespace dom {
@@ -90,6 +92,30 @@
   static GstBusSyncReply ErrorCb(GstBus *aBus, GstMessage *aMessage, gpointer aUserData);
   GstBusSyncReply Error(GstBus *aBus, GstMessage *aMessage);
 
+  /*
+   * We attach this callback to playbin so that when uridecodebin is
+   * constructed, we can then list for its autoplug-sort signal to blacklist
+   * the elements it can construct.
+   */
+  static void ElementAddedCb(GstBin *aPlayBin,
+                             GstElement *aElement,
+                             gpointer aUserData);
+
+  /*
+   * Called on the autoplug-sort signal emitted by uridecodebin for filtering
+   * the elements it uses.
+   */
+  static GValueArray *ElementFilterCb(GstURIDecodeBin *aBin,
+                                      GstPad *aPad,
+                                      GstCaps *aCaps,
+                                      GValueArray *aFactories,
+                                      gpointer aUserData);
+
+  GValueArray *ElementFilter(GstURIDecodeBin *aBin,
+                             GstPad *aPad,
+                             GstCaps *aCaps,
+                             GValueArray *aFactories);
+
   /* Called on the source-setup signal emitted by playbin. Used to
    * configure appsrc .
    */
@@ -169,7 +195,7 @@
   static bool ShouldAutoplugFactory(GstElementFactory* aFactory, GstCaps* aCaps);
 
   /* Called by decodebin during autoplugging. We use it to apply our
-   * container/codec whitelist.
+   * container/codec blacklist.
    */
   static GValueArray* AutoplugSortCb(GstElement* aElement,
                                      GstPad* aPad, GstCaps* aCaps,
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/content/media/MediaDecoderStateMachine.cpp thunderbird-1000~31.6.0+build1/mozilla/content/media/MediaDecoderStateMachine.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/content/media/MediaDecoderStateMachine.cpp	2015-01-12 17:51:21.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/content/media/MediaDecoderStateMachine.cpp	2015-03-30 18:03:42.000000000 +0000
@@ -328,6 +328,8 @@
   if (offset >= aAudio->mFrames)
     return;
 
+  size_t framesToWrite = aAudio->mFrames - offset;
+
   aAudio->EnsureAudioBuffer();
   nsRefPtr<SharedBuffer> buffer = aAudio->mAudioBuffer;
   AudioDataValue* bufferData = static_cast<AudioDataValue*>(buffer->Data());
@@ -335,10 +337,11 @@
   for (uint32_t i = 0; i < aAudio->mChannels; ++i) {
     channels.AppendElement(bufferData + i*aAudio->mFrames + offset);
   }
-  aOutput->AppendFrames(buffer.forget(), channels, aAudio->mFrames);
-  VERBOSE_LOG("writing %d frames of data to MediaStream for AudioData at %lld",
-              aAudio->mFrames - int32_t(offset), aAudio->mTime);
-  aStream->mAudioFramesWritten += aAudio->mFrames - int32_t(offset);
+  aOutput->AppendFrames(buffer.forget(), channels, framesToWrite);
+  VERBOSE_LOG("writing %u frames of data to MediaStream for AudioData at %lld",
+              static_cast<unsigned>(framesToWrite),
+              aAudio->mTime);
+  aStream->mAudioFramesWritten += framesToWrite;
 }
 
 static void WriteVideoToMediaStream(layers::Image* aImage,
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/docshell/base/nsDocShell.cpp thunderbird-1000~31.6.0+build1/mozilla/docshell/base/nsDocShell.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/docshell/base/nsDocShell.cpp	2015-01-12 17:51:22.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/docshell/base/nsDocShell.cpp	2015-03-30 18:03:43.000000000 +0000
@@ -1325,6 +1325,7 @@
     if (IsPrintingOrPP()) {
       return NS_OK; // JS may not handle returning of an error code
     }
+
     nsCOMPtr<nsIURI> referrer;
     nsCOMPtr<nsIInputStream> postStream;
     nsCOMPtr<nsIInputStream> headersStream;
@@ -4204,7 +4205,8 @@
 bool
 nsDocShell::IsNavigationAllowed(bool aDisplayPrintErrorDialog)
 {
-  bool isAllowed = !IsPrintingOrPP(aDisplayPrintErrorDialog) && !mFiredUnloadEvent;
+  bool isAllowed = !IsPrintingOrPP(aDisplayPrintErrorDialog) &&
+                   !mFiredUnloadEvent;
   if (!isAllowed) {
     return false;
   }
@@ -9321,14 +9323,6 @@
             GetCurScrollPos(ScrollOrientation_X, &cx);
             GetCurScrollPos(ScrollOrientation_Y, &cy);
 
-            // ScrollToAnchor doesn't necessarily cause us to scroll the window;
-            // the function decides whether a scroll is appropriate based on the
-            // arguments it receives.  But even if we don't end up scrolling,
-            // ScrollToAnchor performs other important tasks, such as informing
-            // the presShell that we have a new hash.  See bug 680257.
-            rv = ScrollToAnchor(curHash, newHash, aLoadType);
-            NS_ENSURE_SUCCESS(rv, rv);
-
             // Reset mLoadType to its original value once we exit this block,
             // because this short-circuited load might have started after a
             // normal, network load, and we don't want to clobber its load type.
@@ -9416,16 +9410,6 @@
                     mOSHE->SetCacheKey(cacheKey);
             }
 
-            /* restore previous position of scroller(s), if we're moving
-             * back in history (bug 59774)
-             */
-            if (mOSHE && (aLoadType == LOAD_HISTORY || aLoadType == LOAD_RELOAD_NORMAL))
-            {
-                nscoord bx, by;
-                mOSHE->GetScrollPosition(&bx, &by);
-                SetCurScrollPosEx(bx, by);
-            }
-
             /* Restore the original LSHE if we were loading something
              * while short-circuited load was initiated.
              */
@@ -9463,12 +9447,36 @@
 
             SetDocCurrentStateObj(mOSHE);
 
+            // Inform the favicon service that the favicon for oldURI also
+            // applies to aURI.
+            CopyFavicon(currentURI, aURI, mInPrivateBrowsing);
+
+            nsRefPtr<nsGlobalWindow> win = mScriptGlobal ?
+              mScriptGlobal->GetCurrentInnerWindowInternal() : nullptr;
+
+            // ScrollToAnchor doesn't necessarily cause us to scroll the window;
+            // the function decides whether a scroll is appropriate based on the
+            // arguments it receives.  But even if we don't end up scrolling,
+            // ScrollToAnchor performs other important tasks, such as informing
+            // the presShell that we have a new hash.  See bug 680257.
+            rv = ScrollToAnchor(curHash, newHash, aLoadType);
+            NS_ENSURE_SUCCESS(rv, rv);
+
+            /* restore previous position of scroller(s), if we're moving
+             * back in history (bug 59774)
+             */
+            if (mOSHE && (aLoadType == LOAD_HISTORY ||
+                          aLoadType == LOAD_RELOAD_NORMAL)) {
+              nscoord bx, by;
+              mOSHE->GetScrollPosition(&bx, &by);
+              SetCurScrollPosEx(bx, by);
+            }
+
             // Dispatch the popstate and hashchange events, as appropriate.
             //
             // The event dispatch below can cause us to re-enter script and
             // destroy the docshell, nulling out mScriptGlobal. Hold a stack
             // reference to avoid null derefs. See bug 914521.
-            nsRefPtr<nsGlobalWindow> win = mScriptGlobal;
             if (win) {
                 // Fire a hashchange event URIs differ, and only in their hashes.
                 bool doHashchange = sameExceptHashes && !curHash.Equals(newHash);
@@ -9484,10 +9492,6 @@
                 }
             }
 
-            // Inform the favicon service that the favicon for oldURI also
-            // applies to aURI.
-            CopyFavicon(currentURI, aURI, mInPrivateBrowsing);
-
             return NS_OK;
         }
     }
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/dom/base/Navigator.cpp thunderbird-1000~31.6.0+build1/mozilla/dom/base/Navigator.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/dom/base/Navigator.cpp	2015-01-12 17:51:22.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/dom/base/Navigator.cpp	2015-03-30 18:03:43.000000000 +0000
@@ -1278,6 +1278,12 @@
       !contentType.Equals(APPLICATION_WWW_FORM_URLENCODED) &&
       !contentType.Equals(MULTIPART_FORM_DATA) &&
       !contentType.Equals(TEXT_PLAIN)) {
+
+    // we need to set the sameOriginChecker as a notificationCallback
+    // so we can tell the channel not to follow redirects
+    nsCOMPtr<nsIInterfaceRequestor> soc = nsContentUtils::GetSameOriginChecker();
+    channel->SetNotificationCallbacks(soc);
+
     nsCOMPtr<nsIChannel> preflightChannel;
     nsTArray<nsCString> unsafeHeaders;
     unsafeHeaders.AppendElement(NS_LITERAL_CSTRING("Content-Type"));
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/dom/base/nsGlobalWindow.cpp thunderbird-1000~31.6.0+build1/mozilla/dom/base/nsGlobalWindow.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/dom/base/nsGlobalWindow.cpp	2015-01-12 17:51:22.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/dom/base/nsGlobalWindow.cpp	2015-03-30 18:03:43.000000000 +0000
@@ -7394,9 +7394,14 @@
   nsCOMPtr<nsPIDOMWindow> contextWindow;
 
   if (cx) {
-    nsIScriptContext *currentCX = nsJSUtils::GetDynamicScriptContext(cx);
-    if (currentCX) {
-      contextWindow = do_QueryInterface(currentCX->GetGlobalObject());
+    contextWindow = do_QueryInterface(nsJSUtils::GetDynamicScriptGlobal(cx));
+    if (contextWindow) {
+      nsIPrincipal* entryPrin =
+        static_cast<nsGlobalWindow*>(contextWindow.get())->GetPrincipal();
+      nsIPrincipal* subjectPrin = nsContentUtils::GetSubjectPrincipal();
+      if (!subjectPrin->SubsumesConsideringDomain(entryPrin)) {
+        contextWindow = nullptr;
+      }
     }
   }
   if (!contextWindow) {
@@ -8963,6 +8968,8 @@
     return nullptr;
   }
 
+  Telemetry::Accumulate(Telemetry::DOM_WINDOW_SHOWMODALDIALOG_USED, true);
+
   nsRefPtr<DialogValueHolder> argHolder =
     new DialogValueHolder(nsContentUtils::GetSubjectPrincipal(), aArgument);
 
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/dom/bindings/BindingUtils.cpp thunderbird-1000~31.6.0+build1/mozilla/dom/bindings/BindingUtils.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/dom/bindings/BindingUtils.cpp	2015-01-12 17:51:22.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/dom/bindings/BindingUtils.cpp	2015-03-30 18:03:43.000000000 +0000
@@ -1504,17 +1504,30 @@
 HasPropertyOnPrototype(JSContext* cx, JS::Handle<JSObject*> proxy,
                        JS::Handle<jsid> id)
 {
-  JS::Rooted<JSObject*> obj(cx, proxy);
-  Maybe<JSAutoCompartment> ac;
-  if (xpc::WrapperFactory::IsXrayWrapper(obj)) {
-    obj = js::UncheckedUnwrap(obj);
-    ac.construct(cx, obj);
-  }
+  JS::Rooted<JSObject*> curr(cx, proxy);
+  while (true) {
+    JS::Rooted<JSObject*> proto(cx);
+    if (!js::GetObjectProto(cx, curr, &proto)) {
+      JS_ClearPendingException(cx);
+      return true; // Fail safe.
+    }
+
+    if (!proto) {
+      return false;
+    }
+
+    bool hasProp;
+    if (!JS_HasPropertyById(cx, proto, id, &hasProp)) {
+      JS_ClearPendingException(cx);
+      return true; // Fail safe.
+    }
 
-  bool found;
-  // We ignore an error from GetPropertyOnPrototype.  We pass nullptr
-  // for vp so that GetPropertyOnPrototype won't actually do a get.
-  return !GetPropertyOnPrototype(cx, obj, id, &found, nullptr) || found;
+    if (hasProp) {
+      return true;
+    }
+
+    curr = proto;
+  }
 }
 
 bool
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/dom/events/test/test_bug607464.html thunderbird-1000~31.6.0+build1/mozilla/dom/events/test/test_bug607464.html
--- thunderbird-1000~31.4.0+build1/mozilla/dom/events/test/test_bug607464.html	2015-01-12 17:51:23.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/dom/events/test/test_bug607464.html	2015-03-30 18:03:44.000000000 +0000
@@ -55,10 +55,10 @@
     scrollDown15PxWithPixelScrolling(scrollbox);
 
     // wait for the next refresh driver run
-    window.mozRequestAnimationFrame(function() {
+    win.mozRequestAnimationFrame(function() {
       // actually, wait for the next one before checking results, since
       // scrolling might not be flushed until after this code has run
-      window.mozRequestAnimationFrame(function() {
+      win.mozRequestAnimationFrame(function() {
         is(scrollbox.scrollTop, scrollTopBefore + 15,
            "Pixel scrolling should have finished after one refresh driver iteration. " +
            "We shouldn't be scrolling smoothly, even though the pref is set.");
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/dom/indexedDB/IDBDatabase.cpp thunderbird-1000~31.6.0+build1/mozilla/dom/indexedDB/IDBDatabase.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/dom/indexedDB/IDBDatabase.cpp	2015-01-12 17:51:23.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/dom/indexedDB/IDBDatabase.cpp	2015-03-30 18:03:44.000000000 +0000
@@ -536,6 +536,7 @@
   IDBTransaction* transaction = AsyncConnectionHelper::GetCurrentTransaction();
 
   if (!transaction ||
+      transaction->Database() != this ||
       transaction->GetMode() != IDBTransaction::VERSION_CHANGE) {
     aRv.Throw(NS_ERROR_DOM_INDEXEDDB_NOT_ALLOWED_ERR);
     return nullptr;
@@ -577,6 +578,7 @@
   IDBTransaction* transaction = AsyncConnectionHelper::GetCurrentTransaction();
 
   if (!transaction ||
+      transaction->Database() != this ||
       transaction->GetMode() != IDBTransaction::VERSION_CHANGE) {
     aRv.Throw(NS_ERROR_DOM_INDEXEDDB_NOT_ALLOWED_ERR);
     return;
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/dom/indexedDB/test/browser_quotaPrompt.html thunderbird-1000~31.6.0+build1/mozilla/dom/indexedDB/test/browser_quotaPrompt.html
--- thunderbird-1000~31.4.0+build1/mozilla/dom/indexedDB/test/browser_quotaPrompt.html	2015-01-12 17:51:23.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/dom/indexedDB/test/browser_quotaPrompt.html	2015-03-30 18:03:45.000000000 +0000
@@ -38,6 +38,7 @@
         let request = indexedDB.open(window.location.pathname, version++);
         request.onerror = errorHandler;
         request.onupgradeneeded = function(event) {
+          let db = event.target.result;
           db.deleteObjectStore("foo");
           db.onversionchange = function () { db.close(); };
           request.transaction.oncomplete = function(event) {
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/dom/plugins/base/nsPluginHost.cpp thunderbird-1000~31.6.0+build1/mozilla/dom/plugins/base/nsPluginHost.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/dom/plugins/base/nsPluginHost.cpp	2015-01-12 17:51:24.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/dom/plugins/base/nsPluginHost.cpp	2015-03-30 18:03:45.000000000 +0000
@@ -791,23 +791,27 @@
   nsPluginTagType tagType;
   rv = instanceOwner->GetTagType(&tagType);
   if (NS_FAILED(rv)) {
+    instanceOwner->Destroy();
     return rv;
   }
 
   if (tagType != nsPluginTagType_Embed &&
       tagType != nsPluginTagType_Applet &&
       tagType != nsPluginTagType_Object) {
+    instanceOwner->Destroy();
     return NS_ERROR_FAILURE;
   }
 
   rv = SetUpPluginInstance(aMimeType, aURL, instanceOwner);
   if (NS_FAILED(rv)) {
+    instanceOwner->Destroy();
     return NS_ERROR_FAILURE;
   }
 
   nsRefPtr<nsNPAPIPluginInstance> instance;
   rv = instanceOwner->GetInstance(getter_AddRefs(instance));
   if (NS_FAILED(rv)) {
+    instanceOwner->Destroy();
     return rv;
   }
 
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/dom/webidl/HTMLMediaElement.webidl thunderbird-1000~31.6.0+build1/mozilla/dom/webidl/HTMLMediaElement.webidl
--- thunderbird-1000~31.4.0+build1/mozilla/dom/webidl/HTMLMediaElement.webidl	2015-01-12 17:51:25.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/dom/webidl/HTMLMediaElement.webidl	2015-03-30 18:03:47.000000000 +0000
@@ -89,7 +89,7 @@
   //readonly attribute AudioTrackList audioTracks;
   //readonly attribute VideoTrackList videoTracks;
   [Pref="media.webvtt.enabled"]
-  readonly attribute TextTrackList textTracks;
+  readonly attribute TextTrackList? textTracks;
   [Pref="media.webvtt.enabled"]
   TextTrack addTextTrack(TextTrackKind kind,
                          optional DOMString label = "",
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp thunderbird-1000~31.6.0+build1/mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp	2015-01-12 17:51:25.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp	2015-03-30 18:03:47.000000000 +0000
@@ -43,6 +43,7 @@
 #include "nsIXPConnect.h"
 #include "nsIXULRuntime.h"
 #include "nsPIDOMWindow.h"
+#include "nsGlobalWindow.h"
 #include "nsIMarkupDocumentViewer.h"
 #include "nsIContentViewer.h"
 #include "nsIWindowProvider.h"
@@ -1345,9 +1346,14 @@
      in nsGlobalWindow.cpp.) */
   JSContext *cx = nsContentUtils::GetCurrentJSContext();
   if (cx) {
-    nsIScriptContext *scriptcx = nsJSUtils::GetDynamicScriptContext(cx);
-    if (scriptcx) {
-      baseWindow = do_QueryInterface(scriptcx->GetGlobalObject());
+    baseWindow = do_QueryInterface(nsJSUtils::GetDynamicScriptGlobal(cx));
+    if (baseWindow) {
+      nsIPrincipal* entryPrin =
+        static_cast<nsGlobalWindow*>(baseWindow.get())->GetPrincipal();
+      nsIPrincipal* subjectPrin = nsContentUtils::GetSubjectPrincipal();
+      if (!subjectPrin->SubsumesConsideringDomain(entryPrin)) {
+        baseWindow = nullptr;
+      }
     }
   }
 
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/extensions/spellcheck/hunspell/src/hashmgr.cpp thunderbird-1000~31.6.0+build1/mozilla/extensions/spellcheck/hunspell/src/hashmgr.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/extensions/spellcheck/hunspell/src/hashmgr.cpp	2015-01-12 17:51:25.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/extensions/spellcheck/hunspell/src/hashmgr.cpp	2015-03-30 18:03:47.000000000 +0000
@@ -64,6 +64,20 @@
 #include "csutil.hxx"
 #include "atypes.hxx"
 
+// The gcc used to build 32-bit builds of Firefox on Ubuntu
+// miscompiles flag_qsort, using a 32-bit read instead of a 16-bit
+// read while quicksorting an array of 16-bit units.  This causes
+// one of the top Firefox crashes.
+// Given that I haven't been able to produce a reduced testcase to give
+// to gcc developers, just work around the bug by allocating an extra 2
+// bytes on the heap arrays passed to flag_qsort().
+// See https://bugzilla.mozilla.org/show_bug.cgi?id=983817 .
+#if defined(__linux__) && defined(__i386__) && defined(__GNUC__)
+#define EXTRA_QSORT_ALLOC_SIZE 1
+#else
+#define EXTRA_QSORT_ALLOC_SIZE 0
+#endif
+
 // build a hash table from a munched word list
 
 HashMgr::HashMgr(const char * tpath, const char * apath, const char * key)
@@ -313,8 +327,8 @@
     struct hentry * dp = lookup(word);
     while (dp) {
         if (dp->alen == 0 || !TESTAFF(dp->astr, forbiddenword, dp->alen)) {
-            unsigned short * flags =
-                (unsigned short *) malloc(sizeof(short) * (dp->alen + 1));
+            unsigned short * flags = (unsigned short *)
+              malloc(sizeof(short) * (dp->alen + 1 + EXTRA_QSORT_ALLOC_SIZE));
             if (!flags) return 1;
             for (int i = 0; i < dp->alen; i++) flags[i] = dp->astr[i];
             flags[dp->alen] = forbiddenword;
@@ -554,7 +568,8 @@
         len = strlen(flags);
         if (len%2 == 1) HUNSPELL_WARNING(stderr, "error: line %d: bad flagvector\n", af->getlinenum());
         len /= 2;
-        *result = (unsigned short *) malloc(len * sizeof(short));
+        *result = (unsigned short *)
+          malloc((len + EXTRA_QSORT_ALLOC_SIZE) * sizeof(short));
         if (!*result) return -1;
         for (int i = 0; i < len; i++) {
             (*result)[i] = (((unsigned short) flags[i * 2]) << 8) + (unsigned short) flags[i * 2 + 1]; 
@@ -570,7 +585,8 @@
         for (p = flags; *p; p++) {
           if (*p == ',') len++;
         }
-        *result = (unsigned short *) malloc(len * sizeof(short));
+        *result = (unsigned short *)
+          malloc((len + EXTRA_QSORT_ALLOC_SIZE) * sizeof(short));
         if (!*result) return -1;
         dest = *result;
         for (p = flags; *p; p++) {
@@ -594,7 +610,8 @@
       case FLAG_UNI: { // UTF-8 characters
         w_char w[BUFSIZE/2];
         len = u8_u16(w, BUFSIZE/2, flags);
-        *result = (unsigned short *) malloc(len * sizeof(short));
+        *result =
+          (unsigned short *) malloc((len + EXTRA_QSORT_ALLOC_SIZE) * sizeof(short));
         if (!*result) return -1;
         memcpy(*result, w, len * sizeof(short));
         break;
@@ -602,7 +619,8 @@
       default: { // Ispell's one-character flags (erfg -> e r f g)
         unsigned short * dest;
         len = strlen(flags);
-        *result = (unsigned short *) malloc(len * sizeof(short));
+        *result = (unsigned short *)
+          malloc((len + EXTRA_QSORT_ALLOC_SIZE) * sizeof(short));
         if (!*result) return -1;
         dest = *result;
         for (unsigned char * p = (unsigned char *) flags; *p; p++) {
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/gfx/2d/FilterNodeSoftware.cpp thunderbird-1000~31.6.0+build1/mozilla/gfx/2d/FilterNodeSoftware.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/gfx/2d/FilterNodeSoftware.cpp	2015-01-12 17:51:16.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/gfx/2d/FilterNodeSoftware.cpp	2015-03-30 18:03:36.000000000 +0000
@@ -12,6 +12,7 @@
 #include "Blur.h"
 #include <map>
 #include "FilterProcessing.h"
+#include "Logging.h"
 #include "mozilla/PodOperations.h"
 #include "mozilla/DebugOnly.h"
 
@@ -253,9 +254,12 @@
     MOZ_CRASH("we should never be getting invalid rects at this point");
   }
 
-  MOZ_ASSERT(aSrc->GetFormat() == aDest->GetFormat(), "different surface formats");
-  MOZ_ASSERT(IntRect(IntPoint(), aSrc->GetSize()).Contains(aSrcRect), "source rect too big for source surface");
-  MOZ_ASSERT(IntRect(IntPoint(), aDest->GetSize()).Contains(aSrcRect - aSrcRect.TopLeft() + aDestPoint), "dest surface too small");
+  MOZ_RELEASE_ASSERT(aSrc->GetFormat() == aDest->GetFormat(),
+                     "different surface formats");
+  MOZ_RELEASE_ASSERT(IntRect(IntPoint(), aSrc->GetSize()).Contains(aSrcRect),
+                     "source rect too big for source surface");
+  MOZ_RELEASE_ASSERT(IntRect(IntPoint(), aDest->GetSize()).Contains(IntRect(aDestPoint, aSrcRect.Size())),
+                     "dest surface too small");
 
   if (aSrcRect.IsEmpty()) {
     return;
@@ -1565,7 +1569,16 @@
           return nullptr;
         }
       }
-      MOZ_ASSERT(input->GetFormat() == target->GetFormat(), "different surface formats from the same input?");
+
+      if (input->GetFormat() != target->GetFormat()) {
+        // Different rectangles of the input can have different formats. If
+        // that happens, just convert everything to B8G8R8A8.
+        target = FilterProcessing::ConvertToB8G8R8A8(target);
+        input = FilterProcessing::ConvertToB8G8R8A8(input);
+        if (MOZ2D_WARN_IF(!target) || MOZ2D_WARN_IF(!input)) {
+          return nullptr;
+        }
+      }
 
       CopyRect(input, target, srcRect - srcRect.TopLeft(), destRect.TopLeft() - aRect.TopLeft());
     }
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/gfx/2d/Logging.h thunderbird-1000~31.6.0+build1/mozilla/gfx/2d/Logging.h
--- thunderbird-1000~31.4.0+build1/mozilla/gfx/2d/Logging.h	2015-01-12 17:51:16.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/gfx/2d/Logging.h	2015-03-30 18:03:36.000000000 +0000
@@ -155,6 +155,25 @@
 #define gfxWarning if (1) ; else NoLog
 #endif
 
+// See nsDebug.h and the NS_WARN_IF macro
+
+#ifdef __cplusplus
+#ifdef DEBUG
+inline bool MOZ2D_warn_if_impl(bool aCondition, const char* aExpr,
+                               const char* aFile, int32_t aLine)
+{
+  if (MOZ_UNLIKELY(aCondition)) {
+    gfxWarning() << aExpr << " at " << aFile << ":" << aLine;
+  }
+  return aCondition;
+}
+#define MOZ2D_WARN_IF(condition) \
+  MOZ2D_warn_if_impl(condition, #condition, __FILE__, __LINE__)
+#else
+#define MOZ2D_WARN_IF(condition) (bool)(condition)
+#endif
+#endif
+
 const int INDENT_PER_LEVEL = 2;
 
 class TreeLog
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/gfx/layers/ipc/CompositorParent.cpp thunderbird-1000~31.6.0+build1/mozilla/gfx/layers/ipc/CompositorParent.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/gfx/layers/ipc/CompositorParent.cpp	2015-01-12 17:51:17.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/gfx/layers/ipc/CompositorParent.cpp	2015-03-30 18:03:37.000000000 +0000
@@ -22,6 +22,7 @@
 #include "gfxPrefs.h"                   // for gfxPrefs
 #include "ipc/ShadowLayersManager.h"    // for ShadowLayersManager
 #include "mozilla/AutoRestore.h"        // for AutoRestore
+#include "mozilla/ClearOnShutdown.h"    // for ClearOnShutdown
 #include "mozilla/DebugOnly.h"          // for DebugOnly
 #include "mozilla/gfx/2D.h"          // for DrawTarget
 #include "mozilla/gfx/Point.h"          // for IntSize
@@ -70,6 +71,16 @@
 
 typedef map<uint64_t, CompositorParent::LayerTreeState> LayerTreeMap;
 static LayerTreeMap sIndirectLayerTrees;
+static StaticAutoPtr<mozilla::Monitor> sIndirectLayerTreesLock;
+
+static void EnsureLayerTreeMapReady()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  if (!sIndirectLayerTreesLock) {
+    sIndirectLayerTreesLock = new Monitor("IndirectLayerTree");
+    mozilla::ClearOnShutdown(&sIndirectLayerTreesLock);
+  }
+}
 
 // FIXME/bug 774386: we're assuming that there's only one
 // CompositorParent, but that's not always true.  This assumption only
@@ -132,6 +143,7 @@
     return;
   }
   MOZ_ASSERT(!sCompositorLoop);
+  EnsureLayerTreeMapReady();
   CreateCompositorMap();
   CreateThread();
   sMainLoop = MessageLoop::current();
@@ -206,7 +218,11 @@
                                                           this, &mCompositorID));
 
   mRootLayerTreeID = AllocateLayerTreeId();
-  sIndirectLayerTrees[mRootLayerTreeID].mParent = this;
+
+  { // scope lock
+    MonitorAutoLock lock(*sIndirectLayerTreesLock);
+    sIndirectLayerTrees[mRootLayerTreeID].mParent = this;
+  }
 
   mApzcTreeManager = new APZCTreeManager();
   ++sCompositorThreadRefCount;
@@ -249,7 +265,10 @@
   mCompositionManager = nullptr;
   mApzcTreeManager->ClearTree();
   mApzcTreeManager = nullptr;
-  sIndirectLayerTrees.erase(mRootLayerTreeID);
+  { // scope lock
+    MonitorAutoLock lock(*sIndirectLayerTreesLock);
+    sIndirectLayerTrees.erase(mRootLayerTreeID);
+  }
 }
 
 void
@@ -266,6 +285,7 @@
 
   // Ensure that the layer manager is destroyed before CompositorChild.
   if (mLayerManager) {
+    MonitorAutoLock lock(*sIndirectLayerTreesLock);
     for (LayerTreeMap::iterator it = sIndirectLayerTrees.begin();
          it != sIndirectLayerTrees.end(); it++)
     {
@@ -380,7 +400,10 @@
   if (mLayerManager) {
     mLayerManager->Destroy();
     mLayerManager = nullptr;
-    sIndirectLayerTrees[mRootLayerTreeID].mLayerManager = nullptr;
+    { // scope lock
+      MonitorAutoLock lock(*sIndirectLayerTreesLock);
+      sIndirectLayerTrees[mRootLayerTreeID].mLayerManager = nullptr;
+    }
     mCompositionManager = nullptr;
     mCompositor = nullptr;
   }
@@ -696,6 +719,7 @@
 {
   unused << SendDidComposite(0);
 
+  MonitorAutoLock lock(*sIndirectLayerTreesLock);
   for (LayerTreeMap::iterator it = sIndirectLayerTrees.begin();
        it != sIndirectLayerTrees.end(); it++) {
     LayerTreeState* lts = &it->second;
@@ -867,6 +891,7 @@
       mLayerManager = layerManager;
       MOZ_ASSERT(compositor);
       mCompositor = compositor;
+      MonitorAutoLock lock(*sIndirectLayerTreesLock);
       sIndirectLayerTrees[mRootLayerTreeID].mLayerManager = layerManager;
       return;
     }
@@ -962,6 +987,7 @@
 bool
 CompositorParent::RecvNotifyChildCreated(const uint64_t& child)
 {
+  MonitorAutoLock lock(*sIndirectLayerTreesLock);
   NotifyChildCreated(child);
   return true;
 }
@@ -969,6 +995,7 @@
 void
 CompositorParent::NotifyChildCreated(uint64_t aChild)
 {
+  sIndirectLayerTreesLock->AssertCurrentThreadOwns();
   sIndirectLayerTrees[aChild].mParent = this;
   sIndirectLayerTrees[aChild].mLayerManager = mLayerManager;
 }
@@ -985,6 +1012,7 @@
 static void
 EraseLayerState(uint64_t aId)
 {
+  MonitorAutoLock lock(*sIndirectLayerTreesLock);
   sIndirectLayerTrees.erase(aId);
 }
 
@@ -1001,6 +1029,7 @@
                             GeckoContentController* aController)
 {
   // Adopt ref given to us by SetControllerForLayerTree()
+  MonitorAutoLock lock(*sIndirectLayerTreesLock);
   sIndirectLayerTrees[aLayersId].mController =
     already_AddRefed<GeckoContentController>(aController);
 }
@@ -1010,12 +1039,15 @@
                                                          GeckoContentController* aController)
     : mLayersId(aLayersId)
 {
+  EnsureLayerTreeMapReady();
+  MonitorAutoLock lock(*sIndirectLayerTreesLock);
   sIndirectLayerTrees[aLayersId].mRoot = aRoot;
   sIndirectLayerTrees[aLayersId].mController = aController;
 }
 
 ScopedLayerTreeRegistration::~ScopedLayerTreeRegistration()
 {
+  MonitorAutoLock lock(*sIndirectLayerTreesLock);
   sIndirectLayerTrees.erase(mLayersId);
 }
 
@@ -1175,6 +1207,7 @@
 static void
 UpdateIndirectTree(uint64_t aId, Layer* aRoot, const TargetConfig& aTargetConfig)
 {
+  MonitorAutoLock lock(*sIndirectLayerTreesLock);
   sIndirectLayerTrees[aId].mRoot = aRoot;
   sIndirectLayerTrees[aId].mTargetConfig = aTargetConfig;
 }
@@ -1182,6 +1215,7 @@
 /* static */ const CompositorParent::LayerTreeState*
 CompositorParent::GetIndirectShadowTree(uint64_t aId)
 {
+  MonitorAutoLock lock(*sIndirectLayerTreesLock);
   LayerTreeMap::const_iterator cit = sIndirectLayerTrees.find(aId);
   if (sIndirectLayerTrees.end() == cit) {
     return nullptr;
@@ -1189,12 +1223,6 @@
   return &cit->second;
 }
 
-static void
-RemoveIndirectTree(uint64_t aId)
-{
-  sIndirectLayerTrees.erase(aId);
-}
-
 void
 CrossProcessCompositorParent::ActorDestroy(ActorDestroyReason aWhy)
 {
@@ -1211,6 +1239,8 @@
 {
   MOZ_ASSERT(aId != 0);
 
+  MonitorAutoLock lock(*sIndirectLayerTreesLock);
+
   if (sIndirectLayerTrees[aId].mLayerManager) {
     sIndirectLayerTrees[aId].mCrossProcessParent = this;
     LayerManagerComposite* lm = sIndirectLayerTrees[aId].mLayerManager;
@@ -1234,7 +1264,7 @@
 CrossProcessCompositorParent::DeallocPLayerTransactionParent(PLayerTransactionParent* aLayers)
 {
   LayerTransactionParent* slp = static_cast<LayerTransactionParent*>(aLayers);
-  RemoveIndirectTree(slp->GetId());
+  EraseLayerState(slp->GetId());
   static_cast<LayerTransactionParent*>(aLayers)->ReleaseIPDLReference();
   return true;
 }
@@ -1242,6 +1272,7 @@
 bool
 CrossProcessCompositorParent::RecvNotifyChildCreated(const uint64_t& child)
 {
+  MonitorAutoLock lock(*sIndirectLayerTreesLock);
   sIndirectLayerTrees[child].mParent->NotifyChildCreated(child);
   return true;
 }
@@ -1255,13 +1286,19 @@
 {
   uint64_t id = aLayerTree->GetId();
   MOZ_ASSERT(id != 0);
+  const CompositorParent::LayerTreeState* state = CompositorParent::GetIndirectShadowTree(id);
+  if (!state) {
+    return;
+  }
+  MOZ_ASSERT(state->mParent);
+
   Layer* shadowRoot = aLayerTree->GetRoot();
   if (shadowRoot) {
     SetShadowProperties(shadowRoot);
   }
   UpdateIndirectTree(id, shadowRoot, aTargetConfig);
 
-  sIndirectLayerTrees[id].mParent->NotifyShadowTreeTransaction(id, aIsFirstPaint, aScheduleComposite);
+  state->mParent->NotifyShadowTreeTransaction(id, aIsFirstPaint, aScheduleComposite);
 }
 
 void
@@ -1269,7 +1306,12 @@
 {
   uint64_t id = aLayerTree->GetId();
   MOZ_ASSERT(id != 0);
-  sIndirectLayerTrees[id].mParent->ForceComposite(aLayerTree);
+  CompositorParent* parent;
+  { // scope lock
+    MonitorAutoLock lock(*sIndirectLayerTreesLock);
+    parent = sIndirectLayerTrees[id].mParent;
+  }
+  parent->ForceComposite(aLayerTree);
 }
 
 bool
@@ -1293,7 +1335,12 @@
 CrossProcessCompositorParent::GetCompositionManager(LayerTransactionParent* aLayerTree)
 {
   uint64_t id = aLayerTree->GetId();
-  return sIndirectLayerTrees[id].mParent->GetCompositionManager(aLayerTree);
+  const CompositorParent::LayerTreeState* state = CompositorParent::GetIndirectShadowTree(id);
+  if (!state) {
+    return nullptr;
+  }
+  MOZ_ASSERT(state->mParent);
+  return state->mParent->GetCompositionManager(aLayerTree);
 }
 
 void
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/gfx/thebes/gfxPrefs.h thunderbird-1000~31.6.0+build1/mozilla/gfx/thebes/gfxPrefs.h
--- thunderbird-1000~31.4.0+build1/mozilla/gfx/thebes/gfxPrefs.h	2015-01-12 17:51:18.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/gfx/thebes/gfxPrefs.h	2015-03-30 18:03:38.000000000 +0000
@@ -160,6 +160,7 @@
 #else
   DECL_GFX_PREF(Once, "layers.async-video.enabled",            AsyncVideoEnabled, bool, false);
 #endif
+  DECL_GFX_PREF(Once, "layers.async-pan-zoom.enabled",         AsyncPanZoomEnabled, bool, false);
   DECL_GFX_PREF(Once, "layers.bufferrotation.enabled",         BufferRotationEnabled, bool, true);
 #ifdef MOZ_GFX_OPTIMIZE_MOBILE
   // If MOZ_GFX_OPTIMIZE_MOBILE is defined, we force component alpha off
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/image/decoders/nsPNGDecoder.cpp thunderbird-1000~31.6.0+build1/mozilla/image/decoders/nsPNGDecoder.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/image/decoders/nsPNGDecoder.cpp	2015-01-12 17:51:18.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/image/decoders/nsPNGDecoder.cpp	2015-03-30 18:03:38.000000000 +0000
@@ -528,24 +528,26 @@
     png_set_expand(png_ptr);
 
   if (png_get_valid(png_ptr, info_ptr, PNG_INFO_tRNS)) {
-    int sample_max = (1 << bit_depth);
     png_color_16p trans_values;
     png_get_tRNS(png_ptr, info_ptr, &trans, &num_trans, &trans_values);
     /* libpng doesn't reject a tRNS chunk with out-of-range samples
        so we check it here to avoid setting up a useless opacity
-       channel or producing unexpected transparent pixels when using
-       libpng-1.2.19 through 1.2.26 (bug #428045) */
-    if ((color_type == PNG_COLOR_TYPE_GRAY &&
-       (int)trans_values->gray > sample_max) ||
-       (color_type == PNG_COLOR_TYPE_RGB &&
-       ((int)trans_values->red > sample_max ||
-       (int)trans_values->green > sample_max ||
-       (int)trans_values->blue > sample_max)))
+       channel or producing unexpected transparent pixels (bug #428045) */
+    if (bit_depth < 16) {
+      png_uint_16 sample_max = (1 << bit_depth) - 1;
+      if ((color_type == PNG_COLOR_TYPE_GRAY &&
+           trans_values->gray > sample_max) ||
+           (color_type == PNG_COLOR_TYPE_RGB &&
+           (trans_values->red > sample_max ||
+           trans_values->green > sample_max ||
+           trans_values->blue > sample_max)))
       {
         /* clear the tRNS valid flag and release tRNS memory */
         png_free_data(png_ptr, info_ptr, PNG_FREE_TRNS, 0);
+        num_trans = 0;
       }
-    else
+    }
+    if (num_trans != 0)
       png_set_expand(png_ptr);
   }
 
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/image/test/reftest/generic/reftest.list thunderbird-1000~31.6.0+build1/mozilla/image/test/reftest/generic/reftest.list
--- thunderbird-1000~31.4.0+build1/mozilla/image/test/reftest/generic/reftest.list	2015-01-12 17:51:18.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/image/test/reftest/generic/reftest.list	2015-03-30 18:03:38.000000000 +0000
@@ -1 +1 @@
-fails-if(Android&&(AndroidVersion==10||AndroidVersion==17)) HTTP == accept-image-catchall.html accept-image-catchall-ref.html
+HTTP == accept-image-catchall.html accept-image-catchall-ref.html
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/js/public/Class.h thunderbird-1000~31.6.0+build1/mozilla/js/public/Class.h
--- thunderbird-1000~31.4.0+build1/mozilla/js/public/Class.h	2015-01-12 17:51:21.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/js/public/Class.h	2015-03-30 18:03:41.000000000 +0000
@@ -521,7 +521,10 @@
  */
 enum ESClassValue {
     ESClass_Array, ESClass_Number, ESClass_String, ESClass_Boolean,
-    ESClass_RegExp, ESClass_ArrayBuffer, ESClass_Date
+    ESClass_RegExp, ESClass_ArrayBuffer, ESClass_Date,
+    // Special snowflake for the ES6 IsArray method.
+    // Please don't use it without calling that function.
+    ESClass_IsArray
 };
 
 /*
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/js/src/ds/LifoAlloc.h thunderbird-1000~31.6.0+build1/mozilla/js/src/ds/LifoAlloc.h
--- thunderbird-1000~31.4.0+build1/mozilla/js/src/ds/LifoAlloc.h	2015-01-12 17:51:21.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/js/src/ds/LifoAlloc.h	2015-03-30 18:03:42.000000000 +0000
@@ -193,14 +193,14 @@
 
     // Append used chunks to the end of this LifoAlloc. We act as if all the
     // chunks in |this| are used, even if they're not, so memory may be wasted.
-    void appendUsed(BumpChunk *start, BumpChunk *latest, BumpChunk *end) {
-        JS_ASSERT(start && latest &&  end);
+    void appendUsed(BumpChunk *otherFirst, BumpChunk *otherLatest, BumpChunk *otherLast) {
+        JS_ASSERT(otherFirst && otherLatest && otherLast);
         if (last)
-            last->setNext(start);
+            last->setNext(otherFirst);
         else
-            first = latest = start;
-        last = end;
-        this->latest = latest;
+            first = otherFirst;
+        latest = otherLatest;
+        last = otherLast;
     }
 
     void incrementCurSize(size_t size) {
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/js/src/gc/Zone.h thunderbird-1000~31.6.0+build1/mozilla/js/src/gc/Zone.h
--- thunderbird-1000~31.4.0+build1/mozilla/js/src/gc/Zone.h	2015-01-12 17:51:21.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/js/src/gc/Zone.h	2015-03-30 18:03:42.000000000 +0000
@@ -389,21 +389,22 @@
     // This is for the benefit of CompartmentsIterT::comp.
     friend class mozilla::Maybe<CompartmentsInZoneIter>;
   private:
-    JSCompartment **it, **end;
+    JS::Zone *zone;
+    JSCompartment **it;
 
     CompartmentsInZoneIter()
-      : it(nullptr), end(nullptr)
+      : zone(nullptr), it(nullptr)
     {}
 
   public:
-    explicit CompartmentsInZoneIter(JS::Zone *zone) {
+    explicit CompartmentsInZoneIter(JS::Zone *zone) : zone(zone) {
         it = zone->compartments.begin();
-        end = zone->compartments.end();
     }
 
     bool done() const {
         JS_ASSERT(it);
-        return it == end;
+        return it < zone->compartments.begin() ||
+               it >= zone->compartments.end();
     }
     void next() {
         JS_ASSERT(!done());
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/js/src/jit/AsmJS.cpp thunderbird-1000~31.6.0+build1/mozilla/js/src/jit/AsmJS.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/js/src/jit/AsmJS.cpp	2015-01-12 17:51:22.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/js/src/jit/AsmJS.cpp	2015-03-30 18:03:43.000000000 +0000
@@ -14,6 +14,7 @@
 
 #include "jsmath.h"
 #include "jsprf.h"
+#include "jsutil.h"
 #include "jsworkers.h"
 #include "prmjtime.h"
 
@@ -3432,9 +3433,17 @@
     if (IsLiteralOrConstInt(f, maskNode, &mask2)) {
         // Flag the access to skip the bounds check if the mask ensures that an 'out of
         // bounds' access can not occur based on the current heap length constraint.
-        if (mask2 == 0 ||
-            CountLeadingZeroes32(f.m().minHeapLength() - 1) <= CountLeadingZeroes32(mask2)) {
+        if (mask2 == 0) {
             *needsBoundsCheck = NO_BOUNDS_CHECK;
+        } else {
+            uint32_t minHeap = f.m().minHeapLength();
+            uint32_t minHeapZeroes = CountLeadingZeroes32(minHeap - 1);
+            uint32_t maskZeroes = CountLeadingZeroes32(mask2);
+            if ((minHeapZeroes < maskZeroes) ||
+                (IsPowerOfTwo(minHeap) && minHeapZeroes == maskZeroes))
+            {
+                *needsBoundsCheck = NO_BOUNDS_CHECK;
+            }
         }
         *mask &= mask2;
         *indexExpr = indexNode;
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/js/src/jit/CodeGenerator.cpp thunderbird-1000~31.6.0+build1/mozilla/js/src/jit/CodeGenerator.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/js/src/jit/CodeGenerator.cpp	2015-01-12 17:51:32.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/js/src/jit/CodeGenerator.cpp	2015-03-30 18:03:43.000000000 +0000
@@ -1077,6 +1077,12 @@
 }
 
 bool
+CodeGenerator::visitMop(LMop *lir)
+{
+    return true;
+}
+
+bool
 CodeGenerator::visitOsiPoint(LOsiPoint *lir)
 {
     // Note: markOsiPoint ensures enough space exists between the last
@@ -2442,27 +2448,19 @@
 
     masm.checkStackAlignment();
 
-    // If the function is known to be uncompilable, only emit the call to InvokeFunction.
+    // If the function is native, only emit the call to InvokeFunction.
     ExecutionMode executionMode = gen->info().executionMode();
-    if (apply->hasSingleTarget()) {
-        JSFunction *target = apply->getSingleTarget();
-        if (target->isNative()) {
-            if (!emitCallInvokeFunction(apply, copyreg))
-                return false;
-            emitPopArguments(apply, copyreg);
-            return true;
-        }
+    if (apply->hasSingleTarget() && apply->getSingleTarget()->isNative()) {
+        if (!emitCallInvokeFunction(apply, copyreg))
+            return false;
+        emitPopArguments(apply, copyreg);
+        return true;
     }
 
     Label end, invoke;
 
-    // Guard that calleereg is an interpreted function with a JSScript:
-    if (!apply->hasSingleTarget()) {
-        masm.branchIfFunctionHasNoScript(calleereg, &invoke);
-    } else {
-        // Native single targets are handled by LCallNative.
-        JS_ASSERT(!apply->getSingleTarget()->isNative());
-    }
+    // Guard that calleereg is an interpreted function with a JSScript.
+    masm.branchIfFunctionHasNoScript(calleereg, &invoke);
 
     // Knowing that calleereg is a non-native function, load the JSScript.
     masm.loadPtr(Address(calleereg, JSFunction::offsetOfNativeOrScript()), objreg);
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/js/src/jit/CodeGenerator.h thunderbird-1000~31.6.0+build1/mozilla/js/src/jit/CodeGenerator.h
--- thunderbird-1000~31.4.0+build1/mozilla/js/src/jit/CodeGenerator.h	2015-01-12 17:51:32.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/js/src/jit/CodeGenerator.h	2015-03-30 18:03:43.000000000 +0000
@@ -58,6 +58,7 @@
 
     bool visitLabel(LLabel *lir);
     bool visitNop(LNop *lir);
+    bool visitMop(LMop *lir);
     bool visitOsiPoint(LOsiPoint *lir);
     bool visitGoto(LGoto *lir);
     bool visitTableSwitch(LTableSwitch *ins);
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/js/src/jit/LIR-Common.h thunderbird-1000~31.6.0+build1/mozilla/js/src/jit/LIR-Common.h
--- thunderbird-1000~31.4.0+build1/mozilla/js/src/jit/LIR-Common.h	2015-01-12 17:51:32.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/js/src/jit/LIR-Common.h	2015-03-30 18:03:43.000000000 +0000
@@ -42,6 +42,12 @@
     LIR_HEADER(Nop)
 };
 
+class LMop : public LInstructionHelper<0, 0, 0>
+{
+  public:
+    LIR_HEADER(Mop)
+};
+
 // An LOsiPoint captures a snapshot after a call and ensures enough space to
 // patch in a call to the invalidation mechanism.
 //
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/js/src/jit/LOpcodes.h thunderbird-1000~31.6.0+build1/mozilla/js/src/jit/LOpcodes.h
--- thunderbird-1000~31.4.0+build1/mozilla/js/src/jit/LOpcodes.h	2015-01-12 17:51:32.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/js/src/jit/LOpcodes.h	2015-03-30 18:03:43.000000000 +0000
@@ -10,6 +10,7 @@
 #define LIR_COMMON_OPCODE_LIST(_)   \
     _(Label)                        \
     _(Nop)                          \
+    _(Mop)                          \
     _(OsiPoint)                     \
     _(MoveGroup)                    \
     _(Integer)                      \
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/js/src/jit/Lowering.cpp thunderbird-1000~31.6.0+build1/mozilla/js/src/jit/Lowering.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/js/src/jit/Lowering.cpp	2015-01-12 17:51:32.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/js/src/jit/Lowering.cpp	2015-03-30 18:03:43.000000000 +0000
@@ -3616,12 +3616,24 @@
     ins->setInWorklistUnchecked();
 #endif
 
+    // If we added a Nop for this instruction, we'll also add a Mop, so that
+    // that live-ranges for fixed register defs, which with LSRA extend through
+    // the Nop so that they can extend through the OsiPoint don't, with their
+    // one-extra extension, extend into a position where they use the input
+    // move group for the following instruction.
+    bool needsMop = !current->instructions().empty() && current->rbegin()->isNop();
+
     // If no safepoint was created, there's no need for an OSI point.
     if (LOsiPoint *osiPoint = popOsiPoint()) {
         if (!add(osiPoint))
             return false;
     }
 
+    if (needsMop) {
+        if (!add(new(alloc()) LMop))
+            return false;
+    }
+
     return true;
 }
 
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/js/src/jit-test/tests/generators/star-generator-forin.js thunderbird-1000~31.6.0+build1/mozilla/js/src/jit-test/tests/generators/star-generator-forin.js
--- thunderbird-1000~31.4.0+build1/mozilla/js/src/jit-test/tests/generators/star-generator-forin.js	1970-01-01 00:00:00.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/js/src/jit-test/tests/generators/star-generator-forin.js	2015-03-30 18:03:43.000000000 +0000
@@ -0,0 +1,48 @@
+load(libdir + "eqArrayHelper.js");
+
+var iter;
+var hit;
+
+hit = 0;
+iter = function*(){ hit++; };
+assertEqArray([x for (x in iter)],
+              []);
+assertEqArray([x for each (x in iter)],
+              []);
+assertEq(hit, 0);
+
+hit = 0;
+iter = function*(){ hit++; };
+iter["foo"] = "bar";
+assertEqArray([x for (x in iter)],
+              ["foo"]);
+assertEqArray([x for each (x in iter)],
+              ["bar"]);
+assertEq(hit, 0);
+
+hit = 0;
+iter = function*(){ hit++; }();
+assertEqArray([x for (x in iter)],
+              []);
+assertEqArray([x for each (x in iter)],
+              []);
+assertEq(hit, 0);
+
+hit = 0;
+iter = function*(){ hit++; }();
+iter["foo"] = "bar";
+assertEqArray([x for (x in iter)],
+              ["foo"]);
+assertEqArray([x for each (x in iter)],
+              ["bar"]);
+assertEq(hit, 0);
+
+hit = 0;
+iter = function*(){ hit++; }();
+iter["foo"] = 10;
+iter["bar"] = 20;
+assertEqArray([x for (x in iter)].sort(),
+              ["bar", "foo"]);
+assertEqArray([x for each (x in iter)].sort(),
+              [10, 20]);
+assertEq(hit, 0);
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/js/src/jsapi.h thunderbird-1000~31.6.0+build1/mozilla/js/src/jsapi.h
--- thunderbird-1000~31.4.0+build1/mozilla/js/src/jsapi.h	2015-01-12 17:51:22.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/js/src/jsapi.h	2015-03-30 18:03:44.000000000 +0000
@@ -1780,9 +1780,10 @@
 typedef void (*JSIterateCompartmentCallback)(JSRuntime *rt, void *data, JSCompartment *compartment);
 
 /*
- * This function calls |compartmentCallback| on every compartment.  Beware that
+ * This function calls |compartmentCallback| on every compartment. Beware that
  * there is no guarantee that the compartment will survive after the callback
- * returns.
+ * returns. Also, if the callback can GC, there is no guarantee that every
+ * compartment will be visited.
  */
 extern JS_PUBLIC_API(void)
 JS_IterateCompartments(JSRuntime *rt, void *data,
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/js/src/jsarray.cpp thunderbird-1000~31.6.0+build1/mozilla/js/src/jsarray.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/js/src/jsarray.cpp	2015-01-12 17:51:22.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/js/src/jsarray.cpp	2015-03-30 18:03:44.000000000 +0000
@@ -2645,7 +2645,8 @@
         HandleValue v = HandleValue::fromMarkedLocation(&p[i]);
         if (v.isObject()) {
             RootedObject obj(cx, &v.toObject());
-            if (ObjectClassIs(obj, ESClass_Array, cx)) {
+            // This should be IsConcatSpreadable
+            if (IsArray(obj, cx)) {
                 uint32_t alength;
                 if (!GetLengthProperty(cx, obj, &alength))
                     return false;
@@ -2870,7 +2871,11 @@
 array_isArray(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
-    bool isArray = args.length() > 0 && IsObjectWithClass(args[0], ESClass_Array, cx);
+    bool isArray = false;
+    if (args.get(0).isObject()) {
+        RootedObject obj(cx, &args[0].toObject());
+        isArray = IsArray(obj, cx);
+    }
     args.rval().setBoolean(isArray);
     return true;
 }
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/js/src/jsbool.cpp thunderbird-1000~31.6.0+build1/mozilla/js/src/jsbool.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/js/src/jsbool.cpp	2015-01-12 17:51:22.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/js/src/jsbool.cpp	2015-03-30 18:03:44.000000000 +0000
@@ -198,7 +198,8 @@
 bool
 js::BooleanGetPrimitiveValueSlow(HandleObject wrappedBool)
 {
-    JSObject *obj = wrappedBool->as<ProxyObject>().target();
-    JS_ASSERT(obj);
+    JSObject *obj = CheckedUnwrap(wrappedBool);
+    if (!obj || !obj->is<BooleanObject>())
+        return false;
     return obj->as<BooleanObject>().unbox();
 }
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/js/src/jsinfer.cpp thunderbird-1000~31.6.0+build1/mozilla/js/src/jsinfer.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/js/src/jsinfer.cpp	2015-01-12 17:51:22.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/js/src/jsinfer.cpp	2015-03-30 18:03:44.000000000 +0000
@@ -2035,6 +2035,7 @@
         allocationSiteTable = cx->new_<AllocationSiteTable>();
         if (!allocationSiteTable || !allocationSiteTable->init()) {
             js_delete(allocationSiteTable);
+            allocationSiteTable = nullptr;
             return nullptr;
         }
     }
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/js/src/jsiter.cpp thunderbird-1000~31.6.0+build1/mozilla/js/src/jsiter.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/js/src/jsiter.cpp	2015-01-12 17:51:22.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/js/src/jsiter.cpp	2015-03-30 18:03:44.000000000 +0000
@@ -1629,12 +1629,6 @@
     nullptr,                 /* hasInstance */
     nullptr,                 /* construct   */
     TraceGenerator<StarGeneratorObject>,
-    JS_NULL_CLASS_SPEC,
-    {
-        nullptr,             /* outerObject    */
-        nullptr,             /* innerObject    */
-        iterator_iteratorObject,
-    }
 };
 
 /*
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/js/src/jsobj.cpp thunderbird-1000~31.6.0+build1/mozilla/js/src/jsobj.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/js/src/jsobj.cpp	2015-01-12 17:51:22.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/js/src/jsobj.cpp	2015-03-30 18:03:44.000000000 +0000
@@ -1845,12 +1845,8 @@
     if (!clone || !clone->ensureElements(cx, obj->getDenseCapacity()))
         return nullptr;
 
-    // Copy the number of initialized elements.
-    uint32_t initialized = obj->getDenseInitializedLength();
-    if (initialized)
-        clone->setDenseInitializedLength(initialized);
-
     // Recursive copy of dense element.
+    uint32_t initialized = obj->getDenseInitializedLength();
     for (uint32_t i = 0; i < initialized; ++i) {
         v = obj->getDenseElement(i);
         if (v.isObject()) {
@@ -1862,6 +1858,7 @@
             }
             v.setObject(*deepObj);
         }
+        clone->setDenseInitializedLength(i + 1);
         clone->initDenseElement(i, v);
     }
 
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/js/src/jsobjinlines.h thunderbird-1000~31.6.0+build1/mozilla/js/src/jsobjinlines.h
--- thunderbird-1000~31.4.0+build1/mozilla/js/src/jsobjinlines.h	2015-01-12 17:51:22.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/js/src/jsobjinlines.h	2015-03-30 18:03:44.000000000 +0000
@@ -1032,7 +1032,10 @@
         return Proxy::objectClassIs(obj, classValue, cx);
 
     switch (classValue) {
-      case ESClass_Array: return obj->is<ArrayObject>();
+      case ESClass_Array:
+      case ESClass_IsArray:
+        // There difference between those is only relevant for proxies.
+        return obj->is<ArrayObject>();
       case ESClass_Number: return obj->is<NumberObject>();
       case ESClass_String: return obj->is<StringObject>();
       case ESClass_Boolean: return obj->is<BooleanObject>();
@@ -1053,6 +1056,16 @@
     return ObjectClassIs(obj, classValue, cx);
 }
 
+// ES6 7.2.2
+inline bool
+IsArray(HandleObject obj, JSContext *cx)
+{
+    if (obj->is<ArrayObject>())
+        return true;
+
+    return ObjectClassIs(obj, ESClass_IsArray, cx);
+}
+
 static MOZ_ALWAYS_INLINE bool
 NewObjectMetadata(ExclusiveContext *cxArg, JSObject **pmetadata)
 {
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/js/src/json.cpp thunderbird-1000~31.6.0+build1/mozilla/js/src/json.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/js/src/json.cpp	2015-01-12 17:51:22.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/js/src/json.cpp	2015-03-30 18:03:44.000000000 +0000
@@ -300,7 +300,7 @@
     Maybe<AutoIdVector> ids;
     const AutoIdVector *props;
     if (scx->replacer && !scx->replacer->isCallable()) {
-        JS_ASSERT(JS_IsArrayObject(cx, scx->replacer));
+        JS_ASSERT(IsArray(scx->replacer, cx));
         props = &scx->propertyList;
     } else {
         JS_ASSERT_IF(scx->replacer, scx->propertyList.length() == 0);
@@ -488,7 +488,7 @@
 
     scx->depth++;
     bool ok;
-    if (ObjectClassIs(obj, ESClass_Array, cx))
+    if (IsArray(obj, cx))
         ok = JA(cx, obj, scx);
     else
         ok = JO(cx, obj, scx);
@@ -510,7 +510,7 @@
     if (replacer) {
         if (replacer->isCallable()) {
             /* Step 4a(i): use replacer to transform values.  */
-        } else if (ObjectClassIs(replacer, ESClass_Array, cx)) {
+        } else if (IsArray(replacer, cx)) {
             /*
              * Step 4b: The spec algorithm is unhelpfully vague about the exact
              * steps taken when the replacer is an array, regarding the exact
@@ -541,7 +541,8 @@
 
             /* Step 4b(ii). */
             uint32_t len;
-            JS_ALWAYS_TRUE(GetLengthProperty(cx, replacer, &len));
+            if (!GetLengthProperty(cx, replacer, &len))
+                return false;
             if (replacer->is<ArrayObject>() && !replacer->isIndexed())
                 len = Min(len, replacer->getDenseInitializedLength());
 
@@ -678,7 +679,7 @@
     if (val.isObject()) {
         RootedObject obj(cx, &val.toObject());
 
-        if (ObjectClassIs(obj, ESClass_Array, cx)) {
+        if (IsArray(obj, cx)) {
             /* Step 2a(ii). */
             uint32_t length;
             if (!GetLengthProperty(cx, obj, &length))
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/js/src/jsproxy.cpp thunderbird-1000~31.6.0+build1/mozilla/js/src/jsproxy.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/js/src/jsproxy.cpp	2015-01-12 17:51:23.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/js/src/jsproxy.cpp	2015-03-30 18:03:44.000000000 +0000
@@ -1108,6 +1108,14 @@
     virtual bool isExtensible(JSContext *cx, HandleObject proxy, bool *extensible) MOZ_OVERRIDE;
 
     /* Spidermonkey extensions. */
+    // A scripted proxy should not be treated as generic in most contexts.
+    virtual bool nativeCall(JSContext *cx, IsAcceptableThis test, NativeImpl impl,
+                            CallArgs args) MOZ_OVERRIDE;
+    virtual bool objectClassIs(HandleObject obj, ESClassValue classValue,
+                               JSContext *cx) MOZ_OVERRIDE;
+    virtual bool regexp_toShared(JSContext *cx, HandleObject proxy,
+                                 RegExpGuard *g) MOZ_OVERRIDE;
+
     virtual bool call(JSContext *cx, HandleObject proxy, const CallArgs &args) MOZ_OVERRIDE;
     virtual bool construct(JSContext *cx, HandleObject proxy, const CallArgs &args) MOZ_OVERRIDE;
     virtual bool isScripted() MOZ_OVERRIDE { return true; }
@@ -2350,6 +2358,43 @@
     return true;
 }
 
+bool
+ScriptedDirectProxyHandler::nativeCall(JSContext *cx, IsAcceptableThis test, NativeImpl impl,
+                                       CallArgs args)
+{
+    ReportIncompatible(cx, args);
+    return false;
+}
+
+bool
+ScriptedDirectProxyHandler::objectClassIs(HandleObject proxy, ESClassValue classValue,
+                                          JSContext *cx)
+{
+    // Special case IsArray. In every other instance ES wants to have exactly
+    // one object type and not a proxy around it, so return false.
+    if (classValue != ESClass_IsArray)
+        return false;
+
+    // In ES6 IsArray is supposed to poke at the Proxy target, instead we do this here.
+    // The reason for this is that we have proxies for which looking at the target might
+    // be impossible. So instead we use our little objectClassIs function that just works
+    // already across different wrappers.
+    RootedObject target(cx, proxy->as<ProxyObject>().target());
+    if (!target)
+        return false;
+
+    return IsArray(target, cx);
+}
+
+bool
+ScriptedDirectProxyHandler::regexp_toShared(JSContext *cx, HandleObject proxy,
+                                            RegExpGuard *g)
+{
+    MOZ_CRASH("Should not end up in ScriptedDirectProxyHandler::regexp_toShared");
+    return false;
+}
+
+
 ScriptedDirectProxyHandler ScriptedDirectProxyHandler::singleton;
 
 #define INVOKE_ON_PROTOTYPE(cx, handler, proxy, protoCall)                   \
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/js/src/jsscript.h thunderbird-1000~31.6.0+build1/mozilla/js/src/jsscript.h
--- thunderbird-1000~31.4.0+build1/mozilla/js/src/jsscript.h	2015-01-12 17:51:23.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/js/src/jsscript.h	2015-03-30 18:03:44.000000000 +0000
@@ -1251,7 +1251,7 @@
     }
 
     bool isRelazifiable() const {
-        return (selfHosted() || lazyScript) &&
+        return (selfHosted() || lazyScript) && !types &&
                !isGenerator() && !hasBaselineScript() && !hasAnyIonScript() && !hasBeenInlined();
     }
     void setLazyScript(js::LazyScript *lazy) {
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/js/src/tests/lib/jittests.py thunderbird-1000~31.6.0+build1/mozilla/js/src/tests/lib/jittests.py
--- thunderbird-1000~31.4.0+build1/mozilla/js/src/tests/lib/jittests.py	2015-01-12 17:51:24.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/js/src/tests/lib/jittests.py	2015-03-30 18:03:45.000000000 +0000
@@ -146,10 +146,10 @@
                         test.jitflags.append('--debugjit')
                     elif name == 'ion-eager':
                         test.jitflags.append('--ion-eager')
-                    elif name == 'no-ion':
-                        test.jitflags.append('--no-ion')
                     elif name == 'dump-bytecode':
                         test.jitflags.append('--dump-bytecode')
+                    elif name.startswith('--'): # // |jit-test| --ion-gvn=off; --no-sse4
+                        test.jitflags.append(name)
                     else:
                         print('warning: unrecognized |jit-test| attribute %s' % part)
 
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/js/src/vm/Debugger.cpp thunderbird-1000~31.6.0+build1/mozilla/js/src/vm/Debugger.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/js/src/vm/Debugger.cpp	2015-01-12 17:51:25.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/js/src/vm/Debugger.cpp	2015-03-30 18:03:47.000000000 +0000
@@ -2825,35 +2825,47 @@
 {
     THIS_DEBUGGER(cx, argc, vp, "findAllGlobals", args, dbg);
 
+    AutoObjectVector globals(cx);
+
+    {
+        // Accumulate the list of globals before wrapping them, because
+        // wrapping can GC and collect compartments from under us, while
+        // iterating.
+
+        for (CompartmentsIter c(cx->runtime(), SkipAtoms); !c.done(); c.next()) {
+            if (c->options().invisibleToDebugger())
+                continue;
+
+            c->zone()->scheduledForDestruction = false;
+
+            GlobalObject *global = c->maybeGlobal();
+
+            if (cx->runtime()->isSelfHostingGlobal(global))
+                continue;
+
+            if (global) {
+                /*
+                 * We pulled |global| out of nowhere, so it's possible that it was
+                 * marked gray by XPConnect. Since we're now exposing it to JS code,
+                 * we need to mark it black.
+                 */
+                JS::ExposeGCThingToActiveJS(global, JSTRACE_OBJECT);
+                if (!globals.append(global))
+                    return false;
+            }
+        }
+    }
+
     RootedObject result(cx, NewDenseEmptyArray(cx));
     if (!result)
         return false;
 
-    for (CompartmentsIter c(cx->runtime(), SkipAtoms); !c.done(); c.next()) {
-        if (c->options().invisibleToDebugger())
-            continue;
-
-        c->zone()->scheduledForDestruction = false;
-
-        GlobalObject *global = c->maybeGlobal();
-
-        if (cx->runtime()->isSelfHostingGlobal(global))
-            continue;
-
-        if (global) {
-            /*
-             * We pulled |global| out of nowhere, so it's possible that it was
-             * marked gray by XPConnect. Since we're now exposing it to JS code,
-             * we need to mark it black.
-             */
-            JS::ExposeGCThingToActiveJS(global, JSTRACE_OBJECT);
-
-            RootedValue globalValue(cx, ObjectValue(*global));
-            if (!dbg->wrapDebuggeeValue(cx, &globalValue))
-                return false;
-            if (!NewbornArrayPush(cx, result, globalValue))
-                return false;
-        }
+    for (size_t i = 0; i < globals.length(); i++) {
+        RootedValue globalValue(cx, ObjectValue(*globals[i]));
+        if (!dbg->wrapDebuggeeValue(cx, &globalValue))
+            return false;
+        if (!NewbornArrayPush(cx, result, globalValue))
+            return false;
     }
 
     args.rval().setObject(*result);
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/js/xpconnect/wrappers/XrayWrapper.h thunderbird-1000~31.6.0+build1/mozilla/js/xpconnect/wrappers/XrayWrapper.h
--- thunderbird-1000~31.4.0+build1/mozilla/js/xpconnect/wrappers/XrayWrapper.h	2015-01-12 17:51:16.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/js/xpconnect/wrappers/XrayWrapper.h	2015-03-30 18:03:36.000000000 +0000
@@ -9,8 +9,11 @@
 
 #include "mozilla/Attributes.h"
 
+#include "jsapi.h"
 #include "jswrapper.h"
 
+#include "WrapperFactory.h"
+
 // Xray wrappers re-resolve the original native properties on the native
 // object and always directly access to those properties.
 // Because they work so differently from the rest of the wrapper hierarchy,
@@ -126,7 +129,13 @@
         getPrototypeOfHelper(JSContext *cx, JS::HandleObject wrapper,
                              JS::HandleObject target, JS::MutableHandleObject protop)
     {
-        return Base::getPrototypeOf(cx, wrapper, protop);
+        if (!Base::getPrototypeOf(cx, wrapper, protop))
+            return false;
+        if (!protop || WrapperFactory::IsXrayWrapper(protop))
+            return true;
+
+        protop.set(JS_GetObjectPrototype(cx, wrapper));
+        return !!protop.get();
     }
     bool getPrototypeOfHelper(JSContext *cx, JS::HandleObject wrapper,
                               JS::HandleObject target, JS::MutableHandleObject protop)
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/layout/generic/nsTextFrame.cpp thunderbird-1000~31.6.0+build1/mozilla/layout/generic/nsTextFrame.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/layout/generic/nsTextFrame.cpp	2015-01-12 17:51:17.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/layout/generic/nsTextFrame.cpp	2015-03-30 18:03:37.000000000 +0000
@@ -982,18 +982,20 @@
     
     virtual void SetCapitalization(uint32_t aOffset, uint32_t aLength,
                                    bool* aCapitalize) MOZ_OVERRIDE {
-      NS_ASSERTION(mTextRun->GetFlags() & nsTextFrameUtils::TEXT_IS_TRANSFORMED,
-                   "Text run should be transformed!");
-      nsTransformedTextRun* transformedTextRun =
-        static_cast<nsTransformedTextRun*>(mTextRun);
-      transformedTextRun->SetCapitalization(aOffset + mOffsetIntoTextRun, aLength,
-                                            aCapitalize, mContext);
+      MOZ_ASSERT(mTextRun->GetFlags() & nsTextFrameUtils::TEXT_IS_TRANSFORMED,
+                 "Text run should be transformed!");
+      if (mTextRun->GetFlags() & nsTextFrameUtils::TEXT_IS_TRANSFORMED) {
+        nsTransformedTextRun* transformedTextRun =
+          static_cast<nsTransformedTextRun*>(mTextRun);
+        transformedTextRun->SetCapitalization(aOffset + mOffsetIntoTextRun, aLength,
+                                              aCapitalize, mContext);
+      }
     }
 
     void Finish() {
-      NS_ASSERTION(!(mTextRun->GetFlags() &
-                     (gfxTextRunFactory::TEXT_UNUSED_FLAGS |
-                      nsTextFrameUtils::TEXT_UNUSED_FLAG)),
+      MOZ_ASSERT(!(mTextRun->GetFlags() &
+                   (gfxTextRunFactory::TEXT_UNUSED_FLAGS |
+                    nsTextFrameUtils::TEXT_UNUSED_FLAG)),
                    "Flag set that should never be set! (memory safety error?)");
       if (mTextRun->GetFlags() & nsTextFrameUtils::TEXT_IS_TRANSFORMED) {
         nsTransformedTextRun* transformedTextRun =
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/layout/ipc/RenderFrameParent.cpp thunderbird-1000~31.6.0+build1/mozilla/layout/ipc/RenderFrameParent.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/layout/ipc/RenderFrameParent.cpp	2015-01-12 17:51:17.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/layout/ipc/RenderFrameParent.cpp	2015-03-30 18:03:37.000000000 +0000
@@ -9,6 +9,7 @@
 
 #include "BasicLayers.h"
 #include "gfx3DMatrix.h"
+#include "gfxPrefs.h"
 #ifdef MOZ_ENABLE_D3D9_LAYER
 # include "LayerManagerD3D9.h"
 #endif //MOZ_ENABLE_D3D9_LAYER
@@ -761,7 +762,7 @@
   // created and the static getter knows which CompositorParent is
   // instantiated with this layers ID. That's why try to fetch it when
   // we first need it and cache the result.
-  if (!mApzcTreeManager) {
+  if (!mApzcTreeManager && gfxPrefs::AsyncPanZoomEnabled()) {
     mApzcTreeManager = CompositorParent::GetAPZCTreeManager(mLayersId);
   }
   return mApzcTreeManager.get();
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/layout/reftests/backgrounds/reftest.list thunderbird-1000~31.6.0+build1/mozilla/layout/reftests/backgrounds/reftest.list
--- thunderbird-1000~31.4.0+build1/mozilla/layout/reftests/backgrounds/reftest.list	2015-01-12 17:51:17.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/layout/reftests/backgrounds/reftest.list	2015-03-30 18:03:37.000000000 +0000
@@ -128,7 +128,7 @@
 random-if(B2G) == fixed-bg-with-transform-outside-viewport-1.html fixed-bg-with-transform-outside-viewport-ref.html
 
 HTTP == root-background-1.html root-background-ref.html
-fails-if(Android&&(AndroidVersion==10||AndroidVersion==17)) HTTP != root-background-1.html about:blank
+HTTP != root-background-1.html about:blank
 
 random-if(B2G) == really-big-background.html really-big-background-ref.html
 == body-background.html body-background-ref.html
@@ -140,7 +140,7 @@
 
 == multi-background-clip-content-border.html multi-background-clip-content-border-ref.html
 
-fails-if(Android&&(AndroidVersion==10||AndroidVersion==17)) HTTP == background-referrer.html background-referrer-ref.html
+HTTP == background-referrer.html background-referrer-ref.html
 
 == attachment-scroll-positioning-1.html attachment-scroll-positioning-1-ref.html
 == attachment-local-positioning-1.html attachment-local-positioning-1-ref.html
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/layout/reftests/font-face/reftest.list thunderbird-1000~31.6.0+build1/mozilla/layout/reftests/font-face/reftest.list
--- thunderbird-1000~31.4.0+build1/mozilla/layout/reftests/font-face/reftest.list	2015-01-12 17:51:19.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/layout/reftests/font-face/reftest.list	2015-03-30 18:03:39.000000000 +0000
@@ -148,8 +148,8 @@
 # Tests for bug 670900 - handling of 404 (not found) error in @font-face URL
 # (using Chunkfive font data returned from a .sjs file)
 HTTP(..) == font-error-404-1.html font-error-404-1-ref.html # HTTP status 404, don't load
-skip-if(B2G) fails-if(Android&&(AndroidVersion==10||AndroidVersion==17)) HTTP(..) == font-error-404-2.html font-error-404-2-ref.html # HTTP status 200, load # bug 773482
-fails-if(Android&&(AndroidVersion==10||AndroidVersion==17)) HTTP(..) != font-error-404-1.html font-error-404-2.html # sanity-check that the results differ
+skip-if(B2G) HTTP(..) == font-error-404-2.html font-error-404-2-ref.html # HTTP status 200, load # bug 773482
+HTTP(..) != font-error-404-1.html font-error-404-2.html # sanity-check that the results differ
 
 # Font load redirection
 HTTP(..) == font-redirect.html order-1-ref.html
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/layout/style/nsCSSValue.cpp thunderbird-1000~31.6.0+build1/mozilla/layout/style/nsCSSValue.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/layout/style/nsCSSValue.cpp	2015-01-12 17:51:22.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/layout/style/nsCSSValue.cpp	2015-03-30 18:03:42.000000000 +0000
@@ -253,13 +253,14 @@
       return *mValue.mRect == *aOther.mValue.mRect;
     }
     else if (eCSSUnit_List == mUnit) {
-      return *mValue.mList == *aOther.mValue.mList;
+      return nsCSSValueList::Equal(mValue.mList, aOther.mValue.mList);
     }
     else if (eCSSUnit_SharedList == mUnit) {
       return *mValue.mSharedList == *aOther.mValue.mSharedList;
     }
     else if (eCSSUnit_PairList == mUnit) {
-      return *mValue.mPairList == *aOther.mValue.mPairList;
+      return nsCSSValuePairList::Equal(mValue.mPairList,
+                                       aOther.mValue.mPairList);
     }
     else if (eCSSUnit_GridTemplateAreas == mUnit) {
       return *mValue.mGridTemplateAreas == *aOther.mValue.mGridTemplateAreas;
@@ -1740,13 +1741,15 @@
   }
 }
 
-bool
-nsCSSValueList::operator==(const nsCSSValueList& aOther) const
+/* static */ bool
+nsCSSValueList::Equal(const nsCSSValueList* aList1,
+                      const nsCSSValueList* aList2)
 {
-  if (this == &aOther)
+  if (aList1 == aList2) {
     return true;
+  }
 
-  const nsCSSValueList *p1 = this, *p2 = &aOther;
+  const nsCSSValueList *p1 = aList1, *p2 = aList2;
   for ( ; p1 && p2; p1 = p1->mNext, p2 = p2->mNext) {
     if (p1->mValue != p2->mValue)
       return false;
@@ -1799,8 +1802,7 @@
 bool
 nsCSSValueSharedList::operator==(const nsCSSValueSharedList& aOther) const
 {
-  return !mHead == !aOther.mHead &&
-         (!mHead || *mHead == *aOther.mHead);
+  return nsCSSValueList::Equal(mHead, aOther.mHead);
 }
 
 size_t
@@ -2010,13 +2012,15 @@
   }
 }
 
-bool
-nsCSSValuePairList::operator==(const nsCSSValuePairList& aOther) const
+/* static */ bool
+nsCSSValuePairList::Equal(const nsCSSValuePairList* aList1,
+                          const nsCSSValuePairList* aList2)
 {
-  if (this == &aOther)
+  if (aList1 == aList2) {
     return true;
+  }
 
-  const nsCSSValuePairList *p1 = this, *p2 = &aOther;
+  const nsCSSValuePairList *p1 = aList1, *p2 = aList2;
   for ( ; p1 && p2; p1 = p1->mNext, p2 = p2->mNext) {
     if (p1->mXValue != p2->mXValue ||
         p1->mYValue != p2->mYValue)
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/layout/style/nsCSSValue.h thunderbird-1000~31.6.0+build1/mozilla/layout/style/nsCSSValue.h
--- thunderbird-1000~31.4.0+build1/mozilla/layout/style/nsCSSValue.h	2015-01-12 17:51:22.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/layout/style/nsCSSValue.h	2015-03-30 18:03:42.000000000 +0000
@@ -806,9 +806,8 @@
   void AppendToString(nsCSSProperty aProperty, nsAString& aResult,
                       nsCSSValue::Serialization aValueSerialization) const;
 
-  bool operator==(nsCSSValueList const& aOther) const;
-  bool operator!=(const nsCSSValueList& aOther) const
-  { return !(*this == aOther); }
+  static bool Equal(const nsCSSValueList* aList1,
+                    const nsCSSValueList* aList2);
 
   size_t SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf) const;
 
@@ -821,6 +820,12 @@
   {
     MOZ_COUNT_CTOR(nsCSSValueList);
   }
+
+  // We don't want operator== or operator!= because they wouldn't be
+  // null-safe, which is generally what we need.  Use |Equal| method
+  // above instead.
+  bool operator==(nsCSSValueList const& aOther) const MOZ_DELETE;
+  bool operator!=(const nsCSSValueList& aOther) const MOZ_DELETE;
 };
 
 // nsCSSValueList_heap differs from nsCSSValueList only in being
@@ -1199,9 +1204,8 @@
   void AppendToString(nsCSSProperty aProperty, nsAString& aResult,
                       nsCSSValue::Serialization aValueSerialization) const;
 
-  bool operator==(const nsCSSValuePairList& aOther) const;
-  bool operator!=(const nsCSSValuePairList& aOther) const
-  { return !(*this == aOther); }
+  static bool Equal(const nsCSSValuePairList* aList1,
+                    const nsCSSValuePairList* aList2);
 
   size_t SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf) const;
 
@@ -1215,6 +1219,12 @@
   {
     MOZ_COUNT_CTOR(nsCSSValuePairList);
   }
+
+  // We don't want operator== or operator!= because they wouldn't be
+  // null-safe, which is generally what we need.  Use |Equal| method
+  // above instead.
+  bool operator==(const nsCSSValuePairList& aOther) const MOZ_DELETE;
+  bool operator!=(const nsCSSValuePairList& aOther) const MOZ_DELETE;
 };
 
 // nsCSSValuePairList_heap differs from nsCSSValuePairList only in being
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/layout/style/nsStyleAnimation.cpp thunderbird-1000~31.6.0+build1/mozilla/layout/style/nsStyleAnimation.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/layout/style/nsStyleAnimation.cpp	2015-01-12 17:51:22.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/layout/style/nsStyleAnimation.cpp	2015-03-30 18:03:42.000000000 +0000
@@ -3816,11 +3816,13 @@
     case eUnit_Filter:
     case eUnit_Shadow:
     case eUnit_BackgroundPosition:
-      return *mValue.mCSSValueList == *aOther.mValue.mCSSValueList;
+      return nsCSSValueList::Equal(mValue.mCSSValueList,
+                                   aOther.mValue.mCSSValueList);
     case eUnit_Transform:
       return *mValue.mCSSValueSharedList == *aOther.mValue.mCSSValueSharedList;
     case eUnit_CSSValuePairList:
-      return *mValue.mCSSValuePairList == *aOther.mValue.mCSSValuePairList;
+      return nsCSSValuePairList::Equal(mValue.mCSSValuePairList,
+                                       aOther.mValue.mCSSValuePairList);
     case eUnit_UnparsedString:
       return (NS_strcmp(GetStringBufferValue(),
                         aOther.GetStringBufferValue()) == 0);
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/mobile/android/base/tests/BaseTest.java thunderbird-1000~31.6.0+build1/mozilla/mobile/android/base/tests/BaseTest.java
--- thunderbird-1000~31.4.0+build1/mozilla/mobile/android/base/tests/BaseTest.java	2015-01-12 17:51:17.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/mobile/android/base/tests/BaseTest.java	2015-03-30 18:03:37.000000000 +0000
@@ -143,7 +143,7 @@
             mAsserter.endTest();
             // request a force quit of the browser and wait for it to take effect
             GeckoAppShell.sendEventToGecko(GeckoEvent.createBroadcastEvent("Robocop:Quit", null));
-            mSolo.sleep(7000);
+            mSolo.sleep(120000);
             // if still running, finish activities as recommended by Robotium
             mSolo.finishOpenedActivities();
         } catch (Throwable e) {
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/mobile/android/base/tests/UITest.java thunderbird-1000~31.6.0+build1/mozilla/mobile/android/base/tests/UITest.java
--- thunderbird-1000~31.4.0+build1/mozilla/mobile/android/base/tests/UITest.java	2015-01-12 17:51:17.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/mobile/android/base/tests/UITest.java	2015-03-30 18:03:37.000000000 +0000
@@ -82,7 +82,7 @@
             mAsserter.endTest();
             // request a force quit of the browser and wait for it to take effect
             GeckoAppShell.sendEventToGecko(GeckoEvent.createBroadcastEvent("Robocop:Quit", null));
-            mSolo.sleep(7000);
+            mSolo.sleep(120000);
             // if still running, finish activities as recommended by Robotium
             mSolo.finishOpenedActivities();
         } catch (Throwable e) {
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/modules/libpref/src/init/all.js thunderbird-1000~31.6.0+build1/mozilla/modules/libpref/src/init/all.js
--- thunderbird-1000~31.4.0+build1/mozilla/modules/libpref/src/init/all.js	2015-01-12 17:51:18.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/modules/libpref/src/init/all.js	2015-03-30 18:03:38.000000000 +0000
@@ -224,6 +224,7 @@
 #endif
 #ifdef MOZ_GSTREAMER
 pref("media.gstreamer.enabled", true);
+pref("media.gstreamer.enable-blacklist", true);
 #endif
 #ifdef MOZ_APPLEMEDIA
 pref("media.apple.mp3.enabled", true);
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/netwerk/dns/nsDNSService2.cpp thunderbird-1000~31.6.0+build1/mozilla/netwerk/dns/nsDNSService2.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/netwerk/dns/nsDNSService2.cpp	2015-01-12 17:51:18.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/netwerk/dns/nsDNSService2.cpp	2015-03-30 18:03:39.000000000 +0000
@@ -206,11 +206,13 @@
     }
 
     NetAddrElement *iterCopy = mIter;
+    int iterGenCntCopy = mIterGenCnt;
 
     NetAddr addr;
     *result = NS_SUCCEEDED(GetNextAddr(0, &addr));
 
     mIter = iterCopy;
+    mIterGenCnt = iterGenCntCopy;
     mDone = false;
 
     return NS_OK;
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/netwerk/test/mochitests/mochitest.ini thunderbird-1000~31.6.0+build1/mozilla/netwerk/test/mochitests/mochitest.ini
--- thunderbird-1000~31.4.0+build1/mozilla/netwerk/test/mochitests/mochitest.ini	2015-01-12 17:51:19.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/netwerk/test/mochitests/mochitest.ini	2015-03-30 18:03:39.000000000 +0000
@@ -9,6 +9,7 @@
 [test_partially_cached_content.html]
 [test_uri_scheme.html]
 [test_user_agent_overrides.html]
+skip-if = toolkit == 'android' # Bug 1111137
 [test_user_agent_updates.html]
 [test_user_agent_updates_reset.html]
 [test_xhr_method_case.html]
\ No newline at end of file
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/security/manager/boot/src/nsSTSPreloadList.errors thunderbird-1000~31.6.0+build1/mozilla/security/manager/boot/src/nsSTSPreloadList.errors
--- thunderbird-1000~31.4.0+build1/mozilla/security/manager/boot/src/nsSTSPreloadList.errors	2015-01-12 17:51:32.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/security/manager/boot/src/nsSTSPreloadList.errors	2015-03-30 18:03:40.000000000 +0000
@@ -8,31 +8,28 @@
 appengine.google.com: did not receive HSTS header (error ignored - included regardless)
 appseccalifornia.org: did not receive HSTS header
 azprep.us: could not connect to host
+barcodeberlin.com: did not receive HSTS header
 bccx.com: could not connect to host
-bedeta.de: could not connect to host
 betnet.fr: could not connect to host
 bigshinylock.minazo.net: could not connect to host
-bitfactory.ws: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsISiteSecurityService.processHeader]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: /builds/slave/m-esr31-l64-periodicupdate-000/getHSTSPreloadList.js :: processStsHeader :: line 125"  data: no]
 blog.lookout.com: did not receive HSTS header
-braintreegateway.com: did not receive HSTS header
 braintreepayments.com: did not receive HSTS header
 browserid.org: did not receive HSTS header
 business.medbank.com.mt: did not receive HSTS header
 calyxinstitute.org: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsISiteSecurityService.processHeader]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: /builds/slave/m-esr31-l64-periodicupdate-000/getHSTSPreloadList.js :: processStsHeader :: line 125"  data: no]
-carlolly.co.uk: did not receive HSTS header
-cartucce24.it: could not connect to host
+carlolly.co.uk: could not connect to host
+celltek-server.de: did not receive HSTS header
 cert.se: max-age too low: 2628001
 checkout.google.com: did not receive HSTS header (error ignored - included regardless)
 chrome-devtools-frontend.appspot.com: did not receive HSTS header (error ignored - included regardless)
 chrome.google.com: did not receive HSTS header (error ignored - included regardless)
-cloud.google.com: did not receive HSTS header (error ignored - included regardless)
 code.google.com: did not receive HSTS header (error ignored - included regardless)
 codereview.chromium.org: did not receive HSTS header (error ignored - included regardless)
 crate.io: did not receive HSTS header
 crbug.com: did not receive HSTS header
 crowdcurity.com: did not receive HSTS header
-crypto.is: did not receive HSTS header
-csawctf.poly.edu: did not receive HSTS header
+crypto.is: max-age too low: 7776000
+csawctf.poly.edu: could not connect to host
 cybershambles.com: could not connect to host
 discovery.lookout.com: did not receive HSTS header
 dl.google.com: did not receive HSTS header (error ignored - included regardless)
@@ -40,16 +37,15 @@
 download.jitsi.org: did not receive HSTS header
 drive.google.com: did not receive HSTS header (error ignored - included regardless)
 dropcam.com: did not receive HSTS header
-ed.gs: did not receive HSTS header
 edmodo.com: did not receive HSTS header
 email.lookout.com: could not connect to host
 encrypted.google.com: did not receive HSTS header (error ignored - included regardless)
 epoxate.com: did not receive HSTS header
 errors.zenpayroll.com: could not connect to host
 espra.com: could not connect to host
+ethitter.com: did not receive HSTS header
 fatzebra.com.au: did not receive HSTS header
 gamesdepartment.co.uk: did not receive HSTS header
-get.zenpayroll.com: did not receive HSTS header
 getlantern.org: did not receive HSTS header
 glass.google.com: did not receive HSTS header (error ignored - included regardless)
 globalcs.co.uk: did not receive HSTS header
@@ -73,16 +69,18 @@
 intercom.io: did not receive HSTS header
 iop.intuit.com: max-age too low: 86400
 irccloud.com: did not receive HSTS header
-itriskltd.com: did not receive HSTS header
+janoberst.com: did not receive HSTS header
+jelmer.co.uk: could not connect to host
 jottit.com: could not connect to host
+k-dev.de: could not connect to host
 keymaster.lookout.com: did not receive HSTS header
-kitsta.com: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsISiteSecurityService.processHeader]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: /builds/slave/m-esr31-l64-periodicupdate-000/getHSTSPreloadList.js :: processStsHeader :: line 125"  data: no]
+kitsta.com: could not connect to host
 kiwiirc.com: max-age too low: 5256000
 klaxn.com: could not connect to host
-ledgerscope.net: did not receive HSTS header
+koop-bremen.de: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsISiteSecurityService.processHeader]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: /builds/slave/m-esr31-l64-periodicupdate-000/getHSTSPreloadList.js :: processStsHeader :: line 125"  data: no]
 liberty.lavabit.com: could not connect to host
+library.linode.com: did not receive HSTS header
 lifeguard.aecom.com: max-age too low: 86400
-lists.mayfirst.org: did not receive HSTS header
 login.corp.google.com: max-age too low: 7776000 (error ignored - included regardless)
 logotype.se: did not receive HSTS header
 lumi.do: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsISiteSecurityService.processHeader]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: /builds/slave/m-esr31-l64-periodicupdate-000/getHSTSPreloadList.js :: processStsHeader :: line 125"  data: no]
@@ -91,9 +89,10 @@
 manage.zenpayroll.com: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsISiteSecurityService.processHeader]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: /builds/slave/m-esr31-l64-periodicupdate-000/getHSTSPreloadList.js :: processStsHeader :: line 125"  data: no]
 market.android.com: did not receive HSTS header (error ignored - included regardless)
 matteomarescotti.name: could not connect to host
+mediacru.sh: could not connect to host
+mnsure.org: could not connect to host
 mobilethreat.net: could not connect to host
 mobilethreatnetwork.net: could not connect to host
-mudcrab.us: could not connect to host
 my.alfresco.com: did not receive HSTS header
 mydigipass.com: did not receive HSTS header
 mykolab.com: did not receive HSTS header
@@ -102,21 +101,21 @@
 nexth.de: could not connect to host
 nexth.net: could not connect to host
 nexth.us: could not connect to host
+ng-security.com: could not connect to host
 noexpect.org: could not connect to host
 npw.net: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsISiteSecurityService.processHeader]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: /builds/slave/m-esr31-l64-periodicupdate-000/getHSTSPreloadList.js :: processStsHeader :: line 125"  data: no]
 openshift.redhat.com: did not receive HSTS header
 ottospora.nl: could not connect to host
 passwordbox.com: did not receive HSTS header
-payroll.xero.com: max-age too low: 3600
 piratenlogin.de: could not connect to host
 platform.lookout.com: could not connect to host
 play.google.com: did not receive HSTS header (error ignored - included regardless)
 pressfreedomfoundation.org: did not receive HSTS header
 prodpad.com: did not receive HSTS header
-profiles.google.com: did not receive HSTS header (error ignored - included regardless)
 promecon-gmbh.de: did not receive HSTS header
 rapidresearch.me: could not connect to host
-redports.org: could not connect to host
+redports.org: did not receive HSTS header
+reserve-online.net: did not receive HSTS header
 riseup.net: did not receive HSTS header
 rme.li: did not receive HSTS header
 roddis.net: did not receive HSTS header
@@ -147,14 +146,11 @@
 talkgadget.google.com: did not receive HSTS header (error ignored - included regardless)
 tektoria.de: did not receive HSTS header
 translate.googleapis.com: did not receive HSTS header (error ignored - included regardless)
-unterfrankenclan.de: could not connect to host
 uprotect.it: could not connect to host
 viennan.net: did not receive HSTS header
 wallet.google.com: did not receive HSTS header (error ignored - included regardless)
 webmail.mayfirst.org: did not receive HSTS header
-whonix.org: did not receive HSTS header
-wiz.biz: did not receive HSTS header
-www.airbnb.com: did not receive HSTS header
+wiz.biz: could not connect to host
 www.apollo-auto.com: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsISiteSecurityService.processHeader]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: /builds/slave/m-esr31-l64-periodicupdate-000/getHSTSPreloadList.js :: processStsHeader :: line 125"  data: no]
 www.calyxinstitute.org: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsISiteSecurityService.processHeader]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: /builds/slave/m-esr31-l64-periodicupdate-000/getHSTSPreloadList.js :: processStsHeader :: line 125"  data: no]
 www.cueup.com: could not connect to host
@@ -164,7 +160,6 @@
 www.googlemail.com: did not receive HSTS header (error ignored - included regardless)
 www.greplin.com: could not connect to host
 www.jitsi.org: did not receive HSTS header
-www.ledgerscope.net: did not receive HSTS header
 www.logentries.com: did not receive HSTS header
 www.moneybookers.com: did not receive HSTS header
 www.neonisi.com: could not connect to host
@@ -172,4 +167,4 @@
 www.rme.li: did not receive HSTS header
 www.sandbox.mydigipass.com: could not connect to host
 www.surfeasy.com: did not receive HSTS header
-zoo24.de: did not receive HSTS header
+zoo24.de: could not connect to host
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/security/manager/boot/src/nsSTSPreloadList.inc thunderbird-1000~31.6.0+build1/mozilla/security/manager/boot/src/nsSTSPreloadList.inc
--- thunderbird-1000~31.4.0+build1/mozilla/security/manager/boot/src/nsSTSPreloadList.inc	2015-01-12 17:51:32.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/security/manager/boot/src/nsSTSPreloadList.inc	2015-03-30 18:03:40.000000000 +0000
@@ -8,7 +8,7 @@
 /*****************************************************************************/
 
 #include <stdint.h>
-const PRTime gPreloadListExpirationTime = INT64_C(1431169667113000);
+const PRTime gPreloadListExpirationTime = INT64_C(1438423863556000);
 
 class nsSTSPreload
 {
@@ -27,7 +27,7 @@
   { "admin.google.com", true },
   { "adsfund.org", true },
   { "aie.de", true },
-  { "aladdinschools.appspot.com", false },
+  { "aladdinschools.appspot.com", true },
   { "alexsexton.com", true },
   { "alpha.irccloud.com", false },
   { "ansdell.net", true },
@@ -41,7 +41,7 @@
   { "apn-einstellungen.de", true },
   { "app.lookout.com", false },
   { "app.manilla.com", true },
-  { "app.recurly.com", false },
+  { "app.recurly.com", true },
   { "app.simpletax.ca", false },
   { "app.yinxiang.com", false },
   { "appengine.google.com", true },
@@ -50,7 +50,6 @@
   { "auf-feindgebiet.de", true },
   { "baer.im", true },
   { "bank.simple.com", false },
-  { "barcodeberlin.com", true },
   { "baruch.me", true },
   { "bassh.net", true },
   { "bayrisch-fuer-anfaenger.de", true },
@@ -77,6 +76,7 @@
   { "blog.torproject.org", false },
   { "bohramt.de", true },
   { "boxcryptor.com", true },
+  { "braintreegateway.com", true },
   { "brunosouza.org", true },
   { "buddhistische-weisheiten.org", true },
   { "bugzil.la", true },
@@ -86,7 +86,7 @@
   { "ca.gparent.org", false },
   { "carezone.com", false },
   { "cartouche24.eu", true },
-  { "celltek-server.de", false },
+  { "cartucce24.it", true },
   { "certible.com", true },
   { "check.torproject.org", false },
   { "checkout.google.com", true },
@@ -103,7 +103,7 @@
   { "code.google.com", true },
   { "codereview.appspot.com", false },
   { "codereview.chromium.org", true },
-  { "config.schokokeks.org", true },
+  { "config.schokokeks.org", false },
   { "conformal.com", true },
   { "conrad-kostecki.de", true },
   { "controlcenter.gigahost.dk", true },
@@ -137,8 +137,9 @@
   { "donmez.ws", false },
   { "drive.google.com", true },
   { "dropbox.com", true },
-  { "ebanking.indovinabank.com.vn", false },
+  { "ebanking.indovinabank.com.vn", true },
   { "ecosystem.atlassian.net", true },
+  { "ed.gs", true },
   { "edyou.eu", true },
   { "eff.org", true },
   { "emailprivacytester.com", true },
@@ -148,7 +149,6 @@
   { "entropia.de", false },
   { "errors.zenpayroll.com", false },
   { "espra.com", true },
-  { "ethitter.com", true },
   { "eurotramp.com", true },
   { "explodie.org", true },
   { "f-droid.org", true },
@@ -169,6 +169,7 @@
   { "freeshell.de", true },
   { "gemeinfreie-lieder.de", true },
   { "gernert-server.de", true },
+  { "get.zenpayroll.com", false },
   { "getcloak.com", false },
   { "getdigitized.net", true },
   { "giacomopelagatti.it", true },
@@ -207,13 +208,13 @@
   { "id.atlassian.com", true },
   { "id.mayfirst.org", false },
   { "ihrlotto.de", true },
-  { "imouto.my", true },
+  { "imouto.my", false },
   { "in.xero.com", false },
   { "irische-segenswuensche.info", true },
   { "isitchristmas.com", true },
   { "it-schwerin.de", true },
+  { "itriskltd.com", true },
   { "jackyyf.com", false },
-  { "janoberst.com", true },
   { "janus-engineering.de", true },
   { "jelmer.co.uk", true },
   { "jelmer.uk", true },
@@ -245,9 +246,10 @@
   { "launchkey.com", true },
   { "lavalite.de", true },
   { "lb-toner.de", true },
-  { "library.linode.com", false },
+  { "ledgerscope.net", false },
   { "linode.com", false },
   { "linx.net", true },
+  { "lists.mayfirst.org", false },
   { "lockify.com", true },
   { "loenshotel.de", true },
   { "loftboard.eu", true },
@@ -283,7 +285,7 @@
   { "members.nearlyfreespeech.net", false },
   { "mig5.net", true },
   { "mikewest.org", true },
-  { "miku.hatsune.my", true },
+  { "miku.hatsune.my", false },
   { "miskatonic.org", true },
   { "mnsure.org", true },
   { "mobile.usaa.com", false },
@@ -316,12 +318,12 @@
   { "packagist.org", false },
   { "pajonzeck.de", true },
   { "palava.tv", true },
-  { "passport.yandex.by", false },
-  { "passport.yandex.com", false },
-  { "passport.yandex.com.tr", false },
-  { "passport.yandex.kz", false },
-  { "passport.yandex.ru", false },
-  { "passport.yandex.ua", false },
+  { "passport.yandex.by", true },
+  { "passport.yandex.com", true },
+  { "passport.yandex.com.tr", true },
+  { "passport.yandex.kz", true },
+  { "passport.yandex.ru", true },
+  { "passport.yandex.ua", true },
   { "passwd.io", true },
   { "paste.linode.com", false },
   { "pastebin.linode.com", false },
@@ -329,6 +331,7 @@
   { "paymill.com", true },
   { "paymill.de", true },
   { "paypal.com", false },
+  { "payroll.xero.com", false },
   { "pdf.yt", true },
   { "picksin.club", true },
   { "pierre-schmitz.com", true },
@@ -337,7 +340,7 @@
   { "plus.google.com", false },
   { "plus.sandbox.google.com", false },
   { "portal.tirol.gv.at", true },
-  { "posteo.de", true },
+  { "posteo.de", false },
   { "profiles.google.com", true },
   { "projektzentrisch.de", true },
   { "prowhisky.de", true },
@@ -349,9 +352,7 @@
   { "qetesh.de", true },
   { "rad-route.de", true },
   { "raiseyourflag.com", true },
-  { "redports.org", true },
   { "reedloden.com", true },
-  { "reserve-online.net", true },
   { "reviews.anime.my", true },
   { "riccy.org", true },
   { "riesenmagnete.de", true },
@@ -365,7 +366,7 @@
   { "sakaki.anime.my", true },
   { "salaervergleich.com", true },
   { "sandbox.mydigipass.com", false },
-  { "schokokeks.org", true },
+  { "schokokeks.org", false },
   { "schwarzer.it", true },
   { "scrambl.is", true },
   { "script.google.com", true },
@@ -375,7 +376,7 @@
   { "securityheaders.com", true },
   { "secuvera.de", true },
   { "seifried.org", true },
-  { "servethecity-karlsruhe.de", true },
+  { "servethecity-karlsruhe.de", false },
   { "sherbers.de", true },
   { "shodan.io", true },
   { "silentcircle.com", false },
@@ -411,7 +412,7 @@
   { "tent.io", true },
   { "texte-zur-taufe.de", true },
   { "thepaymentscompany.com", true },
-  { "therapynotes.com", false },
+  { "therapynotes.com", true },
   { "tinfoilsecurity.com", false },
   { "tinte24.de", true },
   { "tintenfix.net", true },
@@ -456,7 +457,7 @@
   { "webfilings.appspot.com", true },
   { "webmail.gigahost.dk", false },
   { "webmail.onlime.ch", false },
-  { "webmail.schokokeks.org", true },
+  { "webmail.schokokeks.org", false },
   { "websenat.de", true },
   { "welches-kinderfahrrad.de", true },
   { "wepay.com", false },
@@ -469,12 +470,14 @@
   { "wf-training-hrd.appspot.com", true },
   { "wf-training-master.appspot.com", true },
   { "wf-trial-hrd.appspot.com", true },
+  { "whonix.org", true },
   { "wiki.python.org", true },
   { "wildbee.org", true },
   { "winhistory-forum.net", true },
   { "writeapp.me", false },
   { "wunderlist.com", true },
   { "www.aclu.org", false },
+  { "www.airbnb.com", true },
   { "www.apollo-auto.com", true },
   { "www.banking.co.at", false },
   { "www.braintreepayments.com", false },
@@ -495,6 +498,7 @@
   { "www.intercom.io", false },
   { "www.irccloud.com", false },
   { "www.lastpass.com", false },
+  { "www.ledgerscope.net", false },
   { "www.linode.com", false },
   { "www.lookout.com", false },
   { "www.makeyourlaws.org", true },
@@ -505,10 +509,10 @@
   { "www.paypal.com", false },
   { "www.python.org", true },
   { "www.roddis.net", true },
-  { "www.schokokeks.org", true },
+  { "www.schokokeks.org", false },
   { "www.simbolo.co.uk", false },
   { "www.simple.com", false },
-  { "www.therapynotes.com", false },
+  { "www.therapynotes.com", true },
   { "www.tinfoilsecurity.com", false },
   { "www.torproject.org", false },
   { "www.twitter.com", false },
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/testing/config/mozharness/android_arm_config.py thunderbird-1000~31.6.0+build1/mozilla/testing/config/mozharness/android_arm_config.py
--- thunderbird-1000~31.4.0+build1/mozilla/testing/config/mozharness/android_arm_config.py	2015-01-12 17:51:22.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/testing/config/mozharness/android_arm_config.py	2015-03-30 18:03:43.000000000 +0000
@@ -44,7 +44,7 @@
                 "--deviceIP=%(device_ip)s", "--devicePort=%(device_port)s",
                 "--http-port=%(http_port)s", "--ssl-port=%(ssl_port)s",
                 "--certificate-path=%(certs_path)s", "--symbols-path=%(symbols_path)s",
-                "--quiet", "--log-raw=%(raw_log_file)s",
+                "--quiet",
                 "--total-chunks=4",
                 "--robocop-path=../..",
                 "--robocop-ids=fennec_ids.txt",
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/testing/config/tooltool-manifests/win32/releng.manifest thunderbird-1000~31.6.0+build1/mozilla/testing/config/tooltool-manifests/win32/releng.manifest
--- thunderbird-1000~31.4.0+build1/mozilla/testing/config/tooltool-manifests/win32/releng.manifest	2015-01-12 17:51:22.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/testing/config/tooltool-manifests/win32/releng.manifest	2015-03-30 18:03:43.000000000 +0000
@@ -1,7 +1,30 @@
-[{
+[
+{
 "size": 5032443,
 "digest":
 "8228d0a47b4ec952759703503d74b456f592ec12c7be593b524c7065661bdb3d72c62d230536bce941e86aca2b74c389b24a26b21965510c4185a1e075a146b7", 
 "algorithm": "sha512",
 "filename": "win32-minidump_stackwalk.exe"
-}]
+},
+{
+"size": 80910,
+"digest":
+"f4ded2e1638ffa626afb1726e12033f605f309419483b325b1a081c2f168484f472663372052d5af5148271f5b71f2c8eb6aa98c92ce382dc2a1a40d61c70d66",
+"algorithm": "sha512",
+"filename": "cyggcc_s-1.dll"
+},
+{
+"size": 798734,
+"digest":
+"8769662c6b768d261293a833894657aed402276b44b46abf7bbd8c3a6306be701b4a21a907e1ed834edcf51d80f2c423f6884a4ddef6d31f2e535c3ab4840fa7",
+"algorithm": "sha512",
+"filename": "cygstdc++-6.dll"
+},
+{
+"size": 2855706,
+"digest":
+"ceb359907ea02d1943f4b527e45d4080a330bd3522db19ab40bf5fd68762366c8330830457ba7784687a98c9df18c147de54d667eccac63d6c56a50d791a5ff4",
+"algorithm": "sha512",
+"filename": "cygwin1.dll"
+}
+]
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/testing/mozharness/mozharness.json thunderbird-1000~31.6.0+build1/mozilla/testing/mozharness/mozharness.json
--- thunderbird-1000~31.4.0+build1/mozilla/testing/mozharness/mozharness.json	1970-01-01 00:00:00.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/testing/mozharness/mozharness.json	2015-03-30 18:03:44.000000000 +0000
@@ -0,0 +1,4 @@
+{
+    "repo": "http://hg.mozilla.org/build/mozharness",
+    "revision": "2264bffd89ca"
+}
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/testing/mozharness/README.txt thunderbird-1000~31.6.0+build1/mozilla/testing/mozharness/README.txt
--- thunderbird-1000~31.4.0+build1/mozilla/testing/mozharness/README.txt	1970-01-01 00:00:00.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/testing/mozharness/README.txt	2015-03-30 18:03:44.000000000 +0000
@@ -0,0 +1,2 @@
+mozharness.json is a manifest file that is currently only used on try.
+It allows you to lock mozharness to a repository and a revision.
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/toolkit/components/autocomplete/nsAutoCompleteController.cpp thunderbird-1000~31.6.0+build1/mozilla/toolkit/components/autocomplete/nsAutoCompleteController.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/toolkit/components/autocomplete/nsAutoCompleteController.cpp	2015-01-12 17:51:23.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/components/autocomplete/nsAutoCompleteController.cpp	2015-03-30 18:03:44.000000000 +0000
@@ -489,16 +489,27 @@
       else if (shouldComplete) {
         // We usually try to preserve the casing of what user has typed, but
         // if he wants to autocomplete, we will replace the value with the
-        // actual autocomplete result.
+        // actual autocomplete result. Note that the autocomplete input can also
+        // be showing e.g. "bar >> foo bar" if the search matched "bar", a
+        // word not at the start of the full value "foo bar".
         // The user wants explicitely to use that result, so this ensures
         // association of the result with the autocompleted text.
         nsAutoString value;
         nsAutoString inputValue;
         input->GetTextValue(inputValue);
-        if (NS_SUCCEEDED(GetDefaultCompleteValue(-1, false, value)) &&
-            value.Equals(inputValue, nsCaseInsensitiveStringComparator())) {
-          input->SetTextValue(value);
-          input->SelectTextRange(value.Length(), value.Length());
+        if (NS_SUCCEEDED(GetDefaultCompleteValue(-1, false, value))) {
+          nsAutoString suggestedValue;
+          int32_t pos = inputValue.Find(" >> ");
+          if (pos > 0) {
+            inputValue.Right(suggestedValue, inputValue.Length() - pos - 4);
+          } else {
+            suggestedValue = inputValue;
+          }
+
+          if (value.Equals(suggestedValue, nsCaseInsensitiveStringComparator())) {
+            input->SetTextValue(value);
+            input->SelectTextRange(value.Length(), value.Length());
+          }
         }
       }
       // Close the pop-up even if nothing was selected
@@ -1214,20 +1225,53 @@
     }
 
     if (forceComplete && value.IsEmpty()) {
-      // Since nothing was selected, and forceComplete is specified, that means
-      // we have to find the first default match and enter it instead
+      // See if inputValue is one of the autocomplete results. It can be an
+      // identical value, or if it matched the middle of a result it can be
+      // something like "bar >> foobar" (user entered bar and foobar is
+      // the result value).
+      // If the current search matches one of the autocomplete results, we
+      // should use that result, and not overwrite it with the default value.
+      // It's indeed possible EnterMatch gets called a second time (for example
+      // by the blur handler) and it should not overwrite the current match.
+      nsAutoString inputValue;
+      input->GetTextValue(inputValue);
+      nsAutoString suggestedValue;
+      int32_t pos = inputValue.Find(" >> ");
+      if (pos > 0) {
+        inputValue.Right(suggestedValue, inputValue.Length() - pos - 4);
+      } else {
+        suggestedValue = inputValue;
+      }
+
+      nsAutoString defaultValue;
       for (uint32_t i = 0; i < mResults.Length(); ++i) {
         nsIAutoCompleteResult *result = mResults[i];
-
         if (result) {
-          int32_t defaultIndex;
-          result->GetDefaultIndex(&defaultIndex);
-          if (defaultIndex >= 0) {
-            result->GetFinalCompleteValueAt(defaultIndex, value);
-            break;
+          if (defaultValue.IsEmpty()) {
+            int32_t defaultIndex;
+            result->GetDefaultIndex(&defaultIndex);
+            if (defaultIndex >= 0) {
+              result->GetFinalCompleteValueAt(defaultIndex, defaultValue);
+            }
+          }
+
+          uint32_t matchCount = 0;
+          result->GetMatchCount(&matchCount);
+          for (uint32_t j = 0; j < matchCount; ++j) {
+            nsAutoString matchValue;
+            result->GetFinalCompleteValueAt(j, matchValue);
+            if (suggestedValue.Equals(matchValue, nsCaseInsensitiveStringComparator())) {
+              value = matchValue;
+              break;
+            }
           }
         }
       }
+      if (value.IsEmpty()) {
+        // Since nothing was selected, and forceComplete is specified, that means
+        // we have to enter the first default match instead.
+        value = defaultValue;
+      }
     }
   }
 
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/toolkit/components/satchel/nsFormFillController.cpp thunderbird-1000~31.6.0+build1/mozilla/toolkit/components/satchel/nsFormFillController.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/toolkit/components/satchel/nsFormFillController.cpp	2015-01-12 17:51:23.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/components/satchel/nsFormFillController.cpp	2015-03-30 18:03:44.000000000 +0000
@@ -61,6 +61,7 @@
   mSuppressOnInput(false)
 {
   mController = do_GetService("@mozilla.org/autocomplete/controller;1");
+  MOZ_ASSERT(mController);
 }
 
 struct PwmgrInputsEnumData
@@ -104,6 +105,21 @@
                                        int32_t aNameSpaceID,
                                        nsIAtom* aAttribute, int32_t aModType)
 {
+  if ((aAttribute == nsGkAtoms::type || aAttribute == nsGkAtoms::readonly ||
+       aAttribute == nsGkAtoms::autocomplete) &&
+      aNameSpaceID == kNameSpaceID_None) {
+    nsCOMPtr<nsIDOMHTMLInputElement> focusedInput(mFocusedInput);
+    // Reset the current state of the controller, unconditionally.
+    StopControllingInput();
+    // Then restart based on the new values.  We have to delay this
+    // to avoid ending up in an endless loop due to re-registering our
+    // mutation observer (which would notify us again for *this* event).
+    nsCOMPtr<nsIRunnable> event =
+      NS_NewRunnableMethodWithArg<nsCOMPtr<nsIDOMHTMLInputElement>>
+      (this, &nsFormFillController::MaybeStartControllingInput, focusedInput);
+    NS_DispatchToCurrentThread(event);
+  }
+
   if (mListNode && mListNode->Contains(aElement)) {
     RevalidateDataList();
   }
@@ -841,28 +857,26 @@
   return PL_DHASH_NEXT;
 }
 
-nsresult
-nsFormFillController::Focus(nsIDOMEvent* aEvent)
+void
+nsFormFillController::MaybeStartControllingInput(nsIDOMHTMLInputElement* aInput)
 {
-  nsCOMPtr<nsIDOMHTMLInputElement> input = do_QueryInterface(
-    aEvent->InternalDOMEvent()->GetTarget());
-  nsCOMPtr<nsINode> inputNode = do_QueryInterface(input);
+  nsCOMPtr<nsINode> inputNode = do_QueryInterface(aInput);
   if (!inputNode)
-    return NS_OK;
+    return;
 
-  nsCOMPtr<nsIFormControl> formControl = do_QueryInterface(input);
+  nsCOMPtr<nsIFormControl> formControl = do_QueryInterface(aInput);
   if (!formControl || !formControl->IsSingleLineTextControl(true))
-    return NS_OK;
+    return;
 
   bool isReadOnly = false;
-  input->GetReadOnly(&isReadOnly);
+  aInput->GetReadOnly(&isReadOnly);
   if (isReadOnly)
-    return NS_OK;
+    return;
 
-  bool autocomplete = nsContentUtils::IsAutocompleteEnabled(input);
+  bool autocomplete = nsContentUtils::IsAutocompleteEnabled(aInput);
 
   nsCOMPtr<nsIDOMHTMLElement> datalist;
-  input->GetList(getter_AddRefs(datalist));
+  aInput->GetList(getter_AddRefs(datalist));
   bool hasList = datalist != nullptr;
 
   bool dummy;
@@ -871,9 +885,16 @@
       isPwmgrInput = true;
 
   if (isPwmgrInput || hasList || autocomplete) {
-    StartControllingInput(input);
+    StartControllingInput(aInput);
   }
+}
 
+nsresult
+nsFormFillController::Focus(nsIDOMEvent* aEvent)
+{
+  nsCOMPtr<nsIDOMHTMLInputElement> input = do_QueryInterface(
+    aEvent->InternalDOMEvent()->GetTarget());
+  MaybeStartControllingInput(input);
   return NS_OK;
 }
 
@@ -1087,6 +1108,10 @@
   // Make sure we're not still attached to an input
   StopControllingInput();
 
+  if (!mController) {
+    return;
+  }
+
   // Find the currently focused docShell
   nsCOMPtr<nsIDocShell> docShell = GetDocShellForInput(aInput);
   int32_t index = GetIndexOfDocShell(docShell);
@@ -1129,13 +1154,15 @@
     mListNode = nullptr;
   }
 
-  // Reset the controller's input, but not if it has been switched
-  // to another input already, which might happen if the user switches
-  // focus by clicking another autocomplete textbox
-  nsCOMPtr<nsIAutoCompleteInput> input;
-  mController->GetInput(getter_AddRefs(input));
-  if (input == this)
-    mController->SetInput(nullptr);
+  if (mController) {
+    // Reset the controller's input, but not if it has been switched
+    // to another input already, which might happen if the user switches
+    // focus by clicking another autocomplete textbox
+    nsCOMPtr<nsIAutoCompleteInput> input;
+    mController->GetInput(getter_AddRefs(input));
+    if (input == this)
+      mController->SetInput(nullptr);
+  }
 
   if (mFocusedInputNode) {
     MaybeRemoveMutationObserver(mFocusedInputNode);
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/toolkit/components/satchel/nsFormFillController.h thunderbird-1000~31.6.0+build1/mozilla/toolkit/components/satchel/nsFormFillController.h
--- thunderbird-1000~31.4.0+build1/mozilla/toolkit/components/satchel/nsFormFillController.h	2015-01-12 17:51:23.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/components/satchel/nsFormFillController.h	2015-03-30 18:03:44.000000000 +0000
@@ -62,6 +62,11 @@
 
   void StartControllingInput(nsIDOMHTMLInputElement *aInput);
   void StopControllingInput();
+  /**
+   * Checks that aElement is a type of element we want to fill, then calls
+   * StartControllingInput on it.
+   */
+  void MaybeStartControllingInput(nsIDOMHTMLInputElement* aElement);
 
   nsresult PerformInputListAutoComplete(nsIAutoCompleteResult* aPreviousResult);
 
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/toolkit/components/telemetry/Histograms.json thunderbird-1000~31.6.0+build1/mozilla/toolkit/components/telemetry/Histograms.json
--- thunderbird-1000~31.4.0+build1/mozilla/toolkit/components/telemetry/Histograms.json	2015-01-12 17:51:23.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/components/telemetry/Histograms.json	2015-03-30 18:03:45.000000000 +0000
@@ -3823,6 +3823,11 @@
     "kind": "boolean",
     "description": "DOM: Ranges that are detached on destruction (bug 702948)"
   },
+  "DOM_WINDOW_SHOWMODALDIALOG_USED": {
+    "expires_in_version": "never",
+    "kind": "flag",
+    "description": "Whether Window.showModalDialog was used in this session"
+  },
   "LOCALDOMSTORAGE_INIT_DATABASE_MS": {
     "expires_in_version": "never",
     "kind": "exponential",
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/toolkit/content/tests/chrome/chrome.ini thunderbird-1000~31.6.0+build1/mozilla/toolkit/content/tests/chrome/chrome.ini
--- thunderbird-1000~31.4.0+build1/mozilla/toolkit/content/tests/chrome/chrome.ini	2015-01-12 17:51:23.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/content/tests/chrome/chrome.ini	2015-03-30 18:03:45.000000000 +0000
@@ -39,6 +39,7 @@
   window_showcaret.xul
   window_subframe_origin.xul
   window_titlebar.xul
+  window_tooltip.xul
   xul_selectcontrol.js
   rtlchrome/rtl.css
   rtlchrome/rtl.dtd
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/toolkit/content/tests/chrome/test_autocomplete4.xul thunderbird-1000~31.6.0+build1/mozilla/toolkit/content/tests/chrome/test_autocomplete4.xul
--- thunderbird-1000~31.4.0+build1/mozilla/toolkit/content/tests/chrome/test_autocomplete4.xul	2015-01-12 17:51:23.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/content/tests/chrome/test_autocomplete4.xul	2015-03-30 18:03:45.000000000 +0000
@@ -151,6 +151,14 @@
     result: "Result",
     start: 6, end: 6
   },
+
+  { desc: "RIGHT key complete from middle",
+    key: "VK_RIGHT",
+    forceComplete: true,
+    completeFromMiddle: true,
+    result: "Result",
+    start: 6, end: 6
+  },
 ];
 
 function nextTest() {
@@ -177,20 +185,43 @@
 
 function runCurrentTest() {
   var autocomplete = $("autocomplete");
-
   autocomplete.focus();
 
-  synthesizeKey("r", {});
-  synthesizeKey("e", {});
+  if (!currentTest.completeFromMiddle) {
+    synthesizeKey("r", {});
+    synthesizeKey("e", {});
+  }
+  else {
+    synthesizeKey("l", {});
+    synthesizeKey("t", {});
+  }
 }
 
 function searchComplete() {
   var autocomplete = $("autocomplete");
+  autocomplete.setAttribute("forcecomplete", currentTest.forceComplete ? true : false);
+
+  if (currentTest.completeFromMiddle) {
+    if (!currentTest.forceComplete) {
+      synthesizeKey(currentTest.key, {});
+    }
+    else if (!/ >> /.test(autocomplete.value)) {
+      // At this point we should have a value like "lt >> Result" showing.
+      throw new Error("Expected an middle-completed value, got " + autocomplete.value);
+    }
+
+    // For forceComplete a blur should cause a value from the results to get
+    // completed to. E.g. "lt >> Result" will turn into "Result".
+    if (currentTest.forceComplete)
+      autocomplete.blur();
+
+    checkResult();
+    return;
+  }
+
   is(autocomplete.value, "result",
      "Test '" + currentTest.desc + "': autocomplete.value should equal 'result'");
 
-  autocomplete.setAttribute("forcecomplete", currentTest.forceComplete ? true : false);
-
   if (autocomplete.selectionStart == 2) {  // Finished inserting "re" string.
     if (currentTest.removeSelection) {
       // remove current selection
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/toolkit/content/tests/chrome/test_tooltip.xul thunderbird-1000~31.6.0+build1/mozilla/toolkit/content/tests/chrome/test_tooltip.xul
--- thunderbird-1000~31.4.0+build1/mozilla/toolkit/content/tests/chrome/test_tooltip.xul	2015-01-12 17:51:23.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/content/tests/chrome/test_tooltip.xul	2015-03-30 18:03:45.000000000 +0000
@@ -3,239 +3,17 @@
 <?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?>
 
 <window title="Tooltip Tests"
-  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+        onload="setTimeout(runTest, 0)"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
 
   <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
-  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/EventUtils.js"></script>
-  <script type="application/javascript" src="popup_shared.js"></script>
-
-<tooltip id="thetooltip">
-  <label id="label" value="This is a tooltip"/>
-</tooltip>
-
-<box tooltiptext="Box Tooltip">
-  <button id="withtext" label="Tooltip Text" tooltiptext="Button Tooltip"
-          style="-moz-appearance: none; padding: 0;"/>
-  <button id="without" label="No Tooltip" style="-moz-appearance: none; padding: 0;"/>
-  <!-- remove the native theme and borders to avoid some platform
-       specific sizing differences -->
-  <button id="withtooltip" label="Tooltip Element" tooltip="thetooltip"
-          class="plain" style="-moz-appearance: none; padding: 0;"/>
-  <iframe id="childframe" type="content" width="10" height="10"
-          src="http://sectest2.example.org:80/chrome/toolkit/content/tests/chrome/popup_childframe_node.xul"/>
-</box>
-
-<script class="testbody" type="application/javascript">
-<![CDATA[
 
+<script>
 SimpleTest.waitForExplicitFinish();
-var gOriginalWidth = -1;
-var gOriginalHeight = -1;
-var gButton = null;
-
 function runTest()
 {
-  startPopupTests(popupTests);
-}
-
-function checkCoords(event)
-{
-  // all but one test open the tooltip at the button location offset by 6
-  // in each direction. Test 5 opens it at 4 in each direction.
-  var mod = (gTestIndex == 5) ? 4 : 6;
-
-  var rect = gButton.getBoundingClientRect();
-  var popupstyle = window.getComputedStyle(gButton, "");
-  is(event.clientX, Math.round(rect.left + mod),
-     "step " + (gTestIndex + 1) + " clientX");
-  is(event.clientY, Math.round(rect.top + mod),
-     "step " + (gTestIndex + 1) + " clientY");
-  ok(event.screenX > 0, "step " + (gTestIndex + 1) + " screenX");
-  ok(event.screenY > 0, "step " + (gTestIndex + 1) + " screenY");
+  window.open("window_tooltip.xul", "_blank", "chrome,width=700,height=700");
 }
-
-var popupTests = [
-{
-  testname: "hover tooltiptext attribute",
-  events: [ "popupshowing #tooltip", "popupshown #tooltip" ],
-  test: function() {
-    gButton = document.getElementById("withtext");
-    disableNonTestMouse(true);
-    synthesizeMouse(gButton, 2, 2, { type: "mouseover" });
-    synthesizeMouse(gButton, 4, 4, { type: "mousemove" });
-    synthesizeMouse(gButton, 6, 6, { type: "mousemove" });
-    disableNonTestMouse(false);
-  }
-},
-{
-  testname: "close tooltip",
-  events: [ "popuphiding #tooltip", "popuphidden #tooltip",
-            "DOMMenuInactive #tooltip" ],
-  test: function() {
-    disableNonTestMouse(true);
-    synthesizeMouse(document.documentElement, 2, 2, { type: "mousemove" });
-    disableNonTestMouse(false);
-  }
-},
-{
-  testname: "hover inherited tooltip",
-  events: [ "popupshowing #tooltip", "popupshown #tooltip" ],
-  test: function() {
-    gButton = document.getElementById("without");
-    disableNonTestMouse(true);
-    synthesizeMouse(gButton, 2, 2, { type: "mouseover" });
-    synthesizeMouse(gButton, 4, 4, { type: "mousemove" });
-    synthesizeMouse(gButton, 6, 6, { type: "mousemove" });
-    disableNonTestMouse(false);
-  }
-},
-{
-  testname: "hover tooltip attribute",
-  events: [ "popuphiding #tooltip", "popuphidden #tooltip",
-            "DOMMenuInactive #tooltip",
-            "popupshowing thetooltip", "popupshown thetooltip" ],
-  test: function() {
-    gButton = document.getElementById("withtooltip");
-    gExpectedTriggerNode = gButton;
-    disableNonTestMouse(true);
-    synthesizeMouse(gButton, 2, 2, { type: "mouseover" });
-    synthesizeMouse(gButton, 4, 4, { type: "mousemove" });
-    synthesizeMouse(gButton, 6, 6, { type: "mousemove" });
-    disableNonTestMouse(false);
-  },
-  result: function(testname) {
-    var tooltip = document.getElementById("thetooltip");
-    gExpectedTriggerNode = null;
-    is(tooltip.triggerNode, gButton, testname + " triggerNode");
-    is(document.popupNode, null, testname + " document.popupNode");
-    is(document.tooltipNode, gButton, testname + " document.tooltipNode");
-
-    var child = $("childframe").contentDocument; 
-    var evt = child.createEvent("Event");
-    evt.initEvent("click", true, true);
-    child.documentElement.dispatchEvent(evt);
-    is(child.documentElement.getAttribute("data"), "xnull",
-       "cannot get tooltipNode from other document");
-
-    var buttonrect = document.getElementById("withtooltip").getBoundingClientRect();
-    var rect = tooltip.getBoundingClientRect();
-    var popupstyle = window.getComputedStyle(document.getElementById("thetooltip"), "");
-
-    is(Math.round(rect.left),
-       Math.round(buttonrect.left + parseFloat(popupstyle.marginLeft) + 6),
-       testname + " left position of tooltip");
-    is(Math.round(rect.top),
-       Math.round(buttonrect.top + parseFloat(popupstyle.marginTop) + 6),
-       testname + " top position of tooltip");
-
-    var labelrect = document.getElementById("label").getBoundingClientRect();
-    ok(labelrect.right < rect.right, testname + " tooltip width");
-    ok(labelrect.bottom < rect.bottom, testname + " tooltip height");
-
-    gOriginalWidth = rect.right - rect.left;
-    gOriginalHeight = rect.bottom - rect.top;
-  }
-},
-{
-  testname: "click to close tooltip",
-  events: [ "popuphiding thetooltip", "popuphidden thetooltip",
-            "command withtooltip", "DOMMenuInactive thetooltip" ],
-  test: function() {
-    gButton = document.getElementById("withtooltip");
-    synthesizeMouse(gButton, 2, 2, { });
-  },
-  result: function(testname) {
-    var tooltip = document.getElementById("thetooltip");
-    is(tooltip.triggerNode, null, testname + " triggerNode");
-    is(document.popupNode, null, testname + " document.popupNode");
-    is(document.tooltipNode, null, testname + " document.tooltipNode");
-  }
-},
-{
-  testname: "hover tooltip after size increased",
-  events: [ "popupshowing thetooltip", "popupshown thetooltip" ],
-  test: function() {
-    var label = document.getElementById("label");
-    label.removeAttribute("value");
-    label.textContent = "This is a longer tooltip than before\nIt has multiple lines\nIt is testing tooltip sizing\n";
-    gButton = document.getElementById("withtooltip");
-    disableNonTestMouse(true);
-    synthesizeMouse(gButton, 2, 2, { type: "mouseover" });
-    synthesizeMouse(gButton, 6, 6, { type: "mousemove" });
-    synthesizeMouse(gButton, 4, 4, { type: "mousemove" });
-    disableNonTestMouse(false);
-  },
-  result: function(testname) {
-    var buttonrect = document.getElementById("withtooltip").getBoundingClientRect();
-    var rect = document.getElementById("thetooltip").getBoundingClientRect();
-    var popupstyle = window.getComputedStyle(document.getElementById("thetooltip"), "");
-    var buttonstyle = window.getComputedStyle(document.getElementById("withtooltip"), "");
-
-    is(Math.round(rect.left),
-       Math.round(buttonrect.left + parseFloat(popupstyle.marginLeft) + 4),
-       testname + " left position of tooltip");
-    is(Math.round(rect.top),
-       Math.round(buttonrect.top + parseFloat(popupstyle.marginTop) + 4),
-       testname + " top position of tooltip");
-
-    var labelrect = document.getElementById("label").getBoundingClientRect();
-    ok(labelrect.right < rect.right, testname + " tooltip width");
-    ok(labelrect.bottom < rect.bottom, testname + " tooltip height");
-
-    // make sure that the tooltip is larger than it was before by just
-    // checking against the original height plus an arbitrary 15 pixels
-    ok(gOriginalWidth + 15 < rect.right - rect.left, testname + " tooltip is wider");
-    ok(gOriginalHeight + 15 < rect.bottom - rect.top, testname + " tooltip is taller");
-  }
-},
-{
-  testname: "close tooltip with hidePopup",
-  events: [ "popuphiding thetooltip", "popuphidden thetooltip",
-            "DOMMenuInactive thetooltip" ],
-  test: function() {
-    document.getElementById("thetooltip").hidePopup();
-  },
-},
-{
-  testname: "hover tooltip after size decreased",
-  events: [ "popupshowing thetooltip", "popupshown thetooltip" ],
-  autohide: "thetooltip",
-  test: function() {
-    var label = document.getElementById("label");
-    label.value = "This is a tooltip";
-    gButton = document.getElementById("withtooltip");
-    disableNonTestMouse(true);
-    synthesizeMouse(gButton, 2, 2, { type: "mouseover" });
-    synthesizeMouse(gButton, 4, 4, { type: "mousemove" });
-    synthesizeMouse(gButton, 6, 6, { type: "mousemove" });
-    disableNonTestMouse(false);
-  },
-  result: function(testname) {
-    var buttonrect = document.getElementById("withtooltip").getBoundingClientRect();
-    var rect = document.getElementById("thetooltip").getBoundingClientRect();
-    var popupstyle = window.getComputedStyle(document.getElementById("thetooltip"), "");
-    var buttonstyle = window.getComputedStyle(document.getElementById("withtooltip"), "");
-
-    is(Math.round(rect.left),
-       Math.round(buttonrect.left + parseFloat(popupstyle.marginLeft) + 6),
-       testname + " left position of tooltip");
-    is(Math.round(rect.top),
-       Math.round(buttonrect.top + parseFloat(popupstyle.marginTop) + 6),
-       testname + " top position of tooltip");
-
-    var labelrect = document.getElementById("label").getBoundingClientRect();
-    ok(labelrect.right < rect.right, testname + " tooltip width");
-    ok(labelrect.bottom < rect.bottom, testname + " tooltip height");
-
-    is(gOriginalWidth, rect.right - rect.left, testname + " tooltip is original width");
-    is(gOriginalHeight, rect.bottom - rect.top, testname + " tooltip is original height");
-  }
-}
-
-];
-
-SimpleTest.waitForFocus(runTest);
-]]>
 </script>
 
 <body xmlns="http://www.w3.org/1999/xhtml">
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/toolkit/content/tests/chrome/window_tooltip.xul thunderbird-1000~31.6.0+build1/mozilla/toolkit/content/tests/chrome/window_tooltip.xul
--- thunderbird-1000~31.4.0+build1/mozilla/toolkit/content/tests/chrome/window_tooltip.xul	1970-01-01 00:00:00.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/content/tests/chrome/window_tooltip.xul	2015-03-30 18:03:45.000000000 +0000
@@ -0,0 +1,249 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?>
+
+<window title="Tooltip Tests"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/EventUtils.js"></script>
+  <script type="application/javascript" src="popup_shared.js"></script>
+
+<tooltip id="thetooltip">
+  <label id="label" value="This is a tooltip"/>
+</tooltip>
+
+<box id="parent" tooltiptext="Box Tooltip" style="margin: 10px">
+  <button id="withtext" label="Tooltip Text" tooltiptext="Button Tooltip"
+          style="-moz-appearance: none; padding: 0;"/>
+  <button id="without" label="No Tooltip" style="-moz-appearance: none; padding: 0;"/>
+  <!-- remove the native theme and borders to avoid some platform
+       specific sizing differences -->
+  <button id="withtooltip" label="Tooltip Element" tooltip="thetooltip"
+          class="plain" style="-moz-appearance: none; padding: 0;"/>
+  <iframe id="childframe" type="content" width="10" height="10"
+          src="http://sectest2.example.org:80/chrome/toolkit/content/tests/chrome/popup_childframe_node.xul"/>
+</box>
+
+<script class="testbody" type="application/javascript">
+<![CDATA[
+
+var gOriginalWidth = -1;
+var gOriginalHeight = -1;
+var gButton = null;
+
+function runTest()
+{
+  startPopupTests(popupTests);
+}
+
+function checkCoords(event)
+{
+  // all but one test open the tooltip at the button location offset by 6
+  // in each direction. Test 5 opens it at 4 in each direction.
+  var mod = (gTestIndex == 5) ? 4 : 6;
+
+  var rect = gButton.getBoundingClientRect();
+  var popupstyle = window.getComputedStyle(gButton, "");
+  is(event.clientX, Math.round(rect.left + mod),
+     "step " + (gTestIndex + 1) + " clientX");
+  is(event.clientY, Math.round(rect.top + mod),
+     "step " + (gTestIndex + 1) + " clientY");
+  ok(event.screenX > 0, "step " + (gTestIndex + 1) + " screenX");
+  ok(event.screenY > 0, "step " + (gTestIndex + 1) + " screenY");
+}
+
+var popupTests = [
+{
+  testname: "hover tooltiptext attribute",
+  events: [ "popupshowing #tooltip", "popupshown #tooltip" ],
+  test: function() {
+    gButton = document.getElementById("withtext");
+    disableNonTestMouse(true);
+    synthesizeMouse(gButton, 2, 2, { type: "mouseover" });
+    synthesizeMouse(gButton, 4, 4, { type: "mousemove" });
+    synthesizeMouse(gButton, 6, 6, { type: "mousemove" });
+    disableNonTestMouse(false);
+  }
+},
+{
+  testname: "close tooltip",
+  events: [ "popuphiding #tooltip", "popuphidden #tooltip",
+            "DOMMenuInactive #tooltip" ],
+  test: function() {
+    disableNonTestMouse(true);
+    synthesizeMouse(document.documentElement, 2, 2, { type: "mousemove" });
+    disableNonTestMouse(false);
+  }
+},
+{
+  testname: "hover inherited tooltip",
+  events: [ "popupshowing #tooltip", "popupshown #tooltip" ],
+  test: function() {
+    gButton = document.getElementById("without");
+    disableNonTestMouse(true);
+    synthesizeMouse(gButton, 2, 2, { type: "mouseover" });
+    synthesizeMouse(gButton, 4, 4, { type: "mousemove" });
+    synthesizeMouse(gButton, 6, 6, { type: "mousemove" });
+    disableNonTestMouse(false);
+  }
+},
+{
+  testname: "hover tooltip attribute",
+  events: [ "popuphiding #tooltip", "popuphidden #tooltip",
+            "DOMMenuInactive #tooltip",
+            "popupshowing thetooltip", "popupshown thetooltip" ],
+  test: function() {
+    gButton = document.getElementById("withtooltip");
+    gExpectedTriggerNode = gButton;
+    disableNonTestMouse(true);
+    synthesizeMouse(gButton, 2, 2, { type: "mouseover" });
+    synthesizeMouse(gButton, 4, 4, { type: "mousemove" });
+    synthesizeMouse(gButton, 6, 6, { type: "mousemove" });
+    disableNonTestMouse(false);
+  },
+  result: function(testname) {
+    var tooltip = document.getElementById("thetooltip");
+    gExpectedTriggerNode = null;
+    is(tooltip.triggerNode, gButton, testname + " triggerNode");
+    is(document.popupNode, null, testname + " document.popupNode");
+    is(document.tooltipNode, gButton, testname + " document.tooltipNode");
+
+    var child = $("childframe").contentDocument; 
+    var evt = child.createEvent("Event");
+    evt.initEvent("click", true, true);
+    child.documentElement.dispatchEvent(evt);
+    is(child.documentElement.getAttribute("data"), "xnull",
+       "cannot get tooltipNode from other document");
+
+    var buttonrect = document.getElementById("withtooltip").getBoundingClientRect();
+    var rect = tooltip.getBoundingClientRect();
+    var popupstyle = window.getComputedStyle(document.getElementById("thetooltip"), "");
+
+    is(Math.round(rect.left),
+       Math.round(buttonrect.left + parseFloat(popupstyle.marginLeft) + 6),
+       testname + " left position of tooltip");
+    is(Math.round(rect.top),
+       Math.round(buttonrect.top + parseFloat(popupstyle.marginTop) + 6),
+       testname + " top position of tooltip");
+
+    var labelrect = document.getElementById("label").getBoundingClientRect();
+    ok(labelrect.right < rect.right, testname + " tooltip width");
+    ok(labelrect.bottom < rect.bottom, testname + " tooltip height");
+
+    gOriginalWidth = rect.right - rect.left;
+    gOriginalHeight = rect.bottom - rect.top;
+  }
+},
+{
+  testname: "click to close tooltip",
+  events: [ "popuphiding thetooltip", "popuphidden thetooltip",
+            "command withtooltip", "DOMMenuInactive thetooltip" ],
+  test: function() {
+    gButton = document.getElementById("withtooltip");
+    synthesizeMouse(gButton, 2, 2, { });
+  },
+  result: function(testname) {
+    var tooltip = document.getElementById("thetooltip");
+    is(tooltip.triggerNode, null, testname + " triggerNode");
+    is(document.popupNode, null, testname + " document.popupNode");
+    is(document.tooltipNode, null, testname + " document.tooltipNode");
+  }
+},
+{
+  testname: "hover tooltip after size increased",
+  events: [ "popupshowing thetooltip", "popupshown thetooltip" ],
+  test: function() {
+    var label = document.getElementById("label");
+    label.removeAttribute("value");
+    label.textContent = "This is a longer tooltip than before\nIt has multiple lines\nIt is testing tooltip sizing\n";
+    gButton = document.getElementById("withtooltip");
+    disableNonTestMouse(true);
+    synthesizeMouse(gButton, 2, 2, { type: "mouseover" });
+    synthesizeMouse(gButton, 6, 6, { type: "mousemove" });
+    synthesizeMouse(gButton, 4, 4, { type: "mousemove" });
+    disableNonTestMouse(false);
+  },
+  result: function(testname) {
+    var buttonrect = document.getElementById("withtooltip").getBoundingClientRect();
+    var rect = document.getElementById("thetooltip").getBoundingClientRect();
+    var popupstyle = window.getComputedStyle(document.getElementById("thetooltip"), "");
+    var buttonstyle = window.getComputedStyle(document.getElementById("withtooltip"), "");
+
+    is(Math.round(rect.left),
+       Math.round(buttonrect.left + parseFloat(popupstyle.marginLeft) + 4),
+       testname + " left position of tooltip");
+    is(Math.round(rect.top),
+       Math.round(buttonrect.top + parseFloat(popupstyle.marginTop) + 4),
+       testname + " top position of tooltip");
+
+    var labelrect = document.getElementById("label").getBoundingClientRect();
+    ok(labelrect.right < rect.right, testname + " tooltip width");
+    ok(labelrect.bottom < rect.bottom, testname + " tooltip height");
+
+    // make sure that the tooltip is larger than it was before by just
+    // checking against the original height plus an arbitrary 15 pixels
+    ok(gOriginalWidth + 15 < rect.right - rect.left, testname + " tooltip is wider");
+    ok(gOriginalHeight + 15 < rect.bottom - rect.top, testname + " tooltip is taller");
+  }
+},
+{
+  testname: "close tooltip with hidePopup",
+  events: [ "popuphiding thetooltip", "popuphidden thetooltip",
+            "DOMMenuInactive thetooltip" ],
+  test: function() {
+    document.getElementById("thetooltip").hidePopup();
+  },
+},
+{
+  testname: "hover tooltip after size decreased",
+  events: [ "popupshowing thetooltip", "popupshown thetooltip" ],
+  autohide: "thetooltip",
+  test: function() {
+    var label = document.getElementById("label");
+    label.value = "This is a tooltip";
+    gButton = document.getElementById("withtooltip");
+    disableNonTestMouse(true);
+    synthesizeMouse(gButton, 2, 2, { type: "mouseover" });
+    synthesizeMouse(gButton, 4, 4, { type: "mousemove" });
+    synthesizeMouse(gButton, 6, 6, { type: "mousemove" });
+    disableNonTestMouse(false);
+  },
+  result: function(testname) {
+    var buttonrect = document.getElementById("withtooltip").getBoundingClientRect();
+    var rect = document.getElementById("thetooltip").getBoundingClientRect();
+    var popupstyle = window.getComputedStyle(document.getElementById("thetooltip"), "");
+    var buttonstyle = window.getComputedStyle(document.getElementById("withtooltip"), "");
+
+    is(Math.round(rect.left),
+       Math.round(buttonrect.left + parseFloat(popupstyle.marginLeft) + 6),
+       testname + " left position of tooltip");
+    is(Math.round(rect.top),
+       Math.round(buttonrect.top + parseFloat(popupstyle.marginTop) + 6),
+       testname + " top position of tooltip");
+
+    var labelrect = document.getElementById("label").getBoundingClientRect();
+    ok(labelrect.right < rect.right, testname + " tooltip width");
+    ok(labelrect.bottom < rect.bottom, testname + " tooltip height");
+
+    is(gOriginalWidth, rect.right - rect.left, testname + " tooltip is original width");
+    is(gOriginalHeight, rect.bottom - rect.top, testname + " tooltip is original height");
+  }
+}
+
+];
+
+window.opener.wrappedJSObject.SimpleTest.waitForFocus(runTest, window);
+]]>
+</script>
+
+<body xmlns="http://www.w3.org/1999/xhtml">
+<p id="display">
+</p>
+<div id="content" style="display: none">
+</div>
+<pre id="test">
+</pre>
+</body>
+
+</window>
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/toolkit/content/widgets/autocomplete.xml thunderbird-1000~31.6.0+build1/mozilla/toolkit/content/widgets/autocomplete.xml
--- thunderbird-1000~31.4.0+build1/mozilla/toolkit/content/widgets/autocomplete.xml	2015-01-12 17:51:23.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/content/widgets/autocomplete.xml	2015-03-30 18:03:45.000000000 +0000
@@ -340,12 +340,8 @@
 
       <method name="detachController">
         <body><![CDATA[
-          try {
-            if  (this.mController.input == this)
+          if (this.mController.input == this)
             this.mController.input = null;
-          } catch (ex) {
-            // nothing really to do.
-          }
         ]]></body>
       </method>
 
@@ -591,8 +587,13 @@
       <handler event="focus" phase="capturing"
                action="this.attachController();"/>
 
-      <handler event="blur" phase="capturing"
-               action="if (!this._dontBlur) this.detachController();"/>
+      <handler event="blur" phase="capturing"><![CDATA[
+        if (!this._dontBlur) {
+          if (this.forceComplete && this.mController.matchCount >= 1)
+            this.mController.handleEnter(false);
+          this.detachController();
+        }
+      ]]></handler>
     </handlers>
   </binding>
 
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/toolkit/mozapps/update/nsUpdateService.js thunderbird-1000~31.6.0+build1/mozilla/toolkit/mozapps/update/nsUpdateService.js
--- thunderbird-1000~31.4.0+build1/mozilla/toolkit/mozapps/update/nsUpdateService.js	2015-01-12 17:51:25.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/mozapps/update/nsUpdateService.js	2015-03-30 18:03:46.000000000 +0000
@@ -2921,7 +2921,7 @@
         if (status == STATE_NONE)
           cleanupActiveUpdate();
         self._update = null;
-        this._backgroundUpdateCheckCodePing(PING_BGUC_CHECK_NO_INCOMPAT);
+        self._backgroundUpdateCheckCodePing(PING_BGUC_CHECK_NO_INCOMPAT);
       }
     });
   },
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/toolkit/mozapps/update/updater/loaddlls.cpp thunderbird-1000~31.6.0+build1/mozilla/toolkit/mozapps/update/updater/loaddlls.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/toolkit/mozapps/update/updater/loaddlls.cpp	2015-01-12 17:51:25.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/mozapps/update/updater/loaddlls.cpp	2015-03-30 18:03:46.000000000 +0000
@@ -5,6 +5,13 @@
 
 #include <windows.h>
 
+// Support SDK's that don't have LOAD_LIBRARY_SEARCH_SYSTEM32 or
+// SetDefaultDllDirectories.
+#ifndef NTDDI_WIN8
+#define LOAD_LIBRARY_SEARCH_SYSTEM32 0x00000800
+#endif
+typedef BOOL (WINAPI *SetDefaultDllDirectoriesFunction) (DWORD DirectoryFlags);
+
 // Delayed load libraries are loaded when the first symbol is used.
 // The following ensures that we load the delayed loaded libraries from the
 // system directory.
@@ -16,20 +23,66 @@
     // DLLs as a precaution.  This call has no effect for delay load DLLs.
     SetDllDirectory(L"");
 
-    // The order that these are loaded matter, for example if we load something
-    // that tries to load profapi.dll first, then profapi.dll would be loaded
-    // wrongly from the current directory.
-    static LPCWSTR delayDLLs[] = { L"profapi.dll", L"wsock32.dll",
-                                   L"crypt32.dll", L"cryptsp.dll",
-                                   L"cryptbase.dll", L"msasn1.dll",
-                                   L"userenv.dll", L"secur32.dll",
-                                   L"ws2_32.dll", L"ws2help.dll",
-                                   L"apphelp.dll", L"bcryptprimitives.dll" };
+    HMODULE module = ::GetModuleHandleW(L"kernel32.dll");
+    if (module) {
+      // SetDefaultDllDirectories is always available on Windows 8 and above. It
+      // is also available on Windows Vista, Windows Server 2008, and
+      // Windows 7 when MS KB2533623 has been applied.
+      SetDefaultDllDirectoriesFunction setDefaultDllDirectories =
+          reinterpret_cast<SetDefaultDllDirectoriesFunction>(
+              ::GetProcAddress(module, "SetDefaultDllDirectories"));
+      if (setDefaultDllDirectories) {
+        setDefaultDllDirectories(LOAD_LIBRARY_SEARCH_SYSTEM32);
+        return;
+      }
+    }
+
+    // When SetDefaultDllDirectories is not available, fallback to preloading
+    // dlls. The order that these are loaded does not matter since they are
+    // loaded using the LOAD_WITH_ALTERED_SEARCH_PATH flag.
+#ifdef HAVE_64BIT_BUILD
+    // DLLs for Firefox x64 on Windows 7 (x64).
+    // Note: dwmapi.dll is preloaded since a crash will try to load it from the
+    // application's directory.
+    static LPCWSTR delayDLLs[] = { L"apphelp.dll",
+                                   L"cryptbase.dll",
+                                   L"cryptsp.dll",
+                                   L"dwmapi.dll",
+                                   L"mpr.dll",
+                                   L"ntmarta.dll",
+                                   L"profapi.dll",
+                                   L"propsys.dll",
+                                   L"sspicli.dll",
+                                   L"wsock32.dll" };
+
+#else
+    // DLLs for Firefox x86 on Windows XP through Windows 7 (x86 and x64).
+    // Note: dwmapi.dll is preloaded since a crash will try to load it from the
+    // application's directory.
+    static LPCWSTR delayDLLs[] = { L"apphelp.dll",
+                                   L"crypt32.dll",
+                                   L"cryptbase.dll",
+                                   L"cryptsp.dll",
+                                   L"dwmapi.dll",
+                                   L"mpr.dll",
+                                   L"msasn1.dll",
+                                   L"ntmarta.dll",
+                                   L"profapi.dll",
+                                   L"propsys.dll",
+                                   L"psapi.dll",
+                                   L"secur32.dll",
+                                   L"sspicli.dll",
+                                   L"userenv.dll",
+                                   L"uxtheme.dll",
+                                   L"ws2_32.dll",
+                                   L"ws2help.dll",
+                                   L"wsock32.dll" };
+#endif
 
     WCHAR systemDirectory[MAX_PATH + 1] = { L'\0' };
     // If GetSystemDirectory fails we accept that we'll load the DLLs from the
     // normal search path.
-    GetSystemDirectory(systemDirectory, MAX_PATH + 1);
+    GetSystemDirectoryW(systemDirectory, MAX_PATH + 1);
     size_t systemDirLen = wcslen(systemDirectory);
 
     // Make the system directory path terminate with a slash
@@ -42,7 +95,7 @@
     // For each known DLL ensure it is loaded from the system32 directory
     for (size_t i = 0; i < sizeof(delayDLLs) / sizeof(delayDLLs[0]); ++i) {
       size_t fileLen = wcslen(delayDLLs[i]);
-      wcsncpy(systemDirectory + systemDirLen, delayDLLs[i], 
+      wcsncpy(systemDirectory + systemDirLen, delayDLLs[i],
               MAX_PATH - systemDirLen);
       if (systemDirLen + fileLen <= MAX_PATH) {
         systemDirectory[systemDirLen + fileLen] = L'\0';
@@ -50,7 +103,9 @@
         systemDirectory[MAX_PATH] = L'\0';
       }
       LPCWSTR fullModulePath = systemDirectory; // just for code readability
-      LoadLibraryW(fullModulePath);
+      // LOAD_WITH_ALTERED_SEARCH_PATH makes a dll look in its own directory for
+      // dependencies and is only available on Win 7 and below.
+      LoadLibraryExW(fullModulePath, nullptr, LOAD_WITH_ALTERED_SEARCH_PATH);
     }
   }
 } loadDLLs;
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/toolkit/mozapps/update/updater/moz.build thunderbird-1000~31.6.0+build1/mozilla/toolkit/mozapps/update/updater/moz.build
--- thunderbird-1000~31.4.0+build1/mozilla/toolkit/mozapps/update/updater/moz.build	2015-01-12 17:51:25.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/mozapps/update/updater/moz.build	2015-03-30 18:03:46.000000000 +0000
@@ -67,6 +67,7 @@
 
 DELAYLOAD_DLLS += [
     'crypt32.dll',
+    'comctl32.dll',
     'userenv.dll',
     'wsock32.dll',
 ]
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/toolkit/mozapps/update/updater/progressui_win.cpp thunderbird-1000~31.6.0+build1/mozilla/toolkit/mozapps/update/updater/progressui_win.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/toolkit/mozapps/update/updater/progressui_win.cpp	2015-01-12 17:51:25.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/mozapps/update/updater/progressui_win.cpp	2015-03-30 18:03:46.000000000 +0000
@@ -200,7 +200,7 @@
 }
 
 int
-InitProgressUI(int *argc, NS_tchar ***argv)
+InitProgressUI(int *argc, WCHAR ***argv)
 {
   return 0;
 }
@@ -245,10 +245,49 @@
       return 0;
   }
 
+  // Don't load the UI if there's an <exe_name>.Local directory for redirection.
+  WCHAR appPath[MAX_PATH + 1] = { L'\0' };
+  if (!GetModuleFileNameW(nullptr, appPath, MAX_PATH)) {
+    return -1;
+  }
+
+  if (wcslen(appPath) + wcslen(L".Local") >= MAX_PATH) {
+    return -1;
+  }
+
+  wcscat(appPath, L".Local");
+
+  if (!_waccess(appPath, 04)) {
+    return -1;
+  }
+
+  // Don't load the UI if the strings for the UI are not provided.
   if (initUIStrings && InitProgressUIStrings() == -1) {
     return -1;
   }
 
+  if (!GetModuleFileNameW(nullptr, appPath, MAX_PATH)) {
+    return -1;
+  }
+
+  // Use an activation context that supports visual styles for the controls.
+  ACTCTXW actx = {0};
+  actx.cbSize = sizeof(ACTCTXW);
+  actx.dwFlags = ACTCTX_FLAG_RESOURCE_NAME_VALID | ACTCTX_FLAG_HMODULE_VALID;
+  actx.hModule = GetModuleHandle(NULL); // Use the embedded manifest
+  // This is needed only for Win XP but doesn't cause a problem with other
+  // versions of Windows.
+  actx.lpSource = appPath;
+  actx.lpResourceName = MAKEINTRESOURCE(IDR_COMCTL32_MANIFEST);
+
+  HANDLE hactx = INVALID_HANDLE_VALUE;
+  hactx = CreateActCtxW(&actx);
+  ULONG_PTR actxCookie = NULL;
+  if (hactx != INVALID_HANDLE_VALUE) {
+    // Push the specified activation context to the top of the activation stack.
+    ActivateActCtx(hactx, &actxCookie);
+  }
+
   INITCOMMONCONTROLSEX icc = {
     sizeof(INITCOMMONCONTROLSEX),
     ICC_PROGRESS_CLASS
@@ -259,6 +298,11 @@
             MAKEINTRESOURCE(IDD_DIALOG), nullptr,
             (DLGPROC) DialogProc);
 
+  if (hactx != INVALID_HANDLE_VALUE) {
+    // Deactivate the context now that the comctl32.dll is loaded.
+    DeactivateActCtx(0, actxCookie);
+  }
+
   return 0;
 }
 
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/toolkit/mozapps/update/updater/resource.h thunderbird-1000~31.6.0+build1/mozilla/toolkit/mozapps/update/updater/resource.h
--- thunderbird-1000~31.4.0+build1/mozilla/toolkit/mozapps/update/updater/resource.h	2015-01-12 17:51:25.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/mozapps/update/updater/resource.h	2015-03-30 18:03:46.000000000 +0000
@@ -15,6 +15,7 @@
 #define IDR_BACKUP_CERT                 1005
 #define IDS_UPDATER_IDENTITY            1006
 #define IDR_XPCSHELL_CERT               1007
+#define IDR_COMCTL32_MANIFEST           17
 
 // Next default values for new objects
 // 
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/toolkit/mozapps/update/updater/updater.cpp thunderbird-1000~31.6.0+build1/mozilla/toolkit/mozapps/update/updater/updater.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/toolkit/mozapps/update/updater/updater.cpp	2015-01-12 17:51:25.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/mozapps/update/updater/updater.cpp	2015-03-30 18:03:46.000000000 +0000
@@ -2228,7 +2228,42 @@
 
 #ifdef MOZ_VERIFY_MAR_SIGNATURE
     if (rv == OK) {
+#ifdef XP_WIN
+      HKEY baseKey = nullptr;
+      wchar_t valueName[] = L"Image Path";
+      wchar_t rasenh[] = L"rsaenh.dll";
+      bool reset = false;
+      if (RegOpenKeyExW(HKEY_LOCAL_MACHINE,
+                        L"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\Microsoft Enhanced Cryptographic Provider v1.0",
+                        0, KEY_READ | KEY_WRITE,
+                        &baseKey) == ERROR_SUCCESS) {
+        wchar_t path[MAX_PATH + 1];
+        DWORD size = sizeof(path);
+        DWORD type;
+        if (RegQueryValueExW(baseKey, valueName, 0, &type,
+                             (LPBYTE)path, &size) == ERROR_SUCCESS) {
+          if (type == REG_SZ && wcscmp(path, rasenh) == 0) {
+            wchar_t rasenhFullPath[] = L"%SystemRoot%\\System32\\rsaenh.dll";
+            if (RegSetValueExW(baseKey, valueName, 0, REG_SZ,
+                               (const BYTE*)rasenhFullPath,
+                               sizeof(rasenhFullPath)) == ERROR_SUCCESS) {
+              reset = true;
+            }
+          }
+        }
+      }
+#endif
       rv = gArchiveReader.VerifySignature();
+#ifdef XP_WIN
+      if (baseKey) {
+        if (reset) {
+          RegSetValueExW(baseKey, valueName, 0, REG_SZ,
+                         (const BYTE*)rasenh,
+                         sizeof(rasenh));
+        }
+        RegCloseKey(baseKey);
+      }
+#endif
     }
 
     if (rv == OK) {
@@ -2405,7 +2440,7 @@
 
   // Remove everything except close window from the context menu
   {
-    HKEY hkApp;
+    HKEY hkApp = nullptr;
     RegCreateKeyExW(HKEY_CURRENT_USER, L"Software\\Classes\\Applications",
                     0, nullptr, REG_OPTION_NON_VOLATILE, KEY_SET_VALUE, nullptr,
                     &hkApp, nullptr);
@@ -2639,7 +2674,7 @@
     // updater, then we drop the permissions here. We do not drop the 
     // permissions on the originally called updater because we use its token
     // to start the callback application.
-    if(startedFromUnelevatedUpdater) {
+    if (startedFromUnelevatedUpdater) {
       // Disable every privilege we don't need. Processes started using
       // CreateProcess will use the same token as this process.
       UACHelper::DisablePrivileges(nullptr);
@@ -2704,7 +2739,7 @@
       if (useService) {
         WCHAR maintenanceServiceKey[MAX_PATH + 1];
         if (CalculateRegistryPathFromFilePath(installDir, maintenanceServiceKey)) {
-          HKEY baseKey;
+          HKEY baseKey = nullptr;
           if (RegOpenKeyExW(HKEY_LOCAL_MACHINE, 
                             maintenanceServiceKey, 0, 
                             KEY_READ | KEY_WOW64_64KEY, 
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/toolkit/mozapps/update/updater/updater.exe.comctl32.manifest thunderbird-1000~31.6.0+build1/mozilla/toolkit/mozapps/update/updater/updater.exe.comctl32.manifest
--- thunderbird-1000~31.4.0+build1/mozilla/toolkit/mozapps/update/updater/updater.exe.comctl32.manifest	1970-01-01 00:00:00.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/mozapps/update/updater/updater.exe.comctl32.manifest	2015-03-30 18:03:46.000000000 +0000
@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
+<assemblyIdentity
+        version="1.0.0.0"
+        processorArchitecture="*"
+        name="Updater"
+        type="win32"
+/>
+<description>Updater</description>
+<dependency>
+  <dependentAssembly>
+    <assemblyIdentity
+            type="win32"
+            name="Microsoft.Windows.Common-Controls"
+            version="6.0.0.0"
+            processorArchitecture="*"
+            publicKeyToken="6595b64144ccf1df"
+            language="*"
+    />
+  </dependentAssembly>
+</dependency>
+<ms_asmv3:trustInfo xmlns:ms_asmv3="urn:schemas-microsoft-com:asm.v3">
+  <ms_asmv3:security>
+    <ms_asmv3:requestedPrivileges>
+      <ms_asmv3:requestedExecutionLevel level="asInvoker" uiAccess="false" />
+    </ms_asmv3:requestedPrivileges>
+  </ms_asmv3:security>
+</ms_asmv3:trustInfo>
+  <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
+    <application>
+      <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
+      <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
+      <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
+      <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
+      <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
+    </application>
+  </compatibility>
+</assembly>
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/toolkit/mozapps/update/updater/updater.exe.manifest thunderbird-1000~31.6.0+build1/mozilla/toolkit/mozapps/update/updater/updater.exe.manifest
--- thunderbird-1000~31.4.0+build1/mozilla/toolkit/mozapps/update/updater/updater.exe.manifest	2015-01-12 17:51:25.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/mozapps/update/updater/updater.exe.manifest	2015-03-30 18:03:46.000000000 +0000
@@ -7,18 +7,6 @@
         type="win32"
 />
 <description>Updater</description>
-<dependency>
-        <dependentAssembly>
-                <assemblyIdentity
-                        type="win32"
-                        name="Microsoft.Windows.Common-Controls"
-                        version="6.0.0.0"
-                        processorArchitecture="*"
-                        publicKeyToken="6595b64144ccf1df"
-                        language="*"
-                />
-        </dependentAssembly>
-</dependency>
 <ms_asmv3:trustInfo xmlns:ms_asmv3="urn:schemas-microsoft-com:asm.v3">
   <ms_asmv3:security>
     <ms_asmv3:requestedPrivileges>
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/toolkit/mozapps/update/updater/updater.rc thunderbird-1000~31.6.0+build1/mozilla/toolkit/mozapps/update/updater/updater.rc
--- thunderbird-1000~31.4.0+build1/mozilla/toolkit/mozapps/update/updater/updater.rc	2015-01-12 17:51:25.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/toolkit/mozapps/update/updater/updater.rc	2015-03-30 18:03:46.000000000 +0000
@@ -31,6 +31,7 @@
 //
 
 1                       RT_MANIFEST             "updater.exe.manifest"
+IDR_COMCTL32_MANIFEST   RT_MANIFEST             "updater.exe.comctl32.manifest"
 
 /////////////////////////////////////////////////////////////////////////////
 //
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/uriloader/exthandler/tests/mochitest/handlerApps.js thunderbird-1000~31.6.0+build1/mozilla/uriloader/exthandler/tests/mochitest/handlerApps.js
--- thunderbird-1000~31.4.0+build1/mozilla/uriloader/exthandler/tests/mochitest/handlerApps.js	2015-01-12 17:51:25.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/uriloader/exthandler/tests/mochitest/handlerApps.js	2015-03-30 18:03:47.000000000 +0000
@@ -9,14 +9,6 @@
 
 function test() {
 
-  const isOSXMtnLion = navigator.userAgent.indexOf("Mac OS X 10.8") != -1;
-  const isOSXMavericks = navigator.userAgent.indexOf("Mac OS X 10.9") != -1;
-  if (isOSXMtnLion || isOSXMavericks) {
-    todo(false, "This test fails on OS X 10.8 and 10.9, see bug 786938");
-    SimpleTest.finish();
-    return;
-  }
-
   // set up the web handler object
   var webHandler = Cc["@mozilla.org/uriloader/web-handler-app;1"].
     createInstance(SpecialPowers.Ci.nsIWebHandlerApp);
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/uriloader/exthandler/tests/mochitest/mochitest.ini thunderbird-1000~31.6.0+build1/mozilla/uriloader/exthandler/tests/mochitest/mochitest.ini
--- thunderbird-1000~31.4.0+build1/mozilla/uriloader/exthandler/tests/mochitest/mochitest.ini	2015-01-12 17:51:25.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/uriloader/exthandler/tests/mochitest/mochitest.ini	2015-03-30 18:03:47.000000000 +0000
@@ -7,5 +7,5 @@
 
 [test_badMimeType.html]
 [test_handlerApps.xhtml]
-skip-if = toolkit == 'android'
+skip-if = (toolkit == 'android' || os == 'mac') # OS X: bug 786938
 [test_unsafeBidiChars.xhtml]
diff -Nru thunderbird-1000~31.4.0+build1/mozilla/xpcom/threads/TimerThread.cpp thunderbird-1000~31.6.0+build1/mozilla/xpcom/threads/TimerThread.cpp
--- thunderbird-1000~31.4.0+build1/mozilla/xpcom/threads/TimerThread.cpp	2015-01-12 17:51:26.000000000 +0000
+++ thunderbird-1000~31.6.0+build1/mozilla/xpcom/threads/TimerThread.cpp	2015-03-30 18:03:48.000000000 +0000
@@ -239,43 +239,44 @@
           RemoveTimerInternal(timer);
           timer = nullptr;
 
+#ifdef DEBUG_TIMERS
+          if (PR_LOG_TEST(GetTimerLog(), PR_LOG_DEBUG)) {
+            PR_LOG(GetTimerLog(), PR_LOG_DEBUG,
+                   ("Timer thread woke up %fms from when it was supposed to\n",
+                    fabs((now - timerRef->mTimeout).ToMilliseconds())));
+          }
+#endif
+
           {
             // We release mMonitor around the Fire call to avoid deadlock.
             MonitorAutoUnlock unlock(mMonitor);
 
-#ifdef DEBUG_TIMERS
-            if (PR_LOG_TEST(GetTimerLog(), PR_LOG_DEBUG)) {
-              PR_LOG(GetTimerLog(), PR_LOG_DEBUG,
-                     ("Timer thread woke up %fms from when it was supposed to\n",
-                      fabs((now - timerRef->mTimeout).ToMilliseconds())));
-            }
-#endif
 
             // We are going to let the call to PostTimerEvent here handle the
             // release of the timer so that we don't end up releasing the timer
             // on the TimerThread instead of on the thread it targets.
             timerRef = nsTimerImpl::PostTimerEvent(timerRef.forget());
+          }
 
-            if (timerRef) {
-              // We got our reference back due to an error.
-              // Unhook the nsRefPtr, and release manually so we can get the
-              // refcount.
-              nsrefcnt rc = timerRef.forget().take()->Release();
-              (void)rc;
-
-              // The nsITimer interface requires that its users keep a reference
-              // to the timers they use while those timers are initialized but
-              // have not yet fired.  If this ever happens, it is a bug in the
-              // code that created and used the timer.
-              //
-              // Further, note that this should never happen even with a
-              // misbehaving user, because nsTimerImpl::Release checks for a
-              // refcount of 1 with an armed timer (a timer whose only reference
-              // is from the timer thread) and when it hits this will remove the
-              // timer from the timer thread and thus destroy the last reference,
-              // preventing this situation from occurring.
-              MOZ_ASSERT(rc != 0, "destroyed timer off its target thread!");
-            }
+          if (timerRef) {
+            // We got our reference back due to an error.
+            // Unhook the nsRefPtr, and release manually so we can get the
+            // refcount.
+            nsrefcnt rc = timerRef.forget().take()->Release();
+            (void)rc;
+
+            // The nsITimer interface requires that its users keep a reference
+            // to the timers they use while those timers are initialized but
+            // have not yet fired.  If this ever happens, it is a bug in the
+            // code that created and used the timer.
+            //
+            // Further, note that this should never happen even with a
+            // misbehaving user, because nsTimerImpl::Release checks for a
+            // refcount of 1 with an armed timer (a timer whose only reference
+            // is from the timer thread) and when it hits this will remove the
+            // timer from the timer thread and thus destroy the last reference,
+            // preventing this situation from occurring.
+            MOZ_ASSERT(rc != 0, "destroyed timer off its target thread!");
           }
 
           if (mShutdown)