diff -Nru seamonkey-1.1.11+nobinonly/browser/config/version.txt seamonkey-1.1.12+nobinonly/browser/config/version.txt
--- seamonkey-1.1.11+nobinonly/browser/config/version.txt	2008-07-03 00:57:44.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/browser/config/version.txt	2008-08-30 01:12:02.000000000 +0200
@@ -1 +1 @@
-2.0.0.16
+2.0.0.17
diff -Nru seamonkey-1.1.11+nobinonly/client.mk seamonkey-1.1.12+nobinonly/client.mk
--- seamonkey-1.1.11+nobinonly/client.mk	2008-07-03 00:57:02.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/client.mk	2008-08-30 01:11:16.000000000 +0200
@@ -257,11 +257,11 @@
 #
 # For branches, uncomment the MOZ_CO_TAG line with the proper tag,
 # and commit this file on that tag.
-MOZ_CO_TAG           = SEAMONKEY_1_1_11_RELEASE
-NSPR_CO_TAG          = SEAMONKEY_1_1_11_RELEASE
-NSS_CO_TAG           = SEAMONKEY_1_1_11_RELEASE
-LDAPCSDK_CO_TAG      = SEAMONKEY_1_1_11_RELEASE
-LOCALES_CO_TAG       = SEAMONKEY_1_1_11_RELEASE
+MOZ_CO_TAG           = SEAMONKEY_1_1_12_RELEASE
+NSPR_CO_TAG          = SEAMONKEY_1_1_12_RELEASE
+NSS_CO_TAG           = SEAMONKEY_1_1_12_RELEASE
+LDAPCSDK_CO_TAG      = SEAMONKEY_1_1_12_RELEASE
+LOCALES_CO_TAG       = SEAMONKEY_1_1_12_RELEASE
 
 NSS_FIPS_CO_TAG      = NSS_3_11_4_RTM
 NSS_FIPS_CO_DIR      = nss-fips
diff -Nru seamonkey-1.1.11+nobinonly/config/milestone.txt seamonkey-1.1.12+nobinonly/config/milestone.txt
--- seamonkey-1.1.11+nobinonly/config/milestone.txt	2008-07-03 01:00:44.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/config/milestone.txt	2008-08-30 01:14:45.000000000 +0200
@@ -10,4 +10,4 @@
 # hardcoded milestones in the tree from these two files.
 #--------------------------------------------------------
 
-1.8.1.16
+1.8.1.17
diff -Nru seamonkey-1.1.11+nobinonly/content/base/src/nsDocument.cpp seamonkey-1.1.12+nobinonly/content/base/src/nsDocument.cpp
--- seamonkey-1.1.11+nobinonly/content/base/src/nsDocument.cpp	2008-03-13 20:10:47.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/content/base/src/nsDocument.cpp	2008-08-30 01:15:18.000000000 +0200
@@ -2198,6 +2198,7 @@
   mScriptGlobalObject = aScriptGlobalObject;
 
   if (aScriptGlobalObject) {
+    mScriptObject = nsnull;
     mHasHadScriptHandlingObject = PR_TRUE;
     // Go back to using the docshell for the layout history state
     mLayoutHistoryState = nsnull;
diff -Nru seamonkey-1.1.11+nobinonly/content/base/src/nsDocument.h seamonkey-1.1.12+nobinonly/content/base/src/nsDocument.h
--- seamonkey-1.1.11+nobinonly/content/base/src/nsDocument.h	2008-01-29 20:30:56.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/content/base/src/nsDocument.h	2008-08-30 01:15:18.000000000 +0200
@@ -546,6 +546,11 @@
   virtual nsIScriptGlobalObject*
     GetScriptHandlingObject(PRBool& aHasHadScriptHandlingObject) const;
   virtual void SetScriptHandlingObject(nsIScriptGlobalObject* aScriptObject);
+  void ClearScriptHandlingObject()
+  {
+    mScriptObject = nsnull;
+    mHasHadScriptHandlingObject = PR_TRUE;
+  }
 
   virtual nsIScriptGlobalObject* GetScopeObject();
 
diff -Nru seamonkey-1.1.11+nobinonly/content/base/src/nsXMLHttpRequest.cpp seamonkey-1.1.12+nobinonly/content/base/src/nsXMLHttpRequest.cpp
--- seamonkey-1.1.11+nobinonly/content/base/src/nsXMLHttpRequest.cpp	2008-07-03 01:01:06.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/content/base/src/nsXMLHttpRequest.cpp	2008-08-30 01:15:19.000000000 +0200
@@ -1293,6 +1293,8 @@
   nsCOMPtr<nsIChannel> channel(do_QueryInterface(request));
   NS_ENSURE_TRUE(channel, NS_ERROR_UNEXPECTED);
 
+  mChannel->SetOwner(mPrincipal);
+
   mReadRequest = request;
   mContext = ctxt;
   mState |= XML_HTTP_REQUEST_PARSEBODY;
@@ -1327,6 +1329,9 @@
                                       getter_AddRefs(mDocument));
   if (NS_FAILED(rv)) return NS_ERROR_FAILURE;
 
+  nsCOMPtr<nsIDocument> doc(do_QueryInterface(mDocument));
+  doc->SetPrincipal(mPrincipal);
+
   // Reset responseBody
   mResponseBody.Truncate();
 
diff -Nru seamonkey-1.1.11+nobinonly/content/html/content/src/Makefile.in seamonkey-1.1.12+nobinonly/content/html/content/src/Makefile.in
--- seamonkey-1.1.11+nobinonly/content/html/content/src/Makefile.in	2005-04-18 08:33:21.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/content/html/content/src/Makefile.in	2008-08-30 01:15:19.000000000 +0200
@@ -144,6 +144,7 @@
 		-I$(srcdir)/../../../events/src \
 		-I$(srcdir)/../../../xbl/src \
 		-I$(srcdir)/../../../../layout/style \
+		-I$(srcdir)/../../../../layout/tables \
 		-I$(srcdir) \
 		$(NULL)
 
diff -Nru seamonkey-1.1.11+nobinonly/content/html/content/src/nsHTMLTableCellElement.cpp seamonkey-1.1.12+nobinonly/content/html/content/src/nsHTMLTableCellElement.cpp
--- seamonkey-1.1.11+nobinonly/content/html/content/src/nsHTMLTableCellElement.cpp	2005-03-06 19:33:12.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/content/html/content/src/nsHTMLTableCellElement.cpp	2008-08-30 01:15:19.000000000 +0200
@@ -45,6 +45,7 @@
 #include "nsPresContext.h"
 #include "nsRuleData.h"
 #include "nsIDocument.h"
+#include "celldata.h"
 
 class nsHTMLTableCellElement : public nsGenericHTMLElement,
                                public nsIDOMHTMLTableCellElement
@@ -259,9 +260,6 @@
   { 0 }
 };
 
-#define MAX_ROWSPAN 8190 // celldata.h can not handle more
-#define MAX_COLSPAN 1000 // limit as IE and opera do
-
 PRBool
 nsHTMLTableCellElement::ParseAttribute(nsIAtom* aAttribute,
                                        const nsAString& aValue,
diff -Nru seamonkey-1.1.11+nobinonly/content/xbl/src/nsXBLService.cpp seamonkey-1.1.12+nobinonly/content/xbl/src/nsXBLService.cpp
--- seamonkey-1.1.11+nobinonly/content/xbl/src/nsXBLService.cpp	2007-11-19 21:38:45.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/content/xbl/src/nsXBLService.cpp	2008-08-30 01:15:20.000000000 +0200
@@ -90,6 +90,7 @@
 #endif
 #include "nsIDOMLoadListener.h"
 #include "nsIDOMEventGroup.h"
+#include "nsDocument.h"
 
 // Static IIDs/CIDs. Try to minimize these.
 static NS_DEFINE_CID(kXMLDocumentCID,             NS_XMLDOCUMENT_CID);
@@ -371,6 +372,10 @@
     NS_WARNING("XBL load did not complete until after document went away! Modal dialog bug?\n");
   }
   else {
+    // Clear script handling object on asynchronously loaded XBL documents.
+    NS_STATIC_CAST(nsDocument*, NS_STATIC_CAST(nsIDocument*, doc.get()))->
+      ClearScriptHandlingObject();
+
     // We have to do a flush prior to notification of the document load.
     // This has to happen since the HTML content sink can be holding on
     // to notifications related to our children (e.g., if you bind to the
@@ -1225,6 +1230,11 @@
   }
   NS_ENSURE_SUCCESS(rv, rv);
 
+  nsCOMPtr<nsIDocument> doc = do_QueryInterface(domDoc);
+  // Clear script handling object on synchronously loaded XBL documents.
+  NS_STATIC_CAST(nsDocument*, NS_STATIC_CAST(nsIDocument*, doc.get()))->
+    ClearScriptHandlingObject();
+
   return CallQueryInterface(domDoc, aResult);
 }
 
diff -Nru seamonkey-1.1.11+nobinonly/content/xml/document/src/nsXMLDocument.cpp seamonkey-1.1.12+nobinonly/content/xml/document/src/nsXMLDocument.cpp
--- seamonkey-1.1.11+nobinonly/content/xml/document/src/nsXMLDocument.cpp	2008-03-13 20:10:49.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/content/xml/document/src/nsXMLDocument.cpp	2008-08-30 01:15:20.000000000 +0200
@@ -294,37 +294,16 @@
 {
   NS_PRECONDITION(aNewChannel, "Redirecting to null channel?");
 
-  nsCOMPtr<nsIURI> newLocation;
-  nsresult rv = aNewChannel->GetURI(getter_AddRefs(newLocation)); // The redirected URI
-  if (NS_FAILED(rv)) 
-    return rv;
-
-  nsIScriptSecurityManager *secMan = nsContentUtils::GetSecurityManager();
-
-  if (mScriptContext && !mCrossSiteAccessEnabled) {
-    nsCOMPtr<nsIJSContextStack> stack(do_GetService("@mozilla.org/js/xpc/ContextStack;1", & rv));
-    if (NS_FAILED(rv))
-      return rv;
-
-    JSContext *cx = (JSContext *)mScriptContext->GetNativeContext();
-    if (!cx)
-      return NS_ERROR_UNEXPECTED;
-
-    stack->Push(cx);
-
-    rv = secMan->CheckSameOrigin(nsnull, newLocation);
+  nsCOMPtr<nsIURI> oldURI;
+  nsresult rv = aOldChannel->GetURI(getter_AddRefs(oldURI));
+  NS_ENSURE_SUCCESS(rv, rv);
 
-    stack->Pop(&cx);
-  
-    if (NS_FAILED(rv)) {
-      // The security manager set a pending exception.  Since we're
-      // running under the event loop, we need to report it.
-      ::JS_ReportPendingException(cx);
-      return rv;
-    }
-  }
+  nsCOMPtr<nsIURI> newURI;
+  rv = aNewChannel->GetURI(getter_AddRefs(newURI));
+  NS_ENSURE_SUCCESS(rv, rv);
 
-  return secMan->GetCodebasePrincipal(newLocation, getter_AddRefs(mPrincipal));
+  return nsContentUtils::GetSecurityManager()->
+    CheckSameOriginURI(oldURI, newURI);
 }
 
 NS_IMETHODIMP
@@ -467,17 +446,6 @@
 
   mScriptContext = callingContext;
 
-  // Find out if UniversalBrowserRead privileges are enabled - we will
-  // need this in case of a redirect
-  PRBool crossSiteAccessEnabled;
-  rv = secMan->IsCapabilityEnabled("UniversalBrowserRead",
-                                   &crossSiteAccessEnabled);
-  if (NS_FAILED(rv)) {
-    return rv;
-  }
-
-  mCrossSiteAccessEnabled = crossSiteAccessEnabled;
-
   // Create a channel
   // When we are called from JS we can find the load group for the page,
   // and add ourselves to it. This way any pending requests
diff -Nru seamonkey-1.1.11+nobinonly/content/xml/document/src/nsXMLDocument.h seamonkey-1.1.12+nobinonly/content/xml/document/src/nsXMLDocument.h
--- seamonkey-1.1.11+nobinonly/content/xml/document/src/nsXMLDocument.h	2008-01-29 20:30:59.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/content/xml/document/src/nsXMLDocument.h	2008-08-30 01:15:20.000000000 +0200
@@ -111,7 +111,6 @@
   // mChannel is also cancelled.  Note that if this member is true, mChannel
   // cannot be null.
   PRPackedBool mChannelIsPending;
-  PRPackedBool mCrossSiteAccessEnabled;
   PRPackedBool mLoadedAsData;
   PRPackedBool mLoadedAsInteractiveData;
   PRPackedBool mAsync;
diff -Nru seamonkey-1.1.11+nobinonly/debian/changelog seamonkey-1.1.12+nobinonly/debian/changelog
--- seamonkey-1.1.11+nobinonly/debian/changelog	2008-10-01 00:36:26.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/debian/changelog	2008-10-01 00:36:41.000000000 +0200
@@ -1,17 +1,38 @@
-seamonkey (1.1.11+nobinonly-0ubuntu1) intrepid; urgency=low
+seamonkey (1.1.12+nobinonly-0ubuntu0.8.04.1) hardy-security; urgency=low
 
-  * New security upstream release: 1.1.11 (LP: #218534)
-    Fixes USN-602-1, USN-619-1, USN-623-1 and USN-629-1
+  * New security upstream release: 1.1.12 (LP: #276437)
+    - CVE-2008-4070: Heap overflow when canceling newsgroup message
+    - CVE-2008-4069: XBM image uninitialized memory reading
+    - CVE-2008-4067..4068: resource: traversal vulnerabilities
+    - CVE-2008-4065..4066: BOM characters stripped from JavaScript before execution
+    - CVE-2008-4061..4064: Crashes with evidence of memory corruption
+    - CVE-2008-4058..4060: Privilege escalation via XPCnativeWrapper pollution
+    - CVE-2008-3837: Forced mouse drag
+    - CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation
+    - CVE-2008-0016: UTF-8 URL stack buffer overflow
+  * Also includes security fixes from 1.1.11 and 1.1.10 (LP: #218534)
+    - CVE-2008-2785: Remote code execution by overflowing CSS reference counter
+    - CVE-2008-2811: Crash and remote code execution in block reflow
+    - CVE-2008-2810: Remote site run as local file via Windows URL shortcut
+    - CVE-2008-2809: Peer-trusted certs can use alt names to spoof
+    - CVE-2008-2808: File location URL in directory listings not escaped properly
+    - CVE-2008-2807: Faulty .properties file results in uninitialized memory being used
+    - CVE-2008-2806: Arbitrary socket connections with Java LiveConnect on Mac OS X
+    - CVE-2008-2805: Arbitrary file upload via originalTarget and DOM Range
+    - MFSA 2008-26 (follow-up of CVE-2008-0304): Buffer length checks in MIME processing
+    - CVE-2008-2803: Arbitrary code execution in mozIJSSubScriptLoader.loadSubScript()
+    - CVE-2008-2802: Chrome script loading from fastload file
+    - CVE-2008-2801: Signed JAR tampering
+    - CVE-2008-2800: XSS through JavaScript same-origin violation
+    - CVE-2008-2798..2799: Crashes with evidence of memory corruption
+    - CVE-2008-1380: Crash in JavaScript garbage collector
   * Refresh diverged patch:
     - update debian/patches/80_security_build.patch
   * Fix FTBFS with missing -lfontconfig
     - add debian/patches/11_fix_ftbfs_with_fontconfig.patch
     - update debian/patches/series
-  * Build with default gcc (hardy: 4.2, intrepid: 4.3)
-    - update debian/rules
-    - update debian/control
 
- -- Fabien Tassin <fta@sofaraway.org>  Tue, 29 Jul 2008 21:29:02 +0200
+ -- Fabien Tassin <fta@ubuntu.com>  Tue, 30 Sep 2008 22:44:30 +0200
 
 seamonkey (1.1.9+nobinonly-0ubuntu1) hardy; urgency=low
 
diff -Nru seamonkey-1.1.11+nobinonly/debian/control seamonkey-1.1.12+nobinonly/debian/control
--- seamonkey-1.1.11+nobinonly/debian/control	2008-10-01 00:36:26.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/debian/control	2008-10-01 00:36:41.000000000 +0200
@@ -4,7 +4,7 @@
 Maintainer: Ubuntu Mozilla Team <ubuntu-mozillateam@lists.ubuntu.com>
 Vcs-Bzr: https://code.launchpad.net/~mozillateam/seamonkey/seamonkey-1.1.dev
 Homepage: http://www.seamonkey-project.org/
-Build-Depends: cdbs, debhelper (>= 5.0.0), autotools-dev, quilt, libgtk2.0-dev, binutils (>= 2.17-1), zip, libjpeg62-dev | libjpeg-dev, libz-dev, libxft-dev (>= 2.1-6), libfontconfig1-dev (>= 2.1-13), libidl-dev (>= 0.8), libxp-dev, libxt-dev, libxau-dev, libcairo2-dev, sharutils, libgnomevfs2-dev, libgnomeui-dev, dpkg-dev (>= 1.13.19), imagemagick, librsvg2-bin, libhunspell-dev (>= 1.1.5-2), libnspr4-dev, libnss3-dev (>= 3.11.5-2)
+Build-Depends: cdbs, debhelper (>= 5.0.0), autotools-dev, quilt, libgtk2.0-dev, binutils (>= 2.17-1), zip, libjpeg62-dev | libjpeg-dev, libz-dev, libxft-dev (>= 2.1-6), libfontconfig1-dev (>= 2.1-13), libidl-dev (>= 0.8), libxp-dev, libxt-dev, libxau-dev, libcairo2-dev, sharutils, libgnomevfs2-dev, libgnomeui-dev, dpkg-dev (>= 1.13.19), imagemagick, librsvg2-bin, libhunspell-dev (>= 1.1.5-2), libnspr4-dev, libnss3-dev (>= 3.11.5-2), g++-4.2, gcc-4.2
 Standards-Version: 3.7.3
 
 Package: seamonkey
diff -Nru seamonkey-1.1.11+nobinonly/debian/rules seamonkey-1.1.12+nobinonly/debian/rules
--- seamonkey-1.1.11+nobinonly/debian/rules	2008-10-01 00:36:26.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/debian/rules	2008-10-01 00:36:41.000000000 +0200
@@ -25,18 +25,17 @@
 
 CFLAGS = -Wall -pipe
 
-# workaround multiple crashes in Intrepid (at least 3 in realpath())
-# caused by Intrepid shipping gcc 4.3 with -D_FORTIFY_SOURCE=2 by default
-CPPFLAGS=-U_FORTIFY_SOURCE
-export CPPFLAGS
-$(warning export CPPFLAGS=$(CPPFLAGS))
-
 ifneq (,$(findstring noopt,$(DEB_BUILD_OPTIONS)))
 	OPTFLAGS = -O0
 else
 	OPTFLAGS = -O2 -fno-strict-aliasing
 endif
 
+# we are modern and build with 4.2 everywhere
+CXX=g++-4.2
+CC=gcc-4.2
+export CXX CC
+
 OPTFLAGS += -g
 
 DEB_DH_INSTALL_SOURCEDIR := debian/tmp
diff -Nru seamonkey-1.1.11+nobinonly/dom/src/base/nsGlobalWindow.cpp seamonkey-1.1.12+nobinonly/dom/src/base/nsGlobalWindow.cpp
--- seamonkey-1.1.11+nobinonly/dom/src/base/nsGlobalWindow.cpp	2008-06-16 00:26:18.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/dom/src/base/nsGlobalWindow.cpp	2008-08-30 01:15:23.000000000 +0200
@@ -150,7 +150,7 @@
 #include "nsIScriptError.h"
 #include "plbase64.h"
 #include "nsIObserverService.h"
-
+#include "nsIDragService.h"
 #include "nsIPrintSettings.h"
 #include "nsIPrintSettingsService.h"
 
@@ -186,6 +186,8 @@
 static PRInt32              gOpenPopupSpamCount        = 0;
 static PopupControlState    gPopupControlState         = openAbused;
 static PRInt32              gRunningTimeoutDepth       = 0;
+static PRBool               gMouseDown                 = PR_FALSE;
+static PRBool               gDragServiceDisabled       = PR_FALSE;
 
 #ifdef DEBUG_jst
 PRInt32 gTimeoutCnt                                    = 0;
@@ -1665,6 +1667,23 @@
     }
   }
 
+  if (NS_IS_TRUSTED_EVENT(aEvent)) {
+    if (aEvent->message == NS_MOUSE_LEFT_BUTTON_DOWN) {
+      gMouseDown = PR_TRUE;
+    } else if (aEvent->message == NS_MOUSE_LEFT_BUTTON_UP) {
+      gMouseDown = PR_FALSE;
+      if (gDragServiceDisabled) {
+        nsCOMPtr<nsIDragService_1_8_BRANCH> ds18 =
+          do_GetService("@mozilla.org/widget/dragservice;1");
+        NS_WARN_IF_FALSE(ds18, "No drag service?");
+        if (ds18) {
+          gDragServiceDisabled = PR_FALSE;
+          ds18->Unsuppress();
+        }
+      }
+    }
+  }
+
   // if the window is deactivated while in full screen mode,
   // restore OS chrome, and hide it again upon re-activation
   if (outer && outer->mFullScreen && (NS_EVENT_FLAG_BUBBLE & aFlags)) {
@@ -2528,6 +2547,20 @@
   return result;
 }
 
+
+void
+MaybeSuppressDrag() {
+  if (gMouseDown && !gDragServiceDisabled) {
+    nsCOMPtr<nsIDragService_1_8_BRANCH> ds18 =
+      do_GetService("@mozilla.org/widget/dragservice;1");
+    NS_WARN_IF_FALSE(ds18, "No drag service?");
+    if (ds18) {
+      gDragServiceDisabled = PR_TRUE;
+      ds18->Suppress();
+    }
+  }
+}
+
 NS_IMETHODIMP
 nsGlobalWindow::GetInnerWidth(PRInt32* aInnerWidth)
 {
@@ -2557,6 +2590,7 @@
   if (!CanSetProperty("dom.disable_window_move_resize") || IsFrame()) {
     return NS_OK;
   }
+  MaybeSuppressDrag();
 
   nsCOMPtr<nsIDocShellTreeItem> docShellAsItem(do_QueryInterface(mDocShell));
   NS_ENSURE_TRUE(docShellAsItem, NS_ERROR_FAILURE);
@@ -2605,6 +2639,7 @@
   if (!CanSetProperty("dom.disable_window_move_resize") || IsFrame()) {
     return NS_OK;
   }
+  MaybeSuppressDrag();
 
   nsCOMPtr<nsIDocShellTreeItem> docShellAsItem(do_QueryInterface(mDocShell));
   NS_ENSURE_TRUE(docShellAsItem, NS_ERROR_FAILURE);
@@ -2659,6 +2694,7 @@
   if (!CanSetProperty("dom.disable_window_move_resize")) {
     return NS_OK;
   }
+  MaybeSuppressDrag();
 
   nsCOMPtr<nsIBaseWindow> treeOwnerAsWin;
   GetTreeOwner(getter_AddRefs(treeOwnerAsWin));
@@ -2711,6 +2747,7 @@
   if (!CanSetProperty("dom.disable_window_move_resize")) {
     return NS_OK;
   }
+  MaybeSuppressDrag();
 
   nsCOMPtr<nsIBaseWindow> treeOwnerAsWin;
   GetTreeOwner(getter_AddRefs(treeOwnerAsWin));
@@ -2758,6 +2795,7 @@
   if (!CanSetProperty("dom.disable_window_move_resize")) {
     return NS_OK;
   }
+  MaybeSuppressDrag();
 
   nsCOMPtr<nsIBaseWindow> treeOwnerAsWin;
   GetTreeOwner(getter_AddRefs(treeOwnerAsWin));
@@ -2806,6 +2844,7 @@
   if (!CanSetProperty("dom.disable_window_move_resize")) {
     return NS_OK;
   }
+  MaybeSuppressDrag();
 
   nsCOMPtr<nsIBaseWindow> treeOwnerAsWin;
   GetTreeOwner(getter_AddRefs(treeOwnerAsWin));
@@ -3853,6 +3892,7 @@
   if (!CanSetProperty("dom.disable_window_move_resize") || IsFrame()) {
     return NS_OK;
   }
+  MaybeSuppressDrag();
 
   nsCOMPtr<nsIBaseWindow> treeOwnerAsWin;
   GetTreeOwner(getter_AddRefs(treeOwnerAsWin));
@@ -3880,6 +3920,7 @@
   if (!CanSetProperty("dom.disable_window_move_resize") || IsFrame()) {
     return NS_OK;
   }
+  MaybeSuppressDrag();
 
   nsCOMPtr<nsIBaseWindow> treeOwnerAsWin;
   GetTreeOwner(getter_AddRefs(treeOwnerAsWin));
@@ -3911,6 +3952,7 @@
   if (!CanSetProperty("dom.disable_window_move_resize") || IsFrame()) {
     return NS_OK;
   }
+  MaybeSuppressDrag();
 
   nsCOMPtr<nsIBaseWindow> treeOwnerAsWin;
   GetTreeOwner(getter_AddRefs(treeOwnerAsWin));
@@ -3938,6 +3980,7 @@
   if (!CanSetProperty("dom.disable_window_move_resize") || IsFrame()) {
     return NS_OK;
   }
+  MaybeSuppressDrag();
 
   nsCOMPtr<nsIBaseWindow> treeOwnerAsWin;
   GetTreeOwner(getter_AddRefs(treeOwnerAsWin));
@@ -3974,6 +4017,7 @@
   if (!CanSetProperty("dom.disable_window_move_resize") || IsFrame()) {
     return NS_OK;
   }
+  MaybeSuppressDrag();
 
   // The content viewer does a check to make sure that it's a content
   // viewer for a toplevel docshell.
@@ -6526,20 +6570,10 @@
   }
 
   nsCOMPtr<nsIPrincipal> ourPrincipal = GetPrincipal();
-  JSPrincipals *jsprins;
-  rv = ourPrincipal->GetJSPrincipals(cx, &jsprins);
-  if (NS_FAILED(rv)) {
-    timeout->Release(scx);
-
-    return rv;
-  }
-
-  // We know that ourPrincipal holds a strong ref to jsprins.
-  JSPRINCIPALS_DROP(cx, jsprins);
 
   const char *filename;
   if (nsJSUtils::GetCallingLocation(cx, &filename, &timeout->mLineNo,
-                                    jsprins)) {
+                                    ourPrincipal)) {
     timeout->mFileName = PL_strdup(filename);
 
     if (!timeout->mFileName) {
diff -Nru seamonkey-1.1.11+nobinonly/dom/src/base/nsJSUtils.cpp seamonkey-1.1.12+nobinonly/dom/src/base/nsJSUtils.cpp
--- seamonkey-1.1.11+nobinonly/dom/src/base/nsJSUtils.cpp	2008-03-13 20:10:50.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/dom/src/base/nsJSUtils.cpp	2008-08-30 01:15:23.000000000 +0200
@@ -64,7 +64,7 @@
 
 JSBool
 nsJSUtils::GetCallingLocation(JSContext* aContext, const char* *aFilename,
-                              PRUint32* aLineno, JSPrincipals* aPrincipals)
+                              PRUint32* aLineno, nsIPrincipal* aPrincipal)
 {
   // Get the current filename and line number
   JSStackFrame* frame = nsnull;
@@ -80,32 +80,26 @@
   if (script) {
     // If aPrincipals is non-null then our caller is asking us to ensure
     // that the filename we return does not have elevated privileges.
-    if (aPrincipals) {
-      // The principals might not be in the script, but we can always
-      // find the right principals in the frame's callee.
-      JSPrincipals* scriptPrins = JS_GetScriptPrincipals(aContext, script);
-      if (!scriptPrins) {
-        JSObject *callee = JS_GetFrameCalleeObject(aContext, frame);
-        nsCOMPtr<nsIPrincipal> prin;
+    if (aPrincipal) {
+      uint32 flags = JS_GetScriptFilenameFlags(script);
+
+      // Use the principal for the filename if it shouldn't be receiving
+      // implicit XPCNativeWrappers.
+      if (flags & JSFILENAME_SYSTEM) {
         nsIScriptSecurityManager *ssm = nsContentUtils::GetSecurityManager();
-        if (NS_FAILED(ssm->GetObjectPrincipal(aContext, callee,
-                                              getter_AddRefs(prin))) ||
-            !prin) {
-          return JS_FALSE;
-        }
 
-        prin->GetJSPrincipals(aContext, &scriptPrins);
+        nsCOMPtr<nsIPrincipal> sysPrin;
+        ssm->GetSystemPrincipal(getter_AddRefs(sysPrin));
 
-        // The script has a reference to the principals.
-        JSPRINCIPALS_DROP(aContext, scriptPrins);
-      }
-
-      // Return the weaker of the two principals if they differ.
-      if (scriptPrins != aPrincipals &&
-          scriptPrins->subsume(scriptPrins, aPrincipals)) {
-        *aFilename = aPrincipals->codebase;
-        *aLineno = 0;
-        return JS_TRUE;
+        if (aPrincipal != sysPrin) {
+          JSPrincipals* jsprins;
+          aPrincipal->GetJSPrincipals(aContext, &jsprins);
+
+          *aFilename = jsprins->codebase;
+          *aLineno = 0;
+          JSPRINCIPALS_DROP(aContext, jsprins);
+          return JS_TRUE;
+        }
       }
     }
 
diff -Nru seamonkey-1.1.11+nobinonly/dom/src/base/nsJSUtils.h seamonkey-1.1.12+nobinonly/dom/src/base/nsJSUtils.h
--- seamonkey-1.1.11+nobinonly/dom/src/base/nsJSUtils.h	2008-03-13 20:10:50.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/dom/src/base/nsJSUtils.h	2008-08-30 01:15:23.000000000 +0200
@@ -55,12 +55,13 @@
 class nsIScriptGlobalObject;
 class nsIDOMGCParticipant;
 class nsIXPConnectJSObjectHolder;
+class nsIPrincipal;
 
 class nsJSUtils
 {
 public:
   static JSBool GetCallingLocation(JSContext* aContext, const char* *aFilename,
-                                   PRUint32* aLineno, JSPrincipals* aPrincipals);
+                                   PRUint32* aLineno, nsIPrincipal* aPrincipal);
 
   static jsval ConvertStringToJSVal(const nsString& aProp,
                                     JSContext* aContext);
diff -Nru seamonkey-1.1.11+nobinonly/extensions/schema-validation/src/nsSchemaValidator.cpp seamonkey-1.1.12+nobinonly/extensions/schema-validation/src/nsSchemaValidator.cpp
--- seamonkey-1.1.11+nobinonly/extensions/schema-validation/src/nsSchemaValidator.cpp	2008-01-29 20:30:12.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/extensions/schema-validation/src/nsSchemaValidator.cpp	2008-08-30 01:14:30.000000000 +0200
@@ -2408,7 +2408,8 @@
     sprintf(fulldate, "22-AUG-1993 %d:%d:%d.%u", time.hour, time.minute,
             time.second, time.milisecond);
 
-    PR_ParseTimeString(fulldate, PR_TRUE, aResult);
+    PRBool isGMT = nsSchemaValidatorUtils::IsGMT(aValue);
+    PR_ParseTimeString(fulldate, isGMT ? PR_TRUE : PR_FALSE, aResult);
   } else {
     *aResult = nsnull;
     rv = NS_ERROR_ILLEGAL_VALUE;
@@ -2528,7 +2529,8 @@
     sprintf(fulldate, "%d-%s-%u 00:00:00", date.day,
             monthShorthand.get(), date.year);
 
-    PR_ParseTimeString(fulldate, PR_TRUE, aResult);
+    PRBool isGMT = nsSchemaValidatorUtils::IsGMT(aValue);
+    PR_ParseTimeString(fulldate, isGMT ? PR_TRUE : PR_FALSE, aResult);
   } else {
     *aResult = nsnull;
     rv = NS_ERROR_ILLEGAL_VALUE;
@@ -2615,7 +2617,8 @@
       dateTime.time.second,
       dateTime.time.milisecond);
 
-    PR_ParseTimeString(fulldate, PR_TRUE, aResult);
+    PRBool isGMT = nsSchemaValidatorUtils::IsGMT(aValue);
+    PR_ParseTimeString(fulldate, isGMT ? PR_TRUE : PR_FALSE, aResult);
   } else {
     *aResult = nsnull;
     rv = NS_ERROR_ILLEGAL_VALUE;
@@ -2649,15 +2652,13 @@
 
  /*
     http://www.w3.org/TR/xmlschema-2/#date
-    (-)CCYY-MM-DDT
-      then either: Z
-      or [+/-]hh:mm
+    (-)CCYY-MM-DD
+      then optionally either: 
+        Z
+        or [+/-]hh:mm
   */
 
-  // append 'T' to end to make ParseSchemaDate happy.
-  dateString.Append('T');
-
-  isValid = nsSchemaValidatorUtils::ParseSchemaDate(dateString, aResult);
+  isValid = nsSchemaValidatorUtils::ParseSchemaDate(dateString, PR_TRUE, aResult);
 
   return isValid;
 }
diff -Nru seamonkey-1.1.11+nobinonly/extensions/schema-validation/src/nsSchemaValidatorUtils.cpp seamonkey-1.1.12+nobinonly/extensions/schema-validation/src/nsSchemaValidatorUtils.cpp
--- seamonkey-1.1.11+nobinonly/extensions/schema-validation/src/nsSchemaValidatorUtils.cpp	2008-03-13 20:10:20.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/extensions/schema-validation/src/nsSchemaValidatorUtils.cpp	2008-08-30 01:14:30.000000000 +0200
@@ -170,9 +170,11 @@
 
   // if no T, invalid
   if (findString >= 0) {
-    isValid = ParseSchemaDate(Substring(aNodeValue, 0, findString+1), &aResult->date);
+    // we get the date part (from 0 to before 'T')
+    isValid = ParseSchemaDate(Substring(aNodeValue, 0, findString), PR_FALSE, &aResult->date);
 
     if (isValid) {
+      // we get the time part (from after the 'T' till the end)
       isValid = ParseSchemaTime(
                   Substring(aNodeValue, findString + 1, aNodeValue.Length()),
                   &aResult->time);
@@ -184,13 +186,16 @@
 
 PRBool
 nsSchemaValidatorUtils::ParseSchemaDate(const nsAString & aStrValue,
+                                        PRBool aAllowTimeZone,
                                         nsSchemaDate *aDate)
 {
   PRBool isValid = PR_FALSE;
 
   /*
     http://www.w3.org/TR/xmlschema-2/#date
-    (-)CCYY-MM-DDT
+    (-)CCYY-MM-DD
+    then optionally: Z
+      or [+/-]hh:mm
   */
 
   nsAString::const_iterator start, end, buffStart;
@@ -205,6 +210,8 @@
   nsAutoString year;
   char month[3] = "";
   char day[3] = "";
+  char timezoneHour[3] = "";
+  char timezoneMinute[3] = "";
 
   // if year is negative, skip it
   if (aStrValue.First() == '-') {
@@ -262,10 +269,24 @@
         // day
         if (buffLength > 2) {
           done = PR_TRUE;
-        } else if (currentChar == 'T') {
-          if ((start == end) && (buffLength == 2) && (strcmp(day, "31") < 1))
+        } else if (currentChar == 'Z') {
+          if (aAllowTimeZone) {
+            if ((start == end) && (buffLength == 2) && (strcmp(day, "31") < 1)) {
             isValid = PR_TRUE;
+            }
+          }
+
           done = PR_TRUE;
+        } else if ((currentChar == '+') || (currentChar == '-')) {
+          // timezone
+          if (aAllowTimeZone) {
+            state = 3;
+            buffLength = 0;
+            buffStart = start;
+          } else {
+            // no timezones allowed
+            done = PR_TRUE;
+          }
         } else {
           // has to be a numerical character or else abort
           if ((currentChar > '9') || (currentChar < '0'))
@@ -274,10 +295,26 @@
             day[buffLength] = currentChar;
           }
           buffLength++;
+
+          // are we at the end?
+          if (start == end && buffLength == 2) {
+            isValid = PR_TRUE;
+            done = PR_TRUE;
+          }
         }
         break;
       }
 
+      case 3: {
+        // timezone hh:mm
+        if (end.get()-buffStart.get() == 5) {
+          isValid = ParseSchemaTimeZone(Substring(buffStart, end), timezoneHour,
+                                        timezoneMinute);
+        }
+
+        done = PR_TRUE;
+        break;
+      }
     }
   }
 
@@ -1958,3 +1995,14 @@
   }
 }
 
+PRBool
+nsSchemaValidatorUtils::IsGMT(const nsAString & aDateTime)
+{
+  if (!aDateTime.IsEmpty()) {
+    if (aDateTime.Last() == 'Z') {
+      return PR_TRUE;
+    }
+  }
+
+  return PR_FALSE;
+}
diff -Nru seamonkey-1.1.11+nobinonly/extensions/schema-validation/src/nsSchemaValidatorUtils.h seamonkey-1.1.12+nobinonly/extensions/schema-validation/src/nsSchemaValidatorUtils.h
--- seamonkey-1.1.11+nobinonly/extensions/schema-validation/src/nsSchemaValidatorUtils.h	2006-12-22 14:50:29.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/extensions/schema-validation/src/nsSchemaValidatorUtils.h	2008-08-30 01:14:30.000000000 +0200
@@ -182,7 +182,9 @@
 
   static PRBool ParseDateTime(const nsAString & aNodeValue,
                               nsSchemaDateTime *aResult);
-  static PRBool ParseSchemaDate(const nsAString & aStrValue, nsSchemaDate *aDate);
+  static PRBool ParseSchemaDate(const nsAString & aStrValue,
+                                PRBool aAllowTimeZone,
+                                nsSchemaDate *aDate);
   static PRBool ParseSchemaTime(const nsAString & aStrValue, nsSchemaTime *aTime);
 
   static PRBool ParseSchemaTimeZone(const nsAString & aStrValue, 
@@ -239,6 +241,14 @@
                                     nsSchemaDerivedSimpleType *aDerivedSrc);
 
   static void SetToNullOrElement(nsIDOMNode *aNode, nsIDOMNode **aResultNode);
+
+  /**
+   * Determine if an xsd:date, xsd:dateTime, or xsd:time string
+   * represents a GMT (aka UTC) time. This function assumes the
+   * aDateTime string has already been validated.
+   */
+  static PRBool IsGMT(const nsAString & aDateTime);
+
 private:
   nsSchemaValidatorUtils();
   ~nsSchemaValidatorUtils();
diff -Nru seamonkey-1.1.11+nobinonly/extensions/schema-validation/tests/schema.html seamonkey-1.1.12+nobinonly/extensions/schema-validation/tests/schema.html
--- seamonkey-1.1.11+nobinonly/extensions/schema-validation/tests/schema.html	2008-01-29 20:30:12.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/extensions/schema-validation/tests/schema.html	2008-08-30 01:14:30.000000000 +0200
@@ -468,6 +468,8 @@
         validate("-2004-02-28T12:21:03.434Z", "datetime-test-1", true);
         validate("-2004-02-28T12:21:03-04:00", "datetime-test-1", true);
         validate("-2004-02-30T12:21:03Z", "datetime-test-1", false);
+        validate("2004-02-28ZT24:21:03Z", "datetime-test-1", false);
+        validate("2004-02-28+06:00T24:21:03Z", "datetime-test-1", false);
 
         validate("2004-02-11T12:21:03Z", "datetime-test-2", true);
         validate("2004-02-18T00:00:00Z", "datetime-test-2", true);
@@ -539,6 +541,15 @@
         // leap year test
         validate("2000-02-29", "date-test-1", true);
         validate("2001-02-29", "date-test-1", false);
+        // timezone test
+        validate("2001-01-18Z", "date-test-1", true);
+        validate("2001-01-18A", "date-test-1", false);
+        validate("2001-01-18Z2", "date-test-1", false);
+        validate("2007-01-01-06:00", "date-test-1", true);
+        validate("2007-01-01+06:00", "date-test-1", true);
+        validate("2007-01-01A06:00", "date-test-1", false);
+        validate("2007-01-01-06:00Z", "date-test-1", false);
+        validate("2007-01-01Z-06:00", "date-test-1", false);
 
         validate("2004-02-17", "date-test-2", true);
         validate("2004-02-18", "date-test-2", false);
diff -Nru seamonkey-1.1.11+nobinonly/extensions/transformiix/source/xpath/nsIXFormsUtilityService.h seamonkey-1.1.12+nobinonly/extensions/transformiix/source/xpath/nsIXFormsUtilityService.h
--- seamonkey-1.1.11+nobinonly/extensions/transformiix/source/xpath/nsIXFormsUtilityService.h	2008-03-13 20:10:21.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/extensions/transformiix/source/xpath/nsIXFormsUtilityService.h	2008-08-30 01:14:32.000000000 +0200
@@ -53,11 +53,12 @@
 class nsIXFormsModelElement; /* forward declaration */
 
 /* starting interface:    nsIXFormsUtilityService */
-#define NS_IXFORMSUTILITYSERVICE_IID_STR "2ad098f4-5ee7-4282-a9f7-584eb95e1d69"
+
+#define NS_IXFORMSUTILITYSERVICE_IID_STR "4903f4d8-df4d-454b-b9e7-7c45314af085"
 
 #define NS_IXFORMSUTILITYSERVICE_IID \
-  {0x2ad098f4, 0x5ee7, 0x4282, \
-    { 0xa9, 0xf7, 0x58, 0x4e, 0xb9, 0x5e, 0x1d, 0x69 }}
+  {0x4903f4d8, 0xdf4d, 0x454b, \
+    { 0xb9, 0xe7, 0x7c, 0x45, 0x31, 0x4a, 0xf0, 0x85 }}
 
 #define NS_XFORMS_UTILITY_CONTRACTID   "@mozilla.org/xforms-utility-service;1"
 
@@ -73,7 +74,11 @@
   NS_IMETHOD GetSecondsFromDateTime(const nsAString & aValue, double *aSeconds); \
   NS_IMETHOD GetDaysFromDateTime(const nsAString & aValue, PRInt32 *aDays); \
   NS_IMETHOD GetEventContextInfo(const nsAString & aContextName, nsIDOMNode *aNode, nsCOMArray<nsIDOMNode> *aResult); \
-  NS_IMETHOD GetTime(nsAString & aValue, PRBool aUTC);
+  NS_IMETHOD GetTime(nsAString & aValue, PRBool aUTC); \
+  NS_IMETHOD Context(nsIDOMNode *aResolverNode, nsIDOMNode **aResult); \
+  NS_IMETHOD IsCardNumber(const nsAString & aNumber, PRBool *aResult); \
+  NS_IMETHOD Digest(const nsAString & aData, const nsAString & aAlgorithm, const nsAString & aEncoding, nsIDOMNode *aResolverNode, nsAString & aResult); \
+  NS_IMETHOD AdjustDateTimeToTimezone(const nsAString & aDateTime, nsAString & aResult);
 
 /**
  * Private interface implemented by the nsXFormsUtilityService in XForms extension.
@@ -174,6 +179,36 @@
    */
   /* void getTime(out DOMString, PRBool aUTC); */
   NS_IMETHOD GetTime(nsAString & aValue, PRBool aUTC) = 0;
+
+  /**
+   * Function to retrieve the context node of the node that contained
+   * the XPath context() function.
+   */
+  /* nsIDOMNode context (in nsIDOMNode aResolverNode); */
+  NS_IMETHOD Context(nsIDOMNode *aResolverNode, nsIDOMNode **aResult) = 0;
+
+  /**
+   * Function to determine if a number is a valid card number according to
+   * the Luhn algorithm.
+   */
+  /* PRBool(in DOMString); */
+  NS_IMETHOD IsCardNumber(const nsAString & aNumber, PRBool *aResult) = 0;
+
+  /**
+   * Function that applies the digest algorithm to a string.
+   * DOMString Digest(in DOMString aData, in DOMString aAlgorithm,
+   *                  in DOMString aEncoding, in nsIDOMNode aResolverNode);
+   */
+  NS_IMETHOD Digest(const nsAString & aData, const nsAString & aAlgorithm,
+                    const nsAString & aEncoding, nsIDOMNode *aResolverNode,
+                    nsAString & aResult) = 0;
+
+  /**
+   * Function that adjusts an xsd:dateTime to the local timezone of the implementation.
+   */
+  /* DOMString AdjustDateTimeToTimezone(in DOMString aDateTime); */
+  NS_IMETHOD AdjustDateTimeToTimezone(const nsAString & aDateTime,
+                                      nsAString & aResult) = 0;
 };
 
 #define NS_ERROR_XFORMS_CALCUATION_EXCEPTION \
diff -Nru seamonkey-1.1.11+nobinonly/extensions/transformiix/source/xpath/nsXFormsXPathEvaluator.cpp seamonkey-1.1.12+nobinonly/extensions/transformiix/source/xpath/nsXFormsXPathEvaluator.cpp
--- seamonkey-1.1.11+nobinonly/extensions/transformiix/source/xpath/nsXFormsXPathEvaluator.cpp	2008-03-13 20:10:21.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/extensions/transformiix/source/xpath/nsXFormsXPathEvaluator.cpp	2008-08-30 01:14:32.000000000 +0200
@@ -270,6 +270,26 @@
     else if (aName == txXPathAtoms::compare) {
       aFnCall = new XFormsFunctionCall(XFormsFunctionCall::COMPARE);
     }
+    else if (aName == txXPathAtoms::context) {
+      aFnCall = new XFormsFunctionCall(XFormsFunctionCall::CONTEXT,
+                                       mResolverNode);
+    }
+    else if (aName == txXPathAtoms::daysToDate) {
+      aFnCall = new XFormsFunctionCall(XFormsFunctionCall::DAYSTODATE);
+    }
+    else if (aName == txXPathAtoms::secondsToDateTime) {
+      aFnCall = new XFormsFunctionCall(XFormsFunctionCall::SECONDSTODATETIME);
+    }
+    else if (aName == txXPathAtoms::isCardNumber) {
+      aFnCall = new XFormsFunctionCall(XFormsFunctionCall::ISCARDNUMBER);
+    }
+    else if (aName == txXPathAtoms::digest) {
+      aFnCall = new XFormsFunctionCall(XFormsFunctionCall::DIGEST,
+                                       mResolverNode);
+    }
+    else if (aName == txXPathAtoms::adjustDateTimeToTimezone) {
+      aFnCall = new XFormsFunctionCall(XFormsFunctionCall::ADJUSTDATETIMETOTIMEZONE);
+    }
     else {
       // didn't find functioncall here, aFnCall should be null
       isOutOfMem = PR_FALSE;
diff -Nru seamonkey-1.1.11+nobinonly/extensions/transformiix/source/xpath/txXPathAtomList.h seamonkey-1.1.12+nobinonly/extensions/transformiix/source/xpath/txXPathAtomList.h
--- seamonkey-1.1.11+nobinonly/extensions/transformiix/source/xpath/txXPathAtomList.h	2008-03-13 20:10:21.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/extensions/transformiix/source/xpath/txXPathAtomList.h	2008-08-30 01:14:32.000000000 +0200
@@ -114,4 +114,10 @@
 TX_ATOM(power, "power")
 TX_ATOM(random, "random")
 TX_ATOM(compare, "compare")
+TX_ATOM(context, "context")
+TX_ATOM(daysToDate, "days-to-date")
+TX_ATOM(secondsToDateTime, "seconds-to-dateTime")
+TX_ATOM(isCardNumber, "is-card-number")
+TX_ATOM(digest, "digest")
+TX_ATOM(adjustDateTimeToTimezone, "adjust-dateTime-to-timezone")
 #endif
diff -Nru seamonkey-1.1.11+nobinonly/extensions/transformiix/source/xpath/XFormsFunctionCall.cpp seamonkey-1.1.12+nobinonly/extensions/transformiix/source/xpath/XFormsFunctionCall.cpp
--- seamonkey-1.1.11+nobinonly/extensions/transformiix/source/xpath/XFormsFunctionCall.cpp	2008-03-13 20:10:21.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/extensions/transformiix/source/xpath/XFormsFunctionCall.cpp	2008-08-30 01:14:32.000000000 +0200
@@ -678,6 +678,161 @@
 
       return aContext->recycler()->getNumberResult(result, aResult);
     }
+    case CONTEXT:
+    {
+      if (!requireParams(0, 0, aContext))
+        return NS_ERROR_XPATH_BAD_ARGUMENT_COUNT;
+
+      nsRefPtr<txNodeSet> resultSet;
+      rv = aContext->recycler()->getNodeSet(getter_AddRefs(resultSet));
+      NS_ENSURE_SUCCESS(rv, rv);
+
+      nsCOMPtr<nsIXFormsUtilityService> xformsService =
+            do_GetService("@mozilla.org/xforms-utility-service;1", &rv);
+      NS_ENSURE_SUCCESS(rv, rv);
+
+      // mNode will be the node that contained the context() function.
+      nsCOMPtr<nsIDOMNode> contextNode;
+      rv = xformsService->Context(mNode, getter_AddRefs(contextNode));
+
+      if (contextNode) {
+        nsAutoPtr<txXPathNode> txNode(txXPathNativeNode::createXPathNode(contextNode));
+        if (txNode) {
+          resultSet->add(*txNode);
+        }
+      }
+
+      *aResult = resultSet;
+      NS_ADDREF(*aResult);
+
+      return NS_OK;
+    }
+    case DAYSTODATE:
+    {
+      if (!requireParams(1, 1, aContext))
+        return NS_ERROR_XPATH_BAD_ARGUMENT_COUNT;
+
+      double days = evaluateToNumber((Expr*)iter.next(), aContext);
+
+      nsAutoString date;
+      if (!Double::isNaN(days)) {
+        // Round total number of days to the nearest whole number.
+        PRTime t_days;
+        LL_I2L(t_days, floor(days+0.5));
+
+        PRTime t_secs, t_secs_per_day, t_usec, usec_per_sec;
+        // Calculate total number of seconds in aDays.
+        LL_I2L(t_secs_per_day, 86400UL);
+        LL_MUL(t_secs, t_days, t_secs_per_day);
+        // Convert total seconds to usecs.
+        LL_I2L(usec_per_sec, PR_USEC_PER_SEC);
+        LL_MUL(t_usec, t_secs, usec_per_sec);
+
+        // Convert the time to xsd:date format.
+        PRExplodedTime et;
+        PR_ExplodeTime(t_usec, PR_GMTParameters, &et);
+        char ctime[60];
+        PR_FormatTime(ctime, sizeof(ctime), "%Y-%m-%d", &et);
+        date.AppendASCII(ctime);
+      }
+
+      return aContext->recycler()->getStringResult(date, aResult);
+
+      return NS_OK;
+    }
+    case SECONDSTODATETIME:
+    {
+      if (!requireParams(1, 1, aContext))
+        return NS_ERROR_XPATH_BAD_ARGUMENT_COUNT;
+
+      double seconds = evaluateToNumber((Expr*)iter.next(), aContext);
+
+      nsAutoString dateTime;
+      if (!Double::isNaN(seconds)) {
+        // Round total number of seconds to the nearest whole number.
+        PRTime t_secs;
+        LL_I2L(t_secs, floor(seconds+0.5));
+
+        // Convert total seconds to usecs.
+        PRTime t_usec, usec_per_sec;
+        LL_I2L(usec_per_sec, PR_USEC_PER_SEC);
+        LL_MUL(t_usec, t_secs, usec_per_sec);
+
+        // Convert the time to xsd:dateTime format.
+        PRExplodedTime et;
+        PR_ExplodeTime(t_usec, PR_GMTParameters, &et);
+        char ctime[60];
+        PR_FormatTime(ctime, sizeof(ctime), "%Y-%m-%dT%H:%M:%SZ", &et);
+        dateTime.AppendASCII(ctime);
+      }
+
+      return aContext->recycler()->getStringResult(dateTime, aResult);
+    }
+    case ISCARDNUMBER:
+    {
+      if (!requireParams(1, 1, aContext))
+        return NS_ERROR_XPATH_BAD_ARGUMENT_COUNT;
+
+      nsAutoString number;
+      evaluateToString((Expr*)iter.next(), aContext, number);
+
+      nsCOMPtr<nsIXFormsUtilityService>xformsService =
+            do_GetService("@mozilla.org/xforms-utility-service;1", &rv);
+      NS_ENSURE_SUCCESS(rv, rv);
+
+      PRBool result;
+      rv = xformsService->IsCardNumber(number, &result);
+      NS_ENSURE_SUCCESS(rv, rv);
+
+      aContext->recycler()->getBoolResult(result, aResult);
+
+      return NS_OK;
+    }
+    case DIGEST:
+    {
+      nsresult rv;
+      if (!requireParams(2, 3, aContext))
+        return NS_ERROR_XPATH_BAD_ARGUMENT_COUNT;
+
+      nsAutoString data, algorithm, encoding;
+      evaluateToString((Expr*)iter.next(), aContext, data);
+      evaluateToString((Expr*)iter.next(), aContext, algorithm);
+      evaluateToString((Expr*)iter.next(), aContext, encoding);
+
+      nsCOMPtr<nsIXFormsUtilityService>xformsService =
+            do_GetService("@mozilla.org/xforms-utility-service;1", &rv);
+      NS_ENSURE_SUCCESS(rv, rv);
+
+      // mNode is the node that contained the Event XPath expression.
+      nsAutoString result;
+      rv = xformsService->Digest(data, algorithm, encoding, mNode, result);
+      if (NS_FAILED(rv)) {
+        return rv;
+      }
+
+      return aContext->recycler()->getStringResult(result, aResult);
+    }
+    case ADJUSTDATETIMETOTIMEZONE:
+    {
+      nsresult rv;
+      if (!requireParams(1, 1, aContext))
+        return NS_ERROR_XPATH_BAD_ARGUMENT_COUNT;
+
+      nsAutoString dateTime;
+      evaluateToString((Expr*)iter.next(), aContext, dateTime);
+
+      nsCOMPtr<nsIXFormsUtilityService>xformsService =
+            do_GetService("@mozilla.org/xforms-utility-service;1", &rv);
+      NS_ENSURE_SUCCESS(rv, rv);
+
+      nsAutoString result;
+      rv = xformsService->AdjustDateTimeToTimezone(dateTime, result);
+      if (NS_FAILED(rv)) {
+        return rv;
+      }
+
+      return aContext->recycler()->getStringResult(result, aResult);
+    }
   } /* switch() */
 
   aContext->receiveError(NS_LITERAL_STRING("Internal error"),
@@ -795,6 +950,36 @@
       *aAtom = txXPathAtoms::compare;
       break;
     }
+    case CONTEXT:
+    {
+      *aAtom = txXPathAtoms::context;
+      break;
+    }
+    case DAYSTODATE:
+    {
+      *aAtom = txXPathAtoms::daysToDate;
+      break;
+    }
+    case SECONDSTODATETIME:
+    {
+      *aAtom = txXPathAtoms::secondsToDateTime;
+      break;
+    }
+    case ISCARDNUMBER:
+    {
+      *aAtom = txXPathAtoms::isCardNumber;
+      break;
+    }
+    case DIGEST:
+    {
+      *aAtom = txXPathAtoms::digest;
+      break;
+    }
+    case ADJUSTDATETIMETOTIMEZONE:
+    {
+      *aAtom = txXPathAtoms::adjustDateTimeToTimezone;
+      break;
+    }
     default:
     {
       *aAtom = 0;
diff -Nru seamonkey-1.1.11+nobinonly/extensions/transformiix/source/xpath/XFormsFunctions.h seamonkey-1.1.12+nobinonly/extensions/transformiix/source/xpath/XFormsFunctions.h
--- seamonkey-1.1.11+nobinonly/extensions/transformiix/source/xpath/XFormsFunctions.h	2008-03-13 20:10:21.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/extensions/transformiix/source/xpath/XFormsFunctions.h	2008-08-30 01:14:32.000000000 +0200
@@ -53,27 +53,33 @@
 public:
 
     enum XFormsFunctions {
-        AVG,                  // avg()
-        BOOLEANFROMSTRING,    // boolean-from-string()
-        COUNTNONEMPTY,        // count-non-empty()
-        DAYSFROMDATE,         // days-from-date()
-        IF,                   // if()
-        INDEX,                // index()
-        INSTANCE,             // instance()
-        MAX,                  // max()
-        MIN,                  // min()
-        MONTHS,               // months()
-        NOW,                  // now()
-        LOCALDATETIME,        // local-dateTime()
-        LOCALDATE,            // local-date()
-        PROPERTY,             // property()
-        SECONDS,              // seconds()
-        SECONDSFROMDATETIME,  // seconds-from-dateTime()
-        CURRENT,              // current()
-        EVENT,                // event()
-        POWER,                // power()
-        RANDOM,               // random()
-        COMPARE               // compare()
+        AVG,                      // avg()
+        BOOLEANFROMSTRING,        // boolean-from-string()
+        COUNTNONEMPTY,            // count-non-empty()
+        DAYSFROMDATE,             // days-from-date()
+        IF,                       // if()
+        INDEX,                    // index()
+        INSTANCE,                 // instance()
+        MAX,                      // max()
+        MIN,                      // min()
+        MONTHS,                   // months()
+        NOW,                      // now()
+        LOCALDATETIME,            // local-dateTime()
+        LOCALDATE,                // local-date()
+        PROPERTY,                 // property()
+        SECONDS,                  // seconds()
+        SECONDSFROMDATETIME,      // seconds-from-dateTime()
+        CURRENT,                  // current()
+        EVENT,                    // event()
+        POWER,                    // power()
+        RANDOM,                   // random()
+        COMPARE,                  // compare()
+        CONTEXT,                  // context()
+        DAYSTODATE,               // days-to-date()
+        SECONDSTODATETIME,        // seconds-to-dateTime()
+        ISCARDNUMBER,             // is-card-number()
+        DIGEST,                   // digest()
+        ADJUSTDATETIMETOTIMEZONE  // adjust-dateTime-to-timezone()
     };
 
     /*
diff -Nru seamonkey-1.1.11+nobinonly/extensions/transformiix/source/xslt/txMozillaTextOutput.cpp seamonkey-1.1.12+nobinonly/extensions/transformiix/source/xslt/txMozillaTextOutput.cpp
--- seamonkey-1.1.11+nobinonly/extensions/transformiix/source/xslt/txMozillaTextOutput.cpp	2006-05-15 18:46:26.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/extensions/transformiix/source/xslt/txMozillaTextOutput.cpp	2008-08-30 01:14:40.000000000 +0200
@@ -153,6 +153,23 @@
         // Create the document
         doc = do_CreateInstance(kXMLDocumentCID, &rv);
         NS_ASSERTION(NS_SUCCEEDED(rv), "Couldn't create document");
+        nsCOMPtr<nsIDocument_MOZILLA_1_8_BRANCH3> source =
+          do_QueryInterface(aSourceDocument);
+        if (!source) {
+          return;
+        }
+        PRBool hasHadScriptObject = PR_FALSE;
+        nsIScriptGlobalObject* sgo =
+          source->GetScriptHandlingObject(hasHadScriptObject);
+        if (!sgo && hasHadScriptObject) {
+          return;
+        }
+        nsCOMPtr<nsIDocument_MOZILLA_1_8_BRANCH3> doc18 =
+          do_QueryInterface(doc);
+        if (!doc18) {
+          return;
+        }
+        doc18->SetScriptHandlingObject(sgo);
         mDocument = do_QueryInterface(doc);
     }
     else {
diff -Nru seamonkey-1.1.11+nobinonly/extensions/transformiix/source/xslt/txMozillaXMLOutput.cpp seamonkey-1.1.12+nobinonly/extensions/transformiix/source/xslt/txMozillaXMLOutput.cpp
--- seamonkey-1.1.11+nobinonly/extensions/transformiix/source/xslt/txMozillaXMLOutput.cpp	2005-09-14 10:18:39.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/extensions/transformiix/source/xslt/txMozillaXMLOutput.cpp	2008-08-30 01:14:40.000000000 +0200
@@ -724,6 +724,17 @@
 
             mDocumentIsHTML = PR_FALSE;
         }
+        nsCOMPtr<nsIDocument_MOZILLA_1_8_BRANCH3> source =
+          do_QueryInterface(aSourceDocument);
+        NS_ENSURE_STATE(source);
+        PRBool hasHadScriptObject = PR_FALSE;
+        nsIScriptGlobalObject* sgo =
+          source->GetScriptHandlingObject(hasHadScriptObject);
+        NS_ENSURE_STATE(sgo || !hasHadScriptObject);
+        nsCOMPtr<nsIDocument_MOZILLA_1_8_BRANCH3> doc18 =
+          do_QueryInterface(doc);
+        NS_ENSURE_STATE(doc18);
+        doc18->SetScriptHandlingObject(sgo);
         mDocument = do_QueryInterface(doc);
     }
     else {
diff -Nru seamonkey-1.1.11+nobinonly/extensions/xforms/install.rdf seamonkey-1.1.12+nobinonly/extensions/xforms/install.rdf
--- seamonkey-1.1.11+nobinonly/extensions/xforms/install.rdf	2006-12-22 14:50:32.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/extensions/xforms/install.rdf	2008-08-30 01:14:44.000000000 +0200
@@ -8,6 +8,7 @@
   <Description about="urn:mozilla:install-manifest">
     <em:id>@ID@</em:id>
     <em:version>@PACKAGE_VERSION@</em:version>
+    <em:targetPlatform>@TARGET_PLATFORM@</em:targetPlatform>
 
     <em:targetApplication>
       <!-- Firefox -->
diff -Nru seamonkey-1.1.11+nobinonly/extensions/xforms/Makefile.in seamonkey-1.1.12+nobinonly/extensions/xforms/Makefile.in
--- seamonkey-1.1.11+nobinonly/extensions/xforms/Makefile.in	2008-03-13 20:10:22.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/extensions/xforms/Makefile.in	2008-08-30 01:14:44.000000000 +0200
@@ -84,6 +84,7 @@
 	-DBUILD_ID=$(BUILD_ID) \
 	-DPACKAGE_VERSION=$(PACKAGE_VERSION) \
 	-DID=${INSTALL_EXTENSION_ID} \
+	-DTARGET_PLATFORM=$(OS_TARGET)_$(TARGET_XPCOM_ABI) \
 	$(NULL)
 
 # Include these in the XPI
diff -Nru seamonkey-1.1.11+nobinonly/extensions/xforms/nsIModelElementPrivate.idl seamonkey-1.1.12+nobinonly/extensions/xforms/nsIModelElementPrivate.idl
--- seamonkey-1.1.11+nobinonly/extensions/xforms/nsIModelElementPrivate.idl	2008-01-29 20:30:14.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/extensions/xforms/nsIModelElementPrivate.idl	2008-08-30 01:14:44.000000000 +0200
@@ -48,7 +48,7 @@
  * Private interface implemented by the model element for other
  * elements to use.
  */
-[uuid(e0c08554-0509-45b4-b3e5-b25c6cad8153)]
+[uuid(bbc19255-4341-45fb-a9dc-23f4add8a7c3)]
 interface nsIModelElementPrivate : nsIXFormsModelElement
 {
   /**
@@ -63,9 +63,13 @@
    * Notification that an instance element has started or finished loading
    * its instance data.  Model construction cannot complete until all of
    * the instances have loaded their data.
+   *
+   * The 'uri' parameter for instanceLoadFinished is the uri of @src or
+   * @resource on the instance element and is needed to add the uri to
+   * the context info if the link fails.
    */
   void instanceLoadStarted();
-  void instanceLoadFinished(in boolean success);
+  void instanceLoadFinished(in boolean success, in AString uri);
 
   /**
    * Locate the instance element child with the given id.
diff -Nru seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsAtoms.cpp seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsAtoms.cpp
--- seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsAtoms.cpp	2006-12-22 14:50:32.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsAtoms.cpp	2008-08-30 01:14:44.000000000 +0200
@@ -67,6 +67,7 @@
 nsIAtom* nsXFormsAtoms::externalMessagesProperty;
 nsIAtom* nsXFormsAtoms::deferredEventListProperty;
 nsIAtom* nsXFormsAtoms::attrBased;
+nsIAtom* nsXFormsAtoms::resource;
 
 const nsStaticAtom nsXFormsAtoms::Atoms_info[] = {
   { "src",                      &nsXFormsAtoms::src },
@@ -96,7 +97,8 @@
   { "instanceDocumentOwner",    &nsXFormsAtoms::instanceDocumentOwner },
   { "ExternalMessagesProperty", &nsXFormsAtoms::externalMessagesProperty },
   { "DeferredEventListProperty",&nsXFormsAtoms::deferredEventListProperty },
-  { "attrBased",                &nsXFormsAtoms::attrBased }
+  { "attrBased",                &nsXFormsAtoms::attrBased },
+  { "resource",                 &nsXFormsAtoms::resource }
 };
 
 void
diff -Nru seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsAtoms.h seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsAtoms.h
--- seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsAtoms.h	2006-12-22 14:50:32.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsAtoms.h	2008-08-30 01:14:44.000000000 +0200
@@ -75,6 +75,7 @@
   static NS_HIDDEN_(nsIAtom *) externalMessagesProperty;
   static NS_HIDDEN_(nsIAtom *) deferredEventListProperty;
   static NS_HIDDEN_(nsIAtom *) attrBased;
+  static NS_HIDDEN_(nsIAtom *) resource;
 
   static NS_HIDDEN_(void) InitAtoms();
 
diff -Nru seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsDOMEvent.cpp seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsDOMEvent.cpp
--- seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsDOMEvent.cpp	2008-03-04 23:47:45.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsDOMEvent.cpp	2008-08-30 01:14:44.000000000 +0200
@@ -43,7 +43,28 @@
  *
  */
 
-NS_IMPL_ISUPPORTS3(nsXFormsDOMEvent, nsIXFormsDOMEvent, nsIDOMNSEvent, nsIPrivateDOMEvent)
+// Setup the interface map so that an nsIXFormsDOMEvent can be QI'ed to
+// nsIDOMEvent, nsIDOMNSEvent, nsIPrivateDOMEvent, and nsISupports.
+//
+// nsISupports is ambiguous because all of the interfaces inherit from
+// nsISupports. NS_INTERFACE_MAP_ENTRY_AMBIGOUS will cast to the
+// nsISupports of nsXFormsDOMEvent.
+//
+// nsXFormsDOMEvent contains an nsIDOMEvent (mInner) and nsIDOMEvent
+// implements nsIDOMNSEvent and nsIPrivateDOMEvent. The event dispatcher
+// will QI to those interfaces. We use NS_INTERFACE_MAP_END_AGGREGATED to
+// forward QIs for those interfaces to mInner.
+
+NS_INTERFACE_MAP_BEGIN(nsXFormsDOMEvent)
+  NS_INTERFACE_MAP_ENTRY(nsIXFormsDOMEvent)
+  NS_INTERFACE_MAP_ENTRY(nsIDOMEvent)
+  NS_INTERFACE_MAP_ENTRY(nsIDOMNSEvent)
+  NS_INTERFACE_MAP_ENTRY(nsIPrivateDOMEvent)
+  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIXFormsDOMEvent)
+NS_INTERFACE_MAP_END_AGGREGATED(mInner)
+
+NS_IMPL_ADDREF(nsXFormsDOMEvent)
+NS_IMPL_RELEASE(nsXFormsDOMEvent)
 
 nsXFormsDOMEvent::nsXFormsDOMEvent(nsIDOMEvent *aInner,
                                    nsCOMArray<nsIXFormsContextInfo> *aContextInfo)
diff -Nru seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsDOMEvent.h seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsDOMEvent.h
--- seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsDOMEvent.h	2008-03-04 23:47:45.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsDOMEvent.h	2008-08-30 01:14:44.000000000 +0200
@@ -36,6 +36,9 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
+#ifndef __NSXFORMSDOMEVENT_H__
+#define __NSXFORMSDOMEVENT_H__
+
 #include "nsCOMPtr.h"
 #include "nsCOMArray.h"
 #include "nsInterfaceHashtable.h"
@@ -84,3 +87,5 @@
    */
   nsInterfaceHashtable<nsStringHashKey, nsIXFormsContextInfo> mContextInfo;
 };
+
+#endif
diff -Nru seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsInsertDeleteElement.cpp seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsInsertDeleteElement.cpp
--- seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsInsertDeleteElement.cpp	2008-03-13 20:10:22.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsInsertDeleteElement.cpp	2008-08-30 01:14:44.000000000 +0200
@@ -535,21 +535,20 @@
         if ((!nodeset || nodesetSize < 1) ||
             (nodeset && nodesetSize > 0 && newNodeType != locationNodeType)) {
           Location location = eLocation_Before;
+          nsCOMPtr<nsIDOMNode> targetNode;
           if (newNodeType != nsIDOMNode::ATTRIBUTE_NODE) {
             // Target location is before the first child of location node. If the
             // location node is empty (has no children), it remains the location
             // node and the new node will become the first child of the location
             // node.
-            nsCOMPtr<nsIDOMNode> targetNode;
             locationNode->GetFirstChild(getter_AddRefs(targetNode));
-            if (targetNode) {
-              locationNode.swap(targetNode);
-            } else {
+            if (!targetNode) {
               // New node will become first child of locationNode.
               location = eLocation_FirstChild;
+              targetNode = locationNode;
             }
           }
-          InsertNode(locationNode, newNode, location, getter_AddRefs(resNode));
+          InsertNode(targetNode, newNode, location, getter_AddRefs(resNode));
         } else {
             // Step 6c - If insert location node is the root element of an
             // instance, then that instance root element location is the target
diff -Nru seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsInstanceElement.cpp seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsInstanceElement.cpp
--- seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsInstanceElement.cpp	2007-05-03 03:37:39.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsInstanceElement.cpp	2008-08-30 01:14:44.000000000 +0200
@@ -22,6 +22,7 @@
  * Contributor(s):
  *  Brian Ryner <bryner@brianryner.com>
  *  Olli Pettay <Olli.Pettay@helsinki.fi>
+ *  Merle Sterling <msterlin@us.ibm.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -90,8 +91,23 @@
   if (!mInitialized || mLazy)
     return NS_OK;
 
+  // @src has precedence over inline content which has precedence
+  // over @resource.
   if (aName == nsXFormsAtoms::src) {
     LoadExternalInstance(aNewValue);
+  } else if (aName == nsXFormsAtoms::resource) {
+    // If @resource is set or changed, it only matters if there is
+    // no @src or inline content.
+    nsAutoString src;
+    mElement->GetAttribute(NS_LITERAL_STRING("src"), src);
+    if (src.IsEmpty()) {
+      // Check for inline content.
+      nsCOMPtr<nsIDOMNode> child;
+      GetFirstChildElement(getter_AddRefs(child));
+      if (!child) {
+        LoadExternalInstance(aNewValue);
+      }
+    }
   }
 
   return NS_OK;
@@ -103,6 +119,8 @@
   if (!mInitialized || mLazy)
     return NS_OK;
 
+  // @src has precdence over inline content which has precedence
+  // over @resource.
   if (aName == nsXFormsAtoms::src) {
     PRBool restart = PR_FALSE;
     if (mChannel) {
@@ -114,19 +132,34 @@
       mChannel = nsnull;
       mListener = nsnull;
     }
-    // We no longer have an external instance to use.  Reset our instance
-    // document to whatever inline content we have.
-    nsresult rv = CloneInlineInstance();
+
+    // We no longer have an external (@src) instance to use. Next in precedence
+    // would be inline content so we'll use that if it exists. If there is no
+    // inline content, then we'll look for @resource (the instance may have had
+    // both @src and @resource and no inline content).
+    nsresult rv;
+    nsCOMPtr<nsIDOMNode> child;
+    GetFirstChildElement(getter_AddRefs(child));
+    if (child) {
+      // Reset our instance document to whatever inline content we have.
+      rv = CloneInlineInstance(child);
+    } else {
+      nsAutoString resource;
+      mElement->GetAttribute(NS_LITERAL_STRING("resource"), resource);
+      if (!resource.IsEmpty()) {
+        LoadExternalInstance(resource);
+      }
+    }
 
     // if we had already started to load an external instance document, then
     // as part of that we would have told the model to wait for that external
     // document to load before it finishes the model construction.  Since we
     // aren't loading from an external document any longer, tell the model that
-    // there is need to wait for us anymore.
+    // there is no need to wait for us anymore.
     if (restart) {
       nsCOMPtr<nsIModelElementPrivate> model = GetModel();
       if (model) {
-        model->InstanceLoadFinished(PR_TRUE);
+        model->InstanceLoadFinished(PR_TRUE, EmptyString());
       }
     }
     return rv;
@@ -260,19 +293,21 @@
         SetInstanceDocument(nsnull);
       }
     }
-  }
 
-  // Replace the principal for the loaded document
-  nsCOMPtr<nsIDocument> iDoc(do_QueryInterface(mDocument));
-  nsresult rv = ReplacePrincipal(iDoc);
-  if (NS_FAILED(rv)) {
-    SetInstanceDocument(nsnull);
-    return rv;
+    // Replace the principal for the loaded document
+    nsCOMPtr<nsIDocument> iDoc(do_QueryInterface(mDocument));
+    nsresult rv = ReplacePrincipal(iDoc);
+    if (NS_FAILED(rv)) {
+      SetInstanceDocument(nsnull);
+      return rv;
+    }
   }
 
   nsCOMPtr<nsIModelElementPrivate> model = GetModel();
   if (model) {
-    model->InstanceLoadFinished(succeeded);
+    nsCAutoString uri;
+    request->GetName(uri);
+    model->InstanceLoadFinished(succeeded, NS_ConvertASCIItoUTF16(uri));
   }
 
   mListener = nsnull;
@@ -458,7 +493,9 @@
   }
 
   // If we don't have a linked external instance, use our inline data.
-  nsresult rv = CloneInlineInstance();
+  nsCOMPtr<nsIDOMNode> child;
+  GetFirstChildElement(getter_AddRefs(child));
+  nsresult rv = CloneInlineInstance(child);
   if (NS_FAILED(rv))
     return rv;
   return BackupOriginalDocument();
@@ -475,48 +512,69 @@
   }
 
   // Normal instance
-  nsAutoString src;
+  // If the src attribute is given, then it takes precedence over inline
+  // content and the resource attribute, and the XML data for the instance
+  // is obtained from the link. If the src attribute is omitted, then the
+  // data for the instance is obtained from inline content if it is given
+  // or the resource attribute otherwise. If both the resource attribute
+  // and inline content are provided, the inline content takes precedence.
+  nsresult rv = NS_OK;
+  nsAutoString src, resource;
   mElement->GetAttribute(NS_LITERAL_STRING("src"), src);
 
-  if (src.IsEmpty()) {
-    return CloneInlineInstance();
+  if (!src.IsEmpty()) {
+    LoadExternalInstance(src);
+  } else {
+    // If we have a first child element then we have inline content.
+    nsCOMPtr<nsIDOMNode> child;
+    GetFirstChildElement(getter_AddRefs(child));
+    if (child) {
+      rv = CloneInlineInstance(child);
+    } else {
+      // No @src or inline content, better have @resource
+      mElement->GetAttribute(NS_LITERAL_STRING("resource"), resource);
+      LoadExternalInstance(resource);
+    }
   }
 
-  LoadExternalInstance(src);
-  return NS_OK;
+  return rv;
 }
 
 // private methods
 
 nsresult
-nsXFormsInstanceElement::CloneInlineInstance()
+nsXFormsInstanceElement::CloneInlineInstance(nsIDOMNode *aChild)
 {
   // Clear out our existing instance data
   nsresult rv = CreateInstanceDocument(EmptyString());
   if (NS_FAILED(rv))
     return rv; // don't warn, we might just not be in the document yet
 
-  // look for our first child element (skip over text nodes, etc.)
-  nsCOMPtr<nsIDOMNode> child, temp;
-  mElement->GetFirstChild(getter_AddRefs(child));
-  while (child) {
-    PRUint16 nodeType;
-    child->GetNodeType(&nodeType);
-
-    if (nodeType == nsIDOMNode::ELEMENT_NODE)
-      break;
 
-    temp.swap(child);
-    temp->GetNextSibling(getter_AddRefs(child));
-  }
-
-  // There needs to be a child element, or it is not a valid XML document
-  if (!child) {
+  // aChild must be the first child element under xf:instance or it is not
+  // a valid XML document.
+  if (!aChild) {
     nsXFormsUtils::ReportError(NS_LITERAL_STRING("inlineInstanceNoChildError"),
                                mElement);
+
     nsCOMPtr<nsIModelElementPrivate> model(GetModel());
     nsCOMPtr<nsIDOMNode> modelNode(do_QueryInterface(model));
-    nsXFormsUtils::DispatchEvent(modelNode, eEvent_LinkException);
+    // Context Info: 'resource-uri'
+    // ID of the failed instance preceded by the # fragment identifier.
+    nsAutoString idStr;
+    mElement->GetAttribute(NS_LITERAL_STRING("id"), idStr);
+    if (!idStr.IsEmpty()) {
+      nsAutoString resourceURI;
+      resourceURI.AssignLiteral("#");
+      resourceURI.Append(idStr);
+      nsCOMPtr<nsXFormsContextInfo> contextInfo =
+        new nsXFormsContextInfo(mElement);
+      NS_ENSURE_TRUE(contextInfo, NS_ERROR_OUT_OF_MEMORY);
+      contextInfo->SetStringValue("resource-uri", resourceURI);
+      mContextInfo.AppendObject(contextInfo);
+    }
+    nsXFormsUtils::DispatchEvent(modelNode, eEvent_LinkException, nsnull,
+                                 mElement, &mContextInfo);
     nsXFormsUtils::HandleFatalError(mElement,
                                     NS_LITERAL_STRING("XFormsLinkException"));
     return NS_ERROR_FAILURE;
@@ -524,8 +582,8 @@
 
   // Check for siblings to first child element node. This is an error, since
   // the inline content is then not a well-formed XML document.
-  nsCOMPtr<nsIDOMNode> sibling;
-  child->GetNextSibling(getter_AddRefs(sibling));
+  nsCOMPtr<nsIDOMNode> sibling, temp;
+  aChild->GetNextSibling(getter_AddRefs(sibling));
   while (sibling) {
     PRUint16 nodeType;
     sibling->GetNodeType(&nodeType);
@@ -533,9 +591,25 @@
     if (nodeType == nsIDOMNode::ELEMENT_NODE) {
       nsXFormsUtils::ReportError(NS_LITERAL_STRING("inlineInstanceMultipleElementsError"),
                                  mElement);
+
       nsCOMPtr<nsIModelElementPrivate> model(GetModel());
       nsCOMPtr<nsIDOMNode> modelNode(do_QueryInterface(model));
-      nsXFormsUtils::DispatchEvent(modelNode, eEvent_LinkException);
+      // Context Info: 'resource-uri'
+      // ID of the failed instance preceded by the # fragment identifier.
+      nsAutoString idStr;
+      mElement->GetAttribute(NS_LITERAL_STRING("id"), idStr);
+      if (!idStr.IsEmpty()) {
+        nsAutoString resourceURI;
+        resourceURI.AssignLiteral("#");
+        resourceURI.Append(idStr);
+        nsCOMPtr<nsXFormsContextInfo> contextInfo =
+          new nsXFormsContextInfo(mElement);
+        NS_ENSURE_TRUE(contextInfo, NS_ERROR_OUT_OF_MEMORY);
+        contextInfo->SetStringValue("resource-uri", resourceURI);
+        mContextInfo.AppendObject(contextInfo);
+      }
+      nsXFormsUtils::DispatchEvent(modelNode, eEvent_LinkException, nsnull,
+                                   mElement, &mContextInfo);
       nsXFormsUtils::HandleFatalError(mElement,
                                       NS_LITERAL_STRING("XFormsLinkException"));
       return NS_ERROR_FAILURE;
@@ -547,7 +621,7 @@
 
   // Clone and insert content into new document
   nsCOMPtr<nsIDOMNode> newNode;
-  rv = mDocument->ImportNode(child, PR_TRUE, getter_AddRefs(newNode));
+  rv = mDocument->ImportNode(aChild, PR_TRUE, getter_AddRefs(newNode));
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsIDOMNode> nodeReturn;
@@ -565,9 +639,9 @@
   PRBool restart = PR_FALSE;
   if (mChannel) {
     // probably hit this condition because someone changed the value of our
-    // src attribute while we are already trying to load the previously
-    // specified document.  We'll stop the current load effort and kick off the
-    // new attempt.
+    // src or resource attribute while we are already trying to load the
+    // previously specified document.  We'll stop the current load effort and
+    // kick off the new attempt.
     restart = PR_TRUE;
     mChannel->Cancel(NS_BINDING_ABORTED);
     mChannel = nsnull;
@@ -636,7 +710,9 @@
       model->InstanceLoadStarted();
     }
     if (NS_FAILED(rv)) {
-      model->InstanceLoadFinished(PR_FALSE);
+      // Context Info: 'resource-uri'
+      // The resource URI of the link that failed.
+      model->InstanceLoadFinished(PR_FALSE, aSrc);
     }
   }
 }
@@ -691,6 +767,28 @@
 }
 
 nsresult
+nsXFormsInstanceElement::GetFirstChildElement(nsIDOMNode **aChild)
+{
+  // look for our first child element (skip over text nodes, etc.)
+  nsCOMPtr<nsIDOMNode> child, temp;
+  mElement->GetFirstChild(getter_AddRefs(child));
+  while (child) {
+    PRUint16 nodeType;
+    child->GetNodeType(&nodeType);
+
+    if (nodeType == nsIDOMNode::ELEMENT_NODE)
+      break;
+
+    temp.swap(child);
+    temp->GetNextSibling(getter_AddRefs(child));
+  }
+
+  NS_IF_ADDREF(*aChild = child);
+
+  return NS_OK;
+}
+
+nsresult
 NS_NewXFormsInstanceElement(nsIXTFElement **aResult)
 {
   *aResult = new nsXFormsInstanceElement();
diff -Nru seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsInstanceElement.h seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsInstanceElement.h
--- seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsInstanceElement.h	2006-06-23 22:58:05.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsInstanceElement.h	2008-08-30 01:14:44.000000000 +0200
@@ -41,6 +41,7 @@
 
 #include "nsXFormsStubElement.h"
 #include "nsIDOMDocument.h"
+#include "nsCOMArray.h"
 #include "nsCOMPtr.h"
 #include "nsIModelElementPrivate.h"
 #include "nsIInstanceElementPrivate.h"
@@ -48,6 +49,7 @@
 #include "nsIStreamListener.h"
 #include "nsIChannelEventSink.h"
 #include "nsIInterfaceRequestor.h"
+#include "nsIXFormsContextInfo.h"
 
 class nsIDocument;
 class nsIDOMElement;
@@ -84,10 +86,11 @@
   nsXFormsInstanceElement() NS_HIDDEN;
 
 private:
-  NS_HIDDEN_(nsresult) CloneInlineInstance();
+  NS_HIDDEN_(nsresult) CloneInlineInstance(nsIDOMNode *aChild);
   NS_HIDDEN_(void) LoadExternalInstance(const nsAString &aSrc);
   NS_HIDDEN_(nsresult) CreateInstanceDocument(const nsAString &aQualifiedName);
   NS_HIDDEN_(already_AddRefed<nsIModelElementPrivate>) GetModel();
+  NS_HIDDEN_(nsresult) GetFirstChildElement(nsIDOMNode **aChild);
 
   /**
    * Replace principal for document to be the same as for the owning document.
@@ -108,6 +111,8 @@
   PRBool                      mInitialized;
   PRBool                      mLazy;
   nsCOMPtr<nsIChannel>        mChannel;
+  // Context Info for events.
+  nsCOMArray<nsIXFormsContextInfo> mContextInfo;
 };
 
 NS_HIDDEN_(nsresult)
diff -Nru seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsModelElement.cpp seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsModelElement.cpp
--- seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsModelElement.cpp	2008-03-13 20:10:22.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsModelElement.cpp	2008-08-30 01:14:44.000000000 +0200
@@ -1562,7 +1562,8 @@
 }
 
 NS_IMETHODIMP
-nsXFormsModelElement::InstanceLoadFinished(PRBool aSuccess)
+nsXFormsModelElement::InstanceLoadFinished(PRBool aSuccess,
+                                           const nsAString& aURI)
 {
   if (!aSuccess) {
     // This will leave mPendingInstanceCount in an invalid state, which is
@@ -1570,7 +1571,17 @@
     // should stop. If we decrease mPendingInstanceCount, the model would
     // finish construction, which is wrong.
     nsXFormsUtils::ReportError(NS_LITERAL_STRING("instanceLoadError"), mElement);
-    nsXFormsUtils::DispatchEvent(mElement, eEvent_LinkException);
+    if (!aURI.IsEmpty()) {
+      // Context Info: 'resource-uri'
+      // The resource URI of the link that failed.
+      nsCOMPtr<nsXFormsContextInfo> contextInfo =
+        new nsXFormsContextInfo(mElement);
+      NS_ENSURE_TRUE(contextInfo, NS_ERROR_OUT_OF_MEMORY);
+      contextInfo->SetStringValue("resource-uri", aURI);
+      mContextInfo.AppendObject(contextInfo);
+    }
+    nsXFormsUtils::DispatchEvent(mElement, eEvent_LinkException, nsnull,
+                                 nsnull, &mContextInfo);
     return NS_OK;
   }
 
diff -Nru seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsSchemaValidator.cpp seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsSchemaValidator.cpp
--- seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsSchemaValidator.cpp	2006-04-07 12:19:16.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsSchemaValidator.cpp	2008-08-30 01:14:44.000000000 +0200
@@ -124,6 +124,8 @@
     isValid = IsValidSchemaListItem(aValue);
   } else if (aType.EqualsLiteral("listItems")) {
     isValid = IsValidSchemaListItems(aValue);
+  } else if (aType.EqualsLiteral("card-number")) {
+    isValid = IsValidSchemaCardNumber(aValue);
   }
 
   return isValid;
@@ -220,3 +222,21 @@
   return isValid;
 }
 
+PRBool
+nsXFormsSchemaValidator::IsValidSchemaCardNumber(const nsAString & aValue)
+{
+  nsAutoString value(aValue);
+
+  // A valid card-number is between 12 and 19 digits in length.
+  PRInt32 len = value.Length();
+  if ((len < 12) || (len > 19))
+    return PR_FALSE;
+
+  for (PRInt32 i = 0; i < len; ++i) {
+    PRUnichar c = value.CharAt(i);
+    if ((c > '9') || (c < '0'))
+        return PR_FALSE;
+  }
+
+  return PR_TRUE;
+}
diff -Nru seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsSchemaValidator.h seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsSchemaValidator.h
--- seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsSchemaValidator.h	2006-04-07 12:19:16.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsSchemaValidator.h	2008-08-30 01:14:44.000000000 +0200
@@ -104,6 +104,9 @@
   // Returns if the string is a valid XForms list of listitems
   PRBool IsValidSchemaListItems(const nsAString & aValue);
 
+  // Returns if the string is a valid XForms card-number.
+  PRBool IsValidSchemaCardNumber(const nsAString & aValue);
+
 protected:
   nsCOMPtr<nsISchemaValidator> mSchemaValidator;
 };
diff -Nru seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsSubmissionElement.cpp seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsSubmissionElement.cpp
--- seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsSubmissionElement.cpp	2008-03-13 20:10:23.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsSubmissionElement.cpp	2008-08-30 01:14:44.000000000 +0200
@@ -814,14 +814,17 @@
 nsXFormsSubmissionElement::GetSubmissionURI(nsACString& aURI)
 {
   // Precedence:
-  // 1. If the submission element has a resource element as its first child,
-  // the URI can be specifed by either the 'value' attribute or the string
-  // content of the resource element. The resource element has precedence over
-  // both the 'resource' and 'action' attributes.
+  // 1. If the submission element has a resource element, the URI can be
+  // specifed by either the 'value' attribute or the string content of the
+  // resource element. If a submission has more than one resource child
+  // element, the first resource element child must be selected for use.
   //
-  // 2. If there is no resource element as the first child, the URI may be
-  // specified by either the 'resource' or 'action' attributes with 'resource'
-  // having precedence over 'action'.
+  // The resource element has precedence over both the 'resource' and
+  // 'action' attributes.
+  //
+  // 2. If there is no resource element, the URI may be specified by either
+  // the 'resource' or 'action' attributes with 'resource' having precedence
+  // over 'action'.
   //
   // If no URI is specified via any of the above mechanisms we write a warning
   // message to the error console.
@@ -829,7 +832,7 @@
   nsresult rv = NS_OK;
   nsAutoString uri;
 
-  // First check if the first child element of submission is a resource.
+  // First check if submission has a resource child element.
   nsCOMPtr<nsIDOMNode> currentNode, node, resourceNode;
   mElement->GetFirstChild(getter_AddRefs(currentNode));
 
@@ -838,19 +841,15 @@
   while (currentNode) {
     currentNode->GetNodeType(&nodeType);
     if (nodeType == nsIDOMNode::ELEMENT_NODE) {
-      // Make sure the element is a resource element.
+      // Check if the element is a resource element.
       nsAutoString localName, namespaceURI;
       currentNode->GetLocalName(localName);
       currentNode->GetNamespaceURI(namespaceURI);
       if (localName.EqualsLiteral("resource") &&
           namespaceURI.EqualsLiteral(NS_NAMESPACE_XFORMS)) {
-        // First child element is a resource.
         resourceNode = currentNode;
+        break;
       }
-
-      // The resource element must be the first child, so we
-      // bail out as soon as we find any element.
-      break;
     }
 
     currentNode->GetNextSibling(getter_AddRefs(node));
@@ -917,6 +916,236 @@
 }
 
 nsresult
+nsXFormsSubmissionElement::OverrideRequestHeaders(nsIHttpChannel *aHttpChannel)
+{
+
+  // Check to see if this submission element has any header elements.  Process
+  // the header elements, which will find any name/value pairs and add them
+  // to the channel's request header
+
+  nsresult rv = NS_OK;
+  nsCOMPtr<nsIDOMNode> currentNode, node, headerNode;
+  mElement->GetFirstChild(getter_AddRefs(currentNode));
+
+  PRUint16 nodeType;
+
+  while (currentNode) {
+    currentNode->GetNodeType(&nodeType);
+    if (nodeType == nsIDOMNode::ELEMENT_NODE) {
+      // Check if the element is a header element.
+      nsAutoString localName, namespaceURI;
+      currentNode->GetLocalName(localName);
+      currentNode->GetNamespaceURI(namespaceURI);
+      if (localName.EqualsLiteral("header") &&
+          namespaceURI.EqualsLiteral(NS_NAMESPACE_XFORMS)) {
+        headerNode = currentNode;
+        nsAutoString name, value;
+        rv = ProcessHeaderElement(headerNode, aHttpChannel);
+        NS_ENSURE_SUCCESS(rv, rv);
+      }
+    }
+
+    currentNode->GetNextSibling(getter_AddRefs(node));
+    currentNode.swap(node);
+  }
+
+  return NS_OK;
+}
+
+nsresult
+nsXFormsSubmissionElement::ProcessHeaderElement(nsIDOMNode *aHeaderNode,
+                                                nsIHttpChannel *aHttpChannel)
+{
+  // Take the given header node and look for name/value element pairs
+  // underneath.  Evaluate their bindings, if any, and set those headers on
+  // the submission request.
+
+  NS_ENSURE_ARG(aHeaderNode);
+
+  PRBool hasNodeset = PR_FALSE;
+  nsCOMPtr<nsIDOMXPathResult> nodesetResult;
+  PRInt32 contextSize = kNotFound;
+  nsAutoString nodesetString(NS_LITERAL_STRING("nodeset"));
+  nsresult rv;
+  nsCOMPtr<nsIDOMElement> headerElement(do_QueryInterface(aHeaderNode));
+  NS_ENSURE_STATE(headerElement);
+  headerElement->HasAttribute(nodesetString, &hasNodeset);
+
+  if (hasNodeset) {
+    nsAutoString bindExpr;
+    headerElement->GetAttribute(nodesetString, bindExpr);
+    if (!bindExpr.IsEmpty()) {
+      // Get the nodeset we are bound to
+      nsCOMPtr<nsIModelElementPrivate> model;
+      PRBool usesModelBind = PR_FALSE;
+      rv = nsXFormsUtils::EvaluateNodeBinding(headerElement, 0, nodesetString,
+                                              EmptyString(),
+                                              nsIDOMXPathResult::ORDERED_NODE_SNAPSHOT_TYPE,
+                                              getter_AddRefs(model),
+                                              getter_AddRefs(nodesetResult),
+                                              &usesModelBind);
+      NS_ENSURE_SUCCESS(rv, rv);
+      PRUint32 tempSize;
+      rv = nodesetResult->GetSnapshotLength(&tempSize);
+      NS_ENSURE_SUCCESS(rv, rv);
+      contextSize = (PRInt32)tempSize;
+
+      if (contextSize <= 0) {
+        return NS_OK;
+      }
+    }
+  }
+
+  // look for the name and value elements under the header element
+
+  nsCOMPtr<nsIDOMNode> currentNode, node;
+  headerElement->GetFirstChild(getter_AddRefs(currentNode));
+  
+  PRUint16 nodeType;
+  nsAutoString nameExpr, nameValue, valueExpr, valueValue;
+  PRBool useNameExpr = PR_FALSE, useValueExpr = PR_FALSE;
+  nsCOMPtr<nsIDOMElement> nameElement, valueElement;
+  
+  while (currentNode && (!valueElement || !nameElement)) {
+    currentNode->GetNodeType(&nodeType);
+    if (nodeType == nsIDOMNode::ELEMENT_NODE) {
+      nsAutoString localName, namespaceURI,
+                   valueString(NS_LITERAL_STRING("value"));
+      currentNode->GetLocalName(localName);
+      currentNode->GetNamespaceURI(namespaceURI);
+      if (localName.EqualsLiteral("name") &&
+          namespaceURI.EqualsLiteral(NS_NAMESPACE_XFORMS) &&
+          !nameElement) {
+        nameElement = do_QueryInterface(currentNode);
+        if (nameElement) {
+          nameElement->HasAttribute(valueString, &useNameExpr);
+          if (useNameExpr) {
+            nameElement->GetAttribute(valueString, nameExpr);
+            if (contextSize == kNotFound) {
+              nsCOMPtr<nsIModelElementPrivate> model;
+              PRBool usesModelBind = PR_FALSE;
+              nsCOMPtr<nsIDOMXPathResult> xpRes;
+              rv = nsXFormsUtils::EvaluateNodeBinding(nameElement, 0,
+                                                      valueString, EmptyString(),
+                                                      nsIDOMXPathResult::STRING_TYPE,
+                                                      getter_AddRefs(model),
+                                                      getter_AddRefs(xpRes),
+                                                      &usesModelBind);
+              NS_ENSURE_SUCCESS(rv, rv);
+              if (xpRes) {
+                // Truncate nameValue so GetStringValue replaces the contents
+                // with the xpath result rather than appending to it.
+                nameValue.Truncate();
+                rv = xpRes->GetStringValue(nameValue);
+                NS_ENSURE_SUCCESS(rv, rv);
+              }
+            }
+          } else {
+            // No value attribute. Get the string content of the resource element.
+            nsXFormsUtils::GetNodeValue(currentNode, nameValue);
+          }
+        }
+      } else if (localName.Equals(valueString) &&
+          namespaceURI.EqualsLiteral(NS_NAMESPACE_XFORMS) &&
+          !valueElement) {
+        valueElement = do_QueryInterface(currentNode);
+        if (valueElement) {
+          valueElement->HasAttribute(valueString, &useValueExpr);
+          if (useValueExpr) {
+            valueElement->GetAttribute(valueString, valueExpr);
+            if (contextSize == kNotFound) {
+              nsCOMPtr<nsIModelElementPrivate> model;
+              PRBool usesModelBind = PR_FALSE;
+              nsCOMPtr<nsIDOMXPathResult> xpRes;
+              rv = nsXFormsUtils::EvaluateNodeBinding(valueElement, 0,
+                                                      valueString, EmptyString(),
+                                                      nsIDOMXPathResult::STRING_TYPE,
+                                                      getter_AddRefs(model),
+                                                      getter_AddRefs(xpRes),
+                                                      &usesModelBind);
+              NS_ENSURE_SUCCESS(rv, rv);
+              if (xpRes) {
+                // Truncate valueValue so GetStringValue replaces the contents
+                // with the xpath result rather than appending to it.
+                valueValue.Truncate();
+                rv = xpRes->GetStringValue(valueValue);
+                NS_ENSURE_SUCCESS(rv, rv);
+              }
+            }
+          } else {
+            // No value attribute. Get the string content of the resource element.
+            nsXFormsUtils::GetNodeValue(valueElement, valueValue);
+          }
+        }
+      }
+    }
+    currentNode->GetNextSibling(getter_AddRefs(node));
+    currentNode.swap(node);
+  }
+
+  NS_ENSURE_STATE(nameElement && valueElement);
+
+  if (contextSize == kNotFound) {
+    // if the header element didn't have any nodeset attribute we just have the
+    // one name/value pair to worry about
+
+    if (!nameValue.IsEmpty()) {
+      rv = aHttpChannel->SetRequestHeader(NS_ConvertUTF16toUTF8(nameValue),
+                                          NS_ConvertUTF16toUTF8(valueValue),
+                                          PR_TRUE);
+      NS_ENSURE_SUCCESS(rv, rv);
+    }
+    return NS_OK;
+  }
+
+  for (PRInt32 i = 0; i < contextSize; ++i) {
+    // Get context node
+    nsCOMPtr<nsIDOMNode> contextNode;
+    rv = nodesetResult->SnapshotItem(i, getter_AddRefs(contextNode));
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    if (contextNode) {
+      nsCOMPtr<nsIDOMXPathResult> xpRes;
+      if (!nameExpr.IsEmpty()) {
+        rv = nsXFormsUtils::EvaluateXPath(nameExpr, contextNode, nameElement,
+                                          nsIDOMXPathResult::STRING_TYPE,
+                                          getter_AddRefs(xpRes));
+        NS_ENSURE_SUCCESS(rv, rv);
+        if (xpRes) {
+          // Truncate nameValue so GetStringValue replaces the contents
+          // with the xpath result rather than appending to it.
+          nameValue.Truncate();
+          rv = xpRes->GetStringValue(nameValue);
+          NS_ENSURE_SUCCESS(rv, rv);
+        }
+      }
+      if (!valueExpr.IsEmpty()) {
+        rv = nsXFormsUtils::EvaluateXPath(valueExpr, contextNode, valueElement,
+                                          nsIDOMXPathResult::STRING_TYPE,
+                                          getter_AddRefs(xpRes));
+        NS_ENSURE_SUCCESS(rv, rv);
+        if (xpRes) {
+          // Truncate valueValue so GetStringValue replaces the contents
+          // with the xpath result rather than appending to it.
+          valueValue.Truncate();
+          rv = xpRes->GetStringValue(valueValue);
+          NS_ENSURE_SUCCESS(rv, rv);
+        }
+      }
+
+      if (!nameValue.IsEmpty()) {
+        rv = aHttpChannel->SetRequestHeader(NS_ConvertUTF16toUTF8(nameValue),
+                                            NS_ConvertUTF16toUTF8(valueValue),
+                                            PR_TRUE);
+        NS_ENSURE_SUCCESS(rv, rv);
+      }
+    }
+  }
+
+  return NS_OK;
+}
+
+nsresult
 nsXFormsSubmissionElement::GetBoundInstanceData(nsIDOMNode **result)
 {
   nsCOMPtr<nsIModelElementPrivate> model;
@@ -1165,18 +1394,18 @@
           attrName.Append(localName);
           aTarget->SetAttributeNS(kXMLNSNameSpaceURI, attrName, value);
         }
-      } else if (!value.IsEmpty()) {
+      } else if (!aPrefixHash ||
+                  aPrefixHash->Contains(NS_LITERAL_STRING("#default"))) {
+        // only serialize the default namespace declaration if
+        // includenamespaceprefixes is declared and it includes '#default'
+        // or if we haven't already serialized it (none of the child elements
+        // used it)
         PRBool hasDefaultNSAttr;
         aTarget->HasAttributeNS(kXMLNSNameSpaceURI,
                                 NS_LITERAL_STRING("xmlns"), &hasDefaultNSAttr);
 
         if (!hasDefaultNSAttr) {
-          aTarget->GetNamespaceURI(nsURI);
-          if (!nsURI.IsEmpty()) {
-            // if aTarget default namespace uri isn't empty and it hasn't
-            // default namespace attribute then we should add it.
-            aTarget->SetAttributeNS(kXMLNSNameSpaceURI, localName, value);
-          }
+          aTarget->SetAttributeNS(kXMLNSNameSpaceURI, localName, value);
         }
       }
     }
@@ -1288,19 +1517,6 @@
     submDoc->GetDocumentElement(getter_AddRefs(submDocElm));
     NS_ENSURE_STATE(submDocElm);
 
-    // if submission document has empty default namespace attribute and if
-    // @includenamespaceprefixes attribute doesn't contain "#default" value then
-    // we should remove default namespace attribute (see the specs 11.3).
-    nsAutoString XMLNSAttrValue;
-    submDocElm->GetAttributeNS(kXMLNSNameSpaceURI, NS_LITERAL_STRING("xmlns"),
-                               XMLNSAttrValue);
-
-    if (XMLNSAttrValue.IsEmpty() && (!prefixHash ||
-        !prefixHash->Contains(NS_LITERAL_STRING("#default")))) {
-      submDocElm->RemoveAttributeNS(kXMLNSNameSpaceURI,
-                                    NS_LITERAL_STRING("xmlns"));
-    }
-
     // handle namespaces on the root element of the instance document
     nsCOMPtr<nsIDOMElement> instDocElm;
     instDoc->GetDocumentElement(getter_AddRefs(instDocElm));
@@ -2427,6 +2643,7 @@
 
   if (httpChannel) {
     httpChannel->SetReferrer(currURI);
+    OverrideRequestHeaders(httpChannel);
   }
 
   if (mFormat & METHOD_POST) {
diff -Nru seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsSubmissionElement.h seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsSubmissionElement.h
--- seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsSubmissionElement.h	2008-03-13 20:10:23.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsSubmissionElement.h	2008-08-30 01:14:44.000000000 +0200
@@ -54,6 +54,7 @@
 #include "nsIHttpHeaderVisitor.h"
 #include "nsIXFormsContextInfo.h"
 #include "nsDataHashtable.h"
+#include "nsIHttpChannel.h"
 
 
 class nsIMultiplexInputStream;
@@ -228,6 +229,9 @@
   nsresult SetHttpContextInfo(PRUint32 aResponse, const nsAString &aResponseText);
 
   nsresult ParseErrorResponse(nsIChannel *aChannel);
+  nsresult OverrideRequestHeaders(nsIHttpChannel *aHttpChannel);
+  nsresult ProcessHeaderElement(nsIDOMNode *aHeaderNode,
+                                nsIHttpChannel *aHttpChannel);
 };
 
 NS_HIDDEN_(nsresult)
diff -Nru seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsUtilityService.cpp seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsUtilityService.cpp
--- seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsUtilityService.cpp	2008-03-13 20:10:23.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsUtilityService.cpp	2008-08-30 01:14:44.000000000 +0200
@@ -58,6 +58,9 @@
 #include "nsIModelElementPrivate.h"
 #include "nsIXFormsActionModuleElement.h"
 #include "nsIXFormsContextInfo.h"
+#include "prmem.h"
+#include "plbase64.h"
+#include "nsICryptoHash.h"
 
 NS_IMPL_ISUPPORTS1(nsXFormsUtilityService, nsIXFormsUtilityService)
 
@@ -473,7 +476,7 @@
 
     PR_FormatTime(ctime, sizeof(ctime), "%Y-%m-%dT%H:%M:%S\0", &time);
 
-    aResult.AssignLiteral(ctime);
+    aResult.Assign(NS_ConvertASCIItoUTF16(ctime));
 
     if (aUTC) {
       aResult.AppendLiteral("Z");
@@ -567,3 +570,299 @@
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsXFormsUtilityService::Context(nsIDOMNode  *aResolverNode,
+                                nsIDOMNode **aResult)
+{
+
+  nsCOMPtr<nsIDOMNode> contextNode;
+  PRUint32 contextNodesetSize = 0;
+  PRInt32 contextPosition;
+  nsCOMPtr<nsIModelElementPrivate> model;
+  nsCOMPtr<nsIDOMElement> bindElement;
+  nsCOMPtr<nsIXFormsControl> parentControl;
+  PRBool outerBind;
+
+  nsCOMPtr<nsIDOMElement> element(do_QueryInterface(aResolverNode));
+  if (!element) {
+    contextNode.swap(*aResult);
+    return NS_OK;
+  }
+
+  nsresult rv =
+    nsXFormsUtils::GetNodeContext(element,
+                                  nsXFormsUtils::ELEMENT_WITH_MODEL_ATTR,
+                                  getter_AddRefs(model),
+                                  getter_AddRefs(bindElement),
+                                  &outerBind,
+                                  getter_AddRefs(parentControl),
+                                  getter_AddRefs(contextNode),
+                                  &contextPosition,
+                                  (PRInt32*)&contextNodesetSize,
+                                  PR_FALSE);
+
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  contextNode.swap(*aResult);
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsXFormsUtilityService::IsCardNumber(const nsAString& aNumber, PRBool *aResult)
+{
+  nsAutoString number(aNumber);
+
+  nsXFormsSchemaValidator validator;
+  if (!validator.ValidateString(number,
+                                NS_LITERAL_STRING("card-number"),
+                                NS_LITERAL_STRING(NS_NAMESPACE_XFORMS))) {
+    *aResult = PR_FALSE;
+    return NS_OK;
+  }
+
+  // Now check if the card number is a valid Luhn number.
+  PRInt32 sum = 0;
+  PRBool alt = false;
+  for (PRInt32 i = number.Length() - 1; i >= 0; --i) {
+    PRUnichar currentChar = number.CharAt(i);
+    PRInt32 digit = abs(currentChar - '0');
+
+    if (alt) {
+      digit *= 2;
+      if (digit > 9) {
+        digit -= 9;
+      }
+    }
+    sum += digit;
+    alt = !alt;
+  }
+
+  *aResult = (sum % 10 == 0);
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsXFormsUtilityService::Digest(const nsAString &aData,
+                               const nsAString &aAlgorithm,
+                               const nsAString &aEncoding, 
+                               nsIDOMNode *aResolverNode,
+                               nsAString &aResult)
+{
+  aResult.Truncate();
+
+  PRBool throwException = PR_FALSE;
+  
+  // Determine the hash algorithm to use.
+  PRUint32 hashAlg = 0;
+
+  if (aAlgorithm.EqualsLiteral("MD5")) {
+    hashAlg = nsICryptoHash::MD5;
+  } else if (aAlgorithm.EqualsLiteral("SHA-1")) {
+    hashAlg = nsICryptoHash::SHA1;
+  } else if (aAlgorithm.EqualsLiteral("SHA-256")) {
+    hashAlg = nsICryptoHash::SHA256;
+  } else if (aAlgorithm.EqualsLiteral("SHA-384")) {
+    hashAlg = nsICryptoHash::SHA384;
+  } else if (aAlgorithm.EqualsLiteral("SHA-512")) {
+    hashAlg = nsICryptoHash::SHA512;
+  } else {
+    // Throw exception.
+    throwException = PR_TRUE;
+  }
+
+  if (!throwException) {
+    // Perform the hash.
+    nsresult rv;
+  
+    nsCOMPtr<nsICryptoHash> hash =
+      do_CreateInstance("@mozilla.org/security/hash;1", &rv);
+    NS_ENSURE_SUCCESS(rv, rv);
+  
+    rv = hash->Init(hashAlg);
+    NS_ENSURE_SUCCESS(rv, rv);
+  
+    nsCAutoString data = NS_LossyConvertUTF16toASCII(aData);
+    rv = hash->Update(reinterpret_cast<const PRUint8*>(data.get()),
+                      data.Length());
+    NS_ENSURE_SUCCESS(rv, rv);
+ 
+    // PR_FALSE means return the raw binary data.
+    nsCAutoString result;
+    rv = hash->Finish(PR_FALSE, result);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    // Encode the result.
+    if (aEncoding.IsEmpty() || aEncoding.EqualsLiteral("base64")) {
+      char *buffer = PL_Base64Encode((char *)result.get(),
+                                     result.Length(), nsnull);
+      if (buffer) {
+        aResult = ToNewUnicode(NS_ConvertASCIItoUTF16(buffer));
+        PR_Free(buffer);
+      }
+    } else if (aEncoding.EqualsLiteral("hex")) {
+      PRUint32 length = result.Length() * 2 + 1;
+      PRUnichar *hexBuffer =
+        NS_STATIC_CAST(PRUnichar*, nsMemory::Alloc(length * sizeof(PRUnichar)));
+      NS_ENSURE_TRUE(hexBuffer, NS_ERROR_OUT_OF_MEMORY);
+      nsXFormsUtils::BinaryToHex(result.get(), result.Length(), &hexBuffer);
+      hexBuffer [result.Length() * 2] = 0;
+
+      nsAutoString hexResult(hexBuffer);
+      nsCAutoString hexLower = NS_LossyConvertUTF16toASCII(hexResult);
+      ToLowerCase(hexLower);
+      aResult = NS_ConvertASCIItoUTF16(hexLower);
+
+      nsMemory::Free(hexBuffer);
+    } else {
+      // Throw exception.
+      throwException = PR_TRUE;
+    }
+  }
+
+  if (throwException) {
+    // If the digest function appears in a computed expression (An XPath
+    // expression used by model item properties such as relevant and
+    // calculate to include dynamic functionality in XForms), an
+    // xforms-compute-exception occurs. If the digest function appears
+    // in any other attribute that contains an XPath function, an
+    // xforms-binding-exception occurs.
+    nsXFormsEvent event = eEvent_BindingException;
+    nsAutoString localName, namespaceURI;
+    aResolverNode->GetLocalName(localName);
+    if (localName.EqualsLiteral("bind")) {
+      aResolverNode->GetNamespaceURI(namespaceURI);
+      if (namespaceURI.EqualsLiteral(NS_NAMESPACE_XFORMS)) {
+        event = eEvent_ComputeException;
+      }
+    }
+
+    // Dispatch the event.
+    nsCOMPtr<nsIDOMElement> resolverElement = do_QueryInterface(aResolverNode);
+    nsCOMPtr<nsIModelElementPrivate> modelPriv =
+      nsXFormsUtils::GetModel(resolverElement);
+    nsCOMPtr<nsIDOMNode> model = do_QueryInterface(modelPriv);
+    nsXFormsUtils::DispatchEvent(model, event, nsnull, resolverElement,
+                                 nsnull);
+    return NS_ERROR_FAILURE;
+  }
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsXFormsUtilityService::AdjustDateTimeToTimezone(const nsAString &aDateTime,
+                                                 nsAString &aResult)
+{
+  // We have three cases to deal with:
+  //
+  // 1. aDateTime does not include a timezone indicator: 2007-10-07T02:22:00
+  //    The schema validator will return a PRTime that was calculated using
+  //    PR_LocalTimeParameters and that PRTime value formatted as an
+  //    xsd:dateTime is the same 2007-10-07T02:22:00 that was passed in.
+  //    We just need to append the local time zone.
+  //
+  // 2. aDateTime is a UTC (aka GMT) time: 2007-10-07T21:26:43Z
+  //    The schema validator will treat aDateTime as GMT and return that as a
+  //    PRTime. We convert the GMT time to a time in the local time zone and
+  //    append the local time zone.
+  //
+  // 3. aDateTime includes a time zone component: 2007-10-07T02:22:00-07:00
+  //    The schema validator checks if the time zone component is valid, but
+  //    does not use it when calculating the PRTime value so this case is
+  //    similar to case 1 except that we have to add the given time zone
+  //    offset (to get the GMT time of the input aDateTime), convert the GMT
+  //    time to the local time zone, and append the local time zone.
+  aResult.Truncate();
+
+  nsCOMPtr<nsISchemaValidator> schemaValidator =
+    do_CreateInstance("@mozilla.org/schemavalidator;1");
+  NS_ENSURE_TRUE(schemaValidator, NS_ERROR_FAILURE);
+
+  PRTime t_dateTime;
+  nsresult rv = schemaValidator->ValidateBuiltinTypeDateTime(aDateTime,
+                                                             &t_dateTime);
+
+  if (NS_FAILED(rv)) {
+    return NS_OK;
+  }
+
+  // The dateTime is valid, so get the timeZone information. If there is time
+  // zone information we are dealing with case 3 and have a bit more work to
+  // do to convert aDateTime to the local time zone.
+  nsAutoString timeString, timeZoneString;
+  PRInt32 timeSeparator = aDateTime.FindChar(PRUnichar('T'));
+  timeString.Append(Substring(aDateTime,
+                              timeSeparator + 1,
+                              aDateTime.Length() - timeSeparator));
+  nsXFormsUtils::GetTimeZone(timeString, timeZoneString);
+
+  PRExplodedTime time;
+  char ctime[60];
+
+  if (!timeZoneString.IsEmpty()) {
+    // The time zone string will be of the form ('+' | '-') hh ':' mm
+    // For example: +05:00, -07:00
+    nsAutoString hoursString, minutesString;
+    hoursString.Append(Substring(timeZoneString, 1, 2));
+    minutesString.Append(Substring(timeZoneString, 4, 2));
+
+    PRInt32 errCode;
+    PRInt32 hours = hoursString.ToInteger(&errCode);
+    NS_ENSURE_TRUE(errCode == 0, NS_ERROR_FAILURE);
+    PRInt32 minutes = minutesString.ToInteger(&errCode);
+    NS_ENSURE_TRUE(errCode == 0, NS_ERROR_FAILURE);
+    PRInt32 tzSecs = (hours * 3600) + (minutes * 60);
+
+    if (timeZoneString.CharAt(0) == '+') {
+      // The time zone is relative to GMT so if it is positive, we need to
+      // subtract the total number of seconds represented by the time zone;
+      // likewise, we add if the time zone is negative.
+      tzSecs *= -1;
+    }
+
+    PR_ExplodeTime(t_dateTime, PR_LocalTimeParameters, &time);
+    // Zero out the gmt and dst information because we don't want
+    // PR_NormalizeTime to use the local time zone to get back to
+    // GMT before it normalizes (because it would calculate the GMT
+    // time relative to the time zone that was part of the input dateTime).
+    time.tm_params.tp_gmt_offset = 0;
+    time.tm_params.tp_dst_offset = 0;
+    // Adjust the total seconds.
+    time.tm_sec += tzSecs;
+    // Normalize the fields and apply the local time parameters to convert
+    // the time to the local time zone.
+    PR_NormalizeTime(&time, PR_LocalTimeParameters);
+    PR_FormatTime(ctime, sizeof(ctime), "%Y-%m-%dT%H:%M:%S\0", &time);
+
+  } else {
+    // This is either a GMT time or no time zone information is available.
+    PR_ExplodeTime(t_dateTime, PR_LocalTimeParameters, &time);
+    PR_FormatTime(ctime, sizeof(ctime), "%Y-%m-%dT%H:%M:%S\0", &time);
+  }
+
+  // Calculate local time zone to append to the result.
+  int gmtoffsethour = time.tm_params.tp_gmt_offset / 3600;
+  int remainder = time.tm_params.tp_gmt_offset % 3600;
+  int gmtoffsetminute = remainder ? remainder / 60 : 0;
+  // adjust gmtoffsethour for daylight savings time.
+  int dstoffset = time.tm_params.tp_dst_offset / 3600;
+  gmtoffsethour += dstoffset;
+  if (gmtoffsethour < 0) {
+    // Make the gmtoffsethour positive; we'll add the plus or minus
+    // to the time zone string.
+    gmtoffsethour *= -1;
+  }
+  
+  char zone_location[40];
+  const int zoneBufSize = sizeof(zone_location);
+  PR_snprintf(zone_location, zoneBufSize, "%c%02d:%02d\0",
+              time.tm_params.tp_gmt_offset < 0 ? '-' : '+',
+              gmtoffsethour, gmtoffsetminute);
+
+  aResult.AppendLiteral(ctime);
+  aResult.Append(NS_ConvertASCIItoUTF16(zone_location));
+
+  return NS_OK;
+}
diff -Nru seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsUtils.cpp seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsUtils.cpp
--- seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsUtils.cpp	2008-03-13 20:10:23.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsUtils.cpp	2008-08-30 01:14:44.000000000 +0200
@@ -2538,3 +2538,44 @@
     return PR_FALSE;
   }
 }
+
+static inline PRUnichar
+ToHexChar(PRInt16 aValue)
+{
+  if (aValue < 10)
+    return (PRUnichar) aValue + '0';
+  else
+    return (PRUnichar) aValue - 10 + 'A';
+}
+
+void
+nsXFormsUtils::BinaryToHex(const char *aBuffer, PRUint32 aCount,
+                           PRUnichar **aHexString)
+{
+  for (PRUint32 index = 0; index < aCount; index++) {
+    (*aHexString)[index * 2] = ToHexChar((aBuffer[index] >> 4) & 0xf);
+    (*aHexString)[index * 2 + 1] = ToHexChar(aBuffer[index] & 0xf);
+  }
+}
+
+/* static */ nsresult
+nsXFormsUtils::GetTimeZone(const nsAString &aTime,
+                           nsAString &aResult)
+{
+  aResult.Truncate();
+
+  if (!aTime.IsEmpty()) {
+    PRInt32 timeZoneSeparator = aTime.FindChar(PRUnichar('-'));
+    if (timeZoneSeparator == kNotFound) {
+      timeZoneSeparator = aTime.FindChar(PRUnichar('+'));
+      if (timeZoneSeparator == kNotFound) {
+        // no time zone information available
+        return NS_OK;
+      }
+    }
+    aResult.Append(Substring(aTime, timeZoneSeparator,
+                             aTime.Length() - timeZoneSeparator));
+  }
+
+  return NS_OK;
+}
diff -Nru seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsUtils.h seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsUtils.h
--- seamonkey-1.1.11+nobinonly/extensions/xforms/nsXFormsUtils.h	2008-03-13 20:10:23.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/extensions/xforms/nsXFormsUtils.h	2008-08-30 01:14:45.000000000 +0200
@@ -660,6 +660,20 @@
    */
   static NS_HIDDEN_(PRInt32) waitLimit;
 
+  static NS_HIDDEN_(void) BinaryToHex(const char *aBuffer, PRUint32 aCount,
+                                      PRUnichar **aHexString);
+
+   /**
+    * Get the time zone information from an xsd:time. This function assumes
+    * that aTime is a valid xsd:time.
+    *
+    * @param aTime               A valid xsd:time
+    * @param aResult             Result string containing the time zone or an
+    *                            empty string if none is found.
+    */
+   static NS_HIDDEN_(nsresult) GetTimeZone(const nsAString &aTime,
+                                           nsAString &aResult);
+
 private:
   /**
    * Do same origin checks on aBaseDocument and aTestURI. Hosts can be
diff -Nru seamonkey-1.1.11+nobinonly/extensions/xforms/resources/locale/en-US/xforms.properties seamonkey-1.1.12+nobinonly/extensions/xforms/resources/locale/en-US/xforms.properties
--- seamonkey-1.1.11+nobinonly/extensions/xforms/resources/locale/en-US/xforms.properties	2007-07-15 16:42:41.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/extensions/xforms/resources/locale/en-US/xforms.properties	2008-08-30 01:14:45.000000000 +0200
@@ -88,7 +88,7 @@
 warnSubmitSerializeFailed = XForms Warning (6): Submission failed to serialize data
 warnSubmitNetworkFailure  = XForms Warning (7): Submission could not send data to the network
 warnSubmitProtocolPost    = XForms Warning (8): Submission could not be processed.  We do not handle method="post" with protocol: %S.
-warnSubmitURI             = XForms Warning (9): Submission element must specify the URI via a resource element (must be the first child element of submission), resource attribute or action attribute.
+warnSubmitURI             = XForms Warning (9): Submission element must specify the URI via a resource element, resource attribute or action attribute.
 
 # XForms Permission Messages:
 xformsXDPermissionDialogTitle = Allowed Sites - XForms Cross Domain Access
diff -Nru seamonkey-1.1.11+nobinonly/gfx/src/gtk/nsFontMetricsGTK.cpp seamonkey-1.1.12+nobinonly/gfx/src/gtk/nsFontMetricsGTK.cpp
--- seamonkey-1.1.11+nobinonly/gfx/src/gtk/nsFontMetricsGTK.cpp	2008-01-29 20:31:08.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/gfx/src/gtk/nsFontMetricsGTK.cpp	2008-08-30 01:15:25.000000000 +0200
@@ -61,6 +61,7 @@
 #include "nsAString.h"
 #include "nsXPIDLString.h"
 #include "nsFontDebug.h"
+#include "nsCharTraits.h"
 #ifdef MOZ_ENABLE_FREETYPE2
 #include "nsFT2FontNode.h"
 #include "nsFontFreeType.h"
@@ -76,11 +77,8 @@
 #include <X11/Xatom.h>
 #include <gdk/gdk.h>
 
-#define IS_SURROGATE(u)      (u > 0x10000)
 #define SAFE_CCMAP_HAS_CHAR_EXT(ccmap,c) ((ccmap) && ((IS_SURROGATE(c) && (ccmap)==gDoubleByteSpecialCharsCCMap) ? PR_FALSE : (CCMAP_HAS_CHAR_EXT(ccmap,c))))
 
-#define UCS2_NOMAPPING 0XFFFD
-
 #ifdef PR_LOGGING 
 static PRLogModuleInfo * FontMetricsGTKLM = PR_NewLogModule("FontMetricsGTK");
 #endif /* PR_LOGGING */
@@ -3458,8 +3456,8 @@
     return AddToLoadedFontsList(ftfont);
   }
 
-  if (IS_SURROGATE(aChar)) {
-    // SURROGATE is only supported by FreeType
+  if (!IS_IN_BMP(aChar)) {
+    // Non-BMP is only supported by FreeType
     return nsnull;
   }
 #endif
@@ -5064,10 +5062,10 @@
    * loading a font with the same map.
    */
   if (charSetInfo->mCharSet) {
-    // if SURROGATE char, ignore charSetInfo->mCCMap checking
+    // if not BMP char, ignore charSetInfo->mCCMap checking
     // because the exact ccmap is never created before loading
     // NEED TO FIX: need better way
-    if (IS_SURROGATE(aChar) ) {
+    if (!IS_IN_BMP(aChar) ) {
       goto check_done;
     }
     PRUint16* ccmap = charSetInfo->mCCMap;
@@ -6561,8 +6559,8 @@
   // If this is is the 'unknown' char (ie: converter could not 
   // convert it) there is no sense in searching any further for 
   // a font. Just returing mWesternFont
-  if (aChar == UCS2_NOMAPPING) {
-    FIND_FONT_PRINTF(("      ignore the 'UCS2_NOMAPPING' character, return mWesternFont"));
+  if (aChar == UCS2_REPLACEMENT_CHAR) {
+    FIND_FONT_PRINTF(("      ignore the 'UCS2_REPLACEMENT_CHAR' character, return mWesternFont"));
     return mWesternFont;
   }
 
diff -Nru seamonkey-1.1.11+nobinonly/intl/uconv/src/charsetData.properties seamonkey-1.1.12+nobinonly/intl/uconv/src/charsetData.properties
--- seamonkey-1.1.11+nobinonly/intl/uconv/src/charsetData.properties	2007-05-03 03:38:05.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/intl/uconv/src/charsetData.properties	2008-08-30 01:14:49.000000000 +0200
@@ -64,6 +64,7 @@
 ibm869.notForBrowser                    = true
 x-ibm1046.notForBrowser                 = true
 iso-8859-8-e.notForBrowser              = true
+utf-7.notForBrowser                     = true
 
 t.61-8bit.notForOutgoing             = true
 utf-7.notForOutgoing                 = true
diff -Nru seamonkey-1.1.11+nobinonly/intl/uconv/ucvko/nsISO2022KRToUnicode.cpp seamonkey-1.1.12+nobinonly/intl/uconv/ucvko/nsISO2022KRToUnicode.cpp
--- seamonkey-1.1.11+nobinonly/intl/uconv/ucvko/nsISO2022KRToUnicode.cpp	2007-10-08 21:08:19.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/intl/uconv/ucvko/nsISO2022KRToUnicode.cpp	2008-08-30 01:14:50.000000000 +0200
@@ -52,12 +52,17 @@
   {
     switch(mState)
     {
-      case mState_ASCII:
+      case mState_Init:
         if(0x1b == *src) {
-            mLastLegalState = mState;
-            mState = mState_ESC;
-        } 
-        else if(0x0e == *src) { // Shift-Out 
+          mLastLegalState = mState_ASCII;
+          mState = mState_ESC;
+          break;
+        }
+        mState = mState_ASCII;
+        // fall through
+
+      case mState_ASCII:
+        if(0x0e == *src) { // Shift-Out 
           mState = mState_KSX1001_1992;
           mRunLength = 0;
         } 
@@ -104,11 +109,6 @@
         mState = mLastLegalState;
         if('C' == *src) {
           mState = mState_ASCII;
-          if (mRunLength == 0) {
-            if(dest+1 >= destEnd)
-              goto error1;
-            *dest++ = 0xFFFD;
-          }
           mRunLength = 0;
         } 
         else  {
@@ -207,7 +207,7 @@
     } // switch
     src++;
     if ( *src == 0x0a || *src == 0x0d )   // if LF/CR, return to US-ASCII unconditionally.
-      mState = mState_ASCII;
+      mState = mState_Init;
    }
    *aDestLen = dest - aDest;
    return NS_OK;
diff -Nru seamonkey-1.1.11+nobinonly/intl/uconv/ucvko/nsISO2022KRToUnicode.h seamonkey-1.1.12+nobinonly/intl/uconv/ucvko/nsISO2022KRToUnicode.h
--- seamonkey-1.1.11+nobinonly/intl/uconv/ucvko/nsISO2022KRToUnicode.h	2007-10-08 21:08:19.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/intl/uconv/ucvko/nsISO2022KRToUnicode.h	2008-08-30 01:14:50.000000000 +0200
@@ -46,7 +46,7 @@
 public:
   nsISO2022KRToUnicode()
   { 
-    mState = mState_ASCII;
+    mState = mState_Init;
     mLastLegalState = mState_ASCII;
     mData = 0;
     mEUCKRDecoder = nsnull;
@@ -70,7 +70,7 @@
 
   NS_IMETHOD Reset()
   {
-    mState = mState_ASCII;
+    mState = mState_Init;
     mLastLegalState = mState_ASCII;
     mRunLength = 0;
     return NS_OK;
@@ -78,6 +78,7 @@
 
 private:
   enum {
+    mState_Init,
     mState_ASCII,
     mState_ESC,
     mState_ESC_24,
diff -Nru seamonkey-1.1.11+nobinonly/intl/unicharutil/util/nsUnicharUtils.h seamonkey-1.1.12+nobinonly/intl/unicharutil/util/nsUnicharUtils.h
--- seamonkey-1.1.11+nobinonly/intl/unicharutil/util/nsUnicharUtils.h	2005-02-24 16:50:57.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/intl/unicharutil/util/nsUnicharUtils.h	2008-08-30 01:14:52.000000000 +0200
@@ -41,8 +41,13 @@
 #ifndef nsAString_h___
 #include "nsAString.h"
 #endif
+
 #include "nsReadableUtils.h"
 
+#ifndef nsCharTraits_h___
+#include "nsCharTraits.h"
+#endif
+
 void ToLowerCase( nsAString& );
 void ToUpperCase( nsAString& );
 
@@ -90,16 +95,6 @@
     return ToUpperCase(c) != c;
 }
 
-#define IS_HIGH_SURROGATE(u)  ((PRUnichar)(u) >= (PRUnichar)0xd800 && (PRUnichar)(u) <= (PRUnichar)0xdbff)
-#define IS_LOW_SURROGATE(u)  ((PRUnichar)(u) >= (PRUnichar)0xdc00 && (PRUnichar)(u) <= (PRUnichar)0xdfff)
-
-#define SURROGATE_TO_UCS4(h, l)  ((((PRUint32)(h)-(PRUint32)0xd800) << 10) +  \
-                                    (PRUint32)(l) - (PRUint32)(0xdc00) + 0x10000)
-
-#define H_SURROGATE(s) ((PRUnichar)(((PRUint32)s - (PRUint32)0x10000) >> 10) + (PRUnichar)0xd800)
-#define L_SURROGATE(s) ((PRUnichar)(((PRUint32)s - (PRUint32)0x10000) & 0x3ff) + (PRUnichar)0xdc00)
-#define IS_IN_BMP(ucs) ((PRUint32)ucs < 0x10000)
-
 /* (0x3131u <= (u) && (u) <= 0x318eu) => Hangul Compatibility Jamo */
 /* (0xac00u <= (u) && (u) <= 0xd7a3u) => Hangul Syllables          */
 #define IS_CJ_CHAR(u) \
diff -Nru seamonkey-1.1.11+nobinonly/js/src/jsdbgapi.c seamonkey-1.1.12+nobinonly/js/src/jsdbgapi.c
--- seamonkey-1.1.11+nobinonly/js/src/jsdbgapi.c	2008-01-29 20:30:28.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/js/src/jsdbgapi.c	2008-08-30 01:14:52.000000000 +0200
@@ -454,6 +454,7 @@
                     frame.pc = script->code + script->length
                              - JSOP_STOP_LENGTH;
                 }
+                frame.callee = closure;
                 frame.fun = fun;
                 frame.argv = argv + 2;
                 frame.down = cx->fp;
diff -Nru seamonkey-1.1.11+nobinonly/js/src/jsemit.c seamonkey-1.1.12+nobinonly/js/src/jsemit.c
--- seamonkey-1.1.11+nobinonly/js/src/jsemit.c	2008-07-03 01:00:52.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/js/src/jsemit.c	2008-08-30 01:14:53.000000000 +0200
@@ -4291,10 +4291,6 @@
                 return JS_FALSE;
             cg->treeContext.flags &= ~TCF_IN_FOR_INIT;
 
-            /* Emit a push to allocate the iterator. */
-            if (js_Emit1(cx, cg, JSOP_STARTITER) < 0)
-                return JS_FALSE;
-
             /* Compile the object expression to the right of 'in'. */
             if (!js_EmitTree(cx, cg, pn2->pn_right))
                 return JS_FALSE;
@@ -4393,7 +4389,7 @@
                 if (pn3->pn_slot >= 0) {
                     if (pn3->pn_attrs & JSPROP_READONLY) {
                         JS_ASSERT(op == JSOP_FORVAR);
-                        op = JSOP_GETVAR;
+                        op = JSOP_FORCONST;
                     }
                     atomIndex = (jsatomid) pn3->pn_slot;
                     EMIT_UINT16_IMM_OP(op, atomIndex);
@@ -5451,7 +5447,7 @@
                     EMIT_UINT16_IMM_OP(pn2->pn_op, atomIndex);
                 break;
             }
-            // FALL THROUGH
+            /* FALL THROUGH */
           case TOK_DOT:
             EMIT_ATOM_INDEX_OP(pn2->pn_op, atomIndex);
             break;
diff -Nru seamonkey-1.1.11+nobinonly/js/src/jsfun.c seamonkey-1.1.12+nobinonly/js/src/jsfun.c
--- seamonkey-1.1.11+nobinonly/js/src/jsfun.c	2008-06-16 00:25:44.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/js/src/jsfun.c	2008-08-30 01:14:53.000000000 +0200
@@ -1856,13 +1856,7 @@
     caller = JS_GetScriptedCaller(cx, fp);
     if (caller) {
         principals = JS_EvalFramePrincipals(cx, fp, caller);
-        if (principals == caller->script->principals) {
-            filename = caller->script->filename;
-            lineno = js_PCToLineNumber(cx, caller->script, caller->pc);
-        } else {
-            filename = principals->codebase;
-            lineno = 0;
-        }
+        filename = js_ComputeFilename(cx, caller, principals, &lineno);
     } else {
         filename = NULL;
         lineno = 0;
diff -Nru seamonkey-1.1.11+nobinonly/js/src/jsgc.c seamonkey-1.1.12+nobinonly/js/src/jsgc.c
--- seamonkey-1.1.11+nobinonly/js/src/jsgc.c	2008-06-16 00:25:44.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/js/src/jsgc.c	2008-08-30 01:14:53.000000000 +0200
@@ -2573,6 +2573,9 @@
     if (JSVAL_IS_GCTHING((jsval)fp->thisp))
         GC_MARK(cx, JSVAL_TO_GCTHING((jsval)fp->thisp), "this");
 
+    if (fp->callee)
+        GC_MARK(cx, fp->callee, "callee object");
+
     /*
      * Mark fp->argv, even though in the common case it will be marked via our
      * caller's frame, or via a JSStackHeader if fp was pushed by an external
diff -Nru seamonkey-1.1.11+nobinonly/js/src/jsinterp.c seamonkey-1.1.12+nobinonly/js/src/jsinterp.c
--- seamonkey-1.1.11+nobinonly/js/src/jsinterp.c	2008-06-16 00:25:44.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/js/src/jsinterp.c	2008-08-30 01:14:54.000000000 +0200
@@ -1263,6 +1263,7 @@
     frame.varobj = NULL;
     frame.callobj = frame.argsobj = NULL;
     frame.script = script;
+    frame.callee = funobj;
     frame.fun = fun;
     frame.argc = argc;
     frame.argv = sp - argc;
@@ -1570,6 +1571,7 @@
         frame.callobj = down->callobj;
         frame.argsobj = down->argsobj;
         frame.varobj = down->varobj;
+        frame.callee = down->callee;
         frame.fun = down->fun;
         frame.thisp = down->thisp;
         frame.argc = down->argc;
@@ -1586,6 +1588,7 @@
                 obj = tmp;
         }
         frame.varobj = obj;
+        frame.callee = NULL;
         frame.fun = NULL;
         frame.thisp = chain;
         frame.argc = 0;
@@ -2696,6 +2699,7 @@
 
           BEGIN_CASE(JSOP_FORARG)
           BEGIN_CASE(JSOP_FORVAR)
+          BEGIN_CASE(JSOP_FORCONST)
           BEGIN_CASE(JSOP_FORLOCAL)
             /*
              * JSOP_FORARG and JSOP_FORVAR don't require any lval computation
@@ -2744,6 +2748,10 @@
                 fp->vars[slot] = rval;
                 break;
 
+              case JSOP_FORCONST:
+                /* Don't update the const slot. */
+                break;
+
               case JSOP_FORLOCAL:
                 slot = GET_UINT16(pc);
                 JS_ASSERT(slot < (uintN)depth);
@@ -3857,6 +3865,7 @@
                 newifp->frame.callobj = NULL;
                 newifp->frame.argsobj = NULL;
                 newifp->frame.varobj = NULL;
+                newifp->frame.callee = obj;
                 newifp->frame.script = script;
                 newifp->frame.fun = fun;
                 newifp->frame.argc = argc;
@@ -5949,8 +5958,6 @@
 
 #undef FAST_LOCAL_INCREMENT_OP
 
-          EMPTY_CASE(JSOP_STARTITER)
-
           BEGIN_CASE(JSOP_ENDITER)
             JS_ASSERT(!JSVAL_IS_PRIMITIVE(sp[-1]));
             iterobj = JSVAL_TO_OBJECT(sp[-1]);
diff -Nru seamonkey-1.1.11+nobinonly/js/src/jsinterp.h seamonkey-1.1.12+nobinonly/js/src/jsinterp.h
--- seamonkey-1.1.11+nobinonly/js/src/jsinterp.h	2006-10-09 06:01:11.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/js/src/jsinterp.h	2008-08-30 01:14:54.000000000 +0200
@@ -61,6 +61,7 @@
     JSObject        *callobj;       /* lazily created Call object */
     JSObject        *argsobj;       /* lazily created arguments object */
     JSObject        *varobj;        /* variables object, where vars go */
+    JSObject        *callee;        /* function or script object */
     JSScript        *script;        /* script being interpreted */
     JSFunction      *fun;           /* function being called or null */
     JSObject        *thisp;         /* "this" pointer if in method */
diff -Nru seamonkey-1.1.11+nobinonly/js/src/jsiter.c seamonkey-1.1.12+nobinonly/js/src/jsiter.c
--- seamonkey-1.1.11+nobinonly/js/src/jsiter.c	2007-05-03 03:38:09.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/js/src/jsiter.c	2008-08-30 01:14:54.000000000 +0200
@@ -756,6 +756,7 @@
 
     /* Copy call-invariant script and function references. */
     gen->frame.script = fp->script;
+    gen->frame.callee = fp->callee;
     gen->frame.fun = fp->fun;
 
     /* Use newsp to carve space out of gen->stack. */
diff -Nru seamonkey-1.1.11+nobinonly/js/src/jsnum.c seamonkey-1.1.12+nobinonly/js/src/jsnum.c
--- seamonkey-1.1.11+nobinonly/js/src/jsnum.c	2007-05-03 03:38:09.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/js/src/jsnum.c	2008-08-30 01:14:54.000000000 +0200
@@ -306,7 +306,7 @@
     const char *numGrouping, *tmpGroup;
     JSRuntime *rt;
     JSString *numStr, *str;
-    char *num, *buf, *dec, *end, *tmpSrc, *tmpDest;
+    char *num, *buf, *nint, *end, *tmpSrc, *tmpDest;
     int digits, size, remainder, nrepeat;
 
     /*
@@ -319,17 +319,28 @@
     numStr = JSVAL_TO_STRING(*rval);
     num = js_GetStringBytes(cx->runtime, numStr);
 
-    /* Find bit before the decimal. */
-    dec = strchr(num, '.');
-    digits = dec ? dec - num : (int)strlen(num);
+    /*
+     * Find the first non-integer value, whether it be a letter as in
+     * 'Infinity', a decimal point, or an 'e' from exponential notation.
+     */
+    nint = num;
+    if (*nint == '-')
+        nint++;
+    while(*nint >= '0' && *nint <= '9')
+        nint++;
+    digits = nint - num;
     end = num + digits;
+    if (!digits)
+        return JS_TRUE;
 
     rt = cx->runtime;
     thousandsLength = strlen(rt->thousandsSeparator);
     decimalLength = strlen(rt->decimalSeparator);
 
     /* Figure out how long resulting string will be. */
-    size = digits + (dec ? decimalLength + strlen(dec + 1) : 0);
+    size = digits + (*nint ? strlen(nint + 1) + 1 : 0);
+    if (*nint == '.')
+        size += decimalLength;
 
     numGrouping = tmpGroup = rt->numGrouping;
     remainder = digits;
@@ -371,12 +382,12 @@
             tmpGroup--;
     }
 
-    if (dec) {
+    if (*nint == '.') {
         strcpy(tmpDest, rt->decimalSeparator);
         tmpDest += decimalLength;
-        strcpy(tmpDest, dec + 1);
+        strcpy(tmpDest, nint + 1);
     } else {
-        *tmpDest++ = '\0';
+        strcpy(tmpDest, nint);
     }
 
     if (cx->localeCallbacks && cx->localeCallbacks->localeToUnicode)
diff -Nru seamonkey-1.1.11+nobinonly/js/src/jsobj.c seamonkey-1.1.12+nobinonly/js/src/jsobj.c
--- seamonkey-1.1.11+nobinonly/js/src/jsobj.c	2008-06-16 00:25:45.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/js/src/jsobj.c	2008-08-30 01:14:54.000000000 +0200
@@ -1237,6 +1237,23 @@
     return NULL;
 }
 
+const char *
+js_ComputeFilename(JSContext *cx, JSStackFrame *caller,
+                   JSPrincipals *principals, uintN *linenop)
+{
+    uint32 flags;
+
+    flags = JS_GetScriptFilenameFlags(caller->script);
+    if ((flags & JSFILENAME_SYSTEM) &&
+        strcmp(principals->codebase, "[System Principal]")) {
+        *linenop = 0;
+        return principals->codebase;
+    }
+
+    *linenop = js_PCToLineNumber(cx, caller->script, caller->pc);
+    return caller->script->filename;
+}
+
 static JSBool
 obj_eval(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
 {
@@ -1362,13 +1379,7 @@
     str = JSVAL_TO_STRING(argv[0]);
     if (caller) {
         principals = JS_EvalFramePrincipals(cx, fp, caller);
-        if (principals == caller->script->principals) {
-            file = caller->script->filename;
-            line = js_PCToLineNumber(cx, caller->script, caller->pc);
-        } else {
-            file = principals->codebase;
-            line = 0;
-        }
+        file = js_ComputeFilename(cx, caller, principals, &line);
     } else {
         file = NULL;
         line = 0;
diff -Nru seamonkey-1.1.11+nobinonly/js/src/jsobj.h seamonkey-1.1.12+nobinonly/js/src/jsobj.h
--- seamonkey-1.1.11+nobinonly/js/src/jsobj.h	2007-07-15 16:42:56.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/js/src/jsobj.h	2008-08-30 01:14:54.000000000 +0200
@@ -591,6 +591,12 @@
 extern JSBool
 js_CheckPrincipalsAccess(JSContext *cx, JSObject *scopeobj,
                          JSPrincipals *principals, JSAtom *caller);
+
+/* NB: Infallible. */
+extern const char *
+js_ComputeFilename(JSContext *cx, JSStackFrame *caller,
+                   JSPrincipals *principals, uintN *linenop);
+
 JS_END_EXTERN_C
 
 #endif /* jsobj_h___ */
diff -Nru seamonkey-1.1.11+nobinonly/js/src/jsopcode.c seamonkey-1.1.12+nobinonly/js/src/jsopcode.c
--- seamonkey-1.1.11+nobinonly/js/src/jsopcode.c	2008-06-16 00:25:45.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/js/src/jsopcode.c	2008-08-30 01:14:55.000000000 +0200
@@ -1905,10 +1905,6 @@
                 }
                 break;
 
-              case JSOP_STARTITER:
-                todo = -2;
-                break;
-
               case JSOP_PUSH:
 #if JS_HAS_DESTRUCTURING
                 sn = js_GetSrcNote(jp->script, pc);
@@ -2506,9 +2502,7 @@
                 start = ss->offsets[pos];
                 LOCAL_ASSERT(ss->sprinter.base[start] == '[' ||
                              ss->sprinter.base[start] == '#');
-                pos = blockpos;
-                while (ss->opcodes[++pos] == JSOP_STARTITER)
-                    LOCAL_ASSERT(pos < ss->top);
+                pos = blockpos + 1;
                 LOCAL_ASSERT(pos < ss->top);
                 xval = OFF2STR(&ss->sprinter, ss->offsets[pos]);
                 lval = OFF2STR(&ss->sprinter, start);
@@ -2727,7 +2721,7 @@
                 LOCAL_ASSERT(atom);
                 goto do_fornameinloop;
 
-              case JSOP_FORVAR:
+              case JSOP_FORCONST:
                 atom = GetSlotAtom(jp, js_GetLocalVariable, GET_VARNO(pc));
                 LOCAL_ASSERT(atom);
                 goto do_fornameinloop;
@@ -4437,6 +4431,10 @@
     JSPrinter *jp;
     JSString *name;
 
+    JS_ASSERT(spindex < 0 ||
+              spindex == JSDVG_IGNORE_STACK ||
+              spindex == JSDVG_SEARCH_STACK);
+
     for (fp = cx->fp; fp && !fp->script; fp = fp->down)
         continue;
     if (!fp)
@@ -4534,19 +4532,16 @@
 #if !JS_HAS_NO_SUCH_METHOD
             JS_ASSERT(-depth <= spindex);
 #endif
-            spindex -= depth;
-
-            base = (jsval *) cx->stackPool.current->base;
-            limit = (jsval *) cx->stackPool.current->avail;
             sp = fp->sp + spindex;
-            if (JS_UPTRDIFF(sp, base) < JS_UPTRDIFF(limit, base))
-                pc = (jsbytecode *) *sp;
+            if ((jsuword) (sp - fp->spbase) < (jsuword) depth)
+                pc = (jsbytecode *) *(sp - depth);
+
         }
     }
 
     /*
      * Again, be paranoid, this time about possibly loading an invalid pc
-     * from fp->sp[-(1+depth)].
+     * from fp->sp[spindex - script->depth)].
      */
     if (JS_UPTRDIFF(pc, script->code) >= (jsuword)script->length) {
         pc = fp->pc;
diff -Nru seamonkey-1.1.11+nobinonly/js/src/jsopcode.tbl seamonkey-1.1.12+nobinonly/js/src/jsopcode.tbl
--- seamonkey-1.1.11+nobinonly/js/src/jsopcode.tbl	2007-05-03 03:38:10.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/js/src/jsopcode.tbl	2008-08-30 01:14:55.000000000 +0200
@@ -458,7 +458,7 @@
 /*
  * Iterator, generator, and array comprehension support.
  */
-OPDEF(JSOP_STARTITER,     208,"startiter",   NULL,    1,  0,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_FORCONST,      208,"forconst",    NULL,    3,  0,  1, 19,  JOF_QVAR|JOF_NAME|JOF_FOR)
 OPDEF(JSOP_ENDITER,       209,"enditer",     NULL,    1,  1,  0,  0,  JOF_BYTE)
 OPDEF(JSOP_GENERATOR,     210,"generator",   NULL,    1,  0,  0,  0,  JOF_BYTE)
 OPDEF(JSOP_YIELD,         211,"yield",       NULL,    1,  1,  1,  1,  JOF_BYTE)
diff -Nru seamonkey-1.1.11+nobinonly/js/src/jsscan.c seamonkey-1.1.12+nobinonly/js/src/jsscan.c
--- seamonkey-1.1.11+nobinonly/js/src/jsscan.c	2007-05-03 03:38:10.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/js/src/jsscan.c	2008-08-30 01:14:55.000000000 +0200
@@ -314,146 +314,144 @@
     if (ts->ungetpos != 0) {
         c = ts->ungetbuf[--ts->ungetpos];
     } else {
-        do {
-            if (ts->linebuf.ptr == ts->linebuf.limit) {
-                len = PTRDIFF(ts->userbuf.limit, ts->userbuf.ptr, jschar);
-                if (len <= 0) {
-                    if (!ts->file) {
-                        ts->flags |= TSF_EOF;
-                        return EOF;
-                    }
+        if (ts->linebuf.ptr == ts->linebuf.limit) {
+            len = PTRDIFF(ts->userbuf.limit, ts->userbuf.ptr, jschar);
+            if (len <= 0) {
+                if (!ts->file) {
+                    ts->flags |= TSF_EOF;
+                    return EOF;
+                }
 
-                    /* Fill ts->userbuf so that \r and \r\n convert to \n. */
-                    crflag = (ts->flags & TSF_CRFLAG) != 0;
-                    len = js_fgets(cbuf, JS_LINE_LIMIT - crflag, ts->file);
-                    if (len <= 0) {
-                        ts->flags |= TSF_EOF;
-                        return EOF;
-                    }
-                    olen = len;
-                    ubuf = ts->userbuf.base;
-                    i = 0;
-                    if (crflag) {
-                        ts->flags &= ~TSF_CRFLAG;
-                        if (cbuf[0] != '\n') {
-                            ubuf[i++] = '\n';
-                            len++;
-                            ts->linepos--;
-                        }
+                /* Fill ts->userbuf so that \r and \r\n convert to \n. */
+                crflag = (ts->flags & TSF_CRFLAG) != 0;
+                len = js_fgets(cbuf, JS_LINE_LIMIT - crflag, ts->file);
+                if (len <= 0) {
+                    ts->flags |= TSF_EOF;
+                    return EOF;
+                }
+                olen = len;
+                ubuf = ts->userbuf.base;
+                i = 0;
+                if (crflag) {
+                    ts->flags &= ~TSF_CRFLAG;
+                    if (cbuf[0] != '\n') {
+                        ubuf[i++] = '\n';
+                        len++;
+                        ts->linepos--;
                     }
-                    for (j = 0; i < len; i++, j++)
-                        ubuf[i] = (jschar) (unsigned char) cbuf[j];
-                    ts->userbuf.limit = ubuf + len;
-                    ts->userbuf.ptr = ubuf;
-                }
-                if (ts->listener) {
-                    ts->listener(ts->filename, ts->lineno, ts->userbuf.ptr, len,
-                                 &ts->listenerTSData, ts->listenerData);
                 }
+                for (j = 0; i < len; i++, j++)
+                    ubuf[i] = (jschar) (unsigned char) cbuf[j];
+                ts->userbuf.limit = ubuf + len;
+                ts->userbuf.ptr = ubuf;
+            }
+            if (ts->listener) {
+                ts->listener(ts->filename, ts->lineno, ts->userbuf.ptr, len,
+                             &ts->listenerTSData, ts->listenerData);
+            }
 
-                nl = ts->saveEOL;
-                if (!nl) {
+            nl = ts->saveEOL;
+            if (!nl) {
+                /*
+                 * Any one of \n, \r, or \r\n ends a line (the longest
+                 * match wins).  Also allow the Unicode line and paragraph
+                 * separators.
+                 */
+                for (nl = ts->userbuf.ptr; nl < ts->userbuf.limit; nl++) {
                     /*
-                     * Any one of \n, \r, or \r\n ends a line (the longest
-                     * match wins).  Also allow the Unicode line and paragraph
-                     * separators.
+                     * Try to prevent value-testing on most characters by
+                     * filtering out characters that aren't 000x or 202x.
                      */
-                    for (nl = ts->userbuf.ptr; nl < ts->userbuf.limit; nl++) {
-                        /*
-                         * Try to prevent value-testing on most characters by
-                         * filtering out characters that aren't 000x or 202x.
-                         */
-                        if ((*nl & 0xDFD0) == 0) {
-                            if (*nl == '\n')
-                                break;
-                            if (*nl == '\r') {
-                                if (nl + 1 < ts->userbuf.limit && nl[1] == '\n')
-                                    nl++;
-                                break;
-                            }
-                            if (*nl == LINE_SEPARATOR || *nl == PARA_SEPARATOR)
-                                break;
+                    if ((*nl & 0xDFD0) == 0) {
+                        if (*nl == '\n')
+                            break;
+                        if (*nl == '\r') {
+                            if (nl + 1 < ts->userbuf.limit && nl[1] == '\n')
+                                nl++;
+                            break;
                         }
+                        if (*nl == LINE_SEPARATOR || *nl == PARA_SEPARATOR)
+                            break;
                     }
                 }
+            }
 
-                /*
-                 * If there was a line terminator, copy thru it into linebuf.
-                 * Else copy JS_LINE_LIMIT-1 bytes into linebuf.
-                 */
-                if (nl < ts->userbuf.limit)
-                    len = PTRDIFF(nl, ts->userbuf.ptr, jschar) + 1;
-                if (len >= JS_LINE_LIMIT) {
-                    len = JS_LINE_LIMIT - 1;
-                    ts->saveEOL = nl;
-                } else {
-                    ts->saveEOL = NULL;
-                }
-                js_strncpy(ts->linebuf.base, ts->userbuf.ptr, len);
-                ts->userbuf.ptr += len;
-                olen = len;
+            /*
+             * If there was a line terminator, copy thru it into linebuf.
+             * Else copy JS_LINE_LIMIT-1 bytes into linebuf.
+             */
+            if (nl < ts->userbuf.limit)
+                len = PTRDIFF(nl, ts->userbuf.ptr, jschar) + 1;
+            if (len >= JS_LINE_LIMIT) {
+                len = JS_LINE_LIMIT - 1;
+                ts->saveEOL = nl;
+            } else {
+                ts->saveEOL = NULL;
+            }
+            js_strncpy(ts->linebuf.base, ts->userbuf.ptr, len);
+            ts->userbuf.ptr += len;
+            olen = len;
 
-                /*
-                 * Make sure linebuf contains \n for EOL (don't do this in
-                 * userbuf because the user's string might be readonly).
-                 */
-                if (nl < ts->userbuf.limit) {
-                    if (*nl == '\r') {
-                        if (ts->linebuf.base[len-1] == '\r') {
-                            /*
-                             * Does the line segment end in \r?  We must check
-                             * for a \n at the front of the next segment before
-                             * storing a \n into linebuf.  This case matters
-                             * only when we're reading from a file.
-                             */
-                            if (nl + 1 == ts->userbuf.limit && ts->file) {
-                                len--;
-                                ts->flags |= TSF_CRFLAG; /* clear NLFLAG? */
-                                if (len == 0) {
-                                    /*
-                                     * This can happen when a segment ends in
-                                     * \r\r.  Start over.  ptr == limit in this
-                                     * case, so we'll fall into buffer-filling
-                                     * code.
-                                     */
-                                    return GetChar(ts);
-                                }
-                            } else {
-                                ts->linebuf.base[len-1] = '\n';
-                            }
-                        }
-                    } else if (*nl == '\n') {
-                        if (nl > ts->userbuf.base &&
-                            nl[-1] == '\r' &&
-                            ts->linebuf.base[len-2] == '\r') {
+            /*
+             * Make sure linebuf contains \n for EOL (don't do this in
+             * userbuf because the user's string might be readonly).
+             */
+            if (nl < ts->userbuf.limit) {
+                if (*nl == '\r') {
+                    if (ts->linebuf.base[len-1] == '\r') {
+                        /*
+                         * Does the line segment end in \r?  We must check
+                         * for a \n at the front of the next segment before
+                         * storing a \n into linebuf.  This case matters
+                         * only when we're reading from a file.
+                         */
+                        if (nl + 1 == ts->userbuf.limit && ts->file) {
                             len--;
-                            JS_ASSERT(ts->linebuf.base[len] == '\n');
+                            ts->flags |= TSF_CRFLAG; /* clear NLFLAG? */
+                            if (len == 0) {
+                                /*
+                                 * This can happen when a segment ends in
+                                 * \r\r.  Start over.  ptr == limit in this
+                                 * case, so we'll fall into buffer-filling
+                                 * code.
+                                 */
+                                return GetChar(ts);
+                            }
+                        } else {
                             ts->linebuf.base[len-1] = '\n';
                         }
-                    } else if (*nl == LINE_SEPARATOR || *nl == PARA_SEPARATOR) {
+                    }
+                } else if (*nl == '\n') {
+                    if (nl > ts->userbuf.base &&
+                        nl[-1] == '\r' &&
+                        ts->linebuf.base[len-2] == '\r') {
+                        len--;
+                        JS_ASSERT(ts->linebuf.base[len] == '\n');
                         ts->linebuf.base[len-1] = '\n';
                     }
+                } else if (*nl == LINE_SEPARATOR || *nl == PARA_SEPARATOR) {
+                    ts->linebuf.base[len-1] = '\n';
                 }
+            }
 
-                /* Reset linebuf based on adjusted segment length. */
-                ts->linebuf.limit = ts->linebuf.base + len;
-                ts->linebuf.ptr = ts->linebuf.base;
-
-                /* Update position of linebuf within physical userbuf line. */
-                if (!(ts->flags & TSF_NLFLAG))
-                    ts->linepos += ts->linelen;
-                else
-                    ts->linepos = 0;
-                if (ts->linebuf.limit[-1] == '\n')
-                    ts->flags |= TSF_NLFLAG;
-                else
-                    ts->flags &= ~TSF_NLFLAG;
+            /* Reset linebuf based on adjusted segment length. */
+            ts->linebuf.limit = ts->linebuf.base + len;
+            ts->linebuf.ptr = ts->linebuf.base;
 
-                /* Update linelen from original segment length. */
-                ts->linelen = olen;
-            }
-            c = *ts->linebuf.ptr++;
-        } while (JS_ISFORMAT(c));
+            /* Update position of linebuf within physical userbuf line. */
+            if (!(ts->flags & TSF_NLFLAG))
+                ts->linepos += ts->linelen;
+            else
+                ts->linepos = 0;
+            if (ts->linebuf.limit[-1] == '\n')
+                ts->flags |= TSF_NLFLAG;
+            else
+                ts->flags &= ~TSF_NLFLAG;
+
+            /* Update linelen from original segment length. */
+            ts->linelen = olen;
+        }
+        c = *ts->linebuf.ptr++;
     }
     if (c == '\n')
         ts->lineno++;
@@ -1069,6 +1067,15 @@
     return tp;
 }
 
+static JS_INLINE JSBool
+ScanAsSpace(jschar c)
+{
+    /* Treat little- and big-endian BOMs as whitespace for compatibility. */
+    if (JS_ISSPACE(c) || c == 0xfffe || c == 0xfeff)
+        return JS_TRUE;
+    return JS_FALSE;
+}
+
 JSTokenType
 js_GetToken(JSContext *cx, JSTokenStream *ts)
 {
@@ -1275,7 +1282,7 @@
             if (ts->flags & TSF_NEWLINES)
                 break;
         }
-    } while (JS_ISSPACE(c));
+    } while (ScanAsSpace(c));
 
     tp = NewToken(ts, -1);
     if (c == EOF) {
@@ -1798,7 +1805,7 @@
                     cp[3] == 'n' &&
                     cp[4] == 'e') {
                     SkipChars(ts, 5);
-                    while ((c = GetChar(ts)) != '\n' && JS_ISSPACE(c))
+                    while ((c = GetChar(ts)) != '\n' && ScanAsSpace(c))
                         continue;
                     if (JS7_ISDEC(c)) {
                         line = JS7_UNDEC(c);
@@ -1810,7 +1817,7 @@
                             }
                             line = temp;
                         }
-                        while (c != '\n' && JS_ISSPACE(c))
+                        while (c != '\n' && ScanAsSpace(c))
                             c = GetChar(ts);
                         i = 0;
                         if (c == '"') {
@@ -1825,7 +1832,7 @@
                             }
                             if (c == '"') {
                                 while ((c = GetChar(ts)) != '\n' &&
-                                       JS_ISSPACE(c)) {
+                                       ScanAsSpace(c)) {
                                     continue;
                                 }
                             }
diff -Nru seamonkey-1.1.11+nobinonly/js/src/jsscript.c seamonkey-1.1.12+nobinonly/js/src/jsscript.c
--- seamonkey-1.1.11+nobinonly/js/src/jsscript.c	2007-10-08 21:08:25.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/js/src/jsscript.c	2008-08-30 01:14:55.000000000 +0200
@@ -233,13 +233,7 @@
         }
 
         principals = JS_EvalFramePrincipals(cx, fp, caller);
-        if (principals == caller->script->principals) {
-            file = caller->script->filename;
-            line = js_PCToLineNumber(cx, caller->script, caller->pc);
-        } else {
-            file = principals->codebase;
-            line = 0;
-        }
+        file = js_ComputeFilename(cx, caller, principals, &line);
     } else {
         file = NULL;
         line = 0;
diff -Nru seamonkey-1.1.11+nobinonly/js/src/jsxdrapi.h seamonkey-1.1.12+nobinonly/js/src/jsxdrapi.h
--- seamonkey-1.1.11+nobinonly/js/src/jsxdrapi.h	2007-10-08 21:08:25.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/js/src/jsxdrapi.h	2008-08-30 01:14:55.000000000 +0200
@@ -200,7 +200,7 @@
  * before deserialization of bytecode.  If the saved version does not match
  * the current version, abort deserialization and invalidate the file.
  */
-#define JSXDR_BYTECODE_VERSION      (0xb973c0de - 16)
+#define JSXDR_BYTECODE_VERSION      (0xb973c0de - 29)
 
 /*
  * Library-private functions.
diff -Nru seamonkey-1.1.11+nobinonly/js/src/jsxml.c seamonkey-1.1.12+nobinonly/js/src/jsxml.c
--- seamonkey-1.1.11+nobinonly/js/src/jsxml.c	2008-06-16 00:25:46.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/js/src/jsxml.c	2008-08-30 01:14:56.000000000 +0200
@@ -725,7 +725,8 @@
 }
 
 static JSBool
-Namespace(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
+NamespaceHelper(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
+                jsval *rval)
 {
     jsval urival, prefixval;
     JSObject *uriobj;
@@ -747,7 +748,7 @@
     else uriobj = NULL;
 #endif
 
-    if (!(cx->fp->flags & JSFRAME_CONSTRUCTING)) {
+    if (!obj) {
         /* Namespace called as function. */
         if (argc == 1 && isNamespace) {
             /* Namespace called with one Namespace argument is identity. */
@@ -834,22 +835,32 @@
 }
 
 static JSBool
-QName(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
+Namespace(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
+{
+    return NamespaceHelper(cx,
+                           (cx->fp->flags & JSFRAME_CONSTRUCTING) ? obj : NULL,
+                           argc, argv, rval);
+}
+
+static JSBool
+QNameHelper(JSContext *cx, JSObject *obj, JSClass *clasp, uintN argc,
+            jsval *argv, jsval *rval)
 {
     jsval nameval, nsval;
     JSBool isQName, isNamespace;
     JSXMLQName *qn;
     JSString *uri, *prefix, *name;
     JSObject *nsobj;
-    JSClass *clasp;
     JSXMLNamespace *ns;
 
+    JS_ASSERT(clasp == &js_QNameClass.base ||
+              clasp == &js_AttributeNameClass);
     nameval = argv[argc > 1];
     isQName =
         !JSVAL_IS_PRIMITIVE(nameval) &&
         OBJ_GET_CLASS(cx, JSVAL_TO_OBJECT(nameval)) == &js_QNameClass.base;
 
-    if (!(cx->fp->flags & JSFRAME_CONSTRUCTING)) {
+    if (!obj) {
         /* QName called as function. */
         if (argc == 1 && isQName) {
             /* QName called with one QName argument is identity. */
@@ -858,13 +869,10 @@
         }
 
         /*
-         * Create and return a new QName object exactly as if constructed.
-         * Use the constructor's clasp so we can be shared by AttributeName
-         * (see below after this function).
+         * Create and return a new QName or AttributeName object exactly as if
+         * constructed.
          */
-        obj = js_NewObject(cx,
-                           JS_ValueToFunction(cx, argv[-2])->clasp,
-                           NULL, NULL);
+        obj = js_NewObject(cx, clasp, NULL, NULL);
         if (!obj)
             return JS_FALSE;
         *rval = OBJECT_TO_JSVAL(obj);
@@ -959,14 +967,18 @@
 }
 
 static JSBool
+QName(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
+{
+    return QNameHelper(cx, (cx->fp->flags & JSFRAME_CONSTRUCTING) ? obj : NULL,
+                       &js_QNameClass.base, argc, argv, rval);
+}
+
+static JSBool
 AttributeName(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
               jsval *rval)
 {
-    /*
-     * Since js_AttributeNameClass was initialized, obj will have that as its
-     * class, not js_QNameClass.
-     */
-    return QName(cx, obj, argc, argv, rval);
+    return QNameHelper(cx, (cx->fp->flags & JSFRAME_CONSTRUCTING) ? obj : NULL,
+                       &js_AttributeNameClass, argc, argv, rval);
 }
 
 /*
@@ -5591,21 +5603,6 @@
     NULL,              NULL,              NULL,              NULL
 };
 
-static JSObject *
-CallConstructorFunction(JSContext *cx, JSObject *obj, JSClass *clasp,
-                        uintN argc, jsval *argv)
-{
-    JSObject *tmp;
-    jsval rval;
-
-    while ((tmp = OBJ_GET_PARENT(cx, obj)) != NULL)
-        obj = tmp;
-    if (!JS_CallFunctionName(cx, obj, clasp->name, argc, argv, &rval))
-        return NULL;
-    JS_ASSERT(!JSVAL_IS_PRIMITIVE(rval));
-    return JSVAL_TO_OBJECT(rval);
-}
-
 static JSXML *
 StartNonListXMLMethod(JSContext *cx, JSObject **objp, jsval *argv)
 {
@@ -5660,25 +5657,25 @@
                  jsval *rval)
 {
     JSXML *xml;
-    JSObject *nsobj;
     JSXMLNamespace *ns;
 
     NON_LIST_XML_METHOD_PROLOG;
     if (xml->xml_class != JSXML_CLASS_ELEMENT)
-        return JS_TRUE;
+        goto done;
     xml = CHECK_COPY_ON_WRITE(cx, xml, obj);
     if (!xml)
         return JS_FALSE;
-
-    nsobj = CallConstructorFunction(cx, obj, &js_NamespaceClass.base, 1, argv);
-    if (!nsobj)
+    
+    if (!NamespaceHelper(cx, NULL, 1, argv, rval))
         return JS_FALSE;
-    argv[0] = OBJECT_TO_JSVAL(nsobj);
-
-    ns = (JSXMLNamespace *) JS_GetPrivate(cx, nsobj);
+    JS_ASSERT(!JSVAL_IS_PRIMITIVE(*rval));
+    
+    ns = (JSXMLNamespace *) JS_GetPrivate(cx, JSVAL_TO_OBJECT(*rval));
     if (!AddInScopeNamespace(cx, xml, ns))
         return JS_FALSE;
     ns->declared = JS_TRUE;
+
+  done:
     *rval = OBJECT_TO_JSVAL(obj);
     return JS_TRUE;
 }
@@ -6825,40 +6822,40 @@
                     jsval *rval)
 {
     JSXML *xml;
-    JSObject *nsobj;
     JSXMLNamespace *ns;
 
     NON_LIST_XML_METHOD_PROLOG;
-    *rval = OBJECT_TO_JSVAL(obj);
     if (xml->xml_class != JSXML_CLASS_ELEMENT)
-        return JS_TRUE;
+        goto done;
     xml = CHECK_COPY_ON_WRITE(cx, xml, obj);
     if (!xml)
         return JS_FALSE;
 
-    nsobj = CallConstructorFunction(cx, obj, &js_NamespaceClass.base, 1, argv);
-    if (!nsobj)
+    if (!NamespaceHelper(cx, NULL, 1, argv, rval))
         return JS_FALSE;
-    argv[0] = OBJECT_TO_JSVAL(nsobj);
-    ns = (JSXMLNamespace *) JS_GetPrivate(cx, nsobj);
+    JS_ASSERT(!JSVAL_IS_PRIMITIVE(*rval));
+    ns = (JSXMLNamespace *) JS_GetPrivate(cx, JSVAL_TO_OBJECT(*rval));
 
     /* NOTE: remove ns from each ancestor if not used by that ancestor. */
-    return xml_removeNamespace_helper(cx, xml, ns);
+    if (!xml_removeNamespace_helper(cx, xml, ns))
+        return JS_FALSE;
+  done:
+    *rval = OBJECT_TO_JSVAL(obj);
+    return JS_TRUE;
 }
 
 static JSBool
 xml_replace(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
 {
     JSXML *xml, *vxml, *kid;
-    jsval name, value, id, junk;
+    jsval value, id, junk;
     uint32 index;
-    JSObject *nameobj;
     JSXMLQName *nameqn;
 
     NON_LIST_XML_METHOD_PROLOG;
     *rval = OBJECT_TO_JSVAL(obj);
     if (xml->xml_class != JSXML_CLASS_ELEMENT)
-        return JS_TRUE;
+        goto done;
 
     value = argv[1];
     vxml = VALUE_IS_XML(cx, value)
@@ -6879,32 +6876,39 @@
     if (!xml)
         return JS_FALSE;
 
-    name = argv[0];
-    if (js_IdIsIndex(name, &index))
-        return Replace(cx, xml, name, value);
+    id = argv[0];
+    if (!js_IdIsIndex(id, &index)) {
+        /*
+         * Call function QName per spec, not ToXMLName, to avoid attribute
+         * names.
+         */
+        if (!QNameHelper(cx, NULL, &js_QNameClass.base, 1, argv, rval))
+            return JS_FALSE;
+        JS_ASSERT(!JSVAL_IS_PRIMITIVE(*rval));
+        nameqn = (JSXMLQName *) JS_GetPrivate(cx, JSVAL_TO_OBJECT(*rval));
+        
+        id = JSVAL_VOID;
+        index = xml->xml_kids.length;
+        while (index != 0) {
+            --index;
+            kid = XMLARRAY_MEMBER(&xml->xml_kids, index, JSXML);
+            if (kid && MatchElemName(nameqn, kid)) {
+                if (!JSVAL_IS_VOID(id) && !DeleteByIndex(cx, xml, id, &junk))
+                    return JS_FALSE;
+                if (!IndexToIdVal(cx, index, &id))
+                    return JS_FALSE;
+            }
+        }
+        if (JSVAL_IS_VOID(id))
+            goto done;
+    }
 
-    /* Call function QName per spec, not ToXMLName, to avoid attribute names. */
-    nameobj = CallConstructorFunction(cx, obj, &js_QNameClass.base, 1, &name);
-    if (!nameobj)
+    if (!Replace(cx, xml, id, value))
         return JS_FALSE;
-    argv[0] = OBJECT_TO_JSVAL(nameobj);
-    nameqn = (JSXMLQName *) JS_GetPrivate(cx, nameobj);
 
-    id = JSVAL_VOID;
-    index = xml->xml_kids.length;
-    while (index != 0) {
-        --index;
-        kid = XMLARRAY_MEMBER(&xml->xml_kids, index, JSXML);
-        if (kid && MatchElemName(nameqn, kid)) {
-            if (!JSVAL_IS_VOID(id) && !DeleteByIndex(cx, xml, id, &junk))
-                return JS_FALSE;
-            if (!IndexToIdVal(cx, index, &id))
-                return JS_FALSE;
-        }
-    }
-    if (JSVAL_IS_VOID(id))
-        return JS_TRUE;
-    return Replace(cx, xml, id, value);
+  done:
+    *rval = OBJECT_TO_JSVAL(obj);
+    return JS_TRUE;
 }
 
 static JSBool
diff -Nru seamonkey-1.1.11+nobinonly/js/src/xpconnect/src/xpcconvert.cpp seamonkey-1.1.12+nobinonly/js/src/xpconnect/src/xpcconvert.cpp
--- seamonkey-1.1.11+nobinonly/js/src/xpconnect/src/xpcconvert.cpp	2006-09-15 20:03:14.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/js/src/xpconnect/src/xpcconvert.cpp	2008-08-30 01:14:56.000000000 +0200
@@ -1091,6 +1091,7 @@
                 // printf("Wrapped native accessed across scope boundary\n");
 
                 JSScript* script = nsnull;
+                JSObject* callee = nsnull;
                 if(ccx.GetXPCContext()->CallerTypeIsJavaScript())
                 {
                     // Called from JS.  We're going to hand the resulting
@@ -1098,15 +1099,20 @@
                     // the stack.
                     JSContext* cx = ccx;
                     JSStackFrame* fp = cx->fp;
-                    while(!script && fp)
+                    while(fp)
                     {
                         script = fp->script;
+                        if(script)
+                        {
+                            callee = fp->callee;
+                            break;
+                        }
                         fp = fp->down;
                     }
                 }
                 else if(ccx.GetXPCContext()->CallerTypeIsNative())
                 {
-                    JSObject* callee = ccx.GetCallee();
+                    callee = ccx.GetCallee();
                     if(callee && JS_ObjectIsFunction(ccx, callee))
                     {
                         // Called from c++, and calling out to |callee|, which
@@ -1119,8 +1125,12 @@
                                      "object");
                         script = JS_GetFunctionScript(ccx, fun);
                     }
-                    // Else we don't know whom we're calling, so don't create
-                    // XPCNativeWrappers.
+                    else
+                    {
+                        // Else we don't know whom we're calling, so don't
+                        // create XPCNativeWrappers.
+                        callee = nsnull;
+                    }
                 }
                 // else don't create XPCNativeWrappers, since we have
                 // no idea what's calling what here.
@@ -1141,7 +1151,7 @@
 #endif
 
                     JSObject *nativeWrapper =
-                        XPCNativeWrapper::GetNewOrUsed(ccx, wrapper);
+                        XPCNativeWrapper::GetNewOrUsed(ccx, wrapper, callee);
 
                     if (nativeWrapper)
                     {
diff -Nru seamonkey-1.1.11+nobinonly/js/src/xpconnect/src/XPCNativeWrapper.cpp seamonkey-1.1.12+nobinonly/js/src/xpconnect/src/XPCNativeWrapper.cpp
--- seamonkey-1.1.11+nobinonly/js/src/xpconnect/src/XPCNativeWrapper.cpp	2008-06-16 00:25:46.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/js/src/xpconnect/src/XPCNativeWrapper.cpp	2008-08-30 01:14:56.000000000 +0200
@@ -224,6 +224,20 @@
 }
 
 static inline
+already_AddRefed<nsIScriptSecurityManager>
+GetSecurityManager(JSContext *cx)
+{
+  XPCCallContext ccx(JS_CALLER, cx);
+  nsIXPCSecurityManager *sm = ccx.GetXPCContext()->
+    GetAppropriateSecurityManager(nsIXPCSecurityManager::HOOK_CALL_METHOD);
+  nsCOMPtr<nsIScriptSecurityManager> ssm(do_QueryInterface(sm));
+
+  nsIScriptSecurityManager *rval = nsnull;
+  ssm.swap(rval);
+  return rval;
+}
+
+static inline
 JSBool
 EnsureLegalActivity(JSContext *cx, JSObject *obj)
 {
@@ -244,10 +258,12 @@
     return JS_TRUE;
   }
 
-  XPCCallContext ccx(JS_CALLER, cx);
-  nsIXPCSecurityManager *sm = ccx.GetXPCContext()->
-    GetAppropriateSecurityManager(nsIXPCSecurityManager::HOOK_CALL_METHOD);
-  nsCOMPtr<nsIScriptSecurityManager> ssm(do_QueryInterface(sm));
+  nsCOMPtr<nsIScriptSecurityManager> ssm(GetSecurityManager(cx));
+  if (!ssm) {
+    // If there's no security manager, then we're not running in a browser
+    // context: allow access.
+    return JS_TRUE;
+  }
 
   // A last ditch effort to allow access: if the currently-running code
   // has UniversalXPConnect privileges, then allow access.
@@ -412,7 +428,8 @@
     // Just using GetNewOrUsed on the return value of
     // GetWrappedNativeOfJSObject will give the right thing -- the unique deep
     // implicit wrapper associated with wrappedNative.
-    JSObject* wrapperObj = XPCNativeWrapper::GetNewOrUsed(cx, wrappedNative);
+    JSObject* wrapperObj = XPCNativeWrapper::GetNewOrUsed(cx, wrappedNative,
+                                                          nsnull);
     if (!wrapperObj) {
       return JS_FALSE;
     }
@@ -1097,7 +1114,7 @@
     XPCWrappedNative *parent_wrapper =
       XPCWrappedNative::GetWrappedNativeOfJSObject(cx, wn_parent);
 
-    *result = XPCNativeWrapper::GetNewOrUsed(cx, parent_wrapper);
+    *result = XPCNativeWrapper::GetNewOrUsed(cx, parent_wrapper, nsnull);
     if (!*result)
       return JS_FALSE;
   }
@@ -1115,7 +1132,7 @@
   // |obj| almost always has the wrong proto and parent so we have to create
   // our own object anyway.  Set |obj| to null so we don't use it by accident.
   obj = nsnull;
-  
+
   jsval native = argv[0];
 
   if (JSVAL_IS_PRIMITIVE(native)) {
@@ -1479,8 +1496,28 @@
 
 // static
 JSObject *
-XPCNativeWrapper::GetNewOrUsed(JSContext *cx, XPCWrappedNative *wrapper)
+XPCNativeWrapper::GetNewOrUsed(JSContext *cx, XPCWrappedNative *wrapper,
+                               JSObject *callee)
 {
+  if (callee) {
+    nsCOMPtr<nsIPrincipal> prin;
+
+    nsCOMPtr<nsIScriptSecurityManager> ssm = GetSecurityManager(cx);
+    nsresult rv = ssm
+                  ? ssm->GetObjectPrincipal(cx, callee, getter_AddRefs(prin))
+                  : NS_ERROR_FAILURE;
+    if (NS_SUCCEEDED(rv) && prin) {
+      nsCOMPtr<nsIPrincipal> sysprin;
+      rv = ssm->GetSystemPrincipal(getter_AddRefs(sysprin));
+      if (NS_SUCCEEDED(rv) && sysprin != prin) {
+        jsval v = OBJECT_TO_JSVAL(wrapper->GetFlatJSObject());
+        if (!XPCNativeWrapperCtor(cx, JSVAL_TO_OBJECT(v), 1, &v, &v))
+          return nsnull;
+        return JSVAL_TO_OBJECT(v);
+      }
+    }
+  }
+
   // Prevent wrapping a double-wrapped JS object in an
   // XPCNativeWrapper!
   nsCOMPtr<nsIXPConnectWrappedJS> xpcwrappedjs(do_QueryWrappedNative(wrapper));
diff -Nru seamonkey-1.1.11+nobinonly/js/src/xpconnect/src/XPCNativeWrapper.h seamonkey-1.1.12+nobinonly/js/src/xpconnect/src/XPCNativeWrapper.h
--- seamonkey-1.1.11+nobinonly/js/src/xpconnect/src/XPCNativeWrapper.h	2005-05-26 23:35:27.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/js/src/xpconnect/src/XPCNativeWrapper.h	2008-08-30 01:14:56.000000000 +0200
@@ -46,7 +46,8 @@
   static PRBool AttachNewConstructorObject(XPCCallContext &ccx,
                                            JSObject *aGlobalObject);
 
-  static JSObject *GetNewOrUsed(JSContext *cx, XPCWrappedNative *wrapper);
+  static JSObject *GetNewOrUsed(JSContext *cx, XPCWrappedNative *wrapper,
+                                JSObject *callee);
 
   static PRBool IsNativeWrapperClass(JSClass *clazz)
   {
diff -Nru seamonkey-1.1.11+nobinonly/layout/mathml/base/src/nsMathMLmtableFrame.cpp seamonkey-1.1.12+nobinonly/layout/mathml/base/src/nsMathMLmtableFrame.cpp
--- seamonkey-1.1.11+nobinonly/layout/mathml/base/src/nsMathMLmtableFrame.cpp	2006-12-22 14:51:26.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/layout/mathml/base/src/nsMathMLmtableFrame.cpp	2008-08-30 01:15:35.000000000 +0200
@@ -53,6 +53,7 @@
 #include "nsTableOuterFrame.h"
 #include "nsTableFrame.h"
 #include "nsTableCellFrame.h"
+#include "celldata.h"
 
 #include "nsMathMLmtableFrame.h"
 
@@ -629,8 +630,9 @@
                    nsMathMLAtoms::rowspan_, value)) {
     PRInt32 error;
     rowspan = value.ToInteger(&error);
-    if (error)
+    if (error || rowspan < 0)
       rowspan = 1;
+    rowspan = PR_MIN(rowspan, MAX_ROWSPAN);
   }
   return rowspan;
 }
@@ -644,7 +646,7 @@
                    nsMathMLAtoms::columnspan_, value)) {
     PRInt32 error;
     colspan = value.ToInteger(&error);
-    if (error)
+    if (error || colspan < 0 || colspan > MAX_COLSPAN)
       colspan = 1;
   }
   return colspan;
diff -Nru seamonkey-1.1.11+nobinonly/layout/style/nsCSSScanner.cpp seamonkey-1.1.12+nobinonly/layout/style/nsCSSScanner.cpp
--- seamonkey-1.1.11+nobinonly/layout/style/nsCSSScanner.cpp	2006-05-30 22:55:08.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/layout/style/nsCSSScanner.cpp	2008-08-30 01:15:45.000000000 +0200
@@ -791,10 +791,7 @@
         ch = Read(aErrorCode);
         if (ch < 0) break;
         if (ch == CSS_ESCAPE) {
-          ch = ParseEscape(aErrorCode);
-          if (0 < ch) {
-            ident.Append(PRUnichar(ch));
-          }
+          ParseAndAppendEscape(aErrorCode, ident);
         } else if ((ch == '"') || (ch == '\'') || (ch == '(')) {
           // This is an invalid URL spec
           ok = PR_FALSE;
@@ -830,12 +827,14 @@
 }
 
 
-PRInt32 nsCSSScanner::ParseEscape(nsresult& aErrorCode)
+void
+nsCSSScanner::ParseAndAppendEscape(nsresult& aErrorCode, nsString& aOutput)
 {
   PRUint8* lexTable = gLexTable;
   PRInt32 ch = Peek(aErrorCode);
   if (ch < 0) {
-    return CSS_ESCAPE;
+    aOutput.Append(CSS_ESCAPE);
+    return;
   }
   if ((ch <= 255) && ((lexTable[ch] & IS_HEX_DIGIT) != 0)) {
     PRInt32 rv = 0;
@@ -882,18 +881,22 @@
         }
       }
     }
-    return rv;
+    NS_ASSERTION(rv >= 0, "How did rv become negative?");
+    if (rv > 0) {
+      AppendUCS4ToUTF16(ENSURE_VALID_CHAR(rv), aOutput);
+    }
+    return;
   } else {
     // "Any character except a hexidecimal digit can be escaped to
     // remove its special meaning by putting a backslash in front"
     // -- CSS1 spec section 7.1
-    if (EatNewline(aErrorCode)) { // skip escaped newline
-      ch = 0;
-    }
-    else {
+    if (!EatNewline(aErrorCode)) { // skip escaped newline
       (void) Read(aErrorCode);
+      if (ch > 0) {
+        aOutput.Append(ch);
+      }
     }
-    return ch;
+    return;
   }
 }
 
@@ -908,19 +911,16 @@
                                  nsString& aIdent)
 {
   if (aChar == CSS_ESCAPE) {
-    aChar = ParseEscape(aErrorCode);
+    ParseAndAppendEscape(aErrorCode, aIdent);
   }
-  if (0 < aChar) {
-    aIdent.Append(PRUnichar(aChar));
+  else if (0 < aChar) {
+    aIdent.Append(aChar);
   }
   for (;;) {
     aChar = Read(aErrorCode);
     if (aChar < 0) break;
     if (aChar == CSS_ESCAPE) {
-      aChar = ParseEscape(aErrorCode);
-      if (0 < aChar) {
-        aIdent.Append(PRUnichar(aChar));
-      }
+      ParseAndAppendEscape(aErrorCode, aIdent);
     } else if ((aChar > 255) || ((gLexTable[aChar] & IS_IDENT) != 0)) {
       aIdent.Append(PRUnichar(aChar));
     } else {
@@ -1130,13 +1130,10 @@
       break;
     }
     if (ch == CSS_ESCAPE) {
-      ch = ParseEscape(aErrorCode);
-      if (ch < 0) {
-        return PR_FALSE;
-      }
+      ParseAndAppendEscape(aErrorCode, aToken.mIdent);
     }
-    if (0 < ch) {
-      aToken.mIdent.Append(PRUnichar(ch));
+    else if (0 < ch) {
+      aToken.mIdent.Append(ch);
     }
   }
   return PR_TRUE;
diff -Nru seamonkey-1.1.11+nobinonly/layout/style/nsCSSScanner.h seamonkey-1.1.12+nobinonly/layout/style/nsCSSScanner.h
--- seamonkey-1.1.11+nobinonly/layout/style/nsCSSScanner.h	2005-08-31 23:23:16.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/layout/style/nsCSSScanner.h	2008-08-30 01:15:45.000000000 +0200
@@ -198,7 +198,7 @@
   PRBool EatWhiteSpace(nsresult& aErrorCode);
   PRBool EatNewline(nsresult& aErrorCode);
 
-  PRInt32 ParseEscape(nsresult& aErrorCode);
+  void ParseAndAppendEscape(nsresult& aErrorCode, nsString& aOutput);
   PRBool ParseIdent(nsresult& aErrorCode, PRInt32 aChar, nsCSSToken& aResult);
   PRBool ParseAtKeyword(nsresult& aErrorCode, PRInt32 aChar,
                         nsCSSToken& aResult);
diff -Nru seamonkey-1.1.11+nobinonly/layout/tables/celldata.h seamonkey-1.1.12+nobinonly/layout/tables/celldata.h
--- seamonkey-1.1.11+nobinonly/layout/tables/celldata.h	2005-04-07 20:04:37.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/layout/tables/celldata.h	2008-08-30 01:15:45.000000000 +0200
@@ -40,6 +40,9 @@
 #include "nsISupports.h"
 #include "nsCoord.h"
 
+#define MAX_ROWSPAN 8190 // the cellmap can not handle more
+#define MAX_COLSPAN 1000 // limit as IE and opera do
+
 class nsTableCellFrame;
 
 /** 
diff -Nru seamonkey-1.1.11+nobinonly/mail/config/version.txt seamonkey-1.1.12+nobinonly/mail/config/version.txt
--- seamonkey-1.1.11+nobinonly/mail/config/version.txt	2008-07-03 00:57:50.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/mail/config/version.txt	2008-08-30 01:12:08.000000000 +0200
@@ -1 +1 @@
-2.0.0.16pre
+2.0.0.17pre
diff -Nru seamonkey-1.1.11+nobinonly/mailnews/base/resources/content/msgAccountCentral.xul seamonkey-1.1.12+nobinonly/mailnews/base/resources/content/msgAccountCentral.xul
--- seamonkey-1.1.11+nobinonly/mailnews/base/resources/content/msgAccountCentral.xul	2005-10-20 22:42:32.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/mailnews/base/resources/content/msgAccountCentral.xul	2008-08-30 01:16:09.000000000 +0200
@@ -65,16 +65,16 @@
   <script type="application/x-javascript" src="chrome://messenger/content/msgAccountCentral.js"/>
 
   <grid id="acctCentralGrid" flex="1" style="overflow: auto;"> 
-    <columns>
+    <columns id="acctCentralColumns">
       <column flex="40" id="acctCentralActionsColumn"/>
       <column flex="60" id="acctCentralHelpDataColumn"/>
     </columns>
 
-    <rows>
+    <rows id="acctCentralRows">
       <row id="acctCentralHeaderRow">
         <label id="AccountCentralTitle"/>
       </row>
-      <separator/>
+      <separator id="acctCentralHeader.separator"/>
 
       <row id="EmailHeader" class="acctCentralTitleRow">
         <hbox class="acctCentralRowTitleBox">
diff -Nru seamonkey-1.1.11+nobinonly/mailnews/base/resources/content/widgetglue.js seamonkey-1.1.12+nobinonly/mailnews/base/resources/content/widgetglue.js
--- seamonkey-1.1.11+nobinonly/mailnews/base/resources/content/widgetglue.js	2006-07-19 16:59:19.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/mailnews/base/resources/content/widgetglue.js	2008-08-30 01:16:09.000000000 +0200
@@ -274,6 +274,11 @@
 
 function RebuildSummaryFile(msgFolder)
 {
+  if (msgFolder.locked)
+  {
+    msgFolder.throwAlertMsg("operationFailedFolderBusy", msgWindow);
+    return;
+  }
   var msgDB = msgFolder.getMsgDatabase(msgWindow);
   msgDB.summaryValid = false;
   msgFolder.ForceDBClosed();
diff -Nru seamonkey-1.1.11+nobinonly/mailnews/base/src/nsMsgQuickSearchDBView.cpp seamonkey-1.1.12+nobinonly/mailnews/base/src/nsMsgQuickSearchDBView.cpp
--- seamonkey-1.1.11+nobinonly/mailnews/base/src/nsMsgQuickSearchDBView.cpp	2006-12-22 14:51:49.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/mailnews/base/src/nsMsgQuickSearchDBView.cpp	2008-08-30 01:16:10.000000000 +0200
@@ -264,7 +264,8 @@
     PRUint32 numBadHits;
     if (m_db)
     {
-      m_db->RefreshCache(searchUri, m_hdrHits.Count(), keyArray.GetArray(), &numBadHits, &staleHits);
+      nsresult rv = m_db->RefreshCache(searchUri, m_hdrHits.Count(), keyArray.GetArray(), &numBadHits, &staleHits);
+      NS_ENSURE_SUCCESS(rv, rv);
       for (i = 0; i < numBadHits; i++)
       {
         nsMsgViewIndex staleHitIndex = FindKey(staleHits[i], PR_TRUE);
diff -Nru seamonkey-1.1.11+nobinonly/mailnews/import/eudora/src/nsEudoraWin32.cpp seamonkey-1.1.12+nobinonly/mailnews/import/eudora/src/nsEudoraWin32.cpp
--- seamonkey-1.1.11+nobinonly/mailnews/import/eudora/src/nsEudoraWin32.cpp	2007-11-19 21:41:25.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/mailnews/import/eudora/src/nsEudoraWin32.cpp	2008-08-30 01:16:13.000000000 +0200
@@ -942,7 +942,19 @@
 		if (mimeType.IsEmpty())
 			mimeType = "application/octet-stream";
 
-    aAttachmentName = name; // use the leaf name of the attachment file url as the attachment name
+        // Convert description to unicode.
+        nsCOMPtr<nsIImportService> impSvc = do_GetService(NS_IMPORTSERVICE_CONTRACTID);
+        NS_ASSERTION(NS_SUCCEEDED(rv), "failed to get import service");
+        if (NS_SUCCEEDED(rv)) {
+            nsAutoString description;
+            rv = impSvc->SystemStringToUnicode(name.get(), description);
+            NS_ASSERTION(NS_SUCCEEDED(rv), "failed to convert system string to unicode");
+            if (NS_SUCCEEDED(rv))
+                aAttachmentName = NS_ConvertUTF16toUTF8(description);
+        }
+
+        if (aAttachmentName.IsEmpty())
+            aAttachmentName = name;
 
 		return( NS_OK);
 	}
diff -Nru seamonkey-1.1.11+nobinonly/mailnews/local/src/nsParseMailbox.cpp seamonkey-1.1.12+nobinonly/mailnews/local/src/nsParseMailbox.cpp
--- seamonkey-1.1.11+nobinonly/mailnews/local/src/nsParseMailbox.cpp	2007-07-15 16:44:29.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/mailnews/local/src/nsParseMailbox.cpp	2008-08-30 01:16:15.000000000 +0200
@@ -2160,7 +2160,7 @@
 }
 
 nsresult nsParseNewMailState::AppendMsgFromFile(nsIOFileStream *fileStream, 
-                                                PRInt32 offset, PRUint32 length,
+                                                PRUint32 offset, PRUint32 length,
                                                 nsFileSpec &destFileSpec)
 {
   fileStream->seek(PR_SEEK_SET, offset);
diff -Nru seamonkey-1.1.11+nobinonly/mailnews/local/src/nsParseMailbox.h seamonkey-1.1.12+nobinonly/mailnews/local/src/nsParseMailbox.h
--- seamonkey-1.1.11+nobinonly/mailnews/local/src/nsParseMailbox.h	2007-07-15 16:44:29.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/mailnews/local/src/nsParseMailbox.h	2008-08-30 01:16:15.000000000 +0200
@@ -255,7 +255,7 @@
   void            GetMsgWindow(nsIMsgWindow **aMsgWindow);
   nsresult EndMsgDownload();
 
-  nsresult AppendMsgFromFile(nsIOFileStream *fileStream, PRInt32 offset, 
+  nsresult AppendMsgFromFile(nsIOFileStream *fileStream, PRUint32 offset, 
                              PRUint32 length, nsFileSpec &destFileSpec);
 
   virtual void	ApplyFilters(PRBool *pMoved, nsIMsgWindow *msgWindow, 
diff -Nru seamonkey-1.1.11+nobinonly/mailnews/news/src/nsNNTPProtocol.cpp seamonkey-1.1.12+nobinonly/mailnews/news/src/nsNNTPProtocol.cpp
--- seamonkey-1.1.11+nobinonly/mailnews/news/src/nsNNTPProtocol.cpp	2006-06-30 19:46:30.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/mailnews/news/src/nsNNTPProtocol.cpp	2008-08-30 01:16:18.000000000 +0200
@@ -4103,7 +4103,6 @@
     char *subject = nsnull;
     char *newsgroups = nsnull;
     char *distribution = nsnull;
-    char *other_random_headers = nsnull;
     char *body = nsnull;
     cancelInfoEntry cancelInfo;
     PRBool requireConfirmationForCancel = PR_TRUE;
@@ -4153,7 +4152,6 @@
   L = PL_strlen (id);
   
   subject = (char *) PR_Malloc (L + 20);
-  other_random_headers = (char *) PR_Malloc (L + 20);
   body = (char *) PR_Malloc (PL_strlen (XP_AppCodeName) + 100);
   
   nsXPIDLString alertText;
@@ -4161,6 +4159,9 @@
   
   PRInt32 confirmCancelResult = 0;
 
+  // A little early to declare, but the goto causes problems
+  nsCAutoString otherHeaders;
+ 
   /* Make sure that this loser isn't cancelling someone else's posting.
      Yes, there are occasionally good reasons to do so.  Those people
      capable of making that decision (news admins) have other tools with
@@ -4228,7 +4229,7 @@
       goto FAIL;
   }  
   
-  if (!subject || !other_random_headers || !body) 
+  if (!subject || !body) 
   {
     status = MK_OUT_OF_MEMORY;
     failure = PR_TRUE;
@@ -4238,13 +4239,13 @@
   PL_strcpy (subject, "cancel ");
   PL_strcat (subject, id);
 
-  PL_strcpy (other_random_headers, "Control: cancel ");
-  PL_strcat (other_random_headers, id);
-  PL_strcat (other_random_headers, CRLF);
+  otherHeaders.AppendLiteral("Control: cancel ");
+  otherHeaders += id;
+  otherHeaders.AppendLiteral(CRLF);
   if (distribution) {
-    PL_strcat (other_random_headers, "Distribution: ");
-	  PL_strcat (other_random_headers, distribution);
-	  PL_strcat (other_random_headers, CRLF);
+    otherHeaders.AppendLiteral("Distribution: ");
+    otherHeaders += distribution;
+    otherHeaders.AppendLiteral(CRLF);
   }
 
   PL_strcpy (body, "This message was cancelled from within ");
@@ -4262,12 +4263,12 @@
                        "Newsgroups: %s" CRLF
                        "Subject: %s" CRLF
                        "References: %s" CRLF
-                       "%s" /* other_random_headers, already with CRLF */
+                       "%s" /* otherHeaders, already with CRLF */
                        CRLF /* body separator */
                        "%s" /* body, already with CRLF */
                        "." CRLF, /* trailing message terminator "." */
                        cancelInfo.from, newsgroups, subject, id,
-                       other_random_headers, body);
+                       otherHeaders.get(), body);
     
     nsCOMPtr<nsIMsgMailNewsUrl> mailnewsurl = do_QueryInterface(m_runningURL);
     if (mailnewsurl)
@@ -4314,7 +4315,6 @@
   PR_Free (subject);
   PR_Free (newsgroups);
   PR_Free (distribution);
-  PR_Free (other_random_headers);
   PR_Free (body);
 
   return status;
diff -Nru seamonkey-1.1.11+nobinonly/modules/libpr0n/decoders/xbm/nsXBMDecoder.cpp seamonkey-1.1.12+nobinonly/modules/libpr0n/decoders/xbm/nsXBMDecoder.cpp
--- seamonkey-1.1.11+nobinonly/modules/libpr0n/decoders/xbm/nsXBMDecoder.cpp	2007-07-15 16:41:25.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/modules/libpr0n/decoders/xbm/nsXBMDecoder.cpp	2008-08-30 01:12:13.000000000 +0200
@@ -219,6 +219,8 @@
           return NS_ERROR_OUT_OF_MEMORY;
         }
 
+        memset(mAlphaRow, 0, abpr);
+
         mState = RECV_SEEK;
 
         mCurRow = 0;
diff -Nru seamonkey-1.1.11+nobinonly/modules/plugin/base/src/nsJSNPRuntime.cpp seamonkey-1.1.12+nobinonly/modules/plugin/base/src/nsJSNPRuntime.cpp
--- seamonkey-1.1.11+nobinonly/modules/plugin/base/src/nsJSNPRuntime.cpp	2008-01-29 20:30:43.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/modules/plugin/base/src/nsJSNPRuntime.cpp	2008-08-30 01:14:59.000000000 +0200
@@ -1313,10 +1313,22 @@
   entry->mNPObj = npobj;
   entry->mNpp = npp;
 
+  PRUint32 generation = sNPObjWrappers.generation;
+
   // No existing JSObject, create one.
 
   JSObject *obj = ::JS_NewObject(cx, &sNPObjectJSWrapperClass, nsnull, nsnull);
 
+  if (generation != sNPObjWrappers.generation) {
+      // Reload entry if the JS_NewObject call caused a GC and reallocated
+      // the table (see bug 445229). This is guaranteed to succeed.
+
+      entry = static_cast<NPObjWrapperHashEntry *>
+        (PL_DHashTableOperate(&sNPObjWrappers, npobj, PL_DHASH_LOOKUP));
+      NS_ASSERTION(entry && PL_DHASH_ENTRY_IS_BUSY(entry),
+                   "Hashtable didn't find what we just added?");
+  }
+
   if (!obj) {
     // OOM? Remove the stale entry from the hash.
 
diff -Nru seamonkey-1.1.11+nobinonly/modules/plugin/base/src/nsPluginHostImpl.cpp seamonkey-1.1.12+nobinonly/modules/plugin/base/src/nsPluginHostImpl.cpp
--- seamonkey-1.1.11+nobinonly/modules/plugin/base/src/nsPluginHostImpl.cpp	2007-05-03 03:38:13.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/modules/plugin/base/src/nsPluginHostImpl.cpp	2008-08-30 01:14:59.000000000 +0200
@@ -1882,6 +1882,7 @@
       return rv;
 
     // Create a file to save our stream into. Should we scramble the name?
+    filename.Insert(NS_LITERAL_CSTRING("plugin-"), 0);
     rv = pluginTmp->AppendNative(filename);
     if (NS_FAILED(rv))
       return rv;
diff -Nru seamonkey-1.1.11+nobinonly/netwerk/base/src/nsStandardURL.cpp seamonkey-1.1.12+nobinonly/netwerk/base/src/nsStandardURL.cpp
--- seamonkey-1.1.11+nobinonly/netwerk/base/src/nsStandardURL.cpp	2008-03-13 20:10:43.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/netwerk/base/src/nsStandardURL.cpp	2008-08-30 01:15:04.000000000 +0200
@@ -2258,6 +2258,7 @@
     
     if (mRef.mLen < 0) {
         mSpec.Append('#');
+        ++mPath.mLen;  // Include the # in the path.
         mRef.mPos = mSpec.Length();
         mRef.mLen = 0;
     }
diff -Nru seamonkey-1.1.11+nobinonly/netwerk/dns/src/nsIDNService.cpp seamonkey-1.1.12+nobinonly/netwerk/dns/src/nsIDNService.cpp
--- seamonkey-1.1.11+nobinonly/netwerk/dns/src/nsIDNService.cpp	2005-07-22 17:07:33.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/netwerk/dns/src/nsIDNService.cpp	2008-08-30 01:15:04.000000000 +0200
@@ -151,6 +151,9 @@
 /* ACString ConvertUTF8toACE (in AUTF8String input); */
 NS_IMETHODIMP nsIDNService::ConvertUTF8toACE(const nsACString & input, nsACString & ace)
 {
+  // protect against bogus input
+  NS_ENSURE_TRUE(IsUTF8(input), NS_ERROR_UNEXPECTED);
+
   nsresult rv;
   NS_ConvertUTF8toUCS2 ustr(input);
 
diff -Nru seamonkey-1.1.11+nobinonly/netwerk/protocol/res/src/nsResProtocolHandler.cpp seamonkey-1.1.12+nobinonly/netwerk/protocol/res/src/nsResProtocolHandler.cpp
--- seamonkey-1.1.11+nobinonly/netwerk/protocol/res/src/nsResProtocolHandler.cpp	2007-05-03 03:38:16.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/netwerk/protocol/res/src/nsResProtocolHandler.cpp	2008-08-30 01:15:05.000000000 +0200
@@ -22,6 +22,7 @@
  * Contributor(s):
  *   Darin Fisher <darin@netscape.com>
  *   Benjamin Smedberg <bsmedberg@covad.net>
+ *   Daniel Veditz <dveditz@cruzio.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -176,6 +177,9 @@
     //XXXbsmedberg Neil wants a resource://pchrome/ for the profile chrome dir...
     // but once I finish multiple chrome registration I'm not sure that it is needed
 
+    // XXX dveditz: resource://pchrome/ defeats profile directory salting
+    // if web content can load it. Tread carefully.
+
     return rv;
 }
 
@@ -227,7 +231,36 @@
         return NS_ERROR_OUT_OF_MEMORY;
     NS_ADDREF(resURL);
 
-    rv = resURL->Init(nsIStandardURL::URLTYPE_STANDARD, -1, aSpec, aCharset, aBaseURI);
+    // unescape any %2f and %2e to make sure nsStandardURL coalesces them.
+    // Later net_GetFileFromURLSpec() will do a full unescape and we want to
+    // treat them the same way the file system will. (bugs 380994, 394075)
+    nsCAutoString spec;
+    const char *src = aSpec.BeginReading();
+    const char *end = aSpec.EndReading();
+    const char *last = src;
+
+    spec.SetCapacity(aSpec.Length()+1);
+    for ( ; src < end; ++src) {
+        if (*src == '%' && (src < end-2) && *(src+1) == '2') {
+           char ch = '\0';
+           if (*(src+2) == 'f' || *(src+2) == 'F')
+             ch = '/';
+           else if (*(src+2) == 'e' || *(src+2) == 'E')
+             ch = '.';
+
+           if (ch) {
+             if (last < src)
+               spec.Append(last, src-last);
+             spec.Append(ch);
+             src += 2;
+             last = src+1; // src will be incremented by the loop
+           }
+        }
+    }
+    if (last < src)
+      spec.Append(last, src-last);
+
+    rv = resURL->Init(nsIStandardURL::URLTYPE_STANDARD, -1, spec, aCharset, aBaseURI);
     if (NS_SUCCEEDED(rv))
         rv = CallQueryInterface(resURL, result);
     NS_RELEASE(resURL);
diff -Nru seamonkey-1.1.11+nobinonly/parser/htmlparser/src/nsHTMLTokens.cpp seamonkey-1.1.12+nobinonly/parser/htmlparser/src/nsHTMLTokens.cpp
--- seamonkey-1.1.11+nobinonly/parser/htmlparser/src/nsHTMLTokens.cpp	2008-01-29 20:31:11.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/parser/htmlparser/src/nsHTMLTokens.cpp	2008-08-30 01:15:29.000000000 +0200
@@ -2364,12 +2364,7 @@
   }
 #endif
 
-  if (IS_IN_BMP(aNCRValue))
-    aString.Append(PRUnichar(aNCRValue));
-  else {
-    aString.Append(PRUnichar(H_SURROGATE(aNCRValue)));
-    aString.Append(PRUnichar(L_SURROGATE(aNCRValue)));
-  }
+  AppendUCS4ToUTF16(ENSURE_VALID_CHAR(aNCRValue), aString);
 }
 
 /*
diff -Nru seamonkey-1.1.11+nobinonly/toolkit/content/charsetOverlay.js seamonkey-1.1.12+nobinonly/toolkit/content/charsetOverlay.js
--- seamonkey-1.1.11+nobinonly/toolkit/content/charsetOverlay.js	2006-09-20 02:31:05.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/toolkit/content/charsetOverlay.js	2008-08-30 01:12:36.000000000 +0200
@@ -126,21 +126,19 @@
 var gPrevCharset = null;
 function UpdateCurrentCharset()
 {
-    var menuitem = null;
-
-    // exctract the charset from DOM
+    // extract the charset from DOM
     var wnd = document.commandDispatcher.focusedWindow;
     if ((window == wnd) || (wnd == null)) wnd = window.content;
-    menuitem = document.getElementById('charset.' + wnd.document.characterSet);
 
+    // Uncheck previous item
+    if (gPrevCharset) {
+        var pref_item = document.getElementById('charset.' + gPrevCharset);
+        if (pref_item)
+          pref_item.setAttribute('checked', 'false');
+    }
+
+    var menuitem = document.getElementById('charset.' + wnd.document.characterSet);
     if (menuitem) {
-        // uncheck previously checked item to workaround Mac checkmark problem
-        // bug 98625
-        if (gPrevCharset) {
-            var pref_item = document.getElementById('charset.' + gPrevCharset);
-            if (pref_item)
-              pref_item.setAttribute('checked', 'false');
-        }
         menuitem.setAttribute('checked', 'true');
     }
 }
diff -Nru seamonkey-1.1.11+nobinonly/toolkit/locales/en-US/chrome/global/intl.properties seamonkey-1.1.12+nobinonly/toolkit/locales/en-US/chrome/global/intl.properties
--- seamonkey-1.1.11+nobinonly/toolkit/locales/en-US/chrome/global/intl.properties	2006-04-26 12:12:33.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/toolkit/locales/en-US/chrome/global/intl.properties	2008-08-30 01:12:38.000000000 +0200
@@ -22,7 +22,7 @@
 intl.charsetmenu.browser.more4=armscii-8, GEOSTD8, TIS-620, ISO-8859-11, windows-874, IBM857, ISO-8859-9, x-mac-turkish, windows-1254, x-viet-tcvn5712, VISCII, x-viet-vps, windows-1258, x-mac-devanagari, x-mac-gujarati, x-mac-gurmukhi
 intl.charsetmenu.browser.more5=ISO-8859-6, windows-1256, IBM864, x-mac-arabic, x-mac-farsi, ISO-8859-8-I, windows-1255, ISO-8859-8, IBM862, x-mac-hebrew
 # Localization Note: Never change the following entry.
-intl.charsetmenu.browser.unicode=UTF-8, UTF-16LE, UTF-16BE, UTF-32LE, UTF-32BE, UTF-7
+intl.charsetmenu.browser.unicode=UTF-8, UTF-16LE, UTF-16BE, UTF-32LE, UTF-32BE
 intl.charset.default=ISO-8859-1
 intl.charset.detector=
 intl.charsetmenu.mailedit=ISO-8859-1, ISO-8859-15, ISO-8859-6, armscii-8, geostd8, ISO-8859-13, ISO-8859-14, ISO-8859-2, GB2312, GB18030, Big5, KOI8-R, windows-1251, KOI8-U, ISO-8859-7, ISO-8859-8-I, windows-1255, ISO-2022-JP, EUC-KR, ISO-8859-10, ISO-8859-3, TIS-620, ISO-8859-9, UTF-8, VISCII
diff -Nru seamonkey-1.1.11+nobinonly/toolkit/locales/l10n.ini seamonkey-1.1.12+nobinonly/toolkit/locales/l10n.ini
--- seamonkey-1.1.11+nobinonly/toolkit/locales/l10n.ini	1970-01-01 01:00:00.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/toolkit/locales/l10n.ini	2008-07-17 13:35:19.000000000 +0200
@@ -0,0 +1,8 @@
+[general]
+depth = ../..
+
+[compare]
+dirs = netwerk
+     dom
+     toolkit
+     security/manager
diff -Nru seamonkey-1.1.11+nobinonly/toolkit/mozapps/installer/windows/nsis/version.nsh seamonkey-1.1.12+nobinonly/toolkit/mozapps/installer/windows/nsis/version.nsh
--- seamonkey-1.1.11+nobinonly/toolkit/mozapps/installer/windows/nsis/version.nsh	2007-02-16 03:17:27.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/toolkit/mozapps/installer/windows/nsis/version.nsh	2008-08-30 01:12:40.000000000 +0200
@@ -13,4 +13,5 @@
 VIAddVersionKey "LegalTrademarks" "${BrandShortName} is a Trademark of The Mozilla Foundation."
 VIAddVersionKey "LegalCopyright"  "${CompanyName}"
 VIAddVersionKey "FileVersion"     "${AppVersion}"
+VIAddVersionKey "ProductVersion"  "${AppVersion}"
 ;VIAddVersionKey "Comments"        "Comments"
diff -Nru seamonkey-1.1.11+nobinonly/widget/public/nsIDragService.idl seamonkey-1.1.12+nobinonly/widget/public/nsIDragService.idl
--- seamonkey-1.1.11+nobinonly/widget/public/nsIDragService.idl	2004-04-19 00:00:14.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/widget/public/nsIDragService.idl	2008-08-30 01:15:46.000000000 +0200
@@ -84,6 +84,16 @@
   
 };
 
+[scriptable, uuid(b6ba2c09-4a12-40d6-ad7e-aa4190e78403)]
+interface nsIDragService_1_8_BRANCH : nsIDragService
+{
+  /**
+   * Increase/decrease dragging suppress level by one.
+   * If level is greater than one, dragging is disabled.
+   */
+  void suppress();
+  void unsuppress();
+};
 
 %{ C++
 
diff -Nru seamonkey-1.1.11+nobinonly/widget/src/beos/nsDragService.cpp seamonkey-1.1.12+nobinonly/widget/src/beos/nsDragService.cpp
--- seamonkey-1.1.11+nobinonly/widget/src/beos/nsDragService.cpp	2007-07-15 16:44:04.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/widget/src/beos/nsDragService.cpp	2008-08-30 01:15:46.000000000 +0200
@@ -108,7 +108,9 @@
 	    0 == orig.Compare("BeZilla"));
 }
 
-NS_IMPL_THREADSAFE_ISUPPORTS3(nsDragService, nsIDragService, nsIDragSession, nsIDragSessionBeOS)
+NS_IMPL_THREADSAFE_ISUPPORTS4(nsDragService, nsIDragService,
+                              nsIDragService_1_8_BRANCH, nsIDragSession,
+                              nsIDragSessionBeOS)
 //NS_IMPL_THREADSAFE_ISUPPORTS1(nsBaseDragService, nsIDragSessionBeOS)
 
 //-------------------------------------------------------------------------
@@ -154,8 +156,11 @@
                                   PRUint32 aActionType)
 {
     PR_LOG(sDragLm, PR_LOG_DEBUG, ("nsDragService::InvokeDragSession"));
-    nsBaseDragService::InvokeDragSession (aDOMNode, aArrayTransferables,
-                                         aRegion, aActionType);
+    nsresult rv = nsBaseDragService::InvokeDragSession(aDOMNode,
+                                                       aArrayTransferables,
+                                                       aRegion, aActionType);
+    NS_ENSURE_SUCCESS(rv, rv);
+
     ResetDragInfo();       
     // make sure that we have an array of transferables to use
     if (nsnull == aArrayTransferables)
diff -Nru seamonkey-1.1.11+nobinonly/widget/src/gtk/nsDragService.cpp seamonkey-1.1.12+nobinonly/widget/src/gtk/nsDragService.cpp
--- seamonkey-1.1.11+nobinonly/widget/src/gtk/nsDragService.cpp	2005-06-03 12:26:27.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/widget/src/gtk/nsDragService.cpp	2008-08-30 01:15:46.000000000 +0200
@@ -63,8 +63,9 @@
 
 NS_IMPL_ADDREF_INHERITED(nsDragService, nsBaseDragService)
 NS_IMPL_RELEASE_INHERITED(nsDragService, nsBaseDragService)
-NS_IMPL_QUERY_INTERFACE4(nsDragService,
+NS_IMPL_QUERY_INTERFACE5(nsDragService,
                          nsIDragService,
+                         nsIDragService_1_8_BRANCH,
                          nsIDragSession,
                          nsIDragSessionGTK,
                          nsIObserver)
@@ -150,8 +151,11 @@
                                   PRUint32 aActionType)
 {
   PR_LOG(sDragLm, PR_LOG_DEBUG, ("nsDragService::InvokeDragSession"));
-  nsBaseDragService::InvokeDragSession (aDOMNode, aArrayTransferables,
-                                         aRegion, aActionType);
+  nsresult rv = nsBaseDragService::InvokeDragSession(aDOMNode,
+                                                     aArrayTransferables,
+                                                     aRegion, aActionType);
+  NS_ENSURE_SUCCESS(rv, rv);
+
   // make sure that we have an array of transferables to use
   if (!aArrayTransferables)
     return NS_ERROR_INVALID_ARG;
diff -Nru seamonkey-1.1.11+nobinonly/widget/src/gtk2/nsDragService.cpp seamonkey-1.1.12+nobinonly/widget/src/gtk2/nsDragService.cpp
--- seamonkey-1.1.11+nobinonly/widget/src/gtk2/nsDragService.cpp	2007-11-19 21:40:08.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/widget/src/gtk2/nsDragService.cpp	2008-08-30 01:15:46.000000000 +0200
@@ -67,8 +67,9 @@
 
 NS_IMPL_ADDREF_INHERITED(nsDragService, nsBaseDragService)
 NS_IMPL_RELEASE_INHERITED(nsDragService, nsBaseDragService)
-NS_IMPL_QUERY_INTERFACE4(nsDragService,
+NS_IMPL_QUERY_INTERFACE5(nsDragService,
                          nsIDragService,
+                         nsIDragService_1_8_BRANCH,
                          nsIDragSession,
                          nsIDragSessionGTK,
                          nsIObserver)
@@ -155,8 +156,11 @@
                                  PRUint32 aActionType)
 {
     PR_LOG(sDragLm, PR_LOG_DEBUG, ("nsDragService::InvokeDragSession"));
-    nsBaseDragService::InvokeDragSession(aDOMNode, aArrayTransferables,
-                                         aRegion, aActionType);
+    nsresult rv = nsBaseDragService::InvokeDragSession(aDOMNode,
+                                                       aArrayTransferables,
+                                                       aRegion, aActionType);
+    NS_ENSURE_SUCCESS(rv, rv);
+
     // make sure that we have an array of transferables to use
     if (!aArrayTransferables)
         return NS_ERROR_INVALID_ARG;
diff -Nru seamonkey-1.1.11+nobinonly/widget/src/mac/nsDragService.cpp seamonkey-1.1.12+nobinonly/widget/src/mac/nsDragService.cpp
--- seamonkey-1.1.11+nobinonly/widget/src/mac/nsDragService.cpp	2007-05-03 03:39:13.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/widget/src/mac/nsDragService.cpp	2008-08-30 01:15:46.000000000 +0200
@@ -92,7 +92,11 @@
 // we need our own stuff for MacOS because of nsIDragSessionMac.
 NS_IMPL_ADDREF_INHERITED(nsDragService, nsBaseDragService)
 NS_IMPL_RELEASE_INHERITED(nsDragService, nsBaseDragService)
-NS_IMPL_QUERY_INTERFACE3(nsDragService, nsIDragService, nsIDragSession, nsIDragSessionMac)
+NS_IMPL_QUERY_INTERFACE4(nsDragService,
+                         nsIDragService,
+                         nsIDragService_1_8_BRANCH,
+                         nsIDragSession,
+                         nsIDragSessionMac)
 
 
 //
@@ -223,7 +227,10 @@
 #endif
 
   ::InitCursor();
-  nsBaseDragService::InvokeDragSession ( aDOMNode, aTransferableArray, aDragRgn, aActionType );
+  nsresult rv = nsBaseDragService::InvokeDragSession(aDOMNode,
+                                                     aTransferableArray,
+                                                     aDragRgn, aActionType);
+  NS_ENSURE_SUCCESS(rv, rv);
   
   DragReference theDragRef;
   OSErr result = ::NewDrag(&theDragRef);
diff -Nru seamonkey-1.1.11+nobinonly/widget/src/os2/nsDragService.cpp seamonkey-1.1.12+nobinonly/widget/src/os2/nsDragService.cpp
--- seamonkey-1.1.11+nobinonly/widget/src/os2/nsDragService.cpp	2007-10-08 21:09:50.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/widget/src/os2/nsDragService.cpp	2008-08-30 01:15:46.000000000 +0200
@@ -57,7 +57,10 @@
 
 NS_IMPL_ADDREF_INHERITED(nsDragService, nsBaseDragService)
 NS_IMPL_RELEASE_INHERITED(nsDragService, nsBaseDragService)
-NS_IMPL_QUERY_INTERFACE3(nsDragService, nsIDragService, nsIDragSession, \
+NS_IMPL_QUERY_INTERFACE4(nsDragService,
+                         nsIDragService,
+                         nsIDragService_1_8_BRANCH,
+                         nsIDragSession,
                          nsIDragSessionOS2)
 
 // --------------------------------------------------------------------------
@@ -144,8 +147,10 @@
   if (mDoingDrag)
     return NS_ERROR_UNEXPECTED;
 
-  nsBaseDragService::InvokeDragSession ( aDOMNode, aTransferables,
-                                         aRegion, aActionType );
+  nsresult rv = nsBaseDragService::InvokeDragSession(aDOMNode, aTransferables,
+                                                     aRegion, aActionType );
+  NS_ENSURE_SUCCESS(rv, rv);
+
   mSourceDataItems = aTransferables;
   WinSetCapture(HWND_DESKTOP, NULLHANDLE);
 
@@ -168,7 +173,7 @@
   dragitem.hstrContainerName   = NULLHANDLE;
   dragitem.hstrSourceName      = NULLHANDLE;
 
-  nsresult rv = NS_ERROR_FAILURE;
+  rv = NS_ERROR_FAILURE;
   ULONG idIcon = 0;
 
     // bracket this to reduce our footprint before the drag begins
diff -Nru seamonkey-1.1.11+nobinonly/widget/src/os2/nsWindow.cpp seamonkey-1.1.12+nobinonly/widget/src/os2/nsWindow.cpp
--- seamonkey-1.1.11+nobinonly/widget/src/os2/nsWindow.cpp	2008-06-16 00:26:28.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/widget/src/os2/nsWindow.cpp	2008-08-30 01:15:46.000000000 +0200
@@ -3795,9 +3795,9 @@
    ULONG ulStatus = WinQueryQueueStatus(HWND_DESKTOP);
 
    // If there is pending input then return the current time.
-   if (ulStatus && (QS_KEY | QS_MOUSE | QS_MOUSEBUTTON | QS_MOUSEMOVE)) {
+   if (ulStatus & (QS_KEY | QS_MOUSE)) {
      gLastInputEventTime = PR_IntervalToMicroseconds(PR_IntervalNow());
-   } 
+   }
 
    aTime = gLastInputEventTime;
 
diff -Nru seamonkey-1.1.11+nobinonly/widget/src/photon/nsDragService.cpp seamonkey-1.1.12+nobinonly/widget/src/photon/nsDragService.cpp
--- seamonkey-1.1.11+nobinonly/widget/src/photon/nsDragService.cpp	2007-10-08 21:09:51.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/widget/src/photon/nsDragService.cpp	2008-08-30 01:15:46.000000000 +0200
@@ -49,7 +49,10 @@
 
 NS_IMPL_ADDREF_INHERITED(nsDragService, nsBaseDragService)
 NS_IMPL_RELEASE_INHERITED(nsDragService, nsBaseDragService)
-NS_IMPL_QUERY_INTERFACE2(nsDragService, nsIDragService, nsIDragSession)
+NS_IMPL_QUERY_INTERFACE3(nsDragService,
+                         nsIDragService,
+                         nsIDragService_1_8_BRANCH,
+                         nsIDragSession)
 
 char *nsDragService::mDndEvent = NULL;
 int nsDragService::mDndEventLen;
@@ -144,7 +147,10 @@
 #ifdef DEBUG
 	printf( "nsDragService::InvokeDragSession\n" );
 #endif
-  nsBaseDragService::InvokeDragSession (aDOMNode, aArrayTransferables, aRegion, aActionType);
+  nsresult rv = nsBaseDragService::InvokeDragSession(aDOMNode,
+                                                     aArrayTransferables,
+                                                     aRegion, aActionType);
+  NS_ENSURE_SUCCESS(rv, rv);
 
   if(!aArrayTransferables)
     return NS_ERROR_INVALID_ARG;
@@ -202,7 +208,7 @@
 						const char *FlavourStr = ( const char * ) flavorStr;
 						nsCOMPtr<nsISupports> data;
 						PRUint32 tmpDataLen = 0;
-						nsresult rv = currItem->GetTransferData( FlavourStr, getter_AddRefs(data), &tmpDataLen );
+						rv = currItem->GetTransferData( FlavourStr, getter_AddRefs(data), &tmpDataLen );
 						if( NS_SUCCEEDED( rv ) ) {
 							/* insert FlavourStr, data into the PtTransportCtrl_t */
 							int len = sizeof( PRUint32 ) + sizeof( PRUint32 ) + strlen( FlavourStr ) + 1 + tmpDataLen;
diff -Nru seamonkey-1.1.11+nobinonly/widget/src/qt/nsDragService.cpp seamonkey-1.1.12+nobinonly/widget/src/qt/nsDragService.cpp
--- seamonkey-1.1.11+nobinonly/widget/src/qt/nsDragService.cpp	2004-12-01 23:27:00.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/widget/src/qt/nsDragService.cpp	2008-08-30 01:15:46.000000000 +0200
@@ -60,7 +60,11 @@
 
 NS_IMPL_ADDREF_INHERITED(nsDragService, nsBaseDragService)
 NS_IMPL_RELEASE_INHERITED(nsDragService, nsBaseDragService)
-NS_IMPL_QUERY_INTERFACE3(nsDragService, nsIDragService, nsIDragSession, nsIDragSessionQt )
+NS_IMPL_QUERY_INTERFACE4(nsDragService,
+                         nsIDragService,
+                         nsIDragService_1_8_BRANCH,
+                         nsIDragSession,
+                         nsIDragSessionQt )
 
 //-------------------------------------------------------------------------
 // static variables
@@ -97,8 +101,10 @@
 {
   PRUint32 numItemsToDrag = 0;
 
-  nsBaseDragService::InvokeDragSession(aDOMNode, aArrayTransferables,
-                                       aRegion, aActionType);
+  nsresult rv = nsBaseDragService::InvokeDragSession(aDOMNode,
+                                                     aArrayTransferables,
+                                                     aRegion, aActionType);
+  NS_ENSURE_SUCCESS(rv, rv);
 
   // make sure that we have an array of transferables to use
   if (!aArrayTransferables) {
diff -Nru seamonkey-1.1.11+nobinonly/widget/src/windows/nsDragService.cpp seamonkey-1.1.12+nobinonly/widget/src/windows/nsDragService.cpp
--- seamonkey-1.1.11+nobinonly/widget/src/windows/nsDragService.cpp	2006-05-23 12:18:41.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/widget/src/windows/nsDragService.cpp	2008-08-30 01:15:46.000000000 +0200
@@ -91,9 +91,10 @@
                                  nsIScriptableRegion *aRegion,
                                  PRUint32 aActionType)
 {
-  nsBaseDragService::InvokeDragSession(aDOMNode, anArrayTransferables, aRegion,
-                                       aActionType);
-  nsresult rv;
+  nsresult rv = nsBaseDragService::InvokeDragSession(aDOMNode,
+                                                     anArrayTransferables,
+                                                     aRegion, aActionType);
+  NS_ENSURE_SUCCESS(rv, rv);
 
   // Try and get source URI of the items that are being dragged
   nsIURI *uri = nsnull;
diff -Nru seamonkey-1.1.11+nobinonly/widget/src/windows/nsNativeDragTarget.cpp seamonkey-1.1.12+nobinonly/widget/src/windows/nsNativeDragTarget.cpp
--- seamonkey-1.1.11+nobinonly/widget/src/windows/nsNativeDragTarget.cpp	2006-05-15 19:41:16.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/widget/src/windows/nsNativeDragTarget.cpp	2008-08-30 01:15:46.000000000 +0200
@@ -225,6 +225,10 @@
   // Set the current action into the Gecko specific type
   nsCOMPtr<nsIDragSession> currSession;
   mDragService->GetCurrentSession(getter_AddRefs(currSession));
+  if (!currSession) {
+    return;
+  }
+
   currSession->SetDragAction(geckoAction);
 
   // Dispatch the event into Gecko
diff -Nru seamonkey-1.1.11+nobinonly/widget/src/xlib/nsDragService.cpp seamonkey-1.1.12+nobinonly/widget/src/xlib/nsDragService.cpp
--- seamonkey-1.1.11+nobinonly/widget/src/xlib/nsDragService.cpp	2005-07-01 06:40:31.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/widget/src/xlib/nsDragService.cpp	2008-08-30 01:15:47.000000000 +0200
@@ -109,14 +109,15 @@
                                                 nsIScriptableRegion *aRegion,
                                                 PRUint32 aActionType)
 {
-  nsBaseDragService::InvokeDragSession(aDOMNode, aArrayTransferables,
-                                       aRegion, aActionType);
+  nsresult rv = nsBaseDragService::InvokeDragSession(aDOMNode,
+                                                     aArrayTransferables,
+                                                     aRegion, aActionType);
+  NS_ENSURE_SUCCESS(rv, rv);
 
   /* no data - no dnd */
   if (!aArrayTransferables)
     return NS_ERROR_INVALID_ARG;
 
-  nsresult rv;
   PRUint32 numItemsToDrag = 0;
 
   mSourceDataItems = aArrayTransferables;
@@ -158,7 +159,7 @@
   if (!aSession)
     return NS_ERROR_FAILURE;
 
-  if (!mDragging) {
+  if (!mDragging || mSuppressLevel) {
     *aSession = nsnull;
     return NS_OK;
   }
diff -Nru seamonkey-1.1.11+nobinonly/widget/src/xpwidgets/nsBaseDragService.cpp seamonkey-1.1.12+nobinonly/widget/src/xpwidgets/nsBaseDragService.cpp
--- seamonkey-1.1.11+nobinonly/widget/src/xpwidgets/nsBaseDragService.cpp	2005-06-28 23:40:15.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/widget/src/xpwidgets/nsBaseDragService.cpp	2008-08-30 01:15:47.000000000 +0200
@@ -57,7 +57,8 @@
 
 NS_IMPL_ADDREF(nsBaseDragService)
 NS_IMPL_RELEASE(nsBaseDragService)
-NS_IMPL_QUERY_INTERFACE2(nsBaseDragService, nsIDragService, nsIDragSession)
+NS_IMPL_QUERY_INTERFACE3(nsBaseDragService, nsIDragService,
+                         nsIDragService_1_8_BRANCH, nsIDragSession)
 
 
 //-------------------------------------------------------------------------
@@ -67,7 +68,7 @@
 //-------------------------------------------------------------------------
 nsBaseDragService::nsBaseDragService()
   : mCanDrop(PR_FALSE), mDoingDrag(PR_FALSE),
-    mDragAction(DRAGDROP_ACTION_NONE), mTargetSize(0,0)
+    mDragAction(DRAGDROP_ACTION_NONE), mTargetSize(0,0), mSuppressLevel(0)
 {
   nsresult result = NS_NewISupportsArray(getter_AddRefs(mTransArray));
   if (NS_FAILED(result)) {
@@ -201,6 +202,7 @@
                                      PRUint32 aActionType)
 {
   NS_ENSURE_TRUE(aDOMNode, NS_ERROR_INVALID_ARG);
+  NS_ENSURE_TRUE(mSuppressLevel == 0, NS_ERROR_FAILURE);
 
   // stash the document of the dom node
   aDOMNode->GetOwnerDocument(getter_AddRefs(mSourceDocument));
@@ -239,7 +241,7 @@
 
   // "this" also implements a drag session, so say we are one but only
   // if there is currently a drag going on.
-  if (mDoingDrag) {
+  if (!mSuppressLevel && mDoingDrag) {
     *aSession = this;
     NS_ADDREF(*aSession);      // addRef because we're a "getter"
   }
@@ -306,3 +308,18 @@
   }
 
 } // GetFrameFromNode
+
+NS_IMETHODIMP
+nsBaseDragService::Suppress()
+{
+  EndDragSession();
+  ++mSuppressLevel;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsBaseDragService::Unsuppress()
+{
+  --mSuppressLevel;
+  return NS_OK;
+}
diff -Nru seamonkey-1.1.11+nobinonly/widget/src/xpwidgets/nsBaseDragService.h seamonkey-1.1.12+nobinonly/widget/src/xpwidgets/nsBaseDragService.h
--- seamonkey-1.1.11+nobinonly/widget/src/xpwidgets/nsBaseDragService.h	2005-03-14 23:49:00.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/widget/src/xpwidgets/nsBaseDragService.h	2008-08-30 01:15:47.000000000 +0200
@@ -54,7 +54,7 @@
  * XP DragService wrapper base class
  */
 
-class nsBaseDragService : public nsIDragService,
+class nsBaseDragService : public nsIDragService_1_8_BRANCH,
                           public nsIDragSession
 {
 
@@ -67,6 +67,7 @@
 
   //nsIDragSession and nsIDragService
   NS_DECL_NSIDRAGSERVICE
+  NS_DECL_NSIDRAGSERVICE_1_8_BRANCH
   NS_DECL_NSIDRAGSESSION
 
 protected:
@@ -82,6 +83,7 @@
   nsCOMPtr<nsIDOMNode> mSourceNode;
   nsCOMPtr<nsIDOMDocument> mSourceDocument;       // the document at the drag source. will be null
                                                   //  if it came from outside the app.
+  PRUint32 mSuppressLevel;
 };
 
 #endif // nsBaseDragService_h__
diff -Nru seamonkey-1.1.11+nobinonly/xpcom/glue/nsTArray.cpp seamonkey-1.1.12+nobinonly/xpcom/glue/nsTArray.cpp
--- seamonkey-1.1.11+nobinonly/xpcom/glue/nsTArray.cpp	2006-01-23 04:26:06.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/xpcom/glue/nsTArray.cpp	2008-08-30 01:15:11.000000000 +0200
@@ -48,7 +48,7 @@
   // If the requested memory allocation exceeds size_type(-1)/2, then our
   // doubling algorithm may not be able to allocate it.  Just bail out in
   // cases like that.  We don't want to be allocating 2 GB+ arrays anyway.
-  if (capacity * elemSize > size_type(-1)/2) {
+  if ((PRUint64)capacity * elemSize > size_type(-1)/2) {
     NS_ERROR("Attempting to allocate excessively large array");
     return PR_FALSE;
   }
diff -Nru seamonkey-1.1.11+nobinonly/xpcom/io/nsEscape.cpp seamonkey-1.1.12+nobinonly/xpcom/io/nsEscape.cpp
--- seamonkey-1.1.11+nobinonly/xpcom/io/nsEscape.cpp	2005-07-28 16:51:17.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/xpcom/io/nsEscape.cpp	2008-08-30 01:15:12.000000000 +0200
@@ -75,25 +75,42 @@
 //----------------------------------------------------------------------------------------
 static char* nsEscapeCount(
     const char * str,
-    PRInt32 len,
     nsEscapeMask flags,
-    PRInt32* out_len)
+    size_t* out_len)
 //----------------------------------------------------------------------------------------
 {
 	if (!str)
 		return 0;
 
-    int i, extra = 0;
+    size_t i, len = 0, charsToEscape = 0;
     static const char hexChars[] = "0123456789ABCDEF";
 
 	register const unsigned char* src = (const unsigned char *) str;
-    for (i = 0; i < len; i++)
+    while (*src)
 	{
+        len++;
         if (!IS_OK(*src++))
-            extra += 2; /* the escape, plus an extra byte for each nibble */
+            charsToEscape++;
 	}
 
-	char* result = (char *)nsMemory::Alloc(len + extra + 1);
+    // calculate how much memory should be allocated
+    // original length + 2 bytes for each escaped character + terminating '\0'
+    // do the sum in steps to check for overflow
+    size_t dstSize = len + 1 + charsToEscape;
+    if (dstSize <= len)
+	return 0;
+    dstSize += charsToEscape;
+    if (dstSize < len)
+	return 0;
+
+    // fail if we need more than 4GB
+    // size_t is likely to be long unsigned int but nsMemory::Alloc(size_t)
+    // calls NS_Alloc_P(size_t) which calls PR_Malloc(PRUint32), so there is
+    // no chance to allocate more than 4GB using nsMemory::Alloc()
+    if (dstSize > PR_UINT32_MAX)
+        return 0;
+
+	char* result = (char *)nsMemory::Alloc(dstSize);
     if (!result)
         return 0;
 
@@ -144,7 +161,7 @@
 {
     if(!str)
         return NULL;
-    return nsEscapeCount(str, (PRInt32)strlen(str), flags, NULL);
+    return nsEscapeCount(str, flags, NULL);
 }
 
 //----------------------------------------------------------------------------------------
diff -Nru seamonkey-1.1.11+nobinonly/xpcom/string/public/nsCharTraits.h seamonkey-1.1.12+nobinonly/xpcom/string/public/nsCharTraits.h
--- seamonkey-1.1.11+nobinonly/xpcom/string/public/nsCharTraits.h	2004-06-17 01:29:49.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/xpcom/string/public/nsCharTraits.h	2008-08-30 01:15:13.000000000 +0200
@@ -73,6 +73,37 @@
   typedef PRBool nsCharTraits_bool;
 #endif
 
+// Some macros for working with PRUnichar
+#define PLANE1_BASE          PRUint32(0x00010000)
+// High surrogates are in the range 0xD800 -- OxDBFF
+#define IS_HIGH_SURROGATE(u) ((PRUnichar(u) & 0xFC00) == 0xD800)
+// Low surrogates are in the range 0xDC00 -- 0xDFFF
+#define IS_LOW_SURROGATE(u)  ((PRUnichar(u) & 0xFC00) == 0xDC00)
+// Faster than testing IS_HIGH_SURROGATE || IS_LOW_SURROGATE
+#define IS_SURROGATE(u)      ((PRUnichar(u) & 0xF800) == 0xD800)
+
+// Everything else is not a surrogate: 0x000 -- 0xD7FF, 0xE000 -- 0xFFFF
+
+// N = (H - 0xD800) * 0x400 + 0x10000 + (L - 0xDC00)
+// I wonder whether we could somehow assert that H is a high surrogate
+// and L is a low surrogate
+#define SURROGATE_TO_UCS4(h, l) (((PRUint32(h) & 0x03FF) << 10) + \
+                                 (PRUint32(l) & 0x03FF) + PLANE1_BASE)
+
+// Extract surrogates from a UCS4 char
+// See unicode specification 3.7 for following math.
+#define H_SURROGATE(c) PRUnichar(PRUnichar((PRUint32(c) - PLANE1_BASE) >> 10) | \
+                                 PRUnichar(0xD800))
+#define L_SURROGATE(c) PRUnichar(PRUnichar((PRUint32(c) - PLANE1_BASE) & 0x03FF) | \
+                                 PRUnichar(0xDC00))
+
+#define IS_IN_BMP(ucs) (PRUint32(ucs) < PLANE1_BASE)
+#define UCS2_REPLACEMENT_CHAR PRUnichar(0xFFFD)
+
+#define UCS_END PRUint32(0x00110000)
+#define IS_VALID_CHAR(c) ((PRUint32(c) < UCS_END) && !IS_SURROGATE(c))
+#define ENSURE_VALID_CHAR(c) (IS_VALID_CHAR(c) ? (c) : UCS2_REPLACEMENT_CHAR)
+
 template <class CharT> struct nsCharTraits {};
 
 NS_SPECIALIZE_TEMPLATE
diff -Nru seamonkey-1.1.11+nobinonly/xpcom/string/public/nsReadableUtils.h seamonkey-1.1.12+nobinonly/xpcom/string/public/nsReadableUtils.h
--- seamonkey-1.1.11+nobinonly/xpcom/string/public/nsReadableUtils.h	2006-06-23 09:49:53.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/xpcom/string/public/nsReadableUtils.h	2008-08-30 01:15:13.000000000 +0200
@@ -371,5 +371,7 @@
     return (aStr.Length() == aLen);
 }
 
+NS_COM void
+AppendUCS4ToUTF16(const PRUint32 aSource, nsAString& aDest);
 
 #endif // !defined(nsReadableUtils_h___)
diff -Nru seamonkey-1.1.11+nobinonly/xpcom/string/public/nsUTF8Utils.h seamonkey-1.1.12+nobinonly/xpcom/string/public/nsUTF8Utils.h
--- seamonkey-1.1.11+nobinonly/xpcom/string/public/nsUTF8Utils.h	2005-02-17 21:17:13.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/xpcom/string/public/nsUTF8Utils.h	2008-08-30 01:15:13.000000000 +0200
@@ -39,6 +39,8 @@
 #ifndef nsUTF8Utils_h_
 #define nsUTF8Utils_h_
 
+#include "nsCharTraits.h"
+
 class UTF8traits
   {
     public:
@@ -51,9 +53,6 @@
       static PRBool is6byte(char c) { return (c & 0xFE) == 0xFC; }
   };
 
-#define PLANE1_BASE           0x00010000  
-#define UCS2_REPLACEMENT_CHAR 0xfffd     
-
 #ifdef __GNUC__
 #define NS_ALWAYS_INLINE __attribute__((always_inline))
 #else
@@ -139,6 +138,14 @@
 
             while ( state-- )
               {
+                if (p == end)
+                  {
+                    NS_ERROR("Buffer ended in the middle of a multibyte sequence");
+                    mErrorEncountered = PR_TRUE;
+                    mBuffer = out;
+                    return N;
+                  }
+
                 c = *p++;
 
                 if ( UTF8traits::isInSeq(c) )
@@ -176,13 +183,11 @@
               }
             else if ( ucs4 >= PLANE1_BASE )
               {
-                if ( ucs4 >= 0x00110000 )
+                if ( ucs4 >= UCS_END )
                   *out++ = UCS2_REPLACEMENT_CHAR;
                 else {
-                  // surrogate, see unicode specification 3.7 for following math.
-                  ucs4 -= PLANE1_BASE;
-                  *out++ = (PRUnichar)(ucs4 >> 10) | 0xd800u;
-                  *out++ = (PRUnichar)(ucs4 & 0x3ff) | 0xdc00u;
+                  *out++ = (buffer_type)H_SURROGATE(ucs4);
+                  *out++ = (buffer_type)L_SURROGATE(ucs4);
                 }
               }
             else
@@ -308,17 +313,16 @@
                 *out++ = 0xC0 | (char)(c >> 6);
                 *out++ = 0x80 | (char)(0x003F & c);
               }
-            else if (0xD800 != (0xF800 & c)) // U+0800 - U+D7FF,U+E000 - U+FFFF
+            else if (!IS_SURROGATE(c)) // U+0800 - U+D7FF,U+E000 - U+FFFF
               {
                 *out++ = 0xE0 | (char)(c >> 12);
                 *out++ = 0x80 | (char)(0x003F & (c >> 6));
                 *out++ = 0x80 | (char)(0x003F & c );
               }
-            else if (0xD800 == (0xFC00 & c)) // U+D800 - U+DBFF
+            else if (IS_HIGH_SURROGATE(c)) // U+D800 - U+DBFF
               {
                 // D800- DBFF - High Surrogate
-                // N = (H- D800) *400 + 10000 + ...
-                PRUint32 ucs4 = 0x10000 + ((0x03FF & c) << 10);
+                value_type h = c;
 
                 ++p;
                 if (p == end)
@@ -329,11 +333,11 @@
                   }
                 c = *p;
 
-                if (0xDC00 == (0xFC00 & c))
+                if (IS_LOW_SURROGATE(c))
                   {
                     // DC00- DFFF - Low Surrogate
-                    // N += ( L - DC00 )
-                    ucs4 |= (0x03FF & c);
+                    // N = (H - D800) *400 + 10000 + ( L - DC00 )
+                    PRUint32 ucs4 = SURROGATE_TO_UCS4(h, c);
 
                     // 0001 0000-001F FFFF
                     *out++ = 0xF0 | (char)(ucs4 >> 18);
diff -Nru seamonkey-1.1.11+nobinonly/xpcom/string/src/nsReadableUtils.cpp seamonkey-1.1.12+nobinonly/xpcom/string/src/nsReadableUtils.cpp
--- seamonkey-1.1.11+nobinonly/xpcom/string/src/nsReadableUtils.cpp	2005-08-19 21:36:59.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/xpcom/string/src/nsReadableUtils.cpp	2008-08-30 01:15:14.000000000 +0200
@@ -1094,3 +1094,19 @@
 
     return sEmpty;
   }
+
+NS_COM
+void
+AppendUCS4ToUTF16(PRUint32 aSource, nsAString& aDest)
+  {
+    NS_ASSERTION(IS_VALID_CHAR(aSource), "Invalid UCS4 char");
+    if (IS_IN_BMP(aSource))
+      {
+        aDest.Append(PRUnichar(aSource));
+      }
+    else
+      {
+        aDest.Append(H_SURROGATE(aSource));
+        aDest.Append(L_SURROGATE(aSource));
+      }
+  }
diff -Nru seamonkey-1.1.11+nobinonly/xpfe/bootstrap/module.ver seamonkey-1.1.12+nobinonly/xpfe/bootstrap/module.ver
--- seamonkey-1.1.11+nobinonly/xpfe/bootstrap/module.ver	2008-07-03 01:01:34.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/xpfe/bootstrap/module.ver	2008-08-30 01:15:56.000000000 +0200
@@ -1,7 +1,7 @@
 WIN32_MODULE_COMPANYNAME=mozilla.org
 WIN32_MODULE_COPYRIGHT=İMozilla Developers, according to the MPL 1.1/GPL 2.0/LGPL 2.1 licenses, as applicable.
-WIN32_MODULE_PRODUCTVERSION=1,1,11,0
-WIN32_MODULE_PRODUCTVERSION_STRING=1.1.11
+WIN32_MODULE_PRODUCTVERSION=1,1,12,0
+WIN32_MODULE_PRODUCTVERSION_STRING=1.1.12
 WIN32_MODULE_TRADEMARKS=SeaMonkey and Mozilla are trademarks of The Mozilla Foundation.
 WIN32_MODULE_DESCRIPTION=@MOZ_APP_DISPLAYNAME@
 WIN32_MODULE_PRODUCTNAME=@MOZ_APP_DISPLAYNAME@
diff -Nru seamonkey-1.1.11+nobinonly/xpfe/bootstrap/version.txt seamonkey-1.1.12+nobinonly/xpfe/bootstrap/version.txt
--- seamonkey-1.1.11+nobinonly/xpfe/bootstrap/version.txt	2008-07-03 01:01:34.000000000 +0200
+++ seamonkey-1.1.12+nobinonly/xpfe/bootstrap/version.txt	2008-08-30 01:15:56.000000000 +0200
@@ -1 +1 @@
-1.1.11
\ No newline at end of file
+1.1.12
\ No newline at end of file
diff -Nru seamonkey-1.1.11+nobinonly/xpfe/components/intl/nsCharsetMenu.cpp seamonkey-1.1.12+nobinonly/xpfe/components/intl/nsCharsetMenu.cpp
--- seamonkey-1.1.11+nobinonly/xpfe/components/intl/nsCharsetMenu.cpp	2005-02-25 21:46:32.000000000 +0100
+++ seamonkey-1.1.12+nobinonly/xpfe/components/intl/nsCharsetMenu.cpp	2008-08-30 01:16:00.000000000 +0200
@@ -284,7 +284,7 @@
   nsresult RemoveLastMenuItem(nsIRDFContainer * aContainer, 
                               nsVoidArray * aArray);
 
-  nsresult RemoveFlaggedCharsets(nsCStringArray& aList, nsString * aProp);
+  nsresult RemoveFlaggedCharsets(nsCStringArray& aList, const nsString& aProp);
   nsresult NewRDFContainer(nsIRDFDataSource * aDataSource, 
     nsIRDFResource * aResource, nsIRDFContainer ** aResult);
   void FreeMenuItemArray(nsVoidArray * aArray);
@@ -583,6 +583,10 @@
   // mark the end of the static area, the rest is cache
   mBrowserCacheStart = mBrowserMenu.Count();
 
+  // Remove "notForBrowser" entries before populating cache menu
+  res = RemoveFlaggedCharsets(decs, NS_LITERAL_STRING(".notForBrowser"));
+  NS_ASSERTION(NS_SUCCEEDED(res), "error removing flagged charsets");
+
   res = InitCacheMenu(decs, kNC_BrowserCharsetMenuRoot, kBrowserCachePrefKey, 
                       &mBrowserMenu);
   NS_ASSERTION(NS_SUCCEEDED(res), "error initializing browser cache charset menu");
@@ -893,6 +897,10 @@
     // elements are numbered from 1 (why god, WHY?!?!?!)
     mBrowserMenuRDFPosition -= mBrowserCacheStart - 1;
 
+    // Remove "notForBrowser" entries before populating cache menu
+    res = RemoveFlaggedCharsets(browserDecoderList, NS_LITERAL_STRING(".notForBrowser"));
+    NS_ASSERTION(NS_SUCCEEDED(res), "error initializing static charset menu from prefs");
+
     res = InitCacheMenu(browserDecoderList, kNC_BrowserCharsetMenuRoot, kBrowserCachePrefKey, 
       &mBrowserMenu);
     NS_ASSERTION(NS_SUCCEEDED(res), "error initializing browser cache charset menu");
@@ -1200,13 +1208,12 @@
   nsresult res = NS_OK;
   nsCOMPtr<nsIRDFContainer> container;
   nsVoidArray moreMenu;
-  nsAutoString prop; prop.AssignWithConversion(aFlag);
 
   res = NewRDFContainer(mInner, aResource, getter_AddRefs(container));
   if (NS_FAILED(res)) goto done;
 
   // remove charsets "not for browser"
-  res = RemoveFlaggedCharsets(aDecs, &prop);
+  res = RemoveFlaggedCharsets(aDecs, NS_ConvertASCIItoUTF16(aFlag));
   if (NS_FAILED(res)) goto done;
 
   res = AddCharsetArrayToItemArray(moreMenu, aDecs);
@@ -1688,7 +1695,7 @@
 }
 
 nsresult nsCharsetMenu::RemoveFlaggedCharsets(nsCStringArray& aList, 
-                                              nsString * aProp)
+                                              const nsString& aProp)
 {
   nsresult res = NS_OK;
   PRUint32 count;
@@ -1703,7 +1710,7 @@
     charset = aList.CStringAt(i);
     if (!charset) continue;
 
-    res = mCCManager->GetCharsetData(charset->get(), aProp->get(), str);
+    res = mCCManager->GetCharsetData(charset->get(), aProp.get(), str);
     if (NS_FAILED(res)) continue;
 
     aList.RemoveCStringAt(i);
@@ -1831,6 +1838,13 @@
   nsresult res = NS_OK;
 
   if (mBrowserMenuInitialized) {
+    // Don't add item to the cache if it's marked "notForBrowser"
+    nsAutoString str;
+    res = mCCManager->GetCharsetData(NS_LossyConvertUTF16toASCII(aCharset).get(),
+                                     NS_LITERAL_STRING(".notForBrowser").get(), str);
+    if (NS_SUCCEEDED(res)) // succeeded means attribute exists
+      return res; // don't throw
+
     res = AddCharsetToCache(NS_LossyConvertUCS2toASCII(aCharset),
                             &mBrowserMenu, kNC_BrowserCharsetMenuRoot, 
                             mBrowserCacheStart, mBrowserCacheSize,