Adding upstream version 86.0.1.upstream/86.0.1upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

18 files changed, 2088 insertions, 0 deletions

diff --git a/toolkit/components/startup/StartupTimeline.cpp b/toolkit/components/startup/StartupTimeline.cpp
new file mode 100644
index 0000000000..1981c66d9a
--- /dev/null
+++ b/toolkit/components/startup/StartupTimeline.cpp
@@ -0,0 +1,58 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "StartupTimeline.h"
+#include "mozilla/Telemetry.h"
+#include "mozilla/TimeStamp.h"
+#include "nsXULAppAPI.h"
+
+namespace mozilla {
+
+TimeStamp StartupTimeline::sStartupTimeline[StartupTimeline::MAX_EVENT_ID];
+const char*
+    StartupTimeline::sStartupTimelineDesc[StartupTimeline::MAX_EVENT_ID] = {
+#define mozilla_StartupTimeline_Event(ev, desc) desc,
+#include "StartupTimeline.h"
+#undef mozilla_StartupTimeline_Event
+};
+
+} /* namespace mozilla */
+
+using mozilla::StartupTimeline;
+using mozilla::TimeStamp;
+
+/**
+ * The XRE_StartupTimeline_Record function is to be used by embedding
+ * applications that can't use mozilla::StartupTimeline::Record() directly.
+ *
+ * @param aEvent The event to be recorded, must correspond to an element of the
+ *               mozilla::StartupTimeline::Event enumartion
+ * @param aWhen  The time at which the event happened
+ */
+void XRE_StartupTimelineRecord(int aEvent, TimeStamp aWhen) {
+  StartupTimeline::Record((StartupTimeline::Event)aEvent, aWhen);
+}
+
+void StartupTimeline::RecordOnce(Event ev) { RecordOnce(ev, TimeStamp::Now()); }
+
+void StartupTimeline::RecordOnce(Event ev, const TimeStamp& aWhen) {
+  if (HasRecord(ev)) {
+    return;
+  }
+
+  Record(ev, aWhen);
+
+  // Record first paint timestamp as a scalar.
+  if (ev == FIRST_PAINT || ev == FIRST_PAINT2) {
+    bool error = false;
+    uint32_t firstPaintTime =
+        (uint32_t)(aWhen - TimeStamp::ProcessCreation(&error)).ToMilliseconds();
+    if (!error) {
+      Telemetry::ScalarSet(
+          ev == FIRST_PAINT ? Telemetry::ScalarID::TIMESTAMPS_FIRST_PAINT
+                            : Telemetry::ScalarID::TIMESTAMPS_FIRST_PAINT_TWO,
+          firstPaintTime);
+    }
+  }
+}
diff --git a/toolkit/components/startup/StartupTimeline.h b/toolkit/components/startup/StartupTimeline.h
new file mode 100644
index 0000000000..f7d5ae5db4
--- /dev/null
+++ b/toolkit/components/startup/StartupTimeline.h
@@ -0,0 +1,86 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifdef mozilla_StartupTimeline_Event
+// clang-format off
+  mozilla_StartupTimeline_Event(PROCESS_CREATION, "process")
+  mozilla_StartupTimeline_Event(START, "start")
+  mozilla_StartupTimeline_Event(MAIN, "main")
+  mozilla_StartupTimeline_Event(SELECT_PROFILE, "selectProfile")
+  mozilla_StartupTimeline_Event(AFTER_PROFILE_LOCKED, "afterProfileLocked")
+
+  // Record the beginning and end of startup crash detection to compare with
+  // crash stats to know whether detection should be improved to start or end
+  // sooner.
+  mozilla_StartupTimeline_Event(STARTUP_CRASH_DETECTION_BEGIN, "startupCrashDetectionBegin")
+  mozilla_StartupTimeline_Event(STARTUP_CRASH_DETECTION_END,"startupCrashDetectionEnd")
+  mozilla_StartupTimeline_Event(FIRST_PAINT, "firstPaint")
+  mozilla_StartupTimeline_Event(FIRST_PAINT2, "firstPaint2")
+  mozilla_StartupTimeline_Event(SESSION_RESTORE_INIT, "sessionRestoreInit")
+  mozilla_StartupTimeline_Event(SESSION_RESTORED, "sessionRestored")
+  mozilla_StartupTimeline_Event(CREATE_TOP_LEVEL_WINDOW, "createTopLevelWindow")
+  mozilla_StartupTimeline_Event(LINKER_INITIALIZED, "linkerInitialized")
+  mozilla_StartupTimeline_Event(LIBRARIES_LOADED, "librariesLoaded")
+  mozilla_StartupTimeline_Event(FIRST_LOAD_URI, "firstLoadURI")
+
+  // The following are actually shutdown events, used to monitor the duration
+  // of shutdown
+  mozilla_StartupTimeline_Event(QUIT_APPLICATION, "quitApplication")
+  mozilla_StartupTimeline_Event(PROFILE_BEFORE_CHANGE, "profileBeforeChange")
+// clang-format on
+#else
+
+#  ifndef mozilla_StartupTimeline
+#    define mozilla_StartupTimeline
+
+#    include "mozilla/TimeStamp.h"
+#    include "nscore.h"
+
+#    ifdef MOZILLA_INTERNAL_API
+#      include "mozilla/ProfilerMarkers.h"
+#    endif
+
+namespace mozilla {
+
+void RecordShutdownEndTimeStamp();
+void RecordShutdownStartTimeStamp();
+
+class StartupTimeline {
+ public:
+  enum Event {
+#    define mozilla_StartupTimeline_Event(ev, z) ev,
+#    include "StartupTimeline.h"
+#    undef mozilla_StartupTimeline_Event
+    MAX_EVENT_ID
+  };
+
+  static TimeStamp Get(Event ev) { return sStartupTimeline[ev]; }
+
+  static const char* Describe(Event ev) { return sStartupTimelineDesc[ev]; }
+
+#    ifdef MOZILLA_INTERNAL_API
+  static void Record(Event ev) {
+    PROFILER_MARKER_UNTYPED(
+        ProfilerString8View::WrapNullTerminatedString(Describe(ev)), OTHER);
+    Record(ev, TimeStamp::Now());
+  }
+
+  static void Record(Event ev, TimeStamp when) { sStartupTimeline[ev] = when; }
+
+  static void RecordOnce(Event ev, const TimeStamp& aWhen);
+  static void RecordOnce(Event ev);
+#    endif
+
+  static bool HasRecord(Event ev) { return !sStartupTimeline[ev].IsNull(); }
+
+ private:
+  static TimeStamp sStartupTimeline[MAX_EVENT_ID];
+  static const char* sStartupTimelineDesc[MAX_EVENT_ID];
+};
+
+}  // namespace mozilla
+
+#  endif /* mozilla_StartupTimeline */
+
+#endif /* mozilla_StartupTimeline_Event */
diff --git a/toolkit/components/startup/moz.build b/toolkit/components/startup/moz.build
new file mode 100644
index 0000000000..4127f90e67
--- /dev/null
+++ b/toolkit/components/startup/moz.build
@@ -0,0 +1,24 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+DIRS += ["public"]
+
+EXPORTS.mozilla += [
+    "StartupTimeline.h",
+]
+
+BROWSER_CHROME_MANIFESTS += ["tests/browser/browser.ini"]
+XPCSHELL_TESTS_MANIFESTS += ["tests/unit/xpcshell.ini"]
+
+UNIFIED_SOURCES += [
+    "nsAppStartup.cpp",
+    "StartupTimeline.cpp",
+]
+
+FINAL_LIBRARY = "xul"
+
+with Files("**"):
+    BUG_COMPONENT = ("Toolkit", "Startup and Profile System")
diff --git a/toolkit/components/startup/mozprofilerprobe.mof b/toolkit/components/startup/mozprofilerprobe.mof
new file mode 100644
index 0000000000..03379ba1d1
--- /dev/null
+++ b/toolkit/components/startup/mozprofilerprobe.mof
@@ -0,0 +1,29 @@
+#pragma namespace("\\\\.\\root\\wmi")
+#pragma autorecover
+
+[dynamic: ToInstance, Description("Mozilla Generic Provider"),
+ Guid("{509962E0-406B-46F4-99BA-5A009F8D2225}")]
+class MozillaProvider : EventTrace
+{
+};
+
+[dynamic: ToInstance, Description("Mozilla Event: Places Init is complete."): Amended,
+ Guid("{A3DA04E0-57D7-482A-A1C1-61DA5F95BACB}"),
+ EventType(1)]
+class MozillaEventPlacesInit : MozillaProvider
+{
+};
+
+[dynamic: ToInstance, Description("Mozilla Event: Session Store Window Restored."): Amended,
+ Guid("{917B96B1-ECAD-4DAB-A760-8D49027748AE}"),
+ EventType(1)]
+class MozillaEventSessionStoreWindowRestored : MozillaProvider
+{
+};
+
+[dynamic: ToInstance, Description("Mozilla Event: XPCOM Shutdown."): Amended,
+ Guid("{26D1E091-0AE7-4F49-A554-4214445C505C}"),
+ EventType(1)]
+class MozillaEventXPCOMShutdown : MozillaProvider
+{
+};
diff --git a/toolkit/components/startup/nsAppStartup.cpp b/toolkit/components/startup/nsAppStartup.cpp
new file mode 100644
index 0000000000..dd475eb83b
--- /dev/null
+++ b/toolkit/components/startup/nsAppStartup.cpp
@@ -0,0 +1,1016 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsAppStartup.h"
+
+#include "nsComponentManagerUtils.h"
+#include "nsIAppShellService.h"
+#include "nsPIDOMWindow.h"
+#include "nsIInterfaceRequestor.h"
+#include "nsIFile.h"
+#include "nsIObserverService.h"
+#include "nsIPrefBranch.h"
+#include "nsIPrefService.h"
+#include "nsIProcess.h"
+#include "nsIToolkitProfile.h"
+#include "nsIWebBrowserChrome.h"
+#include "nsIWindowMediator.h"
+#include "nsIXULRuntime.h"
+#include "nsIAppWindow.h"
+#include "nsNativeCharsetUtils.h"
+#include "nsThreadUtils.h"
+#include "nsString.h"
+#include "mozilla/AppShutdown.h"
+#include "mozilla/Preferences.h"
+#include "mozilla/ProfilerMarkers.h"
+#include "mozilla/ResultExtensions.h"
+#include "mozilla/Unused.h"
+
+#include "GeckoProfiler.h"
+#include "prprf.h"
+#include "nsIInterfaceRequestorUtils.h"
+#include "nsWidgetsCID.h"
+#include "nsAppRunner.h"
+#include "nsAppShellCID.h"
+#include "nsXPCOMCIDInternal.h"
+#include "mozilla/Services.h"
+#include "jsapi.h"
+#include "js/Date.h"
+#include "prenv.h"
+#include "nsAppDirectoryServiceDefs.h"
+
+#if defined(XP_WIN)
+// Prevent collisions with nsAppStartup::GetStartupInfo()
+#  undef GetStartupInfo
+
+#  include <windows.h>
+#elif defined(XP_DARWIN)
+#  include <mach/mach_time.h>
+#endif
+
+#include "mozilla/IOInterposer.h"
+#include "mozilla/Telemetry.h"
+#include "mozilla/StartupTimeline.h"
+
+static NS_DEFINE_CID(kAppShellCID, NS_APPSHELL_CID);
+
+#define kPrefLastSuccess "toolkit.startup.last_success"
+#define kPrefMaxResumedCrashes "toolkit.startup.max_resumed_crashes"
+#define kPrefRecentCrashes "toolkit.startup.recent_crashes"
+#define kPrefAlwaysUseSafeMode "toolkit.startup.always_use_safe_mode"
+
+#define kNanosecondsPerSecond 1000000000.0
+
+#if defined(XP_WIN)
+#  include "mozilla/perfprobe.h"
+/**
+ * Events sent to the system for profiling purposes
+ */
+// Keep them syncronized with the .mof file
+
+// Process-wide GUID, used by the OS to differentiate sources
+// {509962E0-406B-46F4-99BA-5A009F8D2225}
+// Keep it synchronized with the .mof file
+#  define NS_APPLICATION_TRACING_CID                   \
+    {                                                  \
+      0x509962E0, 0x406B, 0x46F4, {                    \
+        0x99, 0xBA, 0x5A, 0x00, 0x9F, 0x8D, 0x22, 0x25 \
+      }                                                \
+    }
+
+// Event-specific GUIDs, used by the OS to differentiate events
+// {A3DA04E0-57D7-482A-A1C1-61DA5F95BACB}
+#  define NS_PLACES_INIT_COMPLETE_EVENT_CID            \
+    {                                                  \
+      0xA3DA04E0, 0x57D7, 0x482A, {                    \
+        0xA1, 0xC1, 0x61, 0xDA, 0x5F, 0x95, 0xBA, 0xCB \
+      }                                                \
+    }
+// {917B96B1-ECAD-4DAB-A760-8D49027748AE}
+#  define NS_SESSION_STORE_WINDOW_RESTORED_EVENT_CID   \
+    {                                                  \
+      0x917B96B1, 0xECAD, 0x4DAB, {                    \
+        0xA7, 0x60, 0x8D, 0x49, 0x02, 0x77, 0x48, 0xAE \
+      }                                                \
+    }
+// {26D1E091-0AE7-4F49-A554-4214445C505C}
+#  define NS_XPCOM_SHUTDOWN_EVENT_CID                  \
+    {                                                  \
+      0x26D1E091, 0x0AE7, 0x4F49, {                    \
+        0xA5, 0x54, 0x42, 0x14, 0x44, 0x5C, 0x50, 0x5C \
+      }                                                \
+    }
+
+static NS_DEFINE_CID(kApplicationTracingCID, NS_APPLICATION_TRACING_CID);
+static NS_DEFINE_CID(kPlacesInitCompleteCID, NS_PLACES_INIT_COMPLETE_EVENT_CID);
+static NS_DEFINE_CID(kSessionStoreWindowRestoredCID,
+                     NS_SESSION_STORE_WINDOW_RESTORED_EVENT_CID);
+static NS_DEFINE_CID(kXPCOMShutdownCID, NS_XPCOM_SHUTDOWN_EVENT_CID);
+#endif  // defined(XP_WIN)
+
+using namespace mozilla;
+
+class nsAppExitEvent : public mozilla::Runnable {
+ private:
+  RefPtr<nsAppStartup> mService;
+
+ public:
+  explicit nsAppExitEvent(nsAppStartup* service)
+      : mozilla::Runnable("nsAppExitEvent"), mService(service) {}
+
+  NS_IMETHOD Run() override {
+    // Tell the appshell to exit
+    mService->mAppShell->Exit();
+
+    mService->mRunning = false;
+    return NS_OK;
+  }
+};
+
+/**
+ * Computes an approximation of the absolute time represented by @a stamp
+ * which is comparable to those obtained via PR_Now(). If the current absolute
+ * time varies a lot (e.g. DST adjustments) since the first call then the
+ * resulting times may be inconsistent.
+ *
+ * @param stamp The timestamp to be converted
+ * @returns The converted timestamp
+ */
+static uint64_t ComputeAbsoluteTimestamp(TimeStamp stamp) {
+  static PRTime sAbsoluteNow = PR_Now();
+  static TimeStamp sMonotonicNow = TimeStamp::Now();
+
+  return sAbsoluteNow - (sMonotonicNow - stamp).ToMicroseconds();
+}
+
+//
+// nsAppStartup
+//
+
+nsAppStartup::nsAppStartup()
+    : mConsiderQuitStopper(0),
+      mRunning(false),
+      mShuttingDown(false),
+      mStartingUp(true),
+      mAttemptingQuit(false),
+      mInterrupted(false),
+      mIsSafeModeNecessary(false),
+      mStartupCrashTrackingEnded(false) {}
+
+nsresult nsAppStartup::Init() {
+  nsresult rv;
+
+  // Create widget application shell
+  mAppShell = do_GetService(kAppShellCID, &rv);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
+  if (!os) return NS_ERROR_FAILURE;
+
+  os->AddObserver(this, "quit-application", true);
+  os->AddObserver(this, "quit-application-forced", true);
+  os->AddObserver(this, "sessionstore-init-started", true);
+  os->AddObserver(this, "sessionstore-windows-restored", true);
+  os->AddObserver(this, "profile-change-teardown", true);
+  os->AddObserver(this, "xul-window-registered", true);
+  os->AddObserver(this, "xul-window-destroyed", true);
+  os->AddObserver(this, "profile-before-change", true);
+  os->AddObserver(this, "xpcom-shutdown", true);
+
+#if defined(XP_WIN)
+  os->AddObserver(this, "places-init-complete", true);
+  // This last event is only interesting to us for xperf-based measures
+
+  // Initialize interaction with profiler
+  mProbesManager =
+      new ProbeManager(kApplicationTracingCID, "Application startup probe"_ns);
+  // Note: The operation is meant mostly for in-house profiling.
+  // Therefore, we do not warn if probes manager cannot be initialized
+
+  if (mProbesManager) {
+    mPlacesInitCompleteProbe = mProbesManager->GetProbe(
+        kPlacesInitCompleteCID, "places-init-complete"_ns);
+    NS_WARNING_ASSERTION(mPlacesInitCompleteProbe,
+                         "Cannot initialize probe 'places-init-complete'");
+
+    mSessionWindowRestoredProbe = mProbesManager->GetProbe(
+        kSessionStoreWindowRestoredCID, "sessionstore-windows-restored"_ns);
+    NS_WARNING_ASSERTION(
+        mSessionWindowRestoredProbe,
+        "Cannot initialize probe 'sessionstore-windows-restored'");
+
+    mXPCOMShutdownProbe =
+        mProbesManager->GetProbe(kXPCOMShutdownCID, "xpcom-shutdown"_ns);
+    NS_WARNING_ASSERTION(mXPCOMShutdownProbe,
+                         "Cannot initialize probe 'xpcom-shutdown'");
+
+    rv = mProbesManager->StartSession();
+    NS_WARNING_ASSERTION(NS_SUCCEEDED(rv),
+                         "Cannot initialize system probe manager");
+  }
+#endif  // defined(XP_WIN)
+
+  return NS_OK;
+}
+
+//
+// nsAppStartup->nsISupports
+//
+
+NS_IMPL_ISUPPORTS(nsAppStartup, nsIAppStartup, nsIWindowCreator, nsIObserver,
+                  nsISupportsWeakReference)
+
+//
+// nsAppStartup->nsIAppStartup
+//
+
+NS_IMETHODIMP
+nsAppStartup::CreateHiddenWindow() {
+#if defined(MOZ_WIDGET_UIKIT)
+  return NS_OK;
+#else
+  nsCOMPtr<nsIAppShellService> appShellService(
+      do_GetService(NS_APPSHELLSERVICE_CONTRACTID));
+  NS_ENSURE_TRUE(appShellService, NS_ERROR_FAILURE);
+
+  return appShellService->CreateHiddenWindow();
+#endif
+}
+
+NS_IMETHODIMP
+nsAppStartup::DestroyHiddenWindow() {
+#if defined(MOZ_WIDGET_UIKIT)
+  return NS_OK;
+#else
+  nsCOMPtr<nsIAppShellService> appShellService(
+      do_GetService(NS_APPSHELLSERVICE_CONTRACTID));
+  NS_ENSURE_TRUE(appShellService, NS_ERROR_FAILURE);
+
+  return appShellService->DestroyHiddenWindow();
+#endif
+}
+
+NS_IMETHODIMP
+nsAppStartup::Run(void) {
+  NS_ASSERTION(!mRunning, "Reentrant appstartup->Run()");
+
+  // If we have no windows open and no explicit calls to
+  // enterLastWindowClosingSurvivalArea, or somebody has explicitly called
+  // quit, don't bother running the event loop which would probably leave us
+  // with a zombie process.
+
+  if (!mShuttingDown && mConsiderQuitStopper != 0) {
+#ifdef XP_MACOSX
+    EnterLastWindowClosingSurvivalArea();
+#endif
+
+    mRunning = true;
+
+    nsresult rv = mAppShell->Run();
+    if (NS_FAILED(rv)) return rv;
+  }
+
+  // Make sure that the appropriate quit notifications have been dispatched
+  // regardless of whether the event loop has spun or not. Note that this call
+  // is a no-op if Quit has already been called previously.
+  bool userAllowedQuit = true;
+  Quit(eForceQuit, 0, &userAllowedQuit);
+
+  nsresult retval = NS_OK;
+  if (mozilla::AppShutdown::IsRestarting()) {
+    retval = NS_SUCCESS_RESTART_APP;
+  }
+
+  return retval;
+}
+
+NS_IMETHODIMP
+nsAppStartup::Quit(uint32_t aMode, int aExitCode, bool* aUserAllowedQuit) {
+  uint32_t ferocity = (aMode & 0xF);
+
+  // If the shutdown was cancelled due to a hidden window or
+  // because one of the windows was not permitted to be closed,
+  // return NS_OK with |aUserAllowedQuit| = false.
+  *aUserAllowedQuit = false;
+
+  // Quit the application. We will asynchronously call the appshell's
+  // Exit() method via nsAppExitEvent to allow one last pass
+  // through any events in the queue. This guarantees a tidy cleanup.
+  nsresult rv = NS_OK;
+  bool postedExitEvent = false;
+
+  if (mShuttingDown) return NS_OK;
+
+  // If we're considering quitting, we will only do so if:
+  if (ferocity == eConsiderQuit) {
+#ifdef XP_MACOSX
+    nsCOMPtr<nsIAppShellService> appShell(
+        do_GetService(NS_APPSHELLSERVICE_CONTRACTID));
+    int32_t suspiciousCount = 1;
+#endif
+
+    if (mConsiderQuitStopper == 0) {
+      // there are no windows...
+      ferocity = eAttemptQuit;
+    }
+#ifdef XP_MACOSX
+    else if (mConsiderQuitStopper == suspiciousCount) {
+      // ... or there is only a hiddenWindow left, and it's useless:
+
+      // Failure shouldn't be fatal, but will abort quit attempt:
+      if (!appShell) return NS_OK;
+
+      bool usefulHiddenWindow;
+      appShell->GetApplicationProvidedHiddenWindow(&usefulHiddenWindow);
+      nsCOMPtr<nsIAppWindow> hiddenWindow;
+      appShell->GetHiddenWindow(getter_AddRefs(hiddenWindow));
+      // If the remaining windows are useful, we won't quit:
+      if (!hiddenWindow || usefulHiddenWindow) {
+        return NS_OK;
+      }
+
+      ferocity = eAttemptQuit;
+    }
+#endif
+  }
+
+  nsCOMPtr<nsIObserverService> obsService;
+  if (ferocity == eAttemptQuit || ferocity == eForceQuit) {
+    nsCOMPtr<nsISimpleEnumerator> windowEnumerator;
+    nsCOMPtr<nsIWindowMediator> mediator(
+        do_GetService(NS_WINDOWMEDIATOR_CONTRACTID));
+    if (mediator) {
+      mediator->GetEnumerator(nullptr, getter_AddRefs(windowEnumerator));
+      if (windowEnumerator) {
+        bool more;
+        windowEnumerator->HasMoreElements(&more);
+        // If we reported no windows, we definitely shouldn't be
+        // iterating any here.
+        MOZ_ASSERT_IF(!mConsiderQuitStopper, !more);
+
+        while (more) {
+          nsCOMPtr<nsISupports> window;
+          windowEnumerator->GetNext(getter_AddRefs(window));
+          nsCOMPtr<nsPIDOMWindowOuter> domWindow(do_QueryInterface(window));
+          if (domWindow) {
+            if (!domWindow->CanClose()) {
+              return NS_OK;
+            }
+          }
+          windowEnumerator->HasMoreElements(&more);
+        }
+      }
+    }
+
+    PROFILER_MARKER_UNTYPED("Shutdown start", OTHER);
+    mozilla::RecordShutdownStartTimeStamp();
+
+    *aUserAllowedQuit = true;
+    mShuttingDown = true;
+    auto shutdownMode = ((aMode & eRestart) != 0)
+                            ? mozilla::AppShutdownMode::Restart
+                            : mozilla::AppShutdownMode::Normal;
+    mozilla::AppShutdown::Init(shutdownMode, aExitCode);
+
+    if (mozilla::AppShutdown::IsRestarting()) {
+      // Mark the next startup as a restart.
+      PR_SetEnv("MOZ_APP_RESTART=1");
+
+      /* Firefox-restarts reuse the process so regular process start-time isn't
+         a useful indicator of startup time anymore. */
+      TimeStamp::RecordProcessRestart();
+    }
+
+    obsService = mozilla::services::GetObserverService();
+
+    if (!mAttemptingQuit) {
+      mAttemptingQuit = true;
+#ifdef XP_MACOSX
+      // now even the Mac wants to quit when the last window is closed
+      ExitLastWindowClosingSurvivalArea();
+#endif
+      if (obsService)
+        obsService->NotifyObservers(nullptr, "quit-application-granted",
+                                    nullptr);
+    }
+
+    /* Enumerate through each open window and close it. It's important to do
+       this before we forcequit because this can control whether we really quit
+       at all. e.g. if one of these windows has an unload handler that
+       opens a new window. Ugh. I know. */
+    CloseAllWindows();
+
+    if (mediator) {
+      if (ferocity == eAttemptQuit) {
+        ferocity = eForceQuit;  // assume success
+
+        /* Were we able to immediately close all windows? if not, eAttemptQuit
+           failed. This could happen for a variety of reasons; in fact it's
+           very likely. Perhaps we're being called from JS and the window->Close
+           method hasn't had a chance to wrap itself up yet. So give up.
+           We'll return (with eConsiderQuit) as the remaining windows are
+           closed. */
+        mediator->GetEnumerator(nullptr, getter_AddRefs(windowEnumerator));
+        if (windowEnumerator) {
+          bool more;
+          while (NS_SUCCEEDED(windowEnumerator->HasMoreElements(&more)) &&
+                 more) {
+            /* we can't quit immediately. we'll try again as the last window
+               finally closes. */
+            ferocity = eAttemptQuit;
+            nsCOMPtr<nsISupports> window;
+            windowEnumerator->GetNext(getter_AddRefs(window));
+            nsCOMPtr<nsPIDOMWindowOuter> domWindow = do_QueryInterface(window);
+            if (domWindow) {
+              if (!domWindow->Closed()) {
+                rv = NS_ERROR_FAILURE;
+                break;
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  if (ferocity == eForceQuit) {
+    // do it!
+    mozilla::AppShutdown::OnShutdownConfirmed();
+
+    // No chance of the shutdown being cancelled from here on; tell people
+    // we're shutting down for sure while all services are still available.
+    if (obsService) {
+      bool isRestarting = mozilla::AppShutdown::IsRestarting();
+      obsService->NotifyObservers(nullptr, "quit-application",
+                                  isRestarting ? u"restart" : u"shutdown");
+    }
+
+    if (!mRunning) {
+      postedExitEvent = true;
+    } else {
+      // no matter what, make sure we send the exit event.  If
+      // worst comes to worst, we'll do a leaky shutdown but we WILL
+      // shut down. Well, assuming that all *this* stuff works ;-).
+      nsCOMPtr<nsIRunnable> event = new nsAppExitEvent(this);
+      rv = NS_DispatchToCurrentThread(event);
+      if (NS_SUCCEEDED(rv)) {
+        postedExitEvent = true;
+      } else {
+        NS_WARNING("failed to dispatch nsAppExitEvent");
+      }
+    }
+  }
+
+  // turn off the reentrancy check flag, but not if we have
+  // more asynchronous work to do still.
+  if (!postedExitEvent) {
+    mShuttingDown = false;
+  }
+  return rv;
+}
+
+void nsAppStartup::CloseAllWindows() {
+  nsCOMPtr<nsIWindowMediator> mediator(
+      do_GetService(NS_WINDOWMEDIATOR_CONTRACTID));
+
+  nsCOMPtr<nsISimpleEnumerator> windowEnumerator;
+
+  mediator->GetEnumerator(nullptr, getter_AddRefs(windowEnumerator));
+
+  if (!windowEnumerator) return;
+
+  bool more;
+  while (NS_SUCCEEDED(windowEnumerator->HasMoreElements(&more)) && more) {
+    nsCOMPtr<nsISupports> isupports;
+    if (NS_FAILED(windowEnumerator->GetNext(getter_AddRefs(isupports)))) break;
+
+    nsCOMPtr<nsPIDOMWindowOuter> window = do_QueryInterface(isupports);
+    NS_ASSERTION(window, "not an nsPIDOMWindow");
+    if (window) {
+      window->ForceClose();
+    }
+  }
+}
+
+NS_IMETHODIMP
+nsAppStartup::EnterLastWindowClosingSurvivalArea(void) {
+  ++mConsiderQuitStopper;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsAppStartup::ExitLastWindowClosingSurvivalArea(void) {
+  NS_ASSERTION(mConsiderQuitStopper > 0, "consider quit stopper out of bounds");
+  --mConsiderQuitStopper;
+
+  if (mRunning) {
+    bool userAllowedQuit = false;
+
+    // A previous call to Quit may have told all windows to close and then
+    // bailed out waiting for that to happen. This is how we get back into Quit
+    // after each window closes so the exit process can continue when ready.
+    // Make sure to pass along the exit code that was initially passed to Quit.
+    Quit(eConsiderQuit, mozilla::AppShutdown::GetExitCode(), &userAllowedQuit);
+  }
+
+  return NS_OK;
+}
+
+//
+// nsAppStartup->nsIAppStartup2
+//
+
+NS_IMETHODIMP
+nsAppStartup::GetShuttingDown(bool* aResult) {
+  *aResult = mShuttingDown;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsAppStartup::GetStartingUp(bool* aResult) {
+  *aResult = mStartingUp;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsAppStartup::DoneStartingUp() {
+  // This must be called once at most
+  MOZ_ASSERT(mStartingUp);
+
+  mStartingUp = false;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsAppStartup::GetRestarting(bool* aResult) {
+  *aResult = mozilla::AppShutdown::IsRestarting();
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsAppStartup::GetWasRestarted(bool* aResult) {
+  char* mozAppRestart = PR_GetEnv("MOZ_APP_RESTART");
+
+  /* When calling PR_SetEnv() with an empty value the existing variable may
+   * be unset or set to the empty string depending on the underlying platform
+   * thus we have to check if the variable is present and not empty. */
+  *aResult = mozAppRestart && (strcmp(mozAppRestart, "") != 0);
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsAppStartup::GetSecondsSinceLastOSRestart(int64_t* aResult) {
+#if defined(XP_WIN)
+  *aResult = int64_t(GetTickCount64() / 1000ull);
+  return NS_OK;
+#elif defined(XP_DARWIN)
+  uint64_t absTime = mach_absolute_time();
+  mach_timebase_info_data_t timebaseInfo;
+  mach_timebase_info(&timebaseInfo);
+  double toNanoseconds =
+      double(timebaseInfo.numer) / double(timebaseInfo.denom);
+  *aResult =
+      std::llround(double(absTime) * toNanoseconds / kNanosecondsPerSecond);
+  return NS_OK;
+#else
+  return NS_ERROR_NOT_IMPLEMENTED;
+#endif
+}
+
+NS_IMETHODIMP
+nsAppStartup::SetInterrupted(bool aInterrupted) {
+  mInterrupted = aInterrupted;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsAppStartup::GetInterrupted(bool* aInterrupted) {
+  *aInterrupted = mInterrupted;
+  return NS_OK;
+}
+
+//
+// nsAppStartup->nsIWindowCreator
+//
+
+NS_IMETHODIMP
+nsAppStartup::CreateChromeWindow(nsIWebBrowserChrome* aParent,
+                                 uint32_t aChromeFlags,
+                                 nsIOpenWindowInfo* aOpenWindowInfo,
+                                 bool* aCancel, nsIWebBrowserChrome** _retval) {
+  NS_ENSURE_ARG_POINTER(aCancel);
+  NS_ENSURE_ARG_POINTER(_retval);
+  *aCancel = false;
+  *_retval = 0;
+
+  // Non-modal windows cannot be opened if we are attempting to quit
+  if (mAttemptingQuit &&
+      (aChromeFlags & nsIWebBrowserChrome::CHROME_MODAL) == 0)
+    return NS_ERROR_ILLEGAL_DURING_SHUTDOWN;
+
+  // Fission windows must also be marked as remote
+  if ((aChromeFlags & nsIWebBrowserChrome::CHROME_FISSION_WINDOW) &&
+      !(aChromeFlags & nsIWebBrowserChrome::CHROME_REMOTE_WINDOW)) {
+    NS_WARNING("Cannot create non-remote fission window!");
+    return NS_ERROR_FAILURE;
+  }
+
+  nsCOMPtr<nsIAppWindow> newWindow;
+
+  if (aParent) {
+    nsCOMPtr<nsIAppWindow> appParent(do_GetInterface(aParent));
+    NS_ASSERTION(appParent,
+                 "window created using non-app parent. that's unexpected, but "
+                 "may work.");
+
+    if (appParent)
+      appParent->CreateNewWindow(aChromeFlags, aOpenWindowInfo,
+                                 getter_AddRefs(newWindow));
+    // And if it fails, don't try again without a parent. It could fail
+    // intentionally (bug 115969).
+  } else {  // try using basic methods:
+    MOZ_RELEASE_ASSERT(!aOpenWindowInfo,
+                       "Unexpected aOpenWindowInfo, we shouldn't ever have an "
+                       "nsIOpenWindowInfo without a parent");
+
+    /* You really shouldn't be making dependent windows without a parent.
+      But unparented modal (and therefore dependent) windows happen
+      in our codebase, so we allow it after some bellyaching: */
+    if (aChromeFlags & nsIWebBrowserChrome::CHROME_DEPENDENT)
+      NS_WARNING("dependent window created without a parent");
+
+    nsCOMPtr<nsIAppShellService> appShell(
+        do_GetService(NS_APPSHELLSERVICE_CONTRACTID));
+    if (!appShell) return NS_ERROR_FAILURE;
+
+    appShell->CreateTopLevelWindow(
+        0, 0, aChromeFlags, nsIAppShellService::SIZE_TO_CONTENT,
+        nsIAppShellService::SIZE_TO_CONTENT, getter_AddRefs(newWindow));
+  }
+
+  // if anybody gave us anything to work with, use it
+  if (newWindow) {
+    nsCOMPtr<nsIInterfaceRequestor> thing(do_QueryInterface(newWindow));
+    if (thing) CallGetInterface(thing.get(), _retval);
+  }
+
+  return *_retval ? NS_OK : NS_ERROR_FAILURE;
+}
+
+//
+// nsAppStartup->nsIObserver
+//
+
+NS_IMETHODIMP
+nsAppStartup::Observe(nsISupports* aSubject, const char* aTopic,
+                      const char16_t* aData) {
+  NS_ASSERTION(mAppShell, "appshell service notified before appshell built");
+  if (!strcmp(aTopic, "quit-application-forced")) {
+    mShuttingDown = true;
+  } else if (!strcmp(aTopic, "profile-change-teardown")) {
+    if (!mShuttingDown) {
+      EnterLastWindowClosingSurvivalArea();
+      CloseAllWindows();
+      ExitLastWindowClosingSurvivalArea();
+    }
+  } else if (!strcmp(aTopic, "xul-window-registered")) {
+    EnterLastWindowClosingSurvivalArea();
+  } else if (!strcmp(aTopic, "xul-window-destroyed")) {
+    ExitLastWindowClosingSurvivalArea();
+  } else if (!strcmp(aTopic, "sessionstore-windows-restored")) {
+    StartupTimeline::Record(StartupTimeline::SESSION_RESTORED);
+    IOInterposer::EnteringNextStage();
+#if defined(XP_WIN)
+    if (mSessionWindowRestoredProbe) {
+      mSessionWindowRestoredProbe->Trigger();
+    }
+  } else if (!strcmp(aTopic, "places-init-complete")) {
+    if (mPlacesInitCompleteProbe) {
+      mPlacesInitCompleteProbe->Trigger();
+    }
+#endif  // defined(XP_WIN)
+  } else if (!strcmp(aTopic, "sessionstore-init-started")) {
+    StartupTimeline::Record(StartupTimeline::SESSION_RESTORE_INIT);
+  } else if (!strcmp(aTopic, "xpcom-shutdown")) {
+    IOInterposer::EnteringNextStage();
+#if defined(XP_WIN)
+    if (mXPCOMShutdownProbe) {
+      mXPCOMShutdownProbe->Trigger();
+    }
+#endif  // defined(XP_WIN)
+  } else if (!strcmp(aTopic, "quit-application")) {
+    StartupTimeline::Record(StartupTimeline::QUIT_APPLICATION);
+  } else if (!strcmp(aTopic, "profile-before-change")) {
+    StartupTimeline::Record(StartupTimeline::PROFILE_BEFORE_CHANGE);
+  } else {
+    NS_ERROR("Unexpected observer topic.");
+  }
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsAppStartup::GetStartupInfo(JSContext* aCx,
+                             JS::MutableHandle<JS::Value> aRetval) {
+  JS::Rooted<JSObject*> obj(aCx, JS_NewPlainObject(aCx));
+
+  aRetval.setObject(*obj);
+
+  TimeStamp procTime = StartupTimeline::Get(StartupTimeline::PROCESS_CREATION);
+
+  if (procTime.IsNull()) {
+    bool error = false;
+
+    procTime = TimeStamp::ProcessCreation(&error);
+
+    StartupTimeline::Record(StartupTimeline::PROCESS_CREATION, procTime);
+  }
+
+  for (int i = StartupTimeline::PROCESS_CREATION;
+       i < StartupTimeline::MAX_EVENT_ID; ++i) {
+    StartupTimeline::Event ev = static_cast<StartupTimeline::Event>(i);
+    TimeStamp stamp = StartupTimeline::Get(ev);
+
+    if (stamp.IsNull() && (ev == StartupTimeline::MAIN)) {
+      // Always define main to aid with bug 689256.
+      stamp = procTime;
+      MOZ_ASSERT(!stamp.IsNull());
+    }
+
+    if (!stamp.IsNull()) {
+      if (stamp >= procTime) {
+        PRTime prStamp = ComputeAbsoluteTimestamp(stamp) / PR_USEC_PER_MSEC;
+        JS::Rooted<JSObject*> date(
+            aCx, JS::NewDateObject(aCx, JS::TimeClip(prStamp)));
+        JS_DefineProperty(aCx, obj, StartupTimeline::Describe(ev), date,
+                          JSPROP_ENUMERATE);
+      }
+    }
+  }
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsAppStartup::GetAutomaticSafeModeNecessary(bool* _retval) {
+  NS_ENSURE_ARG_POINTER(_retval);
+
+  bool alwaysSafe = false;
+  Preferences::GetBool(kPrefAlwaysUseSafeMode, &alwaysSafe);
+
+  if (!alwaysSafe) {
+#if DEBUG
+    mIsSafeModeNecessary = false;
+#else
+    mIsSafeModeNecessary &= !PR_GetEnv("MOZ_DISABLE_AUTO_SAFE_MODE");
+#endif
+  }
+
+  *_retval = mIsSafeModeNecessary;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsAppStartup::TrackStartupCrashBegin(bool* aIsSafeModeNecessary) {
+  const int32_t MAX_TIME_SINCE_STARTUP = 6 * 60 * 60 * 1000;
+  const int32_t MAX_STARTUP_BUFFER = 10;
+  nsresult rv;
+
+  mStartupCrashTrackingEnded = false;
+
+  StartupTimeline::Record(StartupTimeline::STARTUP_CRASH_DETECTION_BEGIN);
+
+  bool hasLastSuccess = Preferences::HasUserValue(kPrefLastSuccess);
+  if (!hasLastSuccess) {
+    // Clear so we don't get stuck with SafeModeNecessary returning true if we
+    // have had too many recent crashes and the last success pref is missing.
+    Preferences::ClearUser(kPrefRecentCrashes);
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+
+  bool inSafeMode = false;
+  nsCOMPtr<nsIXULRuntime> xr = do_GetService(XULRUNTIME_SERVICE_CONTRACTID);
+  NS_ENSURE_TRUE(xr, NS_ERROR_FAILURE);
+
+  xr->GetInSafeMode(&inSafeMode);
+
+  PRTime replacedLockTime;
+  rv = xr->GetReplacedLockTime(&replacedLockTime);
+
+  if (NS_FAILED(rv) || !replacedLockTime) {
+    if (!inSafeMode) Preferences::ClearUser(kPrefRecentCrashes);
+    GetAutomaticSafeModeNecessary(aIsSafeModeNecessary);
+    return NS_OK;
+  }
+
+  // check whether safe mode is necessary
+  int32_t maxResumedCrashes = -1;
+  rv = Preferences::GetInt(kPrefMaxResumedCrashes, &maxResumedCrashes);
+  NS_ENSURE_SUCCESS(rv, NS_OK);
+
+  int32_t recentCrashes = 0;
+  Preferences::GetInt(kPrefRecentCrashes, &recentCrashes);
+  mIsSafeModeNecessary =
+      (recentCrashes > maxResumedCrashes && maxResumedCrashes != -1);
+
+  // Bug 731613 - Don't check if the last startup was a crash if
+  // XRE_PROFILE_PATH is set.  After profile manager, the profile lock's mod.
+  // time has been changed so can't be used on this startup. After a restart,
+  // it's safe to assume the last startup was successful.
+  char* xreProfilePath = PR_GetEnv("XRE_PROFILE_PATH");
+  if (xreProfilePath) {
+    GetAutomaticSafeModeNecessary(aIsSafeModeNecessary);
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+
+  // time of last successful startup
+  int32_t lastSuccessfulStartup;
+  rv = Preferences::GetInt(kPrefLastSuccess, &lastSuccessfulStartup);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  int32_t lockSeconds = (int32_t)(replacedLockTime / PR_MSEC_PER_SEC);
+
+  // started close enough to good startup so call it good
+  if (lockSeconds <= lastSuccessfulStartup + MAX_STARTUP_BUFFER &&
+      lockSeconds >= lastSuccessfulStartup - MAX_STARTUP_BUFFER) {
+    GetAutomaticSafeModeNecessary(aIsSafeModeNecessary);
+    return NS_OK;
+  }
+
+  // sanity check that the pref set at last success is not greater than the
+  // current time
+  if (PR_Now() / PR_USEC_PER_SEC <= lastSuccessfulStartup)
+    return NS_ERROR_FAILURE;
+
+  // The last startup was a crash so include it in the count regardless of when
+  // it happened.
+  Telemetry::Accumulate(Telemetry::STARTUP_CRASH_DETECTED, true);
+
+  if (inSafeMode) {
+    GetAutomaticSafeModeNecessary(aIsSafeModeNecessary);
+    return NS_OK;
+  }
+
+  PRTime now = (PR_Now() / PR_USEC_PER_MSEC);
+  // if the last startup attempt which crashed was in the last 6 hours
+  if (replacedLockTime >= now - MAX_TIME_SINCE_STARTUP) {
+    NS_WARNING("Last startup was detected as a crash.");
+    recentCrashes++;
+    rv = Preferences::SetInt(kPrefRecentCrashes, recentCrashes);
+  } else {
+    // Otherwise ignore that crash and all previous since it may not be
+    // applicable anymore and we don't want someone to get stuck in safe mode if
+    // their prefs are read-only.
+    rv = Preferences::ClearUser(kPrefRecentCrashes);
+  }
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // recalculate since recent crashes count may have changed above
+  mIsSafeModeNecessary =
+      (recentCrashes > maxResumedCrashes && maxResumedCrashes != -1);
+
+  nsCOMPtr<nsIPrefService> prefs = Preferences::GetService();
+  rv = static_cast<Preferences*>(prefs.get())
+           ->SavePrefFileBlocking();  // flush prefs to disk since we are
+                                      // tracking crashes
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  GetAutomaticSafeModeNecessary(aIsSafeModeNecessary);
+  return rv;
+}
+
+static nsresult RemoveIncompleteStartupFile() {
+  nsCOMPtr<nsIFile> file;
+  MOZ_TRY(NS_GetSpecialDirectory(NS_APP_USER_PROFILE_LOCAL_50_DIR,
+                                 getter_AddRefs(file)));
+
+  return NS_DispatchBackgroundTask(NS_NewRunnableFunction(
+      "RemoveIncompleteStartupFile", [file = std::move(file)] {
+        auto incompleteStartup =
+            mozilla::startup::GetIncompleteStartupFile(file);
+        if (NS_WARN_IF(incompleteStartup.isErr())) {
+          return;
+        }
+        Unused << NS_WARN_IF(
+            NS_FAILED(incompleteStartup.unwrap()->Remove(false)));
+      }));
+}
+
+NS_IMETHODIMP
+nsAppStartup::TrackStartupCrashEnd() {
+  bool inSafeMode = false;
+  nsCOMPtr<nsIXULRuntime> xr = do_GetService(XULRUNTIME_SERVICE_CONTRACTID);
+  if (xr) xr->GetInSafeMode(&inSafeMode);
+
+  // return if we already ended or we're restarting into safe mode
+  if (mStartupCrashTrackingEnded || (mIsSafeModeNecessary && !inSafeMode))
+    return NS_OK;
+  mStartupCrashTrackingEnded = true;
+
+  StartupTimeline::Record(StartupTimeline::STARTUP_CRASH_DETECTION_END);
+
+  // Remove the incomplete startup canary file, so the next startup doesn't
+  // detect a recent startup crash.
+  Unused << NS_WARN_IF(NS_FAILED(RemoveIncompleteStartupFile()));
+
+  // Use the timestamp of XRE_main as an approximation for the lock file
+  // timestamp. See MAX_STARTUP_BUFFER for the buffer time period.
+  TimeStamp mainTime = StartupTimeline::Get(StartupTimeline::MAIN);
+  nsresult rv;
+
+  if (mainTime.IsNull()) {
+    NS_WARNING("Could not get StartupTimeline::MAIN time.");
+  } else {
+    uint64_t lockFileTime = ComputeAbsoluteTimestamp(mainTime);
+
+    rv = Preferences::SetInt(kPrefLastSuccess,
+                             (int32_t)(lockFileTime / PR_USEC_PER_SEC));
+
+    if (NS_FAILED(rv))
+      NS_WARNING("Could not set startup crash detection pref.");
+  }
+
+  if (inSafeMode && mIsSafeModeNecessary) {
+    // On a successful startup in automatic safe mode, allow the user one more
+    // crash in regular mode before returning to safe mode.
+    int32_t maxResumedCrashes = 0;
+    int32_t prefType;
+    rv = Preferences::GetRootBranch(PrefValueKind::Default)
+             ->GetPrefType(kPrefMaxResumedCrashes, &prefType);
+    NS_ENSURE_SUCCESS(rv, rv);
+    if (prefType == nsIPrefBranch::PREF_INT) {
+      rv = Preferences::GetInt(kPrefMaxResumedCrashes, &maxResumedCrashes);
+      NS_ENSURE_SUCCESS(rv, rv);
+    }
+    rv = Preferences::SetInt(kPrefRecentCrashes, maxResumedCrashes);
+    NS_ENSURE_SUCCESS(rv, rv);
+  } else if (!inSafeMode) {
+    // clear the count of recent crashes after a succesful startup when not in
+    // safe mode
+    rv = Preferences::ClearUser(kPrefRecentCrashes);
+    if (NS_FAILED(rv)) NS_WARNING("Could not clear startup crash count.");
+  }
+  nsCOMPtr<nsIPrefService> prefs = Preferences::GetService();
+  // save prefs to disk since we are tracking crashes.  This may be
+  // asynchronous, so a crash could sneak in that we would mistake for
+  // a start up crash. See bug 789945 and bug 1361262.
+  rv = prefs->SavePrefFile(nullptr);
+
+  return rv;
+}
+
+NS_IMETHODIMP
+nsAppStartup::RestartInSafeMode(uint32_t aQuitMode) {
+  PR_SetEnv("MOZ_SAFE_MODE_RESTART=1");
+  bool userAllowedQuit = false;
+  this->Quit(aQuitMode | nsIAppStartup::eRestart, 0, &userAllowedQuit);
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsAppStartup::CreateInstanceWithProfile(nsIToolkitProfile* aProfile) {
+  if (NS_WARN_IF(!aProfile)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  if (NS_WARN_IF(gAbsoluteArgv0Path.IsEmpty())) {
+    return NS_ERROR_FAILURE;
+  }
+
+  nsCOMPtr<nsIFile> execPath;
+  nsresult rv =
+      NS_NewLocalFile(gAbsoluteArgv0Path, true, getter_AddRefs(execPath));
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
+
+  nsCOMPtr<nsIProcess> process = do_CreateInstance(NS_PROCESS_CONTRACTID, &rv);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
+
+  rv = process->Init(execPath);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
+
+  nsAutoCString profileName;
+  rv = aProfile->GetName(profileName);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
+
+  NS_ConvertUTF8toUTF16 wideName(profileName);
+
+  const char16_t* args[] = {u"-no-remote", u"-P", wideName.get()};
+  rv = process->Runw(false, args, 3);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
+
+  return NS_OK;
+}
diff --git a/toolkit/components/startup/nsAppStartup.h b/toolkit/components/startup/nsAppStartup.h
new file mode 100644
index 0000000000..fcdb0db61e
--- /dev/null
+++ b/toolkit/components/startup/nsAppStartup.h
@@ -0,0 +1,73 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef nsAppStartup_h__
+#define nsAppStartup_h__
+
+#include "nsIAppStartup.h"
+#include "nsIWindowCreator.h"
+#include "nsIObserver.h"
+#include "nsWeakReference.h"
+
+#include "nsIAppShell.h"
+#include "mozilla/Attributes.h"
+
+#if defined(XP_WIN)
+// XPerf-backed probes
+#  include "mozilla/perfprobe.h"
+#endif  // defined(XP_WIN)
+
+// {7DD4D320-C84B-4624-8D45-7BB9B2356977}
+#define NS_TOOLKIT_APPSTARTUP_CID                    \
+  {                                                  \
+    0x7dd4d320, 0xc84b, 0x4624, {                    \
+      0x8d, 0x45, 0x7b, 0xb9, 0xb2, 0x35, 0x69, 0x77 \
+    }                                                \
+  }
+
+class nsAppStartup final : public nsIAppStartup,
+                           public nsIWindowCreator,
+                           public nsIObserver,
+                           public nsSupportsWeakReference {
+ public:
+  NS_DECL_THREADSAFE_ISUPPORTS
+  NS_DECL_NSIAPPSTARTUP
+  NS_DECL_NSIWINDOWCREATOR
+  NS_DECL_NSIOBSERVER
+
+  nsAppStartup();
+  nsresult Init();
+
+ private:
+  ~nsAppStartup() = default;
+
+  void CloseAllWindows();
+
+  friend class nsAppExitEvent;
+
+  nsCOMPtr<nsIAppShell> mAppShell;
+
+  int32_t mConsiderQuitStopper;  // if > 0, Quit(eConsiderQuit) fails
+  bool mRunning;                 // Have we started the main event loop?
+  bool mShuttingDown;            // Quit method reentrancy check
+  bool mStartingUp;              // Have we passed final-ui-startup?
+  bool mAttemptingQuit;          // Quit(eAttemptQuit) still trying
+  bool mInterrupted;  // Was startup interrupted by an interactive prompt?
+  bool mIsSafeModeNecessary;        // Whether safe mode is necessary
+  bool mStartupCrashTrackingEnded;  // Whether startup crash tracking has
+                                    // already ended
+
+#if defined(XP_WIN)
+  // Interaction with OS-provided profiling probes
+  typedef mozilla::probes::ProbeManager ProbeManager;
+  typedef mozilla::probes::Probe Probe;
+  RefPtr<ProbeManager> mProbesManager;
+  RefPtr<Probe> mPlacesInitCompleteProbe;
+  RefPtr<Probe> mSessionWindowRestoredProbe;
+  RefPtr<Probe> mXPCOMShutdownProbe;
+#endif
+};
+
+#endif  // nsAppStartup_h__
diff --git a/toolkit/components/startup/public/moz.build b/toolkit/components/startup/public/moz.build
new file mode 100644
index 0000000000..8dcc96265c
--- /dev/null
+++ b/toolkit/components/startup/public/moz.build
@@ -0,0 +1,11 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+XPIDL_SOURCES += [
+    "nsIAppStartup.idl",
+]
+
+XPIDL_MODULE = "appstartup"
diff --git a/toolkit/components/startup/public/nsIAppStartup.idl b/toolkit/components/startup/public/nsIAppStartup.idl
new file mode 100644
index 0000000000..52f318a2a5
--- /dev/null
+++ b/toolkit/components/startup/public/nsIAppStartup.idl
@@ -0,0 +1,183 @@
+/* -*- Mode: IDL; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+interface nsIToolkitProfile;
+
+[scriptable, builtinclass, uuid(6621f6d5-6c04-4a0e-9e74-447db221484e)]
+interface nsIAppStartup : nsISupports
+{
+    /**
+     * Create the hidden window.
+     */
+    void createHiddenWindow();
+
+    /**
+     * Destroys the hidden window. This will have no effect if the hidden window
+     * has not yet been created.
+     */
+    void destroyHiddenWindow();
+
+    /**
+     * Runs an application event loop: normally the main event pump which
+     * defines the lifetime of the application. If there are no windows open
+     * and no outstanding calls to enterLastWindowClosingSurvivalArea this
+     * method will exit immediately.
+     *
+     * @returnCode NS_SUCCESS_RESTART_APP
+     *             This return code indicates that the application should be
+     *             restarted because quit was called with the eRestart flag.
+     */
+    void run();
+
+    /**
+     * There are situations where all application windows will be
+     * closed but we don't want to take this as a signal to quit the
+     * app. Bracket the code where the last window could close with
+     * these.
+     */
+    void enterLastWindowClosingSurvivalArea();
+    void exitLastWindowClosingSurvivalArea();
+
+    /**
+     * Startup Crash Detection
+     *
+     * Keeps track of application startup begining and success using flags to
+     * determine whether the application is crashing on startup.
+     * When the number of crashes crosses the acceptable threshold, safe mode
+     * or other repair procedures are performed.
+     */
+
+    /**
+     * Whether automatic safe mode is necessary at this time.  This gets set
+     * in trackStartupCrashBegin.
+     *
+     * @see trackStartupCrashBegin
+     */
+    readonly attribute boolean automaticSafeModeNecessary;
+
+    /**
+     * Restart the application in safe mode
+     * @param aQuitMode
+     *        This parameter modifies how the app is shutdown.
+     * @see nsIAppStartup::quit
+     */
+    void restartInSafeMode(in uint32_t aQuitMode);
+
+    /**
+     * Run a new instance of this app with a specified profile
+     * @param aProfile
+     *        The profile we want to use.
+     * @see nsIAppStartup::quit
+     */
+    void createInstanceWithProfile(in nsIToolkitProfile aProfile);
+
+    /**
+     * If the last startup crashed then increment a counter.
+     * Set a flag so on next startup we can detect whether TrackStartupCrashEnd
+     * was called (and therefore the application crashed).
+     * @return whether safe mode is necessary
+     */
+    bool trackStartupCrashBegin();
+
+    /**
+     * We have succesfully started without crashing. Clear flags that were
+     * tracking past crashes.
+     */
+    void trackStartupCrashEnd();
+
+    /**
+     * The following flags may be passed as the aMode parameter to the quit
+     * method.  One and only one of the "Quit" flags must be specified.  The
+     * eRestart flag may be bit-wise combined with one of the "Quit" flags to
+     * cause the application to restart after it quits.
+     */
+
+    /**
+     * Attempt to quit if all windows are closed.
+     */
+    const uint32_t eConsiderQuit = 0x01;
+
+    /**
+     * Try to close all windows, then quit if successful.
+     */
+    const uint32_t eAttemptQuit = 0x02;
+
+    /**
+     * Quit, damnit!
+     */
+    const uint32_t eForceQuit = 0x03;
+
+    /**
+     * Restart the application after quitting.  The application will be
+     * restarted with the same profile and an empty command line.
+     */
+    const uint32_t eRestart = 0x10;
+
+    /**
+     * Exit the event loop, and shut down the app.
+     *
+     * @param aMode
+     *        This parameter modifies how the app is shutdown, and it is
+     *        constructed from the constants defined above.
+     * @param aExitCode
+     *        The exit code to return from the process. The precise code
+     *        returned by the process may vary depending on the platform. Only
+     *        values 0-255 should generallt be used. If not specified an exit
+     *        code of 0 will be used.
+     *
+     * @return false if the shutdown was cancelled due to the presence
+     *         of a hidden window or if the user disallowed a window
+     *         to be closed.
+     */
+    bool quit(in uint32_t aMode, [optional] in int32_t aExitCode);
+
+    /**
+     * True if the application is in the process of shutting down.
+     */
+    [infallible] readonly attribute boolean shuttingDown;
+
+    /**
+     * True if the application is in the process of starting up.
+     *
+     * Startup is complete once all observers of final-ui-startup have returned.
+     */
+    readonly attribute boolean startingUp;
+
+    /**
+     * Mark the startup as completed.
+     *
+     * Called at the end of startup by nsAppRunner.
+     */
+    [noscript] void doneStartingUp();
+
+    /**
+     * True if the application is being restarted
+     */
+    readonly attribute boolean restarting;
+
+    /**
+     * True if this is the startup following restart, i.e. if the application
+     * was restarted using quit(eRestart*).
+     */
+    readonly attribute boolean wasRestarted;
+
+    /**
+     * The number of seconds since the OS was last rebooted
+     */
+    readonly attribute int64_t secondsSinceLastOSRestart;
+
+    /**
+     * Returns an object with main, process, firstPaint, sessionRestored properties.
+     * Properties may not be available depending on platform or application
+     */
+    [implicit_jscontext] jsval getStartupInfo();
+
+    /**
+     * True if startup was interrupted by an interactive prompt.
+     */
+    attribute boolean interrupted;
+};
diff --git a/toolkit/components/startup/tests/browser/beforeunload.html b/toolkit/components/startup/tests/browser/beforeunload.html
new file mode 100644
index 0000000000..81fa1b57bc
--- /dev/null
+++ b/toolkit/components/startup/tests/browser/beforeunload.html
@@ -0,0 +1,10 @@
+<html>
+  <script>
+  window.onbeforeunload = function(event) {
+    event.returnValue = "Test beforeunload handler";
+  };
+  </script>
+  <body>
+    Test page
+  </body>
+</html>
diff --git a/toolkit/components/startup/tests/browser/browser.ini b/toolkit/components/startup/tests/browser/browser.ini
new file mode 100644
index 0000000000..2520709b05
--- /dev/null
+++ b/toolkit/components/startup/tests/browser/browser.ini
@@ -0,0 +1,10 @@
+[DEFAULT]
+support-files =
+  head.js
+  beforeunload.html
+
+[browser_bug511456.js]
+skip-if = (os == "linux" && !e10s) || (os == "linux" && bits == 64 && os_version == "18.04") # Bug 1334729, Bug 1546252;  Bug 1582549
+[browser_bug537449.js]
+[browser_crash_detection.js]
+[browser_Telemetry_timestamp_test.js]
diff --git a/toolkit/components/startup/tests/browser/browser_Telemetry_timestamp_test.js b/toolkit/components/startup/tests/browser/browser_Telemetry_timestamp_test.js
new file mode 100644
index 0000000000..f9b044dbe0
--- /dev/null
+++ b/toolkit/components/startup/tests/browser/browser_Telemetry_timestamp_test.js
@@ -0,0 +1,31 @@
+"use strict";
+
+ChromeUtils.import("resource://gre/modules/TelemetryController.jsm", this);
+ChromeUtils.import("resource://gre/modules/TelemetrySession.jsm", this);
+
+add_task(async function test() {
+  let now = Services.telemetry.msSinceProcessStart();
+  let payload = TelemetrySession.getPayload("main");
+
+  // Check the first_paint scalar.
+  ok(
+    "scalars" in payload.processes.parent,
+    "Scalars are present in the payload."
+  );
+  ok(
+    "timestamps.first_paint" in payload.processes.parent.scalars,
+    "The first_paint timestamp is present in the payload."
+  );
+  Assert.greater(
+    payload.processes.parent.scalars["timestamps.first_paint"],
+    0,
+    "first_paint scalar is greater than 0."
+  );
+  Assert.greater(now, 0, "Browser test runtime is greater than zero.");
+  // Check that the first_paint scalar is less than the current time.
+  Assert.greater(
+    now,
+    payload.processes.parent.scalars["timestamps.first_paint"],
+    "first_paint is less than total browser test runtime."
+  );
+});
diff --git a/toolkit/components/startup/tests/browser/browser_bug511456.js b/toolkit/components/startup/tests/browser/browser_bug511456.js
new file mode 100644
index 0000000000..d8b99417d0
--- /dev/null
+++ b/toolkit/components/startup/tests/browser/browser_bug511456.js
@@ -0,0 +1,58 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+const TEST_URL =
+  "http://example.com/browser/toolkit/components/startup/tests/browser/beforeunload.html";
+
+SpecialPowers.pushPrefEnv({
+  set: [["dom.require_user_interaction_for_beforeunload", false]],
+});
+
+function test() {
+  waitForExplicitFinish();
+  ignoreAllUncaughtExceptions();
+
+  // Create foreground window
+  let win2 = window.openDialog(
+    location,
+    "",
+    "chrome,all,dialog=no",
+    "about:blank"
+  );
+  win2.addEventListener(
+    "load",
+    function() {
+      // Create background test tab
+      let browser = BrowserTestUtils.addTab(gBrowser, TEST_URL).linkedBrowser;
+
+      whenBrowserLoaded(browser, function() {
+        let seenDialog = false;
+
+        // Cancel the prompt the first time.
+        waitForOnBeforeUnloadDialog(browser, (btnLeave, btnStay) => {
+          seenDialog =
+            Services.focus.activeWindow == window &&
+            gBrowser.selectedBrowser == browser;
+          btnStay.click();
+        });
+
+        Services.startup.quit(Ci.nsIAppStartup.eAttemptQuit);
+        ok(seenDialog, "Should have seen a prompt dialog");
+        ok(!win2.closed, "Shouldn't have closed the additional window");
+        win2.close();
+
+        // Leave the page the second time.
+        waitForOnBeforeUnloadDialog(browser, (btnLeave, btnStay) => {
+          btnLeave.click();
+        });
+
+        gBrowser.removeTab(gBrowser.selectedTab);
+        executeSoon(finish);
+      });
+    },
+    { once: true }
+  );
+}
diff --git a/toolkit/components/startup/tests/browser/browser_bug537449.js b/toolkit/components/startup/tests/browser/browser_bug537449.js
new file mode 100644
index 0000000000..ecadcf70a1
--- /dev/null
+++ b/toolkit/components/startup/tests/browser/browser_bug537449.js
@@ -0,0 +1,62 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+SpecialPowers.pushPrefEnv({
+  set: [["dom.require_user_interaction_for_beforeunload", false]],
+});
+
+SpecialPowers.pushPrefEnv({
+  set: [["prompts.contentPromptSubDialog", false]],
+});
+
+const TEST_URL =
+  "http://example.com/browser/toolkit/components/startup/tests/browser/beforeunload.html";
+
+function test() {
+  waitForExplicitFinish();
+
+  gBrowser.selectedTab = BrowserTestUtils.addTab(gBrowser, TEST_URL);
+  let browser = gBrowser.selectedBrowser;
+
+  whenBrowserLoaded(browser, function() {
+    let seenDialog = false;
+
+    // Cancel the prompt the first time.
+    waitForOnBeforeUnloadDialog(browser, (btnLeave, btnStay) => {
+      seenDialog = true;
+      btnStay.click();
+    });
+
+    Services.startup.quit(Ci.nsIAppStartup.eAttemptQuit);
+    ok(seenDialog, "Should have seen a prompt dialog");
+    ok(!window.closed, "Shouldn't have closed the window");
+
+    let win2 = window.openDialog(
+      location,
+      "",
+      "chrome,all,dialog=no",
+      "about:blank"
+    );
+    ok(win2 != null, "Should have been able to open a new window");
+    win2.addEventListener(
+      "load",
+      () => {
+        executeSoon(() => {
+          win2.close();
+
+          // Leave the page the second time.
+          waitForOnBeforeUnloadDialog(browser, (btnLeave, btnStay) => {
+            btnLeave.click();
+          });
+
+          gBrowser.removeTab(gBrowser.selectedTab);
+          finish();
+        });
+      },
+      { once: true }
+    );
+  });
+}
diff --git a/toolkit/components/startup/tests/browser/browser_crash_detection.js b/toolkit/components/startup/tests/browser/browser_crash_detection.js
new file mode 100644
index 0000000000..a53669452d
--- /dev/null
+++ b/toolkit/components/startup/tests/browser/browser_crash_detection.js
@@ -0,0 +1,30 @@
+/* Any copyright is dedicated to the Public Domain.
+ *    http://creativecommons.org/publicdomain/zero/1.0/
+ */
+/* eslint-disable mozilla/no-arbitrary-setTimeout */
+
+function test() {
+  function checkLastSuccess() {
+    let lastSuccess = Services.prefs.getIntPref("toolkit.startup.last_success");
+    let si = Services.startup.getStartupInfo();
+    is(
+      lastSuccess,
+      parseInt(si.main.getTime() / 1000, 10),
+      "Startup tracking pref should be set after a delay at the end of startup"
+    );
+    finish();
+  }
+
+  if (
+    Services.prefs.getPrefType("toolkit.startup.max_resumed_crashes") ==
+    Services.prefs.PREF_INVALID
+  ) {
+    info("Skipping this test since startup crash detection is disabled");
+    return;
+  }
+
+  const startupCrashEndDelay = 35 * 1000;
+  waitForExplicitFinish();
+  requestLongerTimeout(2);
+  setTimeout(checkLastSuccess, startupCrashEndDelay);
+}
diff --git a/toolkit/components/startup/tests/browser/head.js b/toolkit/components/startup/tests/browser/head.js
new file mode 100644
index 0000000000..55c4528e13
--- /dev/null
+++ b/toolkit/components/startup/tests/browser/head.js
@@ -0,0 +1,30 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+SpecialPowers.pushPrefEnv({
+  set: [["prompts.contentPromptSubDialog", false]],
+});
+
+function whenBrowserLoaded(browser, callback) {
+  return BrowserTestUtils.browserLoaded(browser).then(callback);
+}
+
+function waitForOnBeforeUnloadDialog(browser, callback) {
+  browser.addEventListener(
+    "DOMWillOpenModalDialog",
+    function onModalDialog(event) {
+      SimpleTest.waitForCondition(
+        () => Services.focus.activeWindow == browser.ownerGlobal,
+        function() {
+          let prompt = browser.tabModalPromptBox.listPrompts()[0];
+          let { button0, button1 } = prompt.ui;
+          callback(button0, button1);
+        },
+        "Waited too long for window with dialog to focus"
+      );
+    },
+    { capture: true, once: true }
+  );
+}
diff --git a/toolkit/components/startup/tests/unit/head_startup.js b/toolkit/components/startup/tests/unit/head_startup.js
new file mode 100644
index 0000000000..cb4308721b
--- /dev/null
+++ b/toolkit/components/startup/tests/unit/head_startup.js
@@ -0,0 +1,41 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+const XULRUNTIME_CONTRACTID = "@mozilla.org/xre/runtime;1";
+const XULRUNTIME_CID = Components.ID("7685dac8-3637-4660-a544-928c5ec0e714}");
+
+var { XPCOMUtils } = ChromeUtils.import(
+  "resource://gre/modules/XPCOMUtils.jsm"
+);
+
+var gAppInfo = null;
+
+function createAppInfo(ID, name, version, platformVersion = "1.0") {
+  let tmp = {};
+  ChromeUtils.import("resource://testing-common/AppInfo.jsm", tmp);
+  gAppInfo = tmp.newAppInfo({
+    ID,
+    name,
+    version,
+    platformVersion,
+    crashReporter: true,
+    replacedLockTime: 0,
+  });
+
+  let XULAppInfoFactory = {
+    createInstance(outer, iid) {
+      if (outer != null) {
+        throw Components.Exception("", Cr.NS_ERROR_NO_AGGREGATION);
+      }
+      return gAppInfo.QueryInterface(iid);
+    },
+  };
+
+  let registrar = Components.manager.QueryInterface(Ci.nsIComponentRegistrar);
+  registrar.registerFactory(
+    XULRUNTIME_CID,
+    "XULRuntime",
+    XULRUNTIME_CONTRACTID,
+    XULAppInfoFactory
+  );
+}
diff --git a/toolkit/components/startup/tests/unit/test_startup_crash.js b/toolkit/components/startup/tests/unit/test_startup_crash.js
new file mode 100644
index 0000000000..fcaac60477
--- /dev/null
+++ b/toolkit/components/startup/tests/unit/test_startup_crash.js
@@ -0,0 +1,331 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+const { Services } = ChromeUtils.import("resource://gre/modules/Services.jsm");
+
+createAppInfo("xpcshell@tests.mozilla.org", "XPCShell", "1", "10.0");
+
+var prefService = Services.prefs;
+var appStartup = Services.startup;
+
+const pref_last_success = "toolkit.startup.last_success";
+const pref_recent_crashes = "toolkit.startup.recent_crashes";
+const pref_max_resumed_crashes = "toolkit.startup.max_resumed_crashes";
+const pref_always_use_safe_mode = "toolkit.startup.always_use_safe_mode";
+
+function run_test() {
+  prefService.setBoolPref(pref_always_use_safe_mode, true);
+
+  resetTestEnv(0);
+
+  test_trackStartupCrashBegin();
+  test_trackStartupCrashEnd();
+  test_trackStartupCrashBegin_safeMode();
+  test_trackStartupCrashEnd_safeMode();
+  test_maxResumed();
+  resetTestEnv(0);
+
+  prefService.clearUserPref(pref_always_use_safe_mode);
+}
+
+// reset prefs to default
+function resetTestEnv(replacedLockTime) {
+  try {
+    // call begin to reset mStartupCrashTrackingEnded
+    appStartup.trackStartupCrashBegin();
+  } catch (x) {}
+  prefService.setIntPref(pref_max_resumed_crashes, 2);
+  prefService.clearUserPref(pref_recent_crashes);
+  gAppInfo.replacedLockTime = replacedLockTime;
+  prefService.clearUserPref(pref_last_success);
+}
+
+function now_seconds() {
+  return ms_to_s(Date.now());
+}
+
+function ms_to_s(ms) {
+  return Math.floor(ms / 1000);
+}
+
+function test_trackStartupCrashBegin() {
+  let max_resumed = prefService.getIntPref(pref_max_resumed_crashes);
+  Assert.ok(!gAppInfo.inSafeMode);
+
+  // first run with startup crash tracking - existing profile lock
+  let replacedLockTime = Date.now();
+  resetTestEnv(replacedLockTime);
+  Assert.ok(!prefService.prefHasUserValue(pref_recent_crashes));
+  Assert.ok(!prefService.prefHasUserValue(pref_last_success));
+  Assert.equal(replacedLockTime, gAppInfo.replacedLockTime);
+  try {
+    Assert.ok(!appStartup.trackStartupCrashBegin());
+    do_throw("Should have thrown since last_success is not set");
+  } catch (x) {}
+
+  Assert.ok(!prefService.prefHasUserValue(pref_last_success));
+  Assert.ok(!prefService.prefHasUserValue(pref_recent_crashes));
+  Assert.ok(!appStartup.automaticSafeModeNecessary);
+
+  // first run with startup crash tracking - no existing profile lock
+  replacedLockTime = 0;
+  resetTestEnv(replacedLockTime);
+  Assert.ok(!prefService.prefHasUserValue(pref_recent_crashes));
+  Assert.ok(!prefService.prefHasUserValue(pref_last_success));
+  Assert.equal(replacedLockTime, gAppInfo.replacedLockTime);
+  try {
+    Assert.ok(!appStartup.trackStartupCrashBegin());
+    do_throw("Should have thrown since last_success is not set");
+  } catch (x) {}
+
+  Assert.ok(!prefService.prefHasUserValue(pref_last_success));
+  Assert.ok(!prefService.prefHasUserValue(pref_recent_crashes));
+  Assert.ok(!appStartup.automaticSafeModeNecessary);
+
+  // normal startup - last startup was success
+  replacedLockTime = Date.now();
+  resetTestEnv(replacedLockTime);
+  Assert.ok(!prefService.prefHasUserValue(pref_recent_crashes));
+  prefService.setIntPref(pref_last_success, ms_to_s(replacedLockTime));
+  Assert.equal(
+    ms_to_s(replacedLockTime),
+    prefService.getIntPref(pref_last_success)
+  );
+  Assert.ok(!appStartup.trackStartupCrashBegin());
+  Assert.equal(
+    ms_to_s(replacedLockTime),
+    prefService.getIntPref(pref_last_success)
+  );
+  Assert.ok(!prefService.prefHasUserValue(pref_recent_crashes));
+  Assert.ok(!appStartup.automaticSafeModeNecessary);
+
+  // normal startup with 1 recent crash
+  resetTestEnv(replacedLockTime);
+  prefService.setIntPref(pref_recent_crashes, 1);
+  prefService.setIntPref(pref_last_success, ms_to_s(replacedLockTime));
+  Assert.ok(!appStartup.trackStartupCrashBegin());
+  Assert.equal(
+    ms_to_s(replacedLockTime),
+    prefService.getIntPref(pref_last_success)
+  );
+  Assert.equal(1, prefService.getIntPref(pref_recent_crashes));
+  Assert.ok(!appStartup.automaticSafeModeNecessary);
+
+  // normal startup with max_resumed_crashes crash
+  resetTestEnv(replacedLockTime);
+  prefService.setIntPref(pref_recent_crashes, max_resumed);
+  prefService.setIntPref(pref_last_success, ms_to_s(replacedLockTime));
+  Assert.ok(!appStartup.trackStartupCrashBegin());
+  Assert.equal(
+    ms_to_s(replacedLockTime),
+    prefService.getIntPref(pref_last_success)
+  );
+  Assert.equal(max_resumed, prefService.getIntPref(pref_recent_crashes));
+  Assert.ok(!appStartup.automaticSafeModeNecessary);
+
+  // normal startup with too many recent crashes
+  resetTestEnv(replacedLockTime);
+  prefService.setIntPref(pref_recent_crashes, max_resumed + 1);
+  prefService.setIntPref(pref_last_success, ms_to_s(replacedLockTime));
+  Assert.ok(appStartup.trackStartupCrashBegin());
+  // should remain the same since the last startup was not a crash
+  Assert.equal(max_resumed + 1, prefService.getIntPref(pref_recent_crashes));
+  Assert.ok(appStartup.automaticSafeModeNecessary);
+
+  // normal startup with too many recent crashes and startup crash tracking disabled
+  resetTestEnv(replacedLockTime);
+  prefService.setIntPref(pref_max_resumed_crashes, -1);
+  prefService.setIntPref(pref_recent_crashes, max_resumed + 1);
+  prefService.setIntPref(pref_last_success, ms_to_s(replacedLockTime));
+  Assert.ok(!appStartup.trackStartupCrashBegin());
+  // should remain the same since the last startup was not a crash
+  Assert.equal(max_resumed + 1, prefService.getIntPref(pref_recent_crashes));
+  // returns false when disabled
+  Assert.ok(!appStartup.automaticSafeModeNecessary);
+  Assert.equal(-1, prefService.getIntPref(pref_max_resumed_crashes));
+
+  // normal startup after 1 non-recent crash (1 year ago), no other recent
+  replacedLockTime = Date.now() - 365 * 24 * 60 * 60 * 1000;
+  resetTestEnv(replacedLockTime);
+  prefService.setIntPref(
+    pref_last_success,
+    ms_to_s(replacedLockTime) - 365 * 24 * 60 * 60
+  );
+  Assert.ok(!appStartup.trackStartupCrashBegin());
+  // recent crash count pref should be unset since the last crash was not recent
+  Assert.ok(!prefService.prefHasUserValue(pref_recent_crashes));
+  Assert.ok(!appStartup.automaticSafeModeNecessary);
+
+  // normal startup after 1 crash (1 minute ago), no other recent
+  replacedLockTime = Date.now() - 60 * 1000;
+  resetTestEnv(replacedLockTime);
+  prefService.setIntPref(
+    pref_last_success,
+    ms_to_s(replacedLockTime) - 60 * 60
+  ); // last success - 1 hour ago
+  Assert.ok(!appStartup.trackStartupCrashBegin());
+  // recent crash count pref should be created with value 1
+  Assert.equal(1, prefService.getIntPref(pref_recent_crashes));
+  Assert.ok(!appStartup.automaticSafeModeNecessary);
+
+  // normal startup after another crash (1 minute ago), 1 already
+  prefService.setIntPref(
+    pref_last_success,
+    ms_to_s(replacedLockTime) - 60 * 60
+  ); // last success - 1 hour ago
+  replacedLockTime = Date.now() - 60 * 1000;
+  gAppInfo.replacedLockTime = replacedLockTime;
+  Assert.ok(!appStartup.trackStartupCrashBegin());
+  // recent crash count pref should be incremented by 1
+  Assert.equal(2, prefService.getIntPref(pref_recent_crashes));
+  Assert.ok(!appStartup.automaticSafeModeNecessary);
+
+  // normal startup after another crash (1 minute ago), 2 already
+  prefService.setIntPref(
+    pref_last_success,
+    ms_to_s(replacedLockTime) - 60 * 60
+  ); // last success - 1 hour ago
+  Assert.ok(appStartup.trackStartupCrashBegin());
+  // recent crash count pref should be incremented by 1
+  Assert.equal(3, prefService.getIntPref(pref_recent_crashes));
+  Assert.ok(appStartup.automaticSafeModeNecessary);
+
+  // normal startup after 1 non-recent crash (1 year ago), 3 crashes already
+  replacedLockTime = Date.now() - 365 * 24 * 60 * 60 * 1000;
+  resetTestEnv(replacedLockTime);
+  prefService.setIntPref(
+    pref_last_success,
+    ms_to_s(replacedLockTime) - 60 * 60
+  ); // last success - 1 hour ago
+  Assert.ok(!appStartup.trackStartupCrashBegin());
+  // recent crash count should be unset since the last crash was not recent
+  Assert.ok(!prefService.prefHasUserValue(pref_recent_crashes));
+  Assert.ok(!appStartup.automaticSafeModeNecessary);
+}
+
+function test_trackStartupCrashEnd() {
+  // successful startup with no last_success (upgrade test)
+  let replacedLockTime = Date.now() - 10 * 1000; // 10s ago
+  resetTestEnv(replacedLockTime);
+  try {
+    appStartup.trackStartupCrashBegin(); // required to be called before end
+    do_throw("Should have thrown since last_success is not set");
+  } catch (x) {}
+  appStartup.trackStartupCrashEnd();
+  Assert.ok(!prefService.prefHasUserValue(pref_recent_crashes));
+  Assert.ok(!prefService.prefHasUserValue(pref_last_success));
+
+  // successful startup - should set last_success
+  replacedLockTime = Date.now() - 10 * 1000; // 10s ago
+  resetTestEnv(replacedLockTime);
+  prefService.setIntPref(pref_last_success, ms_to_s(replacedLockTime));
+  appStartup.trackStartupCrashBegin(); // required to be called before end
+  appStartup.trackStartupCrashEnd();
+  // ensure last_success was set since we have declared a succesful startup
+  // main timestamp doesn't get set in XPCShell so approximate with now
+  Assert.ok(prefService.getIntPref(pref_last_success) <= now_seconds());
+  Assert.ok(
+    prefService.getIntPref(pref_last_success) >= now_seconds() - 4 * 60 * 60
+  );
+  Assert.ok(!prefService.prefHasUserValue(pref_recent_crashes));
+
+  // successful startup with 1 recent crash
+  resetTestEnv(replacedLockTime);
+  prefService.setIntPref(pref_last_success, ms_to_s(replacedLockTime));
+  prefService.setIntPref(pref_recent_crashes, 1);
+  appStartup.trackStartupCrashBegin(); // required to be called before end
+  appStartup.trackStartupCrashEnd();
+  // ensure recent_crashes was cleared since we have declared a succesful startup
+  Assert.ok(!prefService.prefHasUserValue(pref_recent_crashes));
+}
+
+function test_trackStartupCrashBegin_safeMode() {
+  gAppInfo.inSafeMode = true;
+  resetTestEnv(0);
+  let max_resumed = prefService.getIntPref(pref_max_resumed_crashes);
+
+  // check manual safe mode doesn't change prefs without crash
+  let replacedLockTime = Date.now() - 10 * 1000; // 10s ago
+  resetTestEnv(replacedLockTime);
+  prefService.setIntPref(pref_last_success, ms_to_s(replacedLockTime));
+
+  Assert.ok(!prefService.prefHasUserValue(pref_recent_crashes));
+  Assert.ok(prefService.prefHasUserValue(pref_last_success));
+  Assert.ok(!appStartup.automaticSafeModeNecessary);
+  Assert.ok(!appStartup.trackStartupCrashBegin());
+  Assert.ok(!prefService.prefHasUserValue(pref_recent_crashes));
+  Assert.ok(prefService.prefHasUserValue(pref_last_success));
+  Assert.ok(!appStartup.automaticSafeModeNecessary);
+
+  // check forced safe mode doesn't change prefs without crash
+  replacedLockTime = Date.now() - 10 * 1000; // 10s ago
+  resetTestEnv(replacedLockTime);
+  prefService.setIntPref(pref_last_success, ms_to_s(replacedLockTime));
+  prefService.setIntPref(pref_recent_crashes, max_resumed + 1);
+
+  Assert.equal(max_resumed + 1, prefService.getIntPref(pref_recent_crashes));
+  Assert.ok(prefService.prefHasUserValue(pref_last_success));
+  Assert.ok(!appStartup.automaticSafeModeNecessary);
+  Assert.ok(appStartup.trackStartupCrashBegin());
+  Assert.equal(max_resumed + 1, prefService.getIntPref(pref_recent_crashes));
+  Assert.ok(prefService.prefHasUserValue(pref_last_success));
+  Assert.ok(appStartup.automaticSafeModeNecessary);
+
+  // check forced safe mode after old crash
+  replacedLockTime = Date.now() - 365 * 24 * 60 * 60 * 1000;
+  resetTestEnv(replacedLockTime);
+  // one year ago
+  let last_success = ms_to_s(replacedLockTime) - 365 * 24 * 60 * 60;
+  prefService.setIntPref(pref_last_success, last_success);
+  prefService.setIntPref(pref_recent_crashes, max_resumed + 1);
+  Assert.equal(max_resumed + 1, prefService.getIntPref(pref_recent_crashes));
+  Assert.ok(prefService.prefHasUserValue(pref_last_success));
+  Assert.ok(appStartup.automaticSafeModeNecessary);
+  Assert.ok(appStartup.trackStartupCrashBegin());
+  Assert.equal(max_resumed + 1, prefService.getIntPref(pref_recent_crashes));
+  Assert.equal(last_success, prefService.getIntPref(pref_last_success));
+  Assert.ok(appStartup.automaticSafeModeNecessary);
+}
+
+function test_trackStartupCrashEnd_safeMode() {
+  gAppInfo.inSafeMode = true;
+  let replacedLockTime = Date.now();
+  resetTestEnv(replacedLockTime);
+  let max_resumed = prefService.getIntPref(pref_max_resumed_crashes);
+  prefService.setIntPref(
+    pref_last_success,
+    ms_to_s(replacedLockTime) - 24 * 60 * 60
+  );
+
+  // ensure recent_crashes were not cleared in manual safe mode
+  prefService.setIntPref(pref_recent_crashes, 1);
+  appStartup.trackStartupCrashBegin(); // required to be called before end
+  appStartup.trackStartupCrashEnd();
+  Assert.equal(1, prefService.getIntPref(pref_recent_crashes));
+
+  // recent_crashes should be set to max_resumed in forced safe mode to allow the user
+  // to try and start in regular mode after making changes.
+  prefService.setIntPref(pref_recent_crashes, max_resumed + 1);
+  appStartup.trackStartupCrashBegin(); // required to be called before end
+  appStartup.trackStartupCrashEnd();
+  Assert.equal(max_resumed, prefService.getIntPref(pref_recent_crashes));
+}
+
+function test_maxResumed() {
+  resetTestEnv(0);
+  gAppInfo.inSafeMode = false;
+  let max_resumed = prefService.getIntPref(pref_max_resumed_crashes);
+  let replacedLockTime = Date.now();
+  resetTestEnv(replacedLockTime);
+  prefService.setIntPref(pref_max_resumed_crashes, -1);
+
+  prefService.setIntPref(pref_recent_crashes, max_resumed + 1);
+  prefService.setIntPref(
+    pref_last_success,
+    ms_to_s(replacedLockTime) - 24 * 60 * 60
+  );
+  appStartup.trackStartupCrashBegin();
+  // should remain the same since the last startup was not a crash
+  Assert.equal(max_resumed + 2, prefService.getIntPref(pref_recent_crashes));
+  Assert.ok(!appStartup.automaticSafeModeNecessary);
+}
diff --git a/toolkit/components/startup/tests/unit/xpcshell.ini b/toolkit/components/startup/tests/unit/xpcshell.ini
new file mode 100644
index 0000000000..809f9f3f6a
--- /dev/null
+++ b/toolkit/components/startup/tests/unit/xpcshell.ini
@@ -0,0 +1,5 @@
+[DEFAULT]
+head = head_startup.js
+skip-if = toolkit == 'android'
+
+[test_startup_crash.js]