Adding upstream version 125.0.1.upstream/125.0.1

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

82 files changed, 361 insertions, 366 deletions

diff --git a/dom/html/ElementInternals.cpp b/dom/html/ElementInternals.cpp
index aaf58f818e..9a19744603 100644
--- a/dom/html/ElementInternals.cpp
+++ b/dom/html/ElementInternals.cpp
@@ -22,6 +22,10 @@
 #include "nsDebug.h"
 #include "nsGenericHTMLElement.h"
 
+#ifdef ACCESSIBILITY
+#  include "nsAccessibilityService.h"
+#endif
+
 namespace mozilla::dom {
 
 NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE_CLASS(ElementInternals)
@@ -482,4 +486,44 @@ void ElementInternals::InitializeControlNumber() {
   mControlNumber = mTarget->OwnerDoc()->GetNextControlNumber();
 }
 
+void ElementInternals::SetAttrElement(nsAtom* aAttr, Element* aElement) {
+  // Accessibility requires that no other attribute changes occur between
+  // AttrElementWillChange and AttrElementChanged. Scripts could cause
+  // this, so don't let them run here. We do this even if accessibility isn't
+  // running so that the JS behavior is consistent regardless of accessibility.
+  // Otherwise, JS might be able to use this difference to determine whether
+  // accessibility is running, which would be a privacy concern.
+  nsAutoScriptBlocker scriptBlocker;
+
+#ifdef ACCESSIBILITY
+  // If the target has this attribute defined then it overrides the defaults
+  // defined here in the Internals instance. In that case we don't need to
+  // notify the change to a11y since the attribute hasn't changed, just the
+  // underlying default. We can set accService to null and not notify.
+  nsAccessibilityService* accService =
+      !mTarget->HasAttr(aAttr) ? GetAccService() : nullptr;
+  if (accService) {
+    accService->NotifyAttrElementWillChange(mTarget, aAttr);
+  }
+#endif
+
+  if (aElement) {
+    mAttrElements.InsertOrUpdate(aAttr, do_GetWeakReference(aElement));
+  } else {
+    mAttrElements.Remove(aAttr);
+  }
+
+#ifdef ACCESSIBILITY
+  if (accService) {
+    accService->NotifyAttrElementChanged(mTarget, aAttr);
+  }
+#endif
+}
+
+Element* ElementInternals::GetAttrElement(nsAtom* aAttr) const {
+  nsWeakPtr weakAttrEl = mAttrElements.Get(aAttr);
+  nsCOMPtr<Element> attrEl = do_QueryReferent(weakAttrEl);
+  return attrEl;
+}
+
 }  // namespace mozilla::dom
diff --git a/dom/html/ElementInternals.h b/dom/html/ElementInternals.h
index 7ced3b9771..4bbf5c96f3 100644
--- a/dom/html/ElementInternals.h
+++ b/dom/html/ElementInternals.h
@@ -27,6 +27,13 @@
     aResult = ErrorResult(SetAttr(nsGkAtoms::attr, aValue));        \
   }
 
+#define ARIA_REFLECT_ATTR_ELEMENT(method, attr)                            \
+  Element* Get##method() const { return GetAttrElement(nsGkAtoms::attr); } \
+                                                                           \
+  void Set##method(Element* aElement) {                                    \
+    SetAttrElement(nsGkAtoms::attr, aElement);                             \
+  }
+
 class nsINodeList;
 class nsGenericHTMLElement;
 
@@ -119,9 +126,12 @@ class ElementInternals final : public nsIFormControl,
   ARIA_REFLECT_ATTR(Role, role)
 
   // AriaAttributes
+  ARIA_REFLECT_ATTR_ELEMENT(AriaActiveDescendantElement, aria_activedescendant)
   ARIA_REFLECT_ATTR(AriaAtomic, aria_atomic)
   ARIA_REFLECT_ATTR(AriaAutoComplete, aria_autocomplete)
   ARIA_REFLECT_ATTR(AriaBusy, aria_busy)
+  ARIA_REFLECT_ATTR(AriaBrailleLabel, aria_braillelabel)
+  ARIA_REFLECT_ATTR(AriaBrailleRoleDescription, aria_brailleroledescription)
   ARIA_REFLECT_ATTR(AriaChecked, aria_checked)
   ARIA_REFLECT_ATTR(AriaColCount, aria_colcount)
   ARIA_REFLECT_ATTR(AriaColIndex, aria_colindex)
@@ -172,6 +182,18 @@ class ElementInternals final : public nsIFormControl,
  private:
   ~ElementInternals() = default;
 
+  /**
+   * Gets the attribute element for the given attribute.
+   * https://html.spec.whatwg.org/multipage/common-dom-interfaces.html#explicitly-set-attr-element
+   */
+  Element* GetAttrElement(nsAtom* aAttr) const;
+
+  /**
+   * Sets an attribute element for the given attribute.
+   * https://html.spec.whatwg.org/multipage/common-dom-interfaces.html#explicitly-set-attr-element
+   */
+  void SetAttrElement(nsAtom* aAttr, Element* aElement);
+
   // It's a target element which is a custom element.
   RefPtr<HTMLElement> mTarget;
 
@@ -211,6 +233,12 @@ class ElementInternals final : public nsIFormControl,
   // owner document. This is only set to a number for elements inserted into the
   // document by the parser from the network. Otherwise, it is -1.
   int32_t mControlNumber;
+
+  /**
+   * Explicitly set attr-elements, see
+   * https://html.spec.whatwg.org/multipage/common-dom-interfaces.html#explicitly-set-attr-element
+   */
+  nsTHashMap<RefPtr<nsAtom>, nsWeakPtr> mAttrElements;
 };
 
 }  // namespace mozilla::dom
diff --git a/dom/html/FetchPriority.h b/dom/html/FetchPriority.h
index 5719577771..525f0ffb17 100644
--- a/dom/html/FetchPriority.h
+++ b/dom/html/FetchPriority.h
@@ -21,6 +21,17 @@ enum class FetchPriority : uint8_t { High, Low, Auto };
 
 FetchPriority ToFetchPriority(RequestPriority aRequestPriority);
 
+#define FETCH_PRIORITY_ADJUSTMENT_FOR(feature, fetchPriority)                  \
+  (fetchPriority == FetchPriority::Auto                                        \
+       ? StaticPrefs::network_fetchpriority_adjustments_##feature##_auto()     \
+       : (fetchPriority == FetchPriority::High                                 \
+              ? StaticPrefs::                                                  \
+                    network_fetchpriority_adjustments_##feature##_high()       \
+              : (fetchPriority == FetchPriority::Low                           \
+                     ? StaticPrefs::                                           \
+                           network_fetchpriority_adjustments_##feature##_low() \
+                     : 0)))
+
 // @param aSupportsPriority see <nsISupportsPriority.idl>.
 void LogPriorityMapping(LazyLogModule& aLazyLogModule,
                         FetchPriority aFetchPriority,
diff --git a/dom/html/HTMLAnchorElement.cpp b/dom/html/HTMLAnchorElement.cpp
index a5d958139e..fffe8d9545 100644
--- a/dom/html/HTMLAnchorElement.cpp
+++ b/dom/html/HTMLAnchorElement.cpp
@@ -75,14 +75,14 @@ nsresult HTMLAnchorElement::BindToTree(BindContext& aContext,
   return rv;
 }
 
-void HTMLAnchorElement::UnbindFromTree(bool aNullParent) {
+void HTMLAnchorElement::UnbindFromTree(UnbindContext& aContext) {
   // Cancel any DNS prefetches
   // Note: Must come before ResetLinkState.  If called after, it will recreate
   // mCachedURI based on data that is invalid - due to a call to Link::GetURI()
   // via GetURIForDNSPrefetch().
   CancelDNSPrefetch(*this);
 
-  nsGenericHTMLElement::UnbindFromTree(aNullParent);
+  nsGenericHTMLElement::UnbindFromTree(aContext);
 
   // Without removing the link state we risk a dangling pointer in the
   // mStyledLinks hashtable
diff --git a/dom/html/HTMLAnchorElement.h b/dom/html/HTMLAnchorElement.h
index 2a524b96c2..4d89c6a75b 100644
--- a/dom/html/HTMLAnchorElement.h
+++ b/dom/html/HTMLAnchorElement.h
@@ -47,7 +47,7 @@ class HTMLAnchorElement final : public nsGenericHTMLElement,
   NS_DECL_ADDSIZEOFEXCLUDINGTHIS
 
   nsresult BindToTree(BindContext&, nsINode& aParent) override;
-  void UnbindFromTree(bool aNullParent = true) override;
+  void UnbindFromTree(UnbindContext&) override;
   bool IsHTMLFocusable(bool aWithMouse, bool* aIsFocusable,
                        int32_t* aTabIndex) override;
 
diff --git a/dom/html/HTMLAreaElement.cpp b/dom/html/HTMLAreaElement.cpp
index 81389a4d14..e07150cc06 100644
--- a/dom/html/HTMLAreaElement.cpp
+++ b/dom/html/HTMLAreaElement.cpp
@@ -72,8 +72,8 @@ nsresult HTMLAreaElement::BindToTree(BindContext& aContext, nsINode& aParent) {
   return rv;
 }
 
-void HTMLAreaElement::UnbindFromTree(bool aNullParent) {
-  nsGenericHTMLElement::UnbindFromTree(aNullParent);
+void HTMLAreaElement::UnbindFromTree(UnbindContext& aContext) {
+  nsGenericHTMLElement::UnbindFromTree(aContext);
   // Without removing the link state we risk a dangling pointer in the
   // mStyledLinks hashtable
   Link::UnbindFromTree();
diff --git a/dom/html/HTMLAreaElement.h b/dom/html/HTMLAreaElement.h
index 3cba9dd833..3effb1a87e 100644
--- a/dom/html/HTMLAreaElement.h
+++ b/dom/html/HTMLAreaElement.h
@@ -43,7 +43,7 @@ class HTMLAreaElement final : public nsGenericHTMLElement, public Link {
   already_AddRefed<nsIURI> GetHrefURI() const override;
 
   virtual nsresult BindToTree(BindContext&, nsINode& aParent) override;
-  virtual void UnbindFromTree(bool aNullParent = true) override;
+  virtual void UnbindFromTree(UnbindContext&) override;
 
   virtual nsresult Clone(dom::NodeInfo*, nsINode** aResult) const override;
 
diff --git a/dom/html/HTMLButtonElement.cpp b/dom/html/HTMLButtonElement.cpp
index 7aa7428a26..0d9cc921ad 100644
--- a/dom/html/HTMLButtonElement.cpp
+++ b/dom/html/HTMLButtonElement.cpp
@@ -308,8 +308,8 @@ nsresult HTMLButtonElement::BindToTree(BindContext& aContext,
   return NS_OK;
 }
 
-void HTMLButtonElement::UnbindFromTree(bool aNullParent) {
-  nsGenericHTMLFormControlElementWithState::UnbindFromTree(aNullParent);
+void HTMLButtonElement::UnbindFromTree(UnbindContext& aContext) {
+  nsGenericHTMLFormControlElementWithState::UnbindFromTree(aContext);
 
   UpdateBarredFromConstraintValidation();
   UpdateValidityElementStates(false);
diff --git a/dom/html/HTMLButtonElement.h b/dom/html/HTMLButtonElement.h
index 57bc51c05c..b1a5c53f64 100644
--- a/dom/html/HTMLButtonElement.h
+++ b/dom/html/HTMLButtonElement.h
@@ -65,7 +65,7 @@ class HTMLButtonElement final : public nsGenericHTMLFormControlElementWithState,
 
   // nsIContent
   nsresult BindToTree(BindContext&, nsINode& aParent) override;
-  void UnbindFromTree(bool aNullParent = true) override;
+  void UnbindFromTree(UnbindContext&) override;
   void DoneCreatingElement() override;
 
   void UpdateBarredFromConstraintValidation();
diff --git a/dom/html/HTMLDetailsElement.cpp b/dom/html/HTMLDetailsElement.cpp
index c8e9c11c4f..afb0087e20 100644
--- a/dom/html/HTMLDetailsElement.cpp
+++ b/dom/html/HTMLDetailsElement.cpp
@@ -114,8 +114,9 @@ void HTMLDetailsElement::SetupShadowTree() {
     }
 
     nsAutoString defaultSummaryText;
-    nsContentUtils::GetLocalizedString(nsContentUtils::eFORMS_PROPERTIES,
-                                       "DefaultSummary", defaultSummaryText);
+    nsContentUtils::GetMaybeLocalizedString(nsContentUtils::eFORMS_PROPERTIES,
+                                            "DefaultSummary", OwnerDoc(),
+                                            defaultSummaryText);
     RefPtr<nsTextNode> description = new (nim) nsTextNode(nim);
     description->SetText(defaultSummaryText, kNotify);
     summary->AppendChildTo(description, kNotify, IgnoreErrors());
diff --git a/dom/html/HTMLDialogElement.cpp b/dom/html/HTMLDialogElement.cpp
index 6d4bda0392..cd36201182 100644
--- a/dom/html/HTMLDialogElement.cpp
+++ b/dom/html/HTMLDialogElement.cpp
@@ -106,9 +106,9 @@ void HTMLDialogElement::StorePreviouslyFocusedElement() {
   }
 }
 
-void HTMLDialogElement::UnbindFromTree(bool aNullParent) {
+void HTMLDialogElement::UnbindFromTree(UnbindContext& aContext) {
   RemoveFromTopLayerIfNeeded();
-  nsGenericHTMLElement::UnbindFromTree(aNullParent);
+  nsGenericHTMLElement::UnbindFromTree(aContext);
 }
 
 void HTMLDialogElement::ShowModal(ErrorResult& aError) {
diff --git a/dom/html/HTMLDialogElement.h b/dom/html/HTMLDialogElement.h
index 556e86b891..72c1a6c743 100644
--- a/dom/html/HTMLDialogElement.h
+++ b/dom/html/HTMLDialogElement.h
@@ -35,7 +35,7 @@ class HTMLDialogElement final : public nsGenericHTMLElement {
     mReturnValue = aReturnValue;
   }
 
-  void UnbindFromTree(bool aNullParent = true) override;
+  void UnbindFromTree(UnbindContext&) override;
 
   void Close(const mozilla::dom::Optional<nsAString>& aReturnValue);
   MOZ_CAN_RUN_SCRIPT void Show(ErrorResult& aError);
diff --git a/dom/html/HTMLElement.cpp b/dom/html/HTMLElement.cpp
index ff9c786c55..bccb117034 100644
--- a/dom/html/HTMLElement.cpp
+++ b/dom/html/HTMLElement.cpp
@@ -77,8 +77,8 @@ nsresult HTMLElement::BindToTree(BindContext& aContext, nsINode& aParent) {
   return rv;
 }
 
-void HTMLElement::UnbindFromTree(bool aNullParent) {
-  nsGenericHTMLFormElement::UnbindFromTree(aNullParent);
+void HTMLElement::UnbindFromTree(UnbindContext& aContext) {
+  nsGenericHTMLFormElement::UnbindFromTree(aContext);
 
   UpdateBarredFromConstraintValidation();
   UpdateValidityElementStates(false);
diff --git a/dom/html/HTMLElement.h b/dom/html/HTMLElement.h
index 8fbbc6f2b9..727e6ab487 100644
--- a/dom/html/HTMLElement.h
+++ b/dom/html/HTMLElement.h
@@ -30,7 +30,7 @@ class HTMLElement final : public nsGenericHTMLFormElement {
 
   // nsIContent
   nsresult BindToTree(BindContext&, nsINode& aParent) override;
-  void UnbindFromTree(bool aNullParent = true) override;
+  void UnbindFromTree(UnbindContext&) override;
   void DoneCreatingElement() override;
 
   // Element
diff --git a/dom/html/HTMLEmbedElement.cpp b/dom/html/HTMLEmbedElement.cpp
index 34d79defbf..39582063a7 100644
--- a/dom/html/HTMLEmbedElement.cpp
+++ b/dom/html/HTMLEmbedElement.cpp
@@ -65,9 +65,9 @@ nsresult HTMLEmbedElement::BindToTree(BindContext& aContext, nsINode& aParent) {
   return NS_OK;
 }
 
-void HTMLEmbedElement::UnbindFromTree(bool aNullParent) {
-  nsObjectLoadingContent::UnbindFromTree(aNullParent);
-  nsGenericHTMLElement::UnbindFromTree(aNullParent);
+void HTMLEmbedElement::UnbindFromTree(UnbindContext& aContext) {
+  nsObjectLoadingContent::UnbindFromTree();
+  nsGenericHTMLElement::UnbindFromTree(aContext);
 }
 
 void HTMLEmbedElement::AfterSetAttr(int32_t aNamespaceID, nsAtom* aName,
diff --git a/dom/html/HTMLEmbedElement.h b/dom/html/HTMLEmbedElement.h
index 0cb82c0baa..8e7bcd4166 100644
--- a/dom/html/HTMLEmbedElement.h
+++ b/dom/html/HTMLEmbedElement.h
@@ -36,7 +36,7 @@ class HTMLEmbedElement final : public nsGenericHTMLElement,
   const Element* AsElement() const final { return this; }
 
   nsresult BindToTree(BindContext&, nsINode& aParent) override;
-  void UnbindFromTree(bool aNullParent = true) override;
+  void UnbindFromTree(UnbindContext&) override;
 
   bool IsHTMLFocusable(bool aWithMouse, bool* aIsFocusable,
                        int32_t* aTabIndex) override;
diff --git a/dom/html/HTMLFormElement.cpp b/dom/html/HTMLFormElement.cpp
index 46f2c2a735..7796c4b1f4 100644
--- a/dom/html/HTMLFormElement.cpp
+++ b/dom/html/HTMLFormElement.cpp
@@ -209,22 +209,16 @@ void HTMLFormElement::GetMethod(nsAString& aValue) {
   GetEnumAttr(nsGkAtoms::method, kFormDefaultMethod->tag, aValue);
 }
 
-void HTMLFormElement::ReportInvalidUnfocusableElements() {
+void HTMLFormElement::ReportInvalidUnfocusableElements(
+    const nsTArray<RefPtr<Element>>&& aInvalidElements) {
   RefPtr<nsFocusManager> focusManager = nsFocusManager::GetFocusManager();
   MOZ_ASSERT(focusManager);
 
-  // This shouldn't be called recursively, so use a rather large value
-  // for the preallocated buffer.
-  AutoTArray<RefPtr<nsGenericHTMLFormElement>, 100> sortedControls;
-  if (NS_FAILED(mControls->GetSortedControls(sortedControls))) {
-    return;
-  }
-
-  for (auto& _e : sortedControls) {
-    // MOZ_CAN_RUN_SCRIPT requires explicit copy, Bug 1620312
-    RefPtr<nsGenericHTMLFormElement> element = _e;
+  for (const auto& element : aInvalidElements) {
     bool isFocusable = false;
-    focusManager->ElementIsFocusable(element, 0, &isFocusable);
+    // MOZ_KnownLive because 'aInvalidElements' is guaranteed to keep it alive.
+    // This can go away once bug 1620312 is fixed.
+    focusManager->ElementIsFocusable(MOZ_KnownLive(element), 0, &isFocusable);
     if (!isFocusable) {
       nsTArray<nsString> params;
       nsAutoCString messageName("InvalidFormControlUnfocusable");
@@ -291,7 +285,6 @@ void HTMLFormElement::MaybeSubmit(Element* aSubmitter) {
       HasAttr(nsGkAtoms::novalidate) ||
       (aSubmitter && aSubmitter->HasAttr(nsGkAtoms::formnovalidate));
   if (!noValidateState && !CheckValidFormSubmission()) {
-    ReportInvalidUnfocusableElements();
     return;
   }
 
@@ -494,7 +487,7 @@ static void CollectOrphans(nsINode* aRemovalRoot,
   }
 }
 
-void HTMLFormElement::UnbindFromTree(bool aNullParent) {
+void HTMLFormElement::UnbindFromTree(UnbindContext& aContext) {
   MaybeFireFormRemoved();
 
   // Note, this is explicitly using uncomposed doc, since we count
@@ -506,7 +499,7 @@ void HTMLFormElement::UnbindFromTree(bool aNullParent) {
   MarkOrphans(mControls->mNotInElements.AsList());
   MarkOrphans(mImageElements.AsList());
 
-  nsGenericHTMLElement::UnbindFromTree(aNullParent);
+  nsGenericHTMLElement::UnbindFromTree(aContext);
 
   nsINode* ancestor = this;
   nsINode* cur;
@@ -1759,7 +1752,8 @@ bool HTMLFormElement::CheckValidFormSubmission() {
   /**
    * Check for form validity: do not submit a form if there are unhandled
    * invalid controls in the form.
-   * This should not be done if the form has been submitted with .submit().
+   * This should not be done if the form has been submitted with .submit() or
+   * has been submitted and novalidate/formnovalidate is used.
    *
    * NOTE: for the moment, we are also checking that whether the MozInvalidForm
    * event gets prevented default so it will prevent blocking form submission if
@@ -1770,9 +1764,6 @@ bool HTMLFormElement::CheckValidFormSubmission() {
    * submitted when invalid. See bug 587671.
    */
 
-  NS_ASSERTION(!HasAttr(nsGkAtoms::novalidate),
-               "We shouldn't be there if novalidate is set!");
-
   AutoTArray<RefPtr<Element>, 32> invalidElements;
   if (CheckFormValidity(&invalidElements)) {
     return true;
@@ -1797,6 +1788,8 @@ bool HTMLFormElement::CheckValidFormSubmission() {
 
   DispatchEvent(*event);
 
+  ReportInvalidUnfocusableElements(std::move(invalidElements));
+
   return !event->DefaultPrevented();
 }
 
diff --git a/dom/html/HTMLFormElement.h b/dom/html/HTMLFormElement.h
index 68dd627554..263f665843 100644
--- a/dom/html/HTMLFormElement.h
+++ b/dom/html/HTMLFormElement.h
@@ -70,7 +70,7 @@ class HTMLFormElement final : public nsGenericHTMLElement {
   nsresult PostHandleEvent(EventChainPostVisitor& aVisitor) override;
 
   nsresult BindToTree(BindContext&, nsINode& aParent) override;
-  void UnbindFromTree(bool aNullParent = true) override;
+  void UnbindFromTree(UnbindContext&) override;
   void BeforeSetAttr(int32_t aNamespaceID, nsAtom* aName,
                      const nsAttrValue* aValue, bool aNotify) override;
 
@@ -212,11 +212,11 @@ class HTMLFormElement final : public nsGenericHTMLElement {
    *
    * @return Whether the form is valid.
    *
-   * @note Do not call this method if novalidate/formnovalidate is used.
    * @note This method might disappear with bug 592124, hopefuly.
    * @see
    * https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#interactively-validate-the-constraints
    */
+  MOZ_CAN_RUN_SCRIPT
   bool CheckValidFormSubmission();
 
   /**
@@ -330,6 +330,7 @@ class HTMLFormElement final : public nsGenericHTMLElement {
 
   bool CheckValidity() { return CheckFormValidity(nullptr); }
 
+  MOZ_CAN_RUN_SCRIPT
   bool ReportValidity() { return CheckValidFormSubmission(); }
 
   Element* IndexedGetter(uint32_t aIndex, bool& aFound);
@@ -584,7 +585,8 @@ class HTMLFormElement final : public nsGenericHTMLElement {
   void MaybeFireFormRemoved();
 
   MOZ_CAN_RUN_SCRIPT
-  void ReportInvalidUnfocusableElements();
+  void ReportInvalidUnfocusableElements(
+      const nsTArray<RefPtr<Element>>&& aInvalidElements);
 
   ~HTMLFormElement();
 };
diff --git a/dom/html/HTMLIFrameElement.h b/dom/html/HTMLIFrameElement.h
index 8a87c02472..3124e493b5 100644
--- a/dom/html/HTMLIFrameElement.h
+++ b/dom/html/HTMLIFrameElement.h
@@ -142,11 +142,6 @@ class HTMLIFrameElement final : public nsGenericHTMLFrameElement {
   Document* GetSVGDocument(nsIPrincipal& aSubjectPrincipal) {
     return GetContentDocument(aSubjectPrincipal);
   }
-  bool Mozbrowser() const { return GetBoolAttr(nsGkAtoms::mozbrowser); }
-  void SetMozbrowser(bool aAllow, ErrorResult& aError) {
-    SetHTMLBoolAttr(nsGkAtoms::mozbrowser, aAllow, aError);
-  }
-  using nsGenericHTMLFrameElement::SetMozbrowser;
   // nsGenericHTMLFrameElement::GetFrameLoader is fine
   // nsGenericHTMLFrameElement::GetAppManifestURL is fine
 
diff --git a/dom/html/HTMLImageElement.cpp b/dom/html/HTMLImageElement.cpp
index 1aa23cdea8..691216d152 100644
--- a/dom/html/HTMLImageElement.cpp
+++ b/dom/html/HTMLImageElement.cpp
@@ -10,19 +10,17 @@
 #include "mozilla/dom/BindingUtils.h"
 #include "mozilla/dom/HTMLImageElementBinding.h"
 #include "mozilla/dom/NameSpaceConstants.h"
+#include "mozilla/dom/UnbindContext.h"
 #include "nsGenericHTMLElement.h"
 #include "nsGkAtoms.h"
-#include "nsStyleConsts.h"
 #include "nsPresContext.h"
 #include "nsSize.h"
 #include "mozilla/dom/Document.h"
 #include "nsImageFrame.h"
-#include "nsIScriptContext.h"
 #include "nsContentUtils.h"
 #include "nsContainerFrame.h"
 #include "nsNodeInfoManager.h"
 #include "mozilla/MouseEvents.h"
-#include "nsContentPolicyUtils.h"
 #include "nsFocusManager.h"
 #include "mozilla/dom/DOMIntersectionObserver.h"
 #include "mozilla/dom/HTMLFormElement.h"
@@ -30,7 +28,6 @@
 #include "mozilla/dom/UserActivation.h"
 #include "nsAttrValueOrString.h"
 #include "imgLoader.h"
-#include "Image.h"
 
 // Responsive images!
 #include "mozilla/dom/HTMLSourceElement.h"
@@ -223,6 +220,10 @@ bool HTMLImageElement::ParseAttribute(int32_t aNamespaceID, nsAtom* aAttribute,
     if (aAttribute == nsGkAtoms::loading) {
       return ParseLoadingAttribute(aValue, aResult);
     }
+    if (aAttribute == nsGkAtoms::fetchpriority) {
+      ParseFetchPriority(aValue, aResult);
+      return true;
+    }
     if (ParseImageAttribute(aAttribute, aValue, aResult)) {
       return true;
     }
@@ -564,9 +565,9 @@ nsresult HTMLImageElement::BindToTree(BindContext& aContext, nsINode& aParent) {
   return rv;
 }
 
-void HTMLImageElement::UnbindFromTree(bool aNullParent) {
+void HTMLImageElement::UnbindFromTree(UnbindContext& aContext) {
   if (mForm) {
-    if (aNullParent || !FindAncestorForm(mForm)) {
+    if (aContext.IsUnbindRoot(this) || !FindAncestorForm(mForm)) {
       ClearForm(true);
     } else {
       UnsetFlags(MAYBE_ORPHAN_FORM_ELEMENT);
@@ -578,8 +579,8 @@ void HTMLImageElement::UnbindFromTree(bool aNullParent) {
     mInDocResponsiveContent = false;
   }
 
-  nsImageLoadingContent::UnbindFromTree(aNullParent);
-  nsGenericHTMLElement::UnbindFromTree(aNullParent);
+  nsImageLoadingContent::UnbindFromTree();
+  nsGenericHTMLElement::UnbindFromTree(aContext);
 }
 
 void HTMLImageElement::UpdateFormOwner() {
@@ -1377,4 +1378,8 @@ void HTMLImageElement::QueueImageLoadTask(bool aAlwaysLoad) {
   CycleCollectedJSContext::Get()->DispatchToMicroTask(task.forget());
 }
 
+FetchPriority HTMLImageElement::GetFetchPriorityForImage() const {
+  return nsGenericHTMLElement::GetFetchPriority();
+}
+
 }  // namespace mozilla::dom
diff --git a/dom/html/HTMLImageElement.h b/dom/html/HTMLImageElement.h
index 8e10c6867e..bf41c68d40 100644
--- a/dom/html/HTMLImageElement.h
+++ b/dom/html/HTMLImageElement.h
@@ -74,7 +74,7 @@ class HTMLImageElement final : public nsGenericHTMLElement,
                        int32_t* aTabIndex) override;
 
   nsresult BindToTree(BindContext&, nsINode& aParent) override;
-  void UnbindFromTree(bool aNullParent) override;
+  void UnbindFromTree(UnbindContext&) override;
 
   nsresult Clone(dom::NodeInfo*, nsINode** aResult) const override;
 
@@ -263,6 +263,8 @@ class HTMLImageElement final : public nsGenericHTMLElement,
   // element.
   const StyleLockedDeclarationBlock* GetMappedAttributesFromSource() const;
 
+  FetchPriority GetFetchPriorityForImage() const override;
+
  protected:
   virtual ~HTMLImageElement();
 
diff --git a/dom/html/HTMLInputElement.cpp b/dom/html/HTMLInputElement.cpp
index 4e7241ec7a..d5a65a1755 100644
--- a/dom/html/HTMLInputElement.cpp
+++ b/dom/html/HTMLInputElement.cpp
@@ -49,7 +49,6 @@
 #include "nsSearchControlFrame.h"
 #include "nsPIDOMWindow.h"
 #include "nsRepeatService.h"
-#include "nsContentCID.h"
 #include "mozilla/dom/ProgressEvent.h"
 #include "nsGkAtoms.h"
 #include "nsStyleConsts.h"
@@ -779,8 +778,8 @@ nsresult HTMLInputElement::InitFilePicker(FilePickerType aType) {
   // Get parent nsPIDOMWindow object.
   nsCOMPtr<Document> doc = OwnerDoc();
 
-  nsCOMPtr<nsPIDOMWindowOuter> win = doc->GetWindow();
-  if (!win) {
+  RefPtr<BrowsingContext> bc = doc->GetBrowsingContext();
+  if (!bc) {
     return NS_ERROR_FAILURE;
   }
 
@@ -793,15 +792,14 @@ nsresult HTMLInputElement::InitFilePicker(FilePickerType aType) {
   nsAutoString okButtonLabel;
   if (aType == FILE_PICKER_DIRECTORY) {
     nsContentUtils::GetMaybeLocalizedString(nsContentUtils::eFORMS_PROPERTIES,
-                                            "DirectoryUpload", OwnerDoc(),
-                                            title);
+                                            "DirectoryUpload", doc, title);
 
     nsContentUtils::GetMaybeLocalizedString(nsContentUtils::eFORMS_PROPERTIES,
-                                            "DirectoryPickerOkButtonLabel",
-                                            OwnerDoc(), okButtonLabel);
+                                            "DirectoryPickerOkButtonLabel", doc,
+                                            okButtonLabel);
   } else {
     nsContentUtils::GetMaybeLocalizedString(nsContentUtils::eFORMS_PROPERTIES,
-                                            "FileUpload", OwnerDoc(), title);
+                                            "FileUpload", doc, title);
   }
 
   nsCOMPtr<nsIFilePicker> filePicker =
@@ -818,8 +816,7 @@ nsresult HTMLInputElement::InitFilePicker(FilePickerType aType) {
     mode = nsIFilePicker::modeOpen;
   }
 
-  nsresult rv =
-      filePicker->Init(win, title, mode, OwnerDoc()->GetBrowsingContext());
+  nsresult rv = filePicker->Init(bc, title, mode);
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (!okButtonLabel.IsEmpty()) {
@@ -4447,7 +4444,7 @@ void HTMLInputElement::MaybeDispatchLoginManagerEvents(HTMLFormElement* aForm) {
   dispatcher->PostDOMEvent();
 }
 
-void HTMLInputElement::UnbindFromTree(bool aNullParent) {
+void HTMLInputElement::UnbindFromTree(UnbindContext& aContext) {
   if (mType == FormControlType::InputPassword) {
     MaybeFireInputPasswordRemoved();
   }
@@ -4465,8 +4462,8 @@ void HTMLInputElement::UnbindFromTree(bool aNullParent) {
     NotifyUAWidgetTeardown();
   }
 
-  nsImageLoadingContent::UnbindFromTree(aNullParent);
-  nsGenericHTMLFormControlElementWithState::UnbindFromTree(aNullParent);
+  nsImageLoadingContent::UnbindFromTree();
+  nsGenericHTMLFormControlElementWithState::UnbindFromTree(aContext);
 
   // If we are contained within a disconnected subtree, attempt to add
   // ourselves to the subtree root's radio group.
@@ -6483,7 +6480,8 @@ bool HTMLInputElement::IsHTMLFocusable(bool aWithMouse, bool* aIsFocusable,
   }
 
   // Current radio button is not selected.
-  // But make it tabbable if nothing in group is selected.
+  // Make it tabbable if nothing in group is selected and it is the first radio
+  // button.
   auto* container = GetCurrentRadioGroupContainer();
   if (!container) {
     *aIsFocusable = defaultFocusable;
@@ -6493,7 +6491,8 @@ bool HTMLInputElement::IsHTMLFocusable(bool aWithMouse, bool* aIsFocusable,
   nsAutoString name;
   GetAttr(nsGkAtoms::name, name);
 
-  if (container->GetCurrentRadioButton(name)) {
+  if (container->GetCurrentRadioButton(name) ||
+      container->GetFirstRadioButton(name) != this) {
     *aTabIndex = -1;
   }
   *aIsFocusable = defaultFocusable;
diff --git a/dom/html/HTMLInputElement.h b/dom/html/HTMLInputElement.h
index 8805ce762b..2c90aa83fe 100644
--- a/dom/html/HTMLInputElement.h
+++ b/dom/html/HTMLInputElement.h
@@ -213,7 +213,7 @@ class HTMLInputElement final : public TextControlElement,
                                    SnapToTickMarks = SnapToTickMarks::No);
 
   nsresult BindToTree(BindContext&, nsINode& aParent) override;
-  void UnbindFromTree(bool aNullParent = true) override;
+  void UnbindFromTree(UnbindContext&) override;
 
   MOZ_CAN_RUN_SCRIPT_BOUNDARY
   void DoneCreatingElement() override;
diff --git a/dom/html/HTMLLegendElement.cpp b/dom/html/HTMLLegendElement.cpp
index 2f110dd6ce..6cc079c4e7 100644
--- a/dom/html/HTMLLegendElement.cpp
+++ b/dom/html/HTMLLegendElement.cpp
@@ -62,8 +62,8 @@ nsresult HTMLLegendElement::BindToTree(BindContext& aContext,
   return nsGenericHTMLElement::BindToTree(aContext, aParent);
 }
 
-void HTMLLegendElement::UnbindFromTree(bool aNullParent) {
-  nsGenericHTMLElement::UnbindFromTree(aNullParent);
+void HTMLLegendElement::UnbindFromTree(UnbindContext& aContext) {
+  nsGenericHTMLElement::UnbindFromTree(aContext);
 }
 
 void HTMLLegendElement::Focus(const FocusOptions& aOptions,
diff --git a/dom/html/HTMLLegendElement.h b/dom/html/HTMLLegendElement.h
index cccab9239b..2b0c8581df 100644
--- a/dom/html/HTMLLegendElement.h
+++ b/dom/html/HTMLLegendElement.h
@@ -31,7 +31,7 @@ class HTMLLegendElement final : public nsGenericHTMLElement {
 
   // nsIContent
   virtual nsresult BindToTree(BindContext&, nsINode& aParent) override;
-  virtual void UnbindFromTree(bool aNullParent = true) override;
+  virtual void UnbindFromTree(UnbindContext&) override;
   virtual bool ParseAttribute(int32_t aNamespaceID, nsAtom* aAttribute,
                               const nsAString& aValue,
                               nsIPrincipal* aMaybeScriptedPrincipal,
diff --git a/dom/html/HTMLLinkElement.cpp b/dom/html/HTMLLinkElement.cpp
index 53c2d86d8d..cb316a6f7b 100644
--- a/dom/html/HTMLLinkElement.cpp
+++ b/dom/html/HTMLLinkElement.cpp
@@ -110,7 +110,7 @@ void HTMLLinkElement::LinkAdded() {
   CreateAndDispatchEvent(u"DOMLinkAdded"_ns);
 }
 
-void HTMLLinkElement::UnbindFromTree(bool aNullParent) {
+void HTMLLinkElement::UnbindFromTree(UnbindContext& aContext) {
   CancelDNSPrefetch(*this);
   CancelPrefetchOrPreload();
 
@@ -130,7 +130,7 @@ void HTMLLinkElement::UnbindFromTree(bool aNullParent) {
     }
   }
 
-  nsGenericHTMLElement::UnbindFromTree(aNullParent);
+  nsGenericHTMLElement::UnbindFromTree(aContext);
 
   Unused << UpdateStyleSheetInternal(oldDoc, oldShadowRoot);
 }
@@ -164,6 +164,12 @@ bool HTMLLinkElement::ParseAttribute(int32_t aNamespaceID, nsAtom* aAttribute,
       ParseFetchPriority(aValue, aResult);
       return true;
     }
+
+    if (aAttribute == nsGkAtoms::blocking &&
+        StaticPrefs::dom_element_blocking_enabled()) {
+      aResult.ParseAtomArray(aValue);
+      return true;
+    }
   }
 
   return nsGenericHTMLElement::ParseAttribute(aNamespaceID, aAttribute, aValue,
@@ -703,4 +709,14 @@ nsDOMTokenList* HTMLLinkElement::Blocking() {
   return mBlocking;
 }
 
+bool HTMLLinkElement::IsPotentiallyRenderBlocking() {
+  return BlockingContainsRender();
+
+  // TODO: handle implicitly potentially render blocking
+  // https://html.spec.whatwg.org/#implicitly-potentially-render-blocking
+  // The default type for resources given by the stylesheet keyword is text/css.
+  // A link element of this type is implicitly potentially render-blocking if
+  // the element was created by its node document's parser.
+}
+
 }  // namespace mozilla::dom
diff --git a/dom/html/HTMLLinkElement.h b/dom/html/HTMLLinkElement.h
index 26683aae7b..4381aeea85 100644
--- a/dom/html/HTMLLinkElement.h
+++ b/dom/html/HTMLLinkElement.h
@@ -48,7 +48,7 @@ class HTMLLinkElement final : public nsGenericHTMLElement,
 
   // nsIContent
   nsresult BindToTree(BindContext&, nsINode& aParent) override;
-  void UnbindFromTree(bool aNullParent = true) override;
+  void UnbindFromTree(UnbindContext&) override;
   void BeforeSetAttr(int32_t aNameSpaceID, nsAtom* aName,
                      const nsAttrValue* aValue, bool aNotify) override;
   void AfterSetAttr(int32_t aNameSpaceID, nsAtom* aName,
@@ -167,6 +167,7 @@ class HTMLLinkElement final : public nsGenericHTMLElement,
   }
 
   nsDOMTokenList* Blocking();
+  bool IsPotentiallyRenderBlocking() override;
 
   void NodeInfoChanged(Document* aOldDoc) final {
     mCachedURI = nullptr;
diff --git a/dom/html/HTMLMarqueeElement.cpp b/dom/html/HTMLMarqueeElement.cpp
index 61308bf03e..9719f83ea3 100644
--- a/dom/html/HTMLMarqueeElement.cpp
+++ b/dom/html/HTMLMarqueeElement.cpp
@@ -56,14 +56,14 @@ nsresult HTMLMarqueeElement::BindToTree(BindContext& aContext,
   return rv;
 }
 
-void HTMLMarqueeElement::UnbindFromTree(bool aNullParent) {
+void HTMLMarqueeElement::UnbindFromTree(UnbindContext& aContext) {
   if (IsInComposedDoc()) {
     // We don't want to unattach the shadow root because it used to
     // contain a <slot>.
     NotifyUAWidgetTeardown(UnattachShadowRoot::No);
   }
 
-  nsGenericHTMLElement::UnbindFromTree(aNullParent);
+  nsGenericHTMLElement::UnbindFromTree(aContext);
 }
 
 void HTMLMarqueeElement::GetBehavior(nsAString& aValue) {
diff --git a/dom/html/HTMLMarqueeElement.h b/dom/html/HTMLMarqueeElement.h
index 250d7c2cf9..f93f6b4944 100644
--- a/dom/html/HTMLMarqueeElement.h
+++ b/dom/html/HTMLMarqueeElement.h
@@ -19,7 +19,7 @@ class HTMLMarqueeElement final : public nsGenericHTMLElement {
   NS_IMPL_FROMNODE_HTML_WITH_TAG(HTMLMarqueeElement, marquee);
 
   nsresult BindToTree(BindContext&, nsINode& aParent) override;
-  void UnbindFromTree(bool aNullParent = true) override;
+  void UnbindFromTree(UnbindContext&) override;
 
   static const int kDefaultLoop = -1;
   static const int kDefaultScrollAmount = 6;
diff --git a/dom/html/HTMLMediaElement.cpp b/dom/html/HTMLMediaElement.cpp
index 78e9a7b861..4ea52ccdf6 100644
--- a/dom/html/HTMLMediaElement.cpp
+++ b/dom/html/HTMLMediaElement.cpp
@@ -51,6 +51,7 @@
 #include "base/basictypes.h"
 #include "jsapi.h"
 #include "js/PropertyAndElement.h"  // JS_DefineProperty
+#include "mozilla/AppShutdown.h"
 #include "mozilla/ArrayUtils.h"
 #include "mozilla/AsyncEventDispatcher.h"
 #include "mozilla/EMEUtils.h"
@@ -4891,14 +4892,14 @@ nsresult HTMLMediaElement::BindToTree(BindContext& aContext, nsINode& aParent) {
   return rv;
 }
 
-void HTMLMediaElement::UnbindFromTree(bool aNullParent) {
+void HTMLMediaElement::UnbindFromTree(UnbindContext& aContext) {
   mVisibilityState = Visibility::Untracked;
 
   if (IsInComposedDoc()) {
     NotifyUAWidgetTeardown();
   }
 
-  nsGenericHTMLElement::UnbindFromTree(aNullParent);
+  nsGenericHTMLElement::UnbindFromTree(aContext);
 
   MOZ_ASSERT(IsActuallyInvisible());
   NotifyDecoderActivityChanges();
diff --git a/dom/html/HTMLMediaElement.h b/dom/html/HTMLMediaElement.h
index 0d35fcc85c..eef276b43d 100644
--- a/dom/html/HTMLMediaElement.h
+++ b/dom/html/HTMLMediaElement.h
@@ -202,7 +202,7 @@ class HTMLMediaElement : public nsGenericHTMLElement,
                               nsAttrValue& aResult) override;
 
   virtual nsresult BindToTree(BindContext&, nsINode& aParent) override;
-  virtual void UnbindFromTree(bool aNullParent = true) override;
+  virtual void UnbindFromTree(UnbindContext&) override;
   virtual void DoneCreatingElement() override;
 
   virtual bool IsHTMLFocusable(bool aWithMouse, bool* aIsFocusable,
diff --git a/dom/html/HTMLMetaElement.cpp b/dom/html/HTMLMetaElement.cpp
index b99ffabdaf..01c7e1e824 100644
--- a/dom/html/HTMLMetaElement.cpp
+++ b/dom/html/HTMLMetaElement.cpp
@@ -119,14 +119,14 @@ nsresult HTMLMetaElement::BindToTree(BindContext& aContext, nsINode& aParent) {
   return rv;
 }
 
-void HTMLMetaElement::UnbindFromTree(bool aNullParent) {
+void HTMLMetaElement::UnbindFromTree(UnbindContext& aContext) {
   if (Document* oldDoc = GetUncomposedDoc()) {
     if (const nsAttrValue* name = GetParsedAttr(nsGkAtoms::name)) {
       MetaRemoved(*oldDoc, *name, ChangeKind::TreeChange);
     }
     CreateAndDispatchEvent(*oldDoc, u"DOMMetaRemoved"_ns);
   }
-  nsGenericHTMLElement::UnbindFromTree(aNullParent);
+  nsGenericHTMLElement::UnbindFromTree(aContext);
 }
 
 void HTMLMetaElement::CreateAndDispatchEvent(Document&,
diff --git a/dom/html/HTMLMetaElement.h b/dom/html/HTMLMetaElement.h
index e492b49e8b..04069fa3a3 100644
--- a/dom/html/HTMLMetaElement.h
+++ b/dom/html/HTMLMetaElement.h
@@ -21,7 +21,7 @@ class HTMLMetaElement final : public nsGenericHTMLElement {
   NS_INLINE_DECL_REFCOUNTING_INHERITED(HTMLMetaElement, nsGenericHTMLElement)
 
   nsresult BindToTree(BindContext&, nsINode& aParent) override;
-  void UnbindFromTree(bool aNullParent = true) override;
+  void UnbindFromTree(UnbindContext&) override;
 
   void AfterSetAttr(int32_t aNameSpaceID, nsAtom* aName,
                     const nsAttrValue* aValue, const nsAttrValue* aOldValue,
diff --git a/dom/html/HTMLObjectElement.cpp b/dom/html/HTMLObjectElement.cpp
index f8e5d99963..f77a1f3ba2 100644
--- a/dom/html/HTMLObjectElement.cpp
+++ b/dom/html/HTMLObjectElement.cpp
@@ -89,9 +89,9 @@ nsresult HTMLObjectElement::BindToTree(BindContext& aContext,
   return NS_OK;
 }
 
-void HTMLObjectElement::UnbindFromTree(bool aNullParent) {
-  nsObjectLoadingContent::UnbindFromTree(aNullParent);
-  nsGenericHTMLFormControlElement::UnbindFromTree(aNullParent);
+void HTMLObjectElement::UnbindFromTree(UnbindContext& aContext) {
+  nsObjectLoadingContent::UnbindFromTree();
+  nsGenericHTMLFormControlElement::UnbindFromTree(aContext);
 }
 
 void HTMLObjectElement::AfterSetAttr(int32_t aNamespaceID, nsAtom* aName,
diff --git a/dom/html/HTMLObjectElement.h b/dom/html/HTMLObjectElement.h
index c627511b5c..00bcbc70d5 100644
--- a/dom/html/HTMLObjectElement.h
+++ b/dom/html/HTMLObjectElement.h
@@ -40,7 +40,7 @@ class HTMLObjectElement final : public nsGenericHTMLFormControlElement,
   bool IsInteractiveHTMLContent() const override;
 
   nsresult BindToTree(BindContext&, nsINode& aParent) override;
-  void UnbindFromTree(bool aNullParent = true) override;
+  void UnbindFromTree(UnbindContext&) override;
 
   bool IsHTMLFocusable(bool aWithMouse, bool* aIsFocusable,
                        int32_t* aTabIndex) override;
diff --git a/dom/html/HTMLOptionElement.cpp b/dom/html/HTMLOptionElement.cpp
index 733e15c609..5a9762de89 100644
--- a/dom/html/HTMLOptionElement.cpp
+++ b/dom/html/HTMLOptionElement.cpp
@@ -247,8 +247,8 @@ nsresult HTMLOptionElement::BindToTree(BindContext& aContext,
   return NS_OK;
 }
 
-void HTMLOptionElement::UnbindFromTree(bool aNullParent) {
-  nsGenericHTMLElement::UnbindFromTree(aNullParent);
+void HTMLOptionElement::UnbindFromTree(UnbindContext& aContext) {
+  nsGenericHTMLElement::UnbindFromTree(aContext);
 
   // Our previous parent could have been involved in :disabled/:enabled state.
   UpdateDisabledState(false);
diff --git a/dom/html/HTMLOptionElement.h b/dom/html/HTMLOptionElement.h
index 4d8e920a52..7c9569e87d 100644
--- a/dom/html/HTMLOptionElement.h
+++ b/dom/html/HTMLOptionElement.h
@@ -62,7 +62,7 @@ class HTMLOptionElement final : public nsGenericHTMLElement {
   void UpdateDisabledState(bool aNotify);
 
   nsresult BindToTree(BindContext&, nsINode& aParent) override;
-  void UnbindFromTree(bool aNullParent = true) override;
+  void UnbindFromTree(UnbindContext&) override;
 
   nsresult Clone(dom::NodeInfo*, nsINode** aResult) const override;
 
diff --git a/dom/html/HTMLScriptElement.cpp b/dom/html/HTMLScriptElement.cpp
index 006bff23a7..9fbf46699d 100644
--- a/dom/html/HTMLScriptElement.cpp
+++ b/dom/html/HTMLScriptElement.cpp
@@ -88,6 +88,12 @@ bool HTMLScriptElement::ParseAttribute(int32_t aNamespaceID, nsAtom* aAttribute,
       ParseFetchPriority(aValue, aResult);
       return true;
     }
+
+    if (aAttribute == nsGkAtoms::blocking &&
+        StaticPrefs::dom_element_blocking_enabled()) {
+      aResult.ParseAtomArray(aValue);
+      return true;
+    }
   }
 
   return nsGenericHTMLElement::ParseAttribute(aNamespaceID, aAttribute, aValue,
@@ -251,4 +257,14 @@ nsDOMTokenList* HTMLScriptElement::Blocking() {
   return mBlocking;
 }
 
+bool HTMLScriptElement::IsPotentiallyRenderBlocking() {
+  return BlockingContainsRender();
+
+  // TODO: handle implicitly potentially render blocking
+  // https://html.spec.whatwg.org/#implicitly-potentially-render-blocking
+  // A script element el is implicitly potentially render-blocking if el's type
+  // is "classic", el is parser-inserted, and el does not have an async or defer
+  // attribute.
+}
+
 }  // namespace mozilla::dom
diff --git a/dom/html/HTMLScriptElement.h b/dom/html/HTMLScriptElement.h
index db09e247bc..c5e99c9e5d 100644
--- a/dom/html/HTMLScriptElement.h
+++ b/dom/html/HTMLScriptElement.h
@@ -138,6 +138,7 @@ class HTMLScriptElement final : public nsGenericHTMLElement,
   }
 
   nsDOMTokenList* Blocking();
+  bool IsPotentiallyRenderBlocking() override;
 
   // Required for the webidl-binding because `GetFetchPriority` is overloaded.
   using nsGenericHTMLElement::GetFetchPriority;
diff --git a/dom/html/HTMLSelectElement.cpp b/dom/html/HTMLSelectElement.cpp
index 18bf2b79b2..6ca4209cd9 100644
--- a/dom/html/HTMLSelectElement.cpp
+++ b/dom/html/HTMLSelectElement.cpp
@@ -1089,8 +1089,8 @@ nsresult HTMLSelectElement::BindToTree(BindContext& aContext,
   return rv;
 }
 
-void HTMLSelectElement::UnbindFromTree(bool aNullParent) {
-  nsGenericHTMLFormControlElementWithState::UnbindFromTree(aNullParent);
+void HTMLSelectElement::UnbindFromTree(UnbindContext& aContext) {
+  nsGenericHTMLFormControlElementWithState::UnbindFromTree(aContext);
 
   // We might be no longer disabled because our parent chain changed.
   // XXXbz is this still needed now that fieldset changes always call
diff --git a/dom/html/HTMLSelectElement.h b/dom/html/HTMLSelectElement.h
index 223da65c31..1ba5dc29f6 100644
--- a/dom/html/HTMLSelectElement.h
+++ b/dom/html/HTMLSelectElement.h
@@ -270,7 +270,7 @@ class HTMLSelectElement final : public nsGenericHTMLFormControlElementWithState,
    * Called when an attribute is about to be changed
    */
   nsresult BindToTree(BindContext&, nsINode& aParent) override;
-  void UnbindFromTree(bool aNullParent) override;
+  void UnbindFromTree(UnbindContext&) override;
   void BeforeSetAttr(int32_t aNameSpaceID, nsAtom* aName,
                      const nsAttrValue* aValue, bool aNotify) override;
   void AfterSetAttr(int32_t aNameSpaceID, nsAtom* aName,
diff --git a/dom/html/HTMLSharedElement.cpp b/dom/html/HTMLSharedElement.cpp
index b18f5e3339..85849f9f79 100644
--- a/dom/html/HTMLSharedElement.cpp
+++ b/dom/html/HTMLSharedElement.cpp
@@ -181,10 +181,10 @@ nsresult HTMLSharedElement::BindToTree(BindContext& aContext,
   return NS_OK;
 }
 
-void HTMLSharedElement::UnbindFromTree(bool aNullParent) {
+void HTMLSharedElement::UnbindFromTree(UnbindContext& aContext) {
   Document* doc = GetUncomposedDoc();
 
-  nsGenericHTMLElement::UnbindFromTree(aNullParent);
+  nsGenericHTMLElement::UnbindFromTree(aContext);
 
   // If we're removing a <base> from a document, we may need to update the
   // document's base URI and base target
diff --git a/dom/html/HTMLSharedElement.h b/dom/html/HTMLSharedElement.h
index cb1e5ff288..8e9e15648e 100644
--- a/dom/html/HTMLSharedElement.h
+++ b/dom/html/HTMLSharedElement.h
@@ -32,7 +32,7 @@ class HTMLSharedElement final : public nsGenericHTMLElement {
 
   nsresult BindToTree(BindContext&, nsINode& aParent) override;
 
-  void UnbindFromTree(bool aNullParent = true) override;
+  void UnbindFromTree(UnbindContext&) override;
 
   nsresult Clone(dom::NodeInfo*, nsINode** aResult) const override;
 
diff --git a/dom/html/HTMLSlotElement.cpp b/dom/html/HTMLSlotElement.cpp
index 9fb3986e93..18d65c2c8a 100644
--- a/dom/html/HTMLSlotElement.cpp
+++ b/dom/html/HTMLSlotElement.cpp
@@ -64,10 +64,10 @@ nsresult HTMLSlotElement::BindToTree(BindContext& aContext, nsINode& aParent) {
   return NS_OK;
 }
 
-void HTMLSlotElement::UnbindFromTree(bool aNullParent) {
+void HTMLSlotElement::UnbindFromTree(UnbindContext& aContext) {
   RefPtr<ShadowRoot> oldContainingShadow = GetContainingShadow();
 
-  nsGenericHTMLElement::UnbindFromTree(aNullParent);
+  nsGenericHTMLElement::UnbindFromTree(aContext);
 
   if (oldContainingShadow && !GetContainingShadow()) {
     oldContainingShadow->RemoveSlot(this);
diff --git a/dom/html/HTMLSlotElement.h b/dom/html/HTMLSlotElement.h
index fa12f0df26..1659ca9683 100644
--- a/dom/html/HTMLSlotElement.h
+++ b/dom/html/HTMLSlotElement.h
@@ -26,7 +26,7 @@ class HTMLSlotElement final : public nsGenericHTMLElement {
 
   // nsIContent
   nsresult BindToTree(BindContext&, nsINode& aParent) override;
-  void UnbindFromTree(bool aNullParent) override;
+  void UnbindFromTree(UnbindContext&) override;
 
   void BeforeSetAttr(int32_t aNameSpaceID, nsAtom* aName,
                      const nsAttrValue* aValue, bool aNotify) override;
diff --git a/dom/html/HTMLSourceElement.cpp b/dom/html/HTMLSourceElement.cpp
index b08d449594..1bff67274e 100644
--- a/dom/html/HTMLSourceElement.cpp
+++ b/dom/html/HTMLSourceElement.cpp
@@ -166,9 +166,9 @@ nsresult HTMLSourceElement::BindToTree(BindContext& aContext,
   return NS_OK;
 }
 
-void HTMLSourceElement::UnbindFromTree(bool aNullParent) {
+void HTMLSourceElement::UnbindFromTree(UnbindContext& aContext) {
   mMappedAttributesForImage = nullptr;
-  nsGenericHTMLElement::UnbindFromTree(aNullParent);
+  nsGenericHTMLElement::UnbindFromTree(aContext);
 }
 
 JSObject* HTMLSourceElement::WrapNode(JSContext* aCx,
diff --git a/dom/html/HTMLSourceElement.h b/dom/html/HTMLSourceElement.h
index 4d4a1b212d..91914fb781 100644
--- a/dom/html/HTMLSourceElement.h
+++ b/dom/html/HTMLSourceElement.h
@@ -35,7 +35,7 @@ class HTMLSourceElement final : public nsGenericHTMLElement {
   // child source element.
   nsresult BindToTree(BindContext&, nsINode& aParent) override;
 
-  void UnbindFromTree(bool aNullParent) override;
+  void UnbindFromTree(UnbindContext&) override;
 
   // If this element's media attr matches for its owner document.  Returns true
   // if no media attr was set.
diff --git a/dom/html/HTMLStyleElement.cpp b/dom/html/HTMLStyleElement.cpp
index ed4c141897..e0bc228011 100644
--- a/dom/html/HTMLStyleElement.cpp
+++ b/dom/html/HTMLStyleElement.cpp
@@ -91,15 +91,29 @@ nsresult HTMLStyleElement::BindToTree(BindContext& aContext, nsINode& aParent) {
   return rv;
 }
 
-void HTMLStyleElement::UnbindFromTree(bool aNullParent) {
+void HTMLStyleElement::UnbindFromTree(UnbindContext& aContext) {
   RefPtr<Document> oldDoc = GetUncomposedDoc();
   ShadowRoot* oldShadow = GetContainingShadow();
 
-  nsGenericHTMLElement::UnbindFromTree(aNullParent);
+  nsGenericHTMLElement::UnbindFromTree(aContext);
 
   Unused << UpdateStyleSheetInternal(oldDoc, oldShadow);
 }
 
+bool HTMLStyleElement::ParseAttribute(int32_t aNamespaceID, nsAtom* aAttribute,
+                                      const nsAString& aValue,
+                                      nsIPrincipal* aMaybeScriptedPrincipal,
+                                      nsAttrValue& aResult) {
+  if (aNamespaceID == kNameSpaceID_None && aAttribute == nsGkAtoms::blocking &&
+      StaticPrefs::dom_element_blocking_enabled()) {
+    aResult.ParseAtomArray(aValue);
+    return true;
+  }
+
+  return nsGenericHTMLElement::ParseAttribute(aNamespaceID, aAttribute, aValue,
+                                              aMaybeScriptedPrincipal, aResult);
+}
+
 void HTMLStyleElement::AfterSetAttr(int32_t aNameSpaceID, nsAtom* aName,
                                     const nsAttrValue* aValue,
                                     const nsAttrValue* aOldValue,
@@ -199,4 +213,13 @@ nsDOMTokenList* HTMLStyleElement::Blocking() {
   return mBlocking;
 }
 
+bool HTMLStyleElement::IsPotentiallyRenderBlocking() {
+  return BlockingContainsRender();
+
+  // TODO: handle implicitly potentially render blocking
+  // https://html.spec.whatwg.org/#implicitly-potentially-render-blocking
+  // A style element is implicitly potentially render-blocking if the element
+  // was created by its node document's parser.
+}
+
 }  // namespace mozilla::dom
diff --git a/dom/html/HTMLStyleElement.h b/dom/html/HTMLStyleElement.h
index 5815740ac5..8f637dc60d 100644
--- a/dom/html/HTMLStyleElement.h
+++ b/dom/html/HTMLStyleElement.h
@@ -47,7 +47,11 @@ class HTMLStyleElement final : public nsGenericHTMLElement,
   void SetDevtoolsAsTriggeringPrincipal();
 
   virtual nsresult BindToTree(BindContext&, nsINode& aParent) override;
-  virtual void UnbindFromTree(bool aNullParent = true) override;
+  virtual void UnbindFromTree(UnbindContext&) override;
+  bool ParseAttribute(int32_t aNamespaceID, nsAtom* aAttribute,
+                      const nsAString& aValue,
+                      nsIPrincipal* aMaybeScriptedPrincipal,
+                      nsAttrValue& aResult) override;
   virtual void AfterSetAttr(int32_t aNameSpaceID, nsAtom* aName,
                             const nsAttrValue* aValue,
                             const nsAttrValue* aOldValue,
@@ -74,6 +78,7 @@ class HTMLStyleElement final : public nsGenericHTMLElement,
   }
 
   nsDOMTokenList* Blocking();
+  bool IsPotentiallyRenderBlocking() override;
 
   virtual JSObject* WrapNode(JSContext* aCx,
                              JS::Handle<JSObject*> aGivenProto) override;
diff --git a/dom/html/HTMLTableElement.cpp b/dom/html/HTMLTableElement.cpp
index 97329dcef1..08944ea180 100644
--- a/dom/html/HTMLTableElement.cpp
+++ b/dom/html/HTMLTableElement.cpp
@@ -961,9 +961,9 @@ nsresult HTMLTableElement::BindToTree(BindContext& aContext, nsINode& aParent) {
   return NS_OK;
 }
 
-void HTMLTableElement::UnbindFromTree(bool aNullParent) {
+void HTMLTableElement::UnbindFromTree(UnbindContext& aContext) {
   ReleaseInheritedAttributes();
-  nsGenericHTMLElement::UnbindFromTree(aNullParent);
+  nsGenericHTMLElement::UnbindFromTree(aContext);
 }
 
 void HTMLTableElement::BeforeSetAttr(int32_t aNameSpaceID, nsAtom* aName,
diff --git a/dom/html/HTMLTableElement.h b/dom/html/HTMLTableElement.h
index 38d3e24a83..9c9d59084c 100644
--- a/dom/html/HTMLTableElement.h
+++ b/dom/html/HTMLTableElement.h
@@ -156,7 +156,7 @@ class HTMLTableElement final : public nsGenericHTMLElement {
   nsresult Clone(dom::NodeInfo*, nsINode** aResult) const override;
 
   nsresult BindToTree(BindContext&, nsINode& aParent) override;
-  void UnbindFromTree(bool aNullParent = true) override;
+  void UnbindFromTree(UnbindContext&) override;
   /**
    * Called when an attribute is about to be changed
    */
diff --git a/dom/html/HTMLTemplateElement.h b/dom/html/HTMLTemplateElement.h
index be643d215b..f54967868b 100644
--- a/dom/html/HTMLTemplateElement.h
+++ b/dom/html/HTMLTemplateElement.h
@@ -51,12 +51,18 @@ class HTMLTemplateElement final : public nsGenericHTMLElement {
     SetHTMLAttr(nsGkAtoms::shadowrootmode, aValue);
   }
 
-  bool ShadowRootDelegatesFocus() {
+  bool ShadowRootDelegatesFocus() const {
     return GetBoolAttr(nsGkAtoms::shadowrootdelegatesfocus);
   }
-  void SetShadowRootDelegatesFocus(bool aValue) {
-    SetHTMLBoolAttr(nsGkAtoms::shadowrootdelegatesfocus, aValue,
-                    IgnoredErrorResult());
+  void SetShadowRootDelegatesFocus(bool aValue, ErrorResult& aRv) {
+    SetHTMLBoolAttr(nsGkAtoms::shadowrootdelegatesfocus, aValue, aRv);
+  }
+
+  bool ShadowRootClonable() const {
+    return GetBoolAttr(nsGkAtoms::shadowrootclonable);
+  }
+  void SetShadowRootClonable(bool aValue, ErrorResult& aRv) {
+    SetHTMLBoolAttr(nsGkAtoms::shadowrootclonable, aValue, aRv);
   }
 
   MOZ_CAN_RUN_SCRIPT
diff --git a/dom/html/HTMLTextAreaElement.cpp b/dom/html/HTMLTextAreaElement.cpp
index ce28575a4d..be4ba5a891 100644
--- a/dom/html/HTMLTextAreaElement.cpp
+++ b/dom/html/HTMLTextAreaElement.cpp
@@ -19,7 +19,6 @@
 #include "mozilla/TextControlState.h"
 #include "nsAttrValueInlines.h"
 #include "nsBaseCommandController.h"
-#include "nsContentCID.h"
 #include "nsContentCreatorFunctions.h"
 #include "nsError.h"
 #include "nsFocusManager.h"
@@ -772,8 +771,8 @@ nsresult HTMLTextAreaElement::BindToTree(BindContext& aContext,
   return rv;
 }
 
-void HTMLTextAreaElement::UnbindFromTree(bool aNullParent) {
-  nsGenericHTMLFormControlElementWithState::UnbindFromTree(aNullParent);
+void HTMLTextAreaElement::UnbindFromTree(UnbindContext& aContext) {
+  nsGenericHTMLFormControlElementWithState::UnbindFromTree(aContext);
 
   // We might be no longer disabled because of parent chain changed.
   UpdateValueMissingValidityState();
diff --git a/dom/html/HTMLTextAreaElement.h b/dom/html/HTMLTextAreaElement.h
index ac3eb8bbf5..0adaa48b21 100644
--- a/dom/html/HTMLTextAreaElement.h
+++ b/dom/html/HTMLTextAreaElement.h
@@ -108,7 +108,7 @@ class HTMLTextAreaElement final : public TextControlElement,
 
   // nsIContent
   nsresult BindToTree(BindContext&, nsINode& aParent) override;
-  void UnbindFromTree(bool aNullParent = true) override;
+  void UnbindFromTree(UnbindContext&) override;
   bool ParseAttribute(int32_t aNamespaceID, nsAtom* aAttribute,
                       const nsAString& aValue,
                       nsIPrincipal* aMaybeScriptedPrincipal,
diff --git a/dom/html/HTMLTitleElement.cpp b/dom/html/HTMLTitleElement.cpp
index 776c76f7e5..d8d65491cc 100644
--- a/dom/html/HTMLTitleElement.cpp
+++ b/dom/html/HTMLTitleElement.cpp
@@ -72,11 +72,11 @@ nsresult HTMLTitleElement::BindToTree(BindContext& aContext, nsINode& aParent) {
   return NS_OK;
 }
 
-void HTMLTitleElement::UnbindFromTree(bool aNullParent) {
+void HTMLTitleElement::UnbindFromTree(UnbindContext& aContext) {
   SendTitleChangeEvent(false);
 
   // Let this fall through.
-  nsGenericHTMLElement::UnbindFromTree(aNullParent);
+  nsGenericHTMLElement::UnbindFromTree(aContext);
 }
 
 void HTMLTitleElement::DoneAddingChildren(bool aHaveNotified) {
diff --git a/dom/html/HTMLTitleElement.h b/dom/html/HTMLTitleElement.h
index 63cafa75a2..3d56940e25 100644
--- a/dom/html/HTMLTitleElement.h
+++ b/dom/html/HTMLTitleElement.h
@@ -41,7 +41,7 @@ class HTMLTitleElement final : public nsGenericHTMLElement,
 
   virtual nsresult BindToTree(BindContext&, nsINode& aParent) override;
 
-  virtual void UnbindFromTree(bool aNullParent = true) override;
+  virtual void UnbindFromTree(UnbindContext&) override;
 
   virtual void DoneAddingChildren(bool aHaveNotified) override;
 
diff --git a/dom/html/HTMLTrackElement.cpp b/dom/html/HTMLTrackElement.cpp
index 5363d3e399..e0e31dbb1b 100644
--- a/dom/html/HTMLTrackElement.cpp
+++ b/dom/html/HTMLTrackElement.cpp
@@ -11,10 +11,9 @@
 #include "mozilla/LoadInfo.h"
 #include "mozilla/StaticPrefs_media.h"
 #include "mozilla/dom/HTMLTrackElementBinding.h"
-#include "mozilla/dom/HTMLUnknownElement.h"
+#include "mozilla/dom/UnbindContext.h"
 #include "nsAttrValueInlines.h"
 #include "nsCOMPtr.h"
-#include "nsContentPolicyUtils.h"
 #include "nsContentUtils.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsGenericHTMLElement.h"
@@ -30,7 +29,6 @@
 #include "nsNetUtil.h"
 #include "nsStyleConsts.h"
 #include "nsThreadUtils.h"
-#include "nsVideoFrame.h"
 
 extern mozilla::LazyLogModule gTextTrackLog;
 #define LOG(msg, ...)                       \
@@ -408,8 +406,8 @@ nsresult HTMLTrackElement::BindToTree(BindContext& aContext, nsINode& aParent) {
   return NS_OK;
 }
 
-void HTMLTrackElement::UnbindFromTree(bool aNullParent) {
-  if (mMediaParent && aNullParent) {
+void HTMLTrackElement::UnbindFromTree(UnbindContext& aContext) {
+  if (mMediaParent && aContext.IsUnbindRoot(this)) {
     // mTrack can be null if HTMLTrackElement::LoadResource has never been
     // called.
     if (mTrack) {
@@ -419,7 +417,7 @@ void HTMLTrackElement::UnbindFromTree(bool aNullParent) {
     mMediaParent = nullptr;
   }
 
-  nsGenericHTMLElement::UnbindFromTree(aNullParent);
+  nsGenericHTMLElement::UnbindFromTree(aContext);
 }
 
 TextTrackReadyState HTMLTrackElement::ReadyState() const {
diff --git a/dom/html/HTMLTrackElement.h b/dom/html/HTMLTrackElement.h
index 20a239778d..8c5b4a4e91 100644
--- a/dom/html/HTMLTrackElement.h
+++ b/dom/html/HTMLTrackElement.h
@@ -86,7 +86,7 @@ class HTMLTrackElement final : public nsGenericHTMLElement {
   // Override BindToTree() so that we can trigger a load when we become
   // the child of a media element.
   virtual nsresult BindToTree(BindContext&, nsINode& aParent) override;
-  virtual void UnbindFromTree(bool aNullParent) override;
+  virtual void UnbindFromTree(UnbindContext&) override;
 
   virtual void AfterSetAttr(int32_t aNameSpaceID, nsAtom* aName,
                             const nsAttrValue* aValue,
diff --git a/dom/html/HTMLVideoElement.cpp b/dom/html/HTMLVideoElement.cpp
index effb21706c..925a14c931 100644
--- a/dom/html/HTMLVideoElement.cpp
+++ b/dom/html/HTMLVideoElement.cpp
@@ -6,6 +6,7 @@
 
 #include "mozilla/dom/HTMLVideoElement.h"
 
+#include "mozilla/AppShutdown.h"
 #include "mozilla/AsyncEventDispatcher.h"
 #include "mozilla/dom/HTMLVideoElementBinding.h"
 #include "nsGenericHTMLElement.h"
@@ -188,7 +189,7 @@ nsMapRuleToAttributesFunc HTMLVideoElement::GetAttributeMappingFunction()
   return &MapAttributesIntoRule;
 }
 
-void HTMLVideoElement::UnbindFromTree(bool aNullParent) {
+void HTMLVideoElement::UnbindFromTree(UnbindContext& aContext) {
   if (mVisualCloneSource) {
     mVisualCloneSource->EndCloningVisually();
   } else if (mVisualCloneTarget) {
@@ -198,7 +199,7 @@ void HTMLVideoElement::UnbindFromTree(bool aNullParent) {
     EndCloningVisually();
   }
 
-  HTMLMediaElement::UnbindFromTree(aNullParent);
+  HTMLMediaElement::UnbindFromTree(aContext);
 }
 
 nsresult HTMLVideoElement::SetAcceptHeader(nsIHttpChannel* aChannel) {
diff --git a/dom/html/HTMLVideoElement.h b/dom/html/HTMLVideoElement.h
index eda62d759a..af90cc79a1 100644
--- a/dom/html/HTMLVideoElement.h
+++ b/dom/html/HTMLVideoElement.h
@@ -53,7 +53,7 @@ class HTMLVideoElement final : public HTMLMediaElement {
 
   nsresult Clone(NodeInfo*, nsINode** aResult) const override;
 
-  void UnbindFromTree(bool aNullParent = true) override;
+  void UnbindFromTree(UnbindContext&) override;
 
   mozilla::Maybe<mozilla::CSSIntSize> GetVideoSize() const;
 
diff --git a/dom/html/TextControlState.cpp b/dom/html/TextControlState.cpp
index 3e2c06c53a..11f7619699 100644
--- a/dom/html/TextControlState.cpp
+++ b/dom/html/TextControlState.cpp
@@ -14,7 +14,6 @@
 #include "nsCOMPtr.h"
 #include "nsView.h"
 #include "nsCaret.h"
-#include "nsLayoutCID.h"
 #include "nsITextControlFrame.h"
 #include "nsContentCreatorFunctions.h"
 #include "nsTextControlFrame.h"
diff --git a/dom/html/moz.build b/dom/html/moz.build
index f3fdd30917..9971f600a0 100644
--- a/dom/html/moz.build
+++ b/dom/html/moz.build
@@ -117,7 +117,6 @@ EXPORTS.mozilla.dom += [
     "ImageDocument.h",
     "MediaDocument.h",
     "MediaError.h",
-    "nsBrowserElement.h",
     "PlayPromise.h",
     "RadioNodeList.h",
     "TextTrackManager.h",
@@ -203,7 +202,6 @@ UNIFIED_SOURCES += [
     "ImageDocument.cpp",
     "MediaDocument.cpp",
     "MediaError.cpp",
-    "nsBrowserElement.cpp",
     "nsDOMStringMap.cpp",
     "nsGenericHTMLElement.cpp",
     "nsGenericHTMLFrameElement.cpp",
diff --git a/dom/html/nsBrowserElement.cpp b/dom/html/nsBrowserElement.cpp
deleted file mode 100644
index 69284e77ab..0000000000
--- a/dom/html/nsBrowserElement.cpp
+++ /dev/null
@@ -1,57 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsBrowserElement.h"
-
-#include "mozilla/Preferences.h"
-#include "mozilla/dom/Promise.h"
-#include "mozilla/dom/ScriptSettings.h"
-#include "mozilla/dom/ToJSValue.h"
-
-#include "nsComponentManagerUtils.h"
-#include "nsFrameLoader.h"
-#include "nsINode.h"
-
-#include "js/Wrapper.h"
-
-using namespace mozilla::dom;
-
-namespace mozilla {
-
-bool nsBrowserElement::IsBrowserElementOrThrow(ErrorResult& aRv) {
-  if (mBrowserElementAPI) {
-    return true;
-  }
-  aRv.Throw(NS_ERROR_DOM_INVALID_NODE_TYPE_ERR);
-  return false;
-}
-
-void nsBrowserElement::InitBrowserElementAPI() {
-  RefPtr<nsFrameLoader> frameLoader = GetFrameLoader();
-  NS_ENSURE_TRUE_VOID(frameLoader);
-
-  if (!frameLoader->OwnerIsMozBrowserFrame()) {
-    return;
-  }
-
-  if (!mBrowserElementAPI) {
-    mBrowserElementAPI =
-        do_CreateInstance("@mozilla.org/dom/browser-element-api;1");
-    if (NS_WARN_IF(!mBrowserElementAPI)) {
-      return;
-    }
-  }
-  mBrowserElementAPI->SetFrameLoader(frameLoader);
-}
-
-void nsBrowserElement::DestroyBrowserElementFrameScripts() {
-  if (!mBrowserElementAPI) {
-    return;
-  }
-  mBrowserElementAPI->DestroyFrameScripts();
-}
-
-}  // namespace mozilla
diff --git a/dom/html/nsBrowserElement.h b/dom/html/nsBrowserElement.h
deleted file mode 100644
index c81529de33..0000000000
--- a/dom/html/nsBrowserElement.h
+++ /dev/null
@@ -1,57 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef nsBrowserElement_h
-#define nsBrowserElement_h
-
-#include "mozilla/dom/BindingDeclarations.h"
-
-#include "nsCOMPtr.h"
-#include "nsIBrowserElementAPI.h"
-
-class nsFrameLoader;
-
-namespace mozilla {
-
-namespace dom {
-class Promise;
-}  // namespace dom
-
-class ErrorResult;
-
-/**
- * A helper class for browser-element frames
- */
-class nsBrowserElement {
- public:
-  nsBrowserElement() = default;
-  virtual ~nsBrowserElement() = default;
-
-  void SendMouseEvent(const nsAString& aType, uint32_t aX, uint32_t aY,
-                      uint32_t aButton, uint32_t aClickCount,
-                      uint32_t aModifiers, ErrorResult& aRv);
-  void GoBack(ErrorResult& aRv);
-  void GoForward(ErrorResult& aRv);
-  void Reload(bool aHardReload, ErrorResult& aRv);
-  void Stop(ErrorResult& aRv);
-
-  already_AddRefed<dom::Promise> GetCanGoBack(ErrorResult& aRv);
-  already_AddRefed<dom::Promise> GetCanGoForward(ErrorResult& aRv);
-
- protected:
-  virtual already_AddRefed<nsFrameLoader> GetFrameLoader() = 0;
-
-  void InitBrowserElementAPI();
-  void DestroyBrowserElementFrameScripts();
-  nsCOMPtr<nsIBrowserElementAPI> mBrowserElementAPI;
-
- private:
-  bool IsBrowserElementOrThrow(ErrorResult& aRv);
-};
-
-}  // namespace mozilla
-
-#endif  // nsBrowserElement_h
diff --git a/dom/html/nsGenericHTMLElement.cpp b/dom/html/nsGenericHTMLElement.cpp
index de29276fdc..1014ba2a25 100644
--- a/dom/html/nsGenericHTMLElement.cpp
+++ b/dom/html/nsGenericHTMLElement.cpp
@@ -18,7 +18,6 @@
 #include "mozilla/StaticPrefs_dom.h"
 #include "mozilla/TextEditor.h"
 #include "mozilla/TextEvents.h"
-#include "mozilla/StaticPrefs_html5.h"
 #include "mozilla/StaticPrefs_accessibility.h"
 #include "mozilla/dom/FetchPriority.h"
 #include "mozilla/dom/FormData.h"
@@ -29,6 +28,7 @@
 #include "nsQueryObject.h"
 #include "mozilla/dom/BindContext.h"
 #include "mozilla/dom/Document.h"
+#include "mozilla/dom/UnbindContext.h"
 #include "nsPIDOMWindow.h"
 #include "nsIFrameInlines.h"
 #include "nsIScrollableFrame.h"
@@ -524,7 +524,7 @@ nsresult nsGenericHTMLElement::BindToTree(BindContext& aContext,
   return rv;
 }
 
-void nsGenericHTMLElement::UnbindFromTree(bool aNullParent) {
+void nsGenericHTMLElement::UnbindFromTree(UnbindContext& aContext) {
   if (IsInComposedDoc()) {
     // https://html.spec.whatwg.org/#dom-trees:hide-popover-algorithm
     // If removedNode's popover attribute is not in the no popover state, then
@@ -544,7 +544,7 @@ void nsGenericHTMLElement::UnbindFromTree(bool aNullParent) {
     }
   }
 
-  nsStyledElement::UnbindFromTree(aNullParent);
+  nsStyledElement::UnbindFromTree(aContext);
 
   // Invalidate .labels list. It will be repopulated when used the next time.
   nsExtendedDOMSlots* slots = GetExistingExtendedDOMSlots();
@@ -745,6 +745,16 @@ void nsGenericHTMLElement::AfterSetPopoverAttr() {
   }
 }
 
+void nsGenericHTMLElement::OnAttrSetButNotChanged(
+    int32_t aNamespaceID, nsAtom* aName, const nsAttrValueOrString& aValue,
+    bool aNotify) {
+  if (aNamespaceID == kNameSpaceID_None && aName == nsGkAtoms::popovertarget) {
+    ClearExplicitlySetAttrElement(aName);
+  }
+  return nsGenericHTMLElementBase::OnAttrSetButNotChanged(aNamespaceID, aName,
+                                                          aValue, aNotify);
+}
+
 void nsGenericHTMLElement::AfterSetAttr(int32_t aNamespaceID, nsAtom* aName,
                                         const nsAttrValue* aValue,
                                         const nsAttrValue* aOldValue,
@@ -763,7 +773,7 @@ void nsGenericHTMLElement::AfterSetAttr(int32_t aNamespaceID, nsAtom* aName,
           NewRunnableMethod("nsGenericHTMLElement::AfterSetPopoverAttr", this,
                             &nsGenericHTMLElement::AfterSetPopoverAttr));
     } else if (aName == nsGkAtoms::popovertarget) {
-      ClearExplicitlySetAttrElement(nsGkAtoms::popovertarget);
+      ClearExplicitlySetAttrElement(aName);
     } else if (aName == nsGkAtoms::dir) {
       auto dir = Directionality::Ltr;
       // A boolean tracking whether we need to recompute our directionality.
@@ -1259,25 +1269,24 @@ bool nsGenericHTMLElement::ParseImageAttribute(nsAtom* aAttribute,
 bool nsGenericHTMLElement::ParseReferrerAttribute(const nsAString& aString,
                                                   nsAttrValue& aResult) {
   using mozilla::dom::ReferrerInfo;
+  // This is a bit sketchy, we assume GetEnumString(…).get() points to a static
+  // buffer, relying on the fact that GetEnumString(…) returns a literal string.
   static const nsAttrValue::EnumTable kReferrerPolicyTable[] = {
-      {ReferrerInfo::ReferrerPolicyToString(ReferrerPolicy::No_referrer),
+      {GetEnumString(ReferrerPolicy::No_referrer).get(),
        static_cast<int16_t>(ReferrerPolicy::No_referrer)},
-      {ReferrerInfo::ReferrerPolicyToString(ReferrerPolicy::Origin),
+      {GetEnumString(ReferrerPolicy::Origin).get(),
        static_cast<int16_t>(ReferrerPolicy::Origin)},
-      {ReferrerInfo::ReferrerPolicyToString(
-           ReferrerPolicy::Origin_when_cross_origin),
+      {GetEnumString(ReferrerPolicy::Origin_when_cross_origin).get(),
        static_cast<int16_t>(ReferrerPolicy::Origin_when_cross_origin)},
-      {ReferrerInfo::ReferrerPolicyToString(
-           ReferrerPolicy::No_referrer_when_downgrade),
+      {GetEnumString(ReferrerPolicy::No_referrer_when_downgrade).get(),
        static_cast<int16_t>(ReferrerPolicy::No_referrer_when_downgrade)},
-      {ReferrerInfo::ReferrerPolicyToString(ReferrerPolicy::Unsafe_url),
+      {GetEnumString(ReferrerPolicy::Unsafe_url).get(),
        static_cast<int16_t>(ReferrerPolicy::Unsafe_url)},
-      {ReferrerInfo::ReferrerPolicyToString(ReferrerPolicy::Strict_origin),
+      {GetEnumString(ReferrerPolicy::Strict_origin).get(),
        static_cast<int16_t>(ReferrerPolicy::Strict_origin)},
-      {ReferrerInfo::ReferrerPolicyToString(ReferrerPolicy::Same_origin),
+      {GetEnumString(ReferrerPolicy::Same_origin).get(),
        static_cast<int16_t>(ReferrerPolicy::Same_origin)},
-      {ReferrerInfo::ReferrerPolicyToString(
-           ReferrerPolicy::Strict_origin_when_cross_origin),
+      {GetEnumString(ReferrerPolicy::Strict_origin_when_cross_origin).get(),
        static_cast<int16_t>(ReferrerPolicy::Strict_origin_when_cross_origin)},
       {nullptr, ReferrerPolicy::_empty}};
   return aResult.ParseEnumValue(aString, kReferrerPolicyTable, false);
@@ -1811,14 +1820,14 @@ nsresult nsGenericHTMLFormElement::BindToTree(BindContext& aContext,
   return NS_OK;
 }
 
-void nsGenericHTMLFormElement::UnbindFromTree(bool aNullParent) {
+void nsGenericHTMLFormElement::UnbindFromTree(UnbindContext& aContext) {
   // Save state before doing anything else.
   SaveState();
 
   if (IsFormAssociatedElement()) {
     if (HTMLFormElement* form = GetFormInternal()) {
       // Might need to unset form
-      if (aNullParent) {
+      if (aContext.IsUnbindRoot(this)) {
         // No more parent means no more form
         ClearForm(true, true);
       } else {
@@ -1839,7 +1848,7 @@ void nsGenericHTMLFormElement::UnbindFromTree(bool aNullParent) {
     }
   }
 
-  nsGenericHTMLElement::UnbindFromTree(aNullParent);
+  nsGenericHTMLElement::UnbindFromTree(aContext);
 
   // The element might not have a fieldset anymore.
   UpdateFieldSet(false);
diff --git a/dom/html/nsGenericHTMLElement.h b/dom/html/nsGenericHTMLElement.h
index f6e7d2415d..227e052fdf 100644
--- a/dom/html/nsGenericHTMLElement.h
+++ b/dom/html/nsGenericHTMLElement.h
@@ -332,7 +332,7 @@ class nsGenericHTMLElement : public nsGenericHTMLElementBase {
  public:
   // Implementation for nsIContent
   nsresult BindToTree(BindContext&, nsINode& aParent) override;
-  void UnbindFromTree(bool aNullParent = true) override;
+  void UnbindFromTree(UnbindContext&) override;
 
   Focusable IsFocusableWithoutStyle(bool aWithMouse) override {
     Focusable result;
@@ -727,6 +727,10 @@ class nsGenericHTMLElement : public nsGenericHTMLElementBase {
       const nsAttrValue* aOldValue, nsIPrincipal* aMaybeScriptedPrincipal,
       bool aNotify) override;
 
+  void OnAttrSetButNotChanged(int32_t aNamespaceID, nsAtom* aName,
+                              const nsAttrValueOrString& aValue,
+                              bool aNotify) override;
+
   MOZ_CAN_RUN_SCRIPT void AfterSetPopoverAttr();
 
   mozilla::EventListenerManager* GetEventListenerManagerForAttr(
@@ -1004,7 +1008,7 @@ class nsGenericHTMLFormElement : public nsGenericHTMLElement {
   // nsIContent
   void SaveSubtreeState() override;
   nsresult BindToTree(BindContext&, nsINode& aParent) override;
-  void UnbindFromTree(bool aNullParent = true) override;
+  void UnbindFromTree(UnbindContext&) override;
 
   /**
    * This callback is called by a fieldest on all its elements whenever its
diff --git a/dom/html/nsGenericHTMLFrameElement.cpp b/dom/html/nsGenericHTMLFrameElement.cpp
index ae2c4dcce5..92591d7b72 100644
--- a/dom/html/nsGenericHTMLFrameElement.cpp
+++ b/dom/html/nsGenericHTMLFrameElement.cpp
@@ -35,7 +35,6 @@ NS_IMPL_CYCLE_COLLECTION_CLASS(nsGenericHTMLFrameElement)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsGenericHTMLFrameElement,
                                                   nsGenericHTMLElement)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mFrameLoader)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mBrowserElementAPI)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsGenericHTMLFrameElement,
@@ -45,22 +44,12 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsGenericHTMLFrameElement,
   }
 
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mFrameLoader)
-  NS_IMPL_CYCLE_COLLECTION_UNLINK(mBrowserElementAPI)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
-NS_IMPL_ISUPPORTS_CYCLE_COLLECTION_INHERITED(
-    nsGenericHTMLFrameElement, nsGenericHTMLElement, nsFrameLoaderOwner,
-    nsIDOMMozBrowserFrame, nsIMozBrowserFrame, nsGenericHTMLFrameElement)
-
-NS_IMETHODIMP
-nsGenericHTMLFrameElement::GetMozbrowser(bool* aValue) {
-  *aValue = GetBoolAttr(nsGkAtoms::mozbrowser);
-  return NS_OK;
-}
-NS_IMETHODIMP
-nsGenericHTMLFrameElement::SetMozbrowser(bool aValue) {
-  return SetBoolAttr(nsGkAtoms::mozbrowser, aValue);
-}
+NS_IMPL_ISUPPORTS_CYCLE_COLLECTION_INHERITED(nsGenericHTMLFrameElement,
+                                             nsGenericHTMLElement,
+                                             nsFrameLoaderOwner,
+                                             nsGenericHTMLFrameElement)
 
 int32_t nsGenericHTMLFrameElement::TabIndexDefault() { return 0; }
 
@@ -202,7 +191,7 @@ nsresult nsGenericHTMLFrameElement::BindToTree(BindContext& aContext,
   return rv;
 }
 
-void nsGenericHTMLFrameElement::UnbindFromTree(bool aNullParent) {
+void nsGenericHTMLFrameElement::UnbindFromTree(UnbindContext& aContext) {
   if (mFrameLoader) {
     // This iframe is being taken out of the document, destroy the
     // iframe's frame loader (doing that will tear down the window in
@@ -214,7 +203,7 @@ void nsGenericHTMLFrameElement::UnbindFromTree(bool aNullParent) {
     mFrameLoader = nullptr;
   }
 
-  nsGenericHTMLElement::UnbindFromTree(aNullParent);
+  nsGenericHTMLElement::UnbindFromTree(aContext);
 }
 
 /* static */
@@ -260,9 +249,6 @@ void nsGenericHTMLFrameElement::AfterSetAttr(
           child->SendScrollbarPreferenceChanged(pref);
         }
       }
-    } else if (aName == nsGkAtoms::mozbrowser) {
-      mReallyIsBrowser = !!aValue && XRE_IsParentProcess() &&
-                         NodePrincipal()->IsSystemPrincipal();
     }
   }
 
@@ -336,28 +322,3 @@ bool nsGenericHTMLFrameElement::IsHTMLFocusable(bool aWithMouse,
   *aIsFocusable = true;
   return false;
 }
-
-/**
- * Return true if this frame element really is a mozbrowser.  (It
- * needs to have the right attributes, and its creator must have the right
- * permissions.)
- */
-/* [infallible] */
-nsresult nsGenericHTMLFrameElement::GetReallyIsBrowser(bool* aOut) {
-  *aOut = mReallyIsBrowser;
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsGenericHTMLFrameElement::InitializeBrowserAPI() {
-  MOZ_ASSERT(mFrameLoader);
-  InitBrowserElementAPI();
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsGenericHTMLFrameElement::DestroyBrowserFrameScripts() {
-  MOZ_ASSERT(mFrameLoader);
-  DestroyBrowserElementFrameScripts();
-  return NS_OK;
-}
diff --git a/dom/html/nsGenericHTMLFrameElement.h b/dom/html/nsGenericHTMLFrameElement.h
index 4ac6401721..587e861b88 100644
--- a/dom/html/nsGenericHTMLFrameElement.h
+++ b/dom/html/nsGenericHTMLFrameElement.h
@@ -8,12 +8,10 @@
 #define nsGenericHTMLFrameElement_h
 
 #include "mozilla/Attributes.h"
-#include "mozilla/dom/nsBrowserElement.h"
 
 #include "nsFrameLoader.h"
 #include "nsFrameLoaderOwner.h"
 #include "nsGenericHTMLElement.h"
-#include "nsIMozBrowserFrame.h"
 
 namespace mozilla {
 class ErrorResult;
@@ -38,39 +36,30 @@ class XULFrameElement;
  * A helper class for frame elements
  */
 class nsGenericHTMLFrameElement : public nsGenericHTMLElement,
-                                  public nsFrameLoaderOwner,
-                                  public mozilla::nsBrowserElement,
-                                  public nsIMozBrowserFrame {
+                                  public nsFrameLoaderOwner {
  public:
   nsGenericHTMLFrameElement(
       already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo,
       mozilla::dom::FromParser aFromParser)
       : nsGenericHTMLElement(std::move(aNodeInfo)),
         mSrcLoadHappened(false),
-        mNetworkCreated(aFromParser == mozilla::dom::FROM_PARSER_NETWORK),
-        mBrowserFrameListenersRegistered(false),
-        mReallyIsBrowser(false) {}
+        mNetworkCreated(aFromParser == mozilla::dom::FROM_PARSER_NETWORK) {}
 
   NS_DECL_ISUPPORTS_INHERITED
 
-  NS_DECL_NSIDOMMOZBROWSERFRAME
-  NS_DECL_NSIMOZBROWSERFRAME
-
   NS_DECLARE_STATIC_IID_ACCESSOR(NS_GENERICHTMLFRAMEELEMENT_IID)
 
   // nsIContent
   virtual bool IsHTMLFocusable(bool aWithMouse, bool* aIsFocusable,
                                int32_t* aTabIndex) override;
   virtual nsresult BindToTree(BindContext&, nsINode& aParent) override;
-  virtual void UnbindFromTree(bool aNullParent = true) override;
+  virtual void UnbindFromTree(UnbindContext&) override;
   virtual void DestroyContent() override;
 
   nsresult CopyInnerTo(mozilla::dom::Element* aDest);
 
   virtual int32_t TabIndexDefault() override;
 
-  virtual nsIMozBrowserFrame* GetAsMozBrowserFrame() override { return this; }
-
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsGenericHTMLFrameElement,
                                            nsGenericHTMLElement)
 
@@ -94,11 +83,6 @@ class nsGenericHTMLFrameElement : public nsGenericHTMLElement,
     return mSrcTriggeringPrincipal;
   }
 
-  // Needed for nsBrowserElement
-  already_AddRefed<nsFrameLoader> GetFrameLoader() override {
-    return nsFrameLoaderOwner::GetFrameLoader();
-  }
-
  protected:
   virtual ~nsGenericHTMLFrameElement();
 
@@ -132,9 +116,6 @@ class nsGenericHTMLFrameElement : public nsGenericHTMLElement,
    */
   bool mNetworkCreated;
 
-  bool mBrowserFrameListenersRegistered;
-  bool mReallyIsBrowser;
-
   // This flag is only used by <iframe>. See HTMLIFrameElement::
   // FullscreenFlag() for details. It is placed here so that we
   // do not bloat any struct.
diff --git a/dom/html/nsHTMLContentSink.cpp b/dom/html/nsHTMLContentSink.cpp
index 0c22b3e9aa..85bf8375e2 100644
--- a/dom/html/nsHTMLContentSink.cpp
+++ b/dom/html/nsHTMLContentSink.cpp
@@ -53,8 +53,6 @@
 #include "nsIDocShell.h"
 #include "nsIScriptContext.h"
 
-#include "nsLayoutCID.h"
-
 #include "nsEscape.h"
 #include "nsNodeInfoManager.h"
 #include "nsContentCreatorFunctions.h"
diff --git a/dom/html/test/formData_test.js b/dom/html/test/formData_test.js
index 3997aff4d1..8dff5bd606 100644
--- a/dom/html/test/formData_test.js
+++ b/dom/html/test/formData_test.js
@@ -1,3 +1,5 @@
+/* eslint-disable mozilla/no-comparison-or-assignment-inside-ok */
+
 function testHas() {
   var f = new FormData();
   f.append("foo", "bar");
diff --git a/dom/html/test/forms/test_change_event.html b/dom/html/test/forms/test_change_event.html
index 8be4554c58..b20a623439 100644
--- a/dom/html/test/forms/test_change_event.html
+++ b/dom/html/test/forms/test_change_event.html
@@ -61,7 +61,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=722599
 
   SimpleTest.waitForExplicitFinish();
   var MockFilePicker = SpecialPowers.MockFilePicker;
-  MockFilePicker.init(window);
+  MockFilePicker.init(SpecialPowers.wrap(window).browsingContext);
 
   function fileInputBlurTest() {
     var btn = document.getElementById('fileInput');
diff --git a/dom/html/test/forms/test_input_event.html b/dom/html/test/forms/test_input_event.html
index 72863ca335..d3fbba4b3b 100644
--- a/dom/html/test/forms/test_input_event.html
+++ b/dom/html/test/forms/test_input_event.html
@@ -149,7 +149,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=851780
   }
 
   var MockFilePicker = SpecialPowers.MockFilePicker;
-  MockFilePicker.init(window);
+  MockFilePicker.init(SpecialPowers.wrap(window).browsingContext);
 
   function testUserInput() {
     // Simulating an OK click and with a file name return.
diff --git a/dom/html/test/forms/test_input_file_picker.html b/dom/html/test/forms/test_input_file_picker.html
index 296c12bb7e..f05ee9e6a0 100644
--- a/dom/html/test/forms/test_input_file_picker.html
+++ b/dom/html/test/forms/test_input_file_picker.html
@@ -78,7 +78,7 @@ SimpleTest.waitForExplicitFinish();
 SimpleTest.requestFlakyTimeout("untriaged");
 
 var MockFilePicker = SpecialPowers.MockFilePicker;
-MockFilePicker.init(window);
+MockFilePicker.init(SpecialPowers.wrap(window).browsingContext);
 
 // The following lists are from toolkit/content/filepicker.properties which is used by filePicker
 var imageExtensionList = "*.jpe; *.jpg; *.jpeg; *.gif; *.png; *.bmp; *.ico; *.svg; *.svgz; *.tif; *.tiff; *.ai; *.drw; *.pct; *.psp; *.xcf; *.psd; *.raw; *.webp; *.heic"
diff --git a/dom/html/test/mochitest.toml b/dom/html/test/mochitest.toml
index d1dd78705b..d9a3b34b58 100644
--- a/dom/html/test/mochitest.toml
+++ b/dom/html/test/mochitest.toml
@@ -190,10 +190,13 @@ support-files = [
 
 ["test_allowMedia.html"]
 skip-if = [
-  "verify && (os == 'linux' || os == 'win')",
-  "!debug && os == 'mac' && bits == 64",
-  "debug && os == 'win'",
-  "debug && os == 'linux' && os_version == '18.04'", #Bug 1434744
+  "apple_catalina && !debug",
+  "apple_silicon && !debug",
+  "os == 'linux' && os_version == '18.04' && verify",
+  "os == 'linux' && os_version == '18.04' && debug", #Bug 1434744
+  "win11_2009 && verify",
+  "win10_2009 && debug",
+  "win11_2009 && debug",
 ]
 
 ["test_anchor_href_cache_invalidation.html"]
@@ -324,7 +327,7 @@ skip-if = ["os == 'android'"] #TIMED_OUT
 ["test_bug369370.html"]
 skip-if = [
   "os == 'android'",
-  "os == 'linux'", # disabled on linux bug 1258103
+  "os == 'linux' && os_version == '18.04'", # disabled on linux bug 1258103
 ]
 
 ["test_bug371375.html"]
@@ -597,7 +600,8 @@ fail-if = ["xorigin"]
 ["test_bug615833.html"]
 skip-if = [
   "os == 'android'",
-  "os == 'mac'", #TIMED_OUT # form control not selected/checked with synthesizeMouse, osx(bug 1275664)
+  "apple_catalina", #TIMED_OUT # form control not selected/checked with synthesizeMouse, osx(bug 1275664)
+  "apple_silicon", #TIMED_OUT # form control not selected/checked with synthesizeMouse, osx(bug 1275664)
 ]
 
 ["test_bug618948.html"]
@@ -769,17 +773,22 @@ skip-if = [
 ["test_bug1261673.html"]
 skip-if = [
   "os == 'android'",
-  "os == 'mac'",
+  "apple_catalina",
+  "apple_silicon",
 ]
 
 ["test_bug1261674-1.html"]
 skip-if = [
   "os == 'android'",
-  "os == 'mac'",
+  "apple_catalina",
+  "apple_silicon",
 ]
 
 ["test_bug1261674-2.html"]
-skip-if = ["os == 'mac'"]
+skip-if = [
+  "apple_catalina",
+  "apple_silicon",
+]
 
 ["test_bug1264157.html"]
 
@@ -979,7 +988,8 @@ tags = "openwindow"
 skip-if = [
   "os == 'android' && debug",
   "os == 'linux'",
-  "os == 'win' && debug && bits == 64", # Bug 1533759
+  "win11_2009 && bits == 64 && debug", # Bug 1533759
+  "win10_2009 && bits == 64 && debug", # Bug 1533759
 ]
 
 ["test_window_open_from_closing.html"]
diff --git a/dom/html/test/test_bug389797.html b/dom/html/test/test_bug389797.html
index 701d6e65c9..66396ce54f 100644
--- a/dom/html/test/test_bug389797.html
+++ b/dom/html/test/test_bug389797.html
@@ -115,7 +115,6 @@ HTML_TAG("figure", "")
 HTML_TAG("font", "Font");
 HTML_TAG("footer", "")
 HTML_TAG("form", "Form");
-HTML_TAG("frame", "Frame", [ "nsIDOMMozBrowserFrame" ]);
 HTML_TAG("frameset", "FrameSet");
 HTML_TAG("h1", "Heading");
 HTML_TAG("h2", "Heading");
@@ -129,7 +128,6 @@ HTML_TAG("hgroup", "")
 HTML_TAG("hr", "HR");
 HTML_TAG("html", "Html");
 HTML_TAG("i", "");
-HTML_TAG("iframe", "IFrame", [ "nsIDOMMozBrowserFrame" ]);
 HTML_TAG("image", "");
 HTML_TAG("img", "Image", [ "nsIImageLoadingContent" ], []);
 HTML_TAG("input", "Input", [], [ "imgINotificationObserver",
@@ -171,7 +169,7 @@ HTML_TAG("rtc", "");
 HTML_TAG("ruby", "");
 HTML_TAG("s", "");
 HTML_TAG("samp", "");
-HTML_TAG("script", "Script", [ "nsIScriptLoaderObserver" ], []);
+HTML_TAG("script", "Script");
 HTML_TAG("section", "")
 HTML_TAG("select", "Select");
 HTML_TAG("small", "");
diff --git a/dom/html/test/test_bug500885.html b/dom/html/test/test_bug500885.html
index 3ab9225a4c..5972ed171e 100644
--- a/dom/html/test/test_bug500885.html
+++ b/dom/html/test/test_bug500885.html
@@ -20,7 +20,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=500885
 <script type="text/javascript">
 
 var MockFilePicker = SpecialPowers.MockFilePicker;
-MockFilePicker.init(window);
+MockFilePicker.init(SpecialPowers.wrap(window).browsingContext);
 MockFilePicker.returnValue = MockFilePicker.returnOK;
 
 async function test() {
diff --git a/dom/html/test/test_bug556645.html b/dom/html/test/test_bug556645.html
index 3c308f9ef6..08a230370f 100644
--- a/dom/html/test/test_bug556645.html
+++ b/dom/html/test/test_bug556645.html
@@ -56,10 +56,12 @@ function runTest(aObjectOrEmbed)
   const pbutton = document.getElementById("pbutton");
   pbutton.focus();
 
-  synthesizeKey("KEY_Tab");
-  is(document.activeElement, aObjectOrEmbed, `${desc}: focus in parent after tab`);
-  is(childDoc.activeElement, childDoc.documentElement, `${desc}: focus in child after tab`);
-
+  let canTabMoveFocusToRootElement = !SpecialPowers.getBoolPref("dom.disable_tab_focus_to_root_element");
+  if (canTabMoveFocusToRootElement) {
+    synthesizeKey("KEY_Tab");
+    is(document.activeElement, aObjectOrEmbed, `${desc}: focus in parent after tab`);
+    is(childDoc.activeElement, childDoc.documentElement, `${desc}: focus in child after tab`);
+  }
   synthesizeKey("KEY_Tab");
   is(document.activeElement, aObjectOrEmbed, `${desc}: focus in parent after tab 2`);
   is(childDoc.activeElement, button, `${desc}: focus in child after tab 2`);
diff --git a/dom/html/test/test_bug592802.html b/dom/html/test/test_bug592802.html
index e8b30d84c8..701559237e 100644
--- a/dom/html/test/test_bug592802.html
+++ b/dom/html/test/test_bug592802.html
@@ -26,7 +26,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=592802
 SimpleTest.waitForExplicitFinish();
 
 var MockFilePicker = SpecialPowers.MockFilePicker;
-MockFilePicker.init(window);
+MockFilePicker.init(SpecialPowers.wrap(window).browsingContext);
 
 var testData = [
 /* visibility | display | multiple */
diff --git a/dom/html/test/test_filepicker_default_directory.html b/dom/html/test/test_filepicker_default_directory.html
index 2be811655a..565687235f 100644
--- a/dom/html/test/test_filepicker_default_directory.html
+++ b/dom/html/test/test_filepicker_default_directory.html
@@ -34,7 +34,7 @@ var customUploadDirectory = Cc["@mozilla.org/file/directory_service;1"]
 //info("customUploadDirectory" + customUploadDirectory.path);
 
 var MockFilePicker = SpecialPowers.MockFilePicker;
-MockFilePicker.init(window);
+MockFilePicker.init(SpecialPowers.wrap(window).browsingContext);
 
 // need to show the MockFilePicker so .displayDirectory gets set
 var f = document.getElementById("f");
diff --git a/dom/html/test/test_input_file_cancel_event.html b/dom/html/test/test_input_file_cancel_event.html
index f0fd81c433..64db440485 100644
--- a/dom/html/test/test_input_file_cancel_event.html
+++ b/dom/html/test/test_input_file_cancel_event.html
@@ -14,7 +14,7 @@
 SimpleTest.waitForExplicitFinish();
 
 var MockFilePicker = SpecialPowers.MockFilePicker;
-MockFilePicker.init(window);
+MockFilePicker.init(SpecialPowers.wrap(window).browsingContext);
 MockFilePicker.useBlobFile();
 MockFilePicker.returnValue = MockFilePicker.returnCancel;
 
diff --git a/dom/html/test/test_input_files_not_nsIFile.html b/dom/html/test/test_input_files_not_nsIFile.html
index e70bc093ee..57a3795de8 100644
--- a/dom/html/test/test_input_files_not_nsIFile.html
+++ b/dom/html/test/test_input_files_not_nsIFile.html
@@ -20,7 +20,7 @@
 SimpleTest.waitForExplicitFinish();
 
 var MockFilePicker = SpecialPowers.MockFilePicker;
-MockFilePicker.init(window);
+MockFilePicker.init(SpecialPowers.wrap(window).browsingContext);
 
 SimpleTest.waitForFocus(function() {
   MockFilePicker.useBlobFile();
diff --git a/dom/html/test/test_multipleFilePicker.html b/dom/html/test/test_multipleFilePicker.html
index c4a71151aa..9b342bdfaf 100644
--- a/dom/html/test/test_multipleFilePicker.html
+++ b/dom/html/test/test_multipleFilePicker.html
@@ -25,7 +25,7 @@ foo.addEventListener('click', _ => {
 });
 
 let MockFilePicker = SpecialPowers.MockFilePicker;
-MockFilePicker.init(window);
+MockFilePicker.init(SpecialPowers.wrap(window).browsingContext);
 
 let pickerCount = 0;