diff --git a/mozilla/content/html/content/src/Makefile.in b/mozilla/content/html/content/src/Makefile.in
index 37f70283498..8cfbc561a6d 100644
--- a/mozilla/content/html/content/src/Makefile.in
+++ b/mozilla/content/html/content/src/Makefile.in
@@ -71,6 +71,7 @@ REQUIRES	= xpcom \
 		  exthandler \
 		  uconv \
 		  intl \
+		  plugin \
 		  $(NULL)
 
 EXPORTS		= \
diff --git a/mozilla/content/html/content/src/nsHTMLObjectElement.cpp b/mozilla/content/html/content/src/nsHTMLObjectElement.cpp
index 6464a260852..63b6c82b00d 100644
--- a/mozilla/content/html/content/src/nsHTMLObjectElement.cpp
+++ b/mozilla/content/html/content/src/nsHTMLObjectElement.cpp
@@ -45,7 +45,10 @@
 #include "nsIPresShell.h"
 #include "nsIDOMDocument.h"
 #include "nsIWebNavigation.h"
-#include "nsIFormControl.h"
+#include "nsIFormSubmission.h"
+#include "nsIObjectFrame.h"
+#include "nsIPluginInstance.h"
+#include "nsIPluginInstanceInternal.h"
 
 class nsHTMLObjectElement : public nsGenericHTMLFormElement,
                             public nsImageLoadingContent,
@@ -170,7 +173,47 @@ NS_IMETHODIMP
 nsHTMLObjectElement::SubmitNamesValues(nsIFormSubmission* aFormSubmission,
                                        nsIContent* aSubmitElement)
 {
-  return NS_OK;
+  nsAutoString name;
+  nsresult rv = GetAttr(kNameSpaceID_None, nsHTMLAtoms::name, name);
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+
+  if (rv == NS_CONTENT_ATTR_NOT_THERE) {
+    // No name, don't submit.
+
+    return NS_OK;
+  }
+
+  nsIFrame* frame = GetPrimaryFrame(PR_FALSE);
+
+  nsIObjectFrame *objFrame = nsnull;
+  if (frame) {
+    CallQueryInterface(frame, &objFrame);
+  }
+
+  if (!objFrame) {
+    // No frame, nothing to submit.
+
+    return NS_OK;
+  }
+
+  nsCOMPtr<nsIPluginInstance> pi;
+  objFrame->GetPluginInstance(*getter_AddRefs(pi));
+
+  nsCOMPtr<nsIPluginInstanceInternal> pi_internal(do_QueryInterface(pi));
+
+  if (!pi_internal) {
+    // No plugin, nothing to submit.
+
+    return NS_OK;
+  }
+
+  nsAutoString value;
+  rv = pi_internal->GetFormValue(value);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return aFormSubmission->AddNameValuePair(this, name, value);
 }
 
 NS_IMETHODIMP
diff --git a/mozilla/dom/src/base/nsDOMClassInfo.cpp b/mozilla/dom/src/base/nsDOMClassInfo.cpp
index ace8d2a84ff..6c919bd10f4 100644
--- a/mozilla/dom/src/base/nsDOMClassInfo.cpp
+++ b/mozilla/dom/src/base/nsDOMClassInfo.cpp
@@ -128,8 +128,8 @@
 
 // HTMLEmbed/ObjectElement helper includes
 #include "nsIPluginInstance.h"
+#include "nsIPluginInstanceInternal.h"
 #include "nsIObjectFrame.h"
-#include "nsINPRuntimePlugin.h"
 #include "nsIScriptablePlugin.h"
 #include "nsIPluginHost.h"
 #include "nsPIPluginHost.h"
@@ -7340,11 +7340,11 @@ nsHTMLPluginObjElementSH::GetPluginJSObject(JSContext *cx, JSObject *obj,
   *plugin_obj = nsnull;
   *plugin_proto = nsnull;
 
-  nsCOMPtr<nsINPRuntimePlugin> npruntime_plugin =
+  nsCOMPtr<nsIPluginInstanceInternal> plugin_internal =
     do_QueryInterface(plugin_inst);
 
-  if (npruntime_plugin) {
-    *plugin_obj = npruntime_plugin->GetJSObject(cx);
+  if (plugin_internal) {
+    *plugin_obj = plugin_internal->GetJSObject(cx);
 
     if (*plugin_obj) {
       *plugin_proto = ::JS_GetPrototype(cx, *plugin_obj);
diff --git a/mozilla/modules/plugin/base/public/Makefile.in b/mozilla/modules/plugin/base/public/Makefile.in
index a73db704ae3..335f66142f4 100644
--- a/mozilla/modules/plugin/base/public/Makefile.in
+++ b/mozilla/modules/plugin/base/public/Makefile.in
@@ -57,7 +57,7 @@ EXPORTS		= \
 		npupp.h \
 		npruntime.h \
 		nptypes.h \
-		nsINPRuntimePlugin.h \
+		nsIPluginInstanceInternal.h \
 		$(NULL)
 
 SDK_HEADERS	 = \
diff --git a/mozilla/modules/plugin/base/public/npapi.h b/mozilla/modules/plugin/base/public/npapi.h
index d844ba604f9..e7dc52ca39f 100644
--- a/mozilla/modules/plugin/base/public/npapi.h
+++ b/mozilla/modules/plugin/base/public/npapi.h
@@ -37,7 +37,7 @@
 
 
 /*
- *  npapi.h $Revision: 3.37 $
+ *  npapi.h $Revision: 3.38 $
  *  Netscape client plug-in API spec
  */
 
@@ -125,7 +125,7 @@
 /*----------------------------------------------------------------------*/
 
 #define NP_VERSION_MAJOR 0
-#define NP_VERSION_MINOR 14
+#define NP_VERSION_MINOR 15
 
 
 /* The OS/2 version of Netscape uses RC_DATA to define the
@@ -390,7 +390,13 @@ typedef enum {
   NPPVpluginNeedsXEmbed         = 14,
 
   /* Get the NPObject for scripting the plugin. */
-  NPPVpluginScriptableNPObject  = 15
+  NPPVpluginScriptableNPObject  = 15,
+
+  /* Get the plugin value (as \0-terminated UTF-8 string data) for
+   * form submission if the plugin is part of a form. Use
+   * NPN_MemAlloc() to allocate memory for the string data.
+  */
+  NPPVformValue = 16
 } NPPVariable;
 
 /*
diff --git a/mozilla/modules/plugin/base/src/ns4xPluginInstance.cpp b/mozilla/modules/plugin/base/src/ns4xPluginInstance.cpp
index 357805c5e84..ddc7b9abbaf 100644
--- a/mozilla/modules/plugin/base/src/ns4xPluginInstance.cpp
+++ b/mozilla/modules/plugin/base/src/ns4xPluginInstance.cpp
@@ -764,7 +764,7 @@ nsInstanceStream::~nsInstanceStream()
 ///////////////////////////////////////////////////////////////////////////////
 
 NS_IMPL_ISUPPORTS3(ns4xPluginInstance, nsIPluginInstance, nsIScriptablePlugin,
-                   nsINPRuntimePlugin)
+                   nsIPluginInstanceInternal)
 
 ///////////////////////////////////////////////////////////////////////////////
 
@@ -1545,3 +1545,22 @@ ns4xPluginInstance::GetJSObject(JSContext *cx)
 
   return obj;
 }
+
+nsresult
+ns4xPluginInstance::GetFormValue(nsAString& aValue)
+{
+  aValue.Truncate();
+
+  char *value = nsnull;
+  nsresult rv = GetValueInternal(NPPVformValue, &value);
+
+  if (NS_SUCCEEDED(rv) && value) {
+    CopyUTF8toUTF16(value, aValue);
+
+    // NPPVformValue allocates with NPN_MemAlloc(), which uses
+    // nsMemory.
+    nsMemory::Free(value);
+  }
+
+  return NS_OK;
+}
diff --git a/mozilla/modules/plugin/base/src/ns4xPluginInstance.h b/mozilla/modules/plugin/base/src/ns4xPluginInstance.h
index 96ee7f0b6ef..0f5bbf57122 100644
--- a/mozilla/modules/plugin/base/src/ns4xPluginInstance.h
+++ b/mozilla/modules/plugin/base/src/ns4xPluginInstance.h
@@ -54,7 +54,7 @@
 #include "nsIPluginInstancePeer.h"
 #include "nsIPluginTagInfo2.h"
 #include "nsIScriptablePlugin.h"
-#include "nsINPRuntimePlugin.h"
+#include "nsIPluginInstanceInternal.h"
 
 #include "npupp.h"
 #ifdef OJI
@@ -83,7 +83,7 @@ struct nsInstanceStream
 
 class ns4xPluginInstance : public nsIPluginInstance,
                            public nsIScriptablePlugin,
-                           public nsINPRuntimePlugin
+                           public nsIPluginInstanceInternal
 {
 public:
 
@@ -125,6 +125,13 @@ public:
 
     NS_IMETHOD GetScriptableInterface(nsIID * *aScriptableInterface);
 
+    ////////////////////////////////////////////////////////////////////////
+    // nsIPluginInstanceInternal methods
+
+    virtual JSObject *GetJSObject(JSContext *cx);
+
+    virtual nsresult GetFormValue(nsAString& aValue);
+
     ////////////////////////////////////////////////////////////////////////
     // ns4xPluginInstance-specific methods
 
@@ -162,8 +169,6 @@ public:
     // cache this 4.x plugin like an XPCOM plugin
     nsresult SetCached(PRBool aCache) { mCached = aCache; return NS_OK; };
 
-    virtual JSObject *GetJSObject(JSContext *cx);
-
     // Non-refcounting accessor for faster access to the peer.
     nsIPluginInstancePeer *Peer()
     {