--- a/toolkit/crashreporter/CrashAnnotations.yaml
+++ b/toolkit/crashreporter/CrashAnnotations.yaml
@@ -13,16 +13,21 @@
 # - content: A boolean that indicates whether the field will be included in
 #   subprocess reports, if not specified this defaults to true
 
 A11yHandlerRegistered:
   description: >
     Set to "true" if the accessibility handler is registered, "false" otherwise.
   type: string
 
+AbortMessage:
+  description: >
+    Message passed to NS_DebugBreak().
+  type: string
+
 Accessibility:
   description: >
     Set to "Active" by the accessibility service when it is active.
   type: string
 
 AccessibilityClient:
   description: >
     Accessibility client ID.
@@ -183,16 +188,21 @@ CrashTime:
   ping: true
 
 CreateStreamOnHGlobalFailure:
   description: >
     Set when failing to obtain a global memory handle during the creation of an
     IPC proxy stream.
   type: string
 
+CycleCollector:
+  description: >
+    Reason why the cycle collector crashed.
+  type: string
+
 DeviceResetReason:
   description: >
     Reason why a DirectX device has been reset, Windows only.
   type: string
 
 DOMIPCEnabled:
   description: >
     Set to 1 when a tab is running in a content process
@@ -242,16 +252,21 @@ GraphicsSanityTest:
     Annotation used in tests.
   type: string
 
 GraphicsStartupTest:
   description: >
     Set to 1 by the graphics driver crash guard when it's activated.
   type: boolean
 
+Hang:
+  description: >
+    If set to 1 then Firefox crashed because it was hung for too long.
+  type: boolean
+
 HangMonitorDescription:
   description: >
     Name of the hang monitor that generated the crash.
   type: string
 
 IAccessibleConfig:
   description: >
     Set when something is seriously wrong with the IAccessible configuration in
@@ -357,16 +372,32 @@ IsGarbageCollecting:
   ping: true
 
 JavaStackTrace:
   description: >
     Java stack trace, only present on Firefox for Android if we encounter an
     uncaught Java exception.
   type: string
 
+JSLargeAllocationFailure:
+  description: >
+    A large allocation couldn't be satisfied, check the JSOutOfMemory
+    description for the possible values of this annotation.
+  type: string
+
+JSOutOfMemory:
+  description: >
+    A small allocation couldn't be satisfied, the annotation may contain the
+    "Reporting", "Reported" or "Recovered" value. The first one means that
+    we crashed while responding to the OOM condition (possibly while running a
+    memory-pressure observers), the second that we crashed after having tried to
+    free some memory, and the last that the GC had managed to free enough memory
+    to satisfy the allocation.
+  type: string
+
 MarshalActCtxManifestPath:
   description: >
     Proxy stream marshalling current activation context manifest path.
   type: string
 
 MozCrashReason:
   description: >
     Plaintext description of why Firefox crashed, this is usually set by

--- a/xpcom/base/CycleCollectedJSRuntime.cpp
+++ b/xpcom/base/CycleCollectedJSRuntime.cpp
@@ -1457,29 +1457,45 @@ CycleCollectedJSRuntime::FinalizeDeferre
   if (aType == CycleCollectedJSContext::FinalizeIncrementally) {
     NS_IdleDispatchToCurrentThread(do_AddRef(mFinalizeRunnable), 2500);
   } else {
     mFinalizeRunnable->ReleaseNow(false);
     MOZ_ASSERT(!mFinalizeRunnable);
   }
 }
 
+const char*
+CycleCollectedJSRuntime::OOMStateToString(const OOMState aOomState) const
+{
+  switch (aOomState) {
+    case OOMState::OK:
+      return "OK";
+    case OOMState::Reporting:
+      return "Reporting";
+    case OOMState::Reported:
+      return "Reported";
+    case OOMState::Recovered:
+      return "Recovered";
+    default:
+      MOZ_ASSERT_UNREACHABLE("OOMState holds an invalid value");
+      return "Unknown";
+  }
+}
+
 void
 CycleCollectedJSRuntime::AnnotateAndSetOutOfMemory(OOMState* aStatePtr,
                                                    OOMState aNewState)
 {
   *aStatePtr = aNewState;
-  CrashReporter::AnnotateCrashReport(aStatePtr == &mOutOfMemoryState
-                                     ? NS_LITERAL_CSTRING("JSOutOfMemory")
-                                     : NS_LITERAL_CSTRING("JSLargeAllocationFailure"),
-                                     aNewState == OOMState::Reporting
-                                     ? NS_LITERAL_CSTRING("Reporting")
-                                     : aNewState == OOMState::Reported
-                                     ? NS_LITERAL_CSTRING("Reported")
-                                     : NS_LITERAL_CSTRING("Recovered"));
+  CrashReporter::Annotation annotation = (aStatePtr == &mOutOfMemoryState)
+    ? CrashReporter::Annotation::JSOutOfMemory
+    : CrashReporter::Annotation::JSLargeAllocationFailure;
+
+  CrashReporter::AnnotateCrashReport(
+    annotation, nsDependentCString(OOMStateToString(aNewState)));
 }
 
 void
 CycleCollectedJSRuntime::OnGC(JSContext* aContext,
                               JSGCStatus aStatus)
 {
   switch (aStatus) {
     case JSGC_BEGIN:

--- a/xpcom/base/CycleCollectedJSRuntime.h
+++ b/xpcom/base/CycleCollectedJSRuntime.h
@@ -232,16 +232,18 @@ public:
 
     // The condition has happened, but a GC cycle ended since then.
     //
     // GC is taken as a proxy for "we've been banging on the heap a good bit
     // now and haven't crashed; the OOM was probably handled correctly".
     Recovered
   };
 
+  const char* OOMStateToString(const OOMState aOomState) const;
+
   void SetLargeAllocationFailure(OOMState aNewState);
 
   void AnnotateAndSetOutOfMemory(OOMState* aStatePtr, OOMState aNewState);
   void OnGC(JSContext* aContext, JSGCStatus aStatus);
   void OnOutOfMemory();
   void OnLargeAllocationFailure();
 
   JSRuntime* Runtime() { return mJSRuntime; }

--- a/xpcom/base/nsCycleCollector.cpp
+++ b/xpcom/base/nsCycleCollector.cpp
@@ -665,17 +665,18 @@ PtrInfo::AnnotatedReleaseAssert(bool aCo
     return;
   }
 
   const char* piName = "Unknown";
   if (mParticipant) {
     piName = mParticipant->ClassName();
   }
   nsPrintfCString msg("%s, for class %s", aMessage, piName);
-  CrashReporter::AnnotateCrashReport(NS_LITERAL_CSTRING("CycleCollector"), msg);
+  CrashReporter::AnnotateCrashReport(CrashReporter::Annotation::CycleCollector,
+                                     msg);
 
   MOZ_CRASH();
 }
 
 /**
  * A structure designed to be used like a linked list of PtrInfo, except
  * it allocates many PtrInfos at a time.
  */

--- a/xpcom/base/nsDebugImpl.cpp
+++ b/xpcom/base/nsDebugImpl.cpp
@@ -395,18 +395,19 @@ NS_DebugBreak(uint32_t aSeverity, const 
       // have to do without the annotations in that case.
       if (XRE_IsParentProcess()) {
         // Don't include the PID in the crash report annotation to
         // allow faceting on crash-stats.mozilla.org.
         nsCString note("xpcom_runtime_abort(");
         note += nonPIDBuf.buffer;
         note += ")";
         CrashReporter::AppendAppNotesToCrashReport(note);
-        CrashReporter::AnnotateCrashReport(NS_LITERAL_CSTRING("AbortMessage"),
-                                           nsDependentCString(nonPIDBuf.buffer));
+        CrashReporter::AnnotateCrashReport(
+          CrashReporter::Annotation::AbortMessage,
+          nsDependentCString(nonPIDBuf.buffer));
       }
 
 #if defined(DEBUG) && defined(_WIN32)
       RealBreak();
 #endif
 #if defined(DEBUG)
       nsTraceRefcnt::WalkTheStack(stderr);
 #endif

--- a/xpcom/threads/HangMonitor.cpp
+++ b/xpcom/threads/HangMonitor.cpp
@@ -105,18 +105,17 @@ Crash()
   if (::IsDebuggerPresent()) {
     return;
   }
 #endif
 
   // If you change this, you must also deal with the threadsafety of AnnotateCrashReport in
   // non-chrome processes!
   if (GeckoProcessType_Default == XRE_GetProcessType()) {
-    CrashReporter::AnnotateCrashReport(NS_LITERAL_CSTRING("Hang"),
-                                       NS_LITERAL_CSTRING("1"));
+    CrashReporter::AnnotateCrashReport(CrashReporter::Annotation::Hang, true);
     CrashReporter::SetMinidumpAnalysisAllThreads();
   }
 
   MOZ_CRASH("HangMonitor triggered");
 }
 
 #ifdef REPORT_CHROME_HANGS