From 9ebde3021572b9951e5cdc92f08b3d84e98f96f4 Mon Sep 17 00:00:00 2001
From: Manish Goregaokar <manishsmail@gmail.com>
Date: Mon, 20 Mar 2017 00:28:46 -0700
Subject: [PATCH 01/46] servo: Merge #16016 - Add separate specified value for
 keyword font sizes (from Manishearth:graft-font-size); r=upsuper

In Gecko, these keywords compute to different values depending on the
font.

See https://bugzilla.mozilla.org/show_bug.cgi?id=1341775

Source-Repo: https://github.com/servo/servo
Source-Revision: 50fd39f068fe5a4a018bb4e7a602f50f10590524

--HG--
extra : subtree_source : https%3A//hg.mozilla.org/projects/converted-servo-linear
extra : subtree_revision : bce6512a67ff1bb441554ece8b0e3cf9db07e80e
---
 servo/components/script/dom/element.rs        |   5 +-
 .../components/script/dom/htmlfontelement.rs  |  30 ++--
 .../style/properties/longhand/font.mako.rs    | 163 +++++++++++++++---
 .../style/values/specified/length.rs          |  42 -----
 servo/ports/geckolib/glue.rs                  |   4 +-
 5 files changed, 162 insertions(+), 82 deletions(-)

diff --git a/servo/components/script/dom/element.rs b/servo/components/script/dom/element.rs
index 3a73bbce97ed..f9e23bd50e08 100644
--- a/servo/components/script/dom/element.rs
+++ b/servo/components/script/dom/element.rs
@@ -478,7 +478,10 @@ impl LayoutElementHelpers for LayoutJS<Element> {
         if let Some(font_size) = font_size {
             hints.push(from_declaration(
                 shared_lock,
-                PropertyDeclaration::FontSize(font_size::SpecifiedValue(font_size.into()))))
+                PropertyDeclaration::FontSize(
+                    font_size::SpecifiedValue::from_html_size(font_size as u8)
+                )
+            ))
         }
 
         let cellspacing = if let Some(this) = self.downcast::<HTMLTableElement>() {
diff --git a/servo/components/script/dom/htmlfontelement.rs b/servo/components/script/dom/htmlfontelement.rs
index 8644544cdfe5..4e6b96a9c7e7 100644
--- a/servo/components/script/dom/htmlfontelement.rs
+++ b/servo/components/script/dom/htmlfontelement.rs
@@ -18,7 +18,6 @@ use html5ever_atoms::LocalName;
 use servo_atoms::Atom;
 use style::attr::AttrValue;
 use style::str::{HTML_SPACE_CHARACTERS, read_numbers};
-use style::values::specified;
 
 #[dom_struct]
 pub struct HTMLFontElement {
@@ -62,8 +61,7 @@ impl HTMLFontElementMethods for HTMLFontElement {
     // https://html.spec.whatwg.org/multipage/#dom-font-size
     fn SetSize(&self, value: DOMString) {
         let element = self.upcast::<Element>();
-        let length = parse_length(&value);
-        element.set_attribute(&local_name!("size"), AttrValue::Length(value.into(), length));
+        element.set_attribute(&local_name!("size"), parse_size(&value));
     }
 }
 
@@ -76,10 +74,7 @@ impl VirtualMethods for HTMLFontElement {
         match name {
             &local_name!("face") => AttrValue::from_atomic(value.into()),
             &local_name!("color") => AttrValue::from_legacy_color(value.into()),
-            &local_name!("size") => {
-                let length = parse_length(&value);
-                AttrValue::Length(value.into(), length)
-            },
+            &local_name!("size") => parse_size(&value),
             _ => self.super_type().unwrap().parse_plain_attribute(name, value),
         }
     }
@@ -88,7 +83,7 @@ impl VirtualMethods for HTMLFontElement {
 pub trait HTMLFontElementLayoutHelpers {
     fn get_color(&self) -> Option<RGBA>;
     fn get_face(&self) -> Option<Atom>;
-    fn get_size(&self) -> Option<specified::Length>;
+    fn get_size(&self) -> Option<u32>;
 }
 
 impl HTMLFontElementLayoutHelpers for LayoutJS<HTMLFontElement> {
@@ -113,18 +108,21 @@ impl HTMLFontElementLayoutHelpers for LayoutJS<HTMLFontElement> {
     }
 
     #[allow(unsafe_code)]
-    fn get_size(&self) -> Option<specified::Length> {
-        unsafe {
+    fn get_size(&self) -> Option<u32> {
+        let size = unsafe {
             (*self.upcast::<Element>().unsafe_get())
                 .get_attr_for_layout(&ns!(), &local_name!("size"))
-                .and_then(AttrValue::as_length)
-                .cloned()
+        };
+        match size {
+            Some(&AttrValue::UInt(_, s)) => Some(s),
+            _ => None,
         }
     }
 }
 
 /// https://html.spec.whatwg.org/multipage/#rules-for-parsing-a-legacy-font-size
-fn parse_length(mut input: &str) -> Option<specified::Length> {
+fn parse_size(mut input: &str) -> AttrValue {
+    let original_input = input;
     // Steps 1 & 2 are not relevant
 
     // Step 3
@@ -138,7 +136,7 @@ fn parse_length(mut input: &str) -> Option<specified::Length> {
     let mut input_chars = input.chars().peekable();
     let parse_mode = match input_chars.peek() {
         // Step 4
-        None => return None,
+        None => return AttrValue::String(original_input.into()),
 
         // Step 5
         Some(&'+') => {
@@ -155,7 +153,7 @@ fn parse_length(mut input: &str) -> Option<specified::Length> {
     // Steps 6, 7, 8
     let mut value = match read_numbers(input_chars) {
         (Some(v), _) if v >= 0 => v,
-        _ => return None,
+        _ => return AttrValue::String(original_input.into()),
     };
 
     // Step 9
@@ -166,5 +164,5 @@ fn parse_length(mut input: &str) -> Option<specified::Length> {
     }
 
     // Steps 10, 11, 12
-    Some(specified::Length::from_font_size_int(value as u8))
+    AttrValue::UInt(original_input.into(), value as u32)
 }
diff --git a/servo/components/style/properties/longhand/font.mako.rs b/servo/components/style/properties/longhand/font.mako.rs
index a62da4290650..49b3557c8cb1 100644
--- a/servo/components/style/properties/longhand/font.mako.rs
+++ b/servo/components/style/properties/longhand/font.mako.rs
@@ -400,24 +400,129 @@ ${helpers.single_keyword("font-variant-caps",
 
     impl ToCss for SpecifiedValue {
         fn to_css<W>(&self, dest: &mut W) -> fmt::Result where W: fmt::Write {
-            self.0.to_css(dest)
+            match *self {
+                SpecifiedValue::Length(ref lop) => lop.to_css(dest),
+                SpecifiedValue::Keyword(kw) => kw.to_css(dest),
+                SpecifiedValue::Smaller => dest.write_str("smaller"),
+                SpecifiedValue::Larger => dest.write_str("larger"),
+            }
         }
     }
 
     impl HasViewportPercentage for SpecifiedValue {
         fn has_viewport_percentage(&self) -> bool {
-            return self.0.has_viewport_percentage()
+            match *self {
+                SpecifiedValue::Length(ref lop) => lop.has_viewport_percentage(),
+                _ => false
+            }
         }
     }
 
     #[derive(Debug, Clone, PartialEq)]
     #[cfg_attr(feature = "servo", derive(HeapSizeOf))]
-    pub struct SpecifiedValue(pub specified::LengthOrPercentage);
+    pub enum SpecifiedValue {
+        Length(specified::LengthOrPercentage),
+        Keyword(KeywordSize),
+        Smaller,
+        Larger,
+    }
+
     pub mod computed_value {
         use app_units::Au;
         pub type T = Au;
     }
 
+    /// CSS font keywords
+    #[derive(Debug, Copy, Clone, PartialEq)]
+    #[cfg_attr(feature = "servo", derive(HeapSizeOf))]
+    pub enum KeywordSize {
+        XXSmall = 0,
+        XSmall = 1,
+        Small = 2,
+        Medium = 3,
+        Large = 4,
+        XLarge = 5,
+        XXLarge = 6,
+        // This is not a real font keyword and will not parse
+        // HTML font-size 7 corresponds to this value
+        XXXLarge = 7,
+    }
+
+    pub use self::KeywordSize::*;
+
+    impl KeywordSize {
+        pub fn parse(input: &mut Parser) -> Result<Self, ()> {
+            Ok(match_ignore_ascii_case! {&*input.expect_ident()?,
+                "xx-small" => XXSmall,
+                "x-small" => XSmall,
+                "small" => Small,
+                "medium" => Medium,
+                "large" => Large,
+                "x-large" => XLarge,
+                "xx-large" => XXLarge,
+                _ => return Err(())
+            })
+        }
+    }
+
+    impl ToCss for KeywordSize {
+        fn to_css<W>(&self, dest: &mut W) -> fmt::Result where W: fmt::Write {
+            dest.write_str(match *self {
+                XXSmall => "xx-small",
+                XSmall => "x-small",
+                Small => "small",
+                Medium => "medium",
+                Large => "large",
+                XLarge => "x-large",
+                XXLarge => "xx-large",
+                XXXLarge => unreachable!("We should never serialize \
+                                          specified values set via
+                                          HTML presentation attributes"),
+            })
+        }
+    }
+
+    impl ToComputedValue for KeywordSize {
+        type ComputedValue = Au;
+        #[inline]
+        fn to_computed_value(&self, _: &Context) -> computed_value::T {
+            // https://drafts.csswg.org/css-fonts-3/#font-size-prop
+            use values::FONT_MEDIUM_PX;
+            match *self {
+                XXSmall => Au::from_px(FONT_MEDIUM_PX) * 3 / 5,
+                XSmall => Au::from_px(FONT_MEDIUM_PX) * 3 / 4,
+                Small => Au::from_px(FONT_MEDIUM_PX) * 8 / 9,
+                Medium => Au::from_px(FONT_MEDIUM_PX),
+                Large => Au::from_px(FONT_MEDIUM_PX) * 6 / 5,
+                XLarge => Au::from_px(FONT_MEDIUM_PX) * 3 / 2,
+                XXLarge => Au::from_px(FONT_MEDIUM_PX) * 2,
+                XXXLarge => Au::from_px(FONT_MEDIUM_PX) * 3,
+            }
+        }
+
+        #[inline]
+        fn from_computed_value(_: &computed_value::T) -> Self {
+            unreachable!()
+        }
+    }
+
+    impl SpecifiedValue {
+        /// https://html.spec.whatwg.org/multipage/#rules-for-parsing-a-legacy-font-size
+        pub fn from_html_size(size: u8) -> Self {
+            SpecifiedValue::Keyword(match size {
+                // If value is less than 1, let it be 1.
+                0 | 1 => XSmall,
+                2 => Small,
+                3 => Medium,
+                4 => Large,
+                5 => XLarge,
+                6 => XXLarge,
+                // If value is greater than 7, let it be 7.
+                _ => XXXLarge,
+            })
+        }
+    }
+
     #[inline]
     #[allow(missing_docs)]
     pub fn get_initial_value() -> computed_value::T {
@@ -426,7 +531,7 @@ ${helpers.single_keyword("font-variant-caps",
 
     #[inline]
     pub fn get_initial_specified_value() -> SpecifiedValue {
-        SpecifiedValue(specified::LengthOrPercentage::Length(NoCalcLength::medium()))
+        SpecifiedValue::Keyword(Medium)
     }
 
     impl ToComputedValue for SpecifiedValue {
@@ -434,45 +539,61 @@ ${helpers.single_keyword("font-variant-caps",
 
         #[inline]
         fn to_computed_value(&self, context: &Context) -> computed_value::T {
-            match self.0 {
-                LengthOrPercentage::Length(NoCalcLength::FontRelative(value)) => {
+            use values::specified::length::FontRelativeLength;
+            match *self {
+                SpecifiedValue::Length(LengthOrPercentage::Length(
+                        NoCalcLength::FontRelative(value))) => {
                     value.to_computed_value(context, /* use inherited */ true)
                 }
-                LengthOrPercentage::Length(NoCalcLength::ServoCharacterWidth(value)) => {
+                SpecifiedValue::Length(LengthOrPercentage::Length(
+                        NoCalcLength::ServoCharacterWidth(value))) => {
                     value.to_computed_value(context.inherited_style().get_font().clone_font_size())
                 }
-                LengthOrPercentage::Length(ref l) => {
+                SpecifiedValue::Length(LengthOrPercentage::Length(ref l)) => {
                     l.to_computed_value(context)
                 }
-                LengthOrPercentage::Percentage(Percentage(value)) => {
+                SpecifiedValue::Length(LengthOrPercentage::Percentage(Percentage(value))) => {
                     context.inherited_style().get_font().clone_font_size().scale_by(value)
                 }
-                LengthOrPercentage::Calc(ref calc) => {
+                SpecifiedValue::Length(LengthOrPercentage::Calc(ref calc)) => {
                     let calc = calc.to_computed_value(context);
                     calc.length() + context.inherited_style().get_font().clone_font_size()
                                            .scale_by(calc.percentage())
                 }
+                SpecifiedValue::Keyword(ref key) => {
+                    key.to_computed_value(context)
+                }
+                SpecifiedValue::Smaller => {
+                    FontRelativeLength::Em(0.85).to_computed_value(context,
+                                                                   /* use_inherited */ true)
+                }
+                SpecifiedValue::Larger => {
+                    FontRelativeLength::Em(1.2).to_computed_value(context,
+                                                                   /* use_inherited */ true)
+                }
             }
         }
 
         #[inline]
         fn from_computed_value(computed: &computed_value::T) -> Self {
-                SpecifiedValue(LengthOrPercentage::Length(
+                SpecifiedValue::Length(LengthOrPercentage::Length(
                         ToComputedValue::from_computed_value(computed)
                 ))
         }
     }
     /// <length> | <percentage> | <absolute-size> | <relative-size>
-    pub fn parse(_context: &ParserContext, input: &mut Parser) -> Result<SpecifiedValue, ()> {
-        use values::specified::{Length, LengthOrPercentage};
-
-        input.try(specified::LengthOrPercentage::parse_non_negative)
-        .or_else(|()| {
-            let ident = try!(input.expect_ident());
-            NoCalcLength::from_str(&ident as &str)
-                         .ok_or(())
-                         .map(specified::LengthOrPercentage::Length)
-        }).map(SpecifiedValue)
+    pub fn parse(_: &ParserContext, input: &mut Parser) -> Result<SpecifiedValue, ()> {
+        if let Ok(lop) = input.try(specified::LengthOrPercentage::parse_non_negative) {
+            Ok(SpecifiedValue::Length(lop))
+        } else if let Ok(kw) = input.try(KeywordSize::parse) {
+            Ok(SpecifiedValue::Keyword(kw))
+        } else {
+            match_ignore_ascii_case! {&*input.expect_ident()?,
+                "smaller" => Ok(SpecifiedValue::Smaller),
+                "larger" => Ok(SpecifiedValue::Larger),
+                _ => Err(())
+            }
+        }
     }
 </%helpers:longhand>
 
diff --git a/servo/components/style/values/specified/length.rs b/servo/components/style/values/specified/length.rs
index d530680660a1..bffae92c4ff4 100644
--- a/servo/components/style/values/specified/length.rs
+++ b/servo/components/style/values/specified/length.rs
@@ -276,38 +276,6 @@ impl Mul<CSSFloat> for NoCalcLength {
 }
 
 impl NoCalcLength {
-    /// https://drafts.csswg.org/css-fonts-3/#font-size-prop
-    pub fn from_str(s: &str) -> Option<NoCalcLength> {
-        Some(match_ignore_ascii_case! { s,
-            "xx-small" => NoCalcLength::Absolute(Au::from_px(FONT_MEDIUM_PX) * 3 / 5),
-            "x-small" => NoCalcLength::Absolute(Au::from_px(FONT_MEDIUM_PX) * 3 / 4),
-            "small" => NoCalcLength::Absolute(Au::from_px(FONT_MEDIUM_PX) * 8 / 9),
-            "medium" => NoCalcLength::Absolute(Au::from_px(FONT_MEDIUM_PX)),
-            "large" => NoCalcLength::Absolute(Au::from_px(FONT_MEDIUM_PX) * 6 / 5),
-            "x-large" => NoCalcLength::Absolute(Au::from_px(FONT_MEDIUM_PX) * 3 / 2),
-            "xx-large" => NoCalcLength::Absolute(Au::from_px(FONT_MEDIUM_PX) * 2),
-
-            // https://github.com/servo/servo/issues/3423#issuecomment-56321664
-            "smaller" => NoCalcLength::FontRelative(FontRelativeLength::Em(0.85)),
-            "larger" => NoCalcLength::FontRelative(FontRelativeLength::Em(1.2)),
-            _ => return None
-        })
-    }
-
-    /// https://drafts.csswg.org/css-fonts-3/#font-size-prop
-    pub fn from_font_size_int(i: u8) -> Self {
-        let au = match i {
-            0 | 1 => Au::from_px(FONT_MEDIUM_PX) * 3 / 4,
-            2 => Au::from_px(FONT_MEDIUM_PX) * 8 / 9,
-            3 => Au::from_px(FONT_MEDIUM_PX),
-            4 => Au::from_px(FONT_MEDIUM_PX) * 6 / 5,
-            5 => Au::from_px(FONT_MEDIUM_PX) * 3 / 2,
-            6 => Au::from_px(FONT_MEDIUM_PX) * 2,
-            _ => Au::from_px(FONT_MEDIUM_PX) * 3,
-        };
-        NoCalcLength::Absolute(au)
-    }
-
     /// Parse a given absolute or relative dimension.
     pub fn parse_dimension(value: CSSFloat, unit: &str) -> Result<NoCalcLength, ()> {
         match_ignore_ascii_case! { unit,
@@ -444,21 +412,11 @@ impl Length {
         Length::NoCalc(NoCalcLength::zero())
     }
 
-    /// https://drafts.csswg.org/css-fonts-3/#font-size-prop
-    pub fn from_str(s: &str) -> Option<Length> {
-        NoCalcLength::from_str(s).map(Length::NoCalc)
-    }
-
     /// Parse a given absolute or relative dimension.
     pub fn parse_dimension(value: CSSFloat, unit: &str) -> Result<Length, ()> {
         NoCalcLength::parse_dimension(value, unit).map(Length::NoCalc)
     }
 
-    /// https://drafts.csswg.org/css-fonts-3/#font-size-prop
-    pub fn from_font_size_int(i: u8) -> Self {
-        Length::NoCalc(NoCalcLength::from_font_size_int(i))
-    }
-
     #[inline]
     fn parse_internal(input: &mut Parser, context: AllowedNumericType) -> Result<Length, ()> {
         match try!(input.next()) {
diff --git a/servo/ports/geckolib/glue.rs b/servo/ports/geckolib/glue.rs
index 177a6c076e8f..253e724a3635 100644
--- a/servo/ports/geckolib/glue.rs
+++ b/servo/ports/geckolib/glue.rs
@@ -1111,7 +1111,7 @@ pub extern "C" fn Servo_DeclarationBlock_SetKeywordValue(declarations:
                                                          value: i32) {
     use style::properties::{PropertyDeclaration, LonghandId};
     use style::properties::longhands;
-    use style::values::specified::{BorderStyle, NoCalcLength};
+    use style::values::specified::BorderStyle;
 
     let declarations = Locked::<PropertyDeclarationBlock>::as_arc(&declarations);
     let long = get_longhand_from_id!(property);
@@ -1127,7 +1127,7 @@ pub extern "C" fn Servo_DeclarationBlock_SetKeywordValue(declarations:
         Clear => longhands::clear::SpecifiedValue::from_gecko_keyword(value),
         FontSize => {
             // We rely on Gecko passing in font-size values (0...7) here.
-            longhands::font_size::SpecifiedValue(NoCalcLength::from_font_size_int(value as u8).into())
+            longhands::font_size::SpecifiedValue::from_html_size(value as u8)
         },
         ListStyleType => longhands::list_style_type::SpecifiedValue::from_gecko_keyword(value),
         WhiteSpace => longhands::white_space::SpecifiedValue::from_gecko_keyword(value),

From c6fa23934dff3dbfc2a4d77c6ad631b465e2ab37 Mon Sep 17 00:00:00 2001
From: Henry Chang <hchang@mozilla.com>
Date: Sun, 19 Mar 2017 15:52:25 +0800
Subject: [PATCH 02/46] Bug 1348626 - Retry when isPinged() failed to avoid
 false alarm. r=francois

MozReview-Commit-ID: BOdJZReICxZ

--HG--
extra : rebase_source : 16e0b0b1a65d0bc1249ff0583947acd39defb5d9
---
 .../tests/mochitest/test_classify_ping.html   | 25 +++++++++++++------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/toolkit/components/url-classifier/tests/mochitest/test_classify_ping.html b/toolkit/components/url-classifier/tests/mochitest/test_classify_ping.html
index 4919ff9ceeee..63318dbae89b 100644
--- a/toolkit/components/url-classifier/tests/mochitest/test_classify_ping.html
+++ b/toolkit/components/url-classifier/tests/mochitest/test_classify_ping.html
@@ -21,6 +21,7 @@
   const host_track = "http://trackertest.org/";
   const path_ping = "tests/toolkit/components/url-classifier/tests/mochitest/ping.sjs";
   const TP_ENABLE_PREF = "privacy.trackingprotection.enabled";
+  const RETRY_TIMEOUT_MS = 200;
 
   var testData = [
     { url: "trackertest.org/",
@@ -37,9 +38,8 @@
     ping(id, host_nottrack);
 
     return new Promise(function(resolve, reject) {
-      setTimeout(function() {
-        isPinged(id, expectPing, msg, resolve);
-      }, timeout);
+      // Retry at most 30 seconds.
+      isPingedWithRetry(id, expectPing, msg, resolve, 30 * 1000 / RETRY_TIMEOUT_MS);
     });
   }
 
@@ -85,19 +85,30 @@
     document.body.removeChild(elm);
   }
 
-  function isPinged(id, expected, msg, callback) {
+  function isPingedWithRetry(id, expected, msg, callback, retryCnt) {
     var url = "http://mochi.test:8888/" + path_ping;
     var xhr = new XMLHttpRequest();
     xhr.open('GET', url + "?id=" + id);
     xhr.onload = function() {
       var isPinged = xhr.response === "ping";
-      is(expected, isPinged, msg);
-
-      callback();
+      let success = isPinged === expected;
+      if (success || 0 === retryCnt) {
+        is(expected, isPinged, msg);
+        callback();
+        return;
+      }
+      // Retry on failure.
+      setTimeout(() => {
+        isPingedWithRetry(id, expected, msg, callback, retryCnt - 1);
+      }, RETRY_TIMEOUT_MS);
     };
     xhr.send();
   }
 
+  function isPinged(id, expected, msg, callback) {
+    isPingedWithRetry(id, expected, msg, callback, 0);
+  }
+
   function cleanup() {
     SpecialPowers.clearUserPref(TP_ENABLE_PREF);
   }

From 106b6939c6d4c4843ce81beef2bbdd1b4117a3d2 Mon Sep 17 00:00:00 2001
From: John Lin <jolin@mozilla.com>
Date: Fri, 17 Mar 2017 14:21:27 +0800
Subject: [PATCH 03/46] Bug 1346235 - part 1: translate native error to Java
 exception. r=jchen

MozReview-Commit-ID: BcpfJLSzTvk

--HG--
extra : rebase_source : 53d6e9efa064b4a5ab32676d349a5c0cadb78ea7
---
 .../java/org/mozilla/gecko/mozglue/SharedMemory.java   |  7 ++++++-
 mozglue/android/SharedMemNatives.cpp                   | 10 +++++++++-
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/mobile/android/base/java/org/mozilla/gecko/mozglue/SharedMemory.java b/mobile/android/base/java/org/mozilla/gecko/mozglue/SharedMemory.java
index bc43a275545e..00b80f4a127b 100644
--- a/mobile/android/base/java/org/mozilla/gecko/mozglue/SharedMemory.java
+++ b/mobile/android/base/java/org/mozilla/gecko/mozglue/SharedMemory.java
@@ -133,7 +133,12 @@ public class SharedMemory implements Parcelable {
         }
 
         if (!mIsMapped) {
-            mHandle = map(getFD(), mSize);
+            try {
+                mHandle = map(getFD(), mSize);
+            } catch (NullPointerException e) {
+                Log.e(LOGTAG, "SharedMemory#" + mId + " error.", e);
+                throw e;
+            }
             if (mHandle != 0) {
                 mIsMapped = true;
             }
diff --git a/mozglue/android/SharedMemNatives.cpp b/mozglue/android/SharedMemNatives.cpp
index d186d6e21e9e..04ceac6a57f2 100644
--- a/mozglue/android/SharedMemNatives.cpp
+++ b/mozglue/android/SharedMemNatives.cpp
@@ -3,7 +3,9 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#include <errno.h>
 #include <jni.h>
+#include <stdio.h>
 #include <string.h>
 #include <sys/mman.h>
 
@@ -52,6 +54,12 @@ jlong JNICALL
 Java_org_mozilla_gecko_mozglue_SharedMemory_map(JNIEnv *env, jobject jobj, jint fd, jint length)
 {
   void* address = mmap(NULL, length, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
+  if (address == MAP_FAILED) {
+    char msg[128];
+    snprintf(msg, sizeof(msg), "mmap failed. errno=%d", errno);
+    env->ThrowNew(env->FindClass("java/lang/NullPointerException"), msg);
+    return 0;
+  }
   return jlong(address);
 }
 
@@ -62,4 +70,4 @@ Java_org_mozilla_gecko_mozglue_SharedMemory_unmap(JNIEnv *env, jobject jobj, jlo
   munmap((void*)address, (size_t)size);
 }
 
-}
\ No newline at end of file
+}

From bbbc27bc084726737b2e5eab40fb2c6d296723e3 Mon Sep 17 00:00:00 2001
From: John Lin <jolin@mozilla.com>
Date: Fri, 17 Mar 2017 15:04:26 +0800
Subject: [PATCH 04/46] Bug 1346235 - part 2: translate memory error to I/O
 failure. r=jchen

MozReview-Commit-ID: F2ca0q2JQp

--HG--
extra : rebase_source : 9c23a461dbd2ebe3c61ee08e066af51d3b6fe249
---
 .../org/mozilla/gecko/mozglue/SharedMemBuffer.java   | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/mobile/android/base/java/org/mozilla/gecko/mozglue/SharedMemBuffer.java b/mobile/android/base/java/org/mozilla/gecko/mozglue/SharedMemBuffer.java
index cf22685c2cde..d9455dc5df89 100644
--- a/mobile/android/base/java/org/mozilla/gecko/mozglue/SharedMemBuffer.java
+++ b/mobile/android/base/java/org/mozilla/gecko/mozglue/SharedMemBuffer.java
@@ -54,7 +54,11 @@ public final class SharedMemBuffer implements Sample.Buffer {
         if (!src.isDirect()) {
             throw new IOException("SharedMemBuffer only support reading from direct byte buffer.");
         }
-        nativeReadFromDirectBuffer(src, mSharedMem.getPointer(), offset, size);
+        try {
+            nativeReadFromDirectBuffer(src, mSharedMem.getPointer(), offset, size);
+        } catch (NullPointerException e) {
+            throw new IOException(e);
+        }
     }
 
     private native static void nativeReadFromDirectBuffer(ByteBuffer src, long dest, int offset, int size);
@@ -64,7 +68,11 @@ public final class SharedMemBuffer implements Sample.Buffer {
         if (!dest.isDirect()) {
             throw new IOException("SharedMemBuffer only support writing to direct byte buffer.");
         }
-        nativeWriteToDirectBuffer(mSharedMem.getPointer(), dest, offset, size);
+        try {
+            nativeWriteToDirectBuffer(mSharedMem.getPointer(), dest, offset, size);
+        } catch (NullPointerException e) {
+            throw new IOException(e);
+        }
     }
 
     private native static void nativeWriteToDirectBuffer(long src, ByteBuffer dest, int offset, int size);

From f737b4804b67ee1b71ba8d67b40dbad4713d6968 Mon Sep 17 00:00:00 2001
From: John Lin <jolin@mozilla.com>
Date: Fri, 17 Mar 2017 15:17:16 +0800
Subject: [PATCH 05/46] Bug 1346235 - part 3: forward shared memory allocation
 error to peer process. r=jchen

MozReview-Commit-ID: KDIMylv9tVt

--HG--
extra : rebase_source : fa4326ce1ca97a46ed9f3cb639a17dfa9950fe4e
---
 .../base/java/org/mozilla/gecko/media/Codec.java      | 11 ++++++++---
 .../base/java/org/mozilla/gecko/media/SamplePool.java | 10 ++++------
 2 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/mobile/android/base/java/org/mozilla/gecko/media/Codec.java b/mobile/android/base/java/org/mozilla/gecko/media/Codec.java
index 877cbc7ab69e..58deb8ebfb7b 100644
--- a/mobile/android/base/java/org/mozilla/gecko/media/Codec.java
+++ b/mobile/android/base/java/org/mozilla/gecko/media/Codec.java
@@ -196,8 +196,8 @@ import java.util.concurrent.ConcurrentLinkedQueue;
                 return;
             }
 
-            Sample output = obtainOutputSample(index, info);
             try {
+                Sample output = obtainOutputSample(index, info);
                 mSentIndices.add(index);
                 mSentOutputs.add(output);
                 mCallbacks.onOutput(output);
@@ -471,8 +471,13 @@ import java.util.concurrent.ConcurrentLinkedQueue;
     }
 
     @Override
-    public synchronized Sample dequeueInput(int size) {
-        return mInputProcessor.onAllocate(size);
+    public synchronized Sample dequeueInput(int size) throws RemoteException {
+        try {
+            return mInputProcessor.onAllocate(size);
+        } catch (Exception e) {
+            // Translate allocation error to remote exception.
+            throw new RemoteException(e.getMessage());
+        }
     }
 
     @Override
diff --git a/mobile/android/base/java/org/mozilla/gecko/media/SamplePool.java b/mobile/android/base/java/org/mozilla/gecko/media/SamplePool.java
index f484c7f2a909..f802166f29e5 100644
--- a/mobile/android/base/java/org/mozilla/gecko/media/SamplePool.java
+++ b/mobile/android/base/java/org/mozilla/gecko/media/SamplePool.java
@@ -32,7 +32,7 @@ final class SamplePool {
             mDefaultBufferSize = size;
         }
 
-        private synchronized Sample obtain(int size)  {
+        private synchronized Sample obtain(int size) {
             if (!mRecycledSamples.isEmpty()) {
                 return mRecycledSamples.remove(0);
             }
@@ -48,13 +48,11 @@ final class SamplePool {
             SharedMemory shm = null;
             try {
                 shm = new SharedMemory(mNextId++, Math.max(size, mDefaultBufferSize));
-            } catch (NoSuchMethodException e) {
-                e.printStackTrace();
-            } catch (IOException e) {
-                e.printStackTrace();
+            } catch (NoSuchMethodException | IOException e) {
+                throw new UnsupportedOperationException(e);
             }
 
-            return shm != null ? Sample.create(shm) : Sample.create();
+            return Sample.create(shm);
         }
 
         private synchronized void recycle(Sample recycled) {

From d65535053dadd02412c3ec1cb46bc66bdb1a76ac Mon Sep 17 00:00:00 2001
From: John Lin <jolin@mozilla.com>
Date: Fri, 17 Mar 2017 15:06:39 +0800
Subject: [PATCH 06/46] Bug 1346235 - part 4: recycle unpopulated input
 samples. r=jchen

MozReview-Commit-ID: Lr0aSQ0OfRg

--HG--
extra : rebase_source : 71f37d29c5d3a08e63171956fa5a02e716bcec0a
---
 .../java/org/mozilla/gecko/media/Codec.java   | 22 +++++++---
 .../org/mozilla/gecko/media/CodecProxy.java   | 44 +++++++++++--------
 2 files changed, 40 insertions(+), 26 deletions(-)

diff --git a/mobile/android/base/java/org/mozilla/gecko/media/Codec.java b/mobile/android/base/java/org/mozilla/gecko/media/Codec.java
index 58deb8ebfb7b..fa9b8ecaa3b2 100644
--- a/mobile/android/base/java/org/mozilla/gecko/media/Codec.java
+++ b/mobile/android/base/java/org/mozilla/gecko/media/Codec.java
@@ -66,18 +66,26 @@ import java.util.concurrent.ConcurrentLinkedQueue;
 
         private synchronized void onSample(Sample sample) {
             if (sample == null) {
-                Log.w(LOGTAG, "WARN: null input sample");
+                // Ignore empty input.
+                mSamplePool.recycleInput(mDequeuedSamples.remove());
+                Log.w(LOGTAG, "WARN: empty input sample");
                 return;
             }
 
-            if (!sample.isEOS()) {
-                Sample temp = sample;
-                sample = mDequeuedSamples.remove();
-                sample.info = temp.info;
-                sample.cryptoInfo = temp.cryptoInfo;
-                temp.dispose();
+            if (sample.isEOS()) {
+                queueSample(sample);
+                return;
             }
 
+            Sample dequeued = mDequeuedSamples.remove();
+            dequeued.info = sample.info;
+            dequeued.cryptoInfo = sample.cryptoInfo;
+            queueSample(dequeued);
+
+            sample.dispose();
+        }
+
+        private void queueSample(Sample sample) {
             if (!mInputSamples.offer(sample)) {
                 reportError(Error.FATAL, new Exception("FAIL: input sample queue is full"));
                 return;
diff --git a/mobile/android/base/java/org/mozilla/gecko/media/CodecProxy.java b/mobile/android/base/java/org/mozilla/gecko/media/CodecProxy.java
index b3d95015725d..765689325d17 100644
--- a/mobile/android/base/java/org/mozilla/gecko/media/CodecProxy.java
+++ b/mobile/android/base/java/org/mozilla/gecko/media/CodecProxy.java
@@ -170,34 +170,40 @@ public final class CodecProxy {
             Log.e(LOGTAG, "cannot send input to an ended codec");
             return false;
         }
+
+        boolean eos = info.flags == MediaCodec.BUFFER_FLAG_END_OF_STREAM;
+        mCallbacks.setEndOfInput(eos);
+
+        if (eos) {
+            return sendInput(Sample.EOS);
+        }
+
+        try {
+            return sendInput(mRemote.dequeueInput(info.size).set(bytes, info, cryptoInfo));
+        } catch (RemoteException e) {
+            Log.e(LOGTAG, "fail to dequeue input buffer", e);
+            return false;
+        } catch (IOException e) {
+            Log.e(LOGTAG, "fail to copy input data.", e);
+            // Balance dequeue/queue.
+            return sendInput(null);
+        }
+    }
+
+    private boolean sendInput(Sample sample) {
         try {
-            Sample sample = processInput(bytes, info, cryptoInfo);
-            if (sample == null) {
-                return false;
-            }
             mRemote.queueInput(sample);
-            sample.dispose();
+            if (sample != null) {
+                sample.dispose();
+            }
         } catch (Exception e) {
-            Log.e(LOGTAG, "fail to input sample: size=" + info.size +
-                    ", pts=" + info.presentationTimeUs +
-                    ", flags=" + Integer.toHexString(info.flags), e);
+            Log.e(LOGTAG, "fail to queue input:" + sample, e);
             return false;
         }
 
         return true;
     }
 
-    private Sample processInput(ByteBuffer bytes, BufferInfo info, CryptoInfo cryptoInfo)
-            throws RemoteException, IOException {
-        if (info.flags == MediaCodec.BUFFER_FLAG_END_OF_STREAM) {
-            mCallbacks.setEndOfInput(true);
-            return Sample.EOS;
-        } else {
-            mCallbacks.setEndOfInput(false);
-            return mRemote.dequeueInput(info.size).set(bytes, info, cryptoInfo);
-        }
-    }
-
     @WrapForJNI
     public synchronized boolean flush() {
         if (mRemote == null) {

From 390a075c262c4ff1e050339b2635d36f6933638d Mon Sep 17 00:00:00 2001
From: Frederik Braun <fbraun+gh@mozilla.com>
Date: Mon, 30 Jan 2017 14:09:37 +0100
Subject: [PATCH 07/46] Bug 1073952: inherit CSP into iframe sandbox srcdoc
 r=ckerschb,Tomcat

MozReview-Commit-ID: 3fhWCGwgG4A

--HG--
extra : rebase_source : 7e84fafe0ef69b7f6695de825fc254ee0e4209ba
---
 caps/BasePrincipal.cpp           | 15 +++++++++++++++
 caps/BasePrincipal.h             |  1 +
 caps/nsIPrincipal.idl            |  5 +++--
 caps/nsNullPrincipal.cpp         | 14 ++++++++++++++
 caps/nsNullPrincipal.h           |  1 +
 caps/nsScriptSecurityManager.cpp | 26 +++++++++++++++++++++++++-
 caps/nsSystemPrincipal.cpp       | 11 ++++++++++-
 caps/nsSystemPrincipal.h         |  1 +
 8 files changed, 70 insertions(+), 4 deletions(-)

diff --git a/caps/BasePrincipal.cpp b/caps/BasePrincipal.cpp
index b00ce460c26b..466e4994cd0b 100644
--- a/caps/BasePrincipal.cpp
+++ b/caps/BasePrincipal.cpp
@@ -442,6 +442,21 @@ BasePrincipal::GetCsp(nsIContentSecurityPolicy** aCsp)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+BasePrincipal::SetCsp(nsIContentSecurityPolicy* aCsp)
+{
+  // Never destroy an existing CSP on the principal.
+  // This method should only be called in rare cases.
+
+  MOZ_ASSERT(!mCSP, "do not destroy an existing CSP");
+  if (mCSP) {
+    return NS_ERROR_ALREADY_INITIALIZED;
+  }
+
+  mCSP = aCsp;
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 BasePrincipal::EnsureCSP(nsIDOMDocument* aDocument,
                          nsIContentSecurityPolicy** aCSP)
diff --git a/caps/BasePrincipal.h b/caps/BasePrincipal.h
index 7391e8b468bf..537b1a8e51e9 100644
--- a/caps/BasePrincipal.h
+++ b/caps/BasePrincipal.h
@@ -222,6 +222,7 @@ public:
   NS_IMETHOD SubsumesConsideringDomainIgnoringFPD(nsIPrincipal* other, bool* _retval) final;
   NS_IMETHOD CheckMayLoad(nsIURI* uri, bool report, bool allowIfInheritsPrincipal) final;
   NS_IMETHOD GetCsp(nsIContentSecurityPolicy** aCsp) override;
+  NS_IMETHOD SetCsp(nsIContentSecurityPolicy* aCsp) override;
   NS_IMETHOD EnsureCSP(nsIDOMDocument* aDocument, nsIContentSecurityPolicy** aCSP) override;
   NS_IMETHOD GetPreloadCsp(nsIContentSecurityPolicy** aPreloadCSP) override;
   NS_IMETHOD EnsurePreloadCSP(nsIDOMDocument* aDocument, nsIContentSecurityPolicy** aCSP) override;
diff --git a/caps/nsIPrincipal.idl b/caps/nsIPrincipal.idl
index 16aceafeff7d..870792527813 100644
--- a/caps/nsIPrincipal.idl
+++ b/caps/nsIPrincipal.idl
@@ -151,10 +151,11 @@ interface nsIPrincipal : nsISerializable
 
     /**
      * A Content Security Policy associated with this principal.
-     *
      * Use this function to query the associated CSP with this principal.
+     * Please *only* use this function to *set* a CSP when you know exactly what you are doing.
+     * Most likely you want to call ensureCSP instead of setCSP.
      */
-    [noscript] readonly attribute nsIContentSecurityPolicy csp;
+    [noscript] attribute nsIContentSecurityPolicy csp;
 
     /*
      * Use this function to query a CSP associated with this principal.
diff --git a/caps/nsNullPrincipal.cpp b/caps/nsNullPrincipal.cpp
index 8ab0bd27c91a..fe846ac25b0c 100644
--- a/caps/nsNullPrincipal.cpp
+++ b/caps/nsNullPrincipal.cpp
@@ -108,6 +108,20 @@ nsNullPrincipal::GetHashValue(uint32_t *aResult)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsNullPrincipal::SetCsp(nsIContentSecurityPolicy* aCsp) {
+  // Never destroy an existing CSP on the principal.
+  // This method should only be called in rare cases.
+
+  MOZ_ASSERT(!mCSP, "do not destroy an existing CSP");
+  if (mCSP) {
+    return NS_ERROR_ALREADY_INITIALIZED;
+  }
+
+  mCSP = aCsp;
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsNullPrincipal::GetURI(nsIURI** aURI)
 {
diff --git a/caps/nsNullPrincipal.h b/caps/nsNullPrincipal.h
index ad3345d74741..653029258f4b 100644
--- a/caps/nsNullPrincipal.h
+++ b/caps/nsNullPrincipal.h
@@ -45,6 +45,7 @@ public:
 
   NS_IMETHOD QueryInterface(REFNSIID aIID, void** aInstancePtr) override;
   NS_IMETHOD GetHashValue(uint32_t* aHashValue) override;
+  NS_IMETHOD SetCsp(nsIContentSecurityPolicy* aCsp) override;
   NS_IMETHOD GetURI(nsIURI** aURI) override;
   NS_IMETHOD GetDomain(nsIURI** aDomain) override;
   NS_IMETHOD SetDomain(nsIURI* aDomain) override;
diff --git a/caps/nsScriptSecurityManager.cpp b/caps/nsScriptSecurityManager.cpp
index 2135af2da087..d6176f9e32b6 100644
--- a/caps/nsScriptSecurityManager.cpp
+++ b/caps/nsScriptSecurityManager.cpp
@@ -294,6 +294,30 @@ nsScriptSecurityManager::GetChannelResultPrincipal(nsIChannel* aChannel,
         if (!aIgnoreSandboxing && loadInfo->GetLoadingSandboxed()) {
           MOZ_ALWAYS_TRUE(NS_SUCCEEDED(loadInfo->GetSandboxedLoadingPrincipal(aPrincipal)));
           MOZ_ASSERT(*aPrincipal);
+            // if the new NullPrincipal (above) loads an iframe[srcdoc], we
+            // need to inherit an existing CSP to avoid bypasses (bug 1073952).
+            // We continue inheriting for nested frames with e.g., data: URLs.
+            if (loadInfo->GetExternalContentPolicyType() == nsIContentPolicy::TYPE_SUBDOCUMENT) {
+              nsCOMPtr<nsIURI> uri;
+              aChannel->GetURI(getter_AddRefs(uri));
+              nsAutoCString URISpec;
+              uri->GetSpec(URISpec);
+              bool isData = (NS_SUCCEEDED(uri->SchemeIs("data", &isData)) && isData);
+              if (URISpec.EqualsLiteral("about:srcdoc") || isData) {
+                nsCOMPtr<nsIPrincipal> principalToInherit = loadInfo->PrincipalToInherit();
+                if (!principalToInherit) {
+                  principalToInherit = loadInfo->TriggeringPrincipal();
+                }
+                nsCOMPtr<nsIContentSecurityPolicy> originalCsp;
+                principalToInherit->GetCsp(getter_AddRefs(originalCsp));
+                // if the principalToInherit had a CSP,
+                // add it to the newly created NullPrincipal.
+                if (originalCsp) {
+                  nsresult rv = (*aPrincipal)->SetCsp(originalCsp);
+                  NS_ENSURE_SUCCESS(rv, rv);
+                }
+              }
+            }
           return NS_OK;
         }
 
@@ -325,7 +349,7 @@ nsScriptSecurityManager::GetChannelResultPrincipal(nsIChannel* aChannel,
 
             nsCOMPtr<nsIURI> uri;
             nsresult rv = NS_GetFinalChannelURI(aChannel, getter_AddRefs(uri));
-            NS_ENSURE_SUCCESS(rv, rv); 
+            NS_ENSURE_SUCCESS(rv, rv);
             nsCOMPtr<nsIPrincipal> principalToInherit = loadInfo->PrincipalToInherit();
             if (!principalToInherit) {
               principalToInherit = loadInfo->TriggeringPrincipal();
diff --git a/caps/nsSystemPrincipal.cpp b/caps/nsSystemPrincipal.cpp
index 94cbeecc29a5..b1c33553ac8d 100644
--- a/caps/nsSystemPrincipal.cpp
+++ b/caps/nsSystemPrincipal.cpp
@@ -57,7 +57,7 @@ nsSystemPrincipal::GetHashValue(uint32_t *result)
     return NS_OK;
 }
 
-NS_IMETHODIMP 
+NS_IMETHODIMP
 nsSystemPrincipal::GetURI(nsIURI** aURI)
 {
     *aURI = nullptr;
@@ -78,6 +78,15 @@ nsSystemPrincipal::GetCsp(nsIContentSecurityPolicy** aCsp)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsSystemPrincipal::SetCsp(nsIContentSecurityPolicy* aCsp)
+{
+  // Never destroy an existing CSP on the principal.
+  // This method should only be called in rare cases.
+
+  return NS_ERROR_FAILURE;
+}
+
 NS_IMETHODIMP
 nsSystemPrincipal::EnsureCSP(nsIDOMDocument* aDocument,
                              nsIContentSecurityPolicy** aCSP)
diff --git a/caps/nsSystemPrincipal.h b/caps/nsSystemPrincipal.h
index 2dd6a0f58ef1..0e67ce45e490 100644
--- a/caps/nsSystemPrincipal.h
+++ b/caps/nsSystemPrincipal.h
@@ -37,6 +37,7 @@ public:
   NS_IMETHOD GetDomain(nsIURI** aDomain) override;
   NS_IMETHOD SetDomain(nsIURI* aDomain) override;
   NS_IMETHOD GetCsp(nsIContentSecurityPolicy** aCsp) override;
+  NS_IMETHOD SetCsp(nsIContentSecurityPolicy* aCsp) override;
   NS_IMETHOD EnsureCSP(nsIDOMDocument* aDocument, nsIContentSecurityPolicy** aCSP) override;
   NS_IMETHOD GetPreloadCsp(nsIContentSecurityPolicy** aPreloadCSP) override;
   NS_IMETHOD EnsurePreloadCSP(nsIDOMDocument* aDocument, nsIContentSecurityPolicy** aCSP) override;

From 56207a1b8b410c71ab236363ec16b22eae7e078a Mon Sep 17 00:00:00 2001
From: Frederik Braun <fbraun+gh@mozilla.com>
Date: Mon, 30 Jan 2017 14:12:15 +0100
Subject: [PATCH 08/46] Bug 1073952: tests for iframe sandbox srcdoc and data
 URIs with CSP r=ckerschb,Tomcat

MozReview-Commit-ID: 5Q8XIJPrRPk

--HG--
extra : rebase_source : 391431d3585173d096ab58747a854542dfd3adca
---
 .../test/csp/file_iframe_sandbox_srcdoc.html  |  11 ++
 .../file_iframe_sandbox_srcdoc.html^headers^  |   1 +
 dom/security/test/csp/file_iframe_srcdoc.sjs  |  79 ++++++++++
 dom/security/test/csp/mochitest.ini           |   5 +
 .../test/csp/test_iframe_sandbox_srcdoc.html  |  62 ++++++++
 dom/security/test/csp/test_iframe_srcdoc.html | 140 ++++++++++++++++++
 6 files changed, 298 insertions(+)
 create mode 100644 dom/security/test/csp/file_iframe_sandbox_srcdoc.html
 create mode 100644 dom/security/test/csp/file_iframe_sandbox_srcdoc.html^headers^
 create mode 100644 dom/security/test/csp/file_iframe_srcdoc.sjs
 create mode 100644 dom/security/test/csp/test_iframe_sandbox_srcdoc.html
 create mode 100644 dom/security/test/csp/test_iframe_srcdoc.html

diff --git a/dom/security/test/csp/file_iframe_sandbox_srcdoc.html b/dom/security/test/csp/file_iframe_sandbox_srcdoc.html
new file mode 100644
index 000000000000..bc700ed68fb3
--- /dev/null
+++ b/dom/security/test/csp/file_iframe_sandbox_srcdoc.html
@@ -0,0 +1,11 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Bug 1073952 - CSP should restrict scripts in srcdoc iframe even if sandboxed</title>
+</head>
+<body>
+<iframe srcdoc="<img src=x onerror='parent.postMessage({result: `unexpected-csp-violation`}, `*`);'>"
+        sandbox="allow-scripts"></iframe>
+</body>
+</html>
diff --git a/dom/security/test/csp/file_iframe_sandbox_srcdoc.html^headers^ b/dom/security/test/csp/file_iframe_sandbox_srcdoc.html^headers^
new file mode 100644
index 000000000000..cf869e07d402
--- /dev/null
+++ b/dom/security/test/csp/file_iframe_sandbox_srcdoc.html^headers^
@@ -0,0 +1 @@
+content-security-policy: default-src *;
diff --git a/dom/security/test/csp/file_iframe_srcdoc.sjs b/dom/security/test/csp/file_iframe_srcdoc.sjs
new file mode 100644
index 000000000000..6de8a029ef1b
--- /dev/null
+++ b/dom/security/test/csp/file_iframe_srcdoc.sjs
@@ -0,0 +1,79 @@
+// Custom *.sjs file specifically for the needs of
+// https://bugzilla.mozilla.org/show_bug.cgi?id=1073952
+
+"use strict";
+Components.utils.importGlobalProperties(["URLSearchParams"]);
+
+const SCRIPT = `
+  <script>
+    parent.parent.postMessage({result: &quot;allowed&quot;}, &quot;*&quot;);
+  </script>`;
+
+const SIMPLE_IFRAME_SRCDOC = `
+  <!DOCTYPE html>
+  <html>
+  <head><meta charset="utf-8"></head>
+  <body>
+    <iframe sandbox="allow-scripts" srcdoc="` + SCRIPT + `"></iframe>
+  </body>
+  </html>`;
+
+const INNER_SRCDOC_IFRAME = `
+  <iframe sandbox='allow-scripts' srcdoc='<script>
+      parent.parent.parent.postMessage({result: &quot;allowed&quot;}, &quot;*&quot;);
+    </script>'>
+  </iframe>`;
+
+const NESTED_IFRAME_SRCDOC = `
+  <!DOCTYPE html>
+  <html>
+  <head><meta charset="utf-8"></head>
+  <body>
+    <iframe sandbox="allow-scripts" srcdoc="` + INNER_SRCDOC_IFRAME + `"></iframe>
+  </body>
+  </html>`;
+
+
+const INNER_DATAURI_IFRAME = `
+  <iframe sandbox='allow-scripts' src='data:text/html,<script>
+      parent.parent.parent.postMessage({result: &quot;allowed&quot;}, &quot;*&quot;);
+    </script>'>
+  </iframe>`;
+
+const NESTED_IFRAME_SRCDOC_DATAURI = `
+  <!DOCTYPE html>
+  <html>
+  <head><meta charset="utf-8"></head>
+  <body>
+    <iframe sandbox="allow-scripts" srcdoc="` + INNER_DATAURI_IFRAME + `"></iframe>
+  </body>
+  </html>`;
+
+function handleRequest(request, response) {
+  const query = new URLSearchParams(request.queryString);
+
+  response.setHeader("Cache-Control", "no-cache", false);
+  if (typeof query.get("csp") === "string") {
+    response.setHeader("Content-Security-Policy", query.get("csp"), false);
+  }
+  response.setHeader("Content-Type", "text/html", false);
+
+  if (query.get("action") === "simple_iframe_srcdoc") {
+    response.write(SIMPLE_IFRAME_SRCDOC);
+    return;
+  }
+
+  if (query.get("action") === "nested_iframe_srcdoc") {
+    response.write(NESTED_IFRAME_SRCDOC);
+    return;
+  }
+
+  if (query.get("action") === "nested_iframe_srcdoc_datauri") {
+    response.write(NESTED_IFRAME_SRCDOC_DATAURI);
+    return;
+  }
+
+  // we should never get here, but just in case
+  // return something unexpected
+  response.write("do'h");
+}
diff --git a/dom/security/test/csp/mochitest.ini b/dom/security/test/csp/mochitest.ini
index 58ac777ea5d7..4d3e02b67cd8 100644
--- a/dom/security/test/csp/mochitest.ini
+++ b/dom/security/test/csp/mochitest.ini
@@ -205,6 +205,9 @@ support-files =
   file_upgrade_insecure_navigation.sjs
   file_punycode_host_src.sjs
   file_punycode_host_src.js
+  file_iframe_srcdoc.sjs
+  file_iframe_sandbox_srcdoc.html
+  file_iframe_sandbox_srcdoc.html^headers^
 
 [test_base-uri.html]
 [test_blob_data_schemes.html]
@@ -293,3 +296,5 @@ tags = mcb
 [test_strict_dynamic_default_src.html]
 [test_upgrade_insecure_navigation.html]
 [test_punycode_host_src.html]
+[test_iframe_sandbox_srcdoc.html]
+[test_iframe_srcdoc.html]
diff --git a/dom/security/test/csp/test_iframe_sandbox_srcdoc.html b/dom/security/test/csp/test_iframe_sandbox_srcdoc.html
new file mode 100644
index 000000000000..53beafcacd9c
--- /dev/null
+++ b/dom/security/test/csp/test_iframe_sandbox_srcdoc.html
@@ -0,0 +1,62 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Bug 1073952 - CSP should restrict scripts in srcdoc iframe even if sandboxed</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<p id="display">Bug 1073952</p>
+<iframe style="width:200px;height:200px;" id='cspframe'></iframe>
+<script class="testbody" type="text/javascript">
+
+// This is used to watch the blocked data bounce off CSP and allowed data
+// get sent out to the wire.
+function examiner() {
+  SpecialPowers.addObserver(this, "csp-on-violate-policy", false);
+}
+
+examiner.prototype  = {
+  observe: function(subject, topic, data) {
+
+    if(topic === "csp-on-violate-policy") {
+      var violationString = SpecialPowers.getPrivilegedProps(SpecialPowers.
+                             do_QueryInterface(subject, "nsISupportsCString"), "data");
+      // the violation subject for inline script violations is unfortunately vague,
+      // all we can do is match the string.
+      if (!violationString.includes("Inline Script")) {
+        return
+      }
+      ok(true, "CSP inherited into sandboxed srcdoc iframe, script blocked.");
+      window.testFinished();
+    }
+  },
+
+  // must eventually call this to remove the listener,
+  // or mochitests might get borked.
+  remove: function() {
+    SpecialPowers.removeObserver(this, "csp-on-violate-policy");
+  }
+}
+
+window.examiner = new examiner();
+
+function testFinished() {
+  window.examiner.remove();
+  SimpleTest.finish();
+}
+
+addEventListener("message", function(e) {
+  ok(false, "We should not execute JS in srcdoc iframe.");
+  window.testFinished();
+})
+SimpleTest.waitForExplicitFinish();
+
+// save this for last so that our listeners are registered.
+// ... this loads the testbed of good and bad requests.
+document.getElementById('cspframe').src = 'file_iframe_sandbox_srcdoc.html';
+
+</script>
+</body>
+</html>
diff --git a/dom/security/test/csp/test_iframe_srcdoc.html b/dom/security/test/csp/test_iframe_srcdoc.html
new file mode 100644
index 000000000000..95b924a5e387
--- /dev/null
+++ b/dom/security/test/csp/test_iframe_srcdoc.html
@@ -0,0 +1,140 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Bug 1073952 - Test CSP enforcement within iframe srcdoc</title>
+  <!-- Including SimpleTest.js so we can use waitForExplicitFinish !-->
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<iframe style="width:100%;" id="testframe"></iframe>
+
+<script class="testbody" type="text/javascript">
+
+/*
+ * Description of the test:
+ * (1) We serve a site which makes use of script-allowed sandboxed iframe srcdoc
+ *     and make sure that CSP applies to the nested browsing context
+ *     within the iframe.
+ *     [PAGE WITH CSP [IFRAME SANDBOX SRCDOC [SCRIPT]]]
+ *
+ * (2) We serve a site which nests script within an script-allowed sandboxed
+ *     iframe srcdoc within another script-allowed sandboxed iframe srcdoc and
+ *     make sure that CSP applies to the nested browsing context
+ *     within the iframe*s*.
+ *     [PAGE WITH CSP [IFRAME SANDBOX SRCDOC [IFRAME SANDBOX SRCDOC [SCRIPT]]]]
+ *
+ * Please note that the test relies on the "csp-on-violate-policy" observer.
+ * Whenever the script within the iframe is blocked observers are notified.
+ * In turn, this renders the 'result' within tests[] unused. In case the script
+ * would execute however, the postMessageHandler would bubble up 'allowed' and
+ * the test would fail.
+ */
+
+SimpleTest.waitForExplicitFinish();
+
+var tests = [
+  // [PAGE *WITHOUT* CSP [IFRAME SRCDOC [SCRIPT]]]
+  { csp: "",
+    result: "allowed",
+    query: "simple_iframe_srcdoc",
+    desc: "No CSP should run script within script-allowed sandboxed iframe srcdoc"
+  },
+  { csp: "script-src https://test1.com",
+    result: "blocked",
+    query: "simple_iframe_srcdoc",
+    desc: "CSP should block script within script-allowed sandboxediframe srcdoc"
+  },
+  // [PAGE *WITHOUT* CSP [IFRAME SRCDOC [IFRAME SRCDOC [SCRIPT]]]]
+  { csp: "",
+    result: "allowed",
+    query: "nested_iframe_srcdoc",
+    desc: "No CSP should run script within script-allowed sandboxed iframe srcdoc nested within another script-allowed sandboxed iframe srcdoc"
+  },
+  // [PAGE WITH CSP [IFRAME SRCDOC ]]
+  { csp: "script-src https://test2.com",
+    result: "blocked",
+    query: "nested_iframe_srcdoc",
+    desc: "CSP should block script within script-allowed sandboxed iframe srcdoc nested within another script-allowed sandboxed iframe srcdoc"
+  },
+  { csp: "",
+    result: "allowed",
+    query: "nested_iframe_srcdoc_datauri",
+    desc: "No CSP, should run script within script-allowed sandboxed iframe src with data URL nested within another script-allowed sandboxed iframe srcdoc"
+  },
+  { csp: "script-src https://test3.com",
+    result: "blocked",
+    query: "nested_iframe_srcdoc_datauri",
+    desc: "CSP should block script within script-allowed sandboxed iframe src with data URL nested within another script-allowed sandboxed iframe srcdoc"
+  },
+
+];
+
+// initializing to -1 so we start at index 0 when we start the test
+var counter = -1;
+
+function finishTest() {
+  window.removeEventListener("message", receiveMessage, false);
+  window.examiner.remove();
+  SimpleTest.finish();
+}
+
+window.addEventListener("message", receiveMessage, false);
+function receiveMessage(event) {
+  var result = event.data.result;
+  testComplete(result, tests[counter].result, tests[counter].desc);
+}
+
+function examiner() {
+  SpecialPowers.addObserver(this, "csp-on-violate-policy", false);
+}
+
+examiner.prototype  = {
+  observe: function(subject, topic, data) {
+    if (topic === "csp-on-violate-policy") {
+      var violationString = SpecialPowers.getPrivilegedProps(SpecialPowers.
+                             do_QueryInterface(subject, "nsISupportsCString"), "data");
+      // the violation subject for inline script violations is unfortunately vague,
+      // all we can do is match the string.
+      if (!violationString.includes("Inline Script")) {
+        return
+      }
+      testComplete("blocked", tests[counter].result, tests[counter].desc);
+    }
+  },
+  remove: function() {
+    SpecialPowers.removeObserver(this, "csp-on-violate-policy");
+  }
+}
+
+function testComplete(result, expected, desc) {
+  is(result, expected, desc);
+  // ignore cases when we get csp violations and postMessage from  the same frame.
+  var frameURL = new URL(document.getElementById("testframe").src);
+  var params = new URLSearchParams(frameURL.search);
+  var counterInFrame = params.get("counter");
+  if (counterInFrame == counter) {
+    loadNextTest();
+  }
+}
+
+function loadNextTest() {
+  counter++;
+  if (counter == tests.length) {
+    finishTest();
+    return;
+  }
+  var src = "file_iframe_srcdoc.sjs";
+  src += "?csp=" + escape(tests[counter].csp);
+  src += "&action=" + escape(tests[counter].query);
+  src += "&counter=" + counter;
+  document.getElementById("testframe").src = src;
+}
+
+// start running the tests
+window.examiner = new examiner();
+loadNextTest();
+
+</script>
+</body>
+</html>

From 622080220c2b15ff323e9b1e0b1f79807f09d0ba Mon Sep 17 00:00:00 2001
From: Frederik Braun <fbraun+gh@mozilla.com>
Date: Mon, 30 Jan 2017 14:13:13 +0100
Subject: [PATCH 09/46] Bug 1073952: proper indentation for
 nsScriptSecurityManager::GetChannelResultPrincipal r=Tomcat

MozReview-Commit-ID: 84qywpARPwI

--HG--
extra : rebase_source : fd0bc97039e95d93ba0eb7688ef3e1571ef1bba3
---
 caps/nsScriptSecurityManager.cpp | 126 +++++++++++++++----------------
 1 file changed, 63 insertions(+), 63 deletions(-)

diff --git a/caps/nsScriptSecurityManager.cpp b/caps/nsScriptSecurityManager.cpp
index d6176f9e32b6..a3874ab22ce0 100644
--- a/caps/nsScriptSecurityManager.cpp
+++ b/caps/nsScriptSecurityManager.cpp
@@ -269,28 +269,28 @@ nsScriptSecurityManager::GetChannelResultPrincipal(nsIChannel* aChannel,
                                                    nsIPrincipal** aPrincipal,
                                                    bool aIgnoreSandboxing)
 {
-    NS_PRECONDITION(aChannel, "Must have channel!");
-    // Check whether we have an nsILoadInfo that says what we should do.
-    nsCOMPtr<nsILoadInfo> loadInfo = aChannel->GetLoadInfo();
-    if (loadInfo && loadInfo->GetForceInheritPrincipalOverruleOwner()) {
-      nsCOMPtr<nsIPrincipal> principalToInherit = loadInfo->PrincipalToInherit();
-      if (!principalToInherit) {
-        principalToInherit = loadInfo->TriggeringPrincipal();
-      }
-      principalToInherit.forget(aPrincipal);
+  NS_PRECONDITION(aChannel, "Must have channel!");
+  // Check whether we have an nsILoadInfo that says what we should do.
+  nsCOMPtr<nsILoadInfo> loadInfo = aChannel->GetLoadInfo();
+  if (loadInfo && loadInfo->GetForceInheritPrincipalOverruleOwner()) {
+    nsCOMPtr<nsIPrincipal> principalToInherit = loadInfo->PrincipalToInherit();
+    if (!principalToInherit) {
+      principalToInherit = loadInfo->TriggeringPrincipal();
+    }
+    principalToInherit.forget(aPrincipal);
+    return NS_OK;
+  }
+
+  nsCOMPtr<nsISupports> owner;
+  aChannel->GetOwner(getter_AddRefs(owner));
+  if (owner) {
+    CallQueryInterface(owner, aPrincipal);
+    if (*aPrincipal) {
       return NS_OK;
     }
+  }
 
-    nsCOMPtr<nsISupports> owner;
-    aChannel->GetOwner(getter_AddRefs(owner));
-    if (owner) {
-        CallQueryInterface(owner, aPrincipal);
-        if (*aPrincipal) {
-            return NS_OK;
-        }
-    }
-
-    if (loadInfo) {
+  if (loadInfo) {
         if (!aIgnoreSandboxing && loadInfo->GetLoadingSandboxed()) {
           MOZ_ALWAYS_TRUE(NS_SUCCEEDED(loadInfo->GetSandboxedLoadingPrincipal(aPrincipal)));
           MOZ_ASSERT(*aPrincipal);
@@ -321,51 +321,51 @@ nsScriptSecurityManager::GetChannelResultPrincipal(nsIChannel* aChannel,
           return NS_OK;
         }
 
-        bool forceInherit = loadInfo->GetForceInheritPrincipal();
-        if (aIgnoreSandboxing && !forceInherit) {
-          // Check if SEC_FORCE_INHERIT_PRINCIPAL was dropped because of
-          // sandboxing:
-          if (loadInfo->GetLoadingSandboxed() &&
-              loadInfo->GetForceInheritPrincipalDropped()) {
-            forceInherit = true;
-          }
-        }
-        if (forceInherit) {
-            nsCOMPtr<nsIPrincipal> principalToInherit = loadInfo->PrincipalToInherit();
-            if (!principalToInherit) {
-              principalToInherit = loadInfo->TriggeringPrincipal();
-            }
-            principalToInherit.forget(aPrincipal);
-            return NS_OK;
-        }
-
-        nsSecurityFlags securityFlags = loadInfo->GetSecurityMode();
-        // The data: inheritance flags should only apply to the initial load,
-        // not to loads that it might have redirected to.
-        if (loadInfo->RedirectChain().IsEmpty() &&
-            (securityFlags == nsILoadInfo::SEC_REQUIRE_SAME_ORIGIN_DATA_INHERITS ||
-             securityFlags == nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_INHERITS ||
-             securityFlags == nsILoadInfo::SEC_REQUIRE_CORS_DATA_INHERITS)) {
-
-            nsCOMPtr<nsIURI> uri;
-            nsresult rv = NS_GetFinalChannelURI(aChannel, getter_AddRefs(uri));
-            NS_ENSURE_SUCCESS(rv, rv);
-            nsCOMPtr<nsIPrincipal> principalToInherit = loadInfo->PrincipalToInherit();
-            if (!principalToInherit) {
-              principalToInherit = loadInfo->TriggeringPrincipal();
-            }
-            bool inheritForAboutBlank = loadInfo->GetAboutBlankInherits();
-
-            if (nsContentUtils::ChannelShouldInheritPrincipal(principalToInherit,
-                                                              uri,
-                                                              inheritForAboutBlank,
-                                                              false)) {
-                principalToInherit.forget(aPrincipal);
-                return NS_OK;
-            }
-        }
+    bool forceInherit = loadInfo->GetForceInheritPrincipal();
+    if (aIgnoreSandboxing && !forceInherit) {
+      // Check if SEC_FORCE_INHERIT_PRINCIPAL was dropped because of
+      // sandboxing:
+      if (loadInfo->GetLoadingSandboxed() &&
+        loadInfo->GetForceInheritPrincipalDropped()) {
+        forceInherit = true;
+      }
     }
-    return GetChannelURIPrincipal(aChannel, aPrincipal);
+    if (forceInherit) {
+      nsCOMPtr<nsIPrincipal> principalToInherit = loadInfo->PrincipalToInherit();
+      if (!principalToInherit) {
+        principalToInherit = loadInfo->TriggeringPrincipal();
+      }
+      principalToInherit.forget(aPrincipal);
+      return NS_OK;
+    }
+
+    nsSecurityFlags securityFlags = loadInfo->GetSecurityMode();
+    // The data: inheritance flags should only apply to the initial load,
+    // not to loads that it might have redirected to.
+    if (loadInfo->RedirectChain().IsEmpty() &&
+        (securityFlags == nsILoadInfo::SEC_REQUIRE_SAME_ORIGIN_DATA_INHERITS ||
+         securityFlags == nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_INHERITS ||
+         securityFlags == nsILoadInfo::SEC_REQUIRE_CORS_DATA_INHERITS)) {
+
+      nsCOMPtr<nsIURI> uri;
+      nsresult rv = NS_GetFinalChannelURI(aChannel, getter_AddRefs(uri));
+      NS_ENSURE_SUCCESS(rv, rv);
+      nsCOMPtr<nsIPrincipal> principalToInherit = loadInfo->PrincipalToInherit();
+      if (!principalToInherit) {
+        principalToInherit = loadInfo->TriggeringPrincipal();
+      }
+      bool inheritForAboutBlank = loadInfo->GetAboutBlankInherits();
+
+      if (nsContentUtils::ChannelShouldInheritPrincipal(principalToInherit,
+                                                        uri,
+                                                        inheritForAboutBlank,
+                                                        false)) {
+        principalToInherit.forget(aPrincipal);
+        return NS_OK;
+      }
+    }
+  }
+  return GetChannelURIPrincipal(aChannel, aPrincipal);
 }
 
 /* The principal of the URI that this channel is loading. This is never

From 7e5ea646a59889f7546343f8ec51d057246d6b81 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Emilio=20Cobos=20=C3=81lvarez?= <emilio@crisal.io>
Date: Mon, 20 Mar 2017 03:43:26 -0700
Subject: [PATCH 10/46] servo: Merge #16035 - stylo: Sequentialize binding
 generation if logging is enabled (from emilio:parallel-log-no-fun); r=upsuper

Otherwise the log is useless, and it's even slower than in parallel mode due to
the high lock contention.

Source-Repo: https://github.com/servo/servo
Source-Revision: 9fdebf0934bd4fa97414756b9690a88ae63a991c

--HG--
extra : subtree_source : https%3A//hg.mozilla.org/projects/converted-servo-linear
extra : subtree_revision : 3fd4179805755770bf77025d697e7ddb7227d32c
---
 servo/components/style/build_gecko.rs | 23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/servo/components/style/build_gecko.rs b/servo/components/style/build_gecko.rs
index a217c6fe0332..15a9d06dc023 100644
--- a/servo/components/style/build_gecko.rs
+++ b/servo/components/style/build_gecko.rs
@@ -772,17 +772,22 @@ mod bindings {
 
 pub fn generate() {
     use self::common::*;
-    use std::fs;
-    use std::thread;
+    use std::{env, fs, thread};
     println!("cargo:rerun-if-changed=build_gecko.rs");
     fs::create_dir_all(&*OUTDIR_PATH).unwrap();
     bindings::setup_logging();
-    let threads = vec![
-        thread::spawn(|| bindings::generate_structs(BuildType::Debug)),
-        thread::spawn(|| bindings::generate_structs(BuildType::Release)),
-        thread::spawn(|| bindings::generate_bindings()),
-    ];
-    for t in threads.into_iter() {
-        t.join().unwrap();
+    if env::var("STYLO_BUILD_LOG").is_ok() {
+        bindings::generate_structs(BuildType::Debug);
+        bindings::generate_structs(BuildType::Release);
+        bindings::generate_bindings();
+    } else {
+        let threads = vec![
+            thread::spawn(|| bindings::generate_structs(BuildType::Debug)),
+            thread::spawn(|| bindings::generate_structs(BuildType::Release)),
+            thread::spawn(|| bindings::generate_bindings()),
+        ];
+        for t in threads.into_iter() {
+            t.join().unwrap();
+        }
     }
 }

From 405f2f52de7de5a3d9e2771c0d8a2ee937c4fe81 Mon Sep 17 00:00:00 2001
From: Thomas Nguyen <tnguyen@mozilla.com>
Date: Mon, 20 Mar 2017 14:43:08 +0800
Subject: [PATCH 11/46] Bug 1345569 - Get blocked info from content when
 clicking report false deceiptive site from xul browser. r=francois

MozReview-Commit-ID: GXkbjfOrnHX

--HG--
extra : rebase_source : 7130d656b0dfd2f0cbc64227657347efdce54036
---
 browser/base/content/browser.js               | 29 +++++++++++
 browser/base/content/content.js               | 50 +++++++++++--------
 .../base/content/report-phishing-overlay.xul  |  2 +-
 .../safebrowsing/safebrowsing.properties      |  6 +++
 browser/locales/jar.mn                        |  1 +
 .../url-classifier/SafeBrowsing.jsm           |  4 +-
 6 files changed, 70 insertions(+), 22 deletions(-)
 create mode 100644 browser/locales/en-US/chrome/browser/safebrowsing/safebrowsing.properties

diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index 5ceca60efb10..60434b687b15 100755
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -6680,6 +6680,35 @@ function BrowserOpenSyncTabs() {
   gSyncUI.openSyncedTabsPanel();
 }
 
+function ReportFalseDeceptiveSite() {
+  let docURI = gBrowser.selectedBrowser.documentURI;
+  let isPhishingPage =
+    docURI && docURI.spec.startsWith("about:blocked?e=deceptiveBlocked");
+
+  if (isPhishingPage) {
+    let mm = gBrowser.selectedBrowser.messageManager;
+    let onMessage = (message) => {
+      mm.removeMessageListener("DeceptiveBlockedDetails:Result", onMessage);
+      let reportUrl = gSafeBrowsing.getReportURL("PhishMistake", message.data.blockedInfo);
+      if (reportUrl) {
+        openUILinkIn(reportUrl, "tab");
+      } else {
+        let promptService = Cc["@mozilla.org/embedcomp/prompt-service;1"].
+                            getService(Ci.nsIPromptService);
+        let bundle =
+          Services.strings.createBundle("chrome://browser/locale/safebrowsing/safebrowsing.properties");
+        promptService.alert(window,
+                            bundle.GetStringFromName("errorReportFalseDeceptiveTitle"),
+                            bundle.formatStringFromName("errorReportFalseDeceptiveMessage",
+                                                        [message.data.blockedInfo.provider], 1));
+        }
+    }
+    mm.addMessageListener("DeceptiveBlockedDetails:Result", onMessage);
+
+    mm.sendAsyncMessage("DeceptiveBlockedDetails");
+  }
+}
+
 /**
  * Format a URL
  * eg:
diff --git a/browser/base/content/content.js b/browser/base/content/content.js
index 1be217b95de6..f34d11f9a323 100644
--- a/browser/base/content/content.js
+++ b/browser/base/content/content.js
@@ -262,6 +262,35 @@ function getSerializedSecurityInfo(docShell) {
   return serhelper.serializeToString(securityInfo);
 }
 
+function getSiteBlockedErrorDetails(docShell) {
+  let blockedInfo = {};
+  if (docShell.failedChannel) {
+    let classifiedChannel = docShell.failedChannel.
+                            QueryInterface(Ci.nsIClassifiedChannel);
+    if (classifiedChannel) {
+      let httpChannel = docShell.failedChannel.QueryInterface(Ci.nsIHttpChannel);
+
+      let reportUri = httpChannel.URI.clone();
+
+      // Remove the query to avoid leaking sensitive data
+      if (reportUri instanceof Ci.nsIURL) {
+        reportUri.query = "";
+      }
+
+      blockedInfo = { list: classifiedChannel.matchedList,
+                      provider: classifiedChannel.matchedProvider,
+                      uri: reportUri.asciiSpec };
+    }
+  }
+  return blockedInfo;
+}
+
+addMessageListener("DeceptiveBlockedDetails", (message) => {
+  sendAsyncMessage("DeceptiveBlockedDetails:Result", {
+    blockedInfo: getSiteBlockedErrorDetails(docShell),
+  });
+});
+
 var AboutNetAndCertErrorListener = {
   init(chromeGlobal) {
     addMessageListener("CertErrorDetails", this);
@@ -583,32 +612,13 @@ var ClickEventHandler = {
     let docShell = ownerDoc.defaultView.QueryInterface(Ci.nsIInterfaceRequestor)
                                        .getInterface(Ci.nsIWebNavigation)
                                       .QueryInterface(Ci.nsIDocShell);
-    let blockedInfo = {};
-    if (docShell.failedChannel) {
-      let classifiedChannel = docShell.failedChannel.
-                              QueryInterface(Ci.nsIClassifiedChannel);
-      if (classifiedChannel) {
-        let httpChannel = docShell.failedChannel.QueryInterface(Ci.nsIHttpChannel);
-
-        let reportUri = httpChannel.URI.clone();
-
-        // Remove the query to avoid leaking sensitive data
-        if (reportUri instanceof Ci.nsIURL) {
-          reportUri.query = "";
-        }
-
-        blockedInfo = { list: classifiedChannel.matchedList,
-                        provider: classifiedChannel.matchedProvider,
-                        uri: reportUri.asciiSpec };
-      }
-    }
 
     sendAsyncMessage("Browser:SiteBlockedError", {
       location: ownerDoc.location.href,
       reason,
       elementId: targetElement.getAttribute("id"),
       isTopFrame: (ownerDoc.defaultView.parent === ownerDoc.defaultView),
-      blockedInfo
+      blockedInfo: getSiteBlockedErrorDetails(docShell),
     });
   },
 
diff --git a/browser/base/content/report-phishing-overlay.xul b/browser/base/content/report-phishing-overlay.xul
index 712079f82479..112bf75a0d88 100644
--- a/browser/base/content/report-phishing-overlay.xul
+++ b/browser/base/content/report-phishing-overlay.xul
@@ -29,7 +29,7 @@
               accesskey="&safeb.palm.notdeceptive.accesskey;"
               insertbefore="aboutSeparator"
               observes="reportPhishingErrorBroadcaster"
-              oncommand="openUILinkIn(gSafeBrowsing.getReportURL('PhishMistake'), 'tab');"
+              oncommand="ReportFalseDeceptiveSite();"
               onclick="checkForMiddleClick(this, event);"/>
   </menupopup>
 </overlay>
diff --git a/browser/locales/en-US/chrome/browser/safebrowsing/safebrowsing.properties b/browser/locales/en-US/chrome/browser/safebrowsing/safebrowsing.properties
new file mode 100644
index 000000000000..aa72ddbffd14
--- /dev/null
+++ b/browser/locales/en-US/chrome/browser/safebrowsing/safebrowsing.properties
@@ -0,0 +1,6 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+errorReportFalseDeceptiveTitle=This isn’t a deceptive site
+errorReportFalseDeceptiveMessage=It’s not possible to report this error at this time.
diff --git a/browser/locales/jar.mn b/browser/locales/jar.mn
index 35fc613f4536..b1edf111714f 100644
--- a/browser/locales/jar.mn
+++ b/browser/locales/jar.mn
@@ -54,6 +54,7 @@
     locale/browser/places/moveBookmarks.dtd        (%chrome/browser/places/moveBookmarks.dtd)
     locale/browser/safebrowsing/phishing-afterload-warning-message.dtd (%chrome/browser/safebrowsing/phishing-afterload-warning-message.dtd)
     locale/browser/safebrowsing/report-phishing.dtd                    (%chrome/browser/safebrowsing/report-phishing.dtd)
+    locale/browser/safebrowsing/safebrowsing.properties   (%chrome/browser/safebrowsing/safebrowsing.properties)
     locale/browser/feeds/subscribe.dtd              (%chrome/browser/feeds/subscribe.dtd)
     locale/browser/feeds/subscribe.properties       (%chrome/browser/feeds/subscribe.properties)
     locale/browser/migration/migration.dtd         (%chrome/browser/migration/migration.dtd)
diff --git a/toolkit/components/url-classifier/SafeBrowsing.jsm b/toolkit/components/url-classifier/SafeBrowsing.jsm
index 988aab73865f..8e7bd549dc9d 100644
--- a/toolkit/components/url-classifier/SafeBrowsing.jsm
+++ b/toolkit/components/url-classifier/SafeBrowsing.jsm
@@ -155,7 +155,9 @@ this.SafeBrowsing = {
         throw err;
     }
 
-    if (!info.list || !info.uri) {
+    // The "Phish" reports are about submitting new phishing URLs to Google so
+    // they don't have an associated list URL
+    if (kind != "Phish" && (!info.list || !info.uri)) {
       return null;
     }
 

From f37b8c7128b8b9dc3ab82c0bd8386c5628fffbe8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A3o=20Gottwald?= <dao@mozilla.com>
Date: Sat, 18 Mar 2017 08:40:19 +0100
Subject: [PATCH 12/46] Bug 1348495 - Stop setting padding for .button-box on
 Linux. r=karlt

MozReview-Commit-ID: 7nh452uE5qc

--HG--
extra : rebase_source : 51d5baea48a10930d2cb066b535a31bd6f4ab460
---
 toolkit/themes/linux/global/button.css | 20 --------------------
 1 file changed, 20 deletions(-)

diff --git a/toolkit/themes/linux/global/button.css b/toolkit/themes/linux/global/button.css
index 6ed09c94ca0b..d7c1399bd0ec 100644
--- a/toolkit/themes/linux/global/button.css
+++ b/toolkit/themes/linux/global/button.css
@@ -20,10 +20,6 @@ button {
 
 .button-box {
   -moz-appearance: button-focus;
-  padding-top: 1px;
-  padding-bottom: 2px;
-  padding-inline-start: 3px;
-  padding-inline-end: 4px;
 }
 
 .button-icon {
@@ -49,15 +45,6 @@ button[checked="true"] {
   color: ButtonText;
 }
 
-button:hover:active > .button-box,
-button[open="true"] > .button-box,
-button[checked="true"] > .button-box {
-  padding-top: 2px;
-  padding-bottom: 1px;
-  padding-inline-start: 4px;
-  padding-inline-end: 3px;
-}
-
 /* .......... disabled state .......... */
 
 button[disabled="true"],
@@ -65,13 +52,6 @@ button[disabled="true"]:hover:active {
   color: GrayText;
 }
 
-button[disabled="true"] > .button-box {
-  padding-top: 1px !important;
-  padding-bottom: 2px !important;
-  padding-inline-start: 3px !important;
-  padding-inline-end: 4px !important;
-}
-
 /* ::::: menu/menu-button buttons ::::: */
 
 button[type="menu-button"] {

From e612827768aa3a2547a5eb1d5341c0d451d6fe46 Mon Sep 17 00:00:00 2001
From: "Panashe M. Fundira" <fundirap@gmail.com>
Date: Mon, 20 Mar 2017 04:23:28 -0700
Subject: [PATCH 13/46] servo: Merge #15918 - PropertyDeclaration with
 CSSWideKeyword is parsed (from munyari:whitespace); r=emilio

Addresses #15401

Source-Repo: https://github.com/servo/servo
Source-Revision: 4a63581fadd41f9a1901498e47672c59d44b5fb0

--HG--
extra : subtree_source : https%3A//hg.mozilla.org/projects/converted-servo-linear
extra : subtree_revision : 96b764da3b2d4dcefbb9d76d2b4715117443c0e0
---
 .../style/properties/properties.mako.rs       |  4 +++-
 .../unit/style/properties/serialization.rs    | 21 +++++++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/servo/components/style/properties/properties.mako.rs b/servo/components/style/properties/properties.mako.rs
index f9c2cac07b64..b2a84529f1a6 100644
--- a/servo/components/style/properties/properties.mako.rs
+++ b/servo/components/style/properties/properties.mako.rs
@@ -1175,7 +1175,9 @@ impl PropertyDeclaration {
     pub fn value_is_unparsed(&self) -> bool {
       match *self {
           PropertyDeclaration::WithVariables(..) => true,
-          PropertyDeclaration::Custom(..) => true,
+          PropertyDeclaration::Custom(_, ref value) => {
+            !matches!(value.borrow(), DeclaredValue::CSSWideKeyword(..))
+          }
           _ => false,
       }
     }
diff --git a/servo/tests/unit/style/properties/serialization.rs b/servo/tests/unit/style/properties/serialization.rs
index 962db4f63d57..218691073703 100644
--- a/servo/tests/unit/style/properties/serialization.rs
+++ b/servo/tests/unit/style/properties/serialization.rs
@@ -1130,4 +1130,25 @@ mod shorthand_serialization {
             assert_eq!(serialization, block_text);
         }
     }
+
+    mod keywords {
+        pub use super::*;
+        #[test]
+        fn css_wide_keywords_should_be_parsed() {
+            let block_text = "--a:inherit;";
+            let block = parse_declaration_block(block_text);
+
+            let serialization = block.to_css_string();
+            assert_eq!(serialization, "--a: inherit;");
+        }
+
+        #[test]
+        fn non_keyword_custom_property_should_be_unparsed() {
+            let block_text = "--main-color: #06c;";
+            let block = parse_declaration_block(block_text);
+
+            let serialization = block.to_css_string();
+            assert_eq!(serialization, block_text);
+        }
+    }
 }

From 765b21da4d89785a23bd990e7fd57fcbbe08331c Mon Sep 17 00:00:00 2001
From: Ravi Shankar <wafflespeanut@gmail.com>
Date: Mon, 20 Mar 2017 05:28:12 -0700
Subject: [PATCH 14/46] servo: Merge #16040 - Cleanup tidy (from
 Wafflespeanut:tidy); r=Manishearth

fixes #16039

Source-Repo: https://github.com/servo/servo
Source-Revision: e8b364793416465f6b4877414623dac2c52f2e6a

--HG--
extra : subtree_source : https%3A//hg.mozilla.org/projects/converted-servo-linear
extra : subtree_revision : c7241dfee8e223852f59d05b75c88fb20775963f
---
 servo/python/servo/lints/wpt_lint.py |  6 +++--
 servo/python/tidy/servo_tidy/tidy.py | 39 ++++++++++++++--------------
 2 files changed, 24 insertions(+), 21 deletions(-)

diff --git a/servo/python/servo/lints/wpt_lint.py b/servo/python/servo/lints/wpt_lint.py
index 2160e6d557d4..75c4b72f226b 100644
--- a/servo/python/servo/lints/wpt_lint.py
+++ b/servo/python/servo/lints/wpt_lint.py
@@ -8,7 +8,7 @@
 # except according to those terms.
 
 import os
-import site
+import sys
 
 from servo_tidy.tidy import LintRunner, filter_file
 
@@ -28,11 +28,13 @@ class Lint(LintRunner):
     def run(self):
         if self.stylo:
             return
+
         wpt_working_dir = os.path.abspath(os.path.join(WPT_PATH, "web-platform-tests"))
         for suite in SUITES:
             files = self._get_wpt_files(suite)
-            site.addsitedir(wpt_working_dir)
+            sys.path.insert(0, wpt_working_dir)
             from tools.lint import lint
+            sys.path.remove(wpt_working_dir)
             file_dir = os.path.abspath(os.path.join(WPT_PATH, suite))
             returncode = lint.lint(file_dir, files, output_json=False, css_mode=False)
             if returncode:
diff --git a/servo/python/tidy/servo_tidy/tidy.py b/servo/python/tidy/servo_tidy/tidy.py
index fff707a736a6..36679cf9b1f1 100644
--- a/servo/python/tidy/servo_tidy/tidy.py
+++ b/servo/python/tidy/servo_tidy/tidy.py
@@ -111,11 +111,11 @@ def progress_wrapper(iterator):
 
 
 class FileList(object):
-    def __init__(self, directory, only_changed_files=False, exclude_dirs=[], progress=True, stylo=False):
+    def __init__(self, directory, only_changed_files=False, exclude_dirs=[], progress=True):
         self.directory = directory
         self.excluded = exclude_dirs
         iterator = self._filter_excluded() if exclude_dirs else self._default_walk()
-        if only_changed_files and not stylo:
+        if only_changed_files:
             try:
                 # Fall back if git doesn't work
                 newiter = self._git_changed_files()
@@ -168,10 +168,9 @@ def filter_file(file_name):
     return True
 
 
-def filter_files(start_dir, only_changed_files, progress, stylo):
+def filter_files(start_dir, only_changed_files, progress):
     file_iter = FileList(start_dir, only_changed_files=only_changed_files,
-                         exclude_dirs=config["ignore"]["directories"], progress=progress,
-                         stylo=stylo)
+                         exclude_dirs=config["ignore"]["directories"], progress=progress)
     for file_name in file_iter:
         base_name = os.path.basename(file_name)
         if not any(fnmatch.fnmatch(base_name, pattern) for pattern in FILE_PATTERNS_TO_CHECK):
@@ -1018,20 +1017,22 @@ class LintRunner(object):
         dir_name, filename = os.path.split(self.path)
         sys.path.append(dir_name)
         module = imp.load_source(filename[:-3], self.path)
-        if hasattr(module, 'Lint'):
-            if issubclass(module.Lint, LintRunner):
-                lint = module.Lint(self.path, self.only_changed_files,
-                                   self.exclude_dirs, self.progress, stylo=self.stylo)
-                for error in lint.run():
-                    if not hasattr(error, '__iter__'):
-                        yield (self.path, 1, "errors should be a tuple of (path, line, reason)")
-                        return
-                    yield error
-            else:
-                yield (self.path, 1, "class 'Lint' should inherit from 'LintRunner'")
-        else:
-            yield (self.path, 1, "script should contain a class named 'Lint'")
         sys.path.remove(dir_name)
+        if not hasattr(module, 'Lint'):
+            yield (self.path, 1, "script should contain a class named 'Lint'")
+            return
+
+        if not issubclass(module.Lint, LintRunner):
+            yield (self.path, 1, "class 'Lint' should inherit from 'LintRunner'")
+            return
+
+        lint = module.Lint(self.path, self.only_changed_files,
+                           self.exclude_dirs, self.progress, stylo=self.stylo)
+        for error in lint.run():
+            if type(error) is not tuple or (type(error) is tuple and len(error) != 3):
+                yield (self.path, 1, "errors should be a tuple of (path, line, reason)")
+                return
+            yield error
 
     def get_files(self, path, **kwargs):
         args = ['only_changed_files', 'exclude_dirs', 'progress']
@@ -1071,7 +1072,7 @@ def scan(only_changed_files=False, progress=True, stylo=False):
     # check directories contain expected files
     directory_errors = check_directory_files(config['check_ext'])
     # standard checks
-    files_to_check = filter_files('.', only_changed_files, progress, stylo)
+    files_to_check = filter_files('.', only_changed_files and not stylo, progress)
     checking_functions = (check_flake8, check_lock, check_webidl_spec, check_json, check_yaml)
     line_checking_functions = (check_license, check_by_line, check_toml, check_shell,
                                check_rust, check_spec, check_modeline)

From ef288ed482fbd0bbb4556306798a9042c03362d1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Emilio=20Cobos=20=C3=81lvarez?= <emilio@crisal.io>
Date: Mon, 20 Mar 2017 14:27:57 +0100
Subject: [PATCH 15/46] Bug 1341102: Adjust expectations for new passes caused
 by servo/servo#15918. r=me

MozReview-Commit-ID: EY3AMreVcVG
---
 layout/style/test/stylo-failures.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/layout/style/test/stylo-failures.md b/layout/style/test/stylo-failures.md
index 604116f8abaa..2f84fe6b7528 100644
--- a/layout/style/test/stylo-failures.md
+++ b/layout/style/test/stylo-failures.md
@@ -378,7 +378,6 @@ to mochitest command.
   * background-position invalid 3-value form **issue to be filed**
     * test_shorthand_property_getters.html `should serialize to 4-value` [2]
   * test_variables.html `--weird`: name of custom property is not escaped properly servo/servo#15399 [1]
-  * ... `got "--`: CSS-wide keywords in custom properties servo/servo#15401 [3]
   * image-layer values should omit some of its parts when they are initial servo/servo#15951
     * test_shorthand_property_getters.html `background` [2]
   * counter-{reset,increment} doesn't serialize none servo/servo#15977

From 4f8d16041f6c50094666e66cc76815cedfca6a88 Mon Sep 17 00:00:00 2001
From: Thom Chiovoloni <tchiovoloni@mozilla.com>
Date: Tue, 14 Mar 2017 13:01:10 -0400
Subject: [PATCH 16/46] Bug 1342320 - Use PlacesUtils and not PlacesSyncUtils
 in sync bookmark decline/undecline test r=markh

MozReview-Commit-ID: DgbCeKgSxoE

--HG--
extra : rebase_source : d7a73f871436a3c557e3ea921439da3e6f55e13c
---
 .../sync/tests/unit/test_bookmark_decline_undecline.js | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/services/sync/tests/unit/test_bookmark_decline_undecline.js b/services/sync/tests/unit/test_bookmark_decline_undecline.js
index bcce158d8fce..b503eeee54c4 100644
--- a/services/sync/tests/unit/test_bookmark_decline_undecline.js
+++ b/services/sync/tests/unit/test_bookmark_decline_undecline.js
@@ -70,13 +70,11 @@ add_task(async function test_decline_undecline() {
   await SyncTestingInfrastructure(server);
 
   try {
-    let bzGuid = "999999999999";
-    await PlacesSyncUtils.bookmarks.insert({
-      kind: PlacesSyncUtils.bookmarks.KINDS.BOOKMARK,
-      syncId: bzGuid,
-      parentSyncId: "menu",
+    let { guid: bzGuid } = await PlacesUtils.bookmarks.insert({
+      parentGuid: PlacesUtils.bookmarks.menuGuid,
       url: "https://bugzilla.mozilla.org",
-
+      index: PlacesUtils.bookmarks.DEFAULT_INDEX,
+      title: "bugzilla",
     });
 
     ok(!getBookmarkWBO(server, bzGuid), "Shouldn't have been uploaded yet");

From bd2ab930f4a9c586b3dcd0615c40a5710dbce6ab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Emilio=20Cobos=20=C3=81lvarez?= <emilio@crisal.io>
Date: Mon, 20 Mar 2017 06:26:38 -0700
Subject: [PATCH 17/46] servo: Merge #15890 - selectors: Check the bloom filter
 at most once per complex selector (from emilio:bloom); r=heycam

Fixes https://github.com/servo/rust-selectors/issues/107

Source-Repo: https://github.com/servo/servo
Source-Revision: 4fa40c77036c0635abb6a567146a101d11521cb0

--HG--
extra : subtree_source : https%3A//hg.mozilla.org/projects/converted-servo-linear
extra : subtree_revision : 409937020b288d2b6b26e988093a03987720231e
---
 servo/components/selectors/matching.rs | 157 ++++++++++++-------------
 1 file changed, 73 insertions(+), 84 deletions(-)

diff --git a/servo/components/selectors/matching.rs b/servo/components/selectors/matching.rs
index f567b2bc7cac..e100a6f3357b 100644
--- a/servo/components/selectors/matching.rs
+++ b/servo/components/selectors/matching.rs
@@ -112,12 +112,56 @@ pub fn matches<E>(selector_list: &[Selector<E::Impl>],
     })
 }
 
+fn may_match<E>(mut selector: &ComplexSelector<E::Impl>,
+                bf: &BloomFilter)
+                -> bool
+    where E: Element,
+{
+    // See if the bloom filter can exclude any of the descendant selectors, and
+    // reject if we can.
+    loop {
+         match selector.next {
+             None => break,
+             Some((ref cs, Combinator::Descendant)) => selector = &**cs,
+             Some((ref cs, _)) => {
+                 selector = &**cs;
+                 continue;
+             }
+         };
+
+        for ss in selector.compound_selector.iter() {
+            match *ss {
+                SimpleSelector::LocalName(LocalName { ref name, ref lower_name })  => {
+                    if !bf.might_contain(name) &&
+                       !bf.might_contain(lower_name) {
+                       return false
+                    }
+                },
+                SimpleSelector::Namespace(ref namespace) => {
+                    if !bf.might_contain(&namespace.url) {
+                        return false
+                    }
+                },
+                SimpleSelector::ID(ref id) => {
+                    if !bf.might_contain(id) {
+                        return false
+                    }
+                },
+                SimpleSelector::Class(ref class) => {
+                    if !bf.might_contain(class) {
+                        return false
+                    }
+                },
+                _ => {},
+            }
+        }
+    }
+
+    // If we haven't proven otherwise, it may match.
+    true
+}
+
 /// Determines whether the given element matches the given complex selector.
-///
-/// NB: If you add support for any new kinds of selectors to this routine, be sure to set
-/// `shareable` to false unless you are willing to update the style sharing logic. Otherwise things
-/// will almost certainly break as elements will start mistakenly sharing styles. (See
-/// `can_share_style_with` in `servo/components/style/matching.rs`.)
 pub fn matches_complex_selector<E>(selector: &ComplexSelector<E::Impl>,
                                    element: &E,
                                    parent_bf: Option<&BloomFilter>,
@@ -126,7 +170,13 @@ pub fn matches_complex_selector<E>(selector: &ComplexSelector<E::Impl>,
                                    -> bool
     where E: Element
 {
-    match matches_complex_selector_internal(selector, element, parent_bf, relations, flags) {
+    if let Some(filter) = parent_bf {
+        if !may_match::<E>(selector, filter) {
+            return false;
+        }
+    }
+
+    match matches_complex_selector_internal(selector, element, relations, flags) {
         SelectorMatchingResult::Matched => {
             match selector.next {
                 Some((_, Combinator::NextSibling)) |
@@ -190,81 +240,19 @@ enum SelectorMatchingResult {
     NotMatchedGlobally,
 }
 
-/// Quickly figures out whether or not the complex selector is worth doing more
-/// work on. If the simple selectors don't match, or there's a child selector
-/// that does not appear in the bloom parent bloom filter, we can exit early.
-fn can_fast_reject<E>(mut selector: &ComplexSelector<E::Impl>,
-                      element: &E,
-                      parent_bf: Option<&BloomFilter>,
-                      relations: &mut StyleRelations,
-                      flags: &mut ElementSelectorFlags)
-                      -> Option<SelectorMatchingResult>
-    where E: Element
-{
-    if !selector.compound_selector.iter().all(|simple_selector| {
-      matches_simple_selector(simple_selector, element, parent_bf, relations, flags) }) {
-        return Some(SelectorMatchingResult::NotMatchedAndRestartFromClosestLaterSibling);
-    }
-
-    let bf: &BloomFilter = match parent_bf {
-        None => return None,
-        Some(ref bf) => bf,
-    };
-
-    // See if the bloom filter can exclude any of the descendant selectors, and
-    // reject if we can.
-    loop {
-         match selector.next {
-             None => break,
-             Some((ref cs, Combinator::Descendant)) => selector = &**cs,
-             Some((ref cs, _)) => {
-                 selector = &**cs;
-                 continue;
-             }
-         };
-
-        for ss in selector.compound_selector.iter() {
-            match *ss {
-                SimpleSelector::LocalName(LocalName { ref name, ref lower_name })  => {
-                    if !bf.might_contain(name) &&
-                       !bf.might_contain(lower_name) {
-                        return Some(SelectorMatchingResult::NotMatchedGlobally);
-                    }
-                },
-                SimpleSelector::Namespace(ref namespace) => {
-                    if !bf.might_contain(&namespace.url) {
-                        return Some(SelectorMatchingResult::NotMatchedGlobally);
-                    }
-                },
-                SimpleSelector::ID(ref id) => {
-                    if !bf.might_contain(id) {
-                        return Some(SelectorMatchingResult::NotMatchedGlobally);
-                    }
-                },
-                SimpleSelector::Class(ref class) => {
-                    if !bf.might_contain(class) {
-                        return Some(SelectorMatchingResult::NotMatchedGlobally);
-                    }
-                },
-                _ => {},
-            }
-        }
-    }
-
-    // Can't fast reject.
-    None
-}
-
 fn matches_complex_selector_internal<E>(selector: &ComplexSelector<E::Impl>,
-                                         element: &E,
-                                         parent_bf: Option<&BloomFilter>,
-                                         relations: &mut StyleRelations,
-                                         flags: &mut ElementSelectorFlags)
-                                         -> SelectorMatchingResult
+                                        element: &E,
+                                        relations: &mut StyleRelations,
+                                        flags: &mut ElementSelectorFlags)
+                                        -> SelectorMatchingResult
      where E: Element
 {
-    if let Some(result) = can_fast_reject(selector, element, parent_bf, relations, flags) {
-        return result;
+    let matches_all_simple_selectors = selector.compound_selector.iter().all(|simple| {
+        matches_simple_selector(simple, element, relations, flags)
+    });
+
+    if !matches_all_simple_selectors {
+        return SelectorMatchingResult::NotMatchedAndRestartFromClosestLaterSibling;
     }
 
     match selector.next {
@@ -287,10 +275,9 @@ fn matches_complex_selector_internal<E>(selector: &ComplexSelector<E::Impl>,
                     Some(next_element) => next_element,
                 };
                 let result = matches_complex_selector_internal(&**next_selector,
-                                                                &element,
-                                                                parent_bf,
-                                                                relations,
-                                                                flags);
+                                                               &element,
+                                                               relations,
+                                                               flags);
                 match (result, combinator) {
                     // Return the status immediately.
                     (SelectorMatchingResult::Matched, _) => return result,
@@ -332,7 +319,6 @@ fn matches_complex_selector_internal<E>(selector: &ComplexSelector<E::Impl>,
 fn matches_simple_selector<E>(
         selector: &SimpleSelector<E::Impl>,
         element: &E,
-        parent_bf: Option<&BloomFilter>,
         relations: &mut StyleRelations,
         flags: &mut ElementSelectorFlags)
         -> bool
@@ -466,7 +452,10 @@ fn matches_simple_selector<E>(
         }
         SimpleSelector::Negation(ref negated) => {
             !negated.iter().all(|s| {
-                matches_complex_selector(s, element, parent_bf, relations, flags)
+                match matches_complex_selector_internal(s, element, relations, flags) {
+                    SelectorMatchingResult::Matched => true,
+                    _ => false,
+                }
             })
         }
     }

From f0c29bc5fc916fe61069f653dad3950a7cbb122f Mon Sep 17 00:00:00 2001
From: Ting-Yu Lin <tlin@mozilla.com>
Date: Thu, 9 Mar 2017 17:33:50 +0800
Subject: [PATCH 18/46] Bug 1338446 Part 1 - Label dispatching
 ShortTermURISpecCache by using SystemGroup. r=heycam

In ErrorReporter::~ErrorReporter(), we dispatch sSpecCache to clear itself.
It's not related to content, so label it by using SystemGroup.

Use another runnable pointer to keep sSpecCache alive.

MozReview-Commit-ID: JN1qrS2jxFs

--HG--
extra : rebase_source : ffdd72816e7864cefeabde85f692e837c5fe1bc5
---
 layout/style/ErrorReporter.cpp | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/layout/style/ErrorReporter.cpp b/layout/style/ErrorReporter.cpp
index b57814eb7479..4775a68ef324 100644
--- a/layout/style/ErrorReporter.cpp
+++ b/layout/style/ErrorReporter.cpp
@@ -11,6 +11,7 @@
 #include "mozilla/css/Loader.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/Services.h"
+#include "mozilla/SystemGroup.h"
 #include "nsCSSScanner.h"
 #include "nsIConsoleService.h"
 #include "nsIDocument.h"
@@ -153,7 +154,11 @@ ErrorReporter::~ErrorReporter()
   // balance between performance and memory usage, so we only allow
   // short-term caching.
   if (sSpecCache && sSpecCache->IsInUse() && !sSpecCache->IsPending()) {
-    if (NS_FAILED(NS_DispatchToCurrentThread(sSpecCache))) {
+    nsCOMPtr<nsIRunnable> runnable(sSpecCache);
+    nsresult rv =
+      SystemGroup::Dispatch("ShortTermURISpecCache", TaskCategory::Other,
+                            runnable.forget());
+    if (NS_FAILED(rv)) {
       // Peform the "deferred" cleanup immediately if the dispatch fails.
       sSpecCache->Run();
     } else {

From bef3641333b1d07f8933611006c56b11ae4c854a Mon Sep 17 00:00:00 2001
From: Ting-Yu Lin <tlin@mozilla.com>
Date: Thu, 9 Mar 2017 18:02:01 +0800
Subject: [PATCH 19/46] Bug 1338446 Part 2 - Label
 FontFaceSet::CheckLoadingFinishedAfterDelay. r=heycam

mDocument is always valid because we get mDocument from the argument of
FontFaceSet's constructor, and FontFaceSet is always created in
nsIDocument's methods.

Delay giving checkTask a name until we dispatch it. No need to name it
twice.

MozReview-Commit-ID: 6nKYRcRqvQ0

--HG--
extra : rebase_source : 5d7be9c1bcf41ce6fae9ba37a4013144c23fa832
---
 layout/style/FontFaceSet.cpp | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/layout/style/FontFaceSet.cpp b/layout/style/FontFaceSet.cpp
index a35556c8587b..b126e88b66f8 100644
--- a/layout/style/FontFaceSet.cpp
+++ b/layout/style/FontFaceSet.cpp
@@ -104,6 +104,8 @@ FontFaceSet::FontFaceSet(nsPIDOMWindowInner* aWindow, nsIDocument* aDocument)
   , mHasLoadingFontFacesIsDirty(false)
   , mDelayedLoadCheck(false)
 {
+  MOZ_ASSERT(mDocument, "We should get a valid document from the caller!");
+
   nsCOMPtr<nsIGlobalObject> global = do_QueryInterface(aWindow);
 
   // If the pref is not set, don't create the Promise (which the page wouldn't
@@ -1473,9 +1475,9 @@ FontFaceSet::OnFontFaceStatusChanged(FontFace* aFontFace)
     if (!mDelayedLoadCheck) {
       mDelayedLoadCheck = true;
       nsCOMPtr<nsIRunnable> checkTask =
-        NewRunnableMethod("FontFaceSet::CheckLoadingFinishedAfterDelay",
-                          this, &FontFaceSet::CheckLoadingFinishedAfterDelay);
-      NS_DispatchToMainThread(checkTask);
+        NewRunnableMethod(this, &FontFaceSet::CheckLoadingFinishedAfterDelay);
+      mDocument->Dispatch("FontFaceSet::CheckLoadingFinishedAfterDelay",
+                          TaskCategory::Other, checkTask.forget());
     }
   }
 }

From f087300185b874eecd04538f7e7eeae5e992c9fa Mon Sep 17 00:00:00 2001
From: Ting-Yu Lin <tlin@mozilla.com>
Date: Mon, 13 Mar 2017 17:00:57 +0800
Subject: [PATCH 20/46] Bug 1338446 Part 3 - Label SheetLoadData in
 Loader::PostLoadEvent. r=heycam

When constructing a Loader without passing a document, we added a DocGroup
parameter so that we could still use it to dispatch events to the DocGroup.

Delete NS_ENSURE_TRUE because new() is infallable.

Use another runnable pointer for calling dispatching because forget() will
nuke the pointer and we need to use evt afterwards.

MozReview-Commit-ID: Ce2K6j4pUhA

--HG--
extra : rebase_source : 2bacf1f856e0700f36b2fefe4d2424719cad77a7
---
 dom/base/nsDocument.cpp                  |  3 ++-
 layout/base/nsDocumentViewer.cpp         |  4 ++--
 layout/base/nsStyleSheetService.cpp      |  2 +-
 layout/style/CSSStyleSheet.cpp           |  2 +-
 layout/style/Loader.cpp                  | 23 +++++++++++++++++++----
 layout/style/Loader.h                    |  9 ++++++++-
 layout/style/PreloadedStyleSheet.cpp     |  2 +-
 layout/style/nsLayoutStylesheetCache.cpp |  2 +-
 8 files changed, 35 insertions(+), 12 deletions(-)

diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
index 9df11a64b3b3..d21325719650 100644
--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -4406,7 +4406,8 @@ nsDocument::LoadAdditionalStyleSheet(additionalSheetType aType,
     return NS_ERROR_INVALID_ARG;
 
   // Loading the sheet sync.
-  RefPtr<css::Loader> loader = new css::Loader(GetStyleBackendType());
+  RefPtr<css::Loader> loader =
+    new css::Loader(GetStyleBackendType(), GetDocGroup());
 
   css::SheetParsingMode parsingMode;
   switch (aType) {
diff --git a/layout/base/nsDocumentViewer.cpp b/layout/base/nsDocumentViewer.cpp
index 18b2e7daa91d..5b363899116d 100644
--- a/layout/base/nsDocumentViewer.cpp
+++ b/layout/base/nsDocumentViewer.cpp
@@ -2294,8 +2294,8 @@ nsDocumentViewer::CreateStyleSet(nsIDocument* aDocument)
       nsAutoString sheets;
       elt->GetAttribute(NS_LITERAL_STRING("usechromesheets"), sheets);
       if (!sheets.IsEmpty() && baseURI) {
-        RefPtr<mozilla::css::Loader> cssLoader =
-          new mozilla::css::Loader(backendType);
+        RefPtr<css::Loader> cssLoader =
+          new css::Loader(backendType, aDocument->GetDocGroup());
 
         char *str = ToNewCString(sheets);
         char *newStr = str;
diff --git a/layout/base/nsStyleSheetService.cpp b/layout/base/nsStyleSheetService.cpp
index d75c330069e0..dc6548ed8ce0 100644
--- a/layout/base/nsStyleSheetService.cpp
+++ b/layout/base/nsStyleSheetService.cpp
@@ -218,7 +218,7 @@ LoadSheet(nsIURI* aURI,
           StyleBackendType aType,
           RefPtr<StyleSheet>* aResult)
 {
-  RefPtr<css::Loader> loader = new css::Loader(aType);
+  RefPtr<css::Loader> loader = new css::Loader(aType, nullptr);
   return loader->LoadSheetSync(aURI, aParsingMode, true, aResult);
 }
 
diff --git a/layout/style/CSSStyleSheet.cpp b/layout/style/CSSStyleSheet.cpp
index afb8e7081e04..84d0f7c9f476 100644
--- a/layout/style/CSSStyleSheet.cpp
+++ b/layout/style/CSSStyleSheet.cpp
@@ -988,7 +988,7 @@ CSSStyleSheet::ReparseSheet(const nsAString& aInput)
     loader = mDocument->CSSLoader();
     NS_ASSERTION(loader, "Document with no CSS loader!");
   } else {
-    loader = new css::Loader(StyleBackendType::Gecko);
+    loader = new css::Loader(StyleBackendType::Gecko, nullptr);
   }
 
   mozAutoDocUpdate updateBatch(mDocument, UPDATE_STYLE, true);
diff --git a/layout/style/Loader.cpp b/layout/style/Loader.cpp
index f6e1f34368a6..10cf9af0acd5 100644
--- a/layout/style/Loader.cpp
+++ b/layout/style/Loader.cpp
@@ -19,11 +19,12 @@
 #include "mozilla/css/Loader.h"
 
 #include "mozilla/ArrayUtils.h"
+#include "mozilla/dom/DocGroup.h"
 #include "mozilla/IntegerPrintfMacros.h"
 #include "mozilla/LoadInfo.h"
 #include "mozilla/MemoryReporting.h"
-
 #include "mozilla/StyleSheetInlines.h"
+#include "mozilla/SystemGroup.h"
 #include "nsIRunnable.h"
 #include "nsIUnicharStreamLoader.h"
 #include "nsSyncLoadService.h"
@@ -519,8 +520,9 @@ LoaderReusableStyleSheets::FindReusableStyleSheet(nsIURI* aURL,
  * Loader Implementation *
  *************************/
 
-Loader::Loader(StyleBackendType aType)
+Loader::Loader(StyleBackendType aType, DocGroup* aDocGroup)
   : mDocument(nullptr)
+  , mDocGroup(aDocGroup)
   , mDatasToNotifyOn(0)
   , mCompatMode(eCompatibility_FullStandards)
   , mStyleBackendType(Some(aType))
@@ -542,6 +544,8 @@ Loader::Loader(nsIDocument* aDocument)
   , mSyncCallback(false)
 #endif
 {
+  MOZ_ASSERT(mDocument, "We should get a valid document from the caller!");
+
   // We can just use the preferred set, since there are no sheets in the
   // document yet (if there are, how did they get there? _we_ load the sheets!)
   // and hence the selected set makes no sense at this time.
@@ -2471,13 +2475,24 @@ Loader::PostLoadEvent(nsIURI* aURI,
                       aObserver,
                       nullptr,
                       mDocument);
-  NS_ENSURE_TRUE(evt, NS_ERROR_OUT_OF_MEMORY);
 
   if (!mPostedEvents.AppendElement(evt)) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
-  nsresult rv = NS_DispatchToCurrentThread(evt);
+  nsresult rv;
+  RefPtr<SheetLoadData> runnable(evt);
+  if (mDocument) {
+    rv = mDocument->Dispatch("SheetLoadData", TaskCategory::Other,
+                             runnable.forget());
+  } else if (mDocGroup) {
+    rv = mDocGroup->Dispatch("SheetLoadData", TaskCategory::Other,
+                             runnable.forget());
+  } else {
+    rv = SystemGroup::Dispatch("SheetLoadData", TaskCategory::Other,
+                               runnable.forget());
+  }
+
   if (NS_FAILED(rv)) {
     NS_WARNING("failed to dispatch stylesheet load event");
     mPostedEvents.RemoveElement(evt);
diff --git a/layout/style/Loader.h b/layout/style/Loader.h
index 9059e8e6f886..dbeb5e610324 100644
--- a/layout/style/Loader.h
+++ b/layout/style/Loader.h
@@ -36,6 +36,7 @@ class nsIStyleSheetLinkingElement;
 
 namespace mozilla {
 namespace dom {
+class DocGroup;
 class Element;
 } // namespace dom
 } // namespace mozilla
@@ -191,7 +192,11 @@ class Loader final {
   typedef mozilla::net::ReferrerPolicy ReferrerPolicy;
 
 public:
-  explicit Loader(StyleBackendType aType);
+  // aDocGroup is used for dispatching SheetLoadData in PostLoadEvent(). It
+  // can be null if you want to use this constructor, and there's no
+  // document when the Loader is constructed.
+  Loader(StyleBackendType aType, mozilla::dom::DocGroup* aDocGroup);
+
   explicit Loader(nsIDocument*);
 
  private:
@@ -574,6 +579,8 @@ private:
   // DropDocumentReference().
   nsIDocument* MOZ_NON_OWNING_REF mDocument;  // the document we live for
 
+  // For dispatching events via DocGroup::Dispatch() when mDocument is nullptr.
+  RefPtr<mozilla::dom::DocGroup> mDocGroup;
 
   // Number of datas still waiting to be notified on if we're notifying on a
   // whole bunch at once (e.g. in one of the stop methods).  This is used to
diff --git a/layout/style/PreloadedStyleSheet.cpp b/layout/style/PreloadedStyleSheet.cpp
index e39057fd59ab..276112e7cbd1 100644
--- a/layout/style/PreloadedStyleSheet.cpp
+++ b/layout/style/PreloadedStyleSheet.cpp
@@ -71,7 +71,7 @@ PreloadedStyleSheet::GetSheet(StyleBackendType aType, StyleSheet** aResult)
     aType == StyleBackendType::Gecko ? mGecko : mServo;
 
   if (!sheet) {
-    RefPtr<css::Loader> loader = new css::Loader(aType);
+    RefPtr<css::Loader> loader = new css::Loader(aType, nullptr);
     nsresult rv = loader->LoadSheetSync(mURI, mParsingMode, true, &sheet);
     NS_ENSURE_SUCCESS(rv, rv);
     MOZ_ASSERT(sheet);
diff --git a/layout/style/nsLayoutStylesheetCache.cpp b/layout/style/nsLayoutStylesheetCache.cpp
index a28d943410a5..1cfed5e77a7e 100644
--- a/layout/style/nsLayoutStylesheetCache.cpp
+++ b/layout/style/nsLayoutStylesheetCache.cpp
@@ -773,7 +773,7 @@ nsLayoutStylesheetCache::LoadSheet(nsIURI* aURI,
     gCSSLoader_Servo;
 
   if (!loader) {
-    loader = new mozilla::css::Loader(mBackendType);
+    loader = new Loader(mBackendType, nullptr);
     if (!loader) {
       ErrorLoadingSheet(aURI, "no Loader", eCrash);
       return;

From dd4484225fa464b89f5316530bd7dc55cb16135f Mon Sep 17 00:00:00 2001
From: Ting-Yu Lin <tlin@mozilla.com>
Date: Tue, 14 Mar 2017 21:29:55 +0800
Subject: [PATCH 21/46] Bug 1338446 Part 4 - Label
 StyleImageRequestCleanupTask. r=heycam

If nsStyleImageRequest::Resolve() has been called, we cache the DocGroup and
use it for dispatching events for the clean up task. Otherwise, it's safe to
do clean up task on non-main thread.

MozReview-Commit-ID: BXalEkc6dBm

--HG--
extra : rebase_source : ccc7c43a385f3149b53763030419561fc64efbfa
---
 layout/style/nsCSSValue.cpp    |  4 +++-
 layout/style/nsStyleStruct.cpp | 25 ++++++++++++++++++++-----
 layout/style/nsStyleStruct.h   |  3 +++
 3 files changed, 26 insertions(+), 6 deletions(-)

diff --git a/layout/style/nsCSSValue.cpp b/layout/style/nsCSSValue.cpp
index 16a5432f93db..bc1b6bc1f181 100644
--- a/layout/style/nsCSSValue.cpp
+++ b/layout/style/nsCSSValue.cpp
@@ -3057,7 +3057,9 @@ css::ImageValue::Initialize(nsIDocument* aDocument)
 
 css::ImageValue::~ImageValue()
 {
-  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(NS_IsMainThread() || mRequests.Count() == 0,
+             "Destructor should run on main thread, or on non-main thread "
+             "when mRequest is empty!");
 
   for (auto iter = mRequests.Iter(); !iter.Done(); iter.Next()) {
     nsIDocument* doc = iter.Key();
diff --git a/layout/style/nsStyleStruct.cpp b/layout/style/nsStyleStruct.cpp
index 007df3cdfbbe..5bb6d7564940 100644
--- a/layout/style/nsStyleStruct.cpp
+++ b/layout/style/nsStyleStruct.cpp
@@ -33,6 +33,7 @@
 #include "CounterStyleManager.h"
 
 #include "mozilla/dom/AnimationEffectReadOnlyBinding.h" // for PlaybackDirection
+#include "mozilla/dom/DocGroup.h"
 #include "mozilla/dom/ImageTracker.h"
 #include "mozilla/Likely.h"
 #include "nsIURI.h"
@@ -1890,7 +1891,7 @@ nsStyleGradient::HasCalc()
 
 /**
  * Runnable to release the nsStyleImageRequest's mRequestProxy,
- * mImageValue and mImageValue on the main thread, and to perform
+ * mImageValue and mImageTracker on the main thread, and to perform
  * any necessary unlocking and untracking of the image.
  */
 class StyleImageRequestCleanupTask : public mozilla::Runnable
@@ -1911,7 +1912,8 @@ public:
 
   NS_IMETHOD Run() final
   {
-    MOZ_ASSERT(NS_IsMainThread());
+    MOZ_ASSERT(!mRequestProxy || NS_IsMainThread(),
+               "If mRequestProxy is non-null, we need to run on main thread!");
 
     if (!mRequestProxy) {
       return NS_OK;
@@ -1932,7 +1934,15 @@ public:
   }
 
 protected:
-  virtual ~StyleImageRequestCleanupTask() { MOZ_ASSERT(NS_IsMainThread()); }
+  virtual ~StyleImageRequestCleanupTask()
+  {
+    MOZ_ASSERT(mImageValue->mRequests.Count() == 0 || NS_IsMainThread(),
+               "If mImageValue has any mRequests, we need to run on main "
+               "thread to release ImageValues!");
+    MOZ_ASSERT((!mRequestProxy && !mImageTracker) || NS_IsMainThread(),
+               "mRequestProxy and mImageTracker's destructor need to run "
+               "on the main thread!");
+  }
 
 private:
   Mode mModeFlags;
@@ -1986,10 +1996,13 @@ nsStyleImageRequest::~nsStyleImageRequest()
                                          mRequestProxy.forget(),
                                          mImageValue.forget(),
                                          mImageTracker.forget());
-    if (NS_IsMainThread()) {
+    if (NS_IsMainThread() || !IsResolved()) {
       task->Run();
     } else {
-      NS_DispatchToMainThread(task.forget());
+      MOZ_ASSERT(IsResolved() == bool(mDocGroup),
+                 "We forgot to cache mDocGroup in Resolve()?");
+      mDocGroup->Dispatch("StyleImageRequestCleanupTask",
+                          TaskCategory::Other, task.forget());
     }
   }
 
@@ -2003,8 +2016,10 @@ nsStyleImageRequest::Resolve(nsPresContext* aPresContext)
 {
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(!IsResolved(), "already resolved");
+  MOZ_ASSERT(aPresContext);
 
   mResolved = true;
+  mDocGroup = aPresContext->Document()->GetDocGroup();
 
   // For now, just have unique nsCSSValue/ImageValue objects.  We should
   // really store the ImageValue on the Servo specified value, so that we can
diff --git a/layout/style/nsStyleStruct.h b/layout/style/nsStyleStruct.h
index 500e7cdfc111..1f856654b271 100644
--- a/layout/style/nsStyleStruct.h
+++ b/layout/style/nsStyleStruct.h
@@ -385,6 +385,9 @@ private:
   RefPtr<mozilla::css::ImageValue> mImageValue;
   RefPtr<mozilla::dom::ImageTracker> mImageTracker;
 
+  // Cache DocGroup for dispatching events in the destructor.
+  RefPtr<mozilla::dom::DocGroup> mDocGroup;
+
   Mode mModeFlags;
   bool mResolved;
 };

From e27cc69d635d4290f311a6497b0df86e7050306c Mon Sep 17 00:00:00 2001
From: Ting-Yu Lin <tlin@mozilla.com>
Date: Tue, 14 Mar 2017 21:34:57 +0800
Subject: [PATCH 22/46] Bug 1338446 Part 5 - Label runnable in
 Gecko_DropElementSnapshot by using SystemGroup. r=heycam

This runnable is to delete object only, so using system group should be
fine.

MozReview-Commit-ID: 8uMxMO3yERG

--HG--
extra : rebase_source : 75ae4953d4c91fa0ab9a0c598a1989fa122f8f5a
---
 layout/style/ServoBindings.cpp | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/layout/style/ServoBindings.cpp b/layout/style/ServoBindings.cpp
index 9461a75110bd..1aa3e1563d67 100644
--- a/layout/style/ServoBindings.cpp
+++ b/layout/style/ServoBindings.cpp
@@ -41,6 +41,7 @@
 #include "mozilla/ServoElementSnapshot.h"
 #include "mozilla/ServoRestyleManager.h"
 #include "mozilla/StyleAnimationValue.h"
+#include "mozilla/SystemGroup.h"
 #include "mozilla/DeclarationBlockInlines.h"
 #include "mozilla/dom/Element.h"
 #include "mozilla/dom/ElementInlines.h"
@@ -344,7 +345,8 @@ Gecko_DropElementSnapshot(ServoElementSnapshotOwned aSnapshot)
   // descendants of a new display:none root).
   if (MOZ_UNLIKELY(!NS_IsMainThread())) {
     nsCOMPtr<nsIRunnable> task = NS_NewRunnableFunction([=]() { delete aSnapshot; });
-    NS_DispatchToMainThread(task.forget());
+    SystemGroup::Dispatch("Gecko_DropElementSnapshot", TaskCategory::Other,
+                          task.forget());
   } else {
     delete aSnapshot;
   }

From 44a41925d33e4a9ff4fe1a78882caf866358eccd Mon Sep 17 00:00:00 2001
From: Ting-Yu Lin <tlin@mozilla.com>
Date: Tue, 14 Mar 2017 21:57:34 +0800
Subject: [PATCH 23/46] Bug 1338446 Part 6 - Label LoadTimer in
 nsFontFaceLoader::StartedLoading. r=heycam

Delete #include "mozilla/Logging.h" because it has been included.

Add FontFaceSet::Document() to get valid document for nsFontFaceLoader.

MozReview-Commit-ID: IAXM9UgvjOE

--HG--
extra : rebase_source : e5aa8aadea5e2f9f2e5d73cc718318cf97471d3f
---
 layout/style/FontFaceSet.h        |  2 ++
 layout/style/nsFontFaceLoader.cpp | 15 +++++++++------
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/layout/style/FontFaceSet.h b/layout/style/FontFaceSet.h
index d08fbaf8c8cf..a1473dad61db 100644
--- a/layout/style/FontFaceSet.h
+++ b/layout/style/FontFaceSet.h
@@ -162,6 +162,8 @@ public:
     return set ? set->GetPresContext() : nullptr;
   }
 
+  nsIDocument* Document() const { return mDocument; }
+
   // -- Web IDL --------------------------------------------------------------
 
   IMPL_EVENT_HANDLER(loading)
diff --git a/layout/style/nsFontFaceLoader.cpp b/layout/style/nsFontFaceLoader.cpp
index 2f0ccd634e88..d8bdee0dd063 100644
--- a/layout/style/nsFontFaceLoader.cpp
+++ b/layout/style/nsFontFaceLoader.cpp
@@ -11,8 +11,6 @@
 
 #include "nsFontFaceLoader.h"
 
-#include "mozilla/Logging.h"
-
 #include "nsError.h"
 #include "nsContentUtils.h"
 #include "mozilla/Preferences.h"
@@ -55,6 +53,8 @@ nsFontFaceLoader::nsFontFaceLoader(gfxUserFontEntry* aUserFontEntry,
     mFontFaceSet(aFontFaceSet),
     mChannel(aChannel)
 {
+  MOZ_ASSERT(mFontFaceSet,
+             "We should get a valid FontFaceSet from the caller!");
   mStartTime = TimeStamp::Now();
 }
 
@@ -87,10 +87,13 @@ nsFontFaceLoader::StartedLoading(nsIStreamLoader* aStreamLoader)
   if (loadTimeout > 0) {
     mLoadTimer = do_CreateInstance("@mozilla.org/timer;1");
     if (mLoadTimer) {
-      mLoadTimer->InitWithFuncCallback(LoadTimerCallback,
-                                       static_cast<void*>(this),
-                                       loadTimeout,
-                                       nsITimer::TYPE_ONE_SHOT);
+      mLoadTimer->SetTarget(
+        mFontFaceSet->Document()->EventTargetFor(TaskCategory::Other));
+      mLoadTimer->InitWithNamedFuncCallback(LoadTimerCallback,
+                                            static_cast<void*>(this),
+                                            loadTimeout,
+                                            nsITimer::TYPE_ONE_SHOT,
+                                            "LoadTimerCallback");
     }
   } else {
     mUserFontEntry->mFontDataLoadingState = gfxUserFontEntry::LOADING_SLOWLY;

From 8a533e93cf5c7337eb0298e69acde95402bc657c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Naz=C4=B1m=20Can=20Alt=C4=B1nova?= <canaltinova@gmail.com>
Date: Sat, 18 Mar 2017 19:41:39 +0300
Subject: [PATCH 24/46] Bug 1341642 - Stylo: Add support for -moz-* 
 pseudo-classes for alt text r=manishearth

MozReview-Commit-ID: 1t42xaTtUmb

--HG--
extra : rebase_source : 58072c6ea9df8a931671450f31e345e872ef6e53
---
 dom/events/EventStates.h | 54 ++++++++++++++++++++--------------------
 1 file changed, 27 insertions(+), 27 deletions(-)

diff --git a/dom/events/EventStates.h b/dom/events/EventStates.h
index b1b9654ef198..ddab2cdf8beb 100644
--- a/dom/events/EventStates.h
+++ b/dom/events/EventStates.h
@@ -12,7 +12,7 @@
 
 namespace mozilla {
 
-#define NS_EVENT_STATE_HIGHEST_SERVO_BIT 12
+#define NS_EVENT_STATE_HIGHEST_SERVO_BIT 19
 
 /**
  * EventStates is the class used to represent the event states of nsIContent
@@ -223,6 +223,21 @@ private:
 #define NS_EVENT_STATE_INVALID       NS_DEFINE_EVENT_STATE_MACRO(11)
 // UI friendly version of :valid pseudo-class.
 #define NS_EVENT_STATE_MOZ_UI_VALID NS_DEFINE_EVENT_STATE_MACRO(12)
+// Content could not be rendered (image/object/etc).
+#define NS_EVENT_STATE_BROKEN        NS_DEFINE_EVENT_STATE_MACRO(13)
+// Content disabled by the user (images turned off, say).
+#define NS_EVENT_STATE_USERDISABLED  NS_DEFINE_EVENT_STATE_MACRO(14)
+// Content suppressed by the user (ad blocking, etc).
+#define NS_EVENT_STATE_SUPPRESSED    NS_DEFINE_EVENT_STATE_MACRO(15)
+// Content is still loading such that there is nothing to show the
+// user (eg an image which hasn't started coming in yet).
+#define NS_EVENT_STATE_LOADING       NS_DEFINE_EVENT_STATE_MACRO(16)
+// Handler for the content has been blocked.
+#define NS_EVENT_STATE_HANDLER_BLOCKED NS_DEFINE_EVENT_STATE_MACRO(17)
+// Handler for the content has been disabled.
+#define NS_EVENT_STATE_HANDLER_DISABLED NS_DEFINE_EVENT_STATE_MACRO(18)
+// Handler for the content has crashed
+#define NS_EVENT_STATE_HANDLER_CRASHED NS_DEFINE_EVENT_STATE_MACRO(19)
 
 /*
  * Bits below here do not have Servo-related ordering constraints.
@@ -232,42 +247,27 @@ private:
  */
 
 // Drag is hovering over content.
-#define NS_EVENT_STATE_DRAGOVER      NS_DEFINE_EVENT_STATE_MACRO(13)
+#define NS_EVENT_STATE_DRAGOVER      NS_DEFINE_EVENT_STATE_MACRO(20)
 // Content is required.
-#define NS_EVENT_STATE_REQUIRED      NS_DEFINE_EVENT_STATE_MACRO(14)
+#define NS_EVENT_STATE_REQUIRED      NS_DEFINE_EVENT_STATE_MACRO(21)
 // Content is optional (and can be required).
-#define NS_EVENT_STATE_OPTIONAL      NS_DEFINE_EVENT_STATE_MACRO(15)
+#define NS_EVENT_STATE_OPTIONAL      NS_DEFINE_EVENT_STATE_MACRO(22)
 // Link has been visited.
-#define NS_EVENT_STATE_VISITED       NS_DEFINE_EVENT_STATE_MACRO(16)
+#define NS_EVENT_STATE_VISITED       NS_DEFINE_EVENT_STATE_MACRO(23)
 // Link hasn't been visited.
-#define NS_EVENT_STATE_UNVISITED     NS_DEFINE_EVENT_STATE_MACRO(17)
+#define NS_EVENT_STATE_UNVISITED     NS_DEFINE_EVENT_STATE_MACRO(24)
 // Content value is in-range (and can be out-of-range).
-#define NS_EVENT_STATE_INRANGE       NS_DEFINE_EVENT_STATE_MACRO(18)
+#define NS_EVENT_STATE_INRANGE       NS_DEFINE_EVENT_STATE_MACRO(25)
 // Content value is out-of-range.
-#define NS_EVENT_STATE_OUTOFRANGE    NS_DEFINE_EVENT_STATE_MACRO(19)
+#define NS_EVENT_STATE_OUTOFRANGE    NS_DEFINE_EVENT_STATE_MACRO(26)
 // These two are temporary (see bug 302188)
 // Content is read-only.
-#define NS_EVENT_STATE_MOZ_READONLY  NS_DEFINE_EVENT_STATE_MACRO(20)
+#define NS_EVENT_STATE_MOZ_READONLY  NS_DEFINE_EVENT_STATE_MACRO(27)
 // Content is editable.
-#define NS_EVENT_STATE_MOZ_READWRITE NS_DEFINE_EVENT_STATE_MACRO(21)
+#define NS_EVENT_STATE_MOZ_READWRITE NS_DEFINE_EVENT_STATE_MACRO(28)
 // Content is the default one (meaning depends of the context).
-#define NS_EVENT_STATE_DEFAULT       NS_DEFINE_EVENT_STATE_MACRO(22)
-// Content could not be rendered (image/object/etc).
-#define NS_EVENT_STATE_BROKEN        NS_DEFINE_EVENT_STATE_MACRO(23)
-// Content disabled by the user (images turned off, say).
-#define NS_EVENT_STATE_USERDISABLED  NS_DEFINE_EVENT_STATE_MACRO(24)
-// Content suppressed by the user (ad blocking, etc).
-#define NS_EVENT_STATE_SUPPRESSED    NS_DEFINE_EVENT_STATE_MACRO(25)
-// Content is still loading such that there is nothing to show the
-// user (eg an image which hasn't started coming in yet).
-#define NS_EVENT_STATE_LOADING       NS_DEFINE_EVENT_STATE_MACRO(26)
-#define NS_EVENT_STATE_INCREMENT_SCRIPT_LEVEL NS_DEFINE_EVENT_STATE_MACRO(27)
-// Handler for the content has been blocked.
-#define NS_EVENT_STATE_HANDLER_BLOCKED NS_DEFINE_EVENT_STATE_MACRO(28)
-// Handler for the content has been disabled.
-#define NS_EVENT_STATE_HANDLER_DISABLED NS_DEFINE_EVENT_STATE_MACRO(29)
-// Handler for the content has crashed
-#define NS_EVENT_STATE_HANDLER_CRASHED NS_DEFINE_EVENT_STATE_MACRO(30)
+#define NS_EVENT_STATE_DEFAULT       NS_DEFINE_EVENT_STATE_MACRO(29)
+#define NS_EVENT_STATE_INCREMENT_SCRIPT_LEVEL NS_DEFINE_EVENT_STATE_MACRO(30)
 // Content has focus and should show a ring.
 #define NS_EVENT_STATE_FOCUSRING     NS_DEFINE_EVENT_STATE_MACRO(31)
 // Content is a submit control and the form isn't valid.

From 6d7bb2e928c71132991409c63ead2c21288baacc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Naz=C4=B1m=20Can=20Alt=C4=B1nova?= <canaltinova@gmail.com>
Date: Mon, 20 Mar 2017 17:47:59 +0300
Subject: [PATCH 25/46] Bug 1341642 - Add a reftest for :-moz-broken r=emilio

MozReview-Commit-ID: FiWwxDq47W1

--HG--
extra : rebase_source : fae032d6a4d060cacb2c8b2069cfa4368dc59b07
---
 layout/reftests/image/moz-broken-matching-1-ref.html | 7 +++++++
 layout/reftests/image/moz-broken-matching-1.html     | 7 +++++++
 layout/reftests/image/reftest.list                   | 2 ++
 3 files changed, 16 insertions(+)
 create mode 100644 layout/reftests/image/moz-broken-matching-1-ref.html
 create mode 100644 layout/reftests/image/moz-broken-matching-1.html

diff --git a/layout/reftests/image/moz-broken-matching-1-ref.html b/layout/reftests/image/moz-broken-matching-1-ref.html
new file mode 100644
index 000000000000..94bb5e4962b7
--- /dev/null
+++ b/layout/reftests/image/moz-broken-matching-1-ref.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<style>
+  img {
+    border: 10px solid green;
+  }
+</style>
+<img src="nosuch:url">
diff --git a/layout/reftests/image/moz-broken-matching-1.html b/layout/reftests/image/moz-broken-matching-1.html
new file mode 100644
index 000000000000..eb63194e140b
--- /dev/null
+++ b/layout/reftests/image/moz-broken-matching-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<style>
+  :-moz-broken {
+    border: 10px solid green;
+  }
+</style>
+<img src="nosuch:url">
diff --git a/layout/reftests/image/reftest.list b/layout/reftests/image/reftest.list
index 588034fb0a4b..e4e4d7b2f266 100644
--- a/layout/reftests/image/reftest.list
+++ b/layout/reftests/image/reftest.list
@@ -126,3 +126,5 @@ fuzzy(1,1) == image-orientation-background.html?90&flip      image-orientation-r
 
 == image-resize-percent-height.html image-resize-ref.html
 == image-resize-percent-width.html image-resize-ref.html
+
+== moz-broken-matching-1.html moz-broken-matching-1-ref.html

From 4f6cfa8bc70f48afaa639be7b4b8f4b9fcd3b634 Mon Sep 17 00:00:00 2001
From: Shawn Huang <shuang@mozilla.com>
Date: Mon, 20 Mar 2017 18:34:15 +0800
Subject: [PATCH 26/46] Bug 1348214 - Clear storage per origin when loading
 storage test cases, r=jgraham

MozReview-Commit-ID: ndsajg7Glb

--HG--
extra : rebase_source : 847950b2eaf7f9e1cf779ed5d3c707bc745dd11c
---
 .../wptrunner/executors/executormarionette.py | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/testing/web-platform/harness/wptrunner/executors/executormarionette.py b/testing/web-platform/harness/wptrunner/executors/executormarionette.py
index 128828e60bd8..174f64b671da 100644
--- a/testing/web-platform/harness/wptrunner/executors/executormarionette.py
+++ b/testing/web-platform/harness/wptrunner/executors/executormarionette.py
@@ -264,6 +264,23 @@ class MarionetteProtocol(Protocol):
         with self.marionette.using_context(self.marionette.CONTEXT_CHROME):
             self.marionette.execute_script(script)
 
+    def clear_origin(self, url):
+        self.logger.info("Clearing origin %s" % (url))
+        script = """
+            let url = '%s';
+            let uri = Components.classes["@mozilla.org/network/io-service;1"]
+                                .getService(Ci.nsIIOService)
+                                .newURI(url);
+            let ssm = Components.classes["@mozilla.org/scriptsecuritymanager;1"]
+                                .getService(Ci.nsIScriptSecurityManager);
+            let principal = ssm.createCodebasePrincipal(uri, {});
+            let qms = Components.classes["@mozilla.org/dom/quota-manager-service;1"]
+                                .getService(Components.interfaces.nsIQuotaManagerService);
+            qms.clearStoragesForPrincipal(principal, "default", true);
+            """ % url
+        with self.marionette.using_context(self.marionette.CONTEXT_CHROME):
+            self.marionette.execute_script(script)
+
 
 class RemoteMarionetteProtocol(Protocol):
     def __init__(self, executor, browser):
@@ -325,6 +342,11 @@ class ExecuteAsyncScriptRun(object):
         self.result_flag = threading.Event()
 
     def run(self):
+        index = self.url.rfind("/storage/");
+        if index != -1:
+            # Clear storage
+            self.protocol.clear_origin(self.url)
+
         timeout = self.timeout
 
         try:

From 14f92d0eed183e64ef1ac7b8d9737bc59bcceed5 Mon Sep 17 00:00:00 2001
From: Patrick Brosset <pbrosset@mozilla.com>
Date: Mon, 20 Mar 2017 14:05:21 +0100
Subject: [PATCH 27/46] Bug 1301015 - Re-enable some devtools tests on
 e10s-multi; r=krizsa

Some devtools tests had been forced to run in e10s with just 1
content process in bug 1301340 and bug 1303113 because they were
failing.
Now there seems to have been enough e10s messaging fixes that these
tests work again. It seems safe to re-enable multi-content-processes
for them now.

MozReview-Commit-ID: ENfDdIXvIAI

--HG--
extra : rebase_source : 9f29d7f58088b3a99a3512b9f7e73525cb9a6e7e
---
 devtools/client/aboutdebugging/test/browser_tabs.js         | 6 ------
 .../test/browser_animation_spacebar_toggles_animations.js   | 6 ------
 .../test/browser/browser_toolbox_swap_browsers.js           | 6 ------
 .../browser_webconsole_show_subresource_security_errors.js  | 6 ------
 devtools/client/webconsole/test/browser_webconsole_split.js | 4 ----
 .../tests/browser/browser_animation_getMultipleStates.js    | 6 ------
 6 files changed, 34 deletions(-)

diff --git a/devtools/client/aboutdebugging/test/browser_tabs.js b/devtools/client/aboutdebugging/test/browser_tabs.js
index e82090607fa5..99e76be5d969 100644
--- a/devtools/client/aboutdebugging/test/browser_tabs.js
+++ b/devtools/client/aboutdebugging/test/browser_tabs.js
@@ -5,12 +5,6 @@
 
 const TAB_URL = "data:text/html,<title>foo</title>";
 
-add_task(function* setup() {
-  yield SpecialPowers.pushPrefEnv({
-    set: [["dom.ipc.processCount", 1]]
-  });
-});
-
 add_task(function* () {
   let { tab, document } = yield openAboutDebugging("tabs");
 
diff --git a/devtools/client/animationinspector/test/browser_animation_spacebar_toggles_animations.js b/devtools/client/animationinspector/test/browser_animation_spacebar_toggles_animations.js
index 799ecc28db78..593dbe685c21 100644
--- a/devtools/client/animationinspector/test/browser_animation_spacebar_toggles_animations.js
+++ b/devtools/client/animationinspector/test/browser_animation_spacebar_toggles_animations.js
@@ -4,12 +4,6 @@
 
 "use strict";
 
-add_task(function* setup() {
-  yield SpecialPowers.pushPrefEnv({
-    set: [["dom.ipc.processCount", 1]]
-  });
-});
-
 // Test that the spacebar key press toggles the toggleAll button state
 // when a node with no animation is selected.
 // This test doesn't need to test if animations actually pause/resume
diff --git a/devtools/client/responsive.html/test/browser/browser_toolbox_swap_browsers.js b/devtools/client/responsive.html/test/browser/browser_toolbox_swap_browsers.js
index 8f7afaf010c2..26bc4d1ee714 100644
--- a/devtools/client/responsive.html/test/browser/browser_toolbox_swap_browsers.js
+++ b/devtools/client/responsive.html/test/browser/browser_toolbox_swap_browsers.js
@@ -30,12 +30,6 @@ let checkToolbox = Task.async(function* (tab, location) {
   ok(!!gDevTools.getToolbox(target), `Toolbox exists ${location}`);
 });
 
-add_task(function* setup() {
-  yield SpecialPowers.pushPrefEnv({
-    set: [["dom.ipc.processCount", 1]]
-  });
-});
-
 add_task(function* () {
   let tab = yield addTab(TEST_URL);
 
diff --git a/devtools/client/webconsole/test/browser_webconsole_show_subresource_security_errors.js b/devtools/client/webconsole/test/browser_webconsole_show_subresource_security_errors.js
index 43cb96bdc487..2f2238d1fbbb 100644
--- a/devtools/client/webconsole/test/browser_webconsole_show_subresource_security_errors.js
+++ b/devtools/client/webconsole/test/browser_webconsole_show_subresource_security_errors.js
@@ -13,12 +13,6 @@ const TEST_DOC = "https://example.com/browser/devtools/client/webconsole/" +
                  "test/test_bug1092055_shouldwarn.html";
 const SAMPLE_MSG = "specified a header that could not be parsed successfully.";
 
-add_task(function* setup() {
-  yield SpecialPowers.pushPrefEnv({
-    set: [["dom.ipc.processCount", 1]]
-  });
-});
-
 add_task(function* () {
   let { browser } = yield loadTab(TEST_URI);
 
diff --git a/devtools/client/webconsole/test/browser_webconsole_split.js b/devtools/client/webconsole/test/browser_webconsole_split.js
index a855a246922c..bb858d1c192a 100644
--- a/devtools/client/webconsole/test/browser_webconsole_split.js
+++ b/devtools/client/webconsole/test/browser_webconsole_split.js
@@ -9,10 +9,6 @@ const TEST_URI = "data:text/html;charset=utf-8,Web Console test for splitting";
 
 function test() {
   waitForExplicitFinish();
-  SpecialPowers.pushPrefEnv({"set": [["dom.ipc.processCount", 1]]}, runTest);
-}
-
-function runTest() {
   // Test is slow on Linux EC2 instances - Bug 962931
   requestLongerTimeout(2);
 
diff --git a/devtools/server/tests/browser/browser_animation_getMultipleStates.js b/devtools/server/tests/browser/browser_animation_getMultipleStates.js
index 4436695b0124..2e78aceb61f5 100644
--- a/devtools/server/tests/browser/browser_animation_getMultipleStates.js
+++ b/devtools/server/tests/browser/browser_animation_getMultipleStates.js
@@ -4,12 +4,6 @@
 
 "use strict";
 
-add_task(function* setup() {
-  yield SpecialPowers.pushPrefEnv({
-    set: [["dom.ipc.processCount", 1]]
-  });
-});
-
 // Check that the duration, iterationCount and delay are retrieved correctly for
 // multiple animations.
 

From 6896b92768175cd5575c50d0adf81dec2071d7ee Mon Sep 17 00:00:00 2001
From: Matt Brubeck <mbrubeck@limpet.net>
Date: Mon, 20 Mar 2017 08:31:25 -0700
Subject: [PATCH 28/46] servo: Merge #16045 - Bug 1348487 - stylo: Don't allow
 combinators in :-moz-any (from mbrubeck:any); r=emilio

https://bugzilla.mozilla.org/show_bug.cgi?id=1348487

Source-Repo: https://github.com/servo/servo
Source-Revision: 17098ddc8ffde03945387f98f52d1856ff1a8cd8

--HG--
extra : subtree_source : https%3A//hg.mozilla.org/projects/converted-servo-linear
extra : subtree_revision : 274906c936cbfbaa2cbc04414723e62c56fe348a
---
 servo/components/style/gecko/selector_parser.rs | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/servo/components/style/gecko/selector_parser.rs b/servo/components/style/gecko/selector_parser.rs
index 8b3b019dc772..25785beee023 100644
--- a/servo/components/style/gecko/selector_parser.rs
+++ b/servo/components/style/gecko/selector_parser.rs
@@ -341,6 +341,10 @@ impl<'a> ::selectors::Parser for SelectorParser<'a> {
                         let selectors = parser.parse_comma_separated(|input| {
                             ComplexSelector::parse(self, input)
                         })?;
+                        // Selectors inside `:-moz-any` may not include combinators.
+                        if selectors.iter().any(|s| s.next.is_some()) {
+                            return Err(())
+                        }
                         NonTSPseudoClass::MozAny(selectors)
                     }
                     _ => return Err(())

From 459dc06e8acf9def2625abb2a9b0c271390d350b Mon Sep 17 00:00:00 2001
From: Kirk Steuber <ksteuber@mozilla.com>
Date: Fri, 10 Mar 2017 14:06:49 -0800
Subject: [PATCH 29/46] Bug 1346405 - Update build/pgo/certs/README so
 instructions are current and applicable cross-platform r=ted

MozReview-Commit-ID: LfhNX9WH0zZ

--HG--
extra : rebase_source : cf04c0d266fc378b0ae2278426a0a2c908c9930b
---
 build/pgo/certs/README | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/build/pgo/certs/README b/build/pgo/certs/README
index ba2b346f9ad9..a005ec95ebd2 100644
--- a/build/pgo/certs/README
+++ b/build/pgo/certs/README
@@ -1,9 +1,9 @@
 The certificate authority and server certificates here are generated by $topsrcdir/build/pgo/genpgocert.py.
 
 You can generate a new CA cert by running:
-$objdir/_virtualenv/bin/python $topsrcdir/build/pgo/genpgocert.py --gen-ca
+./mach python build/pgo/genpgocert.py --gen-ca
 
 You can generate new server certificates by running:
-$objdir/_virtualenv/bin/python $topsrcdir/build/pgo/genpgocert.py --gen-server
+./mach python build/pgo/genpgocert.py --gen-server
 
-These will place the new files in this directory where you can commit them.
+These commands will modify cert8.db and key3.db. The changes to these should be committed.

From 7b64f6d5456599fbf20e58e764d5de149a46dbe6 Mon Sep 17 00:00:00 2001
From: Gabriele Svelto <gsvelto@mozilla.com>
Date: Tue, 14 Mar 2017 14:37:26 +0100
Subject: [PATCH 30/46] Bug 1319071 - Make crash minidumps use the same format
 for filenames on Linux as on other platforms; r=ted

This patch forks the breakpad files used for GUID generation and replaces them
with copies living together with the rest of the forked sources. Since other
files in the breakpad sources rely on the original files being present they
haven't been removed but we deliberately define their inclusion definitions in
the build system to prevent them from contributing to the build. This ensures
that we always use our own version of the GUID generator while not touching
the non-forked sources.

MozReview-Commit-ID: 5kW74yAPUDW

--HG--
rename : toolkit/crashreporter/google-breakpad/src/common/linux/guid_creator.cc => toolkit/crashreporter/breakpad-client/linux/handler/guid_generator.cc
rename : toolkit/crashreporter/google-breakpad/src/common/linux/guid_creator.h => toolkit/crashreporter/breakpad-client/linux/handler/guid_generator.h
extra : rebase_source : 60eb027258833996777469d2a13142077486bee9
---
 .../crash_generation_server.cc                |   2 +-
 .../linux/handler/guid_generator.cc           | 108 ++++++++++++++++++
 .../linux/handler/guid_generator.h            |  48 ++++++++
 .../linux/handler/minidump_descriptor.cc      |   3 +-
 .../breakpad-client/linux/moz.build           |   5 +
 .../src/common/linux/moz.build                |   2 -
 tools/profiler/moz.build                      |   1 -
 7 files changed, 163 insertions(+), 6 deletions(-)
 create mode 100644 toolkit/crashreporter/breakpad-client/linux/handler/guid_generator.cc
 create mode 100644 toolkit/crashreporter/breakpad-client/linux/handler/guid_generator.h

diff --git a/toolkit/crashreporter/breakpad-client/linux/crash_generation/crash_generation_server.cc b/toolkit/crashreporter/breakpad-client/linux/crash_generation/crash_generation_server.cc
index de1bfeb56a03..cb15941746d5 100644
--- a/toolkit/crashreporter/breakpad-client/linux/crash_generation/crash_generation_server.cc
+++ b/toolkit/crashreporter/breakpad-client/linux/crash_generation/crash_generation_server.cc
@@ -44,9 +44,9 @@
 #include "linux/crash_generation/crash_generation_server.h"
 #include "linux/crash_generation/client_info.h"
 #include "linux/handler/exception_handler.h"
+#include "linux/handler/guid_generator.h"
 #include "linux/minidump_writer/minidump_writer.h"
 #include "common/linux/eintr_wrapper.h"
-#include "common/linux/guid_creator.h"
 #include "common/linux/safe_readlink.h"
 
 static const char kCommandQuit = 'x';
diff --git a/toolkit/crashreporter/breakpad-client/linux/handler/guid_generator.cc b/toolkit/crashreporter/breakpad-client/linux/handler/guid_generator.cc
new file mode 100644
index 000000000000..b0ef05bd9d0e
--- /dev/null
+++ b/toolkit/crashreporter/breakpad-client/linux/handler/guid_generator.cc
@@ -0,0 +1,108 @@
+// Copyright (c) 2006, Google Inc.
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#include "linux/handler/guid_generator.h"
+
+#include <assert.h>
+#include <pthread.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>
+#include <unistd.h>
+
+//
+// GUIDGenerator
+//
+// This class is used to generate random GUID.
+// Currently use random number to generate a GUID since Linux has
+// no native GUID generator. This should be OK since we don't expect
+// crash to happen very offen.
+//
+class GUIDGenerator {
+ public:
+  static uint16_t BytesToUInt16(const uint8_t bytes[]) {
+    return ((uint16_t) bytes[1] << 8) | ((uint16_t) bytes[0]);
+  }
+
+  // The last field in a GUID is 48 bits long so we're converting only 6 bytes
+  static uint64_t BytesToUInt48(const uint8_t bytes[]) {
+    return ((uint64_t) bytes[0] << 40) | ((uint64_t) bytes[1] << 32) |
+           ((uint64_t) bytes[2] << 24) | ((uint64_t) bytes[3] << 16) |
+           ((uint64_t) bytes[4] << 8)  | (uint64_t) bytes[5];
+  }
+
+  static void UInt32ToBytes(uint8_t bytes[], uint32_t n) {
+    bytes[0] = n & 0xff;
+    bytes[1] = (n >> 8) & 0xff;
+    bytes[2] = (n >> 16) & 0xff;
+    bytes[3] = (n >> 24) & 0xff;
+  }
+
+  static bool CreateGUID(GUID *guid) {
+    InitOnce();
+    guid->data1 = random();
+    guid->data2 = (uint16_t)(random());
+    guid->data3 = (uint16_t)(random());
+    UInt32ToBytes(&guid->data4[0], random());
+    UInt32ToBytes(&guid->data4[4], random());
+    return true;
+  }
+
+ private:
+  static void InitOnce() {
+    pthread_once(&once_control, &InitOnceImpl);
+  }
+
+  static void InitOnceImpl() {
+    srandom(time(NULL));
+  }
+
+  static pthread_once_t once_control;
+};
+
+pthread_once_t GUIDGenerator::once_control = PTHREAD_ONCE_INIT;
+
+bool CreateGUID(GUID *guid) {
+  return GUIDGenerator::CreateGUID(guid);
+}
+
+// Parse guid to string.
+bool GUIDToString(const GUID *guid, char *buf, size_t buf_len) {
+  // Should allow more space the the max length of GUID.
+  assert(buf_len > kGUIDStringLength);
+  int num = snprintf(buf, buf_len, kGUIDFormatString,
+                     guid->data1, guid->data2, guid->data3,
+                     GUIDGenerator::BytesToUInt16(&(guid->data4[0])),
+                     GUIDGenerator::BytesToUInt48(&(guid->data4[2])));
+  if (num != kGUIDStringLength)
+    return false;
+
+  buf[num] = '\0';
+  return true;
+}
diff --git a/toolkit/crashreporter/breakpad-client/linux/handler/guid_generator.h b/toolkit/crashreporter/breakpad-client/linux/handler/guid_generator.h
new file mode 100644
index 000000000000..de97eda1cbdc
--- /dev/null
+++ b/toolkit/crashreporter/breakpad-client/linux/handler/guid_generator.h
@@ -0,0 +1,48 @@
+// Copyright (c) 2006, Google Inc.
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#ifndef LINUX_HANDLER_GUID_GENERATOR_H__
+#define LINUX_HANDLER_GUID_GENERATOR_H__
+
+#include "google_breakpad/common/minidump_format.h"
+
+typedef MDGUID GUID;
+
+// Format string for parsing GUID.
+const char kGUIDFormatString[] = "%08x-%04x-%04x-%04x-%012" PRIx64;
+// Length of GUID string. Don't count the ending '\0'.
+const size_t kGUIDStringLength = 36;
+
+// Create a guid.
+bool CreateGUID(GUID *guid);
+
+// Get the string from guid.
+bool GUIDToString(const GUID *guid, char *buf, size_t buf_len);
+
+#endif
diff --git a/toolkit/crashreporter/breakpad-client/linux/handler/minidump_descriptor.cc b/toolkit/crashreporter/breakpad-client/linux/handler/minidump_descriptor.cc
index 4d4bd162805d..f61db98d5a39 100644
--- a/toolkit/crashreporter/breakpad-client/linux/handler/minidump_descriptor.cc
+++ b/toolkit/crashreporter/breakpad-client/linux/handler/minidump_descriptor.cc
@@ -29,10 +29,9 @@
 
 #include <stdio.h>
 
+#include "linux/handler/guid_generator.h"
 #include "linux/handler/minidump_descriptor.h"
 
-#include "common/linux/guid_creator.h"
-
 namespace google_breakpad {
 
 //static
diff --git a/toolkit/crashreporter/breakpad-client/linux/moz.build b/toolkit/crashreporter/breakpad-client/linux/moz.build
index 71a4389406d2..73a08eb16e62 100644
--- a/toolkit/crashreporter/breakpad-client/linux/moz.build
+++ b/toolkit/crashreporter/breakpad-client/linux/moz.build
@@ -10,6 +10,7 @@ UNIFIED_SOURCES += [
     'dump_writer_common/thread_info.cc',
     'dump_writer_common/ucontext_reader.cc',
     'handler/exception_handler.cc',
+    'handler/guid_generator.cc',
     'handler/minidump_descriptor.cc',
     'log/log.cc',
     'microdump_writer/microdump_writer.cc',
@@ -18,6 +19,10 @@ UNIFIED_SOURCES += [
     'minidump_writer/minidump_writer.cc',
 ]
 
+# On Linux we override the guid_creator.h header and use our own instead
+if CONFIG['OS_TARGET'] == 'Linux' or CONFIG['OS_TARGET'] == 'Android':
+    DEFINES['COMMON_LINUX_GUID_CREATOR_H__'] = 1
+
 if CONFIG['OS_TARGET'] == 'Android':
     LOCAL_INCLUDES += [
         '/toolkit/crashreporter/google-breakpad/src/common/android/include',
diff --git a/toolkit/crashreporter/google-breakpad/src/common/linux/moz.build b/toolkit/crashreporter/google-breakpad/src/common/linux/moz.build
index 7450f6ba3f29..75e1ea2df162 100644
--- a/toolkit/crashreporter/google-breakpad/src/common/linux/moz.build
+++ b/toolkit/crashreporter/google-breakpad/src/common/linux/moz.build
@@ -6,7 +6,6 @@
 
 UNIFIED_SOURCES += [
     'elfutils.cc',
-    'guid_creator.cc',
     'linux_libc_support.cc',
     'memory_mapped_file.cc',
     'safe_readlink.cc',
@@ -29,7 +28,6 @@ HOST_SOURCES += [
     'elf_symbols_to_module.cc',
     'elfutils.cc',
     'file_id.cc',
-    'guid_creator.cc',
     'linux_libc_support.cc',
     'memory_mapped_file.cc',
 ]
diff --git a/tools/profiler/moz.build b/tools/profiler/moz.build
index bd58736fd17f..da4daed82837 100644
--- a/tools/profiler/moz.build
+++ b/tools/profiler/moz.build
@@ -60,7 +60,6 @@ if CONFIG['MOZ_GECKO_PROFILER']:
             SOURCES += [
                 '/toolkit/crashreporter/google-breakpad/src/common/linux/elfutils.cc',
                 '/toolkit/crashreporter/google-breakpad/src/common/linux/file_id.cc',
-                '/toolkit/crashreporter/google-breakpad/src/common/linux/guid_creator.cc',
                 '/toolkit/crashreporter/google-breakpad/src/common/linux/linux_libc_support.cc',
                 '/toolkit/crashreporter/google-breakpad/src/common/linux/memory_mapped_file.cc',
             ]

From 9b71d631d4fc63eb2aa4441232b6600aeb000d08 Mon Sep 17 00:00:00 2001
From: Federico Padua <federico_padua@yahoo.it>
Date: Sat, 18 Mar 2017 21:18:27 +0100
Subject: [PATCH 31/46] Bug 1344833 - Enable flake8 rule E128: "continuation
 line under-indented for visual indent". r=Dexter

This patch enables flake8 rule E128:
"continuation line under-indented for visual indent" in toolkit/components/telemetry
by removing the relative E128 entry from toolkit/components/telemetry/.flake8
and fixing the files for which the E128 error was reported.
Precisely 10 errors violating E128 rule were found and solved.

MozReview-Commit-ID: 4sNXIxGFJQN

--HG--
extra : rebase_source : bc2ef3bf1cc4bbe5b0450458226af07a83c30f30
---
 toolkit/components/telemetry/.flake8          |  2 +-
 .../telemetry/gen-histogram-data.py           | 20 +++++++++----------
 .../components/telemetry/histogram_tools.py   |  8 ++++----
 toolkit/components/telemetry/parse_scalars.py | 10 +++++-----
 4 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/toolkit/components/telemetry/.flake8 b/toolkit/components/telemetry/.flake8
index 4559a3d82bd5..cfed80d4d151 100644
--- a/toolkit/components/telemetry/.flake8
+++ b/toolkit/components/telemetry/.flake8
@@ -1,5 +1,5 @@
 [flake8]
 # See http://pep8.readthedocs.io/en/latest/intro.html#configuration
-ignore = E121, E123, E126, E129, E133, E226, E241, E242, E704, W503, E402, E128, E501, E202, W602, E127, W601
+ignore = E121, E123, E126, E129, E133, E226, E241, E242, E704, W503, E402, E501, E202, W602, E127, W601
 max-line-length = 99
 filename = *.py, +.lint
diff --git a/toolkit/components/telemetry/gen-histogram-data.py b/toolkit/components/telemetry/gen-histogram-data.py
index 1c6813bb2426..151c536f25e3 100644
--- a/toolkit/components/telemetry/gen-histogram-data.py
+++ b/toolkit/components/telemetry/gen-histogram-data.py
@@ -21,16 +21,16 @@ def print_array_entry(output, histogram, name_index, exp_index, label_index, lab
     if cpp_guard:
         print("#if defined(%s)" % cpp_guard, file=output)
     print("  { %s, %s, %s, %s, %d, %d, %s, %d, %d, %s },"
-        % (histogram.low(),
-           histogram.high(),
-           histogram.n_buckets(),
-           histogram.nsITelemetry_kind(),
-           name_index,
-           exp_index,
-           histogram.dataset(),
-           label_index,
-           label_count,
-           "true" if histogram.keyed() else "false"), file=output)
+          % (histogram.low(),
+             histogram.high(),
+             histogram.n_buckets(),
+             histogram.nsITelemetry_kind(),
+             name_index,
+             exp_index,
+             histogram.dataset(),
+             label_index,
+             label_count,
+             "true" if histogram.keyed() else "false"), file=output)
     if cpp_guard:
         print("#endif", file=output)
 
diff --git a/toolkit/components/telemetry/histogram_tools.py b/toolkit/components/telemetry/histogram_tools.py
index a745af236dbd..ce13627330b7 100644
--- a/toolkit/components/telemetry/histogram_tools.py
+++ b/toolkit/components/telemetry/histogram_tools.py
@@ -371,14 +371,14 @@ associated with the histogram.  Returns None if no guarding is necessary."""
                 continue
             if not isinstance(definition[key], key_type):
                 raise ValueError, ('value for key "{0}" in Histogram "{1}" '
-                        'should be {2}').format(key, name, nice_type_name(key_type))
+                                   'should be {2}').format(key, name, nice_type_name(key_type))
 
         for key, key_type in type_checked_list_fields.iteritems():
             if key not in definition:
                 continue
             if not all(isinstance(x, key_type) for x in definition[key]):
                 raise ValueError, ('all values for list "{0}" in Histogram "{1}" '
-                        'should be {2}').format(key, name, nice_type_name(key_type))
+                                   'should be {2}').format(key, name, nice_type_name(key_type))
 
     @staticmethod
     def check_keys(name, definition, allowed_keys):
@@ -393,8 +393,8 @@ associated with the histogram.  Returns None if no guarding is necessary."""
         if whitelists is not None and self._n_buckets > 100 and type(self._n_buckets) is int:
             if self._name not in whitelists['n_buckets']:
                 raise KeyError, ('New histogram "%s" is not permitted to have more than 100 buckets. '
-                                'Histograms with large numbers of buckets use disproportionately high amounts of resources. '
-                                'Contact the Telemetry team (e.g. in #telemetry) if you think an exception ought to be made.' % self._name)
+                                 'Histograms with large numbers of buckets use disproportionately high amounts of resources. '
+                                 'Contact the Telemetry team (e.g. in #telemetry) if you think an exception ought to be made.' % self._name)
 
     @staticmethod
     def boolean_flag_bucket_parameters(definition):
diff --git a/toolkit/components/telemetry/parse_scalars.py b/toolkit/components/telemetry/parse_scalars.py
index b6c6d240c0a0..4a3713047fab 100644
--- a/toolkit/components/telemetry/parse_scalars.py
+++ b/toolkit/components/telemetry/parse_scalars.py
@@ -49,7 +49,7 @@ class ScalarType:
         for n in [group_name, probe_name]:
             if len(n) > MAX_NAME_LENGTH:
                 raise ValueError("Name '{}' exceeds maximum name length of {} characters."
-                                .format(n, MAX_NAME_LENGTH))
+                                 .format(n, MAX_NAME_LENGTH))
 
         def check_name(name, error_msg_prefix, allowed_char_regexp):
             # Check if we only have the allowed characters.
@@ -60,8 +60,8 @@ class ScalarType:
             # Don't allow leading/trailing digits, '.' or '_'.
             if re.search(r'(^[\d\._])|([\d\._])$', name):
                 raise ValueError(error_msg_prefix +
-                    " name must not have a leading/trailing digit, a dot or underscore. Got: '{}'"
-                    .format(name))
+                                 " name must not have a leading/trailing digit, a dot or underscore. Got: '{}'"
+                                 .format(name))
 
         check_name(group_name, 'Group', r'\.')
         check_name(probe_name, 'Probe', r'_')
@@ -115,7 +115,7 @@ class ScalarType:
 
         # Checks the type for all the fields.
         wrong_type_names = ['{} must be {}'.format(f, ALL_FIELDS[f].__name__)
-            for f in definition.keys() if not isinstance(definition[f], ALL_FIELDS[f])]
+                            for f in definition.keys() if not isinstance(definition[f], ALL_FIELDS[f])]
         if len(wrong_type_names) > 0:
             raise TypeError(self._name + ' - ' + ', '.join(wrong_type_names))
 
@@ -237,7 +237,7 @@ class ScalarType:
         release_channel_collection = \
             self._definition.get('release_channel_collection', 'opt-in')
         return 'nsITelemetry::' + ('DATASET_RELEASE_CHANNEL_OPTOUT'
-            if release_channel_collection == 'opt-out' else 'DATASET_RELEASE_CHANNEL_OPTIN')
+                                   if release_channel_collection == 'opt-out' else 'DATASET_RELEASE_CHANNEL_OPTIN')
 
     @property
     def cpp_guard(self):

From d7e6cc08c3797ce2112f41f2bc24005b08a0c14a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A3o=20Gottwald?= <dao@mozilla.com>
Date: Thu, 16 Mar 2017 15:11:05 +0100
Subject: [PATCH 32/46] Bug 1347928 - Remove legacy information-*.png icons.
 r=jaws

MozReview-Commit-ID: 47FAxEjg4KG

--HG--
extra : rebase_source : 6b67778d0129752867b4f1d5933e016464a398c9
---
 .../migration/content/aboutWelcomeBack.xhtml     |   2 +-
 browser/themes/shared/aboutProviderDirectory.css |   2 +-
 .../shared/components/notification-box.css       |   3 ++-
 .../test_autofill_default_behavior.js            |  10 +++++-----
 .../places/tests/unit/test_bookmarks_html.js     |   2 +-
 toolkit/themes/osx/global/global.css             |   2 +-
 .../themes/osx/global/icons/information-16.png   | Bin 818 -> 0 bytes
 .../themes/osx/global/icons/information-24.png   | Bin 1289 -> 0 bytes
 .../themes/osx/global/icons/information-32.png   | Bin 1773 -> 0 bytes
 .../themes/osx/global/icons/information-64.png   | Bin 3687 -> 0 bytes
 .../osx/global/icons/information-large.png       | Bin 2592 -> 0 bytes
 toolkit/themes/osx/global/jar.mn                 |   5 -----
 toolkit/themes/shared/non-mac.jar.inc.mn         |   3 ---
 toolkit/themes/windows/global/global.css         |   2 +-
 .../windows/global/icons/information-24.png      | Bin 1477 -> 0 bytes
 .../windows/global/icons/information-32.png      | Bin 2080 -> 0 bytes
 toolkit/themes/windows/global/jar.mn             |   1 +
 17 files changed, 13 insertions(+), 19 deletions(-)
 delete mode 100644 toolkit/themes/osx/global/icons/information-16.png
 delete mode 100644 toolkit/themes/osx/global/icons/information-24.png
 delete mode 100644 toolkit/themes/osx/global/icons/information-32.png
 delete mode 100644 toolkit/themes/osx/global/icons/information-64.png
 delete mode 100644 toolkit/themes/osx/global/icons/information-large.png
 delete mode 100644 toolkit/themes/windows/global/icons/information-24.png
 delete mode 100644 toolkit/themes/windows/global/icons/information-32.png

diff --git a/browser/components/migration/content/aboutWelcomeBack.xhtml b/browser/components/migration/content/aboutWelcomeBack.xhtml
index 058a329755f4..d4e4b120d7ef 100644
--- a/browser/components/migration/content/aboutWelcomeBack.xhtml
+++ b/browser/components/migration/content/aboutWelcomeBack.xhtml
@@ -20,7 +20,7 @@
     <title>&welcomeback2.tabtitle;</title>
     <link rel="stylesheet" href="chrome://global/skin/in-content/info-pages.css" type="text/css" media="all"/>
     <link rel="stylesheet" href="chrome://browser/skin/aboutWelcomeBack.css" type="text/css" media="all"/>
-    <link rel="icon" type="image/png" href="chrome://global/skin/icons/information-16.png"/>
+    <link rel="icon" type="image/png" href="chrome://browser/skin/info.svg"/>
 
     <script type="application/javascript" src="chrome://browser/content/aboutSessionRestore.js"/>
   </head>
diff --git a/browser/themes/shared/aboutProviderDirectory.css b/browser/themes/shared/aboutProviderDirectory.css
index 73e570aada4b..5b8b08dbca10 100644
--- a/browser/themes/shared/aboutProviderDirectory.css
+++ b/browser/themes/shared/aboutProviderDirectory.css
@@ -7,7 +7,7 @@ body {
 
 #message-box {
   margin-top: 2em;
-  background: url('chrome://global/skin/icons/information-24.png') no-repeat left 4px;
+  background: url(chrome://browser/skin/info.svg) no-repeat left 8px;
   padding-inline-start: 30px;
 }
 
diff --git a/devtools/client/shared/components/notification-box.css b/devtools/client/shared/components/notification-box.css
index 1d2444431be0..12870ac4f778 100644
--- a/devtools/client/shared/components/notification-box.css
+++ b/devtools/client/shared/components/notification-box.css
@@ -51,6 +51,7 @@
 
 .notificationbox .messageImage {
   display: inline-block;
+  background-size: 16px;
   width: 16px;
   height: 16px;
   margin: 6px;
@@ -59,7 +60,7 @@
 /* Default icons for notifications */
 
 .notificationbox .messageImage[data-type="info"] {
-  background-image: url("chrome://global/skin/icons/information-16.png");
+  background-image: url("chrome://global/skin/icons/info.svg");
 }
 
 .notificationbox .messageImage[data-type="warning"] {
diff --git a/toolkit/components/places/tests/unifiedcomplete/test_autofill_default_behavior.js b/toolkit/components/places/tests/unifiedcomplete/test_autofill_default_behavior.js
index 930986905f93..2861bb989ca2 100644
--- a/toolkit/components/places/tests/unifiedcomplete/test_autofill_default_behavior.js
+++ b/toolkit/components/places/tests/unifiedcomplete/test_autofill_default_behavior.js
@@ -24,7 +24,7 @@ add_task(function* test_default_behavior_host() {
   yield addBookmark( { uri: uri4, title: "tpbk" } );
   yield addBookmark( { uri: uri5, title: "title", tags: ["foo"] } );
 
-  yield setFaviconForHref(uri1.spec, "chrome://global/skin/icons/information-16.png");
+  yield setFaviconForHref(uri1.spec, "chrome://global/skin/icons/info.svg");
   yield setFaviconForHref(uri3.spec, "chrome://global/skin/icons/error-16.png");
   yield setFaviconForHref(uri6.spec, "chrome://global/skin/icons/question-16.png");
 
@@ -45,7 +45,7 @@ add_task(function* test_default_behavior_host() {
   yield check_autocomplete({
     search: "ty",
     matches: [ { uri: uri1, title: "typed", style: [ "autofill", "heuristic" ],
-                 icon: "chrome://global/skin/icons/information-16.png" } ],
+                 icon: "chrome://global/skin/icons/info.svg" } ],
     autofilled: "typed/",
     completed: "typed/"
   });
@@ -116,7 +116,7 @@ add_task(function* test_default_behavior_host() {
   yield check_autocomplete({
     search: "ty",
     matches: [ { uri: uri1, title: "typed", style: [ "autofill", "heuristic" ],
-                 icon: "chrome://global/skin/icons/information-16.png"} ],
+                 icon: "chrome://global/skin/icons/info.svg"} ],
     autofilled: "typed/",
     completed: "typed/"
   });
@@ -223,7 +223,7 @@ add_task(function* test_default_behavior_url() {
   yield addBookmark( { uri: uri3, title: "bookmarked" } );
   yield addBookmark( { uri: uri4, title: "tpbk" } );
 
-  yield setFaviconForHref(uri1.spec, "chrome://global/skin/icons/information-16.png");
+  yield setFaviconForHref(uri1.spec, "chrome://global/skin/icons/info.svg");
   yield setFaviconForHref(uri3.spec, "chrome://global/skin/icons/error-16.png");
 
   // RESTRICT TO HISTORY.
@@ -245,7 +245,7 @@ add_task(function* test_default_behavior_url() {
   yield check_autocomplete({
     search: "typed/t",
     matches: [ { uri: uri1, title: "typed/ty/", style: [ "autofill", "heuristic" ],
-                 icon: "chrome://global/skin/icons/information-16.png"} ],
+                 icon: "chrome://global/skin/icons/info.svg"} ],
     autofilled: "typed/ty/",
     completed: "http://typed/ty/"
   });
diff --git a/toolkit/components/places/tests/unit/test_bookmarks_html.js b/toolkit/components/places/tests/unit/test_bookmarks_html.js
index ad04b61dccf2..fb05be298089 100644
--- a/toolkit/components/places/tests/unit/test_bookmarks_html.js
+++ b/toolkit/components/places/tests/unit/test_bookmarks_html.js
@@ -176,7 +176,7 @@ add_task(function* test_import_chromefavicon() {
   // 9. empty bookmarks db and continue
 
   const PAGE_URI = NetUtil.newURI("http://example.com/chromefavicon_page");
-  const CHROME_FAVICON_URI = NetUtil.newURI("chrome://global/skin/icons/information-16.png");
+  const CHROME_FAVICON_URI = NetUtil.newURI("chrome://global/skin/icons/info.svg");
   const CHROME_FAVICON_URI_2 = NetUtil.newURI("chrome://global/skin/icons/error-16.png");
 
   do_print("Importing from html");
diff --git a/toolkit/themes/osx/global/global.css b/toolkit/themes/osx/global/global.css
index a7e52ab1e534..b9dc5c3cc9c2 100644
--- a/toolkit/themes/osx/global/global.css
+++ b/toolkit/themes/osx/global/global.css
@@ -71,7 +71,7 @@ window.dialog {
 }
 
 .message-icon {
-  list-style-image: url("chrome://global/skin/icons/information-64.png");
+  list-style-image: url("chrome://global/skin/icons/info.svg");
 }
 
 .alert-dialog #info\.icon,
diff --git a/toolkit/themes/osx/global/icons/information-16.png b/toolkit/themes/osx/global/icons/information-16.png
deleted file mode 100644
index 6fb2e3a80421bb3e150f4b33aac7860c1f8282b7..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 818
zcmV-21I_%2P)<h;3K|Lk000e1NJLTq000mG000mO1^@s6AM^iV0000PbVXQnQ*UN;
zcVTj606}DLVr3vnZDD6+Qe|Oed2z{QJOBU!)Ja4^RCwA<Q%y)zQ562}dv9i(Kc_K=
z(i)0d)F{}>3Id6CCR7{gXVb2B1+_DZAaa*bw9#dd74F)&h@y<39}tvGgp8(a)Xbl8
z-v52?-p+lE>4n4n`@Zj-d+s?*N(nU>V>r@1TG&?Tyva1<6l2;R)Q6O!EJg5qZRyjU
z52M{n8=Q!zHbiD8&VTETCGtb1j(F~1DTbW|4U7OmDDi7vU}ieN*BQUcz12&vp6nZu
zbrpqSUA>d%8uP{Bp3^BLQVhSABx*GQ9uP({q!J7}n>9G5z?+v2YSo_?#zs1xDiPLx
z>_JQG{<G7^Pd4U!(sNw$$_1{SNnjU|=9WVAKlbPu8e%$-&;=$wn$^nev(nVNEAv{R
z*nO*bAf7Wrz;b2e)$@2nR%3TTkM^8Pn3lkr1r%E2ImM%EO@pTQWSe7=XWy3*kkedV
z;E}-h`G4d<SpX6P^acZpN7r#fLKY>{z&!~ODg(k$$Bn@?c&-awPrxve2q|Y9$yYz7
zc(hC!q4eQ75+SK8vJwet?z@;r+g<~oXE|;U*_2FR%kM#Ip_+6f6dqjlc8Y+z^-z6*
zz!MQL<RNS`pvM}Ue@}nMxgD(y&TEz5Kb+QpZvv=rAnNV}O+JZh`lfr0sl3!GN?&uG
z#TVxKAMzv!xM@<<#Ykc6xr)xVm!Wuc?Pzn84+mDO-)e?#NA5hAfMi0*dNhcL>ReKO
zbj^msD;{0@suI)1&c4fyEl2OQG#{c;O2ee0uq}&(EEur_(%D92G6v<*!ou<d*5}_}
z|M{tZkhqqv%6+}^wyZbg*KLG{g+M%$N+Od^A)8GiooS#{dss8e_`Nc2Rp(yct&9&m
zBHn7$M;pyV2f5_-w)Updg{wwGzKiMc9gs;%xkI7*i-Eg3wlY0@-&y`LMcC^9X4=}$
ws<OzkWKCq5db25jNwz{(Q}5o|&VL0M0A+Em$RO51QUCw|07*qoM6N<$g5?T@<NyEw

diff --git a/toolkit/themes/osx/global/icons/information-24.png b/toolkit/themes/osx/global/icons/information-24.png
deleted file mode 100644
index 6907d02e5f80f56e927461e4e5186a2e30bae5ed..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1289
zcmV+k1@`)hP)<h;3K|Lk000e1NJLTq000;O000;W1^@s6;CDUv0000PbVXQnQ*UN;
zcVTj606}DLVr3vnZDD6+Qe|Oed2z{QJOBU$t4TybRCwBSRqJb9MHD}C-<!>vY_?rf
zQ<{oW(_&&Zq_s90r4%Xnp^z3q|A8ug_lw{Ip?>s(nD_uiXe+h_zo>0Ns3G+MZS$ZB
zRkSp*-Mn_weeb<{@160S*}I#4IdHf$=g$0o=QVSf5CZB4V@!Tf)UoloVJqDC7E`q6
z8B_Y}_X)w51ox)w;>st#To{}|l_%BBc=ZZaL01nP`*BY+e&DlE*cjctM}uAc8f@FH
zfT$pY&jB{pI4s}w;omzRI7MeVwR-K;^()8!B%%h)>LLKw$4)McTOB(l_CITN?He*6
zn-j2^=1{T)xUK-f1t<ywU1JdKRv;2)@YjM1i*t6yDXyKm`rY1(0g0#)RKZ_3F?%8s
z?LRYmGz4a+0-FyI)Dysc0VfY@FoNFD_~W(*XMT3k83qa-jYSzaB@VN{*^tlPdu{6c
z;04^~61Eb=T;2cDHv=7!zE6k8EGVODJ;|lT1g<f^22SJPfCgUK1I{a6C004)O8}1#
z8qm?%JMr|9b5Gzljj)v<p`q9#FHSu6q}jz)21VRVajuHza%di|>x1uu6f&Yv5Ma9u
z9^Pei_4JNT;uaG{QKa=p&W@O2^SSOm9UQdCL(6<T<oT6v!4WV$U#x*o%@k#Lc<{d}
z<+8xgYM@!h;b)GXA0ce=+la&l--!1cVB2U78Y?(R_eC(rAi>vH9GLt*E!UcEf~HwD
z>v^4ngb|7AP|EFl6PGuLz*JQ0P$+_Nb?XVBMnH3{8!#<R5(8RK;8Z8o|Mf#NRbZNV
z2&b0x0GQIJqtc@?6al!uHTPT(zIywi29Vd^&0zH*Ar)ie-2z2bDYZMvcrE_u@fa5#
zxMk5|eKkyF$7@M4=~PXX|C<LDCSj8Cn&7U=g^N|O1-KQS3Mr8{54*@g)n$U9>2(MQ
zTp2B8W9f$+=dJ{)ie13E&Tz=2IAoJPWK(`?nc_Z=1jFiktwNZR0c3~^E1T=Z9o#eI
zq2@sc+Ui)Vo(AV-aQ(sxVQbPDd;LZx+53vF_q09Gj=)2mfc6Bgn}c#Gd7V;47tKj7
zT{>4NuGJ2<h}(w16>ay@Agt8#rL%-h1m(oS=d<{(&pOVUEKhm3UjD~}=6!VO2*WO}
z&fLE>IZL%b1eA?z;?@@*q_h9z1uF(_iUw&7L!1As0O{<Vd}86t_i>dW544~YWgjeG
zUJS+de&h@P!)@J9fu)4y16C<j1qP4(jq^%1F-67aB8+Q}a|Rt@dN1>kOwU2){?*eD
zmVR243dB~cc_gE9tG_Sn;dsJP{DX>W7?IAXd~1D=VXf;pHxaNRD&AJBgTNIi*vpX2
z+|1_^*WO#1`Is8cItqotuQnVaK?I1PY>)Jf4)qMY`i^GAhb*-pLS_sMy$dSaDi^El
zW}xJx!1kBGbJpflx4%7|PyBile{TfV%ZAh3GAU$X6sp%)*Y1~xJ9mzbt5)|AQ_Xlo
z)AyZq-%iix?@eFK+`UW*P1RZM)^MAee)aNEv*<*L23~~%UA3)I-W(KcO^^!`nh)0P
zn|>3CY((_j24c!rw~?S6kl4YObi5hwKLG{+*R&Uy9o{R400000NkvXXu0mjfSA1*e

diff --git a/toolkit/themes/osx/global/icons/information-32.png b/toolkit/themes/osx/global/icons/information-32.png
deleted file mode 100644
index 4501bc813a0ee502fdea711dfb2f4a37cac8abfe..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1773
zcmV<J1`_#+P)<h;3K|Lk000e1NJLTq001BW001Be1^@s6b9#F80000PbVXQnQ*UN;
zcVTj606}DLVr3vnZDD6+Qe|Oed2z{QJOBU&k4Z#9RCwBqS6OUSRT%#7ox9CUXSyP#
zv@ETZBGiO}P+24@22>JwGoqqzCBETH6MU0MLgMmf&<B@5FeYjw5g~DnY!yKXSdnF*
zdrN6M)6Rak<Nu$zGt73|p5&i9_uO;N_nq(j|9{RA7-Qg81VP{rG|!ejJ<Z;VCA&Qy
zZ5Ifh$MIWLep?(T0?fK*S*h=nv4NB4zU#b;)mG-yEEwfJ<^ju_cb{MHuUv6ZQMDJB
zG<#s#QV%R@@IYly$O7XJKzN$L=!gwNgBJANwZPC*r{dGM51&7|`7$;$+=!GAaKJri
z%Jx@>KJfYi`?qdWp>34};V6TN2!mLHK{AcgvlwK%YchaO6`&f4)l~`5+iSv=KXphZ
zqDOx^-uM<a!5(0j;N@3j!5`~<ufDPMjnj=w)%I=AsxXrT7!NZra30JC4r;T^?6dE=
zCz>JwEUXnF;03sNE)Ao@>FdL{kL~Qec;G%QOFpJl4Bock@S?`neLt+-=xuLllc8^%
zK`PC_wt-7+vxh*OK*2lkcBIa|Aq!+lfcAANRM(2_0I!^}tmF&-T{<|5SUD100S8<}
z^F6ok{)P7S{`RI8nafQB((H1;Sq1O|v$F~a$W16vA^V?5*HxpBjGJ()H*x*PV+%K7
zZ8EDwmH;u(o_;y>VZ*YTuGLR?A)3esD;gLpUV2J~jcpkLdv2I;{3nAG$*GiEnv6;{
z=og`XQ!q6?_3^J?wj982De_9unZ4Yx{i{yR7wlTOR)d*D29yS}oF{+h{~1W4l>?{J
zi4JNQCI`#4E3%0x21_1QLD2$TghiNyEjr=m4K7&M-MmJDxK5xfXLga1=bNTg5>6%(
z$n~+D_Q;+;S;nSg4C<Q{AS}WpY>_+O#v`qY=HC%qs2~8i&cbq@iIf0muO)KezyF=!
zF67paIYwhkJ{e@yzk@Idn{<?_>o@PJTP#C5T@+Gwo~P&4fgr(WXVP%=+X(+ID;h|$
zhBGb<O&&Q##XyBCsw5yxe7#Nt6iKVu;SEZhAuHoRrKFI$sDOsE$z(#|p`#W(%N1Fb
zfH3jz`$Rw%MR}DsAcJj|11znx&<8&44ipUf+MyYACQm_Iw?YI6ll~F`6(<lRUnJjR
zPQr1^azsei%~EO8CN8L$$q6<e!nI)NK?W04>5*l-t8HfCtQdDPC?jKmACNPdrPHJS
z6w&#_OG;+nBJhm+qyI^anIc01rU^V`3T9j6h>%-?(y?_+*F=mbqr6?R>=rDd+NRFM
z5FhlPirUQNgSwfX#QgwcI1#lWHjNgs$}EA6xqxMqG#QTwx3J`Sf|<F^$hIv#s;A8W
z=|aQ_(A04t1Nfk&a+l7EA}Ay4Y^$H$_%J~sCSglFi5b(k!{f0ILG*)>ntK46LAg3h
zoV#yk0tp~Y!X^UgWVG+MSfsH-QGN61&iHK0E5Mx0K6^2Y7!W35lW4|7|LLD&@ktC1
z%JXxZRYrl#9x=Dk#vO}I0$~z15zrrmz6qrgBWF|TsoaL+Zs1BF`_0WLhY$u~5hh`C
zA3%#v_MQ4f)@ruaRR<xN66aV$=2ADi56GGg;c!0?7GV;$=p3EnV>dp(f~VN8r(<_O
zRbdVl+!Sy(4G*l5=p9HP24N8<b<28;f>w*xwDS2AC+cd}v?!hih{bJ}C@?VYqqtl~
zCbf#R#Rfq1$YtC6d?Fau2uz0m3Ee!scP~~AqD|5gh|b}VMv9<~4)naUe|++4C}|Ag
z*<a+U7CVy7JRnLzkd#_(^q=ZV+9Cf6zW^zH2p&vb4GsKps0%Sh94sUMOqjh3&?#ks
zR@J&<@rLe?yxP*1`r6f)C?tr+Yz&|I#knL45U3C_(VK8T+zZKMe`xs9kvCJ3TetA@
z1X?0{N66g^@<{lc<*0Ak@@}^pXx>v3XoE_BBlq%T(#G8oRdM`)_6o{?l1Bgq7gEy%
zp6esgL6}M1g!IhalY{5pK7vih^1us^<z;R~qy*jl8Y-9X><BJ-=5^Uy->J!s;8*KF
zL)krI;d)!>4=H^TlKKS1(?ejU#(HK3e)(eh-kHB>Y0<*@$MLzYW)vN&LxQZ@SHHfc
zV)3S}az*2lqU>KTh#r4IezdK)ZN%>xv7w8x;R|OIW0yk?Xv8tS7<^urQ%4N~qa#p-
z^X_#vvTVYzoqUpXEat>{+<Bk><<#wZ?f@zdDb<BQ+5yv@_c^cU{|hhxRLehXq}(3a
P00000NkvXXu0mjfQjJhr

diff --git a/toolkit/themes/osx/global/icons/information-64.png b/toolkit/themes/osx/global/icons/information-64.png
deleted file mode 100644
index 8d9b72498ed340f8c52dd8b2c0677e51fc9e3aac..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 3687
zcmV-t4w&(YP)<h;3K|Lk000e1NJLTq002M$002M;1^@s6s%dfF0000PbVXQnQ*UN;
zcVTj606}DLVr3vnZDD6+Qe|Oed2z{QJOBU=2}wjjRCwCtTX~Qa)fxZ#o^xks+1*)K
z7DNyi5EKM~1rdS=K}wTKi1DaYC8^R_nm<FL6|KZdVv^FN5=oiEqaspjqEeJm5`xOD
z$bHHsupB#kz|PLj^h{4rA9-*3^=xlX_Z+(enzE^n-syS$`hCCe_Z{!O9!l4B_%a_f
ze8~^?a&}HpRQ^wk&_pO(b4*2zoUMPu<zy*)8I{ILGV{N-W1QFDd<)HZ763($rD^u&
zV)tvBvITUlT~(#c>Ezi>+t#+7LVaokkg9`0Rii_j((Ih2>&FM{rasEBo@IiU8PgD9
zps9(5h6WmH!$?9D(3ELj<3Bu%zJ48gFKN)-twUF*3KzRIkTdF8HJe)9A3L;a$9s2t
zh8imvjA{WfYygPzSaELQ@<WRRZ{$(IE8N*SiG@j%S*S-!CsI1ZkaFn^fSA@HlSNu6
z1J=YR7WKe!0DggjfS-aIA3zYDdoStm>8A=DJE}lN%DkINb*|j>=F|_-ZP{u7F=POU
z;`l%IrX}xO6OPRNOHB<wf7TohS|@QirMr4{xD?kBtqmnjWzBQ$**bB0;`!F^@gqVA
zgvL4w>cbQqIjq3GJy}R4Gh5>q_dfXXd$*rJO;y7)^eYE|)#{7yKld}Azvd@1X7Mn6
z1_zzJ8gwG7$#S7$Cgn+FbN)_;!Jv?{zypk`M{b0`IC3Zp2liz_N++J)@apKNP!oBm
zY^WFjqC7L_&JEXu>ZiXkvW1_v@Kym*Xb4zwgW9DP$^(#RgB2Vo{LXY02B0NEL%<8L
zeM<(S9rD3=_s)BEtXqQFpj50+B{vY|*;~GO;8u^n<@M=vh0wLF9CV<-C8n*)K?&t_
zcST(kw=>0q7;#lI4aZSzIDS})r<3jXZhmX}1{@nI(y83Wl%c(_@LNZ|7YL2~)6KVe
z!5gHZJ4SrmqL8CCD*(X#zQPzWIzmAL#hHDdq#>Q?cx2;0r@TNw(5nUjvApM&<%ho?
ztR1y-!5v=6qD!LWZgr;t4_HxmZRdI)IL8Yt0Urf*ejT=NmOxDOJiPIZi7%B4LP-Ej
z+PB@cd1*Lu-CAt<v`#@*Dbs=l-=Tk+Zm_@#9Da^YRU8w{c!GmuKmgdkQ-c296U(-)
znZ3RocPI*g8SrM__Eu}%s0G{FZVQBT&QQKAx)ywg2Fhx1H%gUL$FblO424q}9S)pQ
zV9izq(l~qQ)Zo5cm@xpLaS;bd9|GdwE-`-b!UyyBY`EuWsldpVk?K6PP4ixxGSeHP
z(SRk{-9p7^o3j$9!z0TCXs%}lJqrUd2h|RvQJVY1+nF2)m<_IA+N^J0!-mPCVrqP=
zC!}c$UPG7KkchaHb_1c<Y!D;BE&BF}CmNfDsrAilZeW^4Su?e1w$DzYp+<MjW(t(I
z9-|u=`1(9H*S1(+IniwFA|j>$cs~O*b;5NE?>Y8U9Jn1OUc~`0{r<X}pP%dr)c&}2
zh6fU9+W<-pP`84E>jM?0jVnF(x?uvFYiq;_3%J@~<;_ZRP#Yo%5rH|*1A?z^#gut}
zoQw@=nXeQFz)JnbF-upDZRH_N>UOP|fb(_ZK4cYE1)rz%@&j(8scIfLt7!JKrWdp^
zMU-@ijOHOS_U`9Uw_Z0ExQ&RLwRGKLU(nmu(82>6kCE$bR?zHL(F$p*TNEkx$Y%-7
z&GG}*FL)*qJZ4{rMJ({now?+l#hB4fETCOL5&WSEKWLdKKt?VS@SM)t;5IpBkfbDB
zH)ti57t>n7b99&f^J8*3BsBZ1AIU?Y_S%QgN8X7Aw3F|*&Ut2{;0@dnitu?WYfe_T
zSwPDNyu!g#6a#yYXG#LFc`u4$sI9e+L1Q2RH8++rVvr}m0p|(cj^f!hIHlWJ;KTsF
zzIoAo4ak4YiH&9v`)7>|P_u(D=u81cGw{Yn3EDelSLM${WmvmS1{wi?@6k#I*V2L+
zTvNwE-N*$GW7oE`fOcSnkM)F?*JA6d#KP);XtvLWpCXH>Bq&+Lw3Nw`jLN~&tNLK$
z?gXN`YN5Rf?{4jfU;RA}vc{1NW9dsD=vyP%p%U>1c%V7oQXJT^j#d`rD?xIRn{eY3
zGsjPVX#1455ra}5xYqa16C3BxNC6cub7er0Ge{XNcMZD-#|yx6LcSy}*;ge?->A#z
z=@_&hS#{I#9gpqD>j(Mj(bkp;H?_?RhB;96!hly!onE{=MkAqU-~=zQyeDVT{LBt;
z<wq3;RyPnTIIu1r9}BgOv*x3Zhsko9ZU-Q@yv2DM=L)Ej!jvwlsAWO3BoJW93YMiX
z>kKi+2B6#lwDniX!SIM>!U$X%zesd-27qSR7LT7b{1!^j>z$XooZD)s!h89#nxX@J
z;OB9mX(I?01GD1we~v-qV_WQj&<+4cv;JAUm(536cct`-T_KCpN{K^3Ga5WtC^8Wm
z8UQTNtamoi*%1KRKt}_bp>xq592P1{E@Z&qcmehaOsOic6!1e{zNgK-70#Od>;N#i
z^rITST57&O*xGtY7MMY==*|#+HZ#Dm0_zVE1$|&wi7Dm+44&3#nz7E8w}>qbmI`#>
zvKXS3#Q-DM<Kfu*a#G%Hj^T7!HyA*<0YGlljLJ?cGqt(J11o4?spCtfEY&ClGz$Z*
z_YEfw=z1Oi*A*ekV8B52mQQn~iW0rBy}hlbmL8;>MkC-Z&u%bbK+z?!-01TF*!<cx
zD%+IDzOJHxk400Ba#&S#6yepfT)?0;Rpni47#O4r0J>2$X{bz9bCZ_>A9RS)rm~8R
z^So}X9jI>e{BqU;psZL?`GJ|8P1vIeJE#Rt!<oK4X;GTt@%skt-kK2QEGZib<G)p<
zf+6VTwW0N4gnPHxqM-RlHhIk4Om$;`qAFsCl#*ufUT>bxS*&mdoh5x3*3rufVEJ9+
zD!YK9NQj-O4(mL?5rA~!?5>nJVHqccatg~*6@$>{=mOcS1exT8Ps|rATwNe`;lrJw
zrdeoG&{)=hD~iEoPyn}~wd&HJMkSt{NkXh+(+)cWXgdSCPX6O`R!&4URjPR5p`?__
zfNDQiMY_mxG8#R$>NH`1?v@5II!QUzwNXk(?&XE1>gM4x7@+HBoT(lQWI2ZDe|{}q
zd~#&~8619e8nIw?O6moMfqYdsd?_!0TH97baQ;uFd!gsdzt-S|;#{h?7=kWHmZ(wB
zXK$a#q`J0X<lHtMDi>1TmIOc_w3jekk>y^<h@D%zPrQ!bAjuRfgz}6*l88q?S}ph*
zZ>|m1q6k`@AXt7Ds7@N>(Zn~Fj6z>@+iQgWiX8yj!AEhU)VaOSY>`skd*w`bej+n$
zDYp)&!n5$0B{X&^)wS>ZzTa=fI@#&(wlAO&Ux`N#zwlJQcpg|*A$~c0DaQq>A$ZIQ
zH1>`|fBgmOwvRAdE4ejB5W=L7_qMM)D8`Px*e{*}j;)eq%1ML66#Sw@Jb4Pl-lH$a
z&aOX*x{bNLEke7_91Irpo!t27b7Jz`$xOBfI39}c5Em6FyAU$l4n-JbC`Idmlz8ss
z$xT08NtBn|@~Z1AGUi)hNJfOmF1fL3>VvE6Yi|r>v%a$C_0B<1MH3P+cXoaz11#^)
z%|wS11O+r&o=-zZ&#q+j!1LefJNw_==<-FJ+TC85VoNNeVZVvT+W&os4~%+}x|;o6
zW8L+Tk$jL<hEk|7z;MALMUJsKq7Pv<DDV_;TneI>_CxH<y2p|7hluZIigm^otH{V}
z>X<&gU58(KpYt{T7LjwssD>Lr6#b~a9tsFl)n|IVfM2v0k@EW>(fP@*I}iQseRTN}
zw!Bm1FUtjNTjqEvxeiHF^UM|Z1)Juqh=gY#SMVbsH26G!bQAE?$nTTT*}E6|quZYC
z*!}D)=yDV@7s_~7u#y)g@e2k4B#jMIzI%J^n8m+r2u}-mxslKp*FaIOtm1fvS5rfS
zl<k1t{)5TB_VrKp9C-y>{yZ+^pv+fhD}7a#BOo*cn-@%LnEb%g9?w<dBjKqi_p%5G
zb%+77f+&LGV<?2I&Zy88I|%9YnNvN7UwJ&yu@$Gg9^&^(RbQ30fq>(NpSVP%dCn7$
zc*2wJuM13oaBv)&c<7KwRG$$ndTKC8gGZpCH*p&JQzs$acl6Z@A3gPF^mRA!`6O7j
zzN-#^#T_sR_|2;jjtl;#n<kBzeBY0FPt(+}e<IZQS`Yv_h$$UeNE`AB54JXsqPrjY
zImc2E7tcXFeH`R;=fO)yU;m95{rFRo=K4s$Q!4%C#BhHwArKJ4m=WQL%iH`-Grz(4
zBD4K`3k1Dmz{`hnZ*a=8jwV%xm~U~Jl`(#S0jGZ4D^{52D3sHw8~~YY9QxDeAelJ}
z*;MBav2)j&*zq^Fqo!S?$Pr1ZQ?JMmCTt*>aRIXdC-_<nh%Yj8d~nR7uktl5U*WiL
zqrldKhYJDEVyQ(6bGbXsM^j|CUemK6D}9hr;yJ~o>_x<+Sa&vY?*0Du5B`(t+I@;d
z_dZL7r@)o|$&3pSEXfpJ5-2ek0bkRsvA)QR>0Dsc^)%~=(47Bjie~)-1qW(QrO7-%
z5w)y%T2rLXY_em2s%y{QROil9#L5YBPLTpFI~>KU27m()3}J<bfZ-*7dk8>00gFQ5
zG$I9iESnVyQ7l8OD-oq7a!n!Y`d^%%%@qNHCSb5cILn!_m4qe$Dgi*Toz2Y*{R{cS
z$s#~lYhUY6XPxR{9SVOods&peA^`lq9AElhkN;1A0RV}fOf1bP;Z6Vm002ovPDHLk
FV1m-E`I7(u

diff --git a/toolkit/themes/osx/global/icons/information-large.png b/toolkit/themes/osx/global/icons/information-large.png
deleted file mode 100644
index 3912f1c79aba05b623e2efa110bc33af2241e36c..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 2592
zcmV+*3g7jKP)<h;3K|Lk000e1NJLTq001xm001xu1^@s6R|5Hm0000PbVXQnQ*UN;
zcVTj606}DLVr3vnZDD6+Qe|Oed2z{QJOBU*!bwCyRCwCdT3c)s*BSn2W@q;5HNIdQ
z8{;^{C;<u~1W^G=$VF{LD~jkf4{1?b^+MH`s+Y7cRbGf%DSfF*TD5A^=7A(MDN5V)
zBBdn>&{9l-T`&{~#sqAy*~RwWXLjbCo`2@-?#%AYtk;mL8Tr?Ech3CtegEzJbIuBs
zQg}Zfftytz2twswCSuLGe35b?HD|b40|ssqI06;7?fU2K;n=`VQBv*~KpYT6X`S0W
zlo+EF$OJL8HwxK_SB@O|;3cL9$&keo5t_M?gDzWGe&{pr?2&_Qdqa`H2YQxCu)JS{
z?k)+Iv<nala^s_Z_NVFq$?F6X2?7%n2Bc;Ps73wXC3SZH-=1IjEE`!Wd!{K&3mt5;
zxbpC0?|hB{|K74bdBui%6u50rf=r%5YMw$SN1?>P=8HT$sKr5%nJ|CHA_8<S5g;BF
z;PSWuBd1D`m@ZvmME1RQVCAoweytggEQo+$p$}|&^bbRAU7LT_(;M2hWt##^yCs-P
z5+)Q39@W$#)a5&CoFoBsFe1H6MVLzw7(SuF%yjX{?9A~mpZN1fFR)SiLR`_100*x;
z@QKqOZ)xk>zy97}>)LfPOs6O$=U7A&cYvtZ`Pp_IoS$1`0u1(vaC%gO|BPw#`Si8D
zum5)KOX!V8Bzy^Q@bdOgjeRlJ+WV77c7#D@Auz?j8-@$88tYSNG^Y9;9xHl8PzwZ(
zA1OjEJ^8i6FRuOt=7t{$PXZP2pFaQj_U^7{wtqMbSrs5#@USeY`3|VN^{JP~EQvF3
z#6keW|0qKG#>`g_zp(0;ek5E8l*8t}-6ua8?-+dUk)07p7g#0H{2yMiIH3@fDfG3A
z=J!`wo)lCZBUJAJ4?TFV0?^hX!0^!mWM;=7fAi&y2ff0njsUMV^7`%1-qpAABX4Ye
zDAsC7f>~J>W>E?s+91KB_sR~vuO8RnPyaI5aG^?oxaqMxC$owb4+D&x$jwiU|MC8j
z!+XwhPdN079;GtWx%}a0R;~%P>I}T5V_mZzKzxP5#yf;M@ObRltiYN9Ym7OTRPUp<
z`^$t>HY?2L0Qzqawjvh9gxG8|e?0*{Nh#ZQ5ASL3j%?}dmn)WEh!9pwHw}rNMd87_
z18fYf<_xi>uJUIf&Ro*jvz1r?qVdQU#Dv&v?TIS^{2UHOdcM`aDhN51a*J7F;F)-f
z!AcXJy$(|cA7h0I*Nyix<mKm3o8(#1SlTNCVnS@Sn8n)I-?Ho2XP0yZ`<0kvT7z&Y
zTg)CZmFs3mP+#z1OK`hhyM994LsJMy5NT2R5gTH(hmlxACaOewzSOlMXu7XXxeFP4
z38hqoa}$~;{;_e@98=L#2_@>#TPqsNhj_aJhz&8?af|lk9oqEd9ieDwb+k=(05<9@
z<`zPhx<g0uaOP5>4*c=cS$OI1IWvUIVPb_&HF1ege#sFT<X~_$Vzei-y`2tp^gg&F
z-WC8ux7<x?%A~zT0FOE@D-qcDn>koFI0pkgRy7*Cq{8{DtiDHDd`qz3ftbS403gN-
z@cj|&mFxt}SvR1xZV9&r>KZffd#K}otJ4lg<8XG;fHUt}{e~dKAjEPCuM<P4PI{y|
zp+V#H0VNaw#E4j#sQ7ij7D}=p29^gSEO`y;Q0xRu{fRNR?cB=rQ`u}MpyDk7e)qa+
zKFV!2UdSQI5+FuS05Ka54+v85P9-cmJOEzpF}R19UMj)Iwnkk6Jpb1;$a2W^#6m;I
zQ8L-|j2Jlq!5%`U2Utom7h6dR4MT=H@&I^6F-pV}fX=3LNwk<Rihv2r)L-_1BL^f(
z4RfX>HDG=7!5(T2=7MqstMo%2u}>*=|6UZzH%PS}5Uj?IIBT>g30fCMP-!Q?#{(2Z
zvD!*h0WZ)40vbpM`-(@vnd!uQQLzZPgb_I7-A>BTsR>>ydWTSnwI+gi6U!(<C4}mh
zRV-{QgbdyNb+8gHEW~h@HkdULG!m{_6O*_>2pKqWE)G9I0@SdtGdTztx|X?6$QOp#
zjOQqeCDn4jZi4o&)`a+6tu$$iBS47?h!L^Y62QlnbR$1m%oT?yQCKK2;KfFO-5%m&
zL4)VWB0ZopOCm<w8j`~UB{erWd?T^qfp8?c=rC>6PMg<-MTI|TY7P)1CqV7psOf>^
z#H+8VYL=Cws<oOE{}3WZH4mB<Jc<k(Vzhfew0mIY;=ysPn7W{q=6zpW8c8D$EJieK
z9uOO1bn^i4?k<;2oqnNExNf?v`3G5E@XU|0MVr)%Sn~PnfY=aYxf87r;B5iAB!BVf
zH(zFhrwt=>>qDpvs#(1>1I(z?hz&8?*G}yoAe>z)n;iXlu5iulTblKN;o||rd~a^f
z`Xa-S&Rhe;gxEMnQuj*98DVT?E**Q~U^a8*lv<iL6*S`kzcNajOky;kZcIZycjXjf
zLTt5bL$#|C_;`FDyfHoYt0(6(<5@|{o72B(y@q00+0O$=av{3RmQT#XTzWi<SP&D(
zM*MbYC|{pX&rba1Or&G&K9)iIdO9{i-Vj*}(Rd2Q7nd(QakV_<+v>R4@bVn-*CR;+
zM8X87QzI~U_3%E#f|xiq>PY}y!?%2j$oSe@Pyb$!lvXzEJ6&yeGgpdcALQRm1mM&;
zTtbvw)?7tirMzb{g>^A4F#=Pmw_$$j*bfi`w|>!W<0IhKuP_n_Gs|S=>WQZgkd2yb
zklZ(Vm)^ss>lkFSq>&9hykmEC{Sj{wS=eOZO5!a@PaXTw<jJQGAO?;_cU_2Xw7kwF
z#-zV{{obANzWcu2xnxx=8e9SM^MuWew`PkL_tRP!_)Osn%w^7J)01!hFfp?K6?W-e
z4!*hNbr%v#m~^%DZe81P*JIxeh6dKPw+uln+yS{fH9cY&O>U1e-$x=M#G(Qe)D$Gs
z7ok|VJeoRt;Hk{y(bL@WbBo^KsNE~zo@i&%*}dWGyThGp9#@oQ-SO}s#3Masa-v5{
ztmS6!^>smFDp3%)0HKgzmdJErn#nk*>QthTJo8-Q?H}VrmE<v>z3DBc+D$&b#2x2E
z+Lo^W%C2z7ox3Etb1)=#LRjg9V4xKgCUtqr9;4~=pfbr7lb{(%FiOesLh9V1>mxrs
z#74|=;Ax()w`P;iZJU*^61OnvKthr3jRUd1t=j_8?sZ}y)Gf-<+gw|TQtmR*iwQlK
z7|mWgdL*AXIl%#^_#{<$PqtaTHoEyjYs7XAbAmzp%0c;!kFTa_9B7`m1?BU5yV33U
zQv)7ea*enVDAkD0LH}=lYViN~V-Ml|{&SoE3NQexB|$xfZ1>v$0000<MNUMnLSTX~
CSk@2#

diff --git a/toolkit/themes/osx/global/jar.mn b/toolkit/themes/osx/global/jar.mn
index a5b4699bc080..a1fbebb08896 100644
--- a/toolkit/themes/osx/global/jar.mn
+++ b/toolkit/themes/osx/global/jar.mn
@@ -91,11 +91,6 @@ toolkit.jar:
   skin/classic/global/icons/close@2x.png                             (icons/close@2x.png)
   skin/classic/global/icons/glyph-dropdown.png                       (icons/glyph-dropdown.png)
   skin/classic/global/icons/glyph-dropdown@2x.png                    (icons/glyph-dropdown@2x.png)
-  skin/classic/global/icons/information-16.png                       (icons/information-16.png)
-  skin/classic/global/icons/information-24.png                       (icons/information-24.png)
-  skin/classic/global/icons/information-32.png                       (icons/information-32.png)
-  skin/classic/global/icons/information-64.png                       (icons/information-64.png)
-  skin/classic/global/icons/information-large.png                    (icons/information-large.png)
   skin/classic/global/icons/menulist-dropmarker.png                  (icons/menulist-dropmarker.png)
   skin/classic/global/icons/notfound.png                             (icons/notfound.png)
   skin/classic/global/icons/panebutton-active.png                    (icons/panebutton-active.png)
diff --git a/toolkit/themes/shared/non-mac.jar.inc.mn b/toolkit/themes/shared/non-mac.jar.inc.mn
index 151749f72f0f..28994c0555e9 100644
--- a/toolkit/themes/shared/non-mac.jar.inc.mn
+++ b/toolkit/themes/shared/non-mac.jar.inc.mn
@@ -68,9 +68,6 @@
   skin/classic/global/icons/error-64.png                   (../../windows/global/icons/error-64.png)
   skin/classic/global/icons/expand.png                     (../../windows/global/icons/expand.png)
   skin/classic/global/icons/folder-item.png                (../../windows/global/icons/folder-item.png)
-  skin/classic/global/icons/information-16.png             (../../windows/global/icons/information-16.png)
-  skin/classic/global/icons/information-24.png             (../../windows/global/icons/information-24.png)
-  skin/classic/global/icons/information-32.png             (../../windows/global/icons/information-32.png)
   skin/classic/global/icons/Minimize.gif                   (../../windows/global/icons/Minimize.gif)
   skin/classic/global/icons/Print-preview.png              (../../windows/global/icons/Print-preview.png)
   skin/classic/global/icons/Portrait.png                   (../../windows/global/icons/Portrait.png)
diff --git a/toolkit/themes/windows/global/global.css b/toolkit/themes/windows/global/global.css
index 4df78a297192..1e903a82cfe2 100644
--- a/toolkit/themes/windows/global/global.css
+++ b/toolkit/themes/windows/global/global.css
@@ -61,7 +61,7 @@ window.dialog {
 }
 
 .message-icon {
-  list-style-image: url("chrome://global/skin/icons/information-32.png");
+  list-style-image: url("chrome://global/skin/icons/info.svg");
 }
 
 .alert-dialog #info\.icon,
diff --git a/toolkit/themes/windows/global/icons/information-24.png b/toolkit/themes/windows/global/icons/information-24.png
deleted file mode 100644
index e23f9c3fed37bee0787ae3b2c2c97042cba18fe4..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1477
zcmV;$1v>hPP)<h;3K|Lk000e1NJLTq000;O000;W1^@s6;CDUv0000PbVXQnQ*UN;
zcVTj606}DLVr3vnZDD6+Qe|Oed2z{QJOBU%XGugsR7i=fR_jkwcNq4wUluRO9aJbP
z7tQuziHn<af-t~Vz}uEhqE=<uW^mh=nZ@V~6D%~XrGVpRDTM+(rG>VqrLa<UfN^u>
zB34;8Hn+I=f&B-4_P)QW^8$%W*5t`)&N;vLd9TlVmH}9{7z_<fD|PiowcgNR)?G4&
z^akUC!PppSyxhFd)@}+}x~*oLWLJAU^2()bFc!V3)f*}`b-Ia`HWTd5K?H)=aPy~0
z+z#Ipn4Fr%_{0qi`A1;0*(Zpk@}&ssbOwb+t214w(L`L{AvAW4pyFH)a@9>x6jdYk
zt+UuzT!Vs&7JOdof-5+KU+3qE#1@fd*%Sx_6iX7Y@tRt#qtn_8OaFH$KW)J#Wi`@D
zTA?`DgSBPWXOLdnimVb1PF4?MdhSnz!(sS*KF9MUPyVpy7Bb${HH3l_myup}1)C1J
zq4>~;4dpWQ(mn96s&fX44?J|whfI2&LGP8FGUNNuZ$xqjvg|dzK)^ZwrlvMxaRh{M
z#eNGi4-X-Wz}K9kUi`iAfbbCa@Bc0cGY&<cXB`<r#sLdTPjzDU=Le7^d&DjOTNBYO
zTu?XVy!=ax@I330@y7;o4$H9nr!X};hl^d4f*|XNUp#w^jD04YtQo{Fq9zg*-YdFm
zna*HTx3qVlse2filyeUI83IB&d7DOQc^aFKjUb1R%}~=>aw4;&7XGnW>aJmM3kw43
zZ?oMoh!fN;qHs@n&exn{!veQLQwU8?3ncGzWBq|aq?Fi^pzK3@aS!5(tXQ>Oi<4Cn
z#>a1<i{>O60SyuNIk)15_j;qokNS~AUTrx(x+uZ&H#-oM*GVvAH6ynJt9P2PVw)bX
z@2y2>dIoLnS3-{>s9*Tu)+91j8f2EckWI$791q~Nk4A~ik65JxDasxMg8|%}xF+z*
zJKczXm%L^aSP`4wjWxTv5R==ExHnE?HhdRNH1W|Q)A-NQbSCdSPhR`+YDIu@I)c<P
zC)VU!u`;(?K=!yXI^q>rmDh*FVw*rh5v8cGm&mM$%kRSS>@UFf4913tAYg5|O^n%l
z>abbugW`P|vGg)~#0S?D*aZ4|d*E_P0x<>sNLEIXwA)TZk|2u9HzQ%&8E{5ey97Zi
z3D+d$EWe@+Nkt~gt3`yJP}nC9#uxPqSUSz<>FyASD;h-Vo&lt)29Tn1JRyq9Yr)n7
zIs`_qgKH}YSQW=exIV42W5ret;@LQPleAkB2NQ}11Z=iG*lk?`2}%#vm$|X7)Qz<z
zQL+@36EWKj_~e{b2qdepAmD!GzLl>|Bay<3FR%#D*?8(6Cz6yd0gu}SpT{YXr1Bws
zpATt!y+q^@M5!uj*==9LIuJlB%@q+u=YS`UCyyua_!-Lg+x1A^-7h>^Tk1lh(klq=
z-u@BOp$P#d$T%1vN%21-qPp#DhWe{cunMy>utGf1BGz+Bk|J~Se<ANkGZHD69Qr!)
z?r{XcYvZ&R#xQzyOc1c~4F^X^hlY_vQST^kgl8y-3m0o6T77-x3u-ERWz!v!+{y4C
z$XB-_KDU|b;1o#Qu6Y4$oJkU?bMlUUi+*<iEcL9)i^?_YIO}=%P8jp|AL6qb7gBaq
zBRRhXX{sKiQJ#gz`+eBB*MZbR3)bzbLuFMT<l!J0??a77>(J6(S#qN>3F|qhi#OGc
z&>YS;_)%D4qD`h3o@cA-q5Rm4vj!KO-m730=CrWqb<Y`JawmI8&ux-4!8?~*I5agQ
zrgJttCx$2xybg&3l2w=ss@2uM+)jRmguWKIg;^E(D}uGf(9jssUotL4zcL!k+=>Qc
f(|`Y}_&@Ov`#9L0Mkd5s00000NkvXXu0mjfKSQ_w

diff --git a/toolkit/themes/windows/global/icons/information-32.png b/toolkit/themes/windows/global/icons/information-32.png
deleted file mode 100644
index a2a64a4fc198aa09a732fa0ecd2eeeff1d4ac1a1..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 2080
zcmV+*2;cXKP)<h;3K|Lk000e1NJLTq001BW001Be1^@s6b9#F80000PbVXQnQ*UN;
zcVTj606}DLVr3vnZDD6+Qe|Oed2z{QJOBU(!bwCyRCwCNS9?%Y*BSqvyX-ED0?Q-v
z5OkMkm6QO5%#hH?7=!qTVU$iyVn(Me?R3mcY|V6Z(vE+0{DW!6q?*StY1Agu=>#>&
z<Yi2xqwzruMzSa>mC9oQ<+aPQz_Rat=iIxO-4$z+{*lXk960yf@B5wK_c-5S!C(+S
z<ij|C-Me?I6N?uwhTrc;OiT<WCMHl+RD_|SA>`-h<M{F8#<H@q>Wqwx5?Wfq7&A(e
zgar#0blC0o-tO-1)7!UiZ$EYFRG_)J88tOEsH>~P)~#D{`0(L*0mOVupw%QhHgDei
zL{d_c0H@Jt)RANb2Ut;2ft4#)P7DtZze?+0CK<bz;(GxwksPY5tgP1S^}^WIo43$$
za}1NS5}XbP7%{Nal!YZp8dMhN!elZTb8~ZFC@d^|_QHh=uh92<Nc`UiKwVW;)gdE2
zF1H`er>@|{B^ze22r=3OWywPE`%JGNLAc?2=L=NiF#M*j3=fy&C$3(-`i0Y{Pgfs2
zcyJ>v8~H9Vu&uPT^w7eE3(?*+h*v)ugj=(ecB>8hl7t5^3;i?q_&j!$o4wfg+&UO^
z8gz7Ybne@?Z`Hf+9=jdBj@y>z^LKG^@u9f5I2>vD27me31&=mQHqK;QLHhZ_&+~BQ
z;A1$^ScUQeBh;59F}h^5Ta&SI_dDnxyajScQA0z+NqT9BHWm%QXf~VQqo~G-wwrkW
zvQa2gbt}(?%5*%nG7Et~0GTPV*!zp+G8<v!NCems$i=T;Y{AGl&!+o}nws7?5N%WZ
zqtoexP|CfOl9FQV>Knn|&v>EXzGmTSWywg=!tHho@pwE)OVV*?g3)Wn5CM3S72x?-
zJ{NSCmzV!?)28~eyD?x&Pfy=QxsBI9>4DCW7G-$u`LJ~ecE=26XJ-Y7w?6H@V@;T&
z(KoXMM_Vo-K0X2K*FXLzn$<>RK~7E%A9ir+&susg5i}FBNQL1<+;#-8?L`Y7xjzxN
z?H+v5IZZL5xobK}Opl}IZ)4p<0kW05p{Ay`__NPG{aR&!@)eYAPw=YN(&2!lF(8`w
zNFo?UCK-;lI&tp08yYG|lElam15*Sn!fTjB1}<Iw4-yj-xhpn?w1w(`iC&nvKW~g1
zppOgNHH*qTl4L^wZ$3vX5nwLY2fg_H-}>Qkdl2yX;PLuE5h}7pJ!_bRlNL9YnKLQX
zvwo_$!6N`HU%uSTE8TUg9lF?*c@6W5$2aEp2gDrJeo+}Y0LO$E<3qz@B{wQi%I3x2
z90Zr1LBGhHgoK1_S`eoKASDlQMYi!#NHN)wDHTR5u?)9Qe#Zka#DLcu6aYB@rW7Y`
zoCW1kWC+a<+!_@C^!iwn0$@S_ph+V)z$uIj9#SaD#%E`JaN3<z<vfV<$HL_b3gesw
zpO=6zIS7L+7%H*!w=!};0JdrR9Z)x?Q)7S>Ik*wMAy!UgULwh7+&HIv(mo0Iv}-QF
z=yADRDgdunr!b&+P8bg{5Kv>_zC^8H!0-2oeX9Vd_FK5()cY18=$j#>24Q?=+KtI^
zhw!I}0Ym}_#emn##HhMop<J*Llw_BZELof)063k_e(psz4LdtKdwB*d%T5*tNsx><
zY)&}FY_f5&b4doF_}WL&&f|as@lw=>-b*4_m9=b6B&rkHsTu)bY;24lN;4{erlzJI
zhr`jwGoc{W4co9CGm}&5j%6h*Od%7cTdUOygW^;RGcJW0mlR=|0IHV73jp2SH`+Lf
z;iWiev)Ml2AFlXuDm*S{lwqbQo12S`jTOQ{b093rxC%&;V<|n}PBkEd?;dS!Z6Af2
z6air8&Yfs)Z{I&PHHCE#7gBd)7r}T32%(fk0N^5+U>ZSlGy@`iB|kPkWF%L4VX=I3
z=JI9BSMwc4-F<z1|KK0&`BeqQs3T(c5lj#WgTWw-^HHnQsqt}#aZL;g(?;-EMLvjS
z96NS|AIbKJ!)Rb&0Lu6~>Uh@|<z^-BtRKhA?-K}WyTU=paV`Vk-81(o;1zxj)jv7^
z0<=nlMGN|{>#0(4YPPhT{HU|@%IAubc^i_^^XJb$$z8FzwiM5<=f!F&EdA!{Gw+U*
zlaqx+oSKrt7NvPcf)$MorHIpO$?sqF?ce{>^St`q(Gya;txlAbl<>g%Ej5&{aU*S=
z{n+!S1rzQxQcUMZ&?hQBQwo(B6<|!G7qJuY+fb3`!j4UJeeip6@nT#5-o1Z*W^i!e
zY^VT*dO`spR9wP=H8wUrU0YlGT4rWuyvyUqKTlZD{I7mYxRN1h69voRkq_o0)@^t&
zFMyv_n~{^20L~<J#n))(4OXl5%jov}e*pjiKv!2+aeaOL8+03bkT)y*B69hL6>V1s
zG42e)dTSh7Is%qtr6MEVhl-*c#L~p<tQ)<(JubRQy?5ZiU;jwzdV_bl1K#Um(y?~!
z+DCTn+O>ghJlm<eUGYHSQv9SSPXr)OD=r?7JW`3pwQK*LId|^thi||A*6XzEi=<=v
z|G63Q$4zpC?s*^3)yuqQ&6-sO1qCHZNy$H=`FL)4baa$5xX;?!+WI9$dMnKjWoKv4
ze49I8%y+oRav;~aY}v9!qkJ1`1i5d0k3PD}|GjR<KjiaY0R{jDj6bQI4>GL)0000<
KMNUMnLSTXjQ0prI

diff --git a/toolkit/themes/windows/global/jar.mn b/toolkit/themes/windows/global/jar.mn
index 74259ceba6bf..100a167a8273 100644
--- a/toolkit/themes/windows/global/jar.mn
+++ b/toolkit/themes/windows/global/jar.mn
@@ -43,6 +43,7 @@ toolkit.jar:
   skin/classic/global/icons/close-win7@2x.png              (icons/close-win7@2x.png)
   skin/classic/global/icons/close-inverted-win7.png        (icons/close-inverted-win7.png)
   skin/classic/global/icons/close-inverted-win7@2x.png     (icons/close-inverted-win7@2x.png)
+  skin/classic/global/icons/information-16.png             (icons/information-16.png)
   skin/classic/global/icons/resizer.png                    (icons/resizer.png)
   skin/classic/global/icons/sslWarning.png                 (icons/sslWarning.png)
 * skin/classic/global/in-content/common.css                (in-content/common.css)

From 65bc3f39b7d459c9ff03bfe73b1a78646a2fdfa9 Mon Sep 17 00:00:00 2001
From: Matt Brubeck <mbrubeck@mozilla.com>
Date: Mon, 20 Mar 2017 18:19:46 +0100
Subject: [PATCH 33/46] Bug 1348487 - stylo: Update test expectations.
 r=orange-fix

---
 layout/style/test/stylo-failures.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/layout/style/test/stylo-failures.md b/layout/style/test/stylo-failures.md
index 2f84fe6b7528..7c3be2f260a4 100644
--- a/layout/style/test/stylo-failures.md
+++ b/layout/style/test/stylo-failures.md
@@ -406,7 +406,7 @@ to mochitest command.
   * :-moz-window-inactive bug 1348489
     * test_selectors.html `:-moz-window-inactive` [2]
   * :-moz-{first,last}-node
-    * test_selectors.html `:-moz-` [13]
+    * test_selectors.html `:-moz-` [6]
     * ... `unexpected rule index` [5]
   * :dir
     * test_selectors.html `:dir` [10]

From e2f5ea371ab57a061038ec964dcdfd72a7cbc4d4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Emilio=20Cobos=20=C3=81lvarez?= <emilio@crisal.io>
Date: Mon, 20 Mar 2017 18:22:39 +0100
Subject: [PATCH 34/46] Bug 1341102: Skip some timing-dependent tests due to
 bug 1338982. r=emilio

MozReview-Commit-ID: 9VfSUA7kYux
---
 layout/reftests/bugs/reftest-stylo.list | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/layout/reftests/bugs/reftest-stylo.list b/layout/reftests/bugs/reftest-stylo.list
index bcff09e25d08..3ba1f024e7dc 100644
--- a/layout/reftests/bugs/reftest-stylo.list
+++ b/layout/reftests/bugs/reftest-stylo.list
@@ -386,10 +386,10 @@ fails == 315920-14.html 315920-14.html
 == 315920-15.html 315920-15.html
 fails == 315920-16.html 315920-16.html
 fails == 315920-17.html 315920-17.html
-== 315920-18a.html 315920-18a.html
-fails == 315920-18b.html 315920-18b.html
-== 315920-18c.html 315920-18c.html
-== 315920-18d.html 315920-18d.html
+skip-if(stylo) == 315920-18a.html 315920-18a.html # bug 1338982, which makes this timing-dependent
+skip-if(stylo) == 315920-18b.html 315920-18b.html # bug 1338982, which makes this timing-dependent
+skip-if(stylo) == 315920-18c.html 315920-18c.html # bug 1338982, which makes this timing-dependent
+skip-if(stylo) == 315920-18d.html 315920-18d.html # bug 1338982, which makes this timing-dependent
 fails == 315920-18e.html 315920-18e.html
 fails == 315920-18f.html 315920-18f.html
 fails == 315920-18g.html 315920-18g.html

From 4acfa9a890b567d1b7223189e8f9b108e401cdfc Mon Sep 17 00:00:00 2001
From: Botond Ballo <botond@mozilla.com>
Date: Wed, 15 Mar 2017 17:52:13 -0400
Subject: [PATCH 35/46] Bug 1346632 - On desktop platforms, do not ignore the
 root scroll frame when hit-testing in PrepareForSetTargetAPZCNotification.
 r=kats

Doing so produces incorrect hit testing results in some scenarios, e.g. when
dragging the scrollbar on certain pages.

MozReview-Commit-ID: AA0nu042U00

--HG--
extra : rebase_source : d84849d5bd22eee7fb837e8c717d202ce1bc5c86
---
 gfx/layers/apz/util/APZCCallbackHelper.cpp | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/gfx/layers/apz/util/APZCCallbackHelper.cpp b/gfx/layers/apz/util/APZCCallbackHelper.cpp
index 382d0f04d3b4..8ad1d144b101 100644
--- a/gfx/layers/apz/util/APZCCallbackHelper.cpp
+++ b/gfx/layers/apz/util/APZCCallbackHelper.cpp
@@ -628,8 +628,15 @@ PrepareForSetTargetAPZCNotification(nsIWidget* aWidget,
   ScrollableLayerGuid guid(aGuid.mLayersId, 0, FrameMetrics::NULL_SCROLL_ID);
   nsPoint point =
     nsLayoutUtils::GetEventCoordinatesRelativeTo(aWidget, aRefPoint, aRootFrame);
+  uint32_t flags = 0;
+#ifdef MOZ_WIDGET_ANDROID
+  // On Android, we need IGNORE_ROOT_SCROLL_FRAME for correct hit testing
+  // when zoomed out. On desktop, don't use it because it interferes with
+  // hit testing for some purposes such as scrollbar dragging.
+  flags = nsLayoutUtils::IGNORE_ROOT_SCROLL_FRAME;
+#endif
   nsIFrame* target =
-    nsLayoutUtils::GetFrameForPoint(aRootFrame, point, nsLayoutUtils::IGNORE_ROOT_SCROLL_FRAME);
+    nsLayoutUtils::GetFrameForPoint(aRootFrame, point, flags);
   nsIScrollableFrame* scrollAncestor = target
     ? nsLayoutUtils::GetAsyncScrollableAncestorFrame(target)
     : aRootFrame->PresContext()->PresShell()->GetRootScrollFrameAsScrollable();

From fde5b63146e5f95fec273984bbf6deeff7b9e953 Mon Sep 17 00:00:00 2001
From: Botond Ballo <botond@mozilla.com>
Date: Wed, 15 Mar 2017 17:49:50 -0400
Subject: [PATCH 36/46] Bug 1346632 - Add a mochitest. r=kats

MozReview-Commit-ID: 2o3cpTaGG1V

--HG--
extra : rebase_source : 25dc7749225bab57ebcce79533c105f3ff164dff
---
 .../apz/test/mochitest/helper_bug1346632.html | 77 +++++++++++++++++++
 gfx/layers/apz/test/mochitest/mochitest.ini   |  1 +
 .../mochitest/test_group_mouseevents.html     |  4 +-
 3 files changed, 81 insertions(+), 1 deletion(-)
 create mode 100644 gfx/layers/apz/test/mochitest/helper_bug1346632.html

diff --git a/gfx/layers/apz/test/mochitest/helper_bug1346632.html b/gfx/layers/apz/test/mochitest/helper_bug1346632.html
new file mode 100644
index 000000000000..ab3653887c0f
--- /dev/null
+++ b/gfx/layers/apz/test/mochitest/helper_bug1346632.html
@@ -0,0 +1,77 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width; initial-scale=1.0">
+  <title>Dragging the scrollbar on a page with a fixed-positioned element just past the right edge of the content</title>
+  <script type="application/javascript" src="apz_test_native_event_utils.js"></script>
+  <script type="application/javascript" src="apz_test_utils.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/paint_listener.js"></script>
+  <style>
+    body {
+      height: 2000px;
+    }
+    #fixed {
+      width: 240px;
+      height: 100%;
+      position: fixed;
+      top: 0px;
+      right: -240px;
+      z-index: 1000;
+      overflow-y: scroll;
+    }
+    #fixed-content {
+      height: 2000px;
+    }
+  </style>
+  <script type="text/javascript">
+var root;
+var scrollPos;
+var haveScrolled = false;
+var generatedAll = false;
+
+// Be careful not to call subtestDone() until we've scrolled AND generated
+// all of the events.
+function maybeDone() {
+  if (haveScrolled && generatedAll) {
+    subtestDone();
+  }
+}
+
+function scrolled(e) {
+  // Test that we have scrolled
+  ok(root.scrollTop > scrollPos, "document scrolled after dragging scrollbar");
+  haveScrolled = true;
+  maybeDone();
+}
+
+function* test(testDriver) {
+  root = document.scrollingElement;
+  scrollPos = root.scrollTop;
+  document.addEventListener('scroll', scrolled);
+
+  var scrollbarX = (window.innerWidth + root.clientWidth) / 2;
+  // Move the mouse to the scrollbar
+  yield synthesizeNativeMouseEvent(root, scrollbarX, 100, nativeMouseMoveEventMsg(), testDriver);
+  // mouse down
+  yield synthesizeNativeMouseEvent(root, scrollbarX, 100, nativeMouseDownEventMsg(), testDriver);
+  // drag vertically
+  yield synthesizeNativeMouseEvent(root, scrollbarX, 150, nativeMouseMoveEventMsg(), testDriver);
+  // and release
+  yield synthesizeNativeMouseEvent(root, scrollbarX, 150, nativeMouseUpEventMsg(), testDriver);
+
+  generatedAll = true;
+  maybeDone();
+}
+
+waitUntilApzStable()
+.then(runContinuation(test));
+
+  </script>
+</head>
+<body>
+  <div id="fixed">
+    <p id="fixed-content"></p>
+  </div>
+</body>
+</html>
diff --git a/gfx/layers/apz/test/mochitest/mochitest.ini b/gfx/layers/apz/test/mochitest/mochitest.ini
index 5f7807fb510e..0696805561e2 100644
--- a/gfx/layers/apz/test/mochitest/mochitest.ini
+++ b/gfx/layers/apz/test/mochitest/mochitest.ini
@@ -10,6 +10,7 @@
     helper_bug1280013.html
     helper_bug1285070.html
     helper_bug1299195.html
+    helper_bug1346632.html
     helper_click.html
     helper_div_pan.html
     helper_drag_click.html
diff --git a/gfx/layers/apz/test/mochitest/test_group_mouseevents.html b/gfx/layers/apz/test/mochitest/test_group_mouseevents.html
index dcf71f0cc023..afe89d4d4490 100644
--- a/gfx/layers/apz/test/mochitest/test_group_mouseevents.html
+++ b/gfx/layers/apz/test/mochitest/test_group_mouseevents.html
@@ -17,7 +17,9 @@ var subtests = [
   // Sanity test for click but with some mouse movement between the down and up
   {'file': 'helper_drag_click.html'},
   // Test for dragging on a fake-scrollbar element that scrolls the page
-  {'file': 'helper_drag_scroll.html'}
+  {'file': 'helper_drag_scroll.html'},
+  // Test for dragging the scrollbar with a fixed-pos element overlaying it
+  {'file': 'helper_bug1346632.html'}
 ];
 
 if (isApzEnabled()) {

From d6adf366f63717393c1043e06a7015878458793f Mon Sep 17 00:00:00 2001
From: Kearwood Gilbert <kgilbert@mozilla.com>
Date: Fri, 17 Mar 2017 13:33:56 -0700
Subject: [PATCH 37/46] Bug 1344393 - Add StageParameters for Oculus
 r=daoshengmu

MozReview-Commit-ID: 9OkleewwS2b

--HG--
extra : rebase_source : 75bffc843ba9a3d869700334c41ceb910707e5f4
---
 gfx/vr/gfxVROculus.cpp    | 54 +++++++++++++++++++++++++++++++++++++++
 gfx/vr/gfxVROculus.h      |  4 ++-
 gfx/vr/ovr_capi_dynamic.h | 19 +++++++++++---
 3 files changed, 72 insertions(+), 5 deletions(-)

diff --git a/gfx/vr/gfxVROculus.cpp b/gfx/vr/gfxVROculus.cpp
index a72b9d736daa..b9d1bd4972c8 100644
--- a/gfx/vr/gfxVROculus.cpp
+++ b/gfx/vr/gfxVROculus.cpp
@@ -98,6 +98,7 @@ static pfn_ovr_GetFloatArray ovr_GetFloatArray = nullptr;
 static pfn_ovr_SetFloatArray ovr_SetFloatArray = nullptr;
 static pfn_ovr_GetString ovr_GetString = nullptr;
 static pfn_ovr_SetString ovr_SetString = nullptr;
+static pfn_ovr_GetBoundaryDimensions ovr_GetBoundaryDimensions = nullptr;
 
 #ifdef XP_WIN
 static pfn_ovr_CreateTextureSwapChainDX ovr_CreateTextureSwapChainDX = nullptr;
@@ -286,6 +287,7 @@ InitializeOculusCAPI()
   REQUIRE_FUNCTION(ovr_SetFloatArray);
   REQUIRE_FUNCTION(ovr_GetString);
   REQUIRE_FUNCTION(ovr_SetString);
+  REQUIRE_FUNCTION(ovr_GetBoundaryDimensions);
 
 #ifdef XP_WIN
 
@@ -356,6 +358,7 @@ VRDisplayOculus::VRDisplayOculus(ovrSession aSession)
   , mVertexBuffer(nullptr)
   , mInputLayout(nullptr)
   , mIsPresenting(false)
+  , mEyeHeight(OVR_DEFAULT_EYE_HEIGHT)
 {
   MOZ_COUNT_CTOR_INHERITED(VRDisplayOculus, VRDisplayHost);
 
@@ -373,6 +376,7 @@ VRDisplayOculus::VRDisplayOculus(ovrSession aSession)
   if (mDesc.AvailableTrackingCaps & ovrTrackingCap_Position) {
     mDisplayInfo.mCapabilityFlags |= VRDisplayCapabilityFlags::Cap_Position;
     mDisplayInfo.mCapabilityFlags |= VRDisplayCapabilityFlags::Cap_LinearAcceleration;
+    mDisplayInfo.mCapabilityFlags |= VRDisplayCapabilityFlags::Cap_StageParameters;
   }
   mDisplayInfo.mCapabilityFlags |= VRDisplayCapabilityFlags::Cap_External;
   mDisplayInfo.mCapabilityFlags |= VRDisplayCapabilityFlags::Cap_MountDetection;
@@ -401,6 +405,8 @@ VRDisplayOculus::VRDisplayOculus(ovrSession aSession)
   // take the max of both for eye resolution
   mDisplayInfo.mEyeResolution.width = std::max(texSize[VRDisplayInfo::Eye_Left].w, texSize[VRDisplayInfo::Eye_Right].w);
   mDisplayInfo.mEyeResolution.height = std::max(texSize[VRDisplayInfo::Eye_Left].h, texSize[VRDisplayInfo::Eye_Right].h);
+
+  UpdateStageParameters();
 }
 
 VRDisplayOculus::~VRDisplayOculus() {
@@ -418,10 +424,49 @@ VRDisplayOculus::Destroy()
   }
 }
 
+void
+VRDisplayOculus::UpdateStageParameters()
+{
+  ovrVector3f playArea;
+  ovrResult res = ovr_GetBoundaryDimensions(mSession, ovrBoundary_PlayArea, &playArea);
+  if (res == ovrSuccess) {
+    mDisplayInfo.mStageSize.width = playArea.x;
+    mDisplayInfo.mStageSize.height = playArea.z;
+  } else {
+    // If we fail, fall back to reasonable defaults.
+    // 1m x 1m space
+    mDisplayInfo.mStageSize.width = 1.0f;
+    mDisplayInfo.mStageSize.height = 1.0f;
+  }
+
+  mEyeHeight = ovr_GetFloat(mSession, OVR_KEY_EYE_HEIGHT, OVR_DEFAULT_EYE_HEIGHT);
+
+  mDisplayInfo.mSittingToStandingTransform._11 = 1.0f;
+  mDisplayInfo.mSittingToStandingTransform._12 = 0.0f;
+  mDisplayInfo.mSittingToStandingTransform._13 = 0.0f;
+  mDisplayInfo.mSittingToStandingTransform._14 = 0.0f;
+
+  mDisplayInfo.mSittingToStandingTransform._21 = 0.0f;
+  mDisplayInfo.mSittingToStandingTransform._22 = 1.0f;
+  mDisplayInfo.mSittingToStandingTransform._23 = 0.0f;
+  mDisplayInfo.mSittingToStandingTransform._24 = 0.0f;
+
+  mDisplayInfo.mSittingToStandingTransform._31 = 0.0f;
+  mDisplayInfo.mSittingToStandingTransform._32 = 0.0f;
+  mDisplayInfo.mSittingToStandingTransform._33 = 1.0f;
+  mDisplayInfo.mSittingToStandingTransform._34 = 0.0f;
+
+  mDisplayInfo.mSittingToStandingTransform._41 = 0.0f;
+  mDisplayInfo.mSittingToStandingTransform._42 = mEyeHeight;
+  mDisplayInfo.mSittingToStandingTransform._43 = 0.0f;
+  mDisplayInfo.mSittingToStandingTransform._44 = 1.0f;
+}
+
 void
 VRDisplayOculus::ZeroSensor()
 {
   ovr_RecenterTrackingOrigin(mSession);
+  UpdateStageParameters();
 }
 
 VRHMDSensorState
@@ -440,6 +485,7 @@ VRDisplayOculus::GetSensorState()
   result = GetSensorState(frameDelta);
   result.inputFrameID = mInputFrameID;
   mLastSensorState[result.inputFrameID % kMaxLatencyFrames] = result;
+  result.position[1] -= mEyeHeight;
   return result;
 }
 
@@ -988,6 +1034,11 @@ VRSystemManagerOculus::GetHMDs(nsTArray<RefPtr<VRDisplayHost>>& aHMDResult)
     ovrResult orv = ovr_Create(&session, &luid);
     if (orv == ovrSuccess) {
       mSession = session;
+      orv = ovr_SetTrackingOriginType(session, ovrTrackingOrigin_FloorLevel);
+      if (orv != ovrSuccess) {
+        NS_WARNING("ovr_SetTrackingOriginType failed.\n");
+      }
+
       mHMDInfo = new VRDisplayOculus(session);
     }
   }
@@ -1099,6 +1150,9 @@ VRSystemManagerOculus::HandleInput()
       poseState.linearAcceleration[0] = pose.LinearAcceleration.x;
       poseState.linearAcceleration[1] = pose.LinearAcceleration.y;
       poseState.linearAcceleration[2] = pose.LinearAcceleration.z;
+
+      float eyeHeight = ovr_GetFloat(mSession, OVR_KEY_EYE_HEIGHT, OVR_DEFAULT_EYE_HEIGHT);
+      poseState.position[1] -= eyeHeight;
     }
     HandlePoseTracking(i, poseState, controller);
   }
diff --git a/gfx/vr/gfxVROculus.h b/gfx/vr/gfxVROculus.h
index 7a233925773d..3d99138f5a93 100644
--- a/gfx/vr/gfxVROculus.h
+++ b/gfx/vr/gfxVROculus.h
@@ -48,6 +48,7 @@ protected:
                            const VRHMDSensorState& aSensorState,
                            const gfx::Rect& aLeftEyeRect,
                            const gfx::Rect& aRightEyeRect) override;
+  void UpdateStageParameters();
 
 public:
   explicit VRDisplayOculus(ovrSession aSession);
@@ -82,7 +83,8 @@ protected:
   RefPtr<ID3D11InputLayout> mInputLayout;
 
   bool mIsPresenting;
-  
+  float mEyeHeight;
+
   bool UpdateConstantBuffers();
 
   struct Vertex
diff --git a/gfx/vr/ovr_capi_dynamic.h b/gfx/vr/ovr_capi_dynamic.h
index edf2b78a3d94..9a4ae06ba056 100644
--- a/gfx/vr/ovr_capi_dynamic.h
+++ b/gfx/vr/ovr_capi_dynamic.h
@@ -567,8 +567,15 @@ typedef enum {
   ovrDebugHudStereo_EnumSize = 0x7fffffff
 } ovrDebugHudStereoMode;
 
+typedef enum {
+  // Outer boundary - closely represents user setup walls
+  ovrBoundary_Outer = 0x0001,
+  // Play area - safe rectangular area inside outer boundary which can optionally be used to restrict user interactions and motion.
+  ovrBoundary_PlayArea = 0x0100,
+} ovrBoundaryType;
+
 typedef ovrBool(OVR_PFN* pfn_ovr_GetBool)(ovrSession session, const char* propertyName, ovrBool defaultVal);
-typedef ovrBool(OVR_PFN* pfn_ovr_SetBool)(ovrSession session, const char* propertyName, ovrBool value); 
+typedef ovrBool(OVR_PFN* pfn_ovr_SetBool)(ovrSession session, const char* propertyName, ovrBool value);
 typedef int (OVR_PFN* pfn_ovr_GetInt)(ovrSession session, const char* propertyName, int defaultVal);
 typedef ovrBool (OVR_PFN* pfn_ovr_SetInt)(ovrSession session, const char* propertyName, int value);
 typedef float (OVR_PFN* pfn_ovr_GetFloat)(ovrSession session, const char* propertyName, float defaultVal);
@@ -581,8 +588,9 @@ typedef const char* (OVR_PFN* pfn_ovr_GetString)(ovrSession session, const char*
   const char* defaultVal);
 typedef ovrBool (OVR_PFN* pfn_ovr_SetString)(ovrSession session, const char* propertyName,
   const char* value);
-
-
+typedef ovrResult (OVR_PFN* pfn_ovr_GetBoundaryDimensions)(ovrSession session,
+                                                           ovrBoundaryType boundaryType,
+                                                           ovrVector3f* outDimensions);
 
 typedef enum {
   ovrError_MemoryAllocationFailure = -1000,
@@ -714,7 +722,10 @@ typedef ovrResult (OVR_PFN* pfn_ovr_GetMirrorTextureBufferGL)(ovrSession session
 	ovrMirrorTexture mirrorTexture,
 	unsigned int* out_TexId);
 
-#ifdef __cplusplus 
+#define OVR_KEY_EYE_HEIGHT "EyeHeight" // float meters
+#define OVR_DEFAULT_EYE_HEIGHT 1.675f
+
+#ifdef __cplusplus
 }
 #endif
 

From 4e410934afcc4eba93e414dc4200e179b8c3213c Mon Sep 17 00:00:00 2001
From: Kearwood Gilbert <kgilbert@mozilla.com>
Date: Wed, 15 Mar 2017 16:40:57 -0700
Subject: [PATCH 38/46] Bug 1346923 - Remove PVRManager::GetDisplays sync IPC
 r=daoshengmu,kanru - PVRManager::GetDisplays was a sync IPC that was part of
 an optimization   for a use case that has been eliminated by changes to the
 WebVR spec. - This was an optimization for Navigator.activeVRDisplays that
 would allow   enumeration of displays active in any content process without
 powering   on any additional VR hardware.  This will no longer be necessary
 as the   activeVRDisplays has been restricted to returning only the displays 
  active in the current javascript context.

MozReview-Commit-ID: F6sOtM9nups

--HG--
extra : rebase_source : bd8967fab9677206d998eea922c8d1640551de1c
---
 gfx/vr/ipc/PVRManager.ipdl     |  4 ----
 gfx/vr/ipc/VRManagerChild.cpp  | 10 ----------
 gfx/vr/ipc/VRManagerParent.cpp |  8 --------
 gfx/vr/ipc/VRManagerParent.h   |  1 -
 ipc/ipdl/sync-messages.ini     |  2 --
 5 files changed, 25 deletions(-)

diff --git a/gfx/vr/ipc/PVRManager.ipdl b/gfx/vr/ipc/PVRManager.ipdl
index 61e1bff271a6..2920a352560c 100644
--- a/gfx/vr/ipc/PVRManager.ipdl
+++ b/gfx/vr/ipc/PVRManager.ipdl
@@ -45,10 +45,6 @@ parent:
   // asynchronously to children via UpdateDisplayInfo.
   async RefreshDisplays();
 
-  // GetDisplays synchronously returns the VR displays that have already been
-  // enumerated by RefreshDisplays() but does not enumerate new ones.
-  sync GetDisplays() returns(VRDisplayInfo[] aDisplayInfo);
-
   // Reset the sensor of the display identified by aDisplayID so that the current
   // sensor state is the "Zero" position.
   async ResetSensor(uint32_t aDisplayID);
diff --git a/gfx/vr/ipc/VRManagerChild.cpp b/gfx/vr/ipc/VRManagerChild.cpp
index 5ee0b9af4207..d33951cb4d77 100644
--- a/gfx/vr/ipc/VRManagerChild.cpp
+++ b/gfx/vr/ipc/VRManagerChild.cpp
@@ -293,16 +293,6 @@ VRManagerChild::RecvUpdateDisplayInfo(nsTArray<VRDisplayInfo>&& aDisplayUpdates)
 bool
 VRManagerChild::GetVRDisplays(nsTArray<RefPtr<VRDisplayClient>>& aDisplays)
 {
-  if (!mDisplaysInitialized) {
-    /**
-     * If we haven't received any asynchronous callback after requesting
-     * display enumeration with RefreshDisplays, get the existing displays
-     * that have already been enumerated by other VRManagerChild instances.
-     */
-    nsTArray<VRDisplayInfo> displays;
-    Unused << SendGetDisplays(&displays);
-    UpdateDisplayInfo(displays);
-  }
   aDisplays = mDisplays;
   return true;
 }
diff --git a/gfx/vr/ipc/VRManagerParent.cpp b/gfx/vr/ipc/VRManagerParent.cpp
index e413f24d8b4d..af72b18a7253 100644
--- a/gfx/vr/ipc/VRManagerParent.cpp
+++ b/gfx/vr/ipc/VRManagerParent.cpp
@@ -241,14 +241,6 @@ VRManagerParent::RecvRefreshDisplays()
   return IPC_OK();
 }
 
-mozilla::ipc::IPCResult
-VRManagerParent::RecvGetDisplays(nsTArray<VRDisplayInfo> *aDisplays)
-{
-  VRManager* vm = VRManager::Get();
-  vm->GetVRDisplayInfo(*aDisplays);
-  return IPC_OK();
-}
-
 mozilla::ipc::IPCResult
 VRManagerParent::RecvResetSensor(const uint32_t& aDisplayID)
 {
diff --git a/gfx/vr/ipc/VRManagerParent.h b/gfx/vr/ipc/VRManagerParent.h
index 28d12d5a2200..0eaa18669729 100644
--- a/gfx/vr/ipc/VRManagerParent.h
+++ b/gfx/vr/ipc/VRManagerParent.h
@@ -86,7 +86,6 @@ protected:
   void OnChannelConnected(int32_t pid) override;
 
   virtual mozilla::ipc::IPCResult RecvRefreshDisplays() override;
-  virtual mozilla::ipc::IPCResult RecvGetDisplays(nsTArray<VRDisplayInfo> *aDisplays) override;
   virtual mozilla::ipc::IPCResult RecvResetSensor(const uint32_t& aDisplayID) override;
   virtual mozilla::ipc::IPCResult RecvGetSensorState(const uint32_t& aDisplayID, VRHMDSensorState* aState) override;
   virtual mozilla::ipc::IPCResult RecvSetHaveEventListener(const bool& aHaveEventListener) override;
diff --git a/ipc/ipdl/sync-messages.ini b/ipc/ipdl/sync-messages.ini
index 22682b2489bc..be20e076a070 100644
--- a/ipc/ipdl/sync-messages.ini
+++ b/ipc/ipdl/sync-messages.ini
@@ -949,8 +949,6 @@ description =
 description =
 [PWebRenderBridge::DPGetSnapshot]
 description =
-[PVRManager::GetDisplays]
-description =
 [PVRManager::GetSensorState]
 description =
 [PVRManager::SetHaveEventListener]

From c6610ae7fd976426cae1ce07488451bf9f5ab35e Mon Sep 17 00:00:00 2001
From: Blake Kaplan <mrbkap@gmail.com>
Date: Wed, 15 Mar 2017 14:53:12 -0700
Subject: [PATCH 39/46] Bug 1333472 - Try to fix intermittent failures in
 browser_windowactivation.js. r=Felipe

MozReview-Commit-ID: E1jG1vLznvk

--HG--
extra : rebase_source : 31417c4ab76f822462e4e7367ae37bbfe7a4d411
---
 .../test/general/browser_windowactivation.js  | 66 ++++++++-----------
 1 file changed, 26 insertions(+), 40 deletions(-)

diff --git a/browser/base/content/test/general/browser_windowactivation.js b/browser/base/content/test/general/browser_windowactivation.js
index 73e972a45592..0102c7e958be 100644
--- a/browser/base/content/test/general/browser_windowactivation.js
+++ b/browser/base/content/test/general/browser_windowactivation.js
@@ -4,39 +4,31 @@
 
 /* eslint-env mozilla/frame-script */
 
-var testPage = "data:text/html,<body><style>:-moz-window-inactive { background-color: red; }</style><div id='area'></div></body>";
+var testPage = "data:text/html;charset=utf-8,<body><style>:-moz-window-inactive { background-color: red; }</style><div id='area'></div></body>";
 
 var colorChangeNotifications = 0;
 var otherWindow;
 
 var browser1, browser2;
 
-function test() {
-  waitForExplicitFinish();
-  waitForFocus(reallyRunTests);
-}
+add_task(function* reallyRunTests() {
 
-function reallyRunTests() {
+  let tab1 = yield BrowserTestUtils.openNewForegroundTab(gBrowser, testPage);
+  browser1 = tab1.linkedBrowser;
 
-  let tab1 = gBrowser.addTab();
-  let tab2 = gBrowser.addTab();
-  browser1 = gBrowser.getBrowserForTab(tab1);
-  browser2 = gBrowser.getBrowserForTab(tab2);
+  // This can't use openNewForegroundTab because if we focus tab2 now, we
+  // won't send a focus event during test 6, further down in this file.
+  let tab2 = gBrowser.addTab(testPage);
+  browser2 = tab2.linkedBrowser;
+  yield BrowserTestUtils.browserLoaded(browser2);
+
+  browser1.messageManager.loadFrameScript("data:,(" + childFunction.toString() + ")();", true);
+  browser2.messageManager.loadFrameScript("data:,(" + childFunction.toString() + ")();", true);
 
   gURLBar.focus();
 
-  var loadCount = 0;
-  function check() {
-    // wait for both tabs to load
-    if (++loadCount != 2) {
-      return;
-    }
-
-    browser1.removeEventListener("load", check, true);
-    browser2.removeEventListener("load", check, true);
-
-    sendGetBackgroundRequest(true);
-  }
+  let testFinished = {};
+  testFinished.promise = new Promise(resolve => testFinished.resolve = resolve);
 
   // The test performs four checks, using -moz-window-inactive on two child tabs.
   // First, the initial state should be transparent. The second check is done
@@ -74,7 +66,7 @@ function reallyRunTests() {
         break;
       case 8:
         is(message.data.color, "rgba(0, 0, 0, 0)", "second window after tab switch");
-        finishTest();
+        testFinished.resolve();
         break;
       case 9:
         ok(false, "too many color change notifications");
@@ -97,16 +89,17 @@ function reallyRunTests() {
     ok(message.data.ok, "Test:DeactivateEvent");
   });
 
-  browser1.addEventListener("load", check, true);
-  browser2.addEventListener("load", check, true);
-  browser1.contentWindow.location = testPage;
-  browser2.contentWindow.location = testPage;
-
-  browser1.messageManager.loadFrameScript("data:,(" + childFunction.toString() + ")();", true);
-  browser2.messageManager.loadFrameScript("data:,(" + childFunction.toString() + ")();", true);
-
   gBrowser.selectedTab = tab1;
-}
+
+  // Start the test.
+  sendGetBackgroundRequest(true);
+
+  yield testFinished.promise;
+
+  yield BrowserTestUtils.removeTab(tab1);
+  yield BrowserTestUtils.removeTab(tab2);
+  otherWindow = null;
+});
 
 function sendGetBackgroundRequest(ifChanged) {
   browser1.messageManager.sendAsyncMessage("Test:GetBackgroundColor", { ifChanged });
@@ -114,19 +107,12 @@ function sendGetBackgroundRequest(ifChanged) {
 }
 
 function runOtherWindowTests() {
-  otherWindow = window.open("data:text/html,<body>Hi</body>", "", "chrome");
+  otherWindow = window.open("data:text/html;charset=utf-8,<body>Hi</body>", "", "chrome");
   waitForFocus(function() {
     sendGetBackgroundRequest(true);
   }, otherWindow);
 }
 
-function finishTest() {
-  gBrowser.removeCurrentTab();
-  gBrowser.removeCurrentTab();
-  otherWindow = null;
-  finish();
-}
-
 function childFunction() {
   let oldColor = null;
 

From d6c9b04db10bfb20002bfcda12945011b51ff9a3 Mon Sep 17 00:00:00 2001
From: David Teller <dteller@mozilla.com>
Date: Mon, 20 Mar 2017 16:57:14 +0100
Subject: [PATCH 40/46] Bug 1348883 - Clarifying histogram
 DOM_SCRIPT_SRC_ENCODING;r=francois

MozReview-Commit-ID: KT2zgsuoeAT

--HG--
extra : rebase_source : 9757e8d6a6d6beb85392582aa4f75f4ac88498c7
---
 toolkit/components/telemetry/Histograms.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/toolkit/components/telemetry/Histograms.json b/toolkit/components/telemetry/Histograms.json
index d76c44cfef3f..4d9231a7528a 100644
--- a/toolkit/components/telemetry/Histograms.json
+++ b/toolkit/components/telemetry/Histograms.json
@@ -10462,11 +10462,11 @@
   },
   "DOM_SCRIPT_SRC_ENCODING": {
     "alert_emails": ["dteller@mozilla.com"],
-    "expires_in_version": "never",
+    "expires_in_version": "61",
     "kind": "count",
     "keyed": true,
     "bug_numbers": [1344152],
-    "description": "Encoding used in a <script src>."
+    "description": "Note the encoding (e.g. 'UTF-8', 'windows-1252', 'ASCII') of each external <script> element that is successfully loaded and decoded."
   },
   "VIDEO_FASTSEEK_USED": {
     "alert_emails": ["lchristie@mozilla.com", "cpearce@mozilla.com"],

From efbb2ff1ed119642d248ce4f004719f54832f0b9 Mon Sep 17 00:00:00 2001
From: Federico Padua <federico_padua@yahoo.it>
Date: Sun, 19 Mar 2017 19:08:13 +0100
Subject: [PATCH 41/46] Bug 1345478 - Make the PrintErrorKind::Error case
 explicitly unreachable in PrintSingleError; r=bbouvier

This patch explicitly calls MOZ_CRASH() in the switch case
PrintErrorKind::Error that is never reached inside the function
PrintSingleError in the file js/src/jscntxt.cpp.
Explicitly handling all the possible cases avoids the compiler to issue
warnings for them: a non handled case in the switch code that might derive
from additions to the enum class PrintErrorKind can be caught at compile time
rather then having a default switch case for handling it, which instead would
be called at runtime.

MozReview-Commit-ID: ECZlMoLvn2m

--HG--
extra : rebase_source : 7329eda98352a7a587514bd175a231ab66a3aa96
---
 js/src/jscntxt.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/src/jscntxt.cpp b/js/src/jscntxt.cpp
index 5270c17eecb9..33feced1aee4 100644
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@@ -552,7 +552,7 @@ PrintSingleError(JSContext* cx, FILE* file, JS::ConstUTF8CharsZ toStringResult,
         const char* kindPrefix = nullptr;
         switch (kind) {
           case PrintErrorKind::Error:
-            break;
+            MOZ_CRASH("unreachable");
           case PrintErrorKind::Warning:
             kindPrefix = "warning";
             break;

From 2b7ca7d884552484d52909b09b9586ae28565833 Mon Sep 17 00:00:00 2001
From: Jan Beich <jbeich@FreeBSD.org>
Date: Thu, 16 Mar 2017 18:15:49 +0000
Subject: [PATCH 42/46] Bug 1348021 - Unbreak config/gcc_hidden.h build with
 libc++ after bug 1341238. r=froydnj

MozReview-Commit-ID: Bfv6inLV7lV

--HG--
extra : rebase_source : f0e2f461f4d3f4f54bf3d6db61a1202da7e8234c
---
 config/stl-headers | 1 +
 1 file changed, 1 insertion(+)

diff --git a/config/stl-headers b/config/stl-headers
index d4786f1c995a..3d46e8c2d8de 100644
--- a/config/stl-headers
+++ b/config/stl-headers
@@ -34,6 +34,7 @@ ostream
 set
 stack
 string
+thread
 type_traits
 utility
 vector

From e40fae82c174f86312483c8b8b0b5df9624d615d Mon Sep 17 00:00:00 2001
From: "J.C. Jones" <jjones@mozilla.com>
Date: Tue, 7 Mar 2017 09:37:34 -0700
Subject: [PATCH 43/46] Bug 1342258 - Refactor SetDomain to
 IsRegistrableDomainSuffixOfOrEqualTo r=smaug

This commit refactors the SetDomain method in a Document to call a new function
IsRegistrableDomainSuffixOfOrEqualTo(), defined in HTML [1]. This commit tries
not to rename anything except input variables, so as to remain as clear as
possible. It likely should have various variables renamed, but given the
author's unfamiliarity with this module, review seems a good time to do that.
It's also duplicating comments a little bit; let me know which one(s) you'd like
to keep!

Note: Commentary on the HTML change is available in the PR [2], and the
rationale for this behavior in Web Auentication, where this algorithm will be
used, is also recorded [3].

Updates: Refactored two new protected methods to avoid code duplication.

[1] https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to
[2] https://github.com/whatwg/html/pull/2365
[3] https://github.com/w3ctag/spec-reviews/issues/97#issuecomment-175766580

MozReview-Commit-ID: 4Dr8yOMdhez

--HG--
extra : rebase_source : 5d042c4e97b8866027c81ea0f1c544ce1721b7c4
---
 dom/html/nsHTMLDocument.cpp | 148 ++++++++++++++++++++++++------------
 dom/html/nsHTMLDocument.h   |   6 ++
 2 files changed, 106 insertions(+), 48 deletions(-)

diff --git a/dom/html/nsHTMLDocument.cpp b/dom/html/nsHTMLDocument.cpp
index 555429b7804b..d076df39e852 100644
--- a/dom/html/nsHTMLDocument.cpp
+++ b/dom/html/nsHTMLDocument.cpp
@@ -906,6 +906,104 @@ nsHTMLDocument::GetDomain(nsAString& aDomain)
   return NS_OK;
 }
 
+already_AddRefed<nsIURI>
+nsHTMLDocument::CreateInheritingURIForHost(const nsACString& aHostString)
+{
+  if (aHostString.IsEmpty()) {
+    return nullptr;
+  }
+
+  // Create new URI
+  nsCOMPtr<nsIURI> uri = GetDomainURI();
+  if (!uri) {
+    return nullptr;
+  }
+
+  nsCOMPtr<nsIURI> newURI;
+  nsresult rv = uri->Clone(getter_AddRefs(newURI));
+  if (NS_FAILED(rv)) {
+    return nullptr;
+  }
+
+  rv = newURI->SetUserPass(EmptyCString());
+  if (NS_FAILED(rv)) {
+    return nullptr;
+  }
+
+  // We use SetHostAndPort because we want to reset the port number if needed.
+  rv = newURI->SetHostAndPort(aHostString);
+  if (NS_FAILED(rv)) {
+    return nullptr;
+  }
+
+  return newURI.forget();
+}
+
+already_AddRefed<nsIURI>
+nsHTMLDocument::RegistrableDomainSuffixOfInternal(const nsAString& aNewDomain,
+                                                  nsIURI* aOrigHost)
+{
+  // Check new domain - must be a superdomain of the current host
+  // For example, a page from foo.bar.com may set domain to bar.com,
+  // but not to ar.com, baz.com, or fi.foo.bar.com.
+  nsAutoCString domain = NS_ConvertUTF16toUTF8(aNewDomain);
+  nsAutoCString current;
+  if (NS_FAILED(aOrigHost->GetAsciiHost(current))) {
+    current.Truncate();
+  }
+
+  bool ok = current.Equals(domain);
+  if (current.Length() > domain.Length() &&
+      StringEndsWith(current, domain) &&
+      current.CharAt(current.Length() - domain.Length() - 1) == '.') {
+    // We're golden if the new domain is the current page's base domain or a
+    // subdomain of it.
+    nsCOMPtr<nsIEffectiveTLDService> tldService =
+      do_GetService(NS_EFFECTIVETLDSERVICE_CONTRACTID);
+    if (!tldService) {
+      return nullptr;
+    }
+
+    nsAutoCString currentBaseDomain;
+    ok = NS_SUCCEEDED(tldService->GetBaseDomain(aOrigHost, 0, currentBaseDomain));
+    NS_ASSERTION(StringEndsWith(domain, currentBaseDomain) ==
+                 (domain.Length() >= currentBaseDomain.Length()),
+                 "uh-oh!  slight optimization wasn't valid somehow!");
+    ok = ok && domain.Length() >= currentBaseDomain.Length();
+  }
+
+  if (!ok) {
+    // Error: illegal domain
+    return nullptr;
+  }
+
+  return CreateInheritingURIForHost(domain);
+}
+
+bool
+nsHTMLDocument::IsRegistrableDomainSuffixOfOrEqualTo(const nsAString& aHostSuffixString,
+                                                     const nsACString& aOrigHost)
+{
+  // https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to
+  if (aHostSuffixString.IsEmpty()) {
+    return false;
+  }
+
+  nsCOMPtr<nsIURI> origURI = CreateInheritingURIForHost(aOrigHost);
+  if (!origURI) {
+    // Error: failed to parse input domain
+    return false;
+  }
+
+  nsCOMPtr<nsIURI> newURI = RegistrableDomainSuffixOfInternal(aHostSuffixString, origURI);
+  if (!newURI) {
+    // Error: illegal domain
+    return false;
+  }
+  return true;
+}
+
+
 NS_IMETHODIMP
 nsHTMLDocument::SetDomain(const nsAString& aDomain)
 {
@@ -928,64 +1026,18 @@ nsHTMLDocument::SetDomain(const nsAString& aDomain, ErrorResult& rv)
     return;
   }
 
-  // Create new URI
   nsCOMPtr<nsIURI> uri = GetDomainURI();
-
   if (!uri) {
     rv.Throw(NS_ERROR_FAILURE);
     return;
   }
 
-  nsCOMPtr<nsIURI> newURI;
-  nsresult rv2 = uri->Clone(getter_AddRefs(newURI));
-  if (NS_FAILED(rv2)) {
-    rv.Throw(rv2);
-    return;
-  }
-
-  rv2 = newURI->SetUserPass(EmptyCString());
-  if (NS_FAILED(rv2)) {
-    rv.Throw(rv2);
-    return;
-  }
-
-  // We use SetHostAndPort because we want to reset the port number if needed.
-  rv2 = newURI->SetHostAndPort(NS_ConvertUTF16toUTF8(aDomain));
-  if (NS_FAILED(rv2)) {
-    rv.Throw(rv2);
-    return;
-  }
-
   // Check new domain - must be a superdomain of the current host
   // For example, a page from foo.bar.com may set domain to bar.com,
   // but not to ar.com, baz.com, or fi.foo.bar.com.
-  nsAutoCString current, domain;
-  if (NS_FAILED(uri->GetAsciiHost(current)))
-    current.Truncate();
-  if (NS_FAILED(newURI->GetAsciiHost(domain)))
-    domain.Truncate();
 
-  bool ok = current.Equals(domain);
-  if (current.Length() > domain.Length() &&
-      StringEndsWith(current, domain) &&
-      current.CharAt(current.Length() - domain.Length() - 1) == '.') {
-    // We're golden if the new domain is the current page's base domain or a
-    // subdomain of it.
-    nsCOMPtr<nsIEffectiveTLDService> tldService =
-      do_GetService(NS_EFFECTIVETLDSERVICE_CONTRACTID);
-    if (!tldService) {
-      rv.Throw(NS_ERROR_NOT_AVAILABLE);
-      return;
-    }
-
-    nsAutoCString currentBaseDomain;
-    ok = NS_SUCCEEDED(tldService->GetBaseDomain(uri, 0, currentBaseDomain));
-    NS_ASSERTION(StringEndsWith(domain, currentBaseDomain) ==
-                 (domain.Length() >= currentBaseDomain.Length()),
-                 "uh-oh!  slight optimization wasn't valid somehow!");
-    ok = ok && domain.Length() >= currentBaseDomain.Length();
-  }
-  if (!ok) {
+  nsCOMPtr<nsIURI> newURI = RegistrableDomainSuffixOfInternal(aDomain, uri);
+  if (!newURI) {
     // Error: illegal domain
     rv.Throw(NS_ERROR_DOM_BAD_DOCUMENT_DOMAIN);
     return;
diff --git a/dom/html/nsHTMLDocument.h b/dom/html/nsHTMLDocument.h
index ff79e62871b5..486c6e2d980e 100644
--- a/dom/html/nsHTMLDocument.h
+++ b/dom/html/nsHTMLDocument.h
@@ -166,6 +166,8 @@ public:
   virtual JSObject* WrapNode(JSContext* aCx, JS::Handle<JSObject*> aGivenProto)
     override;
   void SetDomain(const nsAString& aDomain, mozilla::ErrorResult& rv);
+  bool IsRegistrableDomainSuffixOfOrEqualTo(const nsAString& aHostSuffixString,
+                                            const nsACString& aOrigHost);
   void GetCookie(nsAString& aCookie, mozilla::ErrorResult& rv);
   void SetCookie(const nsAString& aCookie, mozilla::ErrorResult& rv);
   void NamedGetter(JSContext* cx, const nsAString& aName, bool& aFound,
@@ -274,6 +276,10 @@ protected:
   static void DocumentWriteTerminationFunc(nsISupports *aRef);
 
   already_AddRefed<nsIURI> GetDomainURI();
+  already_AddRefed<nsIURI> CreateInheritingURIForHost(const nsACString& aHostString);
+  already_AddRefed<nsIURI> RegistrableDomainSuffixOfInternal(const nsAString& aHostSuffixString,
+                                                             nsIURI* aOrigHost);
+
 
   nsresult WriteCommon(JSContext *cx, const nsAString& aText,
                        bool aNewlineTerminate);

From 26d8b036b555d05d4e886649782a07b895baae29 Mon Sep 17 00:00:00 2001
From: Federico Padua <federico_padua@yahoo.it>
Date: Sun, 19 Mar 2017 16:12:48 +0100
Subject: [PATCH 44/46] Bug 1346188 - Remove redundant AppConstants.jsm import
 from browser.js; r=dao

This patch removes the redundant lazy import of AppConstants.jsm from
browser/base/content/browser.js since it gets loaded previously as described
in the bug description.

MozReview-Commit-ID: EoSfSgedgNc

--HG--
extra : rebase_source : 8db27f79b9b43559ed4f94457592b092c5f75942
---
 browser/base/content/browser.js | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index 60434b687b15..111ce3d18455 100755
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -15,7 +15,7 @@ Cu.import("resource://gre/modules/NotificationDB.jsm");
 
 // lazy module getters
 
-/* global AboutHome:false, AddonWatcher:false, AppConstants: false,
+/* global AboutHome:false, AddonWatcher:false,
           BrowserUITelemetry:false, BrowserUsageTelemetry:false, BrowserUtils:false,
           CastingApps:false, CharsetMenu:false, Color:false, ContentSearch:false,
           Deprecated:false, E10SUtils:false, FormValidationHandler:false,
@@ -38,7 +38,6 @@ Cu.import("resource://gre/modules/NotificationDB.jsm");
 [
   ["AboutHome", "resource:///modules/AboutHome.jsm"],
   ["AddonWatcher", "resource://gre/modules/AddonWatcher.jsm"],
-  ["AppConstants", "resource://gre/modules/AppConstants.jsm"],
   ["BrowserUITelemetry", "resource:///modules/BrowserUITelemetry.jsm"],
   ["BrowserUsageTelemetry", "resource:///modules/BrowserUsageTelemetry.jsm"],
   ["BrowserUtils", "resource://gre/modules/BrowserUtils.jsm"],

From 399d6c086f6626150bfc0e850910046021e8832f Mon Sep 17 00:00:00 2001
From: KuoE0 <kuoe0.tw@gmail.com>
Date: Tue, 21 Mar 2017 00:38:11 +0800
Subject: [PATCH 45/46] Bug 1348221 - Implement NewNamedTimerCallback to create
 named timer callback. r=kats

MozReview-Commit-ID: IcEVkfB3puW

--HG--
extra : rebase_source : 45e3f28325d5e6da41fb65688d518170eb5764bb
---
 gfx/layers/apz/util/APZThreadUtils.cpp |  1 +
 gfx/layers/apz/util/APZThreadUtils.h   | 63 ++++++++++++++++++++++++++
 2 files changed, 64 insertions(+)

diff --git a/gfx/layers/apz/util/APZThreadUtils.cpp b/gfx/layers/apz/util/APZThreadUtils.cpp
index e1975a2a067f..ee100add452d 100644
--- a/gfx/layers/apz/util/APZThreadUtils.cpp
+++ b/gfx/layers/apz/util/APZThreadUtils.cpp
@@ -74,6 +74,7 @@ APZThreadUtils::IsControllerThread()
 }
 
 NS_IMPL_ISUPPORTS(GenericTimerCallbackBase, nsITimerCallback)
+NS_IMPL_ISUPPORTS(GenericNamedTimerCallbackBase, nsITimerCallback, nsINamed)
 
 } // namespace layers
 } // namespace mozilla
diff --git a/gfx/layers/apz/util/APZThreadUtils.h b/gfx/layers/apz/util/APZThreadUtils.h
index 4b9b2c0d0072..3ac5bdfbf966 100644
--- a/gfx/layers/apz/util/APZThreadUtils.h
+++ b/gfx/layers/apz/util/APZThreadUtils.h
@@ -7,6 +7,7 @@
 #define mozilla_layers_APZThreadUtils_h
 
 #include "base/message_loop.h"
+#include "nsINamed.h"
 #include "nsITimer.h"
 
 namespace mozilla {
@@ -98,6 +99,68 @@ GenericTimerCallback<Function>* NewTimerCallback(const Function& aFunction)
   return new GenericTimerCallback<Function>(aFunction);
 }
 
+// A base class for GenericNamedTimerCallback<Function>.
+// This is necessary because NS_IMPL_ISUPPORTS doesn't work for a class
+// template.
+class GenericNamedTimerCallbackBase : public nsITimerCallback,
+                                      public nsINamed
+{
+public:
+  NS_DECL_THREADSAFE_ISUPPORTS
+
+protected:
+  virtual ~GenericNamedTimerCallbackBase() {}
+};
+
+// An nsITimerCallback implementation with nsINamed that can be used with any
+// function object that's callable with no arguments.
+template <typename Function>
+class GenericNamedTimerCallback final : public GenericNamedTimerCallbackBase
+{
+public:
+  explicit GenericNamedTimerCallback(const Function& aFunction,
+                                     const char* aName)
+    : mFunction(aFunction)
+    , mName(aName)
+  {
+  }
+
+  NS_IMETHOD Notify(nsITimer*) override
+  {
+    mFunction();
+    return NS_OK;
+  }
+
+  NS_IMETHOD GetName(nsACString& aName) override
+  {
+    aName = mName;
+    return NS_OK;
+  }
+
+  NS_IMETHOD SetName(const char * aName) override
+  {
+    mName.Assign(aName);
+    return NS_OK;
+  }
+
+private:
+  Function mFunction;
+  nsCString mName;
+};
+
+// Convenience function for constructing a GenericNamedTimerCallback.
+// Returns a raw pointer, suitable for passing directly as an argument to
+// nsITimer::InitWithCallback(). The intention is to enable the following
+// terse inline usage:
+//    timer->InitWithCallback(NewNamedTimerCallback([](){ ... }, name), delay);
+template <typename Function>
+GenericNamedTimerCallback<Function>*
+  NewNamedTimerCallback(const Function& aFunction,
+                        const char* aName)
+{
+  return new GenericNamedTimerCallback<Function>(aFunction, aName);
+}
+
 } // namespace layers
 } // namespace mozilla
 

From 56361d2b499e6ddec01203a291da50a8fa567776 Mon Sep 17 00:00:00 2001
From: Sebastian Hengst <archaeopteryx@coole-files.de>
Date: Mon, 20 Mar 2017 21:19:01 +0100
Subject: [PATCH 46/46] Backed out changeset ffa2f50d49ce (bug 1342258) for
 failing mochitest
 dom/tests/mochitest/dom-level0/test_setting_document.domain_idn.html.
 r=backout

---
 dom/html/nsHTMLDocument.cpp | 148 ++++++++++++------------------------
 dom/html/nsHTMLDocument.h   |   6 --
 2 files changed, 48 insertions(+), 106 deletions(-)

diff --git a/dom/html/nsHTMLDocument.cpp b/dom/html/nsHTMLDocument.cpp
index d076df39e852..555429b7804b 100644
--- a/dom/html/nsHTMLDocument.cpp
+++ b/dom/html/nsHTMLDocument.cpp
@@ -906,104 +906,6 @@ nsHTMLDocument::GetDomain(nsAString& aDomain)
   return NS_OK;
 }
 
-already_AddRefed<nsIURI>
-nsHTMLDocument::CreateInheritingURIForHost(const nsACString& aHostString)
-{
-  if (aHostString.IsEmpty()) {
-    return nullptr;
-  }
-
-  // Create new URI
-  nsCOMPtr<nsIURI> uri = GetDomainURI();
-  if (!uri) {
-    return nullptr;
-  }
-
-  nsCOMPtr<nsIURI> newURI;
-  nsresult rv = uri->Clone(getter_AddRefs(newURI));
-  if (NS_FAILED(rv)) {
-    return nullptr;
-  }
-
-  rv = newURI->SetUserPass(EmptyCString());
-  if (NS_FAILED(rv)) {
-    return nullptr;
-  }
-
-  // We use SetHostAndPort because we want to reset the port number if needed.
-  rv = newURI->SetHostAndPort(aHostString);
-  if (NS_FAILED(rv)) {
-    return nullptr;
-  }
-
-  return newURI.forget();
-}
-
-already_AddRefed<nsIURI>
-nsHTMLDocument::RegistrableDomainSuffixOfInternal(const nsAString& aNewDomain,
-                                                  nsIURI* aOrigHost)
-{
-  // Check new domain - must be a superdomain of the current host
-  // For example, a page from foo.bar.com may set domain to bar.com,
-  // but not to ar.com, baz.com, or fi.foo.bar.com.
-  nsAutoCString domain = NS_ConvertUTF16toUTF8(aNewDomain);
-  nsAutoCString current;
-  if (NS_FAILED(aOrigHost->GetAsciiHost(current))) {
-    current.Truncate();
-  }
-
-  bool ok = current.Equals(domain);
-  if (current.Length() > domain.Length() &&
-      StringEndsWith(current, domain) &&
-      current.CharAt(current.Length() - domain.Length() - 1) == '.') {
-    // We're golden if the new domain is the current page's base domain or a
-    // subdomain of it.
-    nsCOMPtr<nsIEffectiveTLDService> tldService =
-      do_GetService(NS_EFFECTIVETLDSERVICE_CONTRACTID);
-    if (!tldService) {
-      return nullptr;
-    }
-
-    nsAutoCString currentBaseDomain;
-    ok = NS_SUCCEEDED(tldService->GetBaseDomain(aOrigHost, 0, currentBaseDomain));
-    NS_ASSERTION(StringEndsWith(domain, currentBaseDomain) ==
-                 (domain.Length() >= currentBaseDomain.Length()),
-                 "uh-oh!  slight optimization wasn't valid somehow!");
-    ok = ok && domain.Length() >= currentBaseDomain.Length();
-  }
-
-  if (!ok) {
-    // Error: illegal domain
-    return nullptr;
-  }
-
-  return CreateInheritingURIForHost(domain);
-}
-
-bool
-nsHTMLDocument::IsRegistrableDomainSuffixOfOrEqualTo(const nsAString& aHostSuffixString,
-                                                     const nsACString& aOrigHost)
-{
-  // https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to
-  if (aHostSuffixString.IsEmpty()) {
-    return false;
-  }
-
-  nsCOMPtr<nsIURI> origURI = CreateInheritingURIForHost(aOrigHost);
-  if (!origURI) {
-    // Error: failed to parse input domain
-    return false;
-  }
-
-  nsCOMPtr<nsIURI> newURI = RegistrableDomainSuffixOfInternal(aHostSuffixString, origURI);
-  if (!newURI) {
-    // Error: illegal domain
-    return false;
-  }
-  return true;
-}
-
-
 NS_IMETHODIMP
 nsHTMLDocument::SetDomain(const nsAString& aDomain)
 {
@@ -1026,18 +928,64 @@ nsHTMLDocument::SetDomain(const nsAString& aDomain, ErrorResult& rv)
     return;
   }
 
+  // Create new URI
   nsCOMPtr<nsIURI> uri = GetDomainURI();
+
   if (!uri) {
     rv.Throw(NS_ERROR_FAILURE);
     return;
   }
 
+  nsCOMPtr<nsIURI> newURI;
+  nsresult rv2 = uri->Clone(getter_AddRefs(newURI));
+  if (NS_FAILED(rv2)) {
+    rv.Throw(rv2);
+    return;
+  }
+
+  rv2 = newURI->SetUserPass(EmptyCString());
+  if (NS_FAILED(rv2)) {
+    rv.Throw(rv2);
+    return;
+  }
+
+  // We use SetHostAndPort because we want to reset the port number if needed.
+  rv2 = newURI->SetHostAndPort(NS_ConvertUTF16toUTF8(aDomain));
+  if (NS_FAILED(rv2)) {
+    rv.Throw(rv2);
+    return;
+  }
+
   // Check new domain - must be a superdomain of the current host
   // For example, a page from foo.bar.com may set domain to bar.com,
   // but not to ar.com, baz.com, or fi.foo.bar.com.
+  nsAutoCString current, domain;
+  if (NS_FAILED(uri->GetAsciiHost(current)))
+    current.Truncate();
+  if (NS_FAILED(newURI->GetAsciiHost(domain)))
+    domain.Truncate();
 
-  nsCOMPtr<nsIURI> newURI = RegistrableDomainSuffixOfInternal(aDomain, uri);
-  if (!newURI) {
+  bool ok = current.Equals(domain);
+  if (current.Length() > domain.Length() &&
+      StringEndsWith(current, domain) &&
+      current.CharAt(current.Length() - domain.Length() - 1) == '.') {
+    // We're golden if the new domain is the current page's base domain or a
+    // subdomain of it.
+    nsCOMPtr<nsIEffectiveTLDService> tldService =
+      do_GetService(NS_EFFECTIVETLDSERVICE_CONTRACTID);
+    if (!tldService) {
+      rv.Throw(NS_ERROR_NOT_AVAILABLE);
+      return;
+    }
+
+    nsAutoCString currentBaseDomain;
+    ok = NS_SUCCEEDED(tldService->GetBaseDomain(uri, 0, currentBaseDomain));
+    NS_ASSERTION(StringEndsWith(domain, currentBaseDomain) ==
+                 (domain.Length() >= currentBaseDomain.Length()),
+                 "uh-oh!  slight optimization wasn't valid somehow!");
+    ok = ok && domain.Length() >= currentBaseDomain.Length();
+  }
+  if (!ok) {
     // Error: illegal domain
     rv.Throw(NS_ERROR_DOM_BAD_DOCUMENT_DOMAIN);
     return;
diff --git a/dom/html/nsHTMLDocument.h b/dom/html/nsHTMLDocument.h
index 486c6e2d980e..ff79e62871b5 100644
--- a/dom/html/nsHTMLDocument.h
+++ b/dom/html/nsHTMLDocument.h
@@ -166,8 +166,6 @@ public:
   virtual JSObject* WrapNode(JSContext* aCx, JS::Handle<JSObject*> aGivenProto)
     override;
   void SetDomain(const nsAString& aDomain, mozilla::ErrorResult& rv);
-  bool IsRegistrableDomainSuffixOfOrEqualTo(const nsAString& aHostSuffixString,
-                                            const nsACString& aOrigHost);
   void GetCookie(nsAString& aCookie, mozilla::ErrorResult& rv);
   void SetCookie(const nsAString& aCookie, mozilla::ErrorResult& rv);
   void NamedGetter(JSContext* cx, const nsAString& aName, bool& aFound,
@@ -276,10 +274,6 @@ protected:
   static void DocumentWriteTerminationFunc(nsISupports *aRef);
 
   already_AddRefed<nsIURI> GetDomainURI();
-  already_AddRefed<nsIURI> CreateInheritingURIForHost(const nsACString& aHostString);
-  already_AddRefed<nsIURI> RegistrableDomainSuffixOfInternal(const nsAString& aHostSuffixString,
-                                                             nsIURI* aOrigHost);
-
 
   nsresult WriteCommon(JSContext *cx, const nsAString& aText,
                        bool aNewlineTerminate);