From 264d6b5edf59d15937ee9264dda1ff3b1322dc19 Mon Sep 17 00:00:00 2001
From: Andrew Osmond <aosmond@mozilla.com>
Date: Mon, 18 Sep 2017 19:53:03 -0400
Subject: [PATCH 01/83] Bug 1380649 - Part 1. Ensure
 SurfaceCache::CollectSizeOfSurfaces removes purged volatile buffer-backed
 surfaces. r=tnikkel

When we lookup a surface in the cache, we are careful to remove any
surfaces which were backed by volatile memory and got purged before we
could reacquire the buffer. We were not so careful in doing that when
generating memory reports. ISurfaceProvider::AddSizeOfExcludingThis will
cause us to acquire the buffer, and if it was purged, forget about its
purged status. Later when we performed a lookup, we would forget the
purged status, and assume we have the right data. This would appear as
completely transparent for BGRA surfaces, and completely black for BGRX
surfaces.

With this patch, we now properly remove purged surfaces instead of
including them in the report. This ensures that the cache state is
consistent. This also resolves memory reports of surfaces which reported
using no data -- they were purged when the report was generated.

Additionally, there was a bug in SurfaceCache::PruneImage where we did
not discard surfaces outside the module lock. Both PruneImage and
CollectSizeOfSurfaces now free any discarded surfaces outside the lock.
---
 image/SurfaceCache.cpp | 54 ++++++++++++++++++++++++++++++++----------
 1 file changed, 42 insertions(+), 12 deletions(-)

diff --git a/image/SurfaceCache.cpp b/image/SurfaceCache.cpp
index 877893fd3c7b..3af3a0149b11 100644
--- a/image/SurfaceCache.cpp
+++ b/image/SurfaceCache.cpp
@@ -614,12 +614,26 @@ public:
     return false;
   }
 
+  template<typename Function>
   void CollectSizeOfSurfaces(nsTArray<SurfaceMemoryCounter>& aCounters,
-                             MallocSizeOf                    aMallocSizeOf)
+                             MallocSizeOf                    aMallocSizeOf,
+                             Function&&                      aRemoveCallback)
   {
     CachedSurface::SurfaceMemoryReport report(aCounters, aMallocSizeOf);
-    for (auto iter = ConstIter(); !iter.Done(); iter.Next()) {
+    for (auto iter = mSurfaces.Iter(); !iter.Done(); iter.Next()) {
       NotNull<CachedSurface*> surface = WrapNotNull(iter.UserData());
+
+      // We don't need the drawable surface for ourselves, but adding a surface
+      // to the report will trigger this indirectly. If the surface was
+      // discarded by the OS because it was in volatile memory, we should remove
+      // it from the cache immediately rather than include it in the report.
+      DrawableSurface drawableSurface = surface->GetDrawableSurface();
+      if (!drawableSurface) {
+        aRemoveCallback(surface);
+        iter.Remove();
+        continue;
+      }
+
       const IntSize& size = surface->GetSurfaceKey().Size();
       bool factor2Size = false;
       if (mFactor2Mode) {
@@ -1073,6 +1087,8 @@ public:
 
     cache->Prune([this, &aAutoLock](NotNull<CachedSurface*> aSurface) -> void {
       StopTracking(aSurface, /* aIsTracked */ true, aAutoLock);
+      // Individual surfaces must be freed outside the lock.
+      mCachedSurfacesDiscard.AppendElement(aSurface);
     });
   }
 
@@ -1165,7 +1181,8 @@ public:
 
   void CollectSizeOfSurfaces(const ImageKey                  aImageKey,
                              nsTArray<SurfaceMemoryCounter>& aCounters,
-                             MallocSizeOf                    aMallocSizeOf)
+                             MallocSizeOf                    aMallocSizeOf,
+                             const StaticMutexAutoLock&      aAutoLock)
   {
     RefPtr<ImageSurfaceCache> cache = GetImageCache(aImageKey);
     if (!cache) {
@@ -1173,7 +1190,12 @@ public:
     }
 
     // Report all surfaces in the per-image cache.
-    cache->CollectSizeOfSurfaces(aCounters, aMallocSizeOf);
+    cache->CollectSizeOfSurfaces(aCounters, aMallocSizeOf,
+      [this, &aAutoLock](NotNull<CachedSurface*> aSurface) -> void {
+      StopTracking(aSurface, /* aIsTracked */ true, aAutoLock);
+      // Individual surfaces must be freed outside the lock.
+      mCachedSurfacesDiscard.AppendElement(aSurface);
+    });
   }
 
 private:
@@ -1544,9 +1566,13 @@ SurfaceCache::RemoveImage(const ImageKey aImageKey)
 /* static */ void
 SurfaceCache::PruneImage(const ImageKey aImageKey)
 {
-  StaticMutexAutoLock lock(sInstanceMutex);
-  if (sInstance) {
-    sInstance->PruneImage(aImageKey, lock);
+  nsTArray<RefPtr<CachedSurface>> discard;
+  {
+    StaticMutexAutoLock lock(sInstanceMutex);
+    if (sInstance) {
+      sInstance->PruneImage(aImageKey, lock);
+      sInstance->TakeDiscard(discard, lock);
+    }
   }
 }
 
@@ -1568,12 +1594,16 @@ SurfaceCache::CollectSizeOfSurfaces(const ImageKey                  aImageKey,
                                     nsTArray<SurfaceMemoryCounter>& aCounters,
                                     MallocSizeOf                    aMallocSizeOf)
 {
-  StaticMutexAutoLock lock(sInstanceMutex);
-  if (!sInstance) {
-    return;
-  }
+  nsTArray<RefPtr<CachedSurface>> discard;
+  {
+    StaticMutexAutoLock lock(sInstanceMutex);
+    if (!sInstance) {
+      return;
+    }
 
-  return sInstance->CollectSizeOfSurfaces(aImageKey, aCounters, aMallocSizeOf);
+    sInstance->CollectSizeOfSurfaces(aImageKey, aCounters, aMallocSizeOf, lock);
+    sInstance->TakeDiscard(discard, lock);
+  }
 }
 
 /* static */ size_t

From 9df74d4975e0b1fce8a85276bec31edbd0350bf5 Mon Sep 17 00:00:00 2001
From: Andrew Osmond <aosmond@mozilla.com>
Date: Mon, 18 Sep 2017 20:08:05 -0400
Subject: [PATCH 02/83] Bug 1380649 - Part 2. Ensure SourceSurfaceVolatileData
 does not forget its purged state. r=jrmuizel

Currently if SourceSurfaceVolatileData::Map fails due to being purged,
we expect that the surface will be discarded by the caller. This has not
consistently been the case, and as such, we should ensure we do not
forget if a buffer was previously purged when we reacquire it. Since we
do not at this time support repopulating an already allocated buffer
with new data, we cannot reset this state once it has been set.
---
 gfx/layers/SourceSurfaceVolatileData.h | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/gfx/layers/SourceSurfaceVolatileData.h b/gfx/layers/SourceSurfaceVolatileData.h
index 7641733621a6..a97bf08ee73c 100644
--- a/gfx/layers/SourceSurfaceVolatileData.h
+++ b/gfx/layers/SourceSurfaceVolatileData.h
@@ -32,6 +32,7 @@ public:
     , mStride(0)
     , mMapCount(0)
     , mFormat(SurfaceFormat::UNKNOWN)
+    , mWasPurged(false)
   {
   }
 
@@ -66,10 +67,14 @@ public:
   bool Map(MapType, MappedSurface *aMappedSurface) override
   {
     MutexAutoLock lock(mMutex);
+    if (mWasPurged) {
+      return false;
+    }
     if (mMapCount == 0) {
       mVBufPtr = mVBuf;
     }
     if (mVBufPtr.WasBufferPurged()) {
+      mWasPurged = true;
       return false;
     }
     aMappedSurface->mData = mVBufPtr;
@@ -82,6 +87,7 @@ public:
   {
     MutexAutoLock lock(mMutex);
     MOZ_ASSERT(mMapCount > 0);
+    MOZ_ASSERT(!mWasPurged);
     if (--mMapCount == 0) {
       mVBufPtr = nullptr;
     }
@@ -100,6 +106,7 @@ private:
   RefPtr<VolatileBuffer> mVBuf;
   VolatileBufferPtr<uint8_t> mVBufPtr;
   SurfaceFormat mFormat;
+  bool mWasPurged;
 };
 
 } // namespace gfx

From 280bab46eb4a6431fd09c1cb31a0186c976abbd9 Mon Sep 17 00:00:00 2001
From: Rail Aliiev <rail@mozilla.com>
Date: Mon, 18 Sep 2017 20:40:53 -0400
Subject: [PATCH 03/83] Bug 1395697 - Syntax fix r=nthomas

---
 testing/mozharness/configs/releases/bouncer_firefox_release.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/testing/mozharness/configs/releases/bouncer_firefox_release.py b/testing/mozharness/configs/releases/bouncer_firefox_release.py
index 5be892cce6fc..ab5be1a74a36 100644
--- a/testing/mozharness/configs/releases/bouncer_firefox_release.py
+++ b/testing/mozharness/configs/releases/bouncer_firefox_release.py
@@ -188,6 +188,7 @@ config = {
                     "bouncer-platform": "win64",
                 },
             },
+        },
     },
     "partials": {
         "releases-dir": {

From 82a08c647e37de978ecad8e712b4916756912041 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Mon, 18 Sep 2017 21:24:37 -0400
Subject: [PATCH 04/83] Bug 991271.  Restore our assertions about how wrapping
 failure should mean an exception was thrown.  r=mccr8

Now that Gecko controls error reporting and the JS engine is no longer doing
JS_IsRunning checks, we should consistently have exceptions here.

MozReview-Commit-ID: IqBe5ArJc2l
---
 dom/bindings/Codegen.py | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index 5742c2a24dbd..54a332ca2bbc 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -6851,8 +6851,7 @@ def getWrapTemplateForType(type, descriptorProvider, result, successCode,
             if not descriptor.hasXPConnectImpls:
                 # Can only fail to wrap as a new-binding object
                 # if they already threw an exception.
-                # XXX Assertion disabled for now, see bug 991271.
-                failed = ("MOZ_ASSERT(true || JS_IsExceptionPending(cx));\n" +
+                failed = ("MOZ_ASSERT(JS_IsExceptionPending(cx));\n" +
                           exceptionCode)
             else:
                 if descriptor.notflattened:
@@ -15371,8 +15370,7 @@ class CGJSImplMethod(CGJSImplMember):
                 MOZ_ASSERT(js::IsObjectInContextCompartment(scopeObj, cx));
                 JS::Rooted<JS::Value> wrappedVal(cx);
                 if (!GetOrCreateDOMReflector(cx, impl, &wrappedVal, aGivenProto)) {
-                  //XXX Assertion disabled for now, see bug 991271.
-                  MOZ_ASSERT(true || JS_IsExceptionPending(cx));
+                  MOZ_ASSERT(JS_IsExceptionPending(cx));
                   aRv.Throw(NS_ERROR_UNEXPECTED);
                   return nullptr;
                 }

From 005450266e36555b9d84f96d3b4f037711bc3b32 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Mon, 18 Sep 2017 21:24:37 -0400
Subject: [PATCH 05/83] Bug 1400139 part 1.  Add infrastructure for marking
 WebIDL interface members as non-enumerable.  r=qdot

MozReview-Commit-ID: 9F0ZNverS63
---
 dom/bindings/Codegen.py                 | 19 +++++++----------
 dom/bindings/parser/WebIDL.py           | 28 ++++++++++++++++++-------
 dom/bindings/test/TestBindingHeader.h   |  4 ++++
 dom/bindings/test/TestCodeGen.webidl    |  8 +++++++
 dom/bindings/test/TestExampleGen.webidl |  8 +++++++
 dom/bindings/test/TestJSImplGen.webidl  |  8 +++++++
 6 files changed, 56 insertions(+), 19 deletions(-)

diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index 54a332ca2bbc..a2e2c5384660 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -2361,6 +2361,12 @@ def IDLToCIdentifier(name):
     return name.replace("-", "_")
 
 
+def EnumerabilityFlags(member):
+    if member.getExtendedAttribute("NonEnumerable"):
+        return "0"
+    return "JSPROP_ENUMERATE"
+
+
 class MethodDefiner(PropertyDefiner):
     """
     A class for defining methods on a prototype object.
@@ -2421,18 +2427,11 @@ class MethodDefiner(PropertyDefiner):
                 })
                 continue
 
-            # Iterable methods should be enumerable, maplike/setlike methods
-            # should not.
-            isMaplikeOrSetlikeMethod = (m.isMaplikeOrSetlikeOrIterableMethod() and
-                                        (m.maplikeOrSetlikeOrIterable.isMaplike() or
-                                         m.maplikeOrSetlikeOrIterable.isSetlike()))
             method = {
                 "name": m.identifier.name,
                 "methodInfo": not m.isStatic(),
                 "length": methodLength(m),
-                # Methods generated for a maplike/setlike declaration are not
-                # enumerable.
-                "flags": "JSPROP_ENUMERATE" if not isMaplikeOrSetlikeMethod else "0",
+                "flags": EnumerabilityFlags(m),
                 "condition": PropertyDefiner.getControllingCondition(m, descriptor),
                 "allowCrossOriginThis": m.getExtendedAttribute("CrossOriginCallable"),
                 "returnsPromise": m.returnsPromise(),
@@ -2728,9 +2727,7 @@ class AttrDefiner(PropertyDefiner):
 
         def flags(attr):
             unforgeable = " | JSPROP_PERMANENT" if self.unforgeable else ""
-            # Attributes generated as part of a maplike/setlike declaration are
-            # not enumerable.
-            enumerable = " | JSPROP_ENUMERATE" if not attr.isMaplikeOrSetlikeAttr() else ""
+            enumerable = " | %s" % EnumerabilityFlags(attr)
             return ("JSPROP_SHARED" + enumerable + unforgeable)
 
         def getter(attr):
diff --git a/dom/bindings/parser/WebIDL.py b/dom/bindings/parser/WebIDL.py
index 2d5166d10162..56d558bf2810 100644
--- a/dom/bindings/parser/WebIDL.py
+++ b/dom/bindings/parser/WebIDL.py
@@ -3703,6 +3703,11 @@ class IDLMaplikeOrSetlikeOrIterableBase(IDLInterfaceMember):
         if isIteratorAlias:
             method.addExtendedAttributes(
                 [IDLExtendedAttribute(self.location, ("Alias", "@@iterator"))])
+        # Methods generated for iterables should be enumerable, but the ones for
+        # maplike/setlike should not be.
+        if not self.isIterable():
+            method.addExtendedAttributes(
+                [IDLExtendedAttribute(self.location, ("NonEnumerable",))])
         members.append(method)
 
     def resolve(self, parentScope):
@@ -3826,11 +3831,15 @@ class IDLMaplikeOrSetlike(IDLMaplikeOrSetlikeOrIterableBase):
         specification during parsing.
         """
         # Both maplike and setlike have a size attribute
-        members.append(IDLAttribute(self.location,
-                                    IDLUnresolvedIdentifier(BuiltinLocation("<auto-generated-identifier>"), "size"),
-                                    BuiltinTypes[IDLBuiltinType.Types.unsigned_long],
-                                    True,
-                                    maplikeOrSetlike=self))
+        sizeAttr = IDLAttribute(self.location,
+                                IDLUnresolvedIdentifier(BuiltinLocation("<auto-generated-identifier>"), "size"),
+                                BuiltinTypes[IDLBuiltinType.Types.unsigned_long],
+                                True,
+                                maplikeOrSetlike=self)
+        # This should be non-enumerable.
+        sizeAttr.addExtendedAttributes(
+                [IDLExtendedAttribute(self.location, ("NonEnumerable",))])
+        members.append(sizeAttr)
         self.reserved_ro_names = ["size"]
         self.disallowedMemberNames.append("size")
 
@@ -3966,7 +3975,8 @@ class IDLConst(IDLInterfaceMember):
         elif (identifier == "Pref" or
               identifier == "ChromeOnly" or
               identifier == "Func" or
-              identifier == "SecureContext"):
+              identifier == "SecureContext" or
+              identifier == "NonEnumerable"):
             # Known attributes that we don't need to do anything with here
             pass
         else:
@@ -4344,7 +4354,8 @@ class IDLAttribute(IDLInterfaceMember):
               identifier == "NeedsSubjectPrincipal" or
               identifier == "NeedsCallerType" or
               identifier == "ReturnValueNeedsContainsHack" or
-              identifier == "BinaryName"):
+              identifier == "BinaryName" or
+              identifier == "NonEnumerable"):
             # Known attributes that we don't need to do anything with here
             pass
         else:
@@ -5081,7 +5092,8 @@ class IDLMethod(IDLInterfaceMember, IDLScope):
               identifier == "BinaryName" or
               identifier == "NeedsSubjectPrincipal" or
               identifier == "NeedsCallerType" or
-              identifier == "StaticClassOverride"):
+              identifier == "StaticClassOverride" or
+              identifier == "NonEnumerable"):
             # Known attributes that we don't need to do anything with here
             pass
         else:
diff --git a/dom/bindings/test/TestBindingHeader.h b/dom/bindings/test/TestBindingHeader.h
index 97964bb679bd..e1cd5d74427c 100644
--- a/dom/bindings/test/TestBindingHeader.h
+++ b/dom/bindings/test/TestBindingHeader.h
@@ -978,6 +978,10 @@ public:
   int8_t Dashed_attribute();
   void Dashed_method();
 
+  bool NonEnumerableAttr() const;
+  void SetNonEnumerableAttr(bool);
+  void NonEnumerableMethod();
+
   // Methods and properties imported via "implements"
   bool ImplementedProperty();
   void SetImplementedProperty(bool);
diff --git a/dom/bindings/test/TestCodeGen.webidl b/dom/bindings/test/TestCodeGen.webidl
index e971e5226b32..7b350afac3f1 100644
--- a/dom/bindings/test/TestCodeGen.webidl
+++ b/dom/bindings/test/TestCodeGen.webidl
@@ -975,6 +975,14 @@ interface TestInterface {
   attribute byte dashed-attribute;
   void dashed-method();
 
+  // [NonEnumerable] tests
+  [NonEnumerable]
+  attribute boolean nonEnumerableAttr;
+  [NonEnumerable]
+  const boolean nonEnumerableConst = true;
+  [NonEnumerable]
+  void nonEnumerableMethod();
+
   // If you add things here, add them to TestExampleGen and TestJSImplGen as well
 };
 
diff --git a/dom/bindings/test/TestExampleGen.webidl b/dom/bindings/test/TestExampleGen.webidl
index e2a04bc7a606..7703b341127a 100644
--- a/dom/bindings/test/TestExampleGen.webidl
+++ b/dom/bindings/test/TestExampleGen.webidl
@@ -802,6 +802,14 @@ interface TestExampleInterface {
   attribute byte dashed-attribute;
   void dashed-method();
 
+  // [NonEnumerable] tests
+  [NonEnumerable]
+  attribute boolean nonEnumerableAttr;
+  [NonEnumerable]
+  const boolean nonEnumerableConst = true;
+  [NonEnumerable]
+  void nonEnumerableMethod();
+
   // If you add things here, add them to TestCodeGen and TestJSImplGen as well
 };
 
diff --git a/dom/bindings/test/TestJSImplGen.webidl b/dom/bindings/test/TestJSImplGen.webidl
index d729f2239b2b..907896a62571 100644
--- a/dom/bindings/test/TestJSImplGen.webidl
+++ b/dom/bindings/test/TestJSImplGen.webidl
@@ -822,6 +822,14 @@ interface TestJSImplInterface {
   attribute byte dashed-attribute;
   void dashed-method();
 
+  // [NonEnumerable] tests
+  [NonEnumerable]
+  attribute boolean nonEnumerableAttr;
+  [NonEnumerable]
+  const boolean nonEnumerableConst = true;
+  [NonEnumerable]
+  void nonEnumerableMethod();
+
   // If you add things here, add them to TestCodeGen as well
 };
 

From 3dc9073bd53ddaa33853c3bf55db3b20cd446fa6 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Mon, 18 Sep 2017 21:24:38 -0400
Subject: [PATCH 06/83] Bug 1400139 part 2.  Make window.content
 non-enumerable.  r=mystor

MozReview-Commit-ID: LQkEkdG8wKf
---
 dom/base/test/mochitest.ini            |  1 +
 dom/base/test/test_window_content.html | 28 ++++++++++++++++++++++++++
 dom/webidl/Window.webidl               |  3 ++-
 3 files changed, 31 insertions(+), 1 deletion(-)
 create mode 100644 dom/base/test/test_window_content.html

diff --git a/dom/base/test/mochitest.ini b/dom/base/test/mochitest.ini
index df3b0e9b799b..cc0baeddb7a5 100644
--- a/dom/base/test/mochitest.ini
+++ b/dom/base/test/mochitest.ini
@@ -814,6 +814,7 @@ skip-if = toolkit == 'android'
 [test_websocket5.html]
 skip-if = toolkit == 'android'
 [test_window_constructor.html]
+[test_window_content.html]
 [test_window_cross_origin_props.html]
 [test_window_define_nonconfigurable.html]
 [test_window_define_symbol.html]
diff --git a/dom/base/test/test_window_content.html b/dom/base/test/test_window_content.html
new file mode 100644
index 000000000000..7ca17d6da1e9
--- /dev/null
+++ b/dom/base/test/test_window_content.html
@@ -0,0 +1,28 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1400139
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 1400139</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="application/javascript">
+
+  /** Test for Bug 1400139 **/
+  var props = [];
+  for (var prop in window) props.push(prop);
+  is(props.indexOf("content"), -1, "Should not have a property named 'content'");
+  </script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1400139">Mozilla Bug 1400139</a>
+<p id="display"></p>
+<div id="notcontent" style="display: none">
+
+</div>
+<pre id="test">
+</pre>
+</body>
+</html>
diff --git a/dom/webidl/Window.webidl b/dom/webidl/Window.webidl
index 00a1c942247d..50b2965a72e0 100644
--- a/dom/webidl/Window.webidl
+++ b/dom/webidl/Window.webidl
@@ -340,7 +340,8 @@ partial interface Window {
 #ifdef NIGHTLY_BUILD
    ChromeOnly,
 #endif
-   Replaceable, Throws, NeedsCallerType] readonly attribute object? content;
+   NonEnumerable, Replaceable, Throws, NeedsCallerType]
+  readonly attribute object? content;
 
   [Throws, ChromeOnly] any getInterface(IID iid);
 

From c1bab3a2f82b36e65f3f43eca8ae7ca6b7581237 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Mon, 18 Sep 2017 21:24:38 -0400
Subject: [PATCH 07/83] Bug 1400139 part 3.  Add a use counter when the
 window.content getter is called from untrusted code.  r=mystor

MozReview-Commit-ID: LFMK7lxs46Z
---
 dom/base/nsDeprecatedOperationList.h        | 1 +
 dom/base/nsGlobalWindow.cpp                 | 3 +++
 dom/locales/en-US/chrome/dom/dom.properties | 2 ++
 3 files changed, 6 insertions(+)

diff --git a/dom/base/nsDeprecatedOperationList.h b/dom/base/nsDeprecatedOperationList.h
index 1c9389f69bff..ac2eb7e6810e 100644
--- a/dom/base/nsDeprecatedOperationList.h
+++ b/dom/base/nsDeprecatedOperationList.h
@@ -50,3 +50,4 @@ DEPRECATED_OPERATION(ImageBitmapRenderingContext_TransferImageBitmap)
 DEPRECATED_OPERATION(URLCreateObjectURL_MediaStream)
 DEPRECATED_OPERATION(XMLBaseAttribute)
 DEPRECATED_OPERATION(XMLBaseAttributeForStyleAttr)
+DEPRECATED_OPERATION(WindowContentUntrusted)
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index 58925b7b0242..31db4edc5ff3 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -4989,6 +4989,9 @@ nsGlobalWindow::GetContentInternal(ErrorResult& aError, CallerType aCallerType)
 
   nsCOMPtr<nsIDocShellTreeItem> primaryContent;
   if (aCallerType != CallerType::System) {
+    if (mDoc) {
+      mDoc->WarnOnceAbout(nsIDocument::eWindowContentUntrusted);
+    }
     // If we're called by non-chrome code, make sure we don't return
     // the primary content window if the calling tab is hidden. In
     // such a case we return the same-type root in the hidden tab,
diff --git a/dom/locales/en-US/chrome/dom/dom.properties b/dom/locales/en-US/chrome/dom/dom.properties
index 3a750ecfa6d4..1d60925a7a66 100644
--- a/dom/locales/en-US/chrome/dom/dom.properties
+++ b/dom/locales/en-US/chrome/dom/dom.properties
@@ -330,6 +330,8 @@ MozAutoGainControlWarning=mozAutoGainControl is deprecated. Use autoGainControl
 MozNoiseSuppressionWarning=mozNoiseSuppression is deprecated. Use noiseSuppression instead.
 # LOCALIZATION NOTE: Do not translate xml:base.
 XMLBaseAttributeWarning=Use of xml:base attribute is deprecated and will be removed soon. Please remove any use of it.
+# LOCALIZATION NOTE: Do not translate "content", "Window", and "window.top"
+WindowContentUntrustedWarning=The ‘content’ attribute of Window objects is deprecated.  Please use ‘window.top’ instead.
 # LOCALIZATION NOTE: %S is the tag name of the element that starts the loop
 SVGReferenceLoopWarning=There is an SVG <%S> reference loop in this document, which will prevent the document rendering correctly.
 # LOCALIZATION NOTE: %S is the tag name of the element that starts the chain

From e3883c1255332cf3c4c42efa7fe28ded58516fb6 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Mon, 18 Sep 2017 21:24:38 -0400
Subject: [PATCH 08/83] Bug 1400501.  Store a list of ancestor principals on
 docshell and document.  r=mystor

Right now every document in a docshell makes a copy of the list.  In practice,
this list is usually pretty short (limited by depth of iframe nesting), so this
is probably not a problem.  We could add a bit of complexity and have a
refcounted struct that contains the list... I wish we had something as simple
as Rust's Arc that we could use here.

MozReview-Commit-ID: 8jGIlkhp1DU
---
 docshell/base/nsDocShell.h | 39 ++++++++++++++++++++++++++++++++++++++
 dom/base/nsDocument.cpp    |  2 ++
 dom/base/nsFrameLoader.cpp | 12 +++++++++++-
 dom/base/nsIDocument.h     | 20 ++++++++++++++++++-
 4 files changed, 71 insertions(+), 2 deletions(-)

diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
index 7bc0ad2b1729..f8c54034870f 100644
--- a/docshell/base/nsDocShell.h
+++ b/docshell/base/nsDocShell.h
@@ -19,6 +19,7 @@
 #include "nsIDOMStorageManager.h"
 #include "nsDocLoader.h"
 #include "mozilla/BasePrincipal.h"
+#include "mozilla/Move.h"
 #include "mozilla/UniquePtr.h"
 #include "mozilla/WeakPtr.h"
 #include "mozilla/TimeStamp.h"
@@ -291,6 +292,41 @@ public:
 
   nsDOMNavigationTiming* GetNavigationTiming() const;
 
+  /**
+   * Get the list of ancestor principals for this docshell.  The list is meant
+   * to be the list of principals of the documents this docshell is "nested
+   * through" in the sense of
+   * <https://html.spec.whatwg.org/multipage/browsers.html#browsing-context-nested-through>.
+   * In practice, it is defined as follows:
+   *
+   * If this is an <iframe mozbrowser> or a toplevel content docshell
+   * (i.e. toplevel document in spec terms), the list is empty.
+   *
+   * Otherwise the list is the list for the document we're nested through (again
+   * in the spec sense), with the principal of that document prepended.  Note
+   * that this matches the ordering specified for Location.ancestorOrigins.
+   */
+  const nsTArray<nsCOMPtr<nsIPrincipal>>& AncestorPrincipals() const
+  {
+    return mAncestorPrincipals;
+  }
+
+  /**
+   * Set the list of ancestor principals for this docshell.  This is really only
+   * needed for use by the frameloader.  We can't do this ourselves, inside
+   * docshell, because there's a bunch of state setup that frameloader does
+   * (like telling us whether we're a mozbrowser), some of which comes after the
+   * docshell is added to the docshell tree, which can affect what the ancestor
+   * principals should look like.
+   *
+   * This method steals the data from the passed-in array.
+   */
+  void SetAncestorPrincipals(
+    nsTArray<nsCOMPtr<nsIPrincipal>>&& aAncestorPrincipals)
+  {
+    mAncestorPrincipals = mozilla::Move(aAncestorPrincipals);
+  }
+
 private:
   bool CanSetOriginAttributes();
 
@@ -1094,6 +1130,9 @@ private:
   // as constants in the nsIDocShell.idl file.
   uint32_t mTouchEventsOverride;
 
+  // Our list of ancestor principals.
+  nsTArray<nsCOMPtr<nsIPrincipal>> mAncestorPrincipals;
+
   // Separate function to do the actual name (i.e. not _top, _self etc.)
   // searching for FindItemWithName.
   nsresult DoFindItemWithName(const nsAString& aName,
diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
index 111bb15e1368..642960e6a155 100644
--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -4965,6 +4965,8 @@ nsIDocument::SetContainer(nsDocShell* aContainer)
 
     static_cast<nsDocument*>(this)->SetIsContentDocument(true);
   }
+
+  mAncestorPrincipals = aContainer->AncestorPrincipals();
 }
 
 nsISupports*
diff --git a/dom/base/nsFrameLoader.cpp b/dom/base/nsFrameLoader.cpp
index 41d58d766555..187e6d0b4def 100644
--- a/dom/base/nsFrameLoader.cpp
+++ b/dom/base/nsFrameLoader.cpp
@@ -2532,7 +2532,7 @@ nsFrameLoader::MaybeCreateDocShell()
   // Note: This logic duplicates a lot of logic in
   // nsSubDocumentFrame::AttributeChanged.  We should fix that.
 
-  int32_t parentType = docShell->ItemType();
+  const int32_t parentType = docShell->ItemType();
 
   // XXXbz why is this in content code, exactly?  We should handle
   // this some other way.....  Not sure how yet.
@@ -2711,6 +2711,16 @@ nsFrameLoader::MaybeCreateDocShell()
 
   nsDocShell::Cast(mDocShell)->SetOriginAttributes(attrs);
 
+  if (!mDocShell->GetIsMozBrowser() &&
+      parentType == mDocShell->ItemType()) {
+    // Propagate through the ancestor principals.
+    nsTArray<nsCOMPtr<nsIPrincipal>> ancestorPrincipals;
+    // Make a copy, so we can modify it.
+    ancestorPrincipals = doc->AncestorPrincipals();
+    ancestorPrincipals.InsertElementAt(0, doc->NodePrincipal());
+    nsDocShell::Cast(mDocShell)->SetAncestorPrincipals(Move(ancestorPrincipals));
+  }
+
   ReallyLoadFrameScripts();
   InitializeBrowserAPI();
 
diff --git a/dom/base/nsIDocument.h b/dom/base/nsIDocument.h
index 4224f3c32b7b..2f287ae2ccb7 100644
--- a/dom/base/nsIDocument.h
+++ b/dom/base/nsIDocument.h
@@ -446,10 +446,24 @@ public:
   }
 
   /**
-   * Set the principal responsible for this document.
+   * Set the principal responsible for this document.  Chances are,
+   * you do not want to be using this.
    */
   virtual void SetPrincipal(nsIPrincipal *aPrincipal) = 0;
 
+  /**
+   * Get the list of ancestor principals for a document.  This is the same as
+   * the ancestor list for the document's docshell the last time SetContainer()
+   * was called with a non-null argument. See the documentation for the
+   * corresponding getter in docshell for how this list is determined.  We store
+   * a copy of the list, because we may lose the ability to reach our docshell
+   * before people stop asking us for this information.
+   */
+  const nsTArray<nsCOMPtr<nsIPrincipal>>& AncestorPrincipals() const
+  {
+    return mAncestorPrincipals;
+  }
+
   /**
    * Return the LoadGroup for the document. May return null.
    */
@@ -3595,6 +3609,10 @@ protected:
   // StartBufferingCSPViolations.
   nsTArray<nsCOMPtr<nsIRunnable>> mBufferedCSPViolations;
 
+  // List of ancestor principals.  This is set at the point a document
+  // is connected to a docshell and not mutated thereafter.
+  nsTArray<nsCOMPtr<nsIPrincipal>> mAncestorPrincipals;
+
   // Restyle root for servo's style system.
   //
   // We store this as an nsINode, rather than as an Element, so that we can store

From 53bb40c960603f7d8f42b6617801a0fe8995c87f Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Mon, 18 Sep 2017 21:27:23 -0400
Subject: [PATCH 09/83] Bug 1400599.  Make sure to properly handle removal of
 the root when the body propagates scrollbar styles to the viewport. 
 r=dholbert

MozReview-Commit-ID: FixsFFtNOfQ
---
 layout/base/crashtests/1400599-1.html  |  7 +++++++
 layout/base/crashtests/crashtests.list |  1 +
 layout/base/nsCSSFrameConstructor.cpp  | 10 +++++++++-
 3 files changed, 17 insertions(+), 1 deletion(-)
 create mode 100644 layout/base/crashtests/1400599-1.html

diff --git a/layout/base/crashtests/1400599-1.html b/layout/base/crashtests/1400599-1.html
new file mode 100644
index 000000000000..19c696ca21f5
--- /dev/null
+++ b/layout/base/crashtests/1400599-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<script>
+onload = function() {
+  document.documentElement.remove();
+}
+</script>
+<body style="overflow: scroll">
diff --git a/layout/base/crashtests/crashtests.list b/layout/base/crashtests/crashtests.list
index 7658efc707c6..7da960f9ccf2 100644
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -501,3 +501,4 @@ load 1397398-1.html
 load 1397398-2.html
 load 1397398-3.html
 load 1398500.html
+load 1400599-1.html
diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index 3fb6cd905bc7..5081706c7664 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -8615,7 +8615,15 @@ nsCSSFrameConstructor::ContentRemoved(nsIContent* aContainer,
   nsPresContext* presContext = mPresShell->GetPresContext();
   MOZ_ASSERT(presContext, "Our presShell should have a valid presContext");
 
-  if (aChild == presContext->GetViewportScrollbarStylesOverrideElement()) {
+  // We want to detect when the viewport override element stored in the
+  // prescontext is in the subtree being removed.  Except in fullscreen cases
+  // (which are handled in Element::UnbindFromTree and do not get stored on the
+  // prescontext), the override element is always either the root element or a
+  // <body> child of the root element.  So we can only be removing the stored
+  // override element if the thing being removed is either the override element
+  // itself or the root element (which can be a parent of the override element).
+  if (aChild == presContext->GetViewportScrollbarStylesOverrideElement() ||
+      (!aContainer && aChild->IsElement())) {
     // We might be removing the element that we propagated viewport scrollbar
     // styles from.  Recompute those. (This clause covers two of the three
     // possible scrollbar-propagation sources: the <body> [as aChild or a

From c41f9edbeae2b43819744ba1f5ffe50992a97147 Mon Sep 17 00:00:00 2001
From: sotaro <sotaro.ikeda.g@gmail.com>
Date: Tue, 19 Sep 2017 11:26:31 +0900
Subject: [PATCH 10/83] Bug 1366700 - Remove MOZ_CRASH in
 GLContextEGLFactory::Create r=jgilbert

---
 gfx/gl/GLContextProviderEGL.cpp | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/gfx/gl/GLContextProviderEGL.cpp b/gfx/gl/GLContextProviderEGL.cpp
index d832308579dd..9b69051adb2d 100644
--- a/gfx/gl/GLContextProviderEGL.cpp
+++ b/gfx/gl/GLContextProviderEGL.cpp
@@ -53,6 +53,7 @@
 #include "GLContextEGL.h"
 #include "GLContextProvider.h"
 #include "GLLibraryEGL.h"
+#include "LayersLogging.h"
 #include "mozilla/ArrayUtils.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/gfx/gfxVars.h"
@@ -169,7 +170,7 @@ GLContextEGLFactory::Create(EGLNativeWindowType aWindow,
     MOZ_ASSERT(aWindow);
     nsCString discardFailureId;
     if (!sEGLLibrary.EnsureInitialized(false, &discardFailureId)) {
-        MOZ_CRASH("GFX: Failed to load EGL library 3!\n");
+        gfxCriticalNote << "Failed to load EGL library 3!";
         return nullptr;
     }
 
@@ -177,14 +178,14 @@ GLContextEGLFactory::Create(EGLNativeWindowType aWindow,
 
     EGLConfig config;
     if (!CreateConfig(&config, aWebRender)) {
-        MOZ_CRASH("GFX: Failed to create EGLConfig!\n");
+        gfxCriticalNote << "Failed to create EGLConfig!";
         return nullptr;
     }
 
     EGLSurface surface = mozilla::gl::CreateSurfaceFromNativeWindow(aWindow, config);
 
     if (!surface) {
-        MOZ_CRASH("GFX: Failed to create EGLSurface!\n");
+        gfxCriticalNote << "Failed to create EGLSurface!";
         return nullptr;
     }
 
@@ -196,7 +197,7 @@ GLContextEGLFactory::Create(EGLNativeWindowType aWindow,
     RefPtr<GLContextEGL> gl = GLContextEGL::CreateGLContext(flags, caps, false, config,
                                                             surface, &discardFailureId);
     if (!gl) {
-        MOZ_CRASH("GFX: Failed to create EGLContext!\n");
+        gfxCriticalNote << "Failed to create EGLContext!";
         mozilla::gl::DestroySurface(surface);
         return nullptr;
     }
@@ -717,7 +718,7 @@ GLContextProviderEGL::CreateWrappingExisting(void* aContext, void* aSurface)
 {
     nsCString discardFailureId;
     if (!sEGLLibrary.EnsureInitialized(false, &discardFailureId)) {
-        MOZ_CRASH("GFX: Failed to load EGL library 2!\n");
+        MOZ_CRASH("GFX: Failed to load EGL library 2!");
         return nullptr;
     }
 
@@ -758,7 +759,7 @@ EGLSurface
 GLContextEGL::CreateCompatibleSurface(void* aWindow)
 {
     if (mConfig == EGL_NO_CONFIG) {
-        MOZ_CRASH("GFX: Failed with invalid EGLConfig 2!\n");
+        MOZ_CRASH("GFX: Failed with invalid EGLConfig 2!");
     }
 
     return GLContextProviderEGL::CreateEGLSurface(aWindow, mConfig);
@@ -770,11 +771,11 @@ GLContextProviderEGL::CreateEGLSurface(void* aWindow, EGLConfig aConfig)
     // NOTE: aWindow is an ANativeWindow
     nsCString discardFailureId;
     if (!sEGLLibrary.EnsureInitialized(false, &discardFailureId)) {
-        MOZ_CRASH("GFX: Failed to load EGL library 4!\n");
+        MOZ_CRASH("GFX: Failed to load EGL library 4!");
     }
     EGLConfig config = aConfig;
     if (!config && !CreateConfig(&config, /* aEnableDepthBuffer */ false)) {
-        MOZ_CRASH("GFX: Failed to create EGLConfig 2!\n");
+        MOZ_CRASH("GFX: Failed to create EGLConfig 2!");
     }
 
     MOZ_ASSERT(aWindow);
@@ -782,7 +783,7 @@ GLContextProviderEGL::CreateEGLSurface(void* aWindow, EGLConfig aConfig)
     EGLSurface surface = sEGLLibrary.fCreateWindowSurface(EGL_DISPLAY(), config, aWindow,
                                                           0);
     if (surface == EGL_NO_SURFACE) {
-        MOZ_CRASH("GFX: Failed to create EGLSurface 2!\n");
+        MOZ_CRASH("GFX: Failed to create EGLSurface 2!");
     }
 
     return surface;
@@ -793,7 +794,7 @@ GLContextProviderEGL::DestroyEGLSurface(EGLSurface surface)
 {
     nsCString discardFailureId;
     if (!sEGLLibrary.EnsureInitialized(false, &discardFailureId)) {
-        MOZ_CRASH("GFX: Failed to load EGL library 5!\n");
+        MOZ_CRASH("GFX: Failed to load EGL library 5!");
     }
 
     sEGLLibrary.fDestroySurface(EGL_DISPLAY(), surface);

From fecb44a27674a6418d4b641a524123362ec2db50 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Mon, 18 Sep 2017 17:57:57 -0400
Subject: [PATCH 11/83] Bug 1401028 - Remove the content-contextmenu observer
 notification; r=kmag

This was used by the add-on SDK.
---
 browser/base/content/nsContextMenu.js                  |  1 -
 browser/modules/ContextMenu.jsm                        | 10 ----------
 .../viewsource/content/viewSource-content.js           |  9 ---------
 3 files changed, 20 deletions(-)

diff --git a/browser/base/content/nsContextMenu.js b/browser/base/content/nsContextMenu.js
index 46969cbb188d..6970ee4afd5a 100644
--- a/browser/base/content/nsContextMenu.js
+++ b/browser/base/content/nsContextMenu.js
@@ -44,7 +44,6 @@ function openContextMenu(aMessage) {
                               spellInfo,
                               principal: data.principal,
                               customMenuItems: data.customMenuItems,
-                              addonInfo: data.addonInfo,
                               documentURIObject,
                               docLocation: data.docLocation,
                               charSet: data.charSet,
diff --git a/browser/modules/ContextMenu.jsm b/browser/modules/ContextMenu.jsm
index 03d69f257264..1d8bba423b13 100644
--- a/browser/modules/ContextMenu.jsm
+++ b/browser/modules/ContextMenu.jsm
@@ -510,15 +510,6 @@ class ContextMenu {
       return;
     }
 
-    let addonInfo = Object.create(null);
-    let subject = {
-      aEvent,
-      addonInfo,
-    };
-
-    subject.wrappedJSObject = subject;
-    Services.obs.notifyObservers(subject, "content-contextmenu");
-
     let doc = aEvent.target.ownerDocument;
     let {
       mozDocumentURIIfNotForErrorPages: docLocation,
@@ -612,7 +603,6 @@ class ContextMenu {
       baseURI,
       isRemote,
       referrer,
-      addonInfo,
       editFlags,
       principal,
       spellInfo,
diff --git a/toolkit/components/viewsource/content/viewSource-content.js b/toolkit/components/viewsource/content/viewSource-content.js
index 4a80aa194984..1f45fbcb2745 100644
--- a/toolkit/components/viewsource/content/viewSource-content.js
+++ b/toolkit/components/viewsource/content/viewSource-content.js
@@ -449,15 +449,6 @@ var ViewSourceContent = {
   },
 
   onContextMenu(event) {
-    let addonInfo = {};
-    let subject = {
-      event,
-      addonInfo,
-    };
-
-    subject.wrappedJSObject = subject;
-    Services.obs.notifyObservers(subject, "content-contextmenu");
-
     let node = event.target;
 
     let result = {

From 149b31c14221becc5263f21f51504f06a769f44f Mon Sep 17 00:00:00 2001
From: vincentliu <vliu@mozilla.com>
Date: Tue, 19 Sep 2017 15:13:27 +0800
Subject: [PATCH 12/83] Bug 1399006 - Invoke PurgeCachedImages to release
 object in main thread while ServoTraversal. r=bholley

---
 layout/style/nsStyleStruct.h | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/layout/style/nsStyleStruct.h b/layout/style/nsStyleStruct.h
index 2be5c75f83ed..12da571c31f7 100644
--- a/layout/style/nsStyleStruct.h
+++ b/layout/style/nsStyleStruct.h
@@ -398,6 +398,10 @@ enum nsStyleImageType {
 
 struct CachedBorderImageData
 {
+  ~CachedBorderImageData() {
+    PurgeCachedImages();
+  }
+
   // Caller are expected to ensure that the value of aSVGViewportSize is
   // different from the cached one since the method won't do the check.
   void SetCachedSVGViewportSize(const mozilla::Maybe<nsSize>& aSVGViewportSize);

From 7ab5f7e1d7dff156b5e84b8ca766595881e86106 Mon Sep 17 00:00:00 2001
From: Michal Novotny <michal.novotny@gmail.com>
Date: Tue, 19 Sep 2017 09:57:49 +0200
Subject: [PATCH 13/83] Bug 1392841 - Enable RCWN on Nightly, r=valentin

---
 modules/libpref/init/all.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index 9f6995d772c3..4c6e54c1c1e8 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -1822,7 +1822,7 @@ pref("network.http.enforce-framing.soft", true);
 pref("network.http.max_response_header_size", 393216);
 
 // If we should attempt to race the cache and network
-pref("network.http.rcwn.enabled", false);
+pref("network.http.rcwn.enabled", true);
 pref("network.http.rcwn.cache_queue_normal_threshold", 8);
 pref("network.http.rcwn.cache_queue_priority_threshold", 2);
 // We might attempt to race the cache with the network only if a resource

From d0ed1d24c4610fbaf0f2b04272fc212bd92eea70 Mon Sep 17 00:00:00 2001
From: Ralph Giles <giles@mozilla.com>
Date: Mon, 18 Sep 2017 17:29:24 -0700
Subject: [PATCH 14/83] Bug 1400927 - Fix u2f-hid-rs cross-compilation on macOS
 r=jcj

One cannot use #[cfg(target_os)] checks in build.rs.
Build scripts can be used to generate code so the target
is set to the host platform when they are compiled.

Having this setting exported an unconditional link
depencency whenever the host was macOS, which broke
cross-compiling, in particular for fennec builds
targetting Android.

Instead, declare the IOKit dependency on the `extern`
block which imports the symbol inside macOS-specific
code. That way final link still works, but the extra
dependency is only enabled when appropriate for the
final target, like the other platform-dependent code.
---
 dom/webauthn/u2f-hid-rs/Cargo.toml         | 1 -
 dom/webauthn/u2f-hid-rs/build.rs           | 8 --------
 dom/webauthn/u2f-hid-rs/src/macos/iokit.rs | 1 +
 3 files changed, 1 insertion(+), 9 deletions(-)
 delete mode 100644 dom/webauthn/u2f-hid-rs/build.rs

diff --git a/dom/webauthn/u2f-hid-rs/Cargo.toml b/dom/webauthn/u2f-hid-rs/Cargo.toml
index e657906d40cd..547dea8ab380 100644
--- a/dom/webauthn/u2f-hid-rs/Cargo.toml
+++ b/dom/webauthn/u2f-hid-rs/Cargo.toml
@@ -2,7 +2,6 @@
 name = "u2fhid"
 version = "0.1.0"
 authors = ["Kyle Machulis <kyle@nonpolynomial.com>", "J.C. Jones <jc@mozilla.com>", "Tim Taubert <ttaubert@mozilla.com>"]
-build = "build.rs"
 
 [target.'cfg(target_os = "linux")'.dependencies]
 libudev = "^0.2"
diff --git a/dom/webauthn/u2f-hid-rs/build.rs b/dom/webauthn/u2f-hid-rs/build.rs
deleted file mode 100644
index 54f038e7fa64..000000000000
--- a/dom/webauthn/u2f-hid-rs/build.rs
+++ /dev/null
@@ -1,8 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-fn main() {
-    #[cfg(any(target_os = "macos"))]
-    println!("cargo:rustc-link-lib=framework=IOKit");
-}
diff --git a/dom/webauthn/u2f-hid-rs/src/macos/iokit.rs b/dom/webauthn/u2f-hid-rs/src/macos/iokit.rs
index 07d1f1228f44..9bf138b40cc2 100644
--- a/dom/webauthn/u2f-hid-rs/src/macos/iokit.rs
+++ b/dom/webauthn/u2f-hid-rs/src/macos/iokit.rs
@@ -50,6 +50,7 @@ pub struct IOHIDDeviceRef(*const c_void);
 unsafe impl Send for IOHIDDeviceRef {}
 unsafe impl Sync for IOHIDDeviceRef {}
 
+#[link(name = "IOKit", kind = "framework")]
 extern "C" {
     // IOHIDManager
     pub fn IOHIDManagerCreate(

From f6d104d246ad7e6986b7e18355da505678f2a0f2 Mon Sep 17 00:00:00 2001
From: Sebastian Hengst <archaeopteryx@coole-files.de>
Date: Tue, 19 Sep 2017 10:49:04 +0200
Subject: [PATCH 15/83] Backed out changeset 58844e6f37b2 (bug 1380649)

---
 gfx/layers/SourceSurfaceVolatileData.h | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/gfx/layers/SourceSurfaceVolatileData.h b/gfx/layers/SourceSurfaceVolatileData.h
index a97bf08ee73c..7641733621a6 100644
--- a/gfx/layers/SourceSurfaceVolatileData.h
+++ b/gfx/layers/SourceSurfaceVolatileData.h
@@ -32,7 +32,6 @@ public:
     , mStride(0)
     , mMapCount(0)
     , mFormat(SurfaceFormat::UNKNOWN)
-    , mWasPurged(false)
   {
   }
 
@@ -67,14 +66,10 @@ public:
   bool Map(MapType, MappedSurface *aMappedSurface) override
   {
     MutexAutoLock lock(mMutex);
-    if (mWasPurged) {
-      return false;
-    }
     if (mMapCount == 0) {
       mVBufPtr = mVBuf;
     }
     if (mVBufPtr.WasBufferPurged()) {
-      mWasPurged = true;
       return false;
     }
     aMappedSurface->mData = mVBufPtr;
@@ -87,7 +82,6 @@ public:
   {
     MutexAutoLock lock(mMutex);
     MOZ_ASSERT(mMapCount > 0);
-    MOZ_ASSERT(!mWasPurged);
     if (--mMapCount == 0) {
       mVBufPtr = nullptr;
     }
@@ -106,7 +100,6 @@ private:
   RefPtr<VolatileBuffer> mVBuf;
   VolatileBufferPtr<uint8_t> mVBufPtr;
   SurfaceFormat mFormat;
-  bool mWasPurged;
 };
 
 } // namespace gfx

From e5075ed4ca0726748f3f9d287a4468ec49f823ef Mon Sep 17 00:00:00 2001
From: Sebastian Hengst <archaeopteryx@coole-files.de>
Date: Tue, 19 Sep 2017 10:51:21 +0200
Subject: [PATCH 16/83] Backed out changeset d4f5756b1d12 (bug 1380649) for
 frequently asserting at image/SurfaceCache.cpp:138. r=backout

---
 image/SurfaceCache.cpp | 54 ++++++++++--------------------------------
 1 file changed, 12 insertions(+), 42 deletions(-)

diff --git a/image/SurfaceCache.cpp b/image/SurfaceCache.cpp
index 3af3a0149b11..877893fd3c7b 100644
--- a/image/SurfaceCache.cpp
+++ b/image/SurfaceCache.cpp
@@ -614,26 +614,12 @@ public:
     return false;
   }
 
-  template<typename Function>
   void CollectSizeOfSurfaces(nsTArray<SurfaceMemoryCounter>& aCounters,
-                             MallocSizeOf                    aMallocSizeOf,
-                             Function&&                      aRemoveCallback)
+                             MallocSizeOf                    aMallocSizeOf)
   {
     CachedSurface::SurfaceMemoryReport report(aCounters, aMallocSizeOf);
-    for (auto iter = mSurfaces.Iter(); !iter.Done(); iter.Next()) {
+    for (auto iter = ConstIter(); !iter.Done(); iter.Next()) {
       NotNull<CachedSurface*> surface = WrapNotNull(iter.UserData());
-
-      // We don't need the drawable surface for ourselves, but adding a surface
-      // to the report will trigger this indirectly. If the surface was
-      // discarded by the OS because it was in volatile memory, we should remove
-      // it from the cache immediately rather than include it in the report.
-      DrawableSurface drawableSurface = surface->GetDrawableSurface();
-      if (!drawableSurface) {
-        aRemoveCallback(surface);
-        iter.Remove();
-        continue;
-      }
-
       const IntSize& size = surface->GetSurfaceKey().Size();
       bool factor2Size = false;
       if (mFactor2Mode) {
@@ -1087,8 +1073,6 @@ public:
 
     cache->Prune([this, &aAutoLock](NotNull<CachedSurface*> aSurface) -> void {
       StopTracking(aSurface, /* aIsTracked */ true, aAutoLock);
-      // Individual surfaces must be freed outside the lock.
-      mCachedSurfacesDiscard.AppendElement(aSurface);
     });
   }
 
@@ -1181,8 +1165,7 @@ public:
 
   void CollectSizeOfSurfaces(const ImageKey                  aImageKey,
                              nsTArray<SurfaceMemoryCounter>& aCounters,
-                             MallocSizeOf                    aMallocSizeOf,
-                             const StaticMutexAutoLock&      aAutoLock)
+                             MallocSizeOf                    aMallocSizeOf)
   {
     RefPtr<ImageSurfaceCache> cache = GetImageCache(aImageKey);
     if (!cache) {
@@ -1190,12 +1173,7 @@ public:
     }
 
     // Report all surfaces in the per-image cache.
-    cache->CollectSizeOfSurfaces(aCounters, aMallocSizeOf,
-      [this, &aAutoLock](NotNull<CachedSurface*> aSurface) -> void {
-      StopTracking(aSurface, /* aIsTracked */ true, aAutoLock);
-      // Individual surfaces must be freed outside the lock.
-      mCachedSurfacesDiscard.AppendElement(aSurface);
-    });
+    cache->CollectSizeOfSurfaces(aCounters, aMallocSizeOf);
   }
 
 private:
@@ -1566,13 +1544,9 @@ SurfaceCache::RemoveImage(const ImageKey aImageKey)
 /* static */ void
 SurfaceCache::PruneImage(const ImageKey aImageKey)
 {
-  nsTArray<RefPtr<CachedSurface>> discard;
-  {
-    StaticMutexAutoLock lock(sInstanceMutex);
-    if (sInstance) {
-      sInstance->PruneImage(aImageKey, lock);
-      sInstance->TakeDiscard(discard, lock);
-    }
+  StaticMutexAutoLock lock(sInstanceMutex);
+  if (sInstance) {
+    sInstance->PruneImage(aImageKey, lock);
   }
 }
 
@@ -1594,16 +1568,12 @@ SurfaceCache::CollectSizeOfSurfaces(const ImageKey                  aImageKey,
                                     nsTArray<SurfaceMemoryCounter>& aCounters,
                                     MallocSizeOf                    aMallocSizeOf)
 {
-  nsTArray<RefPtr<CachedSurface>> discard;
-  {
-    StaticMutexAutoLock lock(sInstanceMutex);
-    if (!sInstance) {
-      return;
-    }
-
-    sInstance->CollectSizeOfSurfaces(aImageKey, aCounters, aMallocSizeOf, lock);
-    sInstance->TakeDiscard(discard, lock);
+  StaticMutexAutoLock lock(sInstanceMutex);
+  if (!sInstance) {
+    return;
   }
+
+  return sInstance->CollectSizeOfSurfaces(aImageKey, aCounters, aMallocSizeOf);
 }
 
 /* static */ size_t

From 0674dd12d2d72c1d494c8364ccb3a29ba2478942 Mon Sep 17 00:00:00 2001
From: Jan de Mooij <jdemooij@mozilla.com>
Date: Thu, 14 Sep 2017 10:03:09 +0200
Subject: [PATCH 17/83] Bug 1399471 part 2 - Add a mechanism to check
 callWithABI invariants in debug builds. r=nbp

---
 js/src/builtin/RegExp.cpp                   |  4 +-
 js/src/irregexp/RegExpMacroAssembler.cpp    |  4 ++
 js/src/irregexp/RegExpStack.cpp             |  1 +
 js/src/jit-test/tests/wasm/integer.js       |  5 ++
 js/src/jit/Bailouts.cpp                     |  4 ++
 js/src/jit/BaselineDebugModeOSR.cpp         |  2 +
 js/src/jit/CodeGenerator.cpp                | 38 +++++++++---
 js/src/jit/IonCacheIRCompiler.cpp           | 10 ++-
 js/src/jit/MacroAssembler-inl.h             | 18 +++++-
 js/src/jit/MacroAssembler.cpp               | 69 ++++++++++++++++-----
 js/src/jit/MacroAssembler.h                 | 22 ++++++-
 js/src/jit/SharedIC.cpp                     |  6 +-
 js/src/jit/VMFunctions.cpp                  | 42 +++++++++----
 js/src/jit/arm/CodeGenerator-arm.cpp        |  9 ++-
 js/src/jit/arm/MacroAssembler-arm.cpp       |  2 +-
 js/src/jit/arm/SharedIC-arm.cpp             |  3 +-
 js/src/jit/arm/Trampoline-arm.cpp           |  2 +-
 js/src/jit/arm64/MacroAssembler-arm64.cpp   |  2 +-
 js/src/jit/arm64/Trampoline-arm64.cpp       |  2 +-
 js/src/jit/mips32/MacroAssembler-mips32.cpp |  2 +-
 js/src/jit/mips32/Trampoline-mips32.cpp     |  2 +-
 js/src/jit/mips64/MacroAssembler-mips64.cpp |  2 +-
 js/src/jit/mips64/Trampoline-mips64.cpp     |  2 +-
 js/src/jit/x64/MacroAssembler-x64.cpp       |  2 +-
 js/src/jit/x64/Trampoline-x64.cpp           |  2 +-
 js/src/jit/x86/CodeGenerator-x86.cpp        | 11 ++--
 js/src/jit/x86/MacroAssembler-x86.cpp       |  2 +-
 js/src/jit/x86/Trampoline-x86.cpp           |  2 +-
 js/src/jsarray.cpp                          |  1 +
 js/src/jsboolinlines.h                      |  3 +
 js/src/jscntxt.cpp                          | 21 +++++++
 js/src/jscntxt.h                            | 25 ++++++++
 js/src/jslibmath.h                          |  6 +-
 js/src/jsmath.cpp                           | 62 ++++++++++++++++++
 js/src/vm/ArgumentsObject.cpp               |  2 +-
 js/src/vm/NativeObject.cpp                  |  4 +-
 36 files changed, 325 insertions(+), 71 deletions(-)

diff --git a/js/src/builtin/RegExp.cpp b/js/src/builtin/RegExp.cpp
index b04bd46608d6..28ca7f1266ac 100644
--- a/js/src/builtin/RegExp.cpp
+++ b/js/src/builtin/RegExp.cpp
@@ -1573,7 +1573,7 @@ js::RegExpPrototypeOptimizable(JSContext* cx, unsigned argc, Value* vp)
 bool
 js::RegExpPrototypeOptimizableRaw(JSContext* cx, JSObject* proto)
 {
-    JS::AutoCheckCannotGC nogc;
+    AutoUnsafeCallWithABI unsafe;
     AutoAssertNoPendingException aanpe(cx);
     if (!proto->isNative())
         return false;
@@ -1666,7 +1666,7 @@ js::RegExpInstanceOptimizable(JSContext* cx, unsigned argc, Value* vp)
 bool
 js::RegExpInstanceOptimizableRaw(JSContext* cx, JSObject* obj, JSObject* proto)
 {
-    JS::AutoCheckCannotGC nogc;
+    AutoUnsafeCallWithABI unsafe;
     AutoAssertNoPendingException aanpe(cx);
 
     RegExpObject* rx = &obj->as<RegExpObject>();
diff --git a/js/src/irregexp/RegExpMacroAssembler.cpp b/js/src/irregexp/RegExpMacroAssembler.cpp
index b39b0773c2fd..8b237d5b0596 100644
--- a/js/src/irregexp/RegExpMacroAssembler.cpp
+++ b/js/src/irregexp/RegExpMacroAssembler.cpp
@@ -40,6 +40,8 @@ int
 irregexp::CaseInsensitiveCompareStrings(const CharT* substring1, const CharT* substring2,
 					size_t byteLength)
 {
+    AutoUnsafeCallWithABI unsafe;
+
     MOZ_ASSERT(byteLength % sizeof(CharT) == 0);
     size_t length = byteLength / sizeof(CharT);
 
@@ -70,6 +72,8 @@ int
 irregexp::CaseInsensitiveCompareUCStrings(const CharT* substring1, const CharT* substring2,
                                           size_t byteLength)
 {
+    AutoUnsafeCallWithABI unsafe;
+
     MOZ_ASSERT(byteLength % sizeof(CharT) == 0);
     size_t length = byteLength / sizeof(CharT);
 
diff --git a/js/src/irregexp/RegExpStack.cpp b/js/src/irregexp/RegExpStack.cpp
index cbc9ae1a4dac..7ea47149ed40 100644
--- a/js/src/irregexp/RegExpStack.cpp
+++ b/js/src/irregexp/RegExpStack.cpp
@@ -47,6 +47,7 @@ RegExpStackScope::~RegExpStackScope()
 int
 irregexp::GrowBacktrackStack(JSRuntime* rt)
 {
+    AutoUnsafeCallWithABI unsafe;
     return TlsContext.get()->regexpStack.ref().grow();
 }
 
diff --git a/js/src/jit-test/tests/wasm/integer.js b/js/src/jit-test/tests/wasm/integer.js
index d72ad23015d2..7d45f91f4ddb 100644
--- a/js/src/jit-test/tests/wasm/integer.js
+++ b/js/src/jit-test/tests/wasm/integer.js
@@ -153,6 +153,11 @@ testComparison32('gt_u', 40, 40, 0);
 testComparison32('ge_s', 40, 40, 1);
 testComparison32('ge_u', 40, 40, 1);
 
+// On 32-bit debug builds, with --ion-eager, this test can run into our
+// per-process JIT code limits and OOM. Trigger a GC to discard code.
+if (getJitCompilerOptions()["ion.warmup.trigger"] === 0)
+    gc();
+
 // Test MTest's GVN branch inversion.
 var testTrunc = wasmEvalText(`(module (func (param f32) (result i32) (if i32 (i32.eqz (i32.trunc_s/f32 (get_local 0))) (i32.const 0) (i32.const 1))) (export "" 0))`).exports[""];
 assertEq(testTrunc(0), 0);
diff --git a/js/src/jit/Bailouts.cpp b/js/src/jit/Bailouts.cpp
index 039578f4a09a..7663ccc4c547 100644
--- a/js/src/jit/Bailouts.cpp
+++ b/js/src/jit/Bailouts.cpp
@@ -29,6 +29,8 @@ using mozilla::IsInRange;
 uint32_t
 jit::Bailout(BailoutStack* sp, BaselineBailoutInfo** bailoutInfo)
 {
+    AutoUnsafeCallWithABI unsafe;
+
     JSContext* cx = TlsContext.get();
     MOZ_ASSERT(bailoutInfo);
 
@@ -104,6 +106,8 @@ uint32_t
 jit::InvalidationBailout(InvalidationBailoutStack* sp, size_t* frameSizeOut,
                          BaselineBailoutInfo** bailoutInfo)
 {
+    AutoUnsafeCallWithABI unsafe;
+
     sp->checkInvariants();
 
     JSContext* cx = TlsContext.get();
diff --git a/js/src/jit/BaselineDebugModeOSR.cpp b/js/src/jit/BaselineDebugModeOSR.cpp
index b06acf7ab8b4..e13ae5a7ddc4 100644
--- a/js/src/jit/BaselineDebugModeOSR.cpp
+++ b/js/src/jit/BaselineDebugModeOSR.cpp
@@ -988,6 +988,7 @@ EmitBranchIsReturningFromCallVM(MacroAssembler& masm, Register entry, Label* lab
 static void
 SyncBaselineDebugModeOSRInfo(BaselineFrame* frame, Value* vp, bool rv)
 {
+    AutoUnsafeCallWithABI unsafe;
     BaselineDebugModeOSRInfo* info = frame->debugModeOSRInfo();
     MOZ_ASSERT(info);
     MOZ_ASSERT(frame->script()->baselineScript()->containsCodeAddress(info->resumeAddr));
@@ -1022,6 +1023,7 @@ SyncBaselineDebugModeOSRInfo(BaselineFrame* frame, Value* vp, bool rv)
 static void
 FinishBaselineDebugModeOSR(BaselineFrame* frame)
 {
+    AutoUnsafeCallWithABI unsafe;
     frame->deleteDebugModeOSRInfo();
 
     // We will return to JIT code now so we have to clear the override pc.
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 45aa261e6999..ac123edf2ec9 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -1591,12 +1591,14 @@ CreateDependentString::generate(MacroAssembler& masm, const JSAtomState& names,
 static void*
 AllocateString(JSContext* cx)
 {
+    AutoUnsafeCallWithABI unsafe;
     return js::Allocate<JSString, NoGC>(cx);
 }
 
 static void*
 AllocateFatInlineString(JSContext* cx)
 {
+    AutoUnsafeCallWithABI unsafe;
     return js::Allocate<JSFatInlineString, NoGC>(cx);
 }
 
@@ -1629,6 +1631,7 @@ CreateDependentString::generateFallback(MacroAssembler& masm, LiveRegisterSet re
 static void*
 CreateMatchResultFallbackFunc(JSContext* cx, gc::AllocKind kind, size_t nDynamicSlots)
 {
+    AutoUnsafeCallWithABI unsafe;
     return js::Allocate<JSObject, NoGC>(cx, kind, nDynamicSlots, gc::DefaultHeap,
                                         &ArrayObject::class_);
 }
@@ -4000,7 +4003,8 @@ CodeGenerator::visitCallNative(LCallNative* call)
         if (jitInfo && jitInfo->type() == JSJitInfo::IgnoresReturnValueNative)
             native = jitInfo->ignoresReturnValueMethod;
     }
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, native));
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, native), MoveOp::GENERAL,
+                     CheckUnsafeCallWithABI::DontCheckHasExitFrame);
 
     emitTracelogStopEvent(TraceLogger_Call);
 
@@ -4123,7 +4127,8 @@ CodeGenerator::visitCallDOMNative(LCallDOMNative* call)
     masm.passABIArg(argObj);
     masm.passABIArg(argPrivate);
     masm.passABIArg(argArgs);
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, target->jitInfo()->method));
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, target->jitInfo()->method), MoveOp::GENERAL,
+                     CheckUnsafeCallWithABI::DontCheckHasExitFrame);
 
     if (target->jitInfo()->isInfallible) {
         masm.loadValue(Address(masm.getStackPointer(), IonDOMMethodExitFrameLayout::offsetOfResult()),
@@ -7059,15 +7064,24 @@ CodeGenerator::visitMathFunctionF(LMathFunctionF* ins)
     masm.passABIArg(input, MoveOp::FLOAT32);
 
     void* funptr = nullptr;
+    CheckUnsafeCallWithABI check = CheckUnsafeCallWithABI::Check;
     switch (ins->mir()->function()) {
-      case MMathFunction::Floor: funptr = JS_FUNC_TO_DATA_PTR(void*, floorf);           break;
-      case MMathFunction::Round: funptr = JS_FUNC_TO_DATA_PTR(void*, math_roundf_impl); break;
-      case MMathFunction::Ceil:  funptr = JS_FUNC_TO_DATA_PTR(void*, ceilf);            break;
+      case MMathFunction::Floor:
+        funptr = JS_FUNC_TO_DATA_PTR(void*, floorf);
+        check = CheckUnsafeCallWithABI::DontCheckOther;
+        break;
+      case MMathFunction::Round:
+        funptr = JS_FUNC_TO_DATA_PTR(void*, math_roundf_impl);
+        break;
+      case MMathFunction::Ceil:
+        funptr = JS_FUNC_TO_DATA_PTR(void*, ceilf);
+        check = CheckUnsafeCallWithABI::DontCheckOther;
+        break;
       default:
         MOZ_CRASH("Unknown or unsupported float32 math function");
     }
 
-    masm.callWithABI(funptr, MoveOp::FLOAT32);
+    masm.callWithABI(funptr, MoveOp::FLOAT32, check);
 }
 
 void
@@ -7960,7 +7974,8 @@ JitRuntime::generateFreeStub(JSContext* cx)
 
     masm.setupUnalignedABICall(regTemp);
     masm.passABIArg(regSlots);
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, js_free));
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, js_free), MoveOp::GENERAL,
+                     CheckUnsafeCallWithABI::DontCheckOther);
 
     masm.PopRegsInMask(save);
 
@@ -7998,7 +8013,8 @@ JitRuntime::generateLazyLinkStub(JSContext* cx)
 
     masm.setupUnalignedABICall(temp0);
     masm.passABIArg(temp0);
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, LazyLinkTopActivation));
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, LazyLinkTopActivation), MoveOp::GENERAL,
+                     CheckUnsafeCallWithABI::DontCheckHasExitFrame);
 
     masm.leaveExitFrame(/* stub code */ sizeof(JitCode*));
 
@@ -11799,7 +11815,8 @@ CodeGenerator::visitGetDOMProperty(LGetDOMProperty* ins)
     masm.passABIArg(ObjectReg);
     masm.passABIArg(PrivateReg);
     masm.passABIArg(ValueReg);
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, ins->mir()->fun()));
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, ins->mir()->fun()), MoveOp::GENERAL,
+                     CheckUnsafeCallWithABI::DontCheckHasExitFrame);
 
     if (ins->mir()->isInfallible()) {
         masm.loadValue(Address(masm.getStackPointer(), IonDOMExitFrameLayout::offsetOfResult()),
@@ -11897,7 +11914,8 @@ CodeGenerator::visitSetDOMProperty(LSetDOMProperty* ins)
     masm.passABIArg(ObjectReg);
     masm.passABIArg(PrivateReg);
     masm.passABIArg(ValueReg);
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, ins->mir()->fun()));
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, ins->mir()->fun()), MoveOp::GENERAL,
+                     CheckUnsafeCallWithABI::DontCheckHasExitFrame);
 
     masm.branchIfFalseBool(ReturnReg, masm.exceptionLabel());
 
diff --git a/js/src/jit/IonCacheIRCompiler.cpp b/js/src/jit/IonCacheIRCompiler.cpp
index bbfbdae57b12..83df0278b22a 100644
--- a/js/src/jit/IonCacheIRCompiler.cpp
+++ b/js/src/jit/IonCacheIRCompiler.cpp
@@ -1078,7 +1078,8 @@ IonCacheIRCompiler::emitCallNativeGetterResult()
     masm.passABIArg(argJSContext);
     masm.passABIArg(argUintN);
     masm.passABIArg(argVp);
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, target->native()));
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, target->native()), MoveOp::GENERAL,
+                     CheckUnsafeCallWithABI::DontCheckHasExitFrame);
 
     // Test for failure.
     masm.branchIfFalseBool(ReturnReg, masm.exceptionLabel());
@@ -1136,7 +1137,8 @@ IonCacheIRCompiler::emitCallProxyGetResult()
     masm.passABIArg(argProxy);
     masm.passABIArg(argId);
     masm.passABIArg(argVp);
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, ProxyGetProperty));
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, ProxyGetProperty), MoveOp::GENERAL,
+                     CheckUnsafeCallWithABI::DontCheckHasExitFrame);
 
     // Test for failure.
     masm.branchIfFalseBool(ReturnReg, masm.exceptionLabel());
@@ -1324,6 +1326,7 @@ IonCacheIRCompiler::emitCallStringSplitResult()
 static bool
 GroupHasPropertyTypes(ObjectGroup* group, jsid* id, Value* v)
 {
+    AutoUnsafeCallWithABI unsafe;
     if (group->unknownPropertiesDontCheckGeneration())
         return true;
     HeapTypeSet* propTypes = group->maybeGetPropertyDontCheckGeneration(*id);
@@ -1991,7 +1994,8 @@ IonCacheIRCompiler::emitCallNativeSetter()
     masm.passABIArg(argJSContext);
     masm.passABIArg(argUintN);
     masm.passABIArg(argVp);
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, target->native()));
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, target->native()), MoveOp::GENERAL,
+                     CheckUnsafeCallWithABI::DontCheckHasExitFrame);
 
     // Test for failure.
     masm.branchIfFalseBool(ReturnReg, masm.exceptionLabel());
diff --git a/js/src/jit/MacroAssembler-inl.h b/js/src/jit/MacroAssembler-inl.h
index 19257c08764a..c48e6168901f 100644
--- a/js/src/jit/MacroAssembler-inl.h
+++ b/js/src/jit/MacroAssembler-inl.h
@@ -126,8 +126,22 @@ MacroAssembler::passABIArg(FloatRegister reg, MoveOp::Type type)
     passABIArg(MoveOperand(reg), type);
 }
 
-template <typename T> void
-MacroAssembler::callWithABI(const T& fun, MoveOp::Type result)
+void
+MacroAssembler::callWithABI(void* fun, MoveOp::Type result, CheckUnsafeCallWithABI check)
+{
+    AutoProfilerCallInstrumentation profiler(*this);
+    callWithABINoProfiler(fun, result, check);
+}
+
+void
+MacroAssembler::callWithABI(Register fun, MoveOp::Type result)
+{
+    AutoProfilerCallInstrumentation profiler(*this);
+    callWithABINoProfiler(fun, result);
+}
+
+void
+MacroAssembler::callWithABI(const Address& fun, MoveOp::Type result)
 {
     AutoProfilerCallInstrumentation profiler(*this);
     callWithABINoProfiler(fun, result);
diff --git a/js/src/jit/MacroAssembler.cpp b/js/src/jit/MacroAssembler.cpp
index ec16d4a702bc..6cab73f2e9e9 100644
--- a/js/src/jit/MacroAssembler.cpp
+++ b/js/src/jit/MacroAssembler.cpp
@@ -1043,7 +1043,7 @@ FindStartOfUninitializedAndUndefinedSlots(NativeObject* templateObj, uint32_t ns
 static void
 AllocateObjectBufferWithInit(JSContext* cx, TypedArrayObject* obj, int32_t count)
 {
-    JS::AutoCheckCannotGC nogc(cx);
+    AutoUnsafeCallWithABI unsafe;
 
     obj->initPrivate(nullptr);
 
@@ -1550,7 +1550,8 @@ MacroAssembler::generateBailoutTail(Register scratch, Register bailoutInfo)
         loadJSContext(ReturnReg);
         setupUnalignedABICall(scratch);
         passABIArg(ReturnReg);
-        callWithABI(JS_FUNC_TO_DATA_PTR(void*, BailoutReportOverRecursed));
+        callWithABI(JS_FUNC_TO_DATA_PTR(void*, BailoutReportOverRecursed), MoveOp::GENERAL,
+                    CheckUnsafeCallWithABI::DontCheckHasExitFrame);
         jump(exceptionLabel());
     }
 
@@ -1615,7 +1616,8 @@ MacroAssembler::generateBailoutTail(Register scratch, Register bailoutInfo)
             // Call a stub to free allocated memory and create arguments objects.
             setupUnalignedABICall(temp);
             passABIArg(bailoutInfo);
-            callWithABI(JS_FUNC_TO_DATA_PTR(void*, FinishBailoutToBaseline));
+            callWithABI(JS_FUNC_TO_DATA_PTR(void*, FinishBailoutToBaseline),
+                        MoveOp::GENERAL, CheckUnsafeCallWithABI::DontCheckHasExitFrame);
             branchTest32(Zero, ReturnReg, ReturnReg, exceptionLabel());
 
             // Restore values where they need to be and resume execution.
@@ -1653,7 +1655,8 @@ MacroAssembler::generateBailoutTail(Register scratch, Register bailoutInfo)
             // Call a stub to free allocated memory and create arguments objects.
             setupUnalignedABICall(temp);
             passABIArg(bailoutInfo);
-            callWithABI(JS_FUNC_TO_DATA_PTR(void*, FinishBailoutToBaseline));
+            callWithABI(JS_FUNC_TO_DATA_PTR(void*, FinishBailoutToBaseline),
+                        MoveOp::GENERAL, CheckUnsafeCallWithABI::DontCheckHasExitFrame);
             branchTest32(Zero, ReturnReg, ReturnReg, exceptionLabel());
 
             // Restore values where they need to be and resume execution.
@@ -1729,7 +1732,9 @@ MacroAssembler::assumeUnreachable(const char* output)
         setupUnalignedABICall(temp);
         movePtr(ImmPtr(output), temp);
         passABIArg(temp);
-        callWithABI(JS_FUNC_TO_DATA_PTR(void*, AssumeUnreachable_));
+        callWithABI(JS_FUNC_TO_DATA_PTR(void*, AssumeUnreachable_),
+                    MoveOp::GENERAL,
+                    CheckUnsafeCallWithABI::DontCheckOther);
 
         PopRegsInMask(save);
     }
@@ -1753,7 +1758,10 @@ MacroAssembler::assertTestInt32(Condition cond, const T& value, const char* outp
 template void MacroAssembler::assertTestInt32(Condition, const Address&, const char*);
 
 static void
-Printf0_(const char* output) {
+Printf0_(const char* output)
+{
+    AutoUnsafeCallWithABI unsafe;
+
     // Use stderr instead of stdout because this is only used for debug
     // output. stderr is less likely to interfere with the program's normal
     // output, and it's always unbuffered.
@@ -1778,7 +1786,9 @@ MacroAssembler::printf(const char* output)
 }
 
 static void
-Printf1_(const char* output, uintptr_t value) {
+Printf1_(const char* output, uintptr_t value)
+{
+    AutoUnsafeCallWithABI unsafe;
     AutoEnterOOMUnsafeRegion oomUnsafe;
     js::UniqueChars line = JS_sprintf_append(nullptr, output, value);
     if (!line)
@@ -1824,7 +1834,8 @@ MacroAssembler::tracelogStartId(Register logger, uint32_t textId, bool force)
     passABIArg(logger);
     move32(Imm32(textId), temp);
     passABIArg(temp);
-    callWithABI(JS_FUNC_TO_DATA_PTR(void*, TraceLogStartEventPrivate));
+    callWithABI(JS_FUNC_TO_DATA_PTR(void*, TraceLogStartEventPrivate), MoveOp::GENERAL,
+                CheckUnsafeCallWithABI::DontCheckOther);
 
     PopRegsInMask(save);
 }
@@ -1843,7 +1854,8 @@ MacroAssembler::tracelogStartId(Register logger, Register textId)
     setupUnalignedABICall(temp);
     passABIArg(logger);
     passABIArg(textId);
-    callWithABI(JS_FUNC_TO_DATA_PTR(void*, TraceLogStartEventPrivate));
+    callWithABI(JS_FUNC_TO_DATA_PTR(void*, TraceLogStartEventPrivate), MoveOp::GENERAL,
+                CheckUnsafeCallWithABI::DontCheckOther);
 
     PopRegsInMask(save);
 }
@@ -1864,7 +1876,8 @@ MacroAssembler::tracelogStartEvent(Register logger, Register event)
     setupUnalignedABICall(temp);
     passABIArg(logger);
     passABIArg(event);
-    callWithABI(JS_FUNC_TO_DATA_PTR(void*, TraceLogFunc));
+    callWithABI(JS_FUNC_TO_DATA_PTR(void*, TraceLogFunc), MoveOp::GENERAL,
+                CheckUnsafeCallWithABI::DontCheckOther);
 
     PopRegsInMask(save);
 }
@@ -1887,7 +1900,8 @@ MacroAssembler::tracelogStopId(Register logger, uint32_t textId, bool force)
     move32(Imm32(textId), temp);
     passABIArg(temp);
 
-    callWithABI(JS_FUNC_TO_DATA_PTR(void*, TraceLogStopEventPrivate));
+    callWithABI(JS_FUNC_TO_DATA_PTR(void*, TraceLogStopEventPrivate), MoveOp::GENERAL,
+                CheckUnsafeCallWithABI::DontCheckOther);
 
     PopRegsInMask(save);
 }
@@ -1906,7 +1920,8 @@ MacroAssembler::tracelogStopId(Register logger, Register textId)
     setupUnalignedABICall(temp);
     passABIArg(logger);
     passABIArg(textId);
-    callWithABI(JS_FUNC_TO_DATA_PTR(void*, TraceLogStopEventPrivate));
+    callWithABI(JS_FUNC_TO_DATA_PTR(void*, TraceLogStopEventPrivate), MoveOp::GENERAL,
+                CheckUnsafeCallWithABI::DontCheckOther);
 
     PopRegsInMask(save);
 }
@@ -2107,7 +2122,8 @@ MacroAssembler::outOfLineTruncateSlow(FloatRegister src, Register dest, bool wid
     } else {
         setupUnalignedABICall(dest);
         passABIArg(src, MoveOp::DOUBLE);
-        callWithABI(mozilla::BitwiseCast<void*, int32_t(*)(double)>(JS::ToInt32));
+        callWithABI(mozilla::BitwiseCast<void*, int32_t(*)(double)>(JS::ToInt32),
+                    MoveOp::GENERAL, CheckUnsafeCallWithABI::DontCheckOther);
     }
     storeCallWordResult(dest);
 
@@ -2801,7 +2817,7 @@ MacroAssembler::passABIArg(const MoveOperand& from, MoveOp::Type type)
 }
 
 void
-MacroAssembler::callWithABINoProfiler(void* fun, MoveOp::Type result)
+MacroAssembler::callWithABINoProfiler(void* fun, MoveOp::Type result, CheckUnsafeCallWithABI check)
 {
     appendSignatureType(result);
 #ifdef JS_SIMULATOR
@@ -2810,8 +2826,33 @@ MacroAssembler::callWithABINoProfiler(void* fun, MoveOp::Type result)
 
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
+
+#ifdef DEBUG
+    if (check == CheckUnsafeCallWithABI::Check) {
+        push(ReturnReg);
+        loadJSContext(ReturnReg);
+        Address flagAddr(ReturnReg, JSContext::offsetOfInUnsafeCallWithABI());
+        store32(Imm32(1), flagAddr);
+        pop(ReturnReg);
+    }
+#endif
+
     call(ImmPtr(fun));
+
     callWithABIPost(stackAdjust, result);
+
+#ifdef DEBUG
+    if (check == CheckUnsafeCallWithABI::Check) {
+        Label ok;
+        push(ReturnReg);
+        loadJSContext(ReturnReg);
+        Address flagAddr(ReturnReg, JSContext::offsetOfInUnsafeCallWithABI());
+        branch32(Assembler::Equal, flagAddr, Imm32(0), &ok);
+        assumeUnreachable("callWithABI: callee did not use AutoInUnsafeCallWithABI");
+        bind(&ok);
+        pop(ReturnReg);
+    }
+#endif
 }
 
 void
diff --git a/js/src/jit/MacroAssembler.h b/js/src/jit/MacroAssembler.h
index 8f13f74b39f2..32dda64714ea 100644
--- a/js/src/jit/MacroAssembler.h
+++ b/js/src/jit/MacroAssembler.h
@@ -193,6 +193,20 @@ enum class ExitFrameToken : uint8_t;
 
 class AutoSaveLiveRegisters;
 
+enum class CheckUnsafeCallWithABI {
+    // Require the callee to use AutoUnsafeCallWithABI.
+    Check,
+
+    // We pushed an exit frame so this callWithABI can safely GC and walk the
+    // stack.
+    DontCheckHasExitFrame,
+
+    // Don't check this callWithABI uses AutoUnsafeCallWithABI, for instance
+    // because we're calling a simple helper function (like malloc or js_free)
+    // that we can't change and/or that we know won't GC.
+    DontCheckOther,
+};
+
 // The public entrypoint for emitting assembly. Note that a MacroAssembler can
 // use cx->lifoAlloc, so take care not to interleave masm use with other
 // lifoAlloc use if one will be destroyed before the other.
@@ -565,8 +579,10 @@ class MacroAssembler : public MacroAssemblerSpecific
     inline void passABIArg(Register reg);
     inline void passABIArg(FloatRegister reg, MoveOp::Type type);
 
-    template <typename T>
-    inline void callWithABI(const T& fun, MoveOp::Type result = MoveOp::GENERAL);
+    inline void callWithABI(void* fun, MoveOp::Type result = MoveOp::GENERAL,
+                            CheckUnsafeCallWithABI check = CheckUnsafeCallWithABI::Check);
+    inline void callWithABI(Register fun, MoveOp::Type result = MoveOp::GENERAL);
+    inline void callWithABI(const Address& fun, MoveOp::Type result = MoveOp::GENERAL);
 
     void callWithABI(wasm::BytecodeOffset offset, wasm::SymbolicAddress fun,
                      MoveOp::Type result = MoveOp::GENERAL);
@@ -580,7 +596,7 @@ class MacroAssembler : public MacroAssemblerSpecific
     void callWithABIPre(uint32_t* stackAdjust, bool callFromWasm = false) PER_ARCH;
 
     // Emits a call to a C/C++ function, resolving all argument moves.
-    void callWithABINoProfiler(void* fun, MoveOp::Type result);
+    void callWithABINoProfiler(void* fun, MoveOp::Type result, CheckUnsafeCallWithABI check);
     void callWithABINoProfiler(Register fun, MoveOp::Type result) PER_ARCH;
     void callWithABINoProfiler(const Address& fun, MoveOp::Type result) PER_ARCH;
 
diff --git a/js/src/jit/SharedIC.cpp b/js/src/jit/SharedIC.cpp
index c38936d9a58f..a42065bd0303 100644
--- a/js/src/jit/SharedIC.cpp
+++ b/js/src/jit/SharedIC.cpp
@@ -1205,7 +1205,8 @@ ICBinaryArith_DoubleWithInt32::Compiler::generateStubCode(MacroAssembler& masm)
         masm.push(intReg);
         masm.setupUnalignedABICall(scratchReg);
         masm.passABIArg(FloatReg0, MoveOp::DOUBLE);
-        masm.callWithABI(mozilla::BitwiseCast<void*, int32_t(*)(double)>(JS::ToInt32));
+        masm.callWithABI(mozilla::BitwiseCast<void*, int32_t(*)(double)>(JS::ToInt32),
+                         MoveOp::GENERAL, CheckUnsafeCallWithABI::DontCheckOther);
         masm.storeCallWordResult(scratchReg);
         masm.pop(intReg);
 
@@ -1358,7 +1359,8 @@ ICUnaryArith_Double::Compiler::generateStubCode(MacroAssembler& masm)
         masm.bind(&truncateABICall);
         masm.setupUnalignedABICall(scratchReg);
         masm.passABIArg(FloatReg0, MoveOp::DOUBLE);
-        masm.callWithABI(BitwiseCast<void*, int32_t(*)(double)>(JS::ToInt32));
+        masm.callWithABI(BitwiseCast<void*, int32_t(*)(double)>(JS::ToInt32),
+                         MoveOp::GENERAL, CheckUnsafeCallWithABI::DontCheckOther);
         masm.storeCallWordResult(scratchReg);
 
         masm.bind(&doneTruncate);
diff --git a/js/src/jit/VMFunctions.cpp b/js/src/jit/VMFunctions.cpp
index ee607266f1c6..68938ce57a7e 100644
--- a/js/src/jit/VMFunctions.cpp
+++ b/js/src/jit/VMFunctions.cpp
@@ -544,6 +544,7 @@ InterruptCheck(JSContext* cx)
 void*
 MallocWrapper(JSRuntime* rt, size_t nbytes)
 {
+    AutoUnsafeCallWithABI unsafe;
     return rt->pod_malloc<uint8_t>(nbytes);
 }
 
@@ -649,6 +650,8 @@ GetDynamicName(JSContext* cx, JSObject* envChain, JSString* str, Value* vp)
     // undefined through rval. This function is infallible, and cannot GC or
     // invalidate.
 
+    AutoUnsafeCallWithABI unsafe;
+
     JSAtom* atom;
     if (str->isAtom()) {
         atom = &str->asAtom();
@@ -679,7 +682,7 @@ GetDynamicName(JSContext* cx, JSObject* envChain, JSString* str, Value* vp)
 void
 PostWriteBarrier(JSRuntime* rt, JSObject* obj)
 {
-    JS::AutoCheckCannotGC nogc;
+    AutoUnsafeCallWithABI unsafe;
     MOZ_ASSERT(!IsInsideNursery(obj));
     rt->gc.storeBuffer().putWholeCell(obj);
 }
@@ -690,7 +693,7 @@ template <IndexInBounds InBounds>
 void
 PostWriteElementBarrier(JSRuntime* rt, JSObject* obj, int32_t index)
 {
-    JS::AutoCheckCannotGC nogc;
+    AutoUnsafeCallWithABI unsafe;
 
     MOZ_ASSERT(!IsInsideNursery(obj));
 
@@ -744,7 +747,7 @@ int32_t
 GetIndexFromString(JSString* str)
 {
     // We shouldn't GC here as this is called directly from IC code.
-    JS::AutoCheckCannotGC nogc;
+    AutoUnsafeCallWithABI unsafe;
 
     if (!str->isFlat())
         return -1;
@@ -760,7 +763,7 @@ JSObject*
 WrapObjectPure(JSContext* cx, JSObject* obj)
 {
     // IC code calls this directly so we shouldn't GC.
-    JS::AutoCheckCannotGC nogc;
+    AutoUnsafeCallWithABI unsafe;
 
     MOZ_ASSERT(obj);
     MOZ_ASSERT(cx->compartment() != obj->compartment());
@@ -864,6 +867,7 @@ DebugEpilogue(JSContext* cx, BaselineFrame* frame, jsbytecode* pc, bool ok)
 void
 FrameIsDebuggeeCheck(BaselineFrame* frame)
 {
+    AutoUnsafeCallWithABI unsafe;
     if (frame->script()->isDebuggee())
         frame->setIsDebuggee();
 }
@@ -1140,6 +1144,7 @@ OnDebuggerStatement(JSContext* cx, BaselineFrame* frame, jsbytecode* pc, bool* m
 bool
 GlobalHasLiveOnDebuggerStatement(JSContext* cx)
 {
+    AutoUnsafeCallWithABI unsafe;
     return cx->compartment()->isDebuggee() &&
            Debugger::hasLiveHook(cx->global(), Debugger::OnDebuggerStatement);
 }
@@ -1232,6 +1237,7 @@ bool
 InitBaselineFrameForOsr(BaselineFrame* frame, InterpreterFrame* interpFrame,
                         uint32_t numStackValues)
 {
+    AutoUnsafeCallWithABI unsafe;
     return frame->initForOsr(interpFrame, numStackValues);
 }
 
@@ -1318,6 +1324,7 @@ AutoDetectInvalidation::setReturnOverride()
 void
 AssertValidObjectPtr(JSContext* cx, JSObject* obj)
 {
+    AutoUnsafeCallWithABI unsafe;
 #ifdef DEBUG
     // Check what we can, so that we'll hopefully assert/crash if we get a
     // bogus object (pointer).
@@ -1339,6 +1346,7 @@ AssertValidObjectPtr(JSContext* cx, JSObject* obj)
 void
 AssertValidObjectOrNullPtr(JSContext* cx, JSObject* obj)
 {
+    AutoUnsafeCallWithABI unsafe;
     if (obj)
         AssertValidObjectPtr(cx, obj);
 }
@@ -1346,6 +1354,7 @@ AssertValidObjectOrNullPtr(JSContext* cx, JSObject* obj)
 void
 AssertValidStringPtr(JSContext* cx, JSString* str)
 {
+    AutoUnsafeCallWithABI unsafe;
 #ifdef DEBUG
     // We can't closely inspect strings from another runtime.
     if (str->runtimeFromAnyThread() != cx->runtime()) {
@@ -1382,6 +1391,8 @@ AssertValidStringPtr(JSContext* cx, JSString* str)
 void
 AssertValidSymbolPtr(JSContext* cx, JS::Symbol* sym)
 {
+    AutoUnsafeCallWithABI unsafe;
+
     // We can't closely inspect symbols from another runtime.
     if (sym->runtimeFromAnyThread() != cx->runtime()) {
         MOZ_ASSERT(sym->isWellKnownSymbol());
@@ -1401,6 +1412,7 @@ AssertValidSymbolPtr(JSContext* cx, JS::Symbol* sym)
 void
 AssertValidValue(JSContext* cx, Value* v)
 {
+    AutoUnsafeCallWithABI unsafe;
     if (v->isObject())
         AssertValidObjectPtr(cx, &v->toObject());
     else if (v->isString())
@@ -1412,24 +1424,28 @@ AssertValidValue(JSContext* cx, Value* v)
 bool
 ObjectIsCallable(JSObject* obj)
 {
+    AutoUnsafeCallWithABI unsafe;
     return obj->isCallable();
 }
 
 bool
 ObjectIsConstructor(JSObject* obj)
 {
+    AutoUnsafeCallWithABI unsafe;
     return obj->isConstructor();
 }
 
 void
 MarkValueFromIon(JSRuntime* rt, Value* vp)
 {
+    AutoUnsafeCallWithABI unsafe;
     TraceManuallyBarrieredEdge(&rt->gc.marker, vp, "write barrier");
 }
 
 void
 MarkStringFromIon(JSRuntime* rt, JSString** stringp)
 {
+    AutoUnsafeCallWithABI unsafe;
     MOZ_ASSERT(*stringp);
     TraceManuallyBarrieredEdge(&rt->gc.marker, stringp, "write barrier");
 }
@@ -1437,6 +1453,7 @@ MarkStringFromIon(JSRuntime* rt, JSString** stringp)
 void
 MarkObjectFromIon(JSRuntime* rt, JSObject** objp)
 {
+    AutoUnsafeCallWithABI unsafe;
     MOZ_ASSERT(*objp);
     TraceManuallyBarrieredEdge(&rt->gc.marker, objp, "write barrier");
 }
@@ -1444,12 +1461,14 @@ MarkObjectFromIon(JSRuntime* rt, JSObject** objp)
 void
 MarkShapeFromIon(JSRuntime* rt, Shape** shapep)
 {
+    AutoUnsafeCallWithABI unsafe;
     TraceManuallyBarrieredEdge(&rt->gc.marker, shapep, "write barrier");
 }
 
 void
 MarkObjectGroupFromIon(JSRuntime* rt, ObjectGroup** groupp)
 {
+    AutoUnsafeCallWithABI unsafe;
     TraceManuallyBarrieredEdge(&rt->gc.marker, groupp, "write barrier");
 }
 
@@ -1551,7 +1570,7 @@ bool
 EqualStringsHelper(JSString* str1, JSString* str2)
 {
     // IC code calls this directly so we shouldn't GC.
-    JS::AutoCheckCannotGC nogc;
+    AutoUnsafeCallWithABI unsafe;
 
     MOZ_ASSERT(str1->isAtom());
     MOZ_ASSERT(!str2->isAtom());
@@ -1581,7 +1600,7 @@ GetNativeDataProperty(JSContext* cx, NativeObject* obj, jsid id, Value* vp)
     // lookup paths, this is optimized to be as fast as possible for simple
     // data property lookups.
 
-    JS::AutoCheckCannotGC nogc;
+    AutoUnsafeCallWithABI unsafe;
 
     MOZ_ASSERT(JSID_IS_ATOM(id) || JSID_IS_SYMBOL(id));
 
@@ -1633,7 +1652,7 @@ GetNativeDataProperty<false>(JSContext* cx, JSObject* obj, PropertyName* name, V
 static MOZ_ALWAYS_INLINE bool
 ValueToAtomOrSymbol(JSContext* cx, Value& idVal, jsid* id)
 {
-    JS::AutoCheckCannotGC nogc;
+    AutoUnsafeCallWithABI unsafe;
 
     if (MOZ_LIKELY(idVal.isString())) {
         JSString* s = idVal.toString();
@@ -1666,7 +1685,7 @@ template <bool HandleMissing>
 bool
 GetNativeDataPropertyByValue(JSContext* cx, JSObject* obj, Value* vp)
 {
-    JS::AutoCheckCannotGC nogc;
+    AutoUnsafeCallWithABI unsafe;
 
     // Condition checked by caller.
     MOZ_ASSERT(obj->isNative());
@@ -1691,7 +1710,7 @@ template <bool NeedsTypeBarrier>
 bool
 SetNativeDataProperty(JSContext* cx, JSObject* obj, PropertyName* name, Value* val)
 {
-    JS::AutoCheckCannotGC nogc;
+    AutoUnsafeCallWithABI unsafe;
 
     if (MOZ_UNLIKELY(!obj->isNative()))
         return false;
@@ -1723,7 +1742,7 @@ SetNativeDataProperty<false>(JSContext* cx, JSObject* obj, PropertyName* name, V
 bool
 ObjectHasGetterSetter(JSContext* cx, JSObject* objArg, Shape* propShape)
 {
-    JS::AutoCheckCannotGC nogc;
+    AutoUnsafeCallWithABI unsafe;
 
     MOZ_ASSERT(propShape->hasGetterObject() || propShape->hasSetterObject());
 
@@ -1766,7 +1785,7 @@ ObjectHasGetterSetter(JSContext* cx, JSObject* objArg, Shape* propShape)
 bool
 HasOwnNativeDataProperty(JSContext* cx, JSObject* obj, Value* vp)
 {
-    JS::AutoCheckCannotGC nogc;
+    AutoUnsafeCallWithABI unsafe;
 
     // vp[0] contains the id, result will be stored in vp[1].
     Value idVal = vp[0];
@@ -1803,6 +1822,7 @@ HasOwnNativeDataProperty(JSContext* cx, JSObject* obj, Value* vp)
 JSString*
 TypeOfObject(JSObject* obj, JSRuntime* rt)
 {
+    AutoUnsafeCallWithABI unsafe;
     JSType type = js::TypeOfObject(obj);
     return TypeName(type, *rt->commonNames);
 }
diff --git a/js/src/jit/arm/CodeGenerator-arm.cpp b/js/src/jit/arm/CodeGenerator-arm.cpp
index 9c1e4ddef26c..bda29ca0516b 100644
--- a/js/src/jit/arm/CodeGenerator-arm.cpp
+++ b/js/src/jit/arm/CodeGenerator-arm.cpp
@@ -630,7 +630,8 @@ CodeGeneratorARM::visitSoftDivI(LSoftDivI* ins)
         masm.setupAlignedABICall();
         masm.passABIArg(lhs);
         masm.passABIArg(rhs);
-        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, __aeabi_idivmod));
+        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, __aeabi_idivmod), MoveOp::GENERAL,
+                         CheckUnsafeCallWithABI::DontCheckOther);
     }
 
     // idivmod returns the quotient in r0, and the remainder in r1.
@@ -819,7 +820,8 @@ CodeGeneratorARM::visitSoftModI(LSoftModI* ins)
         masm.setupAlignedABICall();
         masm.passABIArg(lhs);
         masm.passABIArg(rhs);
-        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, __aeabi_idivmod));
+        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, __aeabi_idivmod), MoveOp::GENERAL,
+                         CheckUnsafeCallWithABI::DontCheckOther);
     }
 
     MOZ_ASSERT(r1 != output);
@@ -2841,7 +2843,8 @@ CodeGeneratorARM::visitSoftUDivOrMod(LSoftUDivOrMod* ins)
         masm.setupAlignedABICall();
         masm.passABIArg(lhs);
         masm.passABIArg(rhs);
-        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, __aeabi_uidivmod));
+        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, __aeabi_uidivmod), MoveOp::GENERAL,
+                         CheckUnsafeCallWithABI::DontCheckOther);
     }
 
     if (mod) {
diff --git a/js/src/jit/arm/MacroAssembler-arm.cpp b/js/src/jit/arm/MacroAssembler-arm.cpp
index 619f3848cead..de25e259b7d0 100644
--- a/js/src/jit/arm/MacroAssembler-arm.cpp
+++ b/js/src/jit/arm/MacroAssembler-arm.cpp
@@ -3598,7 +3598,7 @@ MacroAssemblerARMCompat::handleFailureWithHandlerTail(void* handler)
     // Call the handler.
     asMasm().setupUnalignedABICall(r1);
     asMasm().passABIArg(r0);
-    asMasm().callWithABI(handler);
+    asMasm().callWithABI(handler, MoveOp::GENERAL, CheckUnsafeCallWithABI::DontCheckHasExitFrame);
 
     Label entryFrame;
     Label catch_;
diff --git a/js/src/jit/arm/SharedIC-arm.cpp b/js/src/jit/arm/SharedIC-arm.cpp
index 081ce2490d6a..0c6ab8e06dce 100644
--- a/js/src/jit/arm/SharedIC-arm.cpp
+++ b/js/src/jit/arm/SharedIC-arm.cpp
@@ -94,7 +94,8 @@ ICBinaryArith_Int32::Compiler::generateStubCode(MacroAssembler& masm)
         masm.setupAlignedABICall();
         masm.passABIArg(R0.payloadReg());
         masm.passABIArg(R1.payloadReg());
-        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, __aeabi_idivmod));
+        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, __aeabi_idivmod), MoveOp::GENERAL,
+                         CheckUnsafeCallWithABI::DontCheckOther);
 
         // idivmod returns the quotient in r0, and the remainder in r1.
         if (op_ == JSOP_DIV) {
diff --git a/js/src/jit/arm/Trampoline-arm.cpp b/js/src/jit/arm/Trampoline-arm.cpp
index 2ef02d4a78b6..e04ea367e98f 100644
--- a/js/src/jit/arm/Trampoline-arm.cpp
+++ b/js/src/jit/arm/Trampoline-arm.cpp
@@ -882,7 +882,7 @@ JitRuntime::generateVMWrapper(JSContext* cx, const VMFunction& f)
     if (outReg != InvalidReg)
         masm.passABIArg(outReg);
 
-    masm.callWithABI(f.wrapped);
+    masm.callWithABI(f.wrapped, MoveOp::GENERAL, CheckUnsafeCallWithABI::DontCheckHasExitFrame);
 
     if (!generateTLExitVM(cx, masm, f))
         return nullptr;
diff --git a/js/src/jit/arm64/MacroAssembler-arm64.cpp b/js/src/jit/arm64/MacroAssembler-arm64.cpp
index d1c9a36d4a16..d7e15813e8cb 100644
--- a/js/src/jit/arm64/MacroAssembler-arm64.cpp
+++ b/js/src/jit/arm64/MacroAssembler-arm64.cpp
@@ -145,7 +145,7 @@ MacroAssemblerCompat::handleFailureWithHandlerTail(void* handler)
     // Call the handler.
     asMasm().setupUnalignedABICall(r1);
     asMasm().passABIArg(r0);
-    asMasm().callWithABI(handler);
+    asMasm().callWithABI(handler, MoveOp::GENERAL, CheckUnsafeCallWithABI::DontCheckHasExitFrame);
 
     Label entryFrame;
     Label catch_;
diff --git a/js/src/jit/arm64/Trampoline-arm64.cpp b/js/src/jit/arm64/Trampoline-arm64.cpp
index 4bd1bb036382..d616c66852d1 100644
--- a/js/src/jit/arm64/Trampoline-arm64.cpp
+++ b/js/src/jit/arm64/Trampoline-arm64.cpp
@@ -677,7 +677,7 @@ JitRuntime::generateVMWrapper(JSContext* cx, const VMFunction& f)
     if (outReg != InvalidReg)
         masm.passABIArg(outReg);
 
-    masm.callWithABI(f.wrapped);
+    masm.callWithABI(f.wrapped, MoveOp::GENERAL, CheckUnsafeCallWithABI::DontCheckHasExitFrame);
 
     if (!generateTLExitVM(cx, masm, f))
         return nullptr;
diff --git a/js/src/jit/mips32/MacroAssembler-mips32.cpp b/js/src/jit/mips32/MacroAssembler-mips32.cpp
index eeda1bcc1c74..1fd82b607895 100644
--- a/js/src/jit/mips32/MacroAssembler-mips32.cpp
+++ b/js/src/jit/mips32/MacroAssembler-mips32.cpp
@@ -1848,7 +1848,7 @@ MacroAssemblerMIPSCompat::handleFailureWithHandlerTail(void* handler)
     // Call the handler.
     asMasm().setupUnalignedABICall(a1);
     asMasm().passABIArg(a0);
-    asMasm().callWithABI(handler);
+    asMasm().callWithABI(handler, MoveOp::GENERAL, CheckUnsafeCallWithABI::DontCheckHasExitFrame);
 
     Label entryFrame;
     Label catch_;
diff --git a/js/src/jit/mips32/Trampoline-mips32.cpp b/js/src/jit/mips32/Trampoline-mips32.cpp
index dd8249e03751..cefc22de617b 100644
--- a/js/src/jit/mips32/Trampoline-mips32.cpp
+++ b/js/src/jit/mips32/Trampoline-mips32.cpp
@@ -847,7 +847,7 @@ JitRuntime::generateVMWrapper(JSContext* cx, const VMFunction& f)
                             MoveOp::GENERAL);
     }
 
-    masm.callWithABI(f.wrapped);
+    masm.callWithABI(f.wrapped, MoveOp::GENERAL, CheckUnsafeCallWithABI::DontCheckHasExitFrame);
 
     if (!generateTLExitVM(cx, masm, f))
         return nullptr;
diff --git a/js/src/jit/mips64/MacroAssembler-mips64.cpp b/js/src/jit/mips64/MacroAssembler-mips64.cpp
index d562cc0d92d0..5d0ecc68a6f3 100644
--- a/js/src/jit/mips64/MacroAssembler-mips64.cpp
+++ b/js/src/jit/mips64/MacroAssembler-mips64.cpp
@@ -2030,7 +2030,7 @@ MacroAssemblerMIPS64Compat::handleFailureWithHandlerTail(void* handler)
     // Call the handler.
     asMasm().setupUnalignedABICall(a1);
     asMasm().passABIArg(a0);
-    asMasm().callWithABI(handler);
+    asMasm().callWithABI(handler, MoveOp::GENERAL, CheckUnsafeCallWithABI::DontCheckHasExitFrame);
 
     Label entryFrame;
     Label catch_;
diff --git a/js/src/jit/mips64/Trampoline-mips64.cpp b/js/src/jit/mips64/Trampoline-mips64.cpp
index 6157870c701b..f72b3744b611 100644
--- a/js/src/jit/mips64/Trampoline-mips64.cpp
+++ b/js/src/jit/mips64/Trampoline-mips64.cpp
@@ -793,7 +793,7 @@ JitRuntime::generateVMWrapper(JSContext* cx, const VMFunction& f)
     if (InvalidReg != outReg)
         masm.passABIArg(outReg);
 
-    masm.callWithABI(f.wrapped);
+    masm.callWithABI(f.wrapped, MoveOp::GENERAL, CheckUnsafeCallWithABI::DontCheckHasExitFrame);
 
     if (!generateTLExitVM(cx, masm, f))
         return nullptr;
diff --git a/js/src/jit/x64/MacroAssembler-x64.cpp b/js/src/jit/x64/MacroAssembler-x64.cpp
index db8099cff3d2..2358d4a76096 100644
--- a/js/src/jit/x64/MacroAssembler-x64.cpp
+++ b/js/src/jit/x64/MacroAssembler-x64.cpp
@@ -307,7 +307,7 @@ MacroAssemblerX64::handleFailureWithHandlerTail(void* handler)
     // Call the handler.
     asMasm().setupUnalignedABICall(rcx);
     asMasm().passABIArg(rax);
-    asMasm().callWithABI(handler);
+    asMasm().callWithABI(handler, MoveOp::GENERAL, CheckUnsafeCallWithABI::DontCheckHasExitFrame);
 
     Label entryFrame;
     Label catch_;
diff --git a/js/src/jit/x64/Trampoline-x64.cpp b/js/src/jit/x64/Trampoline-x64.cpp
index 54c23c6d6939..40570dde4a5b 100644
--- a/js/src/jit/x64/Trampoline-x64.cpp
+++ b/js/src/jit/x64/Trampoline-x64.cpp
@@ -765,7 +765,7 @@ JitRuntime::generateVMWrapper(JSContext* cx, const VMFunction& f)
     if (outReg != InvalidReg)
         masm.passABIArg(outReg);
 
-    masm.callWithABI(f.wrapped);
+    masm.callWithABI(f.wrapped, MoveOp::GENERAL, CheckUnsafeCallWithABI::DontCheckHasExitFrame);
 
     if (!generateTLExitVM(cx, masm, f))
         return nullptr;
diff --git a/js/src/jit/x86/CodeGenerator-x86.cpp b/js/src/jit/x86/CodeGenerator-x86.cpp
index 1131ec649d66..e2f80c4ac8fc 100644
--- a/js/src/jit/x86/CodeGenerator-x86.cpp
+++ b/js/src/jit/x86/CodeGenerator-x86.cpp
@@ -744,7 +744,8 @@ CodeGeneratorX86::visitOutOfLineTruncate(OutOfLineTruncate* ool)
         } else {
             masm.setupUnalignedABICall(output);
             masm.passABIArg(input, MoveOp::DOUBLE);
-            masm.callWithABI(BitwiseCast<void*, int32_t(*)(double)>(JS::ToInt32));
+            masm.callWithABI(BitwiseCast<void*, int32_t(*)(double)>(JS::ToInt32), MoveOp::GENERAL,
+                             CheckUnsafeCallWithABI::DontCheckOther);
         }
         masm.storeCallWordResult(output);
 
@@ -831,10 +832,12 @@ CodeGeneratorX86::visitOutOfLineTruncateFloat32(OutOfLineTruncateFloat32* ool)
         masm.vcvtss2sd(input, input, input);
         masm.passABIArg(input.asDouble(), MoveOp::DOUBLE);
 
-        if (gen->compilingWasm())
+        if (gen->compilingWasm()) {
             masm.callWithABI(ins->mir()->bytecodeOffset(), wasm::SymbolicAddress::ToInt32);
-        else
-            masm.callWithABI(BitwiseCast<void*, int32_t(*)(double)>(JS::ToInt32));
+        } else {
+            masm.callWithABI(BitwiseCast<void*, int32_t(*)(double)>(JS::ToInt32), MoveOp::GENERAL,
+                             CheckUnsafeCallWithABI::DontCheckOther);
+        }
 
         masm.storeCallWordResult(output);
         masm.Pop(input);
diff --git a/js/src/jit/x86/MacroAssembler-x86.cpp b/js/src/jit/x86/MacroAssembler-x86.cpp
index fa5db7ef9571..96acddc570b4 100644
--- a/js/src/jit/x86/MacroAssembler-x86.cpp
+++ b/js/src/jit/x86/MacroAssembler-x86.cpp
@@ -206,7 +206,7 @@ MacroAssemblerX86::handleFailureWithHandlerTail(void* handler)
     // Call the handler.
     asMasm().setupUnalignedABICall(ecx);
     asMasm().passABIArg(eax);
-    asMasm().callWithABI(handler);
+    asMasm().callWithABI(handler, MoveOp::GENERAL, CheckUnsafeCallWithABI::DontCheckHasExitFrame);
 
     Label entryFrame;
     Label catch_;
diff --git a/js/src/jit/x86/Trampoline-x86.cpp b/js/src/jit/x86/Trampoline-x86.cpp
index 7b7f3a5a9607..df112251bc3e 100644
--- a/js/src/jit/x86/Trampoline-x86.cpp
+++ b/js/src/jit/x86/Trampoline-x86.cpp
@@ -795,7 +795,7 @@ JitRuntime::generateVMWrapper(JSContext* cx, const VMFunction& f)
     if (outReg != InvalidReg)
         masm.passABIArg(outReg);
 
-    masm.callWithABI(f.wrapped);
+    masm.callWithABI(f.wrapped, MoveOp::GENERAL, CheckUnsafeCallWithABI::DontCheckHasExitFrame);
 
     if (!generateTLExitVM(cx, masm, f))
         return nullptr;
diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp
index 10888882d92b..5f0461a2e36f 100644
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -2424,6 +2424,7 @@ DefineBoxedOrUnboxedFunctor1(ShiftMoveBoxedOrUnboxedDenseElements, JSObject*);
 void
 js::ArrayShiftMoveElements(JSObject* obj)
 {
+    AutoUnsafeCallWithABI unsafe;
     MOZ_ASSERT_IF(obj->is<ArrayObject>(), obj->as<ArrayObject>().lengthIsWritable());
 
     ShiftMoveBoxedOrUnboxedDenseElementsFunctor functor(obj);
diff --git a/js/src/jsboolinlines.h b/js/src/jsboolinlines.h
index 97428eee6e67..e6e76a067fd4 100644
--- a/js/src/jsboolinlines.h
+++ b/js/src/jsboolinlines.h
@@ -9,6 +9,8 @@
 
 #include "jsbool.h"
 
+#include "jscntxt.h"
+
 #include "vm/BooleanObject.h"
 #include "vm/WrapperObject.h"
 
@@ -19,6 +21,7 @@ EmulatesUndefined(JSObject* obj)
 {
     // This may be called off the main thread. It's OK not to expose the object
     // here as it doesn't escape.
+    AutoUnsafeCallWithABI unsafe;
     JSObject* actual = MOZ_LIKELY(!obj->is<WrapperObject>()) ? obj : UncheckedUnwrapWithoutExpose(obj);
     return actual->getClass()->emulatesUndefined();
 }
diff --git a/js/src/jscntxt.cpp b/js/src/jscntxt.cpp
index 8f7ad644961e..926182460fde 100644
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@@ -1293,6 +1293,8 @@ JSContext::JSContext(JSRuntime* runtime, const JS::ContextOptions& options)
     requestDepth(0),
 #ifdef DEBUG
     checkRequestDepth(0),
+    inUnsafeCallWithABI(false),
+    hasAutoUnsafeCallWithABI(false),
 #endif
 #ifdef JS_SIMULATOR
     simulator_(nullptr),
@@ -1668,3 +1670,22 @@ AutoEnterOOMUnsafeRegion::crash(size_t size, const char* reason)
     }
     crash(reason);
 }
+
+#ifdef DEBUG
+AutoUnsafeCallWithABI::AutoUnsafeCallWithABI()
+  : cx_(TlsContext.get()),
+    nested_(cx_->hasAutoUnsafeCallWithABI),
+    nogc(cx_)
+{
+    cx_->hasAutoUnsafeCallWithABI = true;
+}
+
+AutoUnsafeCallWithABI::~AutoUnsafeCallWithABI()
+{
+    MOZ_ASSERT(cx_->hasAutoUnsafeCallWithABI);
+    if (!nested_) {
+        cx_->hasAutoUnsafeCallWithABI = false;
+        cx_->inUnsafeCallWithABI = false;
+    }
+}
+#endif
diff --git a/js/src/jscntxt.h b/js/src/jscntxt.h
index 96bf9d30d152..baaf07d82975 100644
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -379,6 +379,12 @@ struct JSContext : public JS::RootingContext,
         return offsetof(JSContext, profilingActivation_);
      }
 
+#ifdef DEBUG
+    static size_t offsetOfInUnsafeCallWithABI() {
+        return offsetof(JSContext, inUnsafeCallWithABI);
+    }
+#endif
+
   private:
     /* Space for interpreter frames. */
     js::ThreadLocalData<js::InterpreterStack> interpreterStack_;
@@ -419,6 +425,8 @@ struct JSContext : public JS::RootingContext,
 
 #ifdef DEBUG
     js::ThreadLocalData<unsigned> checkRequestDepth;
+    js::ThreadLocalData<uint32_t> inUnsafeCallWithABI;
+    js::ThreadLocalData<bool> hasAutoUnsafeCallWithABI;
 #endif
 
 #ifdef JS_SIMULATOR
@@ -1286,6 +1294,23 @@ class MOZ_RAII AutoEnterIonCompilation
     MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
 };
 
+// Should be used in functions called directly from JIT code (with
+// masm.callWithABI) to assert invariants in debug builds.
+class MOZ_RAII AutoUnsafeCallWithABI
+{
+#ifdef DEBUG
+    JSContext* cx_;
+    bool nested_;
+#endif
+    JS::AutoCheckCannotGC nogc;
+
+  public:
+#ifdef DEBUG
+    AutoUnsafeCallWithABI();
+    ~AutoUnsafeCallWithABI();
+#endif
+};
+
 namespace gc {
 
 // In debug builds, set/unset the performing GC flag for the current thread.
diff --git a/js/src/jslibmath.h b/js/src/jslibmath.h
index 52d21797d00f..b2907ee2e92a 100644
--- a/js/src/jslibmath.h
+++ b/js/src/jslibmath.h
@@ -11,6 +11,7 @@
 
 #include <math.h>
 
+#include "jscntxt.h"
 #include "jsnum.h"
 
 /*
@@ -48,6 +49,7 @@ namespace js {
 inline double
 NumberDiv(double a, double b)
 {
+    AutoUnsafeCallWithABI unsafe;
     if (b == 0) {
         if (a == 0 || mozilla::IsNaN(a)
 #ifdef XP_WIN
@@ -65,7 +67,9 @@ NumberDiv(double a, double b)
 }
 
 inline double
-NumberMod(double a, double b) {
+NumberMod(double a, double b)
+{
+    AutoUnsafeCallWithABI unsafe;
     if (b == 0)
         return JS::GenericNaN();
     return js_fmod(a, b);
diff --git a/js/src/jsmath.cpp b/js/src/jsmath.cpp
index 8a14d04d2186..221b441f2490 100644
--- a/js/src/jsmath.cpp
+++ b/js/src/jsmath.cpp
@@ -183,12 +183,14 @@ js::math_abs(JSContext* cx, unsigned argc, Value* vp)
 double
 js::math_acos_impl(MathCache* cache, double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return cache->lookup(fdlibm::acos, x, MathCache::Acos);
 }
 
 double
 js::math_acos_uncached(double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return fdlibm::acos(x);
 }
 
@@ -218,12 +220,14 @@ js::math_acos(JSContext* cx, unsigned argc, Value* vp)
 double
 js::math_asin_impl(MathCache* cache, double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return cache->lookup(fdlibm::asin, x, MathCache::Asin);
 }
 
 double
 js::math_asin_uncached(double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return fdlibm::asin(x);
 }
 
@@ -253,12 +257,14 @@ js::math_asin(JSContext* cx, unsigned argc, Value* vp)
 double
 js::math_atan_impl(MathCache* cache, double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return cache->lookup(fdlibm::atan, x, MathCache::Atan);
 }
 
 double
 js::math_atan_uncached(double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return fdlibm::atan(x);
 }
 
@@ -288,6 +294,7 @@ js::math_atan(JSContext* cx, unsigned argc, Value* vp)
 double
 js::ecmaAtan2(double y, double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return fdlibm::atan2(y, x);
 }
 
@@ -318,6 +325,7 @@ js::math_atan2(JSContext* cx, unsigned argc, Value* vp)
 double
 js::math_ceil_impl(double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return fdlibm::ceil(x);
 }
 
@@ -372,12 +380,14 @@ js::math_clz32(JSContext* cx, unsigned argc, Value* vp)
 double
 js::math_cos_impl(MathCache* cache, double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return cache->lookup(cos, x, MathCache::Cos);
 }
 
 double
 js::math_cos_uncached(double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return cos(x);
 }
 
@@ -407,12 +417,14 @@ js::math_cos(JSContext* cx, unsigned argc, Value* vp)
 double
 js::math_exp_impl(MathCache* cache, double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return cache->lookup(fdlibm::exp, x, MathCache::Exp);
 }
 
 double
 js::math_exp_uncached(double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return fdlibm::exp(x);
 }
 
@@ -442,6 +454,7 @@ js::math_exp(JSContext* cx, unsigned argc, Value* vp)
 double
 js::math_floor_impl(double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return fdlibm::floor(x);
 }
 
@@ -532,12 +545,14 @@ js::math_fround(JSContext* cx, unsigned argc, Value* vp)
 double
 js::math_log_impl(MathCache* cache, double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return cache->lookup(math_log_uncached, x, MathCache::Log);
 }
 
 double
 js::math_log_uncached(double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return fdlibm::log(x);
 }
 
@@ -573,6 +588,8 @@ js::math_log(JSContext* cx, unsigned argc, Value* vp)
 double
 js::math_max_impl(double x, double y)
 {
+    AutoUnsafeCallWithABI unsafe;
+
     // Math.max(num, NaN) => NaN, Math.max(-0, +0) => +0
     if (x > y || IsNaN(x) || (x == y && IsNegative(y)))
         return x;
@@ -598,6 +615,8 @@ js::math_max(JSContext* cx, unsigned argc, Value* vp)
 double
 js::math_min_impl(double x, double y)
 {
+    AutoUnsafeCallWithABI unsafe;
+
     // Math.min(num, NaN) => NaN, Math.min(-0, +0) => -0
     if (x < y || IsNaN(x) || (x == y && IsNegativeZero(x)))
         return x;
@@ -641,6 +660,7 @@ js::minmax_impl(JSContext* cx, bool max, HandleValue a, HandleValue b, MutableHa
 double
 js::powi(double x, int y)
 {
+    AutoUnsafeCallWithABI unsafe;
     unsigned n = (y < 0) ? -y : y;
     double m = x;
     double p = 1;
@@ -669,6 +689,8 @@ js::powi(double x, int y)
 double
 js::ecmaPow(double x, double y)
 {
+    AutoUnsafeCallWithABI unsafe;
+
     /*
      * Use powi if the exponent is an integer-valued double. We don't have to
      * check for NaN since a comparison with NaN is always false.
@@ -825,6 +847,8 @@ template float js::GetBiggestNumberLessThan<>(float x);
 double
 js::math_round_impl(double x)
 {
+    AutoUnsafeCallWithABI unsafe;
+
     int32_t ignored;
     if (NumberIsInt32(x, &ignored))
         return x;
@@ -840,6 +864,8 @@ js::math_round_impl(double x)
 float
 js::math_roundf_impl(float x)
 {
+    AutoUnsafeCallWithABI unsafe;
+
     int32_t ignored;
     if (NumberIsInt32(x, &ignored))
         return x;
@@ -868,12 +894,14 @@ js::math_round(JSContext* cx, unsigned argc, Value* vp)
 double
 js::math_sin_impl(MathCache* cache, double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return cache->lookup(math_sin_uncached, x, MathCache::Sin);
 }
 
 double
 js::math_sin_uncached(double x)
 {
+    AutoUnsafeCallWithABI unsafe;
 #ifdef _WIN64
     // Workaround MSVC bug where sin(-0) is +0 instead of -0 on x64 on
     // CPUs without FMA3 (pre-Haswell). See bug 1076670.
@@ -915,6 +943,7 @@ js::math_sin(JSContext* cx, unsigned argc, Value* vp)
 void
 js::math_sincos_uncached(double x, double *sin, double *cos)
 {
+    AutoUnsafeCallWithABI unsafe;
 #if defined(HAVE_SINCOS)
     sincos(x, sin, cos);
 #elif defined(HAVE___SINCOS)
@@ -928,6 +957,7 @@ js::math_sincos_uncached(double x, double *sin, double *cos)
 void
 js::math_sincos_impl(MathCache* mathCache, double x, double *sin, double *cos)
 {
+    AutoUnsafeCallWithABI unsafe;
     unsigned indexSin;
     unsigned indexCos;
     bool hasSin = mathCache->isCached(x, MathCache::Sin, sin, &indexSin);
@@ -978,12 +1008,14 @@ js::math_sqrt(JSContext* cx, unsigned argc, Value* vp)
 double
 js::math_tan_impl(MathCache* cache, double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return cache->lookup(tan, x, MathCache::Tan);
 }
 
 double
 js::math_tan_uncached(double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return tan(x);
 }
 
@@ -1037,12 +1069,14 @@ static bool math_function(JSContext* cx, unsigned argc, Value* vp)
 double
 js::math_log10_impl(MathCache* cache, double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return cache->lookup(fdlibm::log10, x, MathCache::Log10);
 }
 
 double
 js::math_log10_uncached(double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return fdlibm::log10(x);
 }
 
@@ -1055,12 +1089,14 @@ js::math_log10(JSContext* cx, unsigned argc, Value* vp)
 double
 js::math_log2_impl(MathCache* cache, double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return cache->lookup(fdlibm::log2, x, MathCache::Log2);
 }
 
 double
 js::math_log2_uncached(double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return fdlibm::log2(x);
 }
 
@@ -1073,12 +1109,14 @@ js::math_log2(JSContext* cx, unsigned argc, Value* vp)
 double
 js::math_log1p_impl(MathCache* cache, double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return cache->lookup(fdlibm::log1p, x, MathCache::Log1p);
 }
 
 double
 js::math_log1p_uncached(double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return fdlibm::log1p(x);
 }
 
@@ -1091,12 +1129,14 @@ js::math_log1p(JSContext* cx, unsigned argc, Value* vp)
 double
 js::math_expm1_impl(MathCache* cache, double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return cache->lookup(fdlibm::expm1, x, MathCache::Expm1);
 }
 
 double
 js::math_expm1_uncached(double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return fdlibm::expm1(x);
 }
 
@@ -1109,12 +1149,14 @@ js::math_expm1(JSContext* cx, unsigned argc, Value* vp)
 double
 js::math_cosh_impl(MathCache* cache, double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return cache->lookup(fdlibm::cosh, x, MathCache::Cosh);
 }
 
 double
 js::math_cosh_uncached(double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return fdlibm::cosh(x);
 }
 
@@ -1127,12 +1169,14 @@ js::math_cosh(JSContext* cx, unsigned argc, Value* vp)
 double
 js::math_sinh_impl(MathCache* cache, double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return cache->lookup(fdlibm::sinh, x, MathCache::Sinh);
 }
 
 double
 js::math_sinh_uncached(double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return fdlibm::sinh(x);
 }
 
@@ -1145,12 +1189,14 @@ js::math_sinh(JSContext* cx, unsigned argc, Value* vp)
 double
 js::math_tanh_impl(MathCache* cache, double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return cache->lookup(fdlibm::tanh, x, MathCache::Tanh);
 }
 
 double
 js::math_tanh_uncached(double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return fdlibm::tanh(x);
 }
 
@@ -1163,12 +1209,14 @@ js::math_tanh(JSContext* cx, unsigned argc, Value* vp)
 double
 js::math_acosh_impl(MathCache* cache, double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return cache->lookup(fdlibm::acosh, x, MathCache::Acosh);
 }
 
 double
 js::math_acosh_uncached(double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return fdlibm::acosh(x);
 }
 
@@ -1181,12 +1229,14 @@ js::math_acosh(JSContext* cx, unsigned argc, Value* vp)
 double
 js::math_asinh_impl(MathCache* cache, double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return cache->lookup(fdlibm::asinh, x, MathCache::Asinh);
 }
 
 double
 js::math_asinh_uncached(double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return fdlibm::asinh(x);
 }
 
@@ -1199,12 +1249,14 @@ js::math_asinh(JSContext* cx, unsigned argc, Value* vp)
 double
 js::math_atanh_impl(MathCache* cache, double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return cache->lookup(fdlibm::atanh, x, MathCache::Atanh);
 }
 
 double
 js::math_atanh_uncached(double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return fdlibm::atanh(x);
 }
 
@@ -1218,6 +1270,7 @@ js::math_atanh(JSContext* cx, unsigned argc, Value* vp)
 double
 js::ecmaHypot(double x, double y)
 {
+    AutoUnsafeCallWithABI unsafe;
     return fdlibm::hypot(x, y);
 }
 
@@ -1237,6 +1290,8 @@ hypot_step(double& scale, double& sumsq, double x)
 double
 js::hypot4(double x, double y, double z, double w)
 {
+    AutoUnsafeCallWithABI unsafe;
+
     /* Check for infinity or NaNs so that we can return immediatelly.
      * Does not need to be WIN_XP specific as ecmaHypot
      */
@@ -1262,6 +1317,7 @@ js::hypot4(double x, double y, double z, double w)
 double
 js::hypot3(double x, double y, double z)
 {
+    AutoUnsafeCallWithABI unsafe;
     return hypot4(x, y, z, 0.0);
 }
 
@@ -1318,12 +1374,14 @@ js::math_hypot_handle(JSContext* cx, HandleValueArray args, MutableHandleValue r
 double
 js::math_trunc_impl(MathCache* cache, double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return cache->lookup(fdlibm::trunc, x, MathCache::Trunc);
 }
 
 double
 js::math_trunc_uncached(double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return fdlibm::trunc(x);
 }
 
@@ -1344,12 +1402,14 @@ static double sign(double x)
 double
 js::math_sign_impl(MathCache* cache, double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return cache->lookup(sign, x, MathCache::Sign);
 }
 
 double
 js::math_sign_uncached(double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return sign(x);
 }
 
@@ -1362,12 +1422,14 @@ js::math_sign(JSContext* cx, unsigned argc, Value* vp)
 double
 js::math_cbrt_impl(MathCache* cache, double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return cache->lookup(fdlibm::cbrt, x, MathCache::Cbrt);
 }
 
 double
 js::math_cbrt_uncached(double x)
 {
+    AutoUnsafeCallWithABI unsafe;
     return fdlibm::cbrt(x);
 }
 
diff --git a/js/src/vm/ArgumentsObject.cpp b/js/src/vm/ArgumentsObject.cpp
index 70c7e2f32d1e..7349624d316a 100644
--- a/js/src/vm/ArgumentsObject.cpp
+++ b/js/src/vm/ArgumentsObject.cpp
@@ -371,7 +371,7 @@ ArgumentsObject::finishForIon(JSContext* cx, jit::JitFrameLayout* frame,
 {
     // JIT code calls this directly (no callVM), because it's faster, so we're
     // not allowed to GC in here.
-    JS::AutoCheckCannotGC nogc;
+    AutoUnsafeCallWithABI unsafe;
 
     JSFunction* callee = jit::CalleeTokenToFunction(frame->calleeToken());
     RootedObject callObj(cx, scopeChain->is<CallObject>() ? scopeChain : nullptr);
diff --git a/js/src/vm/NativeObject.cpp b/js/src/vm/NativeObject.cpp
index 867f69759ba7..4f62e0bb5662 100644
--- a/js/src/vm/NativeObject.cpp
+++ b/js/src/vm/NativeObject.cpp
@@ -406,7 +406,7 @@ NativeObject::growSlots(JSContext* cx, uint32_t oldCount, uint32_t newCount)
 NativeObject::growSlotsDontReportOOM(JSContext* cx, NativeObject* obj, uint32_t newCount)
 {
     // IC code calls this directly.
-    AutoCheckCannotGC nogc;
+    AutoUnsafeCallWithABI unsafe;
 
     if (!obj->growSlots(cx, obj->numDynamicSlots(), newCount)) {
         cx->recoverFromOutOfMemory();
@@ -419,7 +419,7 @@ NativeObject::growSlotsDontReportOOM(JSContext* cx, NativeObject* obj, uint32_t
 NativeObject::addDenseElementDontReportOOM(JSContext* cx, NativeObject* obj)
 {
     // IC code calls this directly.
-    AutoCheckCannotGC nogc;
+    AutoUnsafeCallWithABI unsafe;
 
     MOZ_ASSERT(obj->getDenseInitializedLength() == obj->getDenseCapacity());
     MOZ_ASSERT(!obj->denseElementsAreCopyOnWrite());

From ed23427f8d3fffef8faa97ca9c475b9edfc556a4 Mon Sep 17 00:00:00 2001
From: Gabor Krizsanits <gkrizsanits@mozilla.com>
Date: Tue, 19 Sep 2017 12:56:42 +0200
Subject: [PATCH 18/83] Bug 1336389 - Talos test for content process startup
 time. r=mconley

---
 testing/moz.build                             |   3 +
 testing/talos/talos.json                      |   4 +-
 testing/talos/talos/test.py                   |  22 +++
 .../talos/talos/tests/cpstartup/bootstrap.js  | 144 ++++++++++++++++++
 .../talos/tests/cpstartup/chrome.manifest     |   1 +
 .../tests/cpstartup/content/cpstartup.html    |  31 ++++
 .../talos/tests/cpstartup/content/target.html |   9 ++
 .../tests/cpstartup/cpstartup-signed.xpi      | Bin 0 -> 3792 bytes
 .../talos/tests/cpstartup/cpstartup.manifest  |   1 +
 .../talos/talos/tests/cpstartup/install.rdf   |  24 +++
 toolkit/content/browser-child.js              |   2 +
 11 files changed, 239 insertions(+), 2 deletions(-)
 create mode 100644 testing/talos/talos/tests/cpstartup/bootstrap.js
 create mode 100644 testing/talos/talos/tests/cpstartup/chrome.manifest
 create mode 100644 testing/talos/talos/tests/cpstartup/content/cpstartup.html
 create mode 100644 testing/talos/talos/tests/cpstartup/content/target.html
 create mode 100644 testing/talos/talos/tests/cpstartup/cpstartup-signed.xpi
 create mode 100644 testing/talos/talos/tests/cpstartup/cpstartup.manifest
 create mode 100644 testing/talos/talos/tests/cpstartup/install.rdf

diff --git a/testing/moz.build b/testing/moz.build
index eac4fbf702bb..1511d530aeb9 100644
--- a/testing/moz.build
+++ b/testing/moz.build
@@ -46,6 +46,9 @@ with Files("talos/talos/tests/scroll/**"):
 with Files("talos/talos/tests/tabpaint/**"):
     BUG_COMPONENT = ("Firefox", "Tabbed Browser")
 
+with Files("talos/talos/tests/cpstartup/**"):
+    BUG_COMPONENT = ("Firefox", "Tabbed Browser")
+
 with Files("talos/talos/tests/tart/**"):
     BUG_COMPONENT = ("Firefox", "Tabbed Browser")
 
diff --git a/testing/talos/talos.json b/testing/talos/talos.json
index dea00b8c2d7d..b86c2f029587 100644
--- a/testing/talos/talos.json
+++ b/testing/talos/talos.json
@@ -15,11 +15,11 @@
             "tests": ["dromaeo_css", "kraken"]
         },
         "other-e10s": {
-            "tests": ["a11yr", "ts_paint", "tpaint", "sessionrestore", "sessionrestore_many_windows", "sessionrestore_no_auto_restore", "tabpaint"]
+            "tests": ["a11yr", "ts_paint", "tpaint", "sessionrestore", "sessionrestore_many_windows", "sessionrestore_no_auto_restore", "tabpaint", "cpstartup"]
         },
         "other-stylo-disabled-e10s": {
             "talos_options": ["--disable-stylo"],
-            "tests": ["a11yr", "ts_paint", "tpaint", "sessionrestore", "sessionrestore_many_windows", "sessionrestore_no_auto_restore", "tabpaint"]
+            "tests": ["a11yr", "ts_paint", "tpaint", "sessionrestore", "sessionrestore_many_windows", "sessionrestore_no_auto_restore", "tabpaint", "cpstartup"]
         },
         "g1-e10s": {
             "tests": ["tp5o_scroll", "glterrain"],
diff --git a/testing/talos/talos/test.py b/testing/talos/talos/test.py
index 5cd3eb4b5a5e..78f01d4c3182 100644
--- a/testing/talos/talos/test.py
+++ b/testing/talos/talos/test.py
@@ -304,6 +304,28 @@ class tabpaint(PageloaderTest):
     }
 
 
+@register_test()
+class cpstartup(PageloaderTest):
+    """
+
+    """
+    extensions = '${talos}/tests/cpstartup/cpstartup-signed.xpi'
+    tpmanifest = '${talos}/tests/cpstartup/cpstartup.manifest'
+    tppagecycles = 20
+    gecko_profile_entries = 1000000
+    tploadnocache = True
+    unit = 'ms'
+    preferences = {
+        # By default, Talos is configured to open links from
+        # content in new windows. We're overriding them so that
+        # they open in new tabs instead.
+        # See http://kb.mozillazine.org/Browser.link.open_newwindow
+        # and http://kb.mozillazine.org/Browser.link.open_newwindow.restriction
+        'browser.link.open_newwindow': 3,
+        'browser.link.open_newwindow.restriction': 2,
+    }
+
+
 @register_test()
 class tps(PageloaderTest):
     """
diff --git a/testing/talos/talos/tests/cpstartup/bootstrap.js b/testing/talos/talos/tests/cpstartup/bootstrap.js
new file mode 100644
index 000000000000..7edbb7521ee6
--- /dev/null
+++ b/testing/talos/talos/tests/cpstartup/bootstrap.js
@@ -0,0 +1,144 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+var { classes: Cc, interfaces: Ci, utils: Cu } = Components;
+
+Cu.import("resource://gre/modules/Services.jsm");
+
+const PREALLOCATED_PREF = "dom.ipc.processPrelaunch.enabled";
+
+const TARGET_URI = "chrome://cpstartup/content/target.html";
+
+/**
+ * The purpose of this test it to measure the performance of a content process startup.
+ *
+ * In practice it measures a bit more than the content process startup. First the parent
+ * process starts the clock and requests a new tab with a simple page and then the child
+ * stops the clock in the frame script that will be able to process the URL to handle.
+ * So it does measure a few things pre process creation (browser element and tab creation
+ * on parent side) but does not measure the part where we actually parse and render the
+ * page on the content side, just the overhead of spawning a new content process.
+ */
+var CPStartup = {
+  MESSAGES: [
+    "CPStartup:Go",
+    "Content:BrowserChildReady",
+  ],
+
+  readyCallback: null,
+
+  startStamp: null,
+
+  tab: null,
+  /**
+   * Shortcut to getting at the TalosParentProfiler.
+   */
+  get Profiler() {
+    delete this.Profiler;
+    let context = {};
+    Services.scriptloader.loadSubScript("chrome://talos-powers-content/content/TalosParentProfiler.js", context);
+    return this.Profiler = context.TalosParentProfiler;
+  },
+
+  init() {
+    for (let msgName of this.MESSAGES) {
+      Services.mm.addMessageListener(msgName, this);
+    }
+
+    this.originalPreallocatedEnabled = Services.prefs.getBoolPref(PREALLOCATED_PREF);
+    Services.prefs.setBoolPref(PREALLOCATED_PREF, false);
+  },
+
+  uninit() {
+    for (let msgName of this.MESSAGES) {
+      Services.mm.removeMessageListener(msgName, this);
+    }
+
+    Services.prefs.setBoolPref(PREALLOCATED_PREF, this.originalPreallocatedEnabled);
+  },
+
+  receiveMessage(msg) {
+    let browser = msg.target;
+    let gBrowser = browser.ownerGlobal.gBrowser;
+
+    switch (msg.name) {
+      case "CPStartup:Go": {
+        this.openTab(gBrowser).then(results =>
+          this.reportResults(results));
+        break;
+      }
+
+      case "Content:BrowserChildReady": {
+        // Content has reported that it's ready to process an URL.
+        if (!this.readyCallback) {
+          throw new Error("Content:BrowserChildReady fired without a readyCallback set");
+        }
+        let tab = gBrowser.getTabForBrowser(browser);
+        if (tab != this.tab) {
+          // Let's ignore the message if it's not from the tab we've just opened.
+          break;
+        }
+        // The child stopped the timer when it was ready to process the first URL, it's time to
+        // calculate the difference and report it.
+        let delta = msg.data.time - this.startStamp;
+        this.readyCallback({tab, delta});
+        break;
+      }
+    }
+  },
+
+  openTab(gBrowser) {
+    return new Promise((resolve) => {
+      // Start the timer and the profiler right before the tab open on the parent side.
+      this.Profiler.resume("tab opening starts");
+      this.startStamp = Services.telemetry.msSystemNow();
+      this.tab = gBrowser.selectedTab = gBrowser.addTab(TARGET_URI, {
+        triggeringPrincipal: Services.scriptSecurityManager.getSystemPrincipal(),
+      });
+
+      this.whenTabReady().then(({tab, delta}) => {
+        this.Profiler.pause("tab opening end");
+        this.removeTab(tab).then(() => {
+          resolve(delta);
+        });
+      });
+    });
+  },
+
+  whenTabReady() {
+    return new Promise((resolve) => {
+      this.readyCallback = resolve;
+    });
+  },
+
+  removeTab(tab) {
+    return new Promise((resolve) => {
+      let {messageManager: mm, frameLoader} = tab.linkedBrowser;
+      mm.addMessageListener("SessionStore:update", function onMessage(msg) {
+        if (msg.targetFrameLoader == frameLoader && msg.data.isFinal) {
+          mm.removeMessageListener("SessionStore:update", onMessage);
+          resolve();
+        }
+      }, true);
+
+      tab.ownerGlobal.gBrowser.removeTab(tab);
+    });
+  },
+
+  reportResults(results) {
+    Services.mm.broadcastAsyncMessage("CPStartup:FinalResults", results);
+  },
+};
+
+function install(aData, aReason) {}
+
+function startup(aData, aReason) {
+  CPStartup.init();
+}
+
+function shutdown(aData, aReason) {
+  CPStartup.uninit();
+}
+
+function uninstall(aData, aReason) {}
diff --git a/testing/talos/talos/tests/cpstartup/chrome.manifest b/testing/talos/talos/tests/cpstartup/chrome.manifest
new file mode 100644
index 000000000000..d349e6b2bf6f
--- /dev/null
+++ b/testing/talos/talos/tests/cpstartup/chrome.manifest
@@ -0,0 +1 @@
+content cpstartup content/ remoteenabled=yes contentaccessible=yes
\ No newline at end of file
diff --git a/testing/talos/talos/tests/cpstartup/content/cpstartup.html b/testing/talos/talos/tests/cpstartup/content/cpstartup.html
new file mode 100644
index 000000000000..0cde25597d2d
--- /dev/null
+++ b/testing/talos/talos/tests/cpstartup/content/cpstartup.html
@@ -0,0 +1,31 @@
+<html>
+  <head>
+    <script>
+      const { classes: Cc, interfaces: Ci, utils: Cu } = Components;
+
+      function init() {
+        if (document.location.hash.indexOf("#auto") == 0) {
+          let mm = window.QueryInterface(Ci.nsIInterfaceRequestor)
+                         .getInterface(Ci.nsIWebNavigation)
+                         .QueryInterface(Ci.nsIInterfaceRequestor)
+                         .getInterface(Ci.nsIContentFrameMessageManager);
+
+          mm.addMessageListener("CPStartup:FinalResults", function onResults(msg) {
+            mm.removeMessageListener("CPStartup:FinalResults", onResults);
+            let results = msg.data;
+
+            tpRecordTime(results, 0, "content-process-startup");
+          });
+
+          mm.sendAsyncMessage("CPStartup:Go");
+        }
+      }
+
+    </script>
+  </head>
+  <body onload="init();">
+    Hello, Talos!
+
+    <a href="#" id="target" target="_blank">I'll open a new tab</a>
+  </body>
+</html>
diff --git a/testing/talos/talos/tests/cpstartup/content/target.html b/testing/talos/talos/tests/cpstartup/content/target.html
new file mode 100644
index 000000000000..fe1b8860b603
--- /dev/null
+++ b/testing/talos/talos/tests/cpstartup/content/target.html
@@ -0,0 +1,9 @@
+<html>
+<head>
+<title>Content Process Startup</title>
+<meta http-equiv="Content-Type" content="text/html;charset=utf-8"></meta>
+</head>
+<body>
+<p>Content Process Startup</p>
+</body>
+</html>
diff --git a/testing/talos/talos/tests/cpstartup/cpstartup-signed.xpi b/testing/talos/talos/tests/cpstartup/cpstartup-signed.xpi
new file mode 100644
index 0000000000000000000000000000000000000000..03b22a000895f010d76e8445d5c8477763c3350d
GIT binary patch
literal 3792
zcma)9cQl;e+8r%wNYtn?CdwEl>L6-Fi(Y~th%&m-Mg*gm2+_MBqK2Pdq9vk4_#p<-
zq7z0Lg6JW9lkeVK?!CUXzV}_vd)`0J-utZeoadbVXsZzr(gN@S0D!PPn;LHT*F%E)
zvvNTo;Rxhy?SIZ90Yo8yYGp3=q>Xq0Kpg=9K!0JDm8%ER!X4@93bjKzJJso_xl9UB
zv@9FCu31pd-I1<$3v83C2VmLkgII}`3au=Bp5{*R@%)(O?$TUCwhpLy#;H6%k&*f6
z&HBPj9e@$F_)4l{y{b>+LnL>n7cX1R!J4ZjT)r^JiQW9Q)CzAHjA!~e|2ptld-^A%
z>L3>`0@V>?#-y4-y)bJstq$qH5_WKwlSVDNHgP;1F6y2IHW_+Vq0a%WysD`VM9({{
zljnc~1>-%Kqo-lVGYPZ&v4fmpJ$$#den$G&e{4HiC0Xd~fzg`bpXBT@pdP%u=XAE?
z$NaOslbjhL&C~?4nHpf7XgFRiZk-n5>ZoSnlYzu&F4E|rnyFUqO+K3Cjq*{PT5IL-
zLqyhez%8G8n9UKCaDQW4-D~B3cVqTO2{vWZ+_IO$(7>{_h6NyB!?B7w%Aw#4@gy?@
zlYAYUuil29O0_Izn`Tz6pB0lP^2=`Z_W*<3=59`p`^rjW|GL$et!yD9so9O%=rL8-
zk>v9jJX>ZSjP2zfnkd)`oY-#0BYeI8U}-@<Fp@G}{Ov=z0L;R&ao#UZ`rZTM5XWx(
z-~wlqIofty&+A3heTsR3vH-mEWD^Dh)eIEgjQQb`{2muH7m|(3v@IO@znS)oxl7i;
zPOESr5!S#^A6D|xEN8&1HN%|Z*5KNWj7h^mXTuJGon^nJsxlkh?Da=P<OV|Zl_5_m
zeaT|nZK%dWsgu{Y^I^eowuoRExP-_}h6Qh>g+9+Bi52p%B!<h*J%pxP^bCk3CmPTD
zlv|KK+vLMntR}w0)@MJ7&sRHPDXg{!dz;a81psim4ggT#R%_|vg7iSTTew0UJjx7B
zTqa?({s$G}d-ov3<x=Z|cggbYb!k<a*`M4Dx8SjR{`RYCu9EI{b^Dp$ED&tuo=Hc9
zAvVeH-;*>%_uDn<r_eVErsqSl)S3nhZ%uu*+0(a)$>gd}Ud#vcuhz+;hR@#QUPF$R
zk|js4yg=x4K_ErDaYGfWx50i76LZwZVp-AC{2QSKs**j)o=Rm*+#VC)dZM6eKASSK
z?n6_tr00>lJ)~i;R1;ilJ<GGvHt>Nghnn=e7>WrSaMov~JYtI#NqAVL!Gwe<Tu+y7
z-7Ko_)kqRk5t+Y}ofgAZeJSvr`#wsf$w4<P&+YGV6)axR+vxa#G_kPSnlKS6*Dr<U
z&Jx*yoL`bXkzN6Q-oD3^BTGMiPBX9|*u68cLi(O5qe>wiGmJ(Ng*|VJOFx#x9W_{)
zo6UUqVCH{>Itx0gE*s>8^gCcf-87^L(nF$!S;U44ObqG!q$MS-KBfe|MW~mRQK*2B
zn)2m8UPB5hqvK`pMRVj_6_dSnDPvRB2UQ}O^t$1LH+kP(PY*%!@kdraezdLQTSY?C
z>#s>W%|l@I&c{NoEtpsVw#9JgSSh#X@9qyw<7fxoMi93FP?6B+W6@&?=2dVTL$Zs0
ze9dDlayqrB{kZOW!L65!`ZeJ00#@A!gKHrV1=PzF)qfqGrc}%snW=ojUurvDW@@Q_
zN@iT+W}@%R*8t}R3hRm&KvWHsHcLfrksAq#%veADqFZS_K=g3#5tKVLfyAdl^-2|i
zZtbKhi`PJQqY`Z=$lQd{;xBg|f->ba!J&?U%5bosv!(cMh=>W;U6aTp%9O~E1Ebt#
zO<~j0RQ{bFSgta%3CfKfi|SlD#&%|&wm!F;y52X7-4>Z4vfru4i-k~*O4G{v1j`nI
zP|PysZ3W5QEuV`WBHL$=DT2DIznkKJ+*era4HQ=~8AgmAmMUk7Z)&=Fg2|jWrTV>;
zJYoflZ8PSXYlmmJXg29}Vsa!_{{lOkXCI3-P#vCZ+z9n+*f74QQY}wT2wHljSYv$H
zyr?}Hv*B%u%@W!7G@04h1Y3QW*sdM9L&_A5j4lqRZ_iOl%8qMC`BLSSBw-&Zs^x^f
z=iR{2jNM=7uxFl1sa%E|6>^|uImF^@>+LYr_)m3OhijCD4?t(%h#c}@CDcS2K#nru
zp#1>W2_WBQXkNxBO!482!{=J;;{9h?EU(!ft_M`9+w+q_xQS^q*3Menx~Y?QX|zu=
z2W9cgmt*78A7p`@<Q)ZlN1o)7@87;!vlut{vVIz?lD5Xm;%&Z?%rmsV=k3~-3$!({
zq_Zayqw2QC->@4e!c6zVt~wa;ck<eYY3d>tNx9VYayHE0t#*S#;-ykHJC0Kj)H+LO
zvIdl6>~&0kifyyjY~|M%9KfF~1vxqxi-$Z1J>iriH|cJm(rE3u<;%d{*EcpqYwl~2
z9}@_pV&B7*UM_m?RFb7Pu-c1=3OdDy)-oPk8~4&;(a08JFja3%3KZLKdOE0C$R^8-
zesmj(zxb4mi82tu`7H;Q93xyzk^ZTVjU(I0v9_V|_K&HQ3O4IBaTa8Hk@WMBoITv#
z1(zKDrBLC=&aRu>J;18v_u^ZY_;p&@jbERF#??cN`mSWOoT$?p>5(v;bdUH%xAi#c
zq~)`qwh9Tf1*tP5mJ-Rib#EVdwqgZ}`k(zR6Jh*=^^JN+{;!>*N&jcn{<=^>s2ji)
z`nn^vrzh0$9s|{zt|&3n-MR9LPi&!X-j>7dQ*r@ca}~QinT=!EAPBFBnS`NSp)@J5
zAsn3O*4zC>tkmn7h_rmk>`s<>LZ-L6TJuu{8h+VTQ=vtv9tZLi3ehGOGb^Z|@v}0Y
ziA`BoB<Sjk<_^O`2c5oH+XH!<Xr1rdd2iyTT6}^PS=EHn-&SR0#{T4TN60tdp1ZYQ
zXEAUbFY&38K3Y2Xnwsf{J}cGjj~3jGs(A^ZwoEn|I_ir0S#Z<xzWwY=;5}l0p)c87
zQus8auS%Gjwi8Pl*gtfg(h!IiRcD6lpN&?SpHNZdev#LowVu(aWS`r;B5XE?|JPCb
z>uVT|=sT(7??w-oF<w5VS!v}b^QYcve~A%;Ru*zyXx^i|?bv%}wjSJsP1qVn+B#v?
z*E$cc{h|R`#ul`TRHrt!t_)Yos@CdVml93Q6Z^$Vx}&ssqwD*SjDZokg^R|PxWe77
zVmdl~i!L@#p!Om9#k%T8NjY)Opa*qL!J~e$Jg3JfRl=aGQIXPs<vhIQw{8*xhj@<7
zl9cI3`$pJPqVqfMw@FJFCLM?2?lyT`Q2oA<?c80Q;ZSD_guM;i1F6=JhTQ)Q(NTf&
zK=1SMg88*o!Xs87v;`PUYJMSxlWQrzaNMAfz9XMHF;OonN;s&UT?g>*5(_#3<q#aT
zATFqXOZ>~({ZY}=SLx^JL2J|vjcNT68qoTO^xcRRc+w(<hdU)@(F5-SHGMLhnvRo{
zFdvRm2p3G3QbVobPvA~2uK!<&9rueG57OAwunqE$#&8Cef)D^8$7$FjaK_Zh3F>Zb
zlcm?|{zZUxdKnVhY^4<cjnLSaB~_W2zO_(qym#L-x0ug9-!UP4em4GQm6b7UU1T}i
z!(3VHz4U0p2_ZJrVDfPtMaZO6{LHK$hfK~CY#fvkTGcUMDOH*}@qL^(#)@8vFY*mP
zWG$Qa2T1=r?}{ktu&_~?mb~hWeV)LSz#Ef!{WyM-`<tzF1~+#1NYS1llQ~tqj0(@S
zDI1e&F{%&dDrvkKhoAG*v>(3d{G`2G<;9S!J1VRMlVR-6rTm_4CAZB~sF1HQTy+O!
zeHGGk5}sngAPWL<jxn(sBZO+NA~Q*ujFv=P_OCWL@`(rgvR`p3D0@`{$b}5;frevT
z^{HPIl0iF*iD+3=Ueg83Tb4pwC0tD#d#9}0+VPd0Yta79DX6N2#S>_iVP*)Z8F4ET
zh*dUaj^RiZ(AbSV%+=b8)Lpphr{GLdz|gz=g!pjg2AE8yPOSdyMfCU6;03Nn&qhS~
zbK|~zp43qMCPmm}ydxS5Y%!a4@<(T~bzNKQnnS<*{CJ!Qw*2E8W56^G_uLeh@2Krr
zqFDx(@yKOza?*9fEkaqaIfg1a4qhHF?OM$0yJfzuXf+w?YZ@{ydFX$(CrfQs!T{bm
z$mT!A?J+!jTEPF^$lx{s?z#4l;X+&U2X%R4^LsiTfF1Yc!o{Cv=)4$yw>js^B!J8O
zG7k7p4jNpS^@rnvd%j3;nT0(kXu}a)G_)6ymmLh}$O6*;Iwt-T{GTO%4kjVH>;Slk
uzpSp$@m81O|5W)!p37?YoTm%NbD@&8)rfFL9{?c1y*s#K@A~cc0sjNSyHn!;

literal 0
HcmV?d00001

diff --git a/testing/talos/talos/tests/cpstartup/cpstartup.manifest b/testing/talos/talos/tests/cpstartup/cpstartup.manifest
new file mode 100644
index 000000000000..f6f9e5258e4c
--- /dev/null
+++ b/testing/talos/talos/tests/cpstartup/cpstartup.manifest
@@ -0,0 +1 @@
+% chrome://cpstartup/content/cpstartup.html#auto
diff --git a/testing/talos/talos/tests/cpstartup/install.rdf b/testing/talos/talos/tests/cpstartup/install.rdf
new file mode 100644
index 000000000000..e594dad4cdf1
--- /dev/null
+++ b/testing/talos/talos/tests/cpstartup/install.rdf
@@ -0,0 +1,24 @@
+<?xml version="1.0"?>
+<RDF xmlns="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:em="http://www.mozilla.org/2004/em-rdf#">
+  <Description about="urn:mozilla:install-manifest">
+    <em:id>cpstartup-test@mozilla.org</em:id>
+    <em:type>2</em:type>
+    <em:name>cpstartup test</em:name>
+    <em:version>1.0.0</em:version>
+    <em:bootstrap>true</em:bootstrap>
+    <em:description>Measures the performance of starting and initializing new content processes</em:description>
+    <em:creator>Gabor Krizsanits</em:creator>
+    <em:multiprocessCompatible>true</em:multiprocessCompatible>
+
+    <!-- Desktop -->
+    <em:targetApplication>
+      <Description>
+        <em:id>{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id>
+        <em:minVersion>55.0</em:minVersion>
+        <em:maxVersion>*</em:maxVersion>
+      </Description>
+    </em:targetApplication>
+  </Description>
+  <em:description>https://wiki.mozilla.org/Buildbot/Talos/Tests</em:description>
+  <em:homepageURL>https://wiki.mozilla.org/Buildbot/Talos/Tests</em:homepageURL>
+</RDF>
diff --git a/toolkit/content/browser-child.js b/toolkit/content/browser-child.js
index 3b3b3277b554..8b64e2276421 100644
--- a/toolkit/content/browser-child.js
+++ b/toolkit/content/browser-child.js
@@ -257,6 +257,8 @@ var WebNavigation =  {
     addMessageListener("WebNavigation:SetOriginAttributes", this);
     addMessageListener("WebNavigation:Reload", this);
     addMessageListener("WebNavigation:Stop", this);
+    // This message is used for measuring content process startup performance.
+    sendAsyncMessage("Content:BrowserChildReady", { time: Services.telemetry.msSystemNow() });
   },
 
   get webNavigation() {

From 1077972535b539af14f84cc0cbd25da88e0c0b39 Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Tue, 19 Sep 2017 12:31:30 +0100
Subject: [PATCH 19/83] Bug 1396613 - Update the object moved hook to allow it
 to be called when tenuring nursery objects r=sfink r=mccr8

---
 dom/base/nsGlobalWindow.cpp                |  5 +++--
 dom/bindings/Codegen.py                    | 10 +++++----
 dom/bindings/SimpleGlobalObject.cpp        |  5 +++--
 dom/plugins/base/nsJSNPRuntime.cpp         | 13 +++++------
 js/ipc/WrapperOwner.cpp                    |  7 +++---
 js/public/Class.h                          | 13 ++++++++---
 js/public/Proxy.h                          |  2 +-
 js/src/builtin/MapObject.cpp               | 22 ++++++++++---------
 js/src/builtin/MapObject.h                 |  4 ++--
 js/src/gc/Marking.cpp                      |  4 ++--
 js/src/jsapi-tests/testWeakMap.cpp         |  6 ++++--
 js/src/proxy/BaseProxyHandler.cpp          |  5 +++--
 js/src/proxy/Proxy.cpp                     |  6 +++---
 js/src/vm/ArrayBufferObject.cpp            |  6 ++++--
 js/src/vm/ArrayBufferObject.h              |  2 +-
 js/src/vm/TypedArrayObject.cpp             |  8 ++++---
 js/src/vm/TypedArrayObject.h               |  2 +-
 js/src/vm/UnboxedObject.cpp                |  6 ++++--
 js/src/vm/UnboxedObject.h                  |  2 +-
 js/xpconnect/src/Sandbox.cpp               | 10 +++++----
 js/xpconnect/src/SandboxPrivate.h          |  3 ++-
 js/xpconnect/src/XPCWrappedNativeJSOps.cpp | 25 +++++++++++++---------
 22 files changed, 99 insertions(+), 67 deletions(-)

diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index 31db4edc5ff3..2f9bd20c81b5 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -1157,7 +1157,7 @@ public:
   bool unwatch(JSContext *cx, JS::Handle<JSObject*> proxy,
                JS::Handle<jsid> id) const override;
 
-  static void ObjectMoved(JSObject *obj, const JSObject *old);
+  static size_t ObjectMoved(JSObject *obj, JSObject *old);
 
   static const nsOuterWindowProxy singleton;
 
@@ -1526,13 +1526,14 @@ nsOuterWindowProxy::unwatch(JSContext *cx, JS::Handle<JSObject*> proxy,
   return js::UnwatchGuts(cx, proxy, id);
 }
 
-void
+size_t
 nsOuterWindowProxy::ObjectMoved(JSObject *obj, const JSObject *old)
 {
   nsGlobalWindow* outerWindow = GetOuterWindow(obj);
   if (outerWindow) {
     outerWindow->UpdateWrapper(obj, old);
   }
+  return 0;
 }
 
 const nsOuterWindowProxy
diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index a2e2c5384660..3b59d5e839ba 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -1737,14 +1737,16 @@ class CGClassObjectMovedHook(CGAbstractClassHook):
     is holding moves.
     """
     def __init__(self, descriptor):
-        args = [Argument('JSObject*', 'obj'), Argument('const JSObject*', 'old')]
+        args = [Argument('JSObject*', 'obj'), Argument('JSObject*', 'old')]
         CGAbstractClassHook.__init__(self, descriptor, OBJECT_MOVED_HOOK_NAME,
-                                     'void', args)
+                                     'size_t', args)
 
     def generate_code(self):
         assert self.descriptor.wrapperCache
-        return CGIfWrapper(CGGeneric("UpdateWrapper(self, self, obj, old);\n"),
-                           "self").define()
+        return CGList([
+            CGIfWrapper(CGGeneric("UpdateWrapper(self, self, obj, old);\n"),
+                        "self"),
+            CGGeneric("return 0;\n")]).define()
 
 
 def JSNativeArguments():
diff --git a/dom/bindings/SimpleGlobalObject.cpp b/dom/bindings/SimpleGlobalObject.cpp
index b3a5c4ae9ebf..afefbb7d3cc5 100644
--- a/dom/bindings/SimpleGlobalObject.cpp
+++ b/dom/bindings/SimpleGlobalObject.cpp
@@ -50,12 +50,13 @@ SimpleGlobal_finalize(js::FreeOp *fop, JSObject *obj)
   NS_RELEASE(globalObject);
 }
 
-static void
-SimpleGlobal_moved(JSObject *obj, const JSObject *old)
+static size_t
+SimpleGlobal_moved(JSObject *obj, JSObject *old)
 {
   SimpleGlobalObject* globalObject =
     static_cast<SimpleGlobalObject*>(JS_GetPrivate(obj));
   globalObject->UpdateWrapper(obj, old);
+  return 0;
 }
 
 static const js::ClassOps SimpleGlobalClassOps = {
diff --git a/dom/plugins/base/nsJSNPRuntime.cpp b/dom/plugins/base/nsJSNPRuntime.cpp
index bcae175bcafc..38bd7f072efa 100644
--- a/dom/plugins/base/nsJSNPRuntime.cpp
+++ b/dom/plugins/base/nsJSNPRuntime.cpp
@@ -241,8 +241,8 @@ static bool
 NPObjWrapper_Resolve(JSContext *cx, JS::Handle<JSObject*> obj, JS::Handle<jsid> id,
                      bool* resolved, JS::MutableHandle<JSObject*> method);
 
-static void
-NPObjWrapper_ObjectMoved(JSObject *obj, const JSObject *old);
+static size_t
+NPObjWrapper_ObjectMoved(JSObject *obj, JSObject *old);
 
 static bool
 NPObjWrapper_toPrimitive(JSContext *cx, unsigned argc, JS::Value *vp);
@@ -1787,19 +1787,19 @@ NPObjWrapperProxyHandler::finalize(JSFreeOp* fop, JSObject* proxy) const
   sDelayedReleases->AppendElement(npobj);
 }
 
-static void
-NPObjWrapper_ObjectMoved(JSObject *obj, const JSObject *old)
+static size_t
+NPObjWrapper_ObjectMoved(JSObject *obj, JSObject *old)
 {
   // The wrapper JSObject has been moved, so we need to update the entry in the
   // sNPObjWrappers hash table, if present.
 
   if (!sNPObjWrappers) {
-    return;
+    return 0;
   }
 
   NPObject *npobj = (NPObject *)js::GetProxyPrivate(obj).toPrivate();
   if (!npobj) {
-    return;
+    return 0;
   }
 
   // Calling PLDHashTable::Search() will not result in GC.
@@ -1810,6 +1810,7 @@ NPObjWrapper_ObjectMoved(JSObject *obj, const JSObject *old)
   MOZ_ASSERT(entry && entry->mJSObj);
   MOZ_ASSERT(entry->mJSObj == old);
   entry->mJSObj = obj;
+  return 0;
 }
 
 bool
diff --git a/js/ipc/WrapperOwner.cpp b/js/ipc/WrapperOwner.cpp
index 3ee2e07ea706..51f06ab72ce6 100644
--- a/js/ipc/WrapperOwner.cpp
+++ b/js/ipc/WrapperOwner.cpp
@@ -131,7 +131,7 @@ class CPOWProxyHandler : public BaseProxyHandler
     virtual const char* className(JSContext* cx, HandleObject proxy) const override;
     virtual RegExpShared* regexp_toShared(JSContext* cx, HandleObject proxy) const override;
     virtual void finalize(JSFreeOp* fop, JSObject* proxy) const override;
-    virtual void objectMoved(JSObject* proxy, const JSObject* old) const override;
+    virtual size_t objectMoved(JSObject* proxy, JSObject* old) const override;
     virtual bool isCallable(JSObject* obj) const override;
     virtual bool isConstructor(JSObject* obj) const override;
     virtual bool getPrototype(JSContext* cx, HandleObject proxy, MutableHandleObject protop) const override;
@@ -895,10 +895,11 @@ CPOWProxyHandler::finalize(JSFreeOp* fop, JSObject* proxy) const
         delete aux;
 }
 
-void
-CPOWProxyHandler::objectMoved(JSObject* proxy, const JSObject* old) const
+size_t
+CPOWProxyHandler::objectMoved(JSObject* proxy, JSObject* old) const
 {
     OwnerOf(proxy)->updatePointer(proxy, old);
+    return 0;
 }
 
 bool
diff --git a/js/public/Class.h b/js/public/Class.h
index e08550ad687e..e07c1a9d4aee 100644
--- a/js/public/Class.h
+++ b/js/public/Class.h
@@ -510,8 +510,8 @@ typedef void
 typedef JSObject*
 (* JSWeakmapKeyDelegateOp)(JSObject* obj);
 
-typedef void
-(* JSObjectMovedOp)(JSObject* obj, const JSObject* old);
+typedef size_t
+(* JSObjectMovedOp)(JSObject* obj, JSObject* old);
 
 /* js::Class operation signatures. */
 
@@ -711,7 +711,8 @@ struct JS_STATIC_CLASS ClassExtension
     JSWeakmapKeyDelegateOp weakmapKeyDelegateOp;
 
     /**
-     * Optional hook called when an object is moved by a compacting GC.
+     * Optional hook called when an object is moved by generational or
+     * compacting GC.
      *
      * There may exist weak pointers to an object that are not traced through
      * when the normal trace APIs are used, for example objects in the wrapper
@@ -720,6 +721,12 @@ struct JS_STATIC_CLASS ClassExtension
      * Note that this hook can be called before JS_NewObject() returns if a GC
      * is triggered during construction of the object. This can happen for
      * global objects for example.
+     *
+     * The function should return the difference between nursery bytes used and
+     * tenured bytes used, which may be nonzero e.g. if some nursery-allocated
+     * data beyond the actual GC thing is moved into malloced memory.
+     *
+     * This is used to compute the nursery promotion rate.
      */
     JSObjectMovedOp objectMovedOp;
 };
diff --git a/js/public/Proxy.h b/js/public/Proxy.h
index 49f0f32fe051..39b111096c05 100644
--- a/js/public/Proxy.h
+++ b/js/public/Proxy.h
@@ -335,7 +335,7 @@ class JS_FRIEND_API(BaseProxyHandler)
     virtual bool boxedValue_unbox(JSContext* cx, HandleObject proxy, MutableHandleValue vp) const;
     virtual void trace(JSTracer* trc, JSObject* proxy) const;
     virtual void finalize(JSFreeOp* fop, JSObject* proxy) const;
-    virtual void objectMoved(JSObject* proxy, const JSObject* old) const;
+    virtual size_t objectMoved(JSObject* proxy, JSObject* old) const;
 
     // Allow proxies, wrappers in particular, to specify callability at runtime.
     // Note: These do not take const JSObject*, but they do in spirit.
diff --git a/js/src/builtin/MapObject.cpp b/js/src/builtin/MapObject.cpp
index 5b4df6fba700..b34ff46f4d50 100644
--- a/js/src/builtin/MapObject.cpp
+++ b/js/src/builtin/MapObject.cpp
@@ -275,21 +275,21 @@ MapIteratorObject::finalize(FreeOp* fop, JSObject* obj)
     fop->delete_(range);
 }
 
-void
-MapIteratorObject::objectMoved(JSObject* obj, const JSObject* old)
+size_t
+MapIteratorObject::objectMoved(JSObject* obj, JSObject* old)
 {
     if (!IsInsideNursery(old))
-        return;
+        return 0;
 
     MapIteratorObject* iter = &obj->as<MapIteratorObject>();
     ValueMap::Range* range = MapIteratorObjectRange(iter);
     if (!range)
-        return;
+        return 0;
 
     Nursery& nursery = iter->zone()->group()->nursery();
     if (!nursery.isInside(range)) {
         nursery.removeMallocedBuffer(range);
-        return;
+        return 0;
     }
 
     AutoEnterOOMUnsafeRegion oomUnsafe;
@@ -300,6 +300,7 @@ MapIteratorObject::objectMoved(JSObject* obj, const JSObject* old)
     new (newRange) ValueMap::Range(*range);
     range->~Range();
     iter->setReservedSlot(MapIteratorObject::RangeSlot, PrivateValue(newRange));
+    return sizeof(ValueMap::Range);
 }
 
 template <typename Range>
@@ -1124,21 +1125,21 @@ SetIteratorObject::finalize(FreeOp* fop, JSObject* obj)
     fop->delete_(range);
 }
 
-void
-SetIteratorObject::objectMoved(JSObject* obj, const JSObject* old)
+size_t
+SetIteratorObject::objectMoved(JSObject* obj, JSObject* old)
 {
     if (!IsInsideNursery(old))
-        return;
+        return 0;
 
     SetIteratorObject* iter = &obj->as<SetIteratorObject>();
     ValueSet::Range* range = SetIteratorObjectRange(iter);
     if (!range)
-        return;
+        return 0;
 
     Nursery& nursery = iter->zone()->group()->nursery();
     if (!nursery.isInside(range)) {
         nursery.removeMallocedBuffer(range);
-        return;
+        return 0;
     }
 
     AutoEnterOOMUnsafeRegion oomUnsafe;
@@ -1149,6 +1150,7 @@ SetIteratorObject::objectMoved(JSObject* obj, const JSObject* old)
     new (newRange) ValueSet::Range(*range);
     range->~Range();
     iter->setReservedSlot(SetIteratorObject::RangeSlot, PrivateValue(newRange));
+    return sizeof(ValueSet::Range);
 }
 
 bool
diff --git a/js/src/builtin/MapObject.h b/js/src/builtin/MapObject.h
index 08f87524b40d..ed29f53e32eb 100644
--- a/js/src/builtin/MapObject.h
+++ b/js/src/builtin/MapObject.h
@@ -190,7 +190,7 @@ class MapIteratorObject : public NativeObject
     static MapIteratorObject* create(JSContext* cx, HandleObject mapobj, ValueMap* data,
                                      MapObject::IteratorKind kind);
     static void finalize(FreeOp* fop, JSObject* obj);
-    static void objectMoved(JSObject* obj, const JSObject* old);
+    static size_t objectMoved(JSObject* obj, JSObject* old);
 
     static MOZ_MUST_USE bool next(Handle<MapIteratorObject*> mapIterator,
                                   HandleArrayObject resultPairObj, JSContext* cx);
@@ -293,7 +293,7 @@ class SetIteratorObject : public NativeObject
     static SetIteratorObject* create(JSContext* cx, HandleObject setobj, ValueSet* data,
                                      SetObject::IteratorKind kind);
     static void finalize(FreeOp* fop, JSObject* obj);
-    static void objectMoved(JSObject* obj, const JSObject* old);
+    static size_t objectMoved(JSObject* obj, JSObject* old);
 
     static MOZ_MUST_USE bool next(Handle<SetIteratorObject*> setIterator,
                                   HandleArrayObject resultObj, JSContext* cx);
diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp
index e12c194075e6..c2390df844a8 100644
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -2990,9 +2990,9 @@ js::TenuringTracer::moveObjectToTenured(JSObject* dst, JSObject* src, AllocKind
         MOZ_ASSERT(src->as<ProxyObject>().usingInlineValueArray());
         dst->as<ProxyObject>().setInlineValueArray();
         if (JSObjectMovedOp op = dst->getClass()->extObjectMovedOp())
-            op(dst, src);
+            tenuredSize += op(dst, src);
     } else if (JSObjectMovedOp op = dst->getClass()->extObjectMovedOp()) {
-        op(dst, src);
+        tenuredSize += op(dst, src);
     } else {
         MOZ_ASSERT_IF(src->getClass()->hasFinalize(),
                       CanNurseryAllocateFinalizedClass(src->getClass()));
diff --git a/js/src/jsapi-tests/testWeakMap.cpp b/js/src/jsapi-tests/testWeakMap.cpp
index 62c7abe4f74a..9b787b19db2c 100644
--- a/js/src/jsapi-tests/testWeakMap.cpp
+++ b/js/src/jsapi-tests/testWeakMap.cpp
@@ -140,13 +140,15 @@ BEGIN_TEST(testWeakMap_keyDelegates)
     return true;
 }
 
-static void DelegateObjectMoved(JSObject* obj, const JSObject* old)
+static size_t
+DelegateObjectMoved(JSObject* obj, JSObject* old)
 {
     if (!keyDelegate)
-        return;  // Object got moved before we set keyDelegate to point to it.
+        return 0;  // Object got moved before we set keyDelegate to point to it.
 
     MOZ_RELEASE_ASSERT(keyDelegate == old);
     keyDelegate = obj;
+    return 0;
 }
 
 static JSObject* GetKeyDelegate(JSObject* obj)
diff --git a/js/src/proxy/BaseProxyHandler.cpp b/js/src/proxy/BaseProxyHandler.cpp
index 4b4fbfd0b0b7..6666756ebc14 100644
--- a/js/src/proxy/BaseProxyHandler.cpp
+++ b/js/src/proxy/BaseProxyHandler.cpp
@@ -373,9 +373,10 @@ BaseProxyHandler::finalize(JSFreeOp* fop, JSObject* proxy) const
 {
 }
 
-void
-BaseProxyHandler::objectMoved(JSObject* proxy, const JSObject* old) const
+size_t
+BaseProxyHandler::objectMoved(JSObject* proxy, JSObject* old) const
 {
+    return 0;
 }
 
 JSObject*
diff --git a/js/src/proxy/Proxy.cpp b/js/src/proxy/Proxy.cpp
index 13fce6f49065..5cdc80800e50 100644
--- a/js/src/proxy/Proxy.cpp
+++ b/js/src/proxy/Proxy.cpp
@@ -741,11 +741,11 @@ proxy_Finalize(FreeOp* fop, JSObject* obj)
         js_free(js::detail::GetProxyDataLayout(obj)->values());
 }
 
-static void
-proxy_ObjectMoved(JSObject* obj, const JSObject* old)
+static size_t
+proxy_ObjectMoved(JSObject* obj, JSObject* old)
 {
     MOZ_ASSERT(obj->is<ProxyObject>());
-    obj->as<ProxyObject>().handler()->objectMoved(obj, old);
+    return obj->as<ProxyObject>().handler()->objectMoved(obj, old);
 }
 
 bool
diff --git a/js/src/vm/ArrayBufferObject.cpp b/js/src/vm/ArrayBufferObject.cpp
index 1e813a708820..df86d16222fc 100755
--- a/js/src/vm/ArrayBufferObject.cpp
+++ b/js/src/vm/ArrayBufferObject.cpp
@@ -1254,8 +1254,8 @@ ArrayBufferObject::trace(JSTracer* trc, JSObject* obj)
     buf.setSlot(DATA_SLOT, PrivateValue(view->as<InlineTransparentTypedObject>().inlineTypedMem()));
 }
 
-/* static */ void
-ArrayBufferObject::objectMoved(JSObject* obj, const JSObject* old)
+/* static */ size_t
+ArrayBufferObject::objectMoved(JSObject* obj, JSObject* old)
 {
     ArrayBufferObject& dst = obj->as<ArrayBufferObject>();
     const ArrayBufferObject& src = old->as<ArrayBufferObject>();
@@ -1263,6 +1263,8 @@ ArrayBufferObject::objectMoved(JSObject* obj, const JSObject* old)
     // Fix up possible inline data pointer.
     if (src.hasInlineData())
         dst.setSlot(DATA_SLOT, PrivateValue(dst.inlineDataPointer()));
+
+    return 0;
 }
 
 ArrayBufferViewObject*
diff --git a/js/src/vm/ArrayBufferObject.h b/js/src/vm/ArrayBufferObject.h
index 43170885fadc..47af007c0629 100644
--- a/js/src/vm/ArrayBufferObject.h
+++ b/js/src/vm/ArrayBufferObject.h
@@ -259,7 +259,7 @@ class ArrayBufferObject : public ArrayBufferObjectMaybeShared
                          uint32_t count);
 
     static void trace(JSTracer* trc, JSObject* obj);
-    static void objectMoved(JSObject* obj, const JSObject* old);
+    static size_t objectMoved(JSObject* obj, JSObject* old);
 
     static BufferContents externalizeContents(JSContext* cx,
                                               Handle<ArrayBufferObject*> buffer,
diff --git a/js/src/vm/TypedArrayObject.cpp b/js/src/vm/TypedArrayObject.cpp
index 68e99d0a6f93..186722e13d54 100644
--- a/js/src/vm/TypedArrayObject.cpp
+++ b/js/src/vm/TypedArrayObject.cpp
@@ -180,19 +180,21 @@ TypedArrayObject::finalize(FreeOp* fop, JSObject* obj)
         js_free(curObj->elements());
 }
 
-/* static */ void
-TypedArrayObject::objectMoved(JSObject* obj, const JSObject* old)
+/* static */ size_t
+TypedArrayObject::objectMoved(JSObject* obj, JSObject* old)
 {
     TypedArrayObject* newObj = &obj->as<TypedArrayObject>();
     const TypedArrayObject* oldObj = &old->as<TypedArrayObject>();
 
     // Typed arrays with a buffer object do not need an update.
     if (oldObj->hasBuffer())
-        return;
+        return 0;
 
     // Update the data slot pointer if it points to the old JSObject.
     if (oldObj->hasInlineElements())
         newObj->setInlineElements();
+
+    return 0;
 }
 
 /* static */ size_t
diff --git a/js/src/vm/TypedArrayObject.h b/js/src/vm/TypedArrayObject.h
index 112bd7f872ef..fdb342a96125 100644
--- a/js/src/vm/TypedArrayObject.h
+++ b/js/src/vm/TypedArrayObject.h
@@ -273,7 +273,7 @@ class TypedArrayObject : public NativeObject
   public:
     static void trace(JSTracer* trc, JSObject* obj);
     static void finalize(FreeOp* fop, JSObject* obj);
-    static void objectMoved(JSObject* obj, const JSObject* old);
+    static size_t objectMoved(JSObject* obj, JSObject* old);
     static size_t objectMovedDuringMinorGC(JSTracer* trc, JSObject* obj, const JSObject* old,
                                            gc::AllocKind allocKind);
 
diff --git a/js/src/vm/UnboxedObject.cpp b/js/src/vm/UnboxedObject.cpp
index 4e007489a67e..e21e7bd73154 100644
--- a/js/src/vm/UnboxedObject.cpp
+++ b/js/src/vm/UnboxedObject.cpp
@@ -1203,8 +1203,8 @@ UnboxedArrayObject::trace(JSTracer* trc, JSObject* obj)
     }
 }
 
-/* static */ void
-UnboxedArrayObject::objectMoved(JSObject* obj, const JSObject* old)
+/* static */ size_t
+UnboxedArrayObject::objectMoved(JSObject* obj, JSObject* old)
 {
     UnboxedArrayObject& dst = obj->as<UnboxedArrayObject>();
     const UnboxedArrayObject& src = old->as<UnboxedArrayObject>();
@@ -1212,6 +1212,8 @@ UnboxedArrayObject::objectMoved(JSObject* obj, const JSObject* old)
     // Fix up possible inline data pointer.
     if (src.hasInlineElements())
         dst.setInlineElements();
+
+    return 0;
 }
 
 /* static */ void
diff --git a/js/src/vm/UnboxedObject.h b/js/src/vm/UnboxedObject.h
index 0f8255d6d59b..231e8d502280 100644
--- a/js/src/vm/UnboxedObject.h
+++ b/js/src/vm/UnboxedObject.h
@@ -443,7 +443,7 @@ class UnboxedArrayObject : public UnboxedObject
                           Handle<GCVector<Value>> values, size_t* valueCursor);
 
     static void trace(JSTracer* trc, JSObject* object);
-    static void objectMoved(JSObject* obj, const JSObject* old);
+    static size_t objectMoved(JSObject* obj, JSObject* old);
     static void finalize(FreeOp* fop, JSObject* obj);
 
     static size_t objectMovedDuringMinorGC(JSTracer* trc, JSObject* dst, JSObject* src,
diff --git a/js/xpconnect/src/Sandbox.cpp b/js/xpconnect/src/Sandbox.cpp
index 6c88bb29c225..ed24913d03f0 100644
--- a/js/xpconnect/src/Sandbox.cpp
+++ b/js/xpconnect/src/Sandbox.cpp
@@ -424,16 +424,18 @@ sandbox_finalize(js::FreeOp* fop, JSObject* obj)
     DeferredFinalize(sop);
 }
 
-static void
-sandbox_moved(JSObject* obj, const JSObject* old)
+static size_t
+sandbox_moved(JSObject* obj, JSObject* old)
 {
     // Note that this hook can be called before the private pointer is set. In
     // this case the SandboxPrivate will not exist yet, so there is nothing to
     // do.
     nsIScriptObjectPrincipal* sop =
         static_cast<nsIScriptObjectPrincipal*>(xpc_GetJSPrivate(obj));
-    if (sop)
-        static_cast<SandboxPrivate*>(sop)->ObjectMoved(obj, old);
+    if (!sop)
+        return 0;
+
+    return static_cast<SandboxPrivate*>(sop)->ObjectMoved(obj, old);
 }
 
 static bool
diff --git a/js/xpconnect/src/SandboxPrivate.h b/js/xpconnect/src/SandboxPrivate.h
index 3026a943de8b..7682bde667f2 100644
--- a/js/xpconnect/src/SandboxPrivate.h
+++ b/js/xpconnect/src/SandboxPrivate.h
@@ -53,9 +53,10 @@ public:
         MOZ_CRASH("SandboxPrivate doesn't use DOM bindings!");
     }
 
-    void ObjectMoved(JSObject* obj, const JSObject* old)
+    size_t ObjectMoved(JSObject* obj, JSObject* old)
     {
         UpdateWrapper(obj, old);
+        return 0;
     }
 
 private:
diff --git a/js/xpconnect/src/XPCWrappedNativeJSOps.cpp b/js/xpconnect/src/XPCWrappedNativeJSOps.cpp
index 0bc0b6fa9454..bacb53c867db 100644
--- a/js/xpconnect/src/XPCWrappedNativeJSOps.cpp
+++ b/js/xpconnect/src/XPCWrappedNativeJSOps.cpp
@@ -545,15 +545,16 @@ WrappedNativeFinalize(js::FreeOp* fop, JSObject* obj, WNHelperType helperType)
     wrapper->FlatJSObjectFinalized();
 }
 
-static void
-WrappedNativeObjectMoved(JSObject* obj, const JSObject* old)
+static size_t
+WrappedNativeObjectMoved(JSObject* obj, JSObject* old)
 {
     nsISupports* p = static_cast<nsISupports*>(xpc_GetJSPrivate(obj));
     if (!p)
-        return;
+        return 0;
 
     XPCWrappedNative* wrapper = static_cast<XPCWrappedNative*>(p);
     wrapper->FlatJSObjectMoved(obj, old);
+    return 0;
 }
 
 void
@@ -1009,13 +1010,16 @@ XPC_WN_Shared_Proto_Finalize(js::FreeOp* fop, JSObject* obj)
         p->JSProtoObjectFinalized(fop, obj);
 }
 
-static void
-XPC_WN_Shared_Proto_ObjectMoved(JSObject* obj, const JSObject* old)
+static size_t
+XPC_WN_Shared_Proto_ObjectMoved(JSObject* obj, JSObject* old)
 {
     // This can be null if xpc shutdown has already happened
     XPCWrappedNativeProto* p = (XPCWrappedNativeProto*) xpc_GetJSPrivate(obj);
-    if (p)
-        p->JSProtoObjectMoved(obj, old);
+    if (!p)
+        return 0;
+
+    p->JSProtoObjectMoved(obj, old);
+    return 0;
 }
 
 static void
@@ -1210,14 +1214,15 @@ XPC_WN_TearOff_Finalize(js::FreeOp* fop, JSObject* obj)
     p->JSObjectFinalized();
 }
 
-static void
-XPC_WN_TearOff_ObjectMoved(JSObject* obj, const JSObject* old)
+static size_t
+XPC_WN_TearOff_ObjectMoved(JSObject* obj, JSObject* old)
 {
     XPCWrappedNativeTearOff* p = (XPCWrappedNativeTearOff*)
         xpc_GetJSPrivate(obj);
     if (!p)
-        return;
+        return 0;
     p->JSObjectMoved(obj, old);
+    return 0;
 }
 
 // Make sure XPC_WRAPPER_FLAGS has no reserved slots, so our

From 2a663c4c5a99021be04c2b9ce603dba159963b72 Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Tue, 19 Sep 2017 12:31:30 +0100
Subject: [PATCH 20/83] Bug 1396613 - Replace special cases with use of
 objectMoved hook when tenuring r=sfink

---
 js/src/builtin/TypedObject.cpp | 40 +++++++++++++++++++++++++---------
 js/src/builtin/TypedObject.h   |  2 +-
 js/src/gc/Marking.cpp          | 13 ++++-------
 js/src/gc/Nursery.h            |  7 +++++-
 js/src/vm/ArgumentsObject.cpp  | 23 +++++++++++++++----
 js/src/vm/ArgumentsObject.h    |  4 +++-
 js/src/vm/TypedArrayObject.cpp | 33 ++++++++++------------------
 js/src/vm/TypedArrayObject.h   |  2 --
 js/src/vm/UnboxedObject.cpp    | 30 ++++++++++---------------
 js/src/vm/UnboxedObject.h      |  3 ---
 10 files changed, 87 insertions(+), 70 deletions(-)

diff --git a/js/src/builtin/TypedObject.cpp b/js/src/builtin/TypedObject.cpp
index b322995dbc4a..0d31d4dccc5b 100644
--- a/js/src/builtin/TypedObject.cpp
+++ b/js/src/builtin/TypedObject.cpp
@@ -2126,9 +2126,12 @@ InlineTypedObject::obj_trace(JSTracer* trc, JSObject* object)
     typedObj.typeDescr().traceInstances(trc, typedObj.inlineTypedMem(), 1);
 }
 
-/* static */ void
-InlineTypedObject::objectMovedDuringMinorGC(JSTracer* trc, JSObject* dst, JSObject* src)
+/* static */ size_t
+InlineTypedObject::obj_moved(JSObject* dst, JSObject* src)
 {
+    if (!IsInsideNursery(src))
+        return 0;
+
     // Inline typed object element arrays can be preserved on the stack by Ion
     // and need forwarding pointers created during a minor GC. We can't do this
     // in the trace hook because we don't have any stale data to determine
@@ -2140,9 +2143,12 @@ InlineTypedObject::objectMovedDuringMinorGC(JSTracer* trc, JSObject* dst, JSObje
         // but they will not set any direct forwarding pointers.
         uint8_t* oldData = reinterpret_cast<uint8_t*>(src) + offsetOfDataStart();
         uint8_t* newData = dst->as<InlineTypedObject>().inlineTypedMem();
-        dst->zone()->group()->nursery().maybeSetForwardingPointer(trc, oldData, newData,
-                                                                  descr.size() >= sizeof(uintptr_t));
+        auto& nursery = dst->zone()->group()->nursery();
+        bool direct = descr.size() >= sizeof(uintptr_t);
+        nursery.setForwardingPointerWhileTenuring(oldData, newData, direct);
     }
+
+    return 0;
 }
 
 ArrayBufferObject*
@@ -2219,7 +2225,7 @@ const ObjectOps TypedObject::objectOps_ = {
     nullptr, /* thisValue */
 };
 
-#define DEFINE_TYPEDOBJ_CLASS(Name, Trace, flag)         \
+#define DEFINE_TYPEDOBJ_CLASS(Name, Trace, Moved, flag)   \
     static const ClassOps Name##ClassOps = {             \
         nullptr,        /* addProperty */                \
         nullptr,        /* delProperty */                \
@@ -2233,20 +2239,34 @@ const ObjectOps TypedObject::objectOps_ = {
         nullptr,        /* construct   */                \
         Trace,                                           \
     };                                                   \
+    static const ClassExtension Name##ClassExt = {       \
+        nullptr,        /* weakmapKeyDelegateOp */       \
+        Moved           /* objectMovedOp */              \
+    };                                                   \
     const Class Name::class_ = {                         \
         # Name,                                          \
         Class::NON_NATIVE | flag,                        \
         &Name##ClassOps,                                 \
         JS_NULL_CLASS_SPEC,                              \
-        JS_NULL_CLASS_EXT,                               \
+        &Name##ClassExt,                                 \
         &TypedObject::objectOps_                         \
     }
 
-DEFINE_TYPEDOBJ_CLASS(OutlineTransparentTypedObject, OutlineTypedObject::obj_trace, 0);
-DEFINE_TYPEDOBJ_CLASS(OutlineOpaqueTypedObject,      OutlineTypedObject::obj_trace, 0);
-DEFINE_TYPEDOBJ_CLASS(InlineTransparentTypedObject,  InlineTypedObject::obj_trace,
+DEFINE_TYPEDOBJ_CLASS(OutlineTransparentTypedObject,
+                      OutlineTypedObject::obj_trace,
+                      nullptr,
+                      0);
+DEFINE_TYPEDOBJ_CLASS(OutlineOpaqueTypedObject,
+                      OutlineTypedObject::obj_trace,
+                      nullptr,
+                      0);
+DEFINE_TYPEDOBJ_CLASS(InlineTransparentTypedObject,
+                      InlineTypedObject::obj_trace,
+                      InlineTypedObject::obj_moved,
                       JSCLASS_DELAY_METADATA_BUILDER);
-DEFINE_TYPEDOBJ_CLASS(InlineOpaqueTypedObject,       InlineTypedObject::obj_trace,
+DEFINE_TYPEDOBJ_CLASS(InlineOpaqueTypedObject,
+                      InlineTypedObject::obj_trace,
+                      InlineTypedObject::obj_moved,
                       JSCLASS_DELAY_METADATA_BUILDER);
 
 static int32_t
diff --git a/js/src/builtin/TypedObject.h b/js/src/builtin/TypedObject.h
index f9d899eba729..d994e131752b 100644
--- a/js/src/builtin/TypedObject.h
+++ b/js/src/builtin/TypedObject.h
@@ -723,7 +723,7 @@ class InlineTypedObject : public TypedObject
     }
 
     static void obj_trace(JSTracer* trace, JSObject* object);
-    static void objectMovedDuringMinorGC(JSTracer* trc, JSObject* dst, JSObject* src);
+    static size_t obj_moved(JSObject* dst, JSObject* src);
 
     static size_t offsetOfDataStart() {
         return offsetof(InlineTypedObject, data_);
diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp
index c2390df844a8..39bc5811c090 100644
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -2976,15 +2976,10 @@ js::TenuringTracer::moveObjectToTenured(JSObject* dst, JSObject* src, AllocKind
         // shape list. This is updated in Nursery::sweepDictionaryModeObjects().
     }
 
-    if (src->is<InlineTypedObject>()) {
-        InlineTypedObject::objectMovedDuringMinorGC(this, dst, src);
-    } else if (src->is<TypedArrayObject>()) {
-        tenuredSize += TypedArrayObject::objectMovedDuringMinorGC(this, dst, src, dstKind);
-    } else if (src->is<UnboxedArrayObject>()) {
-        tenuredSize += UnboxedArrayObject::objectMovedDuringMinorGC(this, dst, src, dstKind);
-    } else if (src->is<ArgumentsObject>()) {
-        tenuredSize += ArgumentsObject::objectMovedDuringMinorGC(this, dst, src);
-    } else if (src->is<ProxyObject>()) {
+    if (src->is<ProxyObject>()) {
+        // TODO: Push this logic into proxy_ObjectMoved and make all proxies use
+        // this.
+
         // Objects in the nursery are never swapped so the proxy must have an
         // inline ProxyValueArray.
         MOZ_ASSERT(src->as<ProxyObject>().usingInlineValueArray());
diff --git a/js/src/gc/Nursery.h b/js/src/gc/Nursery.h
index 1f80406dc9df..e6523a5f9b54 100644
--- a/js/src/gc/Nursery.h
+++ b/js/src/gc/Nursery.h
@@ -217,7 +217,12 @@ class Nursery
     void forwardBufferPointer(HeapSlot** pSlotsElems);
 
     void maybeSetForwardingPointer(JSTracer* trc, void* oldData, void* newData, bool direct) {
-        if (trc->isTenuringTracer() && isInside(oldData))
+        if (trc->isTenuringTracer())
+            setForwardingPointerWhileTenuring(oldData, newData, direct);
+    }
+
+    void setForwardingPointerWhileTenuring(void* oldData, void* newData, bool direct) {
+        if (isInside(oldData))
             setForwardingPointer(oldData, newData, direct);
     }
 
diff --git a/js/src/vm/ArgumentsObject.cpp b/js/src/vm/ArgumentsObject.cpp
index 7349624d316a..6565a21518fe 100644
--- a/js/src/vm/ArgumentsObject.cpp
+++ b/js/src/vm/ArgumentsObject.cpp
@@ -855,12 +855,15 @@ ArgumentsObject::trace(JSTracer* trc, JSObject* obj)
 }
 
 /* static */ size_t
-ArgumentsObject::objectMovedDuringMinorGC(JSTracer* trc, JSObject* dst, JSObject* src)
+ArgumentsObject::objectMoved(JSObject* dst, JSObject* src)
 {
     ArgumentsObject* ndst = &dst->as<ArgumentsObject>();
-    ArgumentsObject* nsrc = &src->as<ArgumentsObject>();
+    const ArgumentsObject* nsrc = &src->as<ArgumentsObject>();
     MOZ_ASSERT(ndst->data() == nsrc->data());
 
+    if (!IsInsideNursery(src))
+        return 0;
+
     Nursery& nursery = dst->zone()->group()->nursery();
 
     size_t nbytesTotal = 0;
@@ -917,6 +920,11 @@ const ClassOps MappedArgumentsObject::classOps_ = {
     ArgumentsObject::trace
 };
 
+const js::ClassExtension MappedArgumentsObject::classExt_ = {
+    nullptr,                      /* weakmapKeyDelegateOp */
+    ArgumentsObject::objectMoved  /* objectMovedOp */
+};
+
 const ObjectOps MappedArgumentsObject::objectOps_ = {
     nullptr,                 /* lookupProperty */
     MappedArgumentsObject::obj_defineProperty
@@ -931,7 +939,7 @@ const Class MappedArgumentsObject::class_ = {
     JSCLASS_BACKGROUND_FINALIZE,
     &MappedArgumentsObject::classOps_,
     nullptr,
-    nullptr,
+    &MappedArgumentsObject::classExt_,
     &MappedArgumentsObject::objectOps_
 };
 
@@ -953,6 +961,11 @@ const ClassOps UnmappedArgumentsObject::classOps_ = {
     ArgumentsObject::trace
 };
 
+const js::ClassExtension UnmappedArgumentsObject::classExt_ = {
+    nullptr,                      /* weakmapKeyDelegateOp */
+    ArgumentsObject::objectMoved  /* objectMovedOp */
+};
+
 const Class UnmappedArgumentsObject::class_ = {
     "Arguments",
     JSCLASS_DELAY_METADATA_BUILDER |
@@ -960,5 +973,7 @@ const Class UnmappedArgumentsObject::class_ = {
     JSCLASS_HAS_CACHED_PROTO(JSProto_Object) |
     JSCLASS_SKIP_NURSERY_FINALIZE |
     JSCLASS_BACKGROUND_FINALIZE,
-    &UnmappedArgumentsObject::classOps_
+    &UnmappedArgumentsObject::classOps_,
+    nullptr,
+    &UnmappedArgumentsObject::classExt_
 };
diff --git a/js/src/vm/ArgumentsObject.h b/js/src/vm/ArgumentsObject.h
index d0e645b3a70d..fb8389478cf5 100644
--- a/js/src/vm/ArgumentsObject.h
+++ b/js/src/vm/ArgumentsObject.h
@@ -361,7 +361,7 @@ class ArgumentsObject : public NativeObject
 
     static void finalize(FreeOp* fop, JSObject* obj);
     static void trace(JSTracer* trc, JSObject* obj);
-    static size_t objectMovedDuringMinorGC(JSTracer* trc, JSObject* dst, JSObject* src);
+    static size_t objectMoved(JSObject* dst, JSObject* src);
 
     /* For jit use: */
     static size_t getDataSlotOffset() {
@@ -399,6 +399,7 @@ class ArgumentsObject : public NativeObject
 class MappedArgumentsObject : public ArgumentsObject
 {
     static const ClassOps classOps_;
+    static const ClassExtension classExt_;
     static const ObjectOps objectOps_;
 
   public:
@@ -428,6 +429,7 @@ class MappedArgumentsObject : public ArgumentsObject
 class UnmappedArgumentsObject : public ArgumentsObject
 {
     static const ClassOps classOps_;
+    static const ClassExtension classExt_;
 
   public:
     static const Class class_;
diff --git a/js/src/vm/TypedArrayObject.cpp b/js/src/vm/TypedArrayObject.cpp
index 186722e13d54..6a8aec630f52 100644
--- a/js/src/vm/TypedArrayObject.cpp
+++ b/js/src/vm/TypedArrayObject.cpp
@@ -184,25 +184,7 @@ TypedArrayObject::finalize(FreeOp* fop, JSObject* obj)
 TypedArrayObject::objectMoved(JSObject* obj, JSObject* old)
 {
     TypedArrayObject* newObj = &obj->as<TypedArrayObject>();
-    const TypedArrayObject* oldObj = &old->as<TypedArrayObject>();
-
-    // Typed arrays with a buffer object do not need an update.
-    if (oldObj->hasBuffer())
-        return 0;
-
-    // Update the data slot pointer if it points to the old JSObject.
-    if (oldObj->hasInlineElements())
-        newObj->setInlineElements();
-
-    return 0;
-}
-
-/* static */ size_t
-TypedArrayObject::objectMovedDuringMinorGC(JSTracer* trc, JSObject* obj, const JSObject* old,
-                                           gc::AllocKind newAllocKind)
-{
-    TypedArrayObject* newObj = &obj->as<TypedArrayObject>();
-    const TypedArrayObject* oldObj = &old->as<TypedArrayObject>();
+    TypedArrayObject* oldObj = &old->as<TypedArrayObject>();
     MOZ_ASSERT(newObj->elementsRaw() == oldObj->elementsRaw());
     MOZ_ASSERT(obj->isTenured());
 
@@ -210,6 +192,14 @@ TypedArrayObject::objectMovedDuringMinorGC(JSTracer* trc, JSObject* obj, const J
     if (oldObj->hasBuffer())
         return 0;
 
+    if (!IsInsideNursery(old)) {
+        // Update the data slot pointer if it points to the old JSObject.
+        if (oldObj->hasInlineElements())
+            newObj->setInlineElements();
+
+        return 0;
+    }
+
     Nursery& nursery = obj->zone()->group()->nursery();
     void* buf = oldObj->elements();
 
@@ -236,6 +226,7 @@ JS_FOR_EACH_TYPED_ARRAY(OBJECT_MOVED_TYPED_ARRAY)
     size_t headerSize = dataOffset() + sizeof(HeapSlot);
 
     // See AllocKindForLazyBuffer.
+    AllocKind newAllocKind = obj->asTenured().getAllocKind();
     MOZ_ASSERT_IF(nbytes == 0, headerSize + sizeof(uint8_t) <= GetGCKindBytes(newAllocKind));
 
     if (headerSize + nbytes <= GetGCKindBytes(newAllocKind)) {
@@ -262,8 +253,8 @@ JS_FOR_EACH_TYPED_ARRAY(OBJECT_MOVED_TYPED_ARRAY)
 
     // Set a forwarding pointer for the element buffers in case they were
     // preserved on the stack by Ion.
-    nursery.maybeSetForwardingPointer(trc, oldObj->elements(), newObj->elements(),
-                                      /* direct = */nbytes >= sizeof(uintptr_t));
+    nursery.setForwardingPointerWhileTenuring(oldObj->elements(), newObj->elements(),
+                                              /* direct = */nbytes >= sizeof(uintptr_t));
 
     return newObj->hasInlineElements() ? 0 : nbytes;
 }
diff --git a/js/src/vm/TypedArrayObject.h b/js/src/vm/TypedArrayObject.h
index fdb342a96125..a9f563481328 100644
--- a/js/src/vm/TypedArrayObject.h
+++ b/js/src/vm/TypedArrayObject.h
@@ -274,8 +274,6 @@ class TypedArrayObject : public NativeObject
     static void trace(JSTracer* trc, JSObject* obj);
     static void finalize(FreeOp* fop, JSObject* obj);
     static size_t objectMoved(JSObject* obj, JSObject* old);
-    static size_t objectMovedDuringMinorGC(JSTracer* trc, JSObject* obj, const JSObject* old,
-                                           gc::AllocKind allocKind);
 
     /* Initialization bits */
 
diff --git a/js/src/vm/UnboxedObject.cpp b/js/src/vm/UnboxedObject.cpp
index e21e7bd73154..0a9cdc621ae7 100644
--- a/js/src/vm/UnboxedObject.cpp
+++ b/js/src/vm/UnboxedObject.cpp
@@ -1203,19 +1203,6 @@ UnboxedArrayObject::trace(JSTracer* trc, JSObject* obj)
     }
 }
 
-/* static */ size_t
-UnboxedArrayObject::objectMoved(JSObject* obj, JSObject* old)
-{
-    UnboxedArrayObject& dst = obj->as<UnboxedArrayObject>();
-    const UnboxedArrayObject& src = old->as<UnboxedArrayObject>();
-
-    // Fix up possible inline data pointer.
-    if (src.hasInlineElements())
-        dst.setInlineElements();
-
-    return 0;
-}
-
 /* static */ void
 UnboxedArrayObject::finalize(FreeOp* fop, JSObject* obj)
 {
@@ -1225,15 +1212,21 @@ UnboxedArrayObject::finalize(FreeOp* fop, JSObject* obj)
 }
 
 /* static */ size_t
-UnboxedArrayObject::objectMovedDuringMinorGC(JSTracer* trc, JSObject* dst, JSObject* src,
-                                             gc::AllocKind allocKind)
+UnboxedArrayObject::objectMoved(JSObject* dst, JSObject* src)
 {
     UnboxedArrayObject* ndst = &dst->as<UnboxedArrayObject>();
     UnboxedArrayObject* nsrc = &src->as<UnboxedArrayObject>();
     MOZ_ASSERT(ndst->elements() == nsrc->elements());
 
-    Nursery& nursery = dst->zone()->group()->nursery();
+    if (!IsInsideNursery(src)) {
+        // Fix up possible inline data pointer.
+        if (nsrc->hasInlineElements())
+            ndst->setInlineElements();
 
+        return 0;
+    }
+
+    Nursery& nursery = dst->zone()->group()->nursery();
     if (!nursery.isInside(nsrc->elements())) {
         nursery.removeMallocedBuffer(nsrc->elements());
         return 0;
@@ -1243,7 +1236,8 @@ UnboxedArrayObject::objectMovedDuringMinorGC(JSTracer* trc, JSObject* dst, JSObj
     // possible, the nursery will have picked an allocation size that is large
     // enough.
     size_t nbytes = nsrc->capacity() * nsrc->elementSize();
-    if (offsetOfInlineElements() + nbytes <= GetGCKindBytes(allocKind)) {
+    gc::AllocKind allocKind = dst->asTenured().getAllocKind();
+    if (offsetOfInlineElements() + nbytes <= gc::GetGCKindBytes(allocKind)) {
         ndst->setInlineElements();
     } else {
         MOZ_ASSERT(allocKind == gc::AllocKind::OBJECT0);
@@ -1260,7 +1254,7 @@ UnboxedArrayObject::objectMovedDuringMinorGC(JSTracer* trc, JSObject* dst, JSObj
     // Set a forwarding pointer for the element buffers in case they were
     // preserved on the stack by Ion.
     bool direct = nsrc->capacity() * nsrc->elementSize() >= sizeof(uintptr_t);
-    nursery.maybeSetForwardingPointer(trc, nsrc->elements(), ndst->elements(), direct);
+    nursery.setForwardingPointerWhileTenuring(nsrc->elements(), ndst->elements(), direct);
 
     return ndst->hasInlineElements() ? 0 : nbytes;
 }
diff --git a/js/src/vm/UnboxedObject.h b/js/src/vm/UnboxedObject.h
index 231e8d502280..335334aba889 100644
--- a/js/src/vm/UnboxedObject.h
+++ b/js/src/vm/UnboxedObject.h
@@ -446,9 +446,6 @@ class UnboxedArrayObject : public UnboxedObject
     static size_t objectMoved(JSObject* obj, JSObject* old);
     static void finalize(FreeOp* fop, JSObject* obj);
 
-    static size_t objectMovedDuringMinorGC(JSTracer* trc, JSObject* dst, JSObject* src,
-                                           gc::AllocKind allocKind);
-
     uint8_t* elements() {
         return elements_;
     }

From 8bd8591183118caa9f4ae50a528082468362b22b Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Tue, 19 Sep 2017 12:31:30 +0100
Subject: [PATCH 21/83] Bug 1396613 - Make proxy objects override handler's
 objectMoved method rather than using class hook r=sfink r=mccr8 r=peterv

---
 dom/base/nsGlobalWindow.cpp          | 14 +++-----
 dom/bindings/Codegen.py              | 49 +++++++++++++++++++---------
 dom/plugins/base/nsJSNPRuntime.cpp   | 18 ++++------
 js/public/Proxy.h                    | 19 ++---------
 js/src/gc/Marking.cpp                | 14 ++------
 js/src/jsapi-tests/testBug604087.cpp |  9 ++---
 js/src/proxy/Proxy.cpp               | 21 ++++++++----
 js/src/proxy/Proxy.h                 |  2 ++
 8 files changed, 68 insertions(+), 78 deletions(-)

diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index 2f9bd20c81b5..e325b3f56879 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -1144,6 +1144,7 @@ public:
                         JS::Handle<JSObject*> wrapper) const override;
 
   void finalize(JSFreeOp *fop, JSObject *proxy) const override;
+  size_t objectMoved(JSObject* proxy, JSObject* old) const override;
 
   bool isCallable(JSObject *obj) const override {
     return false;
@@ -1157,8 +1158,6 @@ public:
   bool unwatch(JSContext *cx, JS::Handle<JSObject*> proxy,
                JS::Handle<jsid> id) const override;
 
-  static size_t ObjectMoved(JSObject *obj, JSObject *old);
-
   static const nsOuterWindowProxy singleton;
 
 protected:
@@ -1188,17 +1187,12 @@ protected:
                                   JS::AutoIdVector &props) const;
 };
 
-static const js::ClassExtension OuterWindowProxyClassExtension = PROXY_MAKE_EXT(
-    nsOuterWindowProxy::ObjectMoved
-);
-
 // Give OuterWindowProxyClass 2 reserved slots, like the other wrappers, so
 // JSObject::swap can swap it with CrossCompartmentWrappers without requiring
 // malloc.
-const js::Class OuterWindowProxyClass = PROXY_CLASS_WITH_EXT(
+const js::Class OuterWindowProxyClass = PROXY_CLASS_DEF(
     "Proxy",
-    JSCLASS_HAS_RESERVED_SLOTS(2), /* additional class flags */
-    &OuterWindowProxyClassExtension);
+    JSCLASS_HAS_RESERVED_SLOTS(2)); /* additional class flags */
 
 const char *
 nsOuterWindowProxy::className(JSContext *cx, JS::Handle<JSObject*> proxy) const
@@ -1527,7 +1521,7 @@ nsOuterWindowProxy::unwatch(JSContext *cx, JS::Handle<JSObject*> proxy,
 }
 
 size_t
-nsOuterWindowProxy::ObjectMoved(JSObject *obj, const JSObject *old)
+nsOuterWindowProxy::objectMoved(JSObject *obj, JSObject *old) const
 {
   nsGlobalWindow* outerWindow = GetOuterWindow(obj);
   if (outerWindow) {
diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index 3b59d5e839ba..616f3f4c41b1 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -544,23 +544,16 @@ class CGDOMProxyJSClass(CGThing):
         # HTMLAllCollection.  So just hardcode it here.
         if self.descriptor.interface.identifier.name == "HTMLAllCollection":
             flags.append("JSCLASS_EMULATES_UNDEFINED")
-        objectMovedHook = OBJECT_MOVED_HOOK_NAME if self.descriptor.wrapperCache else 'nullptr'
         return fill(
             """
-            static const js::ClassExtension sClassExtension = PROXY_MAKE_EXT(
-                ${objectMoved}
-            );
-
             static const DOMJSClass sClass = {
-              PROXY_CLASS_WITH_EXT("${name}",
-                                   ${flags},
-                                   &sClassExtension),
+              PROXY_CLASS_DEF("${name}",
+                              ${flags}),
               $*{descriptor}
             };
             """,
             name=self.descriptor.interface.identifier.name,
             flags=" | ".join(flags),
-            objectMoved=objectMovedHook,
             descriptor=DOMClass(self.descriptor))
 
 
@@ -1731,6 +1724,19 @@ class CGClassFinalizeHook(CGAbstractClassHook):
                             self.args[0].name, self.args[1].name).define()
 
 
+def objectMovedHook(descriptor, hookName, obj, old):
+    assert descriptor.wrapperCache
+    return fill("""
+	if (self) {
+	  UpdateWrapper(self, self, ${obj}, ${old});
+	}
+
+	return 0;
+	""",
+	obj=obj,
+	old=old)
+
+
 class CGClassObjectMovedHook(CGAbstractClassHook):
     """
     A hook for objectMovedOp, used to update the wrapper cache when an object it
@@ -1742,11 +1748,8 @@ class CGClassObjectMovedHook(CGAbstractClassHook):
                                      'size_t', args)
 
     def generate_code(self):
-        assert self.descriptor.wrapperCache
-        return CGList([
-            CGIfWrapper(CGGeneric("UpdateWrapper(self, self, obj, old);\n"),
-                        "self"),
-            CGGeneric("return 0;\n")]).define()
+        return objectMovedHook(self.descriptor, self.name,
+                               self.args[0].name, self.args[1].name)
 
 
 def JSNativeArguments():
@@ -12406,6 +12409,20 @@ class CGDOMJSProxyHandler_finalize(ClassMethod):
                              self.args[0].name, self.args[1].name).define())
 
 
+class CGDOMJSProxyHandler_objectMoved(ClassMethod):
+    def __init__(self, descriptor):
+        args = [Argument('JSObject*', 'obj'), Argument('JSObject*', 'old')]
+        ClassMethod.__init__(self, "objectMoved", "size_t", args,
+                             virtual=True, override=True, const=True)
+        self.descriptor = descriptor
+
+    def getBody(self):
+        return (("%s* self = UnwrapPossiblyNotInitializedDOMObject<%s>(obj);\n" %
+                 (self.descriptor.nativeType, self.descriptor.nativeType)) +
+                objectMovedHook(self.descriptor, OBJECT_MOVED_HOOK_NAME,
+                                self.args[0].name, self.args[1].name))
+
+
 class CGDOMJSProxyHandler_getElements(ClassMethod):
     def __init__(self, descriptor):
         assert descriptor.supportsIndexedProperties()
@@ -12581,6 +12598,8 @@ class CGDOMJSProxyHandler(CGClass):
                 raise TypeError("Need a wrapper cache to support nursery "
                                 "allocation of DOM objects")
             methods.append(CGDOMJSProxyHandler_canNurseryAllocate())
+        if descriptor.wrapperCache:
+            methods.append(CGDOMJSProxyHandler_objectMoved(descriptor))
 
         if descriptor.interface.getExtendedAttribute('OverrideBuiltins'):
             parentClass = 'ShadowingDOMProxyHandler'
@@ -12837,7 +12856,7 @@ class CGDescriptor(CGThing):
             # wants a custom hook.
             cgThings.append(CGClassFinalizeHook(descriptor))
 
-        if descriptor.concrete and descriptor.wrapperCache:
+        if descriptor.concrete and descriptor.wrapperCache and not descriptor.proxy:
             cgThings.append(CGClassObjectMovedHook(descriptor))
 
         # Generate the _ClearCachedFooValue methods before the property arrays that use them.
diff --git a/dom/plugins/base/nsJSNPRuntime.cpp b/dom/plugins/base/nsJSNPRuntime.cpp
index 38bd7f072efa..b0cf985b74b1 100644
--- a/dom/plugins/base/nsJSNPRuntime.cpp
+++ b/dom/plugins/base/nsJSNPRuntime.cpp
@@ -232,6 +232,8 @@ public:
     return false;
   }
   void finalize(JSFreeOp* fop, JSObject* proxy) const override;
+
+  size_t objectMoved(JSObject* obj, JSObject* old) const override;
 };
 
 const char NPObjWrapperProxyHandler::family = 0;
@@ -241,9 +243,6 @@ static bool
 NPObjWrapper_Resolve(JSContext *cx, JS::Handle<JSObject*> obj, JS::Handle<jsid> id,
                      bool* resolved, JS::MutableHandle<JSObject*> method);
 
-static size_t
-NPObjWrapper_ObjectMoved(JSObject *obj, JSObject *old);
-
 static bool
 NPObjWrapper_toPrimitive(JSContext *cx, unsigned argc, JS::Value *vp);
 
@@ -253,14 +252,9 @@ CreateNPObjectMember(NPP npp, JSContext *cx,
                      JS::Handle<jsid> id,  NPVariant* getPropertyResult,
                      JS::MutableHandle<JS::Value> vp);
 
-static const js::ClassExtension sNPObjWrapperProxyClassExtension = PROXY_MAKE_EXT(
-    NPObjWrapper_ObjectMoved
-);
-
-const js::Class sNPObjWrapperProxyClass = PROXY_CLASS_WITH_EXT(
+const js::Class sNPObjWrapperProxyClass = PROXY_CLASS_DEF(
     NPRUNTIME_JSCLASS_NAME,
-    JSCLASS_HAS_RESERVED_SLOTS(1),
-    &sNPObjWrapperProxyClassExtension);
+    JSCLASS_HAS_RESERVED_SLOTS(1));
 
 typedef struct NPObjectMemberPrivate {
     JS::Heap<JSObject *> npobjWrapper;
@@ -1787,8 +1781,8 @@ NPObjWrapperProxyHandler::finalize(JSFreeOp* fop, JSObject* proxy) const
   sDelayedReleases->AppendElement(npobj);
 }
 
-static size_t
-NPObjWrapper_ObjectMoved(JSObject *obj, JSObject *old)
+size_t
+NPObjWrapperProxyHandler::objectMoved(JSObject *obj, JSObject *old) const
 {
   // The wrapper JSObject has been moved, so we need to update the entry in the
   // sNPObjWrappers hash table, if present.
diff --git a/js/public/Proxy.h b/js/public/Proxy.h
index 39b111096c05..125c11feb7d9 100644
--- a/js/public/Proxy.h
+++ b/js/public/Proxy.h
@@ -684,18 +684,6 @@ extern JS_FRIEND_DATA(const js::ClassOps) ProxyClassOps;
 extern JS_FRIEND_DATA(const js::ClassExtension) ProxyClassExtension;
 extern JS_FRIEND_DATA(const js::ObjectOps) ProxyObjectOps;
 
-/*
- * Helper Macros for creating JSClasses that function as proxies.
- *
- * NB: The macro invocation must be surrounded by braces, so as to
- *     allow for potential JSClass extensions.
- */
-#define PROXY_MAKE_EXT(objectMoved)                                     \
-    {                                                                   \
-        js::proxy_WeakmapKeyDelegate,                                   \
-        objectMoved                                                     \
-    }
-
 template <unsigned Flags>
 constexpr unsigned
 CheckProxyFlags()
@@ -722,7 +710,7 @@ CheckProxyFlags()
     return Flags;
 }
 
-#define PROXY_CLASS_WITH_EXT(name, flags, extPtr)                                       \
+#define PROXY_CLASS_DEF(name, flags)                                                    \
     {                                                                                   \
         name,                                                                           \
         js::Class::NON_NATIVE |                                                         \
@@ -731,13 +719,10 @@ CheckProxyFlags()
             js::CheckProxyFlags<flags>(),                                               \
         &js::ProxyClassOps,                                                             \
         JS_NULL_CLASS_SPEC,                                                             \
-        extPtr,                                                                         \
+        &js::ProxyClassExtension,                                                       \
         &js::ProxyObjectOps                                                             \
     }
 
-#define PROXY_CLASS_DEF(name, flags) \
-  PROXY_CLASS_WITH_EXT(name, flags, &js::ProxyClassExtension)
-
 } /* namespace js */
 
 #endif /* js_Proxy_h */
diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp
index 39bc5811c090..4487594f97a8 100644
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -2976,17 +2976,9 @@ js::TenuringTracer::moveObjectToTenured(JSObject* dst, JSObject* src, AllocKind
         // shape list. This is updated in Nursery::sweepDictionaryModeObjects().
     }
 
-    if (src->is<ProxyObject>()) {
-        // TODO: Push this logic into proxy_ObjectMoved and make all proxies use
-        // this.
-
-        // Objects in the nursery are never swapped so the proxy must have an
-        // inline ProxyValueArray.
-        MOZ_ASSERT(src->as<ProxyObject>().usingInlineValueArray());
-        dst->as<ProxyObject>().setInlineValueArray();
-        if (JSObjectMovedOp op = dst->getClass()->extObjectMovedOp())
-            tenuredSize += op(dst, src);
-    } else if (JSObjectMovedOp op = dst->getClass()->extObjectMovedOp()) {
+    JSObjectMovedOp op = dst->getClass()->extObjectMovedOp();
+    MOZ_ASSERT_IF(src->is<ProxyObject>(), op == proxy_ObjectMoved);
+    if (op) {
         tenuredSize += op(dst, src);
     } else {
         MOZ_ASSERT_IF(src->getClass()->hasFinalize(),
diff --git a/js/src/jsapi-tests/testBug604087.cpp b/js/src/jsapi-tests/testBug604087.cpp
index 3d415ced24b7..81f5e8ab7995 100644
--- a/js/src/jsapi-tests/testBug604087.cpp
+++ b/js/src/jsapi-tests/testBug604087.cpp
@@ -14,14 +14,9 @@
 
 #include "vm/ProxyObject.h"
 
-static const js::ClassExtension OuterWrapperClassExtension = PROXY_MAKE_EXT(
-    nullptr  /* objectMoved */
-);
-
-const js::Class OuterWrapperClass = PROXY_CLASS_WITH_EXT(
+const js::Class OuterWrapperClass = PROXY_CLASS_DEF(
     "Proxy",
-    JSCLASS_HAS_RESERVED_SLOTS(1), /* additional class flags */
-    &OuterWrapperClassExtension);
+    JSCLASS_HAS_RESERVED_SLOTS(1) /* additional class flags */);
 
 static JSObject*
 wrap(JSContext* cx, JS::HandleObject toWrap, JS::HandleObject target)
diff --git a/js/src/proxy/Proxy.cpp b/js/src/proxy/Proxy.cpp
index 5cdc80800e50..bc46a65c1be1 100644
--- a/js/src/proxy/Proxy.cpp
+++ b/js/src/proxy/Proxy.cpp
@@ -741,11 +741,19 @@ proxy_Finalize(FreeOp* fop, JSObject* obj)
         js_free(js::detail::GetProxyDataLayout(obj)->values());
 }
 
-static size_t
-proxy_ObjectMoved(JSObject* obj, JSObject* old)
+size_t
+js::proxy_ObjectMoved(JSObject* obj, JSObject* old)
 {
-    MOZ_ASSERT(obj->is<ProxyObject>());
-    return obj->as<ProxyObject>().handler()->objectMoved(obj, old);
+    ProxyObject& proxy = obj->as<ProxyObject>();
+
+    if (IsInsideNursery(old)) {
+        // Objects in the nursery are never swapped so the proxy must have an
+        // inline ProxyValueArray.
+        MOZ_ASSERT(old->as<ProxyObject>().usingInlineValueArray());
+        proxy.setInlineValueArray();
+    }
+
+    return proxy.handler()->objectMoved(obj, old);
 }
 
 bool
@@ -780,9 +788,10 @@ const ClassOps js::ProxyClassOps = {
     ProxyObject::trace,      /* trace       */
 };
 
-const ClassExtension js::ProxyClassExtension = PROXY_MAKE_EXT(
+const ClassExtension js::ProxyClassExtension = {
+    proxy_WeakmapKeyDelegate,
     proxy_ObjectMoved
-);
+};
 
 const ObjectOps js::ProxyObjectOps = {
     proxy_LookupProperty,
diff --git a/js/src/proxy/Proxy.h b/js/src/proxy/Proxy.h
index 1f564749d2bf..b6919605048a 100644
--- a/js/src/proxy/Proxy.h
+++ b/js/src/proxy/Proxy.h
@@ -80,6 +80,8 @@ bool
 proxy_Call(JSContext* cx, unsigned argc, Value* vp);
 bool
 proxy_Construct(JSContext* cx, unsigned argc, Value* vp);
+size_t
+proxy_ObjectMoved(JSObject* obj, JSObject* old);
 
 // These functions are used by JIT code
 

From ff71be3b981486397a44014b2ebaa7c6717ad80f Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Tue, 19 Sep 2017 12:31:31 +0100
Subject: [PATCH 22/83] Bug 1396613 - Update rust glue with new objectMoved
 hook signature r=fitzgen

---
 js/rust/src/glue.rs    |  3 ++-
 js/rust/src/jsglue.cpp | 25 +++++++------------------
 2 files changed, 9 insertions(+), 19 deletions(-)

diff --git a/js/rust/src/glue.rs b/js/rust/src/glue.rs
index c5c274d2e71d..362c08d69cb0 100644
--- a/js/rust/src/glue.rs
+++ b/js/rust/src/glue.rs
@@ -133,7 +133,8 @@ pub struct ProxyTraps {
     pub finalize:
         ::std::option::Option<unsafe extern "C" fn(fop: *mut JSFreeOp, proxy: *mut JSObject)>,
     pub objectMoved:
-        ::std::option::Option<unsafe extern "C" fn(proxy: *mut JSObject, old: *const JSObject)>,
+        ::std::option::Option<unsafe extern "C" fn(proxy: *mut JSObject,
+                                                   old: *mut JSObject) -> usize>,
     pub isCallable: ::std::option::Option<unsafe extern "C" fn(obj: *mut JSObject) -> bool>,
     pub isConstructor: ::std::option::Option<unsafe extern "C" fn(obj: *mut JSObject) -> bool>,
 }
diff --git a/js/rust/src/jsglue.cpp b/js/rust/src/jsglue.cpp
index fe758f86be99..a38b730fc958 100644
--- a/js/rust/src/jsglue.cpp
+++ b/js/rust/src/jsglue.cpp
@@ -85,7 +85,7 @@ struct ProxyTraps {
     bool (*defaultValue)(JSContext *cx, JS::HandleObject obj, JSType hint, JS::MutableHandleValue vp);
     void (*trace)(JSTracer *trc, JSObject *proxy);
     void (*finalize)(JSFreeOp *fop, JSObject *proxy);
-    void (*objectMoved)(JSObject *proxy, const JSObject *old);
+    size_t (*objectMoved)(JSObject *proxy, JSObject *old);
 
     bool (*isCallable)(JSObject *obj);
     bool (*isConstructor)(JSObject *obj);
@@ -226,12 +226,11 @@ static int HandlerFamily;
         : _base::finalize(fop, proxy);                                          \
     }                                                                           \
                                                                                 \
-    virtual void objectMoved(JSObject* proxy,                                   \
-                             const JSObject *old) const override                \
+    virtual size_t objectMoved(JSObject* proxy, JSObject *old) const override   \
     {                                                                           \
-        mTraps.objectMoved                                                      \
-        ? mTraps.objectMoved(proxy, old)                                        \
-        : _base::objectMoved(proxy, old);                                       \
+        return mTraps.objectMoved                                               \
+               ? mTraps.objectMoved(proxy, old)                                 \
+               : _base::objectMoved(proxy, old);                                \
     }                                                                           \
                                                                                 \
     virtual bool isCallable(JSObject* obj) const override                       \
@@ -568,19 +567,9 @@ WrapperNew(JSContext* aCx, JS::HandleObject aObj, const void* aHandler,
     return js::Wrapper::New(aCx, aObj, (const js::Wrapper*)aHandler, options);
 }
 
-void WindowProxyObjectMoved(JSObject*, const JSObject*)
-{
-    abort();
-}
-
-static const js::ClassExtension WindowProxyClassExtension = PROXY_MAKE_EXT(
-    WindowProxyObjectMoved
-);
-
-const js::Class WindowProxyClass = PROXY_CLASS_WITH_EXT(
+const js::Class WindowProxyClass = PROXY_CLASS_DEF(
     "Proxy",
-    JSCLASS_HAS_RESERVED_SLOTS(1), /* additional class flags */
-    &WindowProxyClassExtension);
+    JSCLASS_HAS_RESERVED_SLOTS(1)); /* additional class flags */
 
 const js::Class*
 GetWindowProxyClass()

From ae251056d7e51d052e0d7a0599a37336d1c1ec59 Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Tue, 19 Sep 2017 12:31:31 +0100
Subject: [PATCH 23/83] Bug 1399944 - Check for valid GC cell pointers in
 various places r=sfink

---
 js/public/GCPolicyAPI.h                  | 36 +++++++++++++++++++++
 js/public/GCVariant.h                    | 13 ++++++++
 js/public/HeapAPI.h                      | 40 +++++++++++++++++++++---
 js/public/Id.h                           |  3 ++
 js/public/Realm.h                        |  3 +-
 js/public/RootingAPI.h                   |  6 ++++
 js/public/Value.h                        | 11 ++++---
 js/src/gc/Heap.h                         |  3 ++
 js/src/gc/Policy.h                       |  3 ++
 js/src/jit/RematerializedFrame.h         | 12 ++-----
 js/src/jsapi-tests/testGCGrayMarking.cpp |  7 ++---
 js/src/jsgc.cpp                          |  1 +
 js/src/vm/Scope.h                        | 12 +------
 13 files changed, 114 insertions(+), 36 deletions(-)

diff --git a/js/public/GCPolicyAPI.h b/js/public/GCPolicyAPI.h
index 09489e506222..725c789e4df7 100644
--- a/js/public/GCPolicyAPI.h
+++ b/js/public/GCPolicyAPI.h
@@ -94,6 +94,10 @@ struct StructGCPolicy
     static bool needsSweep(T* tp) {
         return tp->needsSweep();
     }
+
+    static bool isValid(const T& tp) {
+        return true;
+    }
 };
 
 // The default GC policy attempts to defer to methods on the underlying type.
@@ -108,6 +112,7 @@ struct IgnoreGCPolicy {
     static T initial() { return T(); }
     static void trace(JSTracer* trc, T* t, const char* name) {}
     static bool needsSweep(T* v) { return false; }
+    static bool isValid(const T& v) { return true; }
 };
 template <> struct GCPolicy<uint32_t> : public IgnoreGCPolicy<uint32_t> {};
 template <> struct GCPolicy<uint64_t> : public IgnoreGCPolicy<uint64_t> {};
@@ -125,6 +130,9 @@ struct GCPointerPolicy
             return js::gc::IsAboutToBeFinalizedUnbarriered(vp);
         return false;
     }
+    static bool isValid(T v) {
+        return js::gc::IsCellPointerValid(v);
+    }
 };
 template <> struct GCPolicy<JS::Symbol*> : public GCPointerPolicy<JS::Symbol*> {};
 template <> struct GCPolicy<JSAtom*> : public GCPointerPolicy<JSAtom*> {};
@@ -133,6 +141,24 @@ template <> struct GCPolicy<JSObject*> : public GCPointerPolicy<JSObject*> {};
 template <> struct GCPolicy<JSScript*> : public GCPointerPolicy<JSScript*> {};
 template <> struct GCPolicy<JSString*> : public GCPointerPolicy<JSString*> {};
 
+template <typename T>
+struct NonGCPointerPolicy
+{
+    static T initial() { return nullptr; }
+    static void trace(JSTracer* trc, T* vp, const char* name) {
+        if (*vp)
+            (*vp)->trace(trc);
+    }
+    static bool needsSweep(T* vp) {
+        if (*vp)
+            return (*vp)->needsSweep();
+        return false;
+    }
+    static bool isValid(T v) {
+        return true;
+    }
+};
+
 template <typename T>
 struct GCPolicy<JS::Heap<T>>
 {
@@ -158,6 +184,11 @@ struct GCPolicy<mozilla::UniquePtr<T, D>>
             return GCPolicy<T>::needsSweep(tp->get());
         return false;
     }
+    static bool isValid(const mozilla::UniquePtr<T,D>& t) {
+        if (t.get())
+            return GCPolicy<T>::isValid(*t.get());
+        return true;
+    }
 };
 
 // GCPolicy<Maybe<T>> forwards tracing/sweeping to GCPolicy<T*> if
@@ -175,6 +206,11 @@ struct GCPolicy<mozilla::Maybe<T>>
             return GCPolicy<T>::needsSweep(tp->ptr());
         return false;
     }
+    static bool isValid(const mozilla::Maybe<T>& t) {
+        if (t.isSome())
+            return GCPolicy<T>::isValid(t.ref());
+        return true;
+    }
 };
 
 template <> struct GCPolicy<JS::Realm*>;  // see Realm.h
diff --git a/js/public/GCVariant.h b/js/public/GCVariant.h
index 3e11de2136d8..2f465127bf0a 100644
--- a/js/public/GCVariant.h
+++ b/js/public/GCVariant.h
@@ -118,6 +118,19 @@ struct GCPolicy<mozilla::Variant<Ts...>>
     static void trace(JSTracer* trc, mozilla::Variant<Ts...>* v, const char* name) {
         Impl::trace(trc, v, name);
     }
+
+    static bool isValid(const mozilla::Variant<Ts...>& v) {
+        return v.match(IsValidMatcher());
+    }
+
+  private:
+    struct IsValidMatcher
+    {
+        template<typename T>
+        bool match(T& v) {
+            return GCPolicy<T>::isValid(v);
+        };
+    };
 };
 
 } // namespace JS
diff --git a/js/public/HeapAPI.h b/js/public/HeapAPI.h
index 34a3e156e66d..dba94f42ff21 100644
--- a/js/public/HeapAPI.h
+++ b/js/public/HeapAPI.h
@@ -53,6 +53,7 @@ const size_t ChunkMarkBitmapBits = 129024;
 const size_t ChunkRuntimeOffset = ChunkSize - sizeof(void*);
 const size_t ChunkTrailerSize = 2 * sizeof(uintptr_t) + sizeof(uint64_t);
 const size_t ChunkLocationOffset = ChunkSize - ChunkTrailerSize;
+const size_t ChunkStoreBufferOffset = ChunkLocationOffset + sizeof(uint64_t);
 const size_t ArenaZoneOffset = sizeof(size_t);
 const size_t ArenaHeaderSize = sizeof(size_t) + 2 * sizeof(uintptr_t) +
                                sizeof(size_t) + sizeof(uintptr_t);
@@ -372,6 +373,24 @@ extern JS_PUBLIC_API(bool)
 CellIsNotGray(const Cell* cell);
 #endif
 
+MOZ_ALWAYS_INLINE ChunkLocation
+GetCellLocation(const void* cell)
+{
+    uintptr_t addr = uintptr_t(cell);
+    addr &= ~js::gc::ChunkMask;
+    addr |= js::gc::ChunkLocationOffset;
+    return *reinterpret_cast<ChunkLocation*>(addr);
+}
+
+MOZ_ALWAYS_INLINE bool
+NurseryCellHasStoreBuffer(const void* cell)
+{
+    uintptr_t addr = uintptr_t(cell);
+    addr &= ~js::gc::ChunkMask;
+    addr |= js::gc::ChunkStoreBufferOffset;
+    return *reinterpret_cast<void**>(addr) != nullptr;
+}
+
 } /* namespace detail */
 
 MOZ_ALWAYS_INLINE bool
@@ -379,14 +398,27 @@ IsInsideNursery(const js::gc::Cell* cell)
 {
     if (!cell)
         return false;
-    uintptr_t addr = uintptr_t(cell);
-    addr &= ~js::gc::ChunkMask;
-    addr |= js::gc::ChunkLocationOffset;
-    auto location = *reinterpret_cast<ChunkLocation*>(addr);
+    auto location = detail::GetCellLocation(cell);
     MOZ_ASSERT(location == ChunkLocation::Nursery || location == ChunkLocation::TenuredHeap);
     return location == ChunkLocation::Nursery;
 }
 
+MOZ_ALWAYS_INLINE bool
+IsCellPointerValid(const void* cell)
+{
+    if (!cell)
+        return true;
+    auto addr = uintptr_t(cell);
+    if (addr < ChunkSize || addr % CellAlignBytes != 0)
+        return false;
+    auto location = detail::GetCellLocation(cell);
+    if (location == ChunkLocation::TenuredHeap)
+        return !!detail::GetGCThingZone(addr);
+    if (location == ChunkLocation::Nursery)
+        return detail::NurseryCellHasStoreBuffer(cell);
+    return false;
+}
+
 } /* namespace gc */
 } /* namespace js */
 
diff --git a/js/public/Id.h b/js/public/Id.h
index 746638aa6fc4..db79eddc515b 100644
--- a/js/public/Id.h
+++ b/js/public/Id.h
@@ -171,6 +171,9 @@ struct GCPolicy<jsid>
     static void trace(JSTracer* trc, jsid* idp, const char* name) {
         js::UnsafeTraceManuallyBarrieredEdge(trc, idp, name);
     }
+    static bool isValid(jsid id) {
+        return !JSID_IS_GCTHING(id) || js::gc::IsCellPointerValid(JSID_TO_GCTHING(id).asCell());
+    }
 };
 
 } // namespace JS
diff --git a/js/public/Realm.h b/js/public/Realm.h
index d5200a5defdb..8ddc512bdc24 100644
--- a/js/public/Realm.h
+++ b/js/public/Realm.h
@@ -28,9 +28,8 @@ namespace JS {
 
 // Each Realm holds a strong reference to its GlobalObject, and vice versa.
 template <>
-struct GCPolicy<Realm*>
+struct GCPolicy<Realm*> : public NonGCPointerPolicy<Realm*>
 {
-    static Realm* initial() { return nullptr; }
     static void trace(JSTracer* trc, Realm** vp, const char* name) {
         if (*vp)
             ::js::gc::TraceRealm(trc, *vp, name);
diff --git a/js/public/RootingAPI.h b/js/public/RootingAPI.h
index fc28ee34b1fa..74a61af93703 100644
--- a/js/public/RootingAPI.h
+++ b/js/public/RootingAPI.h
@@ -396,6 +396,7 @@ class TenuredHeap : public js::HeapBase<T, TenuredHeap<T>>
 
     void setPtr(T newPtr) {
         MOZ_ASSERT((reinterpret_cast<uintptr_t>(newPtr) & flagsMask) == 0);
+        MOZ_ASSERT(js::gc::IsCellPointerValid(newPtr));
         if (newPtr)
             AssertGCThingMustBeTenured(newPtr);
         bits = (bits & flagsMask) | reinterpret_cast<uintptr_t>(newPtr);
@@ -571,9 +572,11 @@ class MOZ_STACK_CLASS MutableHandle : public js::MutableHandleBase<T, MutableHan
   public:
     void set(const T& v) {
         *ptr = v;
+        MOZ_ASSERT(GCPolicy<T>::isValid(*ptr));
     }
     void set(T&& v) {
         *ptr = mozilla::Move(v);
+        MOZ_ASSERT(GCPolicy<T>::isValid(*ptr));
     }
 
     /*
@@ -818,6 +821,7 @@ class MOZ_RAII Rooted : public js::RootedBase<T, Rooted<T>>
     Rooted(const RootingContext& cx, S&& initial)
       : ptr(mozilla::Forward<S>(initial))
     {
+        MOZ_ASSERT(GCPolicy<T>::isValid(ptr));
         registerWithRootLists(rootLists(cx));
     }
 
@@ -834,9 +838,11 @@ class MOZ_RAII Rooted : public js::RootedBase<T, Rooted<T>>
      */
     void set(const T& value) {
         ptr = value;
+        MOZ_ASSERT(GCPolicy<T>::isValid(ptr));
     }
     void set(T&& value) {
         ptr = mozilla::Move(value);
+        MOZ_ASSERT(GCPolicy<T>::isValid(ptr));
     }
 
     DECLARE_POINTER_CONSTREF_OPS(T);
diff --git a/js/public/Value.h b/js/public/Value.h
index 92ab005a7123..8734365de880 100644
--- a/js/public/Value.h
+++ b/js/public/Value.h
@@ -354,17 +354,17 @@ class MOZ_NON_PARAM alignas(8) Value
     }
 
     void setString(JSString* str) {
-        MOZ_ASSERT(uintptr_t(str) > 0x1000);
+        MOZ_ASSERT(js::gc::IsCellPointerValid(str));
         data.asBits = bitsFromTagAndPayload(JSVAL_TAG_STRING, PayloadType(str));
     }
 
     void setSymbol(JS::Symbol* sym) {
-        MOZ_ASSERT(uintptr_t(sym) > 0x1000);
+        MOZ_ASSERT(js::gc::IsCellPointerValid(sym));
         data.asBits = bitsFromTagAndPayload(JSVAL_TAG_SYMBOL, PayloadType(sym));
     }
 
     void setObject(JSObject& obj) {
-        MOZ_ASSERT(uintptr_t(&obj) >= 0x1000);
+        MOZ_ASSERT(js::gc::IsCellPointerValid(&obj));
 #if defined(JS_PUNBOX64)
         // VisualStudio cannot contain parenthesized C++ style cast and shift
         // inside decltype in template parameter:
@@ -756,7 +756,7 @@ class MOZ_NON_PARAM alignas(8) Value
         MOZ_ASSERT(JS::GCThingTraceKind(cell) != JS::TraceKind::Object,
                    "Private GC thing Values must not be objects. Make an ObjectValue instead.");
 
-        MOZ_ASSERT(uintptr_t(cell) > 0x1000);
+        MOZ_ASSERT(js::gc::IsCellPointerValid(cell));
 #if defined(JS_PUNBOX64)
         // VisualStudio cannot contain parenthesized C++ style cast and shift
         // inside decltype in template parameter:
@@ -1259,6 +1259,9 @@ struct GCPolicy<JS::Value>
     static bool isTenured(const Value& thing) {
         return !thing.isGCThing() || !IsInsideNursery(thing.toGCThing());
     }
+    static bool isValid(const Value& value) {
+        return !value.isGCThing() || js::gc::IsCellPointerValid(value.toGCThing());
+    }
 };
 
 } // namespace JS
diff --git a/js/src/gc/Heap.h b/js/src/gc/Heap.h
index 346a830ea46b..1e840b8a3606 100644
--- a/js/src/gc/Heap.h
+++ b/js/src/gc/Heap.h
@@ -1107,6 +1107,9 @@ static_assert(js::gc::ChunkRuntimeOffset == offsetof(Chunk, trailer) +
 static_assert(js::gc::ChunkLocationOffset == offsetof(Chunk, trailer) +
                                              offsetof(ChunkTrailer, location),
               "The hardcoded API location offset must match the actual offset.");
+static_assert(js::gc::ChunkStoreBufferOffset == offsetof(Chunk, trailer) +
+                                                offsetof(ChunkTrailer, storeBuffer),
+              "The hardcoded API storeBuffer offset must match the actual offset.");
 
 /*
  * Tracks the used sizes for owned heap data and automatically maintains the
diff --git a/js/src/gc/Policy.h b/js/src/gc/Policy.h
index 280054256410..287ad0ba2299 100644
--- a/js/src/gc/Policy.h
+++ b/js/src/gc/Policy.h
@@ -126,6 +126,9 @@ struct InternalGCPointerPolicy {
     static void trace(JSTracer* trc, T* vp, const char* name) {
         TraceManuallyBarrieredEdge(trc, vp, name);
     }
+    static bool isValid(T v) {
+        return gc::IsCellPointerValid(v);
+    }
 };
 
 } // namespace js
diff --git a/js/src/jit/RematerializedFrame.h b/js/src/jit/RematerializedFrame.h
index 963554a65335..ff2e02a24516 100644
--- a/js/src/jit/RematerializedFrame.h
+++ b/js/src/jit/RematerializedFrame.h
@@ -259,16 +259,8 @@ struct MapTypeToRootKind<js::jit::RematerializedFrame*>
 
 template <>
 struct GCPolicy<js::jit::RematerializedFrame*>
-{
-    static js::jit::RematerializedFrame* initial() {
-        return nullptr;
-    }
-
-    static void trace(JSTracer* trc, js::jit::RematerializedFrame** frame, const char* name) {
-        if (*frame)
-            (*frame)->trace(trc);
-    }
-};
+  : public NonGCPointerPolicy<js::jit::RematerializedFrame*>
+{};
 
 } // namespace JS
 
diff --git a/js/src/jsapi-tests/testGCGrayMarking.cpp b/js/src/jsapi-tests/testGCGrayMarking.cpp
index e38413bd0477..806c214a3be8 100644
--- a/js/src/jsapi-tests/testGCGrayMarking.cpp
+++ b/js/src/jsapi-tests/testGCGrayMarking.cpp
@@ -27,11 +27,8 @@ struct MapTypeToRootKind<js::ObjectWeakMap*> {
 };
 
 template <>
-struct GCPolicy<js::ObjectWeakMap*> {
-    static void trace(JSTracer* trc, js::ObjectWeakMap** tp, const char* name) {
-        (*tp)->trace(trc);
-    }
-};
+struct GCPolicy<js::ObjectWeakMap*> : public NonGCPointerPolicy<js::ObjectWeakMap*>
+{};
 
 } // namespace JS
 
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index dbcf0959da17..43c95e2b9514 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -8083,6 +8083,7 @@ JS::AssertGCThingIsNotAnObjectSubclass(Cell* cell)
 JS_FRIEND_API(void)
 js::gc::AssertGCThingHasType(js::gc::Cell* cell, JS::TraceKind kind)
 {
+    MOZ_ASSERT(IsCellPointerValid(cell));
     if (!cell)
         MOZ_ASSERT(kind == JS::TraceKind::Null);
     else if (IsInsideNursery(cell))
diff --git a/js/src/vm/Scope.h b/js/src/vm/Scope.h
index 6200690773c6..0876da443f62 100644
--- a/js/src/vm/Scope.h
+++ b/js/src/vm/Scope.h
@@ -1517,17 +1517,7 @@ struct GCPolicy<js::ScopeKind> : public IgnoreGCPolicy<js::ScopeKind>
 { };
 
 template <typename T>
-struct ScopeDataGCPolicy
-{
-    static T initial() {
-        return nullptr;
-    }
-
-    static void trace(JSTracer* trc, T* vp, const char* name) {
-        if (*vp)
-            (*vp)->trace(trc);
-    }
-};
+struct ScopeDataGCPolicy : public NonGCPointerPolicy<T> {};
 
 #define DEFINE_SCOPE_DATA_GCPOLICY(Data)                        \
     template <>                                                 \

From 39b7095b54f8c5decc8954fc466cd6bd4a669c0a Mon Sep 17 00:00:00 2001
From: Andrew Osmond <aosmond@mozilla.com>
Date: Tue, 19 Sep 2017 08:19:48 -0400
Subject: [PATCH 24/83] Bug 1380649 - Part 1. Ensure
 SurfaceCache::CollectSizeOfSurfaces removes purged volatile buffer-backed
 surfaces. r=tnikkel

When we lookup a surface in the cache, we are careful to remove any
surfaces which were backed by volatile memory and got purged before we
could reacquire the buffer. We were not so careful in doing that when
generating memory reports. ISurfaceProvider::AddSizeOfExcludingThis will
cause us to acquire the buffer, and if it was purged, forget about its
purged status. Later when we performed a lookup, we would forget the
purged status, and assume we have the right data. This would appear as
completely transparent for BGRA surfaces, and completely black for BGRX
surfaces.

With this patch, we now properly remove purged surfaces instead of
including them in the report. This ensures that the cache state is
consistent. This also resolves memory reports of surfaces which reported
using no data -- they were purged when the report was generated.

Additionally, there was a bug in SurfaceCache::PruneImage where we did
not discard surfaces outside the module lock. Both PruneImage and
CollectSizeOfSurfaces now free any discarded surfaces outside the lock.
---
 image/SurfaceCache.cpp | 57 +++++++++++++++++++++++++++++++++---------
 1 file changed, 45 insertions(+), 12 deletions(-)

diff --git a/image/SurfaceCache.cpp b/image/SurfaceCache.cpp
index 877893fd3c7b..543dd3a4142c 100644
--- a/image/SurfaceCache.cpp
+++ b/image/SurfaceCache.cpp
@@ -614,12 +614,29 @@ public:
     return false;
   }
 
+  template<typename Function>
   void CollectSizeOfSurfaces(nsTArray<SurfaceMemoryCounter>& aCounters,
-                             MallocSizeOf                    aMallocSizeOf)
+                             MallocSizeOf                    aMallocSizeOf,
+                             Function&&                      aRemoveCallback)
   {
     CachedSurface::SurfaceMemoryReport report(aCounters, aMallocSizeOf);
-    for (auto iter = ConstIter(); !iter.Done(); iter.Next()) {
+    for (auto iter = mSurfaces.Iter(); !iter.Done(); iter.Next()) {
       NotNull<CachedSurface*> surface = WrapNotNull(iter.UserData());
+
+      // We don't need the drawable surface for ourselves, but adding a surface
+      // to the report will trigger this indirectly. If the surface was
+      // discarded by the OS because it was in volatile memory, we should remove
+      // it from the cache immediately rather than include it in the report.
+      DrawableSurface drawableSurface;
+      if (!surface->IsPlaceholder()) {
+        drawableSurface = surface->GetDrawableSurface();
+        if (!drawableSurface) {
+          aRemoveCallback(surface);
+          iter.Remove();
+          continue;
+        }
+      }
+
       const IntSize& size = surface->GetSurfaceKey().Size();
       bool factor2Size = false;
       if (mFactor2Mode) {
@@ -1073,6 +1090,8 @@ public:
 
     cache->Prune([this, &aAutoLock](NotNull<CachedSurface*> aSurface) -> void {
       StopTracking(aSurface, /* aIsTracked */ true, aAutoLock);
+      // Individual surfaces must be freed outside the lock.
+      mCachedSurfacesDiscard.AppendElement(aSurface);
     });
   }
 
@@ -1165,7 +1184,8 @@ public:
 
   void CollectSizeOfSurfaces(const ImageKey                  aImageKey,
                              nsTArray<SurfaceMemoryCounter>& aCounters,
-                             MallocSizeOf                    aMallocSizeOf)
+                             MallocSizeOf                    aMallocSizeOf,
+                             const StaticMutexAutoLock&      aAutoLock)
   {
     RefPtr<ImageSurfaceCache> cache = GetImageCache(aImageKey);
     if (!cache) {
@@ -1173,7 +1193,12 @@ public:
     }
 
     // Report all surfaces in the per-image cache.
-    cache->CollectSizeOfSurfaces(aCounters, aMallocSizeOf);
+    cache->CollectSizeOfSurfaces(aCounters, aMallocSizeOf,
+      [this, &aAutoLock](NotNull<CachedSurface*> aSurface) -> void {
+      StopTracking(aSurface, /* aIsTracked */ true, aAutoLock);
+      // Individual surfaces must be freed outside the lock.
+      mCachedSurfacesDiscard.AppendElement(aSurface);
+    });
   }
 
 private:
@@ -1544,9 +1569,13 @@ SurfaceCache::RemoveImage(const ImageKey aImageKey)
 /* static */ void
 SurfaceCache::PruneImage(const ImageKey aImageKey)
 {
-  StaticMutexAutoLock lock(sInstanceMutex);
-  if (sInstance) {
-    sInstance->PruneImage(aImageKey, lock);
+  nsTArray<RefPtr<CachedSurface>> discard;
+  {
+    StaticMutexAutoLock lock(sInstanceMutex);
+    if (sInstance) {
+      sInstance->PruneImage(aImageKey, lock);
+      sInstance->TakeDiscard(discard, lock);
+    }
   }
 }
 
@@ -1568,12 +1597,16 @@ SurfaceCache::CollectSizeOfSurfaces(const ImageKey                  aImageKey,
                                     nsTArray<SurfaceMemoryCounter>& aCounters,
                                     MallocSizeOf                    aMallocSizeOf)
 {
-  StaticMutexAutoLock lock(sInstanceMutex);
-  if (!sInstance) {
-    return;
-  }
+  nsTArray<RefPtr<CachedSurface>> discard;
+  {
+    StaticMutexAutoLock lock(sInstanceMutex);
+    if (!sInstance) {
+      return;
+    }
 
-  return sInstance->CollectSizeOfSurfaces(aImageKey, aCounters, aMallocSizeOf);
+    sInstance->CollectSizeOfSurfaces(aImageKey, aCounters, aMallocSizeOf, lock);
+    sInstance->TakeDiscard(discard, lock);
+  }
 }
 
 /* static */ size_t

From 7c2def154017148d1634b6ec2e283ea1b536bb29 Mon Sep 17 00:00:00 2001
From: Andrew Osmond <aosmond@mozilla.com>
Date: Tue, 19 Sep 2017 08:19:48 -0400
Subject: [PATCH 25/83] Bug 1380649 - Part 2. Ensure SourceSurfaceVolatileData
 does not forget its purged state. r=jrmuizel

Currently if SourceSurfaceVolatileData::Map fails due to being purged,
we expect that the surface will be discarded by the caller. This has not
consistently been the case, and as such, we should ensure we do not
forget if a buffer was previously purged when we reacquire it. Since we
do not at this time support repopulating an already allocated buffer
with new data, we cannot reset this state once it has been set.
---
 gfx/layers/SourceSurfaceVolatileData.h | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/gfx/layers/SourceSurfaceVolatileData.h b/gfx/layers/SourceSurfaceVolatileData.h
index 7641733621a6..a97bf08ee73c 100644
--- a/gfx/layers/SourceSurfaceVolatileData.h
+++ b/gfx/layers/SourceSurfaceVolatileData.h
@@ -32,6 +32,7 @@ public:
     , mStride(0)
     , mMapCount(0)
     , mFormat(SurfaceFormat::UNKNOWN)
+    , mWasPurged(false)
   {
   }
 
@@ -66,10 +67,14 @@ public:
   bool Map(MapType, MappedSurface *aMappedSurface) override
   {
     MutexAutoLock lock(mMutex);
+    if (mWasPurged) {
+      return false;
+    }
     if (mMapCount == 0) {
       mVBufPtr = mVBuf;
     }
     if (mVBufPtr.WasBufferPurged()) {
+      mWasPurged = true;
       return false;
     }
     aMappedSurface->mData = mVBufPtr;
@@ -82,6 +87,7 @@ public:
   {
     MutexAutoLock lock(mMutex);
     MOZ_ASSERT(mMapCount > 0);
+    MOZ_ASSERT(!mWasPurged);
     if (--mMapCount == 0) {
       mVBufPtr = nullptr;
     }
@@ -100,6 +106,7 @@ private:
   RefPtr<VolatileBuffer> mVBuf;
   VolatileBufferPtr<uint8_t> mVBufPtr;
   SurfaceFormat mFormat;
+  bool mWasPurged;
 };
 
 } // namespace gfx

From 3434431a1af38332dfb5543a03ac94056c74b000 Mon Sep 17 00:00:00 2001
From: Nicolas Silva <nsilva@mozilla.com>
Date: Fri, 15 Sep 2017 13:24:31 +0200
Subject: [PATCH 26/83] Bug 1397407 - Apply deferred image key deletions to the
 next transaction. r=Gankro

---
 gfx/layers/wr/WebRenderLayerManager.cpp | 16 +++++++++++++---
 gfx/layers/wr/WebRenderLayerManager.h   |  5 +++++
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/gfx/layers/wr/WebRenderLayerManager.cpp b/gfx/layers/wr/WebRenderLayerManager.cpp
index 131212427078..ca3a392689c0 100644
--- a/gfx/layers/wr/WebRenderLayerManager.cpp
+++ b/gfx/layers/wr/WebRenderLayerManager.cpp
@@ -102,6 +102,7 @@ WebRenderLayerManager::DoDestroy(bool aIsSync)
 
   if (WrBridge()) {
     // Just clear ImageKeys, they are deleted during WebRenderAPI destruction.
+    mImageKeysToDeleteLater.Clear();
     mImageKeysToDelete.Clear();
     // CompositorAnimations are cleared by WebRenderBridgeParent.
     mDiscardedCompositorAnimationsIds.Clear();
@@ -376,7 +377,6 @@ WebRenderLayerManager::EndTransactionWithoutLayer(nsDisplayList* aDisplayList,
 {
   MOZ_ASSERT(aDisplayList && aDisplayListBuilder);
   mEndTransactionWithoutLayers = true;
-  DiscardImages();
   WrBridge()->RemoveExpiredFontKeys();
   EndTransactionInternal(nullptr,
                          nullptr,
@@ -686,7 +686,6 @@ WebRenderLayerManager::EndTransaction(DrawPaintedLayerCallback aCallback,
                                       EndTransactionFlags aFlags)
 {
   mEndTransactionWithoutLayers = false;
-  DiscardImages();
   WrBridge()->RemoveExpiredFontKeys();
   EndTransactionInternal(aCallback, aCallbackData, aFlags);
 }
@@ -817,6 +816,12 @@ WebRenderLayerManager::EndTransactionInternal(DrawPaintedLayerCallback aCallback
   mLatestTransactionId = mTransactionIdAllocator->GetTransactionId(/*aThrottle*/ true);
   TimeStamp transactionStart = mTransactionIdAllocator->GetTransactionStart();
 
+  for (const auto& key : mImageKeysToDelete) {
+    resourceUpdates.DeleteImage(key);
+  }
+  mImageKeysToDelete.Clear();
+  mImageKeysToDelete.SwapElements(mImageKeysToDeleteLater);
+
   // Skip the synchronization for buffer since we also skip the painting during
   // device-reset status.
   if (!gfxPlatform::GetPlatform()->DidRenderingDeviceReset()) {
@@ -922,16 +927,20 @@ WebRenderLayerManager::MakeSnapshotIfRequired(LayoutDeviceIntSize aSize)
 void
 WebRenderLayerManager::AddImageKeyForDiscard(wr::ImageKey key)
 {
-  mImageKeysToDelete.AppendElement(key);
+  mImageKeysToDeleteLater.AppendElement(key);
 }
 
 void
 WebRenderLayerManager::DiscardImages()
 {
   wr::IpcResourceUpdateQueue resources(WrBridge()->GetShmemAllocator());
+  for (const auto& key : mImageKeysToDeleteLater) {
+    resources.DeleteImage(key);
+  }
   for (const auto& key : mImageKeysToDelete) {
     resources.DeleteImage(key);
   }
+  mImageKeysToDeleteLater.Clear();
   mImageKeysToDelete.Clear();
   WrBridge()->UpdateResources(resources);
 }
@@ -958,6 +967,7 @@ WebRenderLayerManager::DiscardLocalImages()
   // Removes images but doesn't tell the parent side about them
   // This is useful in empty / failed transactions where we created
   // image keys but didn't tell the parent about them yet.
+  mImageKeysToDeleteLater.Clear();
   mImageKeysToDelete.Clear();
 }
 
diff --git a/gfx/layers/wr/WebRenderLayerManager.h b/gfx/layers/wr/WebRenderLayerManager.h
index 1cd0c05b4d3d..7931cfbeaf20 100644
--- a/gfx/layers/wr/WebRenderLayerManager.h
+++ b/gfx/layers/wr/WebRenderLayerManager.h
@@ -250,6 +250,11 @@ private:
 private:
   nsIWidget* MOZ_NON_OWNING_REF mWidget;
   nsTArray<wr::ImageKey> mImageKeysToDelete;
+  // TODO - This is needed because we have some code that creates image keys
+  // and enqueues them for deletion right away which is bad not only because
+  // of poor texture cache usage, but also because images end up deleted before
+  // they are used. This should hopfully be temporary.
+  nsTArray<wr::ImageKey> mImageKeysToDeleteLater;
   nsTArray<uint64_t> mDiscardedCompositorAnimationsIds;
 
   /* PaintedLayer callbacks; valid at the end of a transaciton,

From 64add6a97f00f679c5c41dc70110882887323287 Mon Sep 17 00:00:00 2001
From: Nick Thomas <nthomas@mozilla.com>
Date: Tue, 19 Sep 2017 15:21:22 +0200
Subject: [PATCH 27/83] Bug 1400141 - Use redo params from nightly with a
 jitter r=bhearsum

MozReview-Commit-ID: BjU6A9pOpKE

--HG--
extra : amend_source : df945e1a1c60ed7973079b82ddeddadb79696ebd
---
 .../scripts/funsize-balrog-submitter.py                    | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/taskcluster/docker/funsize-balrog-submitter/scripts/funsize-balrog-submitter.py b/taskcluster/docker/funsize-balrog-submitter/scripts/funsize-balrog-submitter.py
index ce6bb4080cc8..833da9146ce9 100644
--- a/taskcluster/docker/funsize-balrog-submitter/scripts/funsize-balrog-submitter.py
+++ b/taskcluster/docker/funsize-balrog-submitter/scripts/funsize-balrog-submitter.py
@@ -178,8 +178,9 @@ def main():
                 appVersion=e["version"], extVersion=e["version"],
                 buildID=e["to_buildid"], locale=e["locale"],
                 hashFunction='sha512',
-                partialInfo=partial_info, completeInfo=complete_info,
-            ))
+                partialInfo=partial_info, completeInfo=complete_info),
+                attempts=30, sleeptime=10, max_sleeptime=60, jitter=3,
+            )
         elif "from_buildid" in e and uploads_enabled:
             log.info("Nightly style balrog submission")
             partial_mar_url = "{}/{}".format(args.artifacts_url_prefix,
@@ -213,7 +214,7 @@ def main():
                 appVersion=e["version"], locale=e["locale"],
                 hashFunction='sha512', extVersion=e["version"],
                 partialInfo=partial_info, completeInfo=complete_info),
-                attempts=30, sleeptime=10, max_sleeptime=60,
+                attempts=30, sleeptime=10, max_sleeptime=60, jitter=3,
             )
         else:
             raise RuntimeError("Cannot determine Balrog submission style")

From e8910cf14c6f0cedd607a27eca0146bb90f88780 Mon Sep 17 00:00:00 2001
From: Vedant Chakravadhanula <vedantc98@gmail.com>
Date: Tue, 19 Sep 2017 12:33:28 +0530
Subject: [PATCH 28/83] Bug 1359289 - Add a "Learn More" link to Safe Browsing
 checkbox in about:preferences. r=jhofmann

---
 browser/components/preferences/in-content/privacy.js   |  4 ++++
 browser/components/preferences/in-content/privacy.xul  | 10 +++++++---
 .../en-US/chrome/browser/preferences/privacy.dtd       |  1 +
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/browser/components/preferences/in-content/privacy.js b/browser/components/preferences/in-content/privacy.js
index dc5bd3452acb..cbe344aa4974 100644
--- a/browser/components/preferences/in-content/privacy.js
+++ b/browser/components/preferences/in-content/privacy.js
@@ -1071,6 +1071,10 @@ var gPrivacyPane = {
     let blockUnwantedPref = document.getElementById("browser.safebrowsing.downloads.remote.block_potentially_unwanted");
     let blockUncommonPref = document.getElementById("browser.safebrowsing.downloads.remote.block_uncommon");
 
+    let learnMoreLink = document.getElementById("enableSafeBrowsingLearnMore");
+    let phishingUrl = "https://support.mozilla.org/kb/how-does-phishing-and-malware-protection-work";
+    learnMoreLink.setAttribute("href", phishingUrl);
+
     enableSafeBrowsing.addEventListener("command", function() {
       safeBrowsingPhishingPref.value = enableSafeBrowsing.checked;
       safeBrowsingMalwarePref.value = enableSafeBrowsing.checked;
diff --git a/browser/components/preferences/in-content/privacy.xul b/browser/components/preferences/in-content/privacy.xul
index 47b407830830..4854c305fde4 100644
--- a/browser/components/preferences/in-content/privacy.xul
+++ b/browser/components/preferences/in-content/privacy.xul
@@ -762,9 +762,13 @@
 <!-- addons, forgery (phishing) UI Security -->
 <groupbox id="browsingProtectionGroup" data-category="panePrivacy" hidden="true">
   <caption><label>&browsingProtection.label;</label></caption>
-  <checkbox id="enableSafeBrowsing"
-            label="&enableSafeBrowsing.label;"
-            accesskey="&enableSafeBrowsing.accesskey;" />
+  <hbox align = "center">
+    <checkbox id="enableSafeBrowsing"
+              label="&enableSafeBrowsing.label;"
+              accesskey="&enableSafeBrowsing.accesskey;" />
+    <label id="enableSafeBrowsingLearnMore"
+           class="learnMore text-link">&enableSafeBrowsingLearnMore.label;</label>
+  </hbox>
   <vbox class="indent">
 #ifdef MOZILLA_OFFICIAL
     <checkbox id="blockDownloads"
diff --git a/browser/locales/en-US/chrome/browser/preferences/privacy.dtd b/browser/locales/en-US/chrome/browser/preferences/privacy.dtd
index b4da1b4c9fd3..360836fb160e 100644
--- a/browser/locales/en-US/chrome/browser/preferences/privacy.dtd
+++ b/browser/locales/en-US/chrome/browser/preferences/privacy.dtd
@@ -117,3 +117,4 @@
 <!ENTITY  a11yPrivacy.checkbox.label     "Prevent accessibility services from accessing your browser">
 <!ENTITY  a11yPrivacy.checkbox.accesskey "a">
 <!ENTITY  a11yPrivacy.learnmore.label    "Learn more">
+<!ENTITY enableSafeBrowsingLearnMore.label "Learn more">
\ No newline at end of file

From c1246240349b22b7a12a113c510f7d9fa39d373f Mon Sep 17 00:00:00 2001
From: Ekanan Ketunuti <ananuti@gmail.com>
Date: Tue, 19 Sep 2017 07:01:39 +0700
Subject: [PATCH 29/83] Bug 1401050 - Add vanishingly to the en-US dictionary.
 r=ehsan

---
 extensions/spellcheck/locales/en-US/hunspell/en-US.dic | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/extensions/spellcheck/locales/en-US/hunspell/en-US.dic b/extensions/spellcheck/locales/en-US/hunspell/en-US.dic
index c6098c2726db..bda64cf593f5 100644
--- a/extensions/spellcheck/locales/en-US/hunspell/en-US.dic
+++ b/extensions/spellcheck/locales/en-US/hunspell/en-US.dic
@@ -1,4 +1,4 @@
-52365
+52366
 0/nm
 0th/pt
 1/n1
@@ -50434,6 +50434,7 @@ vane/MS
 vanguard/MS
 vanilla/SM
 vanish/JDSG
+vanishingly
 vanity/SM
 vanned
 vanning

From 076af4a6e03cf10e28ca3150a4321e9ad2f6225e Mon Sep 17 00:00:00 2001
From: Tim Taubert <ttaubert@mozilla.com>
Date: Tue, 19 Sep 2017 15:46:55 +0200
Subject: [PATCH 30/83] Bug 1400559 - Move runloop code into its own crate
 r=jcj

The runloop seems like a good candidate for moving into its own crate.

I wasn't sure whether we want it under the Mozilla org on GitHub, so I pushed
it to ttaubert/rust-runloop for a start. Moving the repository to mozilla/*
is easy, and we'd just need to bump the crate version with the updated
repository, if you think we should.

Bug #: 1400559

Differential Revision: https://phabricator.services.mozilla.com/D62

--HG--
rename : dom/webauthn/u2f-hid-rs/src/runloop.rs => third_party/rust/runloop/src/lib.rs
---
 dom/webauthn/u2f-hid-rs/Cargo.toml            |   1 +
 dom/webauthn/u2f-hid-rs/src/lib.rs            |   2 +-
 dom/webauthn/u2f-hid-rs/src/linux/mod.rs      |   4 +-
 dom/webauthn/u2f-hid-rs/src/linux/monitor.rs  |   4 +-
 dom/webauthn/u2f-hid-rs/src/macos/mod.rs      |   4 +-
 dom/webauthn/u2f-hid-rs/src/macos/monitor.rs  |  79 ++--
 dom/webauthn/u2f-hid-rs/src/manager.rs        |  73 ++--
 dom/webauthn/u2f-hid-rs/src/windows/mod.rs    |   4 +-
 .../u2f-hid-rs/src/windows/monitor.rs         |   4 +-
 third_party/rust/runloop/.cargo-checksum.json |   1 +
 third_party/rust/runloop/.cargo-ok            |   0
 third_party/rust/runloop/.travis.yml          |  16 +
 third_party/rust/runloop/Cargo.toml           |  22 ++
 third_party/rust/runloop/LICENSE              | 374 ++++++++++++++++++
 third_party/rust/runloop/README.md            |  88 +++++
 third_party/rust/runloop/rustfmt.toml         |   2 +
 .../rust/runloop/src/lib.rs                   |  68 ++--
 toolkit/library/gtest/rust/Cargo.lock         |   7 +
 toolkit/library/rust/Cargo.lock               |   7 +
 19 files changed, 645 insertions(+), 115 deletions(-)
 create mode 100644 third_party/rust/runloop/.cargo-checksum.json
 create mode 100644 third_party/rust/runloop/.cargo-ok
 create mode 100644 third_party/rust/runloop/.travis.yml
 create mode 100644 third_party/rust/runloop/Cargo.toml
 create mode 100644 third_party/rust/runloop/LICENSE
 create mode 100644 third_party/rust/runloop/README.md
 create mode 100644 third_party/rust/runloop/rustfmt.toml
 rename dom/webauthn/u2f-hid-rs/src/runloop.rs => third_party/rust/runloop/src/lib.rs (69%)

diff --git a/dom/webauthn/u2f-hid-rs/Cargo.toml b/dom/webauthn/u2f-hid-rs/Cargo.toml
index 547dea8ab380..5d52318e7a2b 100644
--- a/dom/webauthn/u2f-hid-rs/Cargo.toml
+++ b/dom/webauthn/u2f-hid-rs/Cargo.toml
@@ -18,6 +18,7 @@ log = "0.3"
 env_logger = "0.4.1"
 libc = "^0.2"
 boxfnonce = "0.0.3"
+runloop = "0.1.0"
 
 [dev-dependencies]
 rust-crypto = "^0.2"
diff --git a/dom/webauthn/u2f-hid-rs/src/lib.rs b/dom/webauthn/u2f-hid-rs/src/lib.rs
index 2ff068963551..a22667b007db 100644
--- a/dom/webauthn/u2f-hid-rs/src/lib.rs
+++ b/dom/webauthn/u2f-hid-rs/src/lib.rs
@@ -32,9 +32,9 @@ extern crate log;
 extern crate rand;
 extern crate libc;
 extern crate boxfnonce;
+extern crate runloop;
 
 mod consts;
-mod runloop;
 mod u2ftypes;
 mod u2fprotocol;
 
diff --git a/dom/webauthn/u2f-hid-rs/src/linux/mod.rs b/dom/webauthn/u2f-hid-rs/src/linux/mod.rs
index bf633eac0e87..464d85e3559e 100644
--- a/dom/webauthn/u2f-hid-rs/src/linux/mod.rs
+++ b/dom/webauthn/u2f-hid-rs/src/linux/mod.rs
@@ -40,7 +40,7 @@ impl PlatformManager {
 
         let cbc = callback.clone();
 
-        let thread = RunLoop::new(
+        let thread = RunLoop::new_with_timeout(
             move |alive| {
                 let mut devices = DeviceMap::new();
                 let monitor = try_or!(Monitor::new(), |e| { callback.call(Err(e)); });
@@ -87,7 +87,7 @@ impl PlatformManager {
 
         let cbc = callback.clone();
 
-        let thread = RunLoop::new(
+        let thread = RunLoop::new_with_timeout(
             move |alive| {
                 let mut devices = DeviceMap::new();
                 let monitor = try_or!(Monitor::new(), |e| { callback.call(Err(e)); });
diff --git a/dom/webauthn/u2f-hid-rs/src/linux/monitor.rs b/dom/webauthn/u2f-hid-rs/src/linux/monitor.rs
index 2c7511cd3065..7d66cf1dc829 100644
--- a/dom/webauthn/u2f-hid-rs/src/linux/monitor.rs
+++ b/dom/webauthn/u2f-hid-rs/src/linux/monitor.rs
@@ -100,9 +100,7 @@ impl Monitor {
                 }
 
                 Ok(())
-            },
-            0, /* no timeout */
-        )?;
+            })?;
 
         Ok(Self { rx, thread })
     }
diff --git a/dom/webauthn/u2f-hid-rs/src/macos/mod.rs b/dom/webauthn/u2f-hid-rs/src/macos/mod.rs
index 530e84dda07e..f13e48f66700 100644
--- a/dom/webauthn/u2f-hid-rs/src/macos/mod.rs
+++ b/dom/webauthn/u2f-hid-rs/src/macos/mod.rs
@@ -45,7 +45,7 @@ impl PlatformManager {
 
         let cbc = callback.clone();
 
-        let thread = RunLoop::new(
+        let thread = RunLoop::new_with_timeout(
             move |alive| {
                 let mut devices = DeviceMap::new();
                 let monitor = try_or!(Monitor::new(), |e| { callback.call(Err(e)); });
@@ -98,7 +98,7 @@ impl PlatformManager {
 
         let cbc = callback.clone();
 
-        let thread = RunLoop::new(
+        let thread = RunLoop::new_with_timeout(
             move |alive| {
                 let mut devices = DeviceMap::new();
                 let monitor = try_or!(Monitor::new(), |e| { callback.call(Err(e)); });
diff --git a/dom/webauthn/u2f-hid-rs/src/macos/monitor.rs b/dom/webauthn/u2f-hid-rs/src/macos/monitor.rs
index 5d25c91ddfff..147b76b067a0 100644
--- a/dom/webauthn/u2f-hid-rs/src/macos/monitor.rs
+++ b/dom/webauthn/u2f-hid-rs/src/macos/monitor.rs
@@ -31,53 +31,50 @@ impl Monitor {
     pub fn new() -> io::Result<Self> {
         let (tx, rx) = channel();
 
-        let thread = RunLoop::new(
-            move |alive| -> io::Result<()> {
-                let tx_box = Box::new(tx);
-                let tx_ptr = Box::into_raw(tx_box) as *mut libc::c_void;
+        let thread = RunLoop::new(move |alive| -> io::Result<()> {
+            let tx_box = Box::new(tx);
+            let tx_ptr = Box::into_raw(tx_box) as *mut libc::c_void;
 
-                // This will keep `tx` alive only for the scope.
-                let _tx = unsafe { Box::from_raw(tx_ptr as *mut Sender<Event>) };
+            // This will keep `tx` alive only for the scope.
+            let _tx = unsafe { Box::from_raw(tx_ptr as *mut Sender<Event>) };
 
-                // Create and initialize a scoped HID manager.
-                let manager = IOHIDManager::new()?;
+            // Create and initialize a scoped HID manager.
+            let manager = IOHIDManager::new()?;
 
-                // Match only U2F devices.
-                let dict = IOHIDDeviceMatcher::new();
-                unsafe { IOHIDManagerSetDeviceMatching(manager.get(), dict.get()) };
+            // Match only U2F devices.
+            let dict = IOHIDDeviceMatcher::new();
+            unsafe { IOHIDManagerSetDeviceMatching(manager.get(), dict.get()) };
 
-                // Register callbacks.
-                unsafe {
-                    IOHIDManagerRegisterDeviceMatchingCallback(
-                        manager.get(),
-                        Monitor::device_add_cb,
-                        tx_ptr,
-                    );
-                    IOHIDManagerRegisterDeviceRemovalCallback(
-                        manager.get(),
-                        Monitor::device_remove_cb,
-                        tx_ptr,
-                    );
+            // Register callbacks.
+            unsafe {
+                IOHIDManagerRegisterDeviceMatchingCallback(
+                    manager.get(),
+                    Monitor::device_add_cb,
+                    tx_ptr,
+                );
+                IOHIDManagerRegisterDeviceRemovalCallback(
+                    manager.get(),
+                    Monitor::device_remove_cb,
+                    tx_ptr,
+                );
+            }
+
+            // Run the Event Loop. CFRunLoopRunInMode() will dispatch HID
+            // input reports into the various callbacks
+            while alive() {
+                trace!("OSX Runloop running, handle={:?}", thread::current());
+
+                if unsafe { CFRunLoopRunInMode(kCFRunLoopDefaultMode, 0.1, 0) } ==
+                    kCFRunLoopRunStopped
+                {
+                    debug!("OSX Runloop device stopped.");
+                    break;
                 }
+            }
+            debug!("OSX Runloop completed, handle={:?}", thread::current());
 
-                // Run the Event Loop. CFRunLoopRunInMode() will dispatch HID
-                // input reports into the various callbacks
-                while alive() {
-                    trace!("OSX Runloop running, handle={:?}", thread::current());
-
-                    if unsafe { CFRunLoopRunInMode(kCFRunLoopDefaultMode, 0.1, 0) } ==
-                        kCFRunLoopRunStopped
-                    {
-                        debug!("OSX Runloop device stopped.");
-                        break;
-                    }
-                }
-                debug!("OSX Runloop completed, handle={:?}", thread::current());
-
-                Ok(())
-            },
-            0, /* no timeout */
-        )?;
+            Ok(())
+        })?;
 
         Ok(Self { rx, thread })
     }
diff --git a/dom/webauthn/u2f-hid-rs/src/manager.rs b/dom/webauthn/u2f-hid-rs/src/manager.rs
index 5b2688181934..a6320a824711 100644
--- a/dom/webauthn/u2f-hid-rs/src/manager.rs
+++ b/dom/webauthn/u2f-hid-rs/src/manager.rs
@@ -38,48 +38,45 @@ impl U2FManager {
         let (tx, rx) = channel();
 
         // Start a new work queue thread.
-        let queue = try!(RunLoop::new(
-            move |alive| {
-                let mut pm = PlatformManager::new();
+        let queue = RunLoop::new(move |alive| {
+            let mut pm = PlatformManager::new();
 
-                while alive() {
-                    match rx.recv_timeout(Duration::from_millis(50)) {
-                        Ok(QueueAction::Register {
-                               timeout,
-                               challenge,
-                               application,
-                               callback,
-                           }) => {
-                            // This must not block, otherwise we can't cancel.
-                            pm.register(timeout, challenge, application, callback);
-                        }
-                        Ok(QueueAction::Sign {
-                               timeout,
-                               challenge,
-                               application,
-                               key_handles,
-                               callback,
-                           }) => {
-                            // This must not block, otherwise we can't cancel.
-                            pm.sign(timeout, challenge, application, key_handles, callback);
-                        }
-                        Ok(QueueAction::Cancel) => {
-                            // Cancelling must block so that we don't start a new
-                            // polling thread before the old one has shut down.
-                            pm.cancel();
-                        }
-                        Err(RecvTimeoutError::Disconnected) => {
-                            break;
-                        }
-                        _ => { /* continue */ }
+            while alive() {
+                match rx.recv_timeout(Duration::from_millis(50)) {
+                    Ok(QueueAction::Register {
+                           timeout,
+                           challenge,
+                           application,
+                           callback,
+                       }) => {
+                        // This must not block, otherwise we can't cancel.
+                        pm.register(timeout, challenge, application, callback);
                     }
+                    Ok(QueueAction::Sign {
+                           timeout,
+                           challenge,
+                           application,
+                           key_handles,
+                           callback,
+                       }) => {
+                        // This must not block, otherwise we can't cancel.
+                        pm.sign(timeout, challenge, application, key_handles, callback);
+                    }
+                    Ok(QueueAction::Cancel) => {
+                        // Cancelling must block so that we don't start a new
+                        // polling thread before the old one has shut down.
+                        pm.cancel();
+                    }
+                    Err(RecvTimeoutError::Disconnected) => {
+                        break;
+                    }
+                    _ => { /* continue */ }
                 }
+            }
 
-                // Cancel any ongoing activity.
-                pm.cancel();
-            },
-            0, /* no timeout */
-        ));
+            // Cancel any ongoing activity.
+            pm.cancel();
+        })?;
 
         Ok(Self {
             queue: queue,
diff --git a/dom/webauthn/u2f-hid-rs/src/windows/mod.rs b/dom/webauthn/u2f-hid-rs/src/windows/mod.rs
index 728bf27bcb9e..ee4189b765d7 100644
--- a/dom/webauthn/u2f-hid-rs/src/windows/mod.rs
+++ b/dom/webauthn/u2f-hid-rs/src/windows/mod.rs
@@ -40,7 +40,7 @@ impl PlatformManager {
 
         let cbc = callback.clone();
 
-        let thread = RunLoop::new(
+        let thread = RunLoop::new_with_timeout(
             move |alive| {
                 let mut devices = DeviceMap::new();
                 let monitor = try_or!(Monitor::new(), |e| { callback.call(Err(e)); });
@@ -86,7 +86,7 @@ impl PlatformManager {
 
         let cbc = callback.clone();
 
-        let thread = RunLoop::new(
+        let thread = RunLoop::new_with_timeout(
             move |alive| {
                 let mut devices = DeviceMap::new();
                 let monitor = try_or!(Monitor::new(), |e| { callback.call(Err(e)); });
diff --git a/dom/webauthn/u2f-hid-rs/src/windows/monitor.rs b/dom/webauthn/u2f-hid-rs/src/windows/monitor.rs
index 38a4879df388..6c063a10cb8c 100644
--- a/dom/webauthn/u2f-hid-rs/src/windows/monitor.rs
+++ b/dom/webauthn/u2f-hid-rs/src/windows/monitor.rs
@@ -63,9 +63,7 @@ impl Monitor {
                 }
 
                 Ok(())
-            },
-            0, /* no timeout */
-        )?;
+            })?;
 
         Ok(Self {
             rx: rx,
diff --git a/third_party/rust/runloop/.cargo-checksum.json b/third_party/rust/runloop/.cargo-checksum.json
new file mode 100644
index 000000000000..417387fe1aa6
--- /dev/null
+++ b/third_party/rust/runloop/.cargo-checksum.json
@@ -0,0 +1 @@
+{"files":{".cargo-ok":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",".travis.yml":"0b87ec61b2b5ea3d71356aa08965587185b70ea2e00d68dab69c7db893a4499a","Cargo.toml":"6148ea66fe5c0f49d36f01cc88b7aaf90a058ffb406402f0c9e8d790b32a509d","LICENSE":"b946744aeda89b467929585fe8eeb5461847695220c1b168fb375d8abd4ea3d0","README.md":"466aa6f249e465158175bd05567c1c9b996c3a57e22666ef78273e2a2f5a3f02","rustfmt.toml":"de4e1daab481c1572805aed3e51e72c5dc1b3e5af757bc675e1717b251c6e922","src/lib.rs":"e904c1c9d0fbc6dcf9749346f9ee612747e9755b33f60d57689249594d6b0750"},"package":"5d79b4b604167921892e84afbbaad9d5ad74e091bf6c511d9dbfb0593f09fabd"}
\ No newline at end of file
diff --git a/third_party/rust/runloop/.cargo-ok b/third_party/rust/runloop/.cargo-ok
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/third_party/rust/runloop/.travis.yml b/third_party/rust/runloop/.travis.yml
new file mode 100644
index 000000000000..22c4708a699a
--- /dev/null
+++ b/third_party/rust/runloop/.travis.yml
@@ -0,0 +1,16 @@
+sudo: false
+language: rust
+cache: cargo
+rust:
+  - stable
+  - beta
+  - nightly
+
+before_install:
+  - cargo install rustfmt || true
+
+script:
+- |
+  cargo fmt -- --write-mode=diff &&
+  cargo build &&
+  cargo test
diff --git a/third_party/rust/runloop/Cargo.toml b/third_party/rust/runloop/Cargo.toml
new file mode 100644
index 000000000000..3746a73a5dfa
--- /dev/null
+++ b/third_party/rust/runloop/Cargo.toml
@@ -0,0 +1,22 @@
+# THIS FILE IS AUTOMATICALLY GENERATED BY CARGO
+#
+# When uploading crates to the registry Cargo will automatically
+# "normalize" Cargo.toml files for maximal compatibility
+# with all versions of Cargo and also rewrite `path` dependencies
+# to registry (e.g. crates.io) dependencies
+#
+# If you believe there's an error in this file please file an
+# issue against the rust-lang/cargo repository. If you're
+# editing this file be aware that the upstream Cargo.toml
+# will likely look very different (and much more reasonable)
+
+[package]
+name = "runloop"
+version = "0.1.0"
+authors = ["Tim Taubert <tim@timtaubert.de>"]
+description = "Cancelable non-blocking polling threads (with optional timeouts)."
+homepage = "https://github.com/ttaubert/rust-runloop/"
+readme = "README.md"
+keywords = ["runloop", "threads"]
+license = "MPL-2.0"
+repository = "https://github.com/ttaubert/rust-runloop/"
diff --git a/third_party/rust/runloop/LICENSE b/third_party/rust/runloop/LICENSE
new file mode 100644
index 000000000000..398385c9fb9b
--- /dev/null
+++ b/third_party/rust/runloop/LICENSE
@@ -0,0 +1,374 @@
+ Mozilla Public License Version 2.0
+==================================
+
+1. Definitions
+--------------
+
+1.1. "Contributor"
+means each individual or legal entity that creates, contributes to
+the creation of, or owns Covered Software.
+
+1.2. "Contributor Version"
+means the combination of the Contributions of others (if any) used
+by a Contributor and that particular Contributor's Contribution.
+
+1.3. "Contribution"
+means Covered Software of a particular Contributor.
+
+1.4. "Covered Software"
+means Source Code Form to which the initial Contributor has attached
+the notice in Exhibit A, the Executable Form of such Source Code
+Form, and Modifications of such Source Code Form, in each case
+including portions thereof.
+
+1.5. "Incompatible With Secondary Licenses"
+means
+
+(a) that the initial Contributor has attached the notice described
+in Exhibit B to the Covered Software; or
+
+(b) that the Covered Software was made available under the terms of
+version 1.1 or earlier of the License, but not also under the
+terms of a Secondary License.
+
+1.6. "Executable Form"
+means any form of the work other than Source Code Form.
+
+1.7. "Larger Work"
+means a work that combines Covered Software with other material, in
+a separate file or files, that is not Covered Software.
+
+1.8. "License"
+means this document.
+
+1.9. "Licensable"
+means having the right to grant, to the maximum extent possible,
+whether at the time of the initial grant or subsequently, any and
+all of the rights conveyed by this License.
+
+1.10. "Modifications"
+means any of the following:
+
+(a) any file in Source Code Form that results from an addition to,
+deletion from, or modification of the contents of Covered
+Software; or
+
+(b) any new file in Source Code Form that contains any Covered
+Software.
+
+1.11. "Patent Claims" of a Contributor
+means any patent claim(s), including without limitation, method,
+process, and apparatus claims, in any patent Licensable by such
+Contributor that would be infringed, but for the grant of the
+License, by the making, using, selling, offering for sale, having
+made, import, or transfer of either its Contributions or its
+Contributor Version.
+
+1.12. "Secondary License"
+means either the GNU General Public License, Version 2.0, the GNU
+Lesser General Public License, Version 2.1, the GNU Affero General
+Public License, Version 3.0, or any later versions of those
+licenses.
+
+1.13. "Source Code Form"
+means the form of the work preferred for making modifications.
+
+1.14. "You" (or "Your")
+means an individual or a legal entity exercising rights under this
+License. For legal entities, "You" includes any entity that
+controls, is controlled by, or is under common control with You. For
+purposes of this definition, "control" means (a) the power, direct
+or indirect, to cause the direction or management of such entity,
+whether by contract or otherwise, or (b) ownership of more than
+fifty percent (50%) of the outstanding shares or beneficial
+ownership of such entity.
+
+2. License Grants and Conditions
+--------------------------------
+
+2.1. Grants
+
+Each Contributor hereby grants You a world-wide, royalty-free,
+non-exclusive license:
+
+(a) under intellectual property rights (other than patent or trademark)
+Licensable by such Contributor to use, reproduce, make available,
+modify, display, perform, distribute, and otherwise exploit its
+Contributions, either on an unmodified basis, with Modifications, or
+as part of a Larger Work; and
+
+(b) under Patent Claims of such Contributor to make, use, sell, offer
+for sale, have made, import, and otherwise transfer either its
+Contributions or its Contributor Version.
+
+2.2. Effective Date
+
+The licenses granted in Section 2.1 with respect to any Contribution
+become effective for each Contribution on the date the Contributor first
+distributes such Contribution.
+
+2.3. Limitations on Grant Scope
+
+The licenses granted in this Section 2 are the only rights granted under
+this License. No additional rights or licenses will be implied from the
+distribution or licensing of Covered Software under this License.
+Notwithstanding Section 2.1(b) above, no patent license is granted by a
+Contributor:
+
+(a) for any code that a Contributor has removed from Covered Software;
+or
+
+(b) for infringements caused by: (i) Your and any other third party's
+modifications of Covered Software, or (ii) the combination of its
+Contributions with other software (except as part of its Contributor
+Version); or
+
+(c) under Patent Claims infringed by Covered Software in the absence of
+its Contributions.
+
+This License does not grant any rights in the trademarks, service marks,
+or logos of any Contributor (except as may be necessary to comply with
+the notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+No Contributor makes additional grants as a result of Your choice to
+distribute the Covered Software under a subsequent version of this
+License (see Section 10.2) or under the terms of a Secondary License (if
+permitted under the terms of Section 3.3).
+
+2.5. Representation
+
+Each Contributor represents that the Contributor believes its
+Contributions are its original creation(s) or it has sufficient rights
+to grant the rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+This License is not intended to limit any rights You have under
+applicable copyright doctrines of fair use, fair dealing, or other
+equivalents.
+
+2.7. Conditions
+
+Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted
+in Section 2.1.
+
+3. Responsibilities
+-------------------
+
+3.1. Distribution of Source Form
+
+All distribution of Covered Software in Source Code Form, including any
+Modifications that You create or to which You contribute, must be under
+the terms of this License. You must inform recipients that the Source
+Code Form of the Covered Software is governed by the terms of this
+License, and how they can obtain a copy of this License. You may not
+attempt to alter or restrict the recipients' rights in the Source Code
+Form.
+
+3.2. Distribution of Executable Form
+
+If You distribute Covered Software in Executable Form then:
+
+(a) such Covered Software must also be made available in Source Code
+Form, as described in Section 3.1, and You must inform recipients of
+the Executable Form how they can obtain a copy of such Source Code
+Form by reasonable means in a timely manner, at a charge no more
+than the cost of distribution to the recipient; and
+
+(b) You may distribute such Executable Form under the terms of this
+License, or sublicense it under different terms, provided that the
+license for the Executable Form does not attempt to limit or alter
+the recipients' rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+You may create and distribute a Larger Work under terms of Your choice,
+provided that You also comply with the requirements of this License for
+the Covered Software. If the Larger Work is a combination of Covered
+Software with a work governed by one or more Secondary Licenses, and the
+Covered Software is not Incompatible With Secondary Licenses, this
+License permits You to additionally distribute such Covered Software
+under the terms of such Secondary License(s), so that the recipient of
+the Larger Work may, at their option, further distribute the Covered
+Software under the terms of either this License or such Secondary
+License(s).
+
+3.4. Notices
+
+You may not remove or alter the substance of any license notices
+(including copyright notices, patent notices, disclaimers of warranty,
+or limitations of liability) contained within the Source Code Form of
+the Covered Software, except that You may alter any license notices to
+the extent required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+You may choose to offer, and to charge a fee for, warranty, support,
+indemnity or liability obligations to one or more recipients of Covered
+Software. However, You may do so only on Your own behalf, and not on
+behalf of any Contributor. You must make it absolutely clear that any
+such warranty, support, indemnity, or liability obligation is offered by
+You alone, and You hereby agree to indemnify every Contributor for any
+liability incurred by such Contributor as a result of warranty, support,
+indemnity or liability terms You offer. You may include additional
+disclaimers of warranty and limitations of liability specific to any
+jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+---------------------------------------------------
+
+If it is impossible for You to comply with any of the terms of this
+License with respect to some or all of the Covered Software due to
+statute, judicial order, or regulation then You must: (a) comply with
+the terms of this License to the maximum extent possible; and (b)
+describe the limitations and the code they affect. Such description must
+be placed in a text file included with all distributions of the Covered
+Software under this License. Except to the extent prohibited by statute
+or regulation, such description must be sufficiently detailed for a
+recipient of ordinary skill to be able to understand it.
+
+5. Termination
+--------------
+
+5.1. The rights granted under this License will terminate automatically
+if You fail to comply with any of its terms. However, if You become
+compliant, then the rights granted under this License from a particular
+Contributor are reinstated (a) provisionally, unless and until such
+Contributor explicitly and finally terminates Your grants, and (b) on an
+ongoing basis, if such Contributor fails to notify You of the
+non-compliance by some reasonable means prior to 60 days after You have
+come back into compliance. Moreover, Your grants from a particular
+Contributor are reinstated on an ongoing basis if such Contributor
+notifies You of the non-compliance by some reasonable means, this is the
+first time You have received notice of non-compliance with this License
+from such Contributor, and You become compliant prior to 30 days after
+Your receipt of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+infringement claim (excluding declaratory judgment actions,
+counter-claims, and cross-claims) alleging that a Contributor Version
+directly or indirectly infringes any patent, then the rights granted to
+You by any and all Contributors for the Covered Software under Section
+2.1 of this License shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all
+end user license agreements (excluding distributors and resellers) which
+have been validly granted by You or Your distributors under this License
+prior to termination shall survive termination.
+
+************************************************************************
+* *
+* 6. Disclaimer of Warranty *
+* ------------------------- *
+* *
+* Covered Software is provided under this License on an "as is" *
+* basis, without warranty of any kind, either expressed, implied, or *
+* statutory, including, without limitation, warranties that the *
+* Covered Software is free of defects, merchantable, fit for a *
+* particular purpose or non-infringing. The entire risk as to the *
+* quality and performance of the Covered Software is with You. *
+* Should any Covered Software prove defective in any respect, You *
+* (not any Contributor) assume the cost of any necessary servicing, *
+* repair, or correction. This disclaimer of warranty constitutes an *
+* essential part of this License. No use of any Covered Software is *
+* authorized under this License except under this disclaimer. *
+* *
+************************************************************************
+
+************************************************************************
+* *
+* 7. Limitation of Liability *
+* -------------------------- *
+* *
+* Under no circumstances and under no legal theory, whether tort *
+* (including negligence), contract, or otherwise, shall any *
+* Contributor, or anyone who distributes Covered Software as *
+* permitted above, be liable to You for any direct, indirect, *
+* special, incidental, or consequential damages of any character *
+* including, without limitation, damages for lost profits, loss of *
+* goodwill, work stoppage, computer failure or malfunction, or any *
+* and all other commercial damages or losses, even if such party *
+* shall have been informed of the possibility of such damages. This *
+* limitation of liability shall not apply to liability for death or *
+* personal injury resulting from such party's negligence to the *
+* extent applicable law prohibits such limitation. Some *
+* jurisdictions do not allow the exclusion or limitation of *
+* incidental or consequential damages, so this exclusion and *
+* limitation may not apply to You. *
+* *
+************************************************************************
+
+8. Litigation
+-------------
+
+Any litigation relating to this License may be brought only in the
+courts of a jurisdiction where the defendant maintains its principal
+place of business and such litigation shall be governed by laws of that
+jurisdiction, without reference to its conflict-of-law provisions.
+Nothing in this Section shall prevent a party's ability to bring
+cross-claims or counter-claims.
+
+9. Miscellaneous
+----------------
+
+This License represents the complete agreement concerning the subject
+matter hereof. If any provision of this License is held to be
+unenforceable, such provision shall be reformed only to the extent
+necessary to make it enforceable. Any law or regulation which provides
+that the language of a contract shall be construed against the drafter
+shall not be used to construe this License against a Contributor.
+
+10. Versions of the License
+---------------------------
+
+10.1. New Versions
+
+Mozilla Foundation is the license steward. Except as provided in Section
+10.3, no one other than the license steward has the right to modify or
+publish new versions of this License. Each version will be given a
+distinguishing version number.
+
+10.2. Effect of New Versions
+
+You may distribute the Covered Software under the terms of the version
+of the License under which You originally received the Covered Software,
+or under the terms of any subsequent version published by the license
+steward.
+
+10.3. Modified Versions
+
+If you create software not governed by this License, and you want to
+create a new license for such software, you may create and use a
+modified version of this License if you rename the license and remove
+any references to the name of the license steward (except to note that
+such modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary
+Licenses
+
+If You choose to distribute Source Code Form that is Incompatible With
+Secondary Licenses under the terms of this version of the License, the
+notice described in Exhibit B of this License must be attached.
+
+Exhibit A - Source Code Form License Notice
+-------------------------------------------
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular
+file, then You may include the notice in a location (such as a LICENSE
+file in a relevant directory) where a recipient would be likely to look
+for such a notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - "Incompatible With Secondary Licenses" Notice
+---------------------------------------------------------
+
+This Source Code Form is "Incompatible With Secondary Licenses", as
+defined by the Mozilla Public License, v. 2.0.
+
diff --git a/third_party/rust/runloop/README.md b/third_party/rust/runloop/README.md
new file mode 100644
index 000000000000..8b9508b93be0
--- /dev/null
+++ b/third_party/rust/runloop/README.md
@@ -0,0 +1,88 @@
+# runloop [![Crates.io](https://img.shields.io/crates/v/runloop.svg)](https://crates.io/crates/runloop) [![Build Status](https://travis-ci.org/ttaubert/rust-runloop.svg?branch=master)](https://travis-ci.org/ttaubert/rust-runloop) [![License](https://img.shields.io/badge/license-MPL2-blue.svg?style=flat)](LICENSE)
+
+This crate provides a cancelable `RunLoop` to simplify writing non-blocking
+polling threads.
+
+## Usage
+
+The closure passed to `RunLoop::new()` or `RunLoop::new_with_timeout()` will be
+called once and is executed in the newly spawned thread. It should periodically
+check, via the given callback argument named `alive` in the below examples,
+whether the runloop was requested to terminate.
+
+`RunLoop::alive()` allows the owning thread to check whether the runloop is
+still alive. This can be useful for debugging (e.g. assertions) or early
+returns on failure in the passed closure.
+
+`RunLoop::cancel()` will request the runloop to terminate. If the runloop is
+still active it will join the thread and block. If the runloop already
+terminated on its own this will be a no-op.
+
+### Example: An endless runloop
+
+A runloop does not have to terminate on its own, it can wait until the
+`cancel()` method is called.
+
+```rust
+// This runloop runs until we stop it.
+let rloop = RunLoop::new(|alive| {
+    while alive() { /* endless loop */ }
+})?;
+
+// Loop a few times.
+thread::sleep_ms(500);
+assert!(rloop.alive());
+
+// This will cause `alive()` to return false
+// and block until the thread was joined.
+rloop.cancel();
+```
+
+### Example: A runloop with a timeout
+
+Creating a runloop via `new_with_timeout()` ensures that `alive()` returns
+`false` after the given duration.
+
+```rust
+// This runloop will time out after 10ms.
+let rloop = RunLoop::new_with_timeout(|alive| {
+    while alive() { /* endless loop */ }
+}, 10)?;
+
+// Wait for the timeout.
+while rloop.alive() { /* loop */ }
+
+// This won't block anymore, it's a no-op.
+// The runloop has already terminated.
+rloop.cancel();
+```
+
+### Example: A runloop with channels
+
+As a runloop will run the given closure in a newly spawned thread it requires
+channels and similar utilities to communicate back to the owning thread.
+
+```rust
+let (tx, rx) = channel();
+
+// This runloop will send a lot of numbers.
+let rloop = RunLoop::new(move |alive| {
+    let mut counter = 0u64;
+    while alive() {
+        tx.send(counter).unwrap();
+        counter += 1;
+    }
+})?;
+
+// Wait until we receive a specific number.
+while rx.recv().unwrap() < 50 { /* loop */ }
+
+// We've seen enough.
+rloop.cancel();
+```
+
+## License
+
+`runloop` is distributed under the terms of the Mozilla Public License, v. 2.0.
+
+See [LICENSE](LICENSE) for details.
diff --git a/third_party/rust/runloop/rustfmt.toml b/third_party/rust/runloop/rustfmt.toml
new file mode 100644
index 000000000000..ed37b0c63a5f
--- /dev/null
+++ b/third_party/rust/runloop/rustfmt.toml
@@ -0,0 +1,2 @@
+comment_width = 200
+wrap_comments = true
diff --git a/dom/webauthn/u2f-hid-rs/src/runloop.rs b/third_party/rust/runloop/src/lib.rs
similarity index 69%
rename from dom/webauthn/u2f-hid-rs/src/runloop.rs
rename to third_party/rust/runloop/src/lib.rs
index 39cdcaee3060..d705e605d021 100644
--- a/dom/webauthn/u2f-hid-rs/src/runloop.rs
+++ b/third_party/rust/runloop/src/lib.rs
@@ -5,8 +5,7 @@
 use std::io;
 use std::sync::{Arc, Mutex, Weak};
 use std::sync::atomic::{AtomicBool, Ordering};
-use std::thread;
-use std::thread::JoinHandle;
+use std::thread::{Builder, JoinHandle};
 use std::time::{Duration, Instant};
 
 struct Canary {
@@ -28,7 +27,15 @@ pub struct RunLoop {
 }
 
 impl RunLoop {
-    pub fn new<F, T>(fun: F, timeout_ms: u64) -> io::Result<Self>
+    pub fn new<F, T>(fun: F) -> io::Result<Self>
+    where
+        F: FnOnce(&Fn() -> bool) -> T,
+        F: Send + 'static,
+    {
+        Self::new_with_timeout(fun, 0 /* no timeout */)
+    }
+
+    pub fn new_with_timeout<F, T>(fun: F, timeout_ms: u64) -> io::Result<Self>
     where
         F: FnOnce(&Fn() -> bool) -> T,
         F: Send + 'static,
@@ -37,7 +44,7 @@ impl RunLoop {
         let flag_ = flag.clone();
 
         // Spawn the run loop thread.
-        let thread = thread::Builder::new().spawn(move || {
+        let thread = Builder::new().spawn(move || {
             let timeout = Duration::from_millis(timeout_ms);
             let start = Instant::now();
 
@@ -97,21 +104,22 @@ impl RunLoop {
 #[cfg(test)]
 mod tests {
     use std::sync::{Arc, Barrier};
+    use std::sync::mpsc::channel;
 
     use super::RunLoop;
 
     #[test]
     fn test_empty() {
         // Create a runloop that exits right away.
-        let thread = RunLoop::new(move |_| {}, 0).unwrap();
-        while thread.alive() { /* wait */ }
-        thread.cancel(); // noop
+        let rloop = RunLoop::new(|_| {}).unwrap();
+        while rloop.alive() { /* wait */ }
+        rloop.cancel(); // noop
     }
 
     #[test]
     fn test_cancel_early() {
         // Create a runloop and cancel it before the thread spawns.
-        RunLoop::new(|alive| assert!(!alive()), 0).unwrap().cancel();
+        RunLoop::new(|alive| assert!(!alive())).unwrap().cancel();
     }
 
     #[test]
@@ -120,27 +128,41 @@ mod tests {
         let b = barrier.clone();
 
         // Create a runloop that never exits.
-        let thread = RunLoop::new(
-            move |alive| {
-                b.wait();
-                while alive() { /* loop */ }
-            },
-            0,
-        ).unwrap();
+        let rloop = RunLoop::new(move |alive| {
+            b.wait();
+            while alive() { /* loop */ }
+        }).unwrap();
 
         barrier.wait();
-        assert!(thread.alive());
-        thread.cancel();
-        assert!(!thread.alive());
+        assert!(rloop.alive());
+        rloop.cancel();
+        assert!(!rloop.alive());
     }
 
     #[test]
     fn test_timeout() {
-        // Create a runloop that never exits, but times out after a second.
-        let thread = RunLoop::new(|alive| while alive() {}, 1).unwrap();
+        // Create a runloop that never exits, but times out after 1ms.
+        let rloop = RunLoop::new_with_timeout(|alive| while alive() {}, 1).unwrap();
 
-        while thread.alive() { /* wait */ }
-        assert!(!thread.alive());
-        thread.cancel(); // noop
+        while rloop.alive() { /* wait */ }
+        assert!(!rloop.alive());
+        rloop.cancel(); // noop
+    }
+
+    #[test]
+    fn test_channel() {
+        let (tx, rx) = channel();
+
+        // A runloop that sends data via a channel.
+        let rloop = RunLoop::new(move |alive| while alive() {
+            tx.send(0u8).unwrap();
+        }).unwrap();
+
+        // Wait until the data arrives.
+        assert_eq!(rx.recv().unwrap(), 0u8);
+
+        assert!(rloop.alive());
+        rloop.cancel();
+        assert!(!rloop.alive());
     }
 }
diff --git a/toolkit/library/gtest/rust/Cargo.lock b/toolkit/library/gtest/rust/Cargo.lock
index 6c84a198c9db..483ba9a2fa60 100644
--- a/toolkit/library/gtest/rust/Cargo.lock
+++ b/toolkit/library/gtest/rust/Cargo.lock
@@ -1127,6 +1127,11 @@ name = "regex-syntax"
 version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 
+[[package]]
+name = "runloop"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+
 [[package]]
 name = "rust_url_capi"
 version = "0.0.1"
@@ -1471,6 +1476,7 @@ dependencies = [
  "libudev 0.2.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "log 0.3.6 (registry+https://github.com/rust-lang/crates.io-index)",
  "rand 0.3.15 (registry+https://github.com/rust-lang/crates.io-index)",
+ "runloop 0.1.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "winapi 0.2.8 (registry+https://github.com/rust-lang/crates.io-index)",
 ]
 
@@ -1738,6 +1744,7 @@ dependencies = [
 "checksum redox_syscall 0.1.16 (registry+https://github.com/rust-lang/crates.io-index)" = "8dd35cc9a8bdec562c757e3d43c1526b5c6d2653e23e2315065bc25556550753"
 "checksum regex 0.2.1 (registry+https://github.com/rust-lang/crates.io-index)" = "4278c17d0f6d62dfef0ab00028feb45bd7d2102843f80763474eeb1be8a10c01"
 "checksum regex-syntax 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)" = "2f9191b1f57603095f105d317e375d19b1c9c5c3185ea9633a99a6dcbed04457"
+"checksum runloop 0.1.0 (registry+https://github.com/rust-lang/crates.io-index)" = "5d79b4b604167921892e84afbbaad9d5ad74e091bf6c511d9dbfb0593f09fabd"
 "checksum rustc-demangle 0.1.4 (registry+https://github.com/rust-lang/crates.io-index)" = "3058a43ada2c2d0b92b3ae38007a2d0fa5e9db971be260e0171408a4ff471c95"
 "checksum rustc-serialize 0.3.22 (registry+https://github.com/rust-lang/crates.io-index)" = "237546c689f20bb44980270c73c3b9edd0891c1be49cc1274406134a66d3957b"
 "checksum same-file 0.1.3 (registry+https://github.com/rust-lang/crates.io-index)" = "d931a44fdaa43b8637009e7632a02adc4f2b2e0733c08caa4cf00e8da4a117a7"
diff --git a/toolkit/library/rust/Cargo.lock b/toolkit/library/rust/Cargo.lock
index 0a31f943ce9a..03433913bce8 100644
--- a/toolkit/library/rust/Cargo.lock
+++ b/toolkit/library/rust/Cargo.lock
@@ -1114,6 +1114,11 @@ name = "regex-syntax"
 version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 
+[[package]]
+name = "runloop"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+
 [[package]]
 name = "rust_url_capi"
 version = "0.0.1"
@@ -1458,6 +1463,7 @@ dependencies = [
  "libudev 0.2.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "log 0.3.6 (registry+https://github.com/rust-lang/crates.io-index)",
  "rand 0.3.15 (registry+https://github.com/rust-lang/crates.io-index)",
+ "runloop 0.1.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "winapi 0.2.8 (registry+https://github.com/rust-lang/crates.io-index)",
 ]
 
@@ -1725,6 +1731,7 @@ dependencies = [
 "checksum redox_syscall 0.1.16 (registry+https://github.com/rust-lang/crates.io-index)" = "8dd35cc9a8bdec562c757e3d43c1526b5c6d2653e23e2315065bc25556550753"
 "checksum regex 0.2.1 (registry+https://github.com/rust-lang/crates.io-index)" = "4278c17d0f6d62dfef0ab00028feb45bd7d2102843f80763474eeb1be8a10c01"
 "checksum regex-syntax 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)" = "2f9191b1f57603095f105d317e375d19b1c9c5c3185ea9633a99a6dcbed04457"
+"checksum runloop 0.1.0 (registry+https://github.com/rust-lang/crates.io-index)" = "5d79b4b604167921892e84afbbaad9d5ad74e091bf6c511d9dbfb0593f09fabd"
 "checksum rustc-demangle 0.1.4 (registry+https://github.com/rust-lang/crates.io-index)" = "3058a43ada2c2d0b92b3ae38007a2d0fa5e9db971be260e0171408a4ff471c95"
 "checksum rustc-serialize 0.3.22 (registry+https://github.com/rust-lang/crates.io-index)" = "237546c689f20bb44980270c73c3b9edd0891c1be49cc1274406134a66d3957b"
 "checksum same-file 0.1.3 (registry+https://github.com/rust-lang/crates.io-index)" = "d931a44fdaa43b8637009e7632a02adc4f2b2e0733c08caa4cf00e8da4a117a7"

From 2ae4025eddb82fb9364d4779965466d07fc4d16d Mon Sep 17 00:00:00 2001
From: Sebastian Hengst <archaeopteryx@coole-files.de>
Date: Tue, 19 Sep 2017 16:12:41 +0200
Subject: [PATCH 31/83] Backed out changeset 5cd2ba3bc6c4 (bug 1336389) for
 failing new talos test cpstartup. r=backout

---
 testing/moz.build                             |   3 -
 testing/talos/talos.json                      |   4 +-
 testing/talos/talos/test.py                   |  22 ---
 .../talos/talos/tests/cpstartup/bootstrap.js  | 144 ------------------
 .../talos/tests/cpstartup/chrome.manifest     |   1 -
 .../tests/cpstartup/content/cpstartup.html    |  31 ----
 .../talos/tests/cpstartup/content/target.html |   9 --
 .../tests/cpstartup/cpstartup-signed.xpi      | Bin 3792 -> 0 bytes
 .../talos/tests/cpstartup/cpstartup.manifest  |   1 -
 .../talos/talos/tests/cpstartup/install.rdf   |  24 ---
 toolkit/content/browser-child.js              |   2 -
 11 files changed, 2 insertions(+), 239 deletions(-)
 delete mode 100644 testing/talos/talos/tests/cpstartup/bootstrap.js
 delete mode 100644 testing/talos/talos/tests/cpstartup/chrome.manifest
 delete mode 100644 testing/talos/talos/tests/cpstartup/content/cpstartup.html
 delete mode 100644 testing/talos/talos/tests/cpstartup/content/target.html
 delete mode 100644 testing/talos/talos/tests/cpstartup/cpstartup-signed.xpi
 delete mode 100644 testing/talos/talos/tests/cpstartup/cpstartup.manifest
 delete mode 100644 testing/talos/talos/tests/cpstartup/install.rdf

diff --git a/testing/moz.build b/testing/moz.build
index 1511d530aeb9..eac4fbf702bb 100644
--- a/testing/moz.build
+++ b/testing/moz.build
@@ -46,9 +46,6 @@ with Files("talos/talos/tests/scroll/**"):
 with Files("talos/talos/tests/tabpaint/**"):
     BUG_COMPONENT = ("Firefox", "Tabbed Browser")
 
-with Files("talos/talos/tests/cpstartup/**"):
-    BUG_COMPONENT = ("Firefox", "Tabbed Browser")
-
 with Files("talos/talos/tests/tart/**"):
     BUG_COMPONENT = ("Firefox", "Tabbed Browser")
 
diff --git a/testing/talos/talos.json b/testing/talos/talos.json
index b86c2f029587..dea00b8c2d7d 100644
--- a/testing/talos/talos.json
+++ b/testing/talos/talos.json
@@ -15,11 +15,11 @@
             "tests": ["dromaeo_css", "kraken"]
         },
         "other-e10s": {
-            "tests": ["a11yr", "ts_paint", "tpaint", "sessionrestore", "sessionrestore_many_windows", "sessionrestore_no_auto_restore", "tabpaint", "cpstartup"]
+            "tests": ["a11yr", "ts_paint", "tpaint", "sessionrestore", "sessionrestore_many_windows", "sessionrestore_no_auto_restore", "tabpaint"]
         },
         "other-stylo-disabled-e10s": {
             "talos_options": ["--disable-stylo"],
-            "tests": ["a11yr", "ts_paint", "tpaint", "sessionrestore", "sessionrestore_many_windows", "sessionrestore_no_auto_restore", "tabpaint", "cpstartup"]
+            "tests": ["a11yr", "ts_paint", "tpaint", "sessionrestore", "sessionrestore_many_windows", "sessionrestore_no_auto_restore", "tabpaint"]
         },
         "g1-e10s": {
             "tests": ["tp5o_scroll", "glterrain"],
diff --git a/testing/talos/talos/test.py b/testing/talos/talos/test.py
index 78f01d4c3182..5cd3eb4b5a5e 100644
--- a/testing/talos/talos/test.py
+++ b/testing/talos/talos/test.py
@@ -304,28 +304,6 @@ class tabpaint(PageloaderTest):
     }
 
 
-@register_test()
-class cpstartup(PageloaderTest):
-    """
-
-    """
-    extensions = '${talos}/tests/cpstartup/cpstartup-signed.xpi'
-    tpmanifest = '${talos}/tests/cpstartup/cpstartup.manifest'
-    tppagecycles = 20
-    gecko_profile_entries = 1000000
-    tploadnocache = True
-    unit = 'ms'
-    preferences = {
-        # By default, Talos is configured to open links from
-        # content in new windows. We're overriding them so that
-        # they open in new tabs instead.
-        # See http://kb.mozillazine.org/Browser.link.open_newwindow
-        # and http://kb.mozillazine.org/Browser.link.open_newwindow.restriction
-        'browser.link.open_newwindow': 3,
-        'browser.link.open_newwindow.restriction': 2,
-    }
-
-
 @register_test()
 class tps(PageloaderTest):
     """
diff --git a/testing/talos/talos/tests/cpstartup/bootstrap.js b/testing/talos/talos/tests/cpstartup/bootstrap.js
deleted file mode 100644
index 7edbb7521ee6..000000000000
--- a/testing/talos/talos/tests/cpstartup/bootstrap.js
+++ /dev/null
@@ -1,144 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-var { classes: Cc, interfaces: Ci, utils: Cu } = Components;
-
-Cu.import("resource://gre/modules/Services.jsm");
-
-const PREALLOCATED_PREF = "dom.ipc.processPrelaunch.enabled";
-
-const TARGET_URI = "chrome://cpstartup/content/target.html";
-
-/**
- * The purpose of this test it to measure the performance of a content process startup.
- *
- * In practice it measures a bit more than the content process startup. First the parent
- * process starts the clock and requests a new tab with a simple page and then the child
- * stops the clock in the frame script that will be able to process the URL to handle.
- * So it does measure a few things pre process creation (browser element and tab creation
- * on parent side) but does not measure the part where we actually parse and render the
- * page on the content side, just the overhead of spawning a new content process.
- */
-var CPStartup = {
-  MESSAGES: [
-    "CPStartup:Go",
-    "Content:BrowserChildReady",
-  ],
-
-  readyCallback: null,
-
-  startStamp: null,
-
-  tab: null,
-  /**
-   * Shortcut to getting at the TalosParentProfiler.
-   */
-  get Profiler() {
-    delete this.Profiler;
-    let context = {};
-    Services.scriptloader.loadSubScript("chrome://talos-powers-content/content/TalosParentProfiler.js", context);
-    return this.Profiler = context.TalosParentProfiler;
-  },
-
-  init() {
-    for (let msgName of this.MESSAGES) {
-      Services.mm.addMessageListener(msgName, this);
-    }
-
-    this.originalPreallocatedEnabled = Services.prefs.getBoolPref(PREALLOCATED_PREF);
-    Services.prefs.setBoolPref(PREALLOCATED_PREF, false);
-  },
-
-  uninit() {
-    for (let msgName of this.MESSAGES) {
-      Services.mm.removeMessageListener(msgName, this);
-    }
-
-    Services.prefs.setBoolPref(PREALLOCATED_PREF, this.originalPreallocatedEnabled);
-  },
-
-  receiveMessage(msg) {
-    let browser = msg.target;
-    let gBrowser = browser.ownerGlobal.gBrowser;
-
-    switch (msg.name) {
-      case "CPStartup:Go": {
-        this.openTab(gBrowser).then(results =>
-          this.reportResults(results));
-        break;
-      }
-
-      case "Content:BrowserChildReady": {
-        // Content has reported that it's ready to process an URL.
-        if (!this.readyCallback) {
-          throw new Error("Content:BrowserChildReady fired without a readyCallback set");
-        }
-        let tab = gBrowser.getTabForBrowser(browser);
-        if (tab != this.tab) {
-          // Let's ignore the message if it's not from the tab we've just opened.
-          break;
-        }
-        // The child stopped the timer when it was ready to process the first URL, it's time to
-        // calculate the difference and report it.
-        let delta = msg.data.time - this.startStamp;
-        this.readyCallback({tab, delta});
-        break;
-      }
-    }
-  },
-
-  openTab(gBrowser) {
-    return new Promise((resolve) => {
-      // Start the timer and the profiler right before the tab open on the parent side.
-      this.Profiler.resume("tab opening starts");
-      this.startStamp = Services.telemetry.msSystemNow();
-      this.tab = gBrowser.selectedTab = gBrowser.addTab(TARGET_URI, {
-        triggeringPrincipal: Services.scriptSecurityManager.getSystemPrincipal(),
-      });
-
-      this.whenTabReady().then(({tab, delta}) => {
-        this.Profiler.pause("tab opening end");
-        this.removeTab(tab).then(() => {
-          resolve(delta);
-        });
-      });
-    });
-  },
-
-  whenTabReady() {
-    return new Promise((resolve) => {
-      this.readyCallback = resolve;
-    });
-  },
-
-  removeTab(tab) {
-    return new Promise((resolve) => {
-      let {messageManager: mm, frameLoader} = tab.linkedBrowser;
-      mm.addMessageListener("SessionStore:update", function onMessage(msg) {
-        if (msg.targetFrameLoader == frameLoader && msg.data.isFinal) {
-          mm.removeMessageListener("SessionStore:update", onMessage);
-          resolve();
-        }
-      }, true);
-
-      tab.ownerGlobal.gBrowser.removeTab(tab);
-    });
-  },
-
-  reportResults(results) {
-    Services.mm.broadcastAsyncMessage("CPStartup:FinalResults", results);
-  },
-};
-
-function install(aData, aReason) {}
-
-function startup(aData, aReason) {
-  CPStartup.init();
-}
-
-function shutdown(aData, aReason) {
-  CPStartup.uninit();
-}
-
-function uninstall(aData, aReason) {}
diff --git a/testing/talos/talos/tests/cpstartup/chrome.manifest b/testing/talos/talos/tests/cpstartup/chrome.manifest
deleted file mode 100644
index d349e6b2bf6f..000000000000
--- a/testing/talos/talos/tests/cpstartup/chrome.manifest
+++ /dev/null
@@ -1 +0,0 @@
-content cpstartup content/ remoteenabled=yes contentaccessible=yes
\ No newline at end of file
diff --git a/testing/talos/talos/tests/cpstartup/content/cpstartup.html b/testing/talos/talos/tests/cpstartup/content/cpstartup.html
deleted file mode 100644
index 0cde25597d2d..000000000000
--- a/testing/talos/talos/tests/cpstartup/content/cpstartup.html
+++ /dev/null
@@ -1,31 +0,0 @@
-<html>
-  <head>
-    <script>
-      const { classes: Cc, interfaces: Ci, utils: Cu } = Components;
-
-      function init() {
-        if (document.location.hash.indexOf("#auto") == 0) {
-          let mm = window.QueryInterface(Ci.nsIInterfaceRequestor)
-                         .getInterface(Ci.nsIWebNavigation)
-                         .QueryInterface(Ci.nsIInterfaceRequestor)
-                         .getInterface(Ci.nsIContentFrameMessageManager);
-
-          mm.addMessageListener("CPStartup:FinalResults", function onResults(msg) {
-            mm.removeMessageListener("CPStartup:FinalResults", onResults);
-            let results = msg.data;
-
-            tpRecordTime(results, 0, "content-process-startup");
-          });
-
-          mm.sendAsyncMessage("CPStartup:Go");
-        }
-      }
-
-    </script>
-  </head>
-  <body onload="init();">
-    Hello, Talos!
-
-    <a href="#" id="target" target="_blank">I'll open a new tab</a>
-  </body>
-</html>
diff --git a/testing/talos/talos/tests/cpstartup/content/target.html b/testing/talos/talos/tests/cpstartup/content/target.html
deleted file mode 100644
index fe1b8860b603..000000000000
--- a/testing/talos/talos/tests/cpstartup/content/target.html
+++ /dev/null
@@ -1,9 +0,0 @@
-<html>
-<head>
-<title>Content Process Startup</title>
-<meta http-equiv="Content-Type" content="text/html;charset=utf-8"></meta>
-</head>
-<body>
-<p>Content Process Startup</p>
-</body>
-</html>
diff --git a/testing/talos/talos/tests/cpstartup/cpstartup-signed.xpi b/testing/talos/talos/tests/cpstartup/cpstartup-signed.xpi
deleted file mode 100644
index 03b22a000895f010d76e8445d5c8477763c3350d..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 3792
zcma)9cQl;e+8r%wNYtn?CdwEl>L6-Fi(Y~th%&m-Mg*gm2+_MBqK2Pdq9vk4_#p<-
zq7z0Lg6JW9lkeVK?!CUXzV}_vd)`0J-utZeoadbVXsZzr(gN@S0D!PPn;LHT*F%E)
zvvNTo;Rxhy?SIZ90Yo8yYGp3=q>Xq0Kpg=9K!0JDm8%ER!X4@93bjKzJJso_xl9UB
zv@9FCu31pd-I1<$3v83C2VmLkgII}`3au=Bp5{*R@%)(O?$TUCwhpLy#;H6%k&*f6
z&HBPj9e@$F_)4l{y{b>+LnL>n7cX1R!J4ZjT)r^JiQW9Q)CzAHjA!~e|2ptld-^A%
z>L3>`0@V>?#-y4-y)bJstq$qH5_WKwlSVDNHgP;1F6y2IHW_+Vq0a%WysD`VM9({{
zljnc~1>-%Kqo-lVGYPZ&v4fmpJ$$#den$G&e{4HiC0Xd~fzg`bpXBT@pdP%u=XAE?
z$NaOslbjhL&C~?4nHpf7XgFRiZk-n5>ZoSnlYzu&F4E|rnyFUqO+K3Cjq*{PT5IL-
zLqyhez%8G8n9UKCaDQW4-D~B3cVqTO2{vWZ+_IO$(7>{_h6NyB!?B7w%Aw#4@gy?@
zlYAYUuil29O0_Izn`Tz6pB0lP^2=`Z_W*<3=59`p`^rjW|GL$et!yD9so9O%=rL8-
zk>v9jJX>ZSjP2zfnkd)`oY-#0BYeI8U}-@<Fp@G}{Ov=z0L;R&ao#UZ`rZTM5XWx(
z-~wlqIofty&+A3heTsR3vH-mEWD^Dh)eIEgjQQb`{2muH7m|(3v@IO@znS)oxl7i;
zPOESr5!S#^A6D|xEN8&1HN%|Z*5KNWj7h^mXTuJGon^nJsxlkh?Da=P<OV|Zl_5_m
zeaT|nZK%dWsgu{Y^I^eowuoRExP-_}h6Qh>g+9+Bi52p%B!<h*J%pxP^bCk3CmPTD
zlv|KK+vLMntR}w0)@MJ7&sRHPDXg{!dz;a81psim4ggT#R%_|vg7iSTTew0UJjx7B
zTqa?({s$G}d-ov3<x=Z|cggbYb!k<a*`M4Dx8SjR{`RYCu9EI{b^Dp$ED&tuo=Hc9
zAvVeH-;*>%_uDn<r_eVErsqSl)S3nhZ%uu*+0(a)$>gd}Ud#vcuhz+;hR@#QUPF$R
zk|js4yg=x4K_ErDaYGfWx50i76LZwZVp-AC{2QSKs**j)o=Rm*+#VC)dZM6eKASSK
z?n6_tr00>lJ)~i;R1;ilJ<GGvHt>Nghnn=e7>WrSaMov~JYtI#NqAVL!Gwe<Tu+y7
z-7Ko_)kqRk5t+Y}ofgAZeJSvr`#wsf$w4<P&+YGV6)axR+vxa#G_kPSnlKS6*Dr<U
z&Jx*yoL`bXkzN6Q-oD3^BTGMiPBX9|*u68cLi(O5qe>wiGmJ(Ng*|VJOFx#x9W_{)
zo6UUqVCH{>Itx0gE*s>8^gCcf-87^L(nF$!S;U44ObqG!q$MS-KBfe|MW~mRQK*2B
zn)2m8UPB5hqvK`pMRVj_6_dSnDPvRB2UQ}O^t$1LH+kP(PY*%!@kdraezdLQTSY?C
z>#s>W%|l@I&c{NoEtpsVw#9JgSSh#X@9qyw<7fxoMi93FP?6B+W6@&?=2dVTL$Zs0
ze9dDlayqrB{kZOW!L65!`ZeJ00#@A!gKHrV1=PzF)qfqGrc}%snW=ojUurvDW@@Q_
zN@iT+W}@%R*8t}R3hRm&KvWHsHcLfrksAq#%veADqFZS_K=g3#5tKVLfyAdl^-2|i
zZtbKhi`PJQqY`Z=$lQd{;xBg|f->ba!J&?U%5bosv!(cMh=>W;U6aTp%9O~E1Ebt#
zO<~j0RQ{bFSgta%3CfKfi|SlD#&%|&wm!F;y52X7-4>Z4vfru4i-k~*O4G{v1j`nI
zP|PysZ3W5QEuV`WBHL$=DT2DIznkKJ+*era4HQ=~8AgmAmMUk7Z)&=Fg2|jWrTV>;
zJYoflZ8PSXYlmmJXg29}Vsa!_{{lOkXCI3-P#vCZ+z9n+*f74QQY}wT2wHljSYv$H
zyr?}Hv*B%u%@W!7G@04h1Y3QW*sdM9L&_A5j4lqRZ_iOl%8qMC`BLSSBw-&Zs^x^f
z=iR{2jNM=7uxFl1sa%E|6>^|uImF^@>+LYr_)m3OhijCD4?t(%h#c}@CDcS2K#nru
zp#1>W2_WBQXkNxBO!482!{=J;;{9h?EU(!ft_M`9+w+q_xQS^q*3Menx~Y?QX|zu=
z2W9cgmt*78A7p`@<Q)ZlN1o)7@87;!vlut{vVIz?lD5Xm;%&Z?%rmsV=k3~-3$!({
zq_Zayqw2QC->@4e!c6zVt~wa;ck<eYY3d>tNx9VYayHE0t#*S#;-ykHJC0Kj)H+LO
zvIdl6>~&0kifyyjY~|M%9KfF~1vxqxi-$Z1J>iriH|cJm(rE3u<;%d{*EcpqYwl~2
z9}@_pV&B7*UM_m?RFb7Pu-c1=3OdDy)-oPk8~4&;(a08JFja3%3KZLKdOE0C$R^8-
zesmj(zxb4mi82tu`7H;Q93xyzk^ZTVjU(I0v9_V|_K&HQ3O4IBaTa8Hk@WMBoITv#
z1(zKDrBLC=&aRu>J;18v_u^ZY_;p&@jbERF#??cN`mSWOoT$?p>5(v;bdUH%xAi#c
zq~)`qwh9Tf1*tP5mJ-Rib#EVdwqgZ}`k(zR6Jh*=^^JN+{;!>*N&jcn{<=^>s2ji)
z`nn^vrzh0$9s|{zt|&3n-MR9LPi&!X-j>7dQ*r@ca}~QinT=!EAPBFBnS`NSp)@J5
zAsn3O*4zC>tkmn7h_rmk>`s<>LZ-L6TJuu{8h+VTQ=vtv9tZLi3ehGOGb^Z|@v}0Y
ziA`BoB<Sjk<_^O`2c5oH+XH!<Xr1rdd2iyTT6}^PS=EHn-&SR0#{T4TN60tdp1ZYQ
zXEAUbFY&38K3Y2Xnwsf{J}cGjj~3jGs(A^ZwoEn|I_ir0S#Z<xzWwY=;5}l0p)c87
zQus8auS%Gjwi8Pl*gtfg(h!IiRcD6lpN&?SpHNZdev#LowVu(aWS`r;B5XE?|JPCb
z>uVT|=sT(7??w-oF<w5VS!v}b^QYcve~A%;Ru*zyXx^i|?bv%}wjSJsP1qVn+B#v?
z*E$cc{h|R`#ul`TRHrt!t_)Yos@CdVml93Q6Z^$Vx}&ssqwD*SjDZokg^R|PxWe77
zVmdl~i!L@#p!Om9#k%T8NjY)Opa*qL!J~e$Jg3JfRl=aGQIXPs<vhIQw{8*xhj@<7
zl9cI3`$pJPqVqfMw@FJFCLM?2?lyT`Q2oA<?c80Q;ZSD_guM;i1F6=JhTQ)Q(NTf&
zK=1SMg88*o!Xs87v;`PUYJMSxlWQrzaNMAfz9XMHF;OonN;s&UT?g>*5(_#3<q#aT
zATFqXOZ>~({ZY}=SLx^JL2J|vjcNT68qoTO^xcRRc+w(<hdU)@(F5-SHGMLhnvRo{
zFdvRm2p3G3QbVobPvA~2uK!<&9rueG57OAwunqE$#&8Cef)D^8$7$FjaK_Zh3F>Zb
zlcm?|{zZUxdKnVhY^4<cjnLSaB~_W2zO_(qym#L-x0ug9-!UP4em4GQm6b7UU1T}i
z!(3VHz4U0p2_ZJrVDfPtMaZO6{LHK$hfK~CY#fvkTGcUMDOH*}@qL^(#)@8vFY*mP
zWG$Qa2T1=r?}{ktu&_~?mb~hWeV)LSz#Ef!{WyM-`<tzF1~+#1NYS1llQ~tqj0(@S
zDI1e&F{%&dDrvkKhoAG*v>(3d{G`2G<;9S!J1VRMlVR-6rTm_4CAZB~sF1HQTy+O!
zeHGGk5}sngAPWL<jxn(sBZO+NA~Q*ujFv=P_OCWL@`(rgvR`p3D0@`{$b}5;frevT
z^{HPIl0iF*iD+3=Ueg83Tb4pwC0tD#d#9}0+VPd0Yta79DX6N2#S>_iVP*)Z8F4ET
zh*dUaj^RiZ(AbSV%+=b8)Lpphr{GLdz|gz=g!pjg2AE8yPOSdyMfCU6;03Nn&qhS~
zbK|~zp43qMCPmm}ydxS5Y%!a4@<(T~bzNKQnnS<*{CJ!Qw*2E8W56^G_uLeh@2Krr
zqFDx(@yKOza?*9fEkaqaIfg1a4qhHF?OM$0yJfzuXf+w?YZ@{ydFX$(CrfQs!T{bm
z$mT!A?J+!jTEPF^$lx{s?z#4l;X+&U2X%R4^LsiTfF1Yc!o{Cv=)4$yw>js^B!J8O
zG7k7p4jNpS^@rnvd%j3;nT0(kXu}a)G_)6ymmLh}$O6*;Iwt-T{GTO%4kjVH>;Slk
uzpSp$@m81O|5W)!p37?YoTm%NbD@&8)rfFL9{?c1y*s#K@A~cc0sjNSyHn!;

diff --git a/testing/talos/talos/tests/cpstartup/cpstartup.manifest b/testing/talos/talos/tests/cpstartup/cpstartup.manifest
deleted file mode 100644
index f6f9e5258e4c..000000000000
--- a/testing/talos/talos/tests/cpstartup/cpstartup.manifest
+++ /dev/null
@@ -1 +0,0 @@
-% chrome://cpstartup/content/cpstartup.html#auto
diff --git a/testing/talos/talos/tests/cpstartup/install.rdf b/testing/talos/talos/tests/cpstartup/install.rdf
deleted file mode 100644
index e594dad4cdf1..000000000000
--- a/testing/talos/talos/tests/cpstartup/install.rdf
+++ /dev/null
@@ -1,24 +0,0 @@
-<?xml version="1.0"?>
-<RDF xmlns="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:em="http://www.mozilla.org/2004/em-rdf#">
-  <Description about="urn:mozilla:install-manifest">
-    <em:id>cpstartup-test@mozilla.org</em:id>
-    <em:type>2</em:type>
-    <em:name>cpstartup test</em:name>
-    <em:version>1.0.0</em:version>
-    <em:bootstrap>true</em:bootstrap>
-    <em:description>Measures the performance of starting and initializing new content processes</em:description>
-    <em:creator>Gabor Krizsanits</em:creator>
-    <em:multiprocessCompatible>true</em:multiprocessCompatible>
-
-    <!-- Desktop -->
-    <em:targetApplication>
-      <Description>
-        <em:id>{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id>
-        <em:minVersion>55.0</em:minVersion>
-        <em:maxVersion>*</em:maxVersion>
-      </Description>
-    </em:targetApplication>
-  </Description>
-  <em:description>https://wiki.mozilla.org/Buildbot/Talos/Tests</em:description>
-  <em:homepageURL>https://wiki.mozilla.org/Buildbot/Talos/Tests</em:homepageURL>
-</RDF>
diff --git a/toolkit/content/browser-child.js b/toolkit/content/browser-child.js
index 8b64e2276421..3b3b3277b554 100644
--- a/toolkit/content/browser-child.js
+++ b/toolkit/content/browser-child.js
@@ -257,8 +257,6 @@ var WebNavigation =  {
     addMessageListener("WebNavigation:SetOriginAttributes", this);
     addMessageListener("WebNavigation:Reload", this);
     addMessageListener("WebNavigation:Stop", this);
-    // This message is used for measuring content process startup performance.
-    sendAsyncMessage("Content:BrowserChildReady", { time: Services.telemetry.msSystemNow() });
   },
 
   get webNavigation() {

From 624fdefa5712e08d6cf0b02499a4872baffd5ca2 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Tue, 19 Sep 2017 10:13:22 -0400
Subject: [PATCH 32/83] Bug 1400898 part 1.  Remove the one script use of
 nsIDOMChromeWindow.  r=farre

MozReview-Commit-ID: I31eceiJP55
---
 browser/components/downloads/content/downloads.js | 2 +-
 dom/interfaces/base/nsIDOMChromeWindow.idl        | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/browser/components/downloads/content/downloads.js b/browser/components/downloads/content/downloads.js
index 934ecf74baec..a31046fb524a 100644
--- a/browser/components/downloads/content/downloads.js
+++ b/browser/components/downloads/content/downloads.js
@@ -547,7 +547,7 @@ var DownloadsPanel = {
       // without any notification, and there would be no way to either open or
       // close the panel any more.  To prevent this, check if the window is
       // minimized and in that case force the panel to the closed state.
-      if (window.windowState == Ci.nsIDOMChromeWindow.STATE_MINIMIZED) {
+      if (window.windowState == window.STATE_MINIMIZED) {
         DownloadsButton.releaseAnchor();
         this._state = this.kStateHidden;
         return;
diff --git a/dom/interfaces/base/nsIDOMChromeWindow.idl b/dom/interfaces/base/nsIDOMChromeWindow.idl
index 600aa46eb6e2..2d428b1ca7a8 100644
--- a/dom/interfaces/base/nsIDOMChromeWindow.idl
+++ b/dom/interfaces/base/nsIDOMChromeWindow.idl
@@ -11,7 +11,8 @@ interface nsIDOMEvent;
 interface nsIMessageBroadcaster;
 interface mozIDOMWindowProxy;
 
-[scriptable, uuid(78bdcb41-1efa-409f-aaba-70842213f80f)]
+// Scriptable only so Components.interfaces.nsIDOMChromeWindow works.
+[scriptable, builtinclass, uuid(78bdcb41-1efa-409f-aaba-70842213f80f)]
 interface nsIDOMChromeWindow : nsISupports
 {
   const unsigned short STATE_MAXIMIZED = 1;

From b4ae7df9690071bcd5f040925ba7b8c0951d2ee2 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Tue, 19 Sep 2017 10:13:22 -0400
Subject: [PATCH 33/83] Bug 1400898 part 2.  Get rid of the interface constants
 on nsIDOMChromeWindow.  r=farre

MozReview-Commit-ID: 4FuJSgha5y3
---
 dom/base/nsGlobalWindow.cpp                | 18 +++++++++++++-----
 dom/interfaces/base/nsIDOMChromeWindow.idl |  5 -----
 dom/webidl/Window.webidl                   |  1 +
 3 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index e325b3f56879..099db9ce558e 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -14074,6 +14074,14 @@ nsGlobalChromeWindow::GetWindowState(uint16_t* aWindowState)
   return NS_OK;
 }
 
+enum WindowState {
+  // These constants need to match the constants in Window.webidl
+  STATE_MAXIMIZED = 1,
+  STATE_MINIMIZED = 2,
+  STATE_NORMAL = 3,
+  STATE_FULLSCREEN = 4
+};
+
 uint16_t
 nsGlobalWindow::WindowState()
 {
@@ -14084,19 +14092,19 @@ nsGlobalWindow::WindowState()
 
   switch (mode) {
     case nsSizeMode_Minimized:
-      return nsIDOMChromeWindow::STATE_MINIMIZED;
+      return STATE_MINIMIZED;
     case nsSizeMode_Maximized:
-      return nsIDOMChromeWindow::STATE_MAXIMIZED;
+      return STATE_MAXIMIZED;
     case nsSizeMode_Fullscreen:
-      return nsIDOMChromeWindow::STATE_FULLSCREEN;
+      return STATE_FULLSCREEN;
     case nsSizeMode_Normal:
-      return nsIDOMChromeWindow::STATE_NORMAL;
+      return STATE_NORMAL;
     default:
       NS_WARNING("Illegal window state for this chrome window");
       break;
   }
 
-  return nsIDOMChromeWindow::STATE_NORMAL;
+  return STATE_NORMAL;
 }
 
 bool
diff --git a/dom/interfaces/base/nsIDOMChromeWindow.idl b/dom/interfaces/base/nsIDOMChromeWindow.idl
index 2d428b1ca7a8..a63c8dab5ef5 100644
--- a/dom/interfaces/base/nsIDOMChromeWindow.idl
+++ b/dom/interfaces/base/nsIDOMChromeWindow.idl
@@ -15,11 +15,6 @@ interface mozIDOMWindowProxy;
 [scriptable, builtinclass, uuid(78bdcb41-1efa-409f-aaba-70842213f80f)]
 interface nsIDOMChromeWindow : nsISupports
 {
-  const unsigned short STATE_MAXIMIZED = 1;
-  const unsigned short STATE_MINIMIZED = 2;
-  const unsigned short STATE_NORMAL = 3;
-  const unsigned short STATE_FULLSCREEN = 4;
-
   readonly attribute unsigned short              windowState;
 
   /**
diff --git a/dom/webidl/Window.webidl b/dom/webidl/Window.webidl
index 50b2965a72e0..a3b2a8e53701 100644
--- a/dom/webidl/Window.webidl
+++ b/dom/webidl/Window.webidl
@@ -375,6 +375,7 @@ partial interface Window {
 
 [Func="IsChromeOrXBL"]
 interface ChromeWindow {
+  // The STATE_* constants need to match the corresponding enum in nsGlobalWindow.cpp.
   [Func="nsGlobalWindow::IsPrivilegedChromeWindow"]
   const unsigned short STATE_MAXIMIZED = 1;
   [Func="nsGlobalWindow::IsPrivilegedChromeWindow"]

From ff472070b58d6f1dd466b681cfa69a9efb0a9314 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Tue, 19 Sep 2017 10:13:23 -0400
Subject: [PATCH 34/83] Bug 1400898 part 3.  Make
 nsIDOMChromeWindow.browserDOMWindow readonly.  r=farre

C++ code only reads this attribute.  Code that sets it comes via WebIDL bindings.

MozReview-Commit-ID: 2itFAxUVTBo
---
 dom/base/nsGlobalWindow.cpp                | 10 ----------
 dom/interfaces/base/nsIDOMChromeWindow.idl |  2 +-
 2 files changed, 1 insertion(+), 11 deletions(-)

diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index 099db9ce558e..92c0077ff726 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -14385,16 +14385,6 @@ nsGlobalWindow::GetBrowserDOMWindow(ErrorResult& aError)
   FORWARD_TO_OUTER_OR_THROW(GetBrowserDOMWindowOuter, (), aError, nullptr);
 }
 
-NS_IMETHODIMP
-nsGlobalChromeWindow::SetBrowserDOMWindow(nsIBrowserDOMWindow *aBrowserWindow)
-{
-  FORWARD_TO_INNER_CHROME(SetBrowserDOMWindow, (aBrowserWindow), NS_ERROR_UNEXPECTED);
-
-  ErrorResult rv;
-  SetBrowserDOMWindow(aBrowserWindow, rv);
-  return rv.StealNSResult();
-}
-
 void
 nsGlobalWindow::SetBrowserDOMWindowOuter(nsIBrowserDOMWindow* aBrowserWindow)
 {
diff --git a/dom/interfaces/base/nsIDOMChromeWindow.idl b/dom/interfaces/base/nsIDOMChromeWindow.idl
index a63c8dab5ef5..94c0d5a68aa6 100644
--- a/dom/interfaces/base/nsIDOMChromeWindow.idl
+++ b/dom/interfaces/base/nsIDOMChromeWindow.idl
@@ -22,7 +22,7 @@ interface nsIDOMChromeWindow : nsISupports
    * utility functions implemented by chrome script. It will be null
    * for DOMWindows not corresponding to browsers.
    */
-           attribute nsIBrowserDOMWindow browserDOMWindow;
+  readonly attribute nsIBrowserDOMWindow browserDOMWindow;
 
   void                      getAttention();
 

From d9be58174db4df19df2244671341da2974c62a97 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Tue, 19 Sep 2017 10:13:23 -0400
Subject: [PATCH 35/83] Bug 1400898 part 4.  Get rid of nsIDOMChromeWindow
 methods that are unused from C++, and mark the rest [noscript].  r=farre

MozReview-Commit-ID: GtYmfg6XiaQ
---
 dom/base/nsGlobalWindow.cpp                | 97 ----------------------
 dom/interfaces/base/nsIDOMChromeWindow.idl | 36 ++------
 2 files changed, 5 insertions(+), 128 deletions(-)

diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index 92c0077ff726..ff610d0b39b2 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -14065,15 +14065,6 @@ nsGlobalChromeWindow::Create(nsGlobalWindow *aOuterWindow)
   return window.forget();
 }
 
-NS_IMETHODIMP
-nsGlobalChromeWindow::GetWindowState(uint16_t* aWindowState)
-{
-  FORWARD_TO_INNER_CHROME(GetWindowState, (aWindowState), NS_ERROR_UNEXPECTED);
-
-  *aWindowState = WindowState();
-  return NS_OK;
-}
-
 enum WindowState {
   // These constants need to match the constants in Window.webidl
   STATE_MAXIMIZED = 1,
@@ -14116,15 +14107,6 @@ nsGlobalWindow::IsFullyOccluded()
   return widget && widget->IsFullyOccluded();
 }
 
-NS_IMETHODIMP
-nsGlobalChromeWindow::Maximize()
-{
-  FORWARD_TO_INNER_CHROME(Maximize, (), NS_ERROR_UNEXPECTED);
-
-  nsGlobalWindow::Maximize();
-  return NS_OK;
-}
-
 void
 nsGlobalWindow::Maximize()
 {
@@ -14137,15 +14119,6 @@ nsGlobalWindow::Maximize()
   }
 }
 
-NS_IMETHODIMP
-nsGlobalChromeWindow::Minimize()
-{
-  FORWARD_TO_INNER_CHROME(Minimize, (), NS_ERROR_UNEXPECTED);
-
-  nsGlobalWindow::Minimize();
-  return NS_OK;
-}
-
 void
 nsGlobalWindow::Minimize()
 {
@@ -14158,15 +14131,6 @@ nsGlobalWindow::Minimize()
   }
 }
 
-NS_IMETHODIMP
-nsGlobalChromeWindow::Restore()
-{
-  FORWARD_TO_INNER_CHROME(Restore, (), NS_ERROR_UNEXPECTED);
-
-  nsGlobalWindow::Restore();
-  return NS_OK;
-}
-
 void
 nsGlobalWindow::Restore()
 {
@@ -14179,16 +14143,6 @@ nsGlobalWindow::Restore()
   }
 }
 
-NS_IMETHODIMP
-nsGlobalChromeWindow::GetAttention()
-{
-  FORWARD_TO_INNER_CHROME(GetAttention, (), NS_ERROR_UNEXPECTED);
-
-  ErrorResult rv;
-  GetAttention(rv);
-  return rv.StealNSResult();
-}
-
 void
 nsGlobalWindow::GetAttention(ErrorResult& aResult)
 {
@@ -14196,16 +14150,6 @@ nsGlobalWindow::GetAttention(ErrorResult& aResult)
   return GetAttentionWithCycleCount(-1, aResult);
 }
 
-NS_IMETHODIMP
-nsGlobalChromeWindow::GetAttentionWithCycleCount(int32_t aCycleCount)
-{
-  FORWARD_TO_INNER_CHROME(GetAttentionWithCycleCount, (aCycleCount), NS_ERROR_UNEXPECTED);
-
-  ErrorResult rv;
-  GetAttentionWithCycleCount(aCycleCount, rv);
-  return rv.StealNSResult();
-}
-
 void
 nsGlobalWindow::GetAttentionWithCycleCount(int32_t aCycleCount,
                                            ErrorResult& aError)
@@ -14219,23 +14163,6 @@ nsGlobalWindow::GetAttentionWithCycleCount(int32_t aCycleCount,
   }
 }
 
-NS_IMETHODIMP
-nsGlobalChromeWindow::BeginWindowMove(nsIDOMEvent *aMouseDownEvent, nsIDOMElement* aPanel)
-{
-  FORWARD_TO_INNER_CHROME(BeginWindowMove, (aMouseDownEvent, aPanel), NS_ERROR_UNEXPECTED);
-
-  NS_ENSURE_TRUE(aMouseDownEvent, NS_ERROR_FAILURE);
-  Event* mouseDownEvent = aMouseDownEvent->InternalDOMEvent();
-  NS_ENSURE_TRUE(mouseDownEvent, NS_ERROR_FAILURE);
-
-  nsCOMPtr<Element> panel = do_QueryInterface(aPanel);
-  NS_ENSURE_TRUE(panel || !aPanel, NS_ERROR_FAILURE);
-
-  ErrorResult rv;
-  BeginWindowMove(*mouseDownEvent, panel, rv);
-  return rv.StealNSResult();
-}
-
 void
 nsGlobalWindow::BeginWindowMove(Event& aMouseDownEvent, Element* aPanel,
                                 ErrorResult& aError)
@@ -14291,16 +14218,6 @@ nsGlobalWindow::GetWindowRoot(mozilla::ErrorResult& aError)
 
 //Note: This call will lock the cursor, it will not change as it moves.
 //To unlock, the cursor must be set back to CURSOR_AUTO.
-NS_IMETHODIMP
-nsGlobalChromeWindow::SetCursor(const nsAString& aCursor)
-{
-  FORWARD_TO_INNER_CHROME(SetCursor, (aCursor), NS_ERROR_UNEXPECTED);
-
-  ErrorResult rv;
-  SetCursor(aCursor, rv);
-  return rv.StealNSResult();
-}
-
 void
 nsGlobalWindow::SetCursorOuter(const nsAString& aCursor, ErrorResult& aError)
 {
@@ -14400,20 +14317,6 @@ nsGlobalWindow::SetBrowserDOMWindow(nsIBrowserDOMWindow* aBrowserWindow,
   FORWARD_TO_OUTER_OR_THROW(SetBrowserDOMWindowOuter, (aBrowserWindow), aError, );
 }
 
-NS_IMETHODIMP
-nsGlobalChromeWindow::NotifyDefaultButtonLoaded(nsIDOMElement* aDefaultButton)
-{
-  FORWARD_TO_INNER_CHROME(NotifyDefaultButtonLoaded,
-                          (aDefaultButton), NS_ERROR_UNEXPECTED);
-
-  nsCOMPtr<Element> defaultButton = do_QueryInterface(aDefaultButton);
-  NS_ENSURE_ARG(defaultButton);
-
-  ErrorResult rv;
-  NotifyDefaultButtonLoaded(*defaultButton, rv);
-  return rv.StealNSResult();
-}
-
 void
 nsGlobalWindow::NotifyDefaultButtonLoaded(Element& aDefaultButton,
                                           ErrorResult& aError)
diff --git a/dom/interfaces/base/nsIDOMChromeWindow.idl b/dom/interfaces/base/nsIDOMChromeWindow.idl
index 94c0d5a68aa6..77f2840da1cc 100644
--- a/dom/interfaces/base/nsIDOMChromeWindow.idl
+++ b/dom/interfaces/base/nsIDOMChromeWindow.idl
@@ -15,52 +15,24 @@ interface mozIDOMWindowProxy;
 [scriptable, builtinclass, uuid(78bdcb41-1efa-409f-aaba-70842213f80f)]
 interface nsIDOMChromeWindow : nsISupports
 {
-  readonly attribute unsigned short              windowState;
-
   /**
    * browserDOMWindow provides access to yet another layer of
    * utility functions implemented by chrome script. It will be null
    * for DOMWindows not corresponding to browsers.
    */
+  [noscript]
   readonly attribute nsIBrowserDOMWindow browserDOMWindow;
 
-  void                      getAttention();
-
-  void                      getAttentionWithCycleCount(in long aCycleCount);
-
-  void                      setCursor(in DOMString cursor);
-
-  void                      maximize();
-  void                      minimize();
-  void                      restore();
-
-  /**
-   * Notify a default button is loaded on a dialog or a wizard.
-   * defaultButton is the default button.
-   */
-  void notifyDefaultButtonLoaded(in nsIDOMElement defaultButton);
-
+  [noscript]
   readonly attribute nsIMessageBroadcaster messageManager;
 
   /**
    * Returns the message manager identified by the given group name that
    * manages all frame loaders belonging to that group.
    */
+  [noscript]
   nsIMessageBroadcaster getGroupMessageManager(in AString group);
 
-  /**
-   * On some operating systems, we must allow the window manager to
-   * handle window dragging. This function tells the window manager to
-   * start dragging the window. This function will fail unless called
-   * while the left mouse button is held down, callers must check this.
-   *
-   * The optional panel argument should be set when moving a panel.
-   *
-   * Returns NS_ERROR_NOT_IMPLEMENTED (and thus throws in JS) if the OS
-   * doesn't support this.
-   */
-  void beginWindowMove(in nsIDOMEvent mouseDownEvent, [optional] in nsIDOMElement panel);
-
   /**
    * These methods provide a way to specify the opener value for the content in
    * the window before the content itself is created. This is important in order
@@ -72,6 +44,8 @@ interface nsIDOMChromeWindow : nsISupports
    * take the value set earlier, and null out the value in the
    * nsIDOMChromeWindow.
    */
+  [noscript]
   void setOpenerForInitialContentBrowser(in mozIDOMWindowProxy aOpener);
+  [noscript]
   mozIDOMWindowProxy takeOpenerForInitialContentBrowser();
 };

From 5c70c284145b24dfdb2934605d703dd0c1773a62 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Sun, 11 Jun 2017 00:07:23 -0400
Subject: [PATCH 36/83] Bug 1401204 - Make nsIMultiplexInputStream not inherit
 from nsIInputStream.  r=bkelly

This is a preexisting issue that makes nsMultiplexInputStream multiple-inherit
from nsIInputStream: once via nsIMultipartInputStream and once via
nsIAsyncInputStream.  This causes problems once we end up with more multiplex
streams that are async streams, because then some assingments to
nsCOMPtr<nsIInputStream> start asserting.  This patch just removes the footgun
by getting rid of the multiple inheritance.
---
 dom/file/MultipartBlobImpl.cpp                |  2 +-
 dom/html/HTMLFormSubmission.cpp               | 11 +++++++---
 dom/html/HTMLFormSubmission.h                 |  8 ++++++-
 dom/network/TCPSocket.cpp                     |  6 +++--
 .../PresentationTCPSessionTransport.cpp       |  3 ++-
 dom/workers/FileReaderSync.cpp                |  4 +++-
 netwerk/protocol/http/nsHttpTransaction.cpp   |  3 ++-
 xpcom/io/nsIMultiplexInputStream.idl          |  2 +-
 xpcom/io/nsMultiplexInputStream.cpp           |  6 ++---
 xpcom/tests/gtest/TestCloneInputStream.cpp    | 12 ++++++----
 .../tests/gtest/TestMultiplexInputStream.cpp  | 22 ++++++++++---------
 11 files changed, 51 insertions(+), 28 deletions(-)

diff --git a/dom/file/MultipartBlobImpl.cpp b/dom/file/MultipartBlobImpl.cpp
index 73af16cf145c..3d062f116947 100644
--- a/dom/file/MultipartBlobImpl.cpp
+++ b/dom/file/MultipartBlobImpl.cpp
@@ -85,7 +85,7 @@ MultipartBlobImpl::GetInternalStream(nsIInputStream** aStream,
     }
   }
 
-  stream.forget(aStream);
+  CallQueryInterface(stream, aStream);
 }
 
 already_AddRefed<BlobImpl>
diff --git a/dom/html/HTMLFormSubmission.cpp b/dom/html/HTMLFormSubmission.cpp
index 97fec081e15b..a249282cf8e2 100644
--- a/dom/html/HTMLFormSubmission.cpp
+++ b/dom/html/HTMLFormSubmission.cpp
@@ -394,8 +394,13 @@ FSMultipartFormData::FSMultipartFormData(NotNull<const Encoding*> aEncoding,
                                          nsIContent* aOriginatingElement)
   : EncodingFormSubmission(aEncoding, aOriginatingElement)
 {
-  mPostDataStream =
+  mPostData =
     do_CreateInstance("@mozilla.org/io/multiplex-input-stream;1");
+
+  nsCOMPtr<nsIInputStream> inputStream = do_QueryInterface(mPostData);
+  MOZ_ASSERT(SameCOMIdentity(mPostData, inputStream));
+  mPostDataStream = inputStream;
+
   mTotalLength = 0;
 
   mBoundary.AssignLiteral("---------------------------");
@@ -600,7 +605,7 @@ FSMultipartFormData::AddDataChunk(const nsACString& aName,
     // here, since we're about to add the file input stream
     AddPostDataStream();
 
-    mPostDataStream->AppendStream(aInputStream);
+    mPostData->AppendStream(aInputStream);
     mTotalLength += aInputStreamSize;
   }
 
@@ -640,7 +645,7 @@ FSMultipartFormData::AddPostDataStream()
                                 mPostDataChunk);
   NS_ASSERTION(postDataChunkStream, "Could not open a stream for POST!");
   if (postDataChunkStream) {
-    mPostDataStream->AppendStream(postDataChunkStream);
+    mPostData->AppendStream(postDataChunkStream);
     mTotalLength += mPostDataChunk.Length();
   }
 
diff --git a/dom/html/HTMLFormSubmission.h b/dom/html/HTMLFormSubmission.h
index 138a5214fb7e..7eea8f3924a9 100644
--- a/dom/html/HTMLFormSubmission.h
+++ b/dom/html/HTMLFormSubmission.h
@@ -193,7 +193,13 @@ private:
    * chunks--string streams and file streams interleaved to make one big POST
    * stream.
    */
-  nsCOMPtr<nsIMultiplexInputStream> mPostDataStream;
+  nsCOMPtr<nsIMultiplexInputStream> mPostData;
+
+  /**
+   * The same stream, but as an nsIInputStream.
+   * Raw pointers because it is just QI of mInputStream.
+   */
+  nsIInputStream* mPostDataStream;
 
   /**
    * The current string chunk.  When a file is hit, the string chunk gets
diff --git a/dom/network/TCPSocket.cpp b/dom/network/TCPSocket.cpp
index 4403e1fa55d7..d3c4b57939a0 100644
--- a/dom/network/TCPSocket.cpp
+++ b/dom/network/TCPSocket.cpp
@@ -210,6 +210,7 @@ TCPSocket::CreateStream()
 
   mMultiplexStream = do_CreateInstance("@mozilla.org/io/multiplex-input-stream;1", &rv);
   NS_ENSURE_SUCCESS(rv, rv);
+  nsCOMPtr<nsIInputStream> stream = do_QueryInterface(mMultiplexStream);
 
   mMultiplexStreamCopier = do_CreateInstance("@mozilla.org/network/async-stream-copier;1", &rv);
   NS_ENSURE_SUCCESS(rv, rv);
@@ -218,7 +219,7 @@ TCPSocket::CreateStream()
       do_GetService("@mozilla.org/network/socket-transport-service;1");
 
   nsCOMPtr<nsIEventTarget> target = do_QueryInterface(sts);
-  rv = mMultiplexStreamCopier->Init(mMultiplexStream,
+  rv = mMultiplexStreamCopier->Init(stream,
                                     mSocketOutputStream,
                                     target,
                                     true, /* source buffered */
@@ -596,7 +597,8 @@ TCPSocket::BufferedAmount()
   }
   if (mMultiplexStream) {
     uint64_t available = 0;
-    mMultiplexStream->Available(&available);
+    nsCOMPtr<nsIInputStream> stream(do_QueryInterface(mMultiplexStream));
+    stream->Available(&available);
     return available;
   }
   return 0;
diff --git a/dom/presentation/PresentationTCPSessionTransport.cpp b/dom/presentation/PresentationTCPSessionTransport.cpp
index 103d388cddeb..65db9b890b6c 100644
--- a/dom/presentation/PresentationTCPSessionTransport.cpp
+++ b/dom/presentation/PresentationTCPSessionTransport.cpp
@@ -240,6 +240,7 @@ PresentationTCPSessionTransport::CreateStream()
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return rv;
   }
+  nsCOMPtr<nsIInputStream> stream = do_QueryInterface(mMultiplexStream);
 
   mMultiplexStreamCopier = do_CreateInstance("@mozilla.org/network/async-stream-copier;1", &rv);
   if (NS_WARN_IF(NS_FAILED(rv))) {
@@ -253,7 +254,7 @@ PresentationTCPSessionTransport::CreateStream()
   }
 
   nsCOMPtr<nsIEventTarget> target = do_QueryInterface(sts);
-  rv = mMultiplexStreamCopier->Init(mMultiplexStream,
+  rv = mMultiplexStreamCopier->Init(stream,
                                     mSocketOutputStream,
                                     target,
                                     true, /* source buffered */
diff --git a/dom/workers/FileReaderSync.cpp b/dom/workers/FileReaderSync.cpp
index 301f0045232b..2e02d2c92965 100644
--- a/dom/workers/FileReaderSync.cpp
+++ b/dom/workers/FileReaderSync.cpp
@@ -232,7 +232,9 @@ FileReaderSync::ReadAsText(Blob& aBlob,
 
   nsAutoCString charset;
   encoding->Name(charset);
-  aRv = ConvertStream(multiplexStream, charset.get(), aResult);
+
+  nsCOMPtr<nsIInputStream> multiplex(do_QueryInterface(multiplexStream));
+  aRv = ConvertStream(multiplex, charset.get(), aResult);
   if (NS_WARN_IF(aRv.Failed())) {
     return;
   }
diff --git a/netwerk/protocol/http/nsHttpTransaction.cpp b/netwerk/protocol/http/nsHttpTransaction.cpp
index d6efcf0641ce..52eb74bd7560 100644
--- a/netwerk/protocol/http/nsHttpTransaction.cpp
+++ b/netwerk/protocol/http/nsHttpTransaction.cpp
@@ -382,7 +382,8 @@ nsHttpTransaction::Init(uint32_t caps,
         // wrap the multiplexed input stream with a buffered input stream, so
         // that we write data in the largest chunks possible.  this is actually
         // necessary to workaround some common server bugs (see bug 137155).
-        rv = NS_NewBufferedInputStream(getter_AddRefs(mRequestStream), multi,
+        nsCOMPtr<nsIInputStream> stream(do_QueryInterface(multi));
+        rv = NS_NewBufferedInputStream(getter_AddRefs(mRequestStream), stream,
                                        nsIOService::gDefaultSegmentSize);
         if (NS_FAILED(rv)) return rv;
     } else {
diff --git a/xpcom/io/nsIMultiplexInputStream.idl b/xpcom/io/nsIMultiplexInputStream.idl
index d42adcbd40fa..f01d6ecacd39 100644
--- a/xpcom/io/nsIMultiplexInputStream.idl
+++ b/xpcom/io/nsIMultiplexInputStream.idl
@@ -11,7 +11,7 @@
  */
 
 [scriptable, uuid(a076fd12-1dd1-11b2-b19a-d53b5dffaade)]
-interface nsIMultiplexInputStream : nsIInputStream
+interface nsIMultiplexInputStream : nsISupports
 {
     /**
      * Number of streams in this multiplex-stream
diff --git a/xpcom/io/nsMultiplexInputStream.cpp b/xpcom/io/nsMultiplexInputStream.cpp
index 646878cdd5d6..f81057821ed3 100644
--- a/xpcom/io/nsMultiplexInputStream.cpp
+++ b/xpcom/io/nsMultiplexInputStream.cpp
@@ -103,7 +103,7 @@ NS_IMPL_CLASSINFO(nsMultiplexInputStream, nullptr, nsIClassInfo::THREADSAFE,
 
 NS_INTERFACE_MAP_BEGIN(nsMultiplexInputStream)
   NS_INTERFACE_MAP_ENTRY(nsIMultiplexInputStream)
-  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsIInputStream, nsIMultiplexInputStream)
+  NS_INTERFACE_MAP_ENTRY(nsIInputStream)
   NS_INTERFACE_MAP_ENTRY_CONDITIONAL(nsISeekableStream, IsSeekable())
   NS_INTERFACE_MAP_ENTRY_CONDITIONAL(nsIIPCSerializableInputStream,
                                      IsIPCSerializable())
@@ -349,7 +349,7 @@ nsMultiplexInputStream::ReadSegments(nsWriteSegmentFun aWriter, void* aClosure,
 
   nsresult rv = NS_OK;
   ReadSegmentsState state;
-  state.mThisStream = static_cast<nsIMultiplexInputStream*>(this);
+  state.mThisStream = this;
   state.mOffset = 0;
   state.mWriter = aWriter;
   state.mClosure = aClosure;
@@ -1048,7 +1048,7 @@ nsMultiplexInputStream::Clone(nsIInputStream** aClone)
     return NS_ERROR_FAILURE;
   }
 
-  nsCOMPtr<nsIMultiplexInputStream> clone = new nsMultiplexInputStream();
+  RefPtr<nsMultiplexInputStream> clone = new nsMultiplexInputStream();
 
   nsresult rv;
   uint32_t len = mStreams.Length();
diff --git a/xpcom/tests/gtest/TestCloneInputStream.cpp b/xpcom/tests/gtest/TestCloneInputStream.cpp
index de4dd5ea3be7..678a7a65b99a 100644
--- a/xpcom/tests/gtest/TestCloneInputStream.cpp
+++ b/xpcom/tests/gtest/TestCloneInputStream.cpp
@@ -116,8 +116,10 @@ TEST(CloneInputStream, NonCloneableInput_Fallback)
 
 TEST(CloneInputStream, CloneMultiplexStream)
 {
-  nsCOMPtr<nsIMultiplexInputStream> stream =
+  nsCOMPtr<nsIMultiplexInputStream> multiplexStream =
     do_CreateInstance("@mozilla.org/io/multiplex-input-stream;1");
+  ASSERT_TRUE(multiplexStream);
+  nsCOMPtr<nsIInputStream> stream(do_QueryInterface(multiplexStream));
   ASSERT_TRUE(stream);
 
   nsTArray<char> inputData;
@@ -129,7 +131,7 @@ TEST(CloneInputStream, CloneMultiplexStream)
     nsresult rv = NS_NewCStringInputStream(getter_AddRefs(base), inputString);
     ASSERT_TRUE(NS_SUCCEEDED(rv));
 
-    rv = stream->AppendStream(base);
+    rv = multiplexStream->AppendStream(base);
     ASSERT_TRUE(NS_SUCCEEDED(rv));
   }
 
@@ -156,8 +158,10 @@ TEST(CloneInputStream, CloneMultiplexStream)
 
 TEST(CloneInputStream, CloneMultiplexStreamPartial)
 {
-  nsCOMPtr<nsIMultiplexInputStream> stream =
+  nsCOMPtr<nsIMultiplexInputStream> multiplexStream =
     do_CreateInstance("@mozilla.org/io/multiplex-input-stream;1");
+  ASSERT_TRUE(multiplexStream);
+  nsCOMPtr<nsIInputStream> stream(do_QueryInterface(multiplexStream));
   ASSERT_TRUE(stream);
 
   nsTArray<char> inputData;
@@ -169,7 +173,7 @@ TEST(CloneInputStream, CloneMultiplexStreamPartial)
     nsresult rv = NS_NewCStringInputStream(getter_AddRefs(base), inputString);
     ASSERT_TRUE(NS_SUCCEEDED(rv));
 
-    rv = stream->AppendStream(base);
+    rv = multiplexStream->AppendStream(base);
     ASSERT_TRUE(NS_SUCCEEDED(rv));
   }
 
diff --git a/xpcom/tests/gtest/TestMultiplexInputStream.cpp b/xpcom/tests/gtest/TestMultiplexInputStream.cpp
index ce2a6dca968b..179d612da9f2 100644
--- a/xpcom/tests/gtest/TestMultiplexInputStream.cpp
+++ b/xpcom/tests/gtest/TestMultiplexInputStream.cpp
@@ -34,6 +34,8 @@ TEST(MultiplexInputStream, Seek_SET)
   nsCOMPtr<nsIMultiplexInputStream> multiplexStream =
     do_CreateInstance("@mozilla.org/io/multiplex-input-stream;1");
   ASSERT_TRUE(multiplexStream);
+  nsCOMPtr<nsIInputStream> stream(do_QueryInterface(multiplexStream));
+  ASSERT_TRUE(stream);
 
   rv = multiplexStream->AppendStream(inputStream1);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
@@ -51,16 +53,16 @@ TEST(MultiplexInputStream, Seek_SET)
   // Seek forward in first input stream
   rv = seekStream->Seek(nsISeekableStream::NS_SEEK_SET, 1);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
-  rv = multiplexStream->Available(&length);
+  rv = stream->Available(&length);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)buf1.Length() + buf2.Length() + buf3.Length() - 1,
             length);
 
   // Check read is correct
-  rv = multiplexStream->Read(readBuf, 3, &count);
+  rv = stream->Read(readBuf, 3, &count);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)3, count);
-  rv = multiplexStream->Available(&length);
+  rv = stream->Available(&length);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)buf1.Length() + buf2.Length() + buf3.Length() - 4,
             length);
@@ -70,15 +72,15 @@ TEST(MultiplexInputStream, Seek_SET)
   rv = seekStream->Seek(nsISeekableStream::NS_SEEK_SET,
                         buf1.Length() + buf2.Length());
   ASSERT_TRUE(NS_SUCCEEDED(rv));
-  rv = multiplexStream->Available(&length);
+  rv = stream->Available(&length);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)buf3.Length(), length);
 
   // Check read is correct
-  rv = multiplexStream->Read(readBuf, 5, &count);
+  rv = stream->Read(readBuf, 5, &count);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)5, count);
-  rv = multiplexStream->Available(&length);
+  rv = stream->Available(&length);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)buf3.Length() - 5, length);
   ASSERT_EQ(0, strncmp(readBuf, "Foo b", count));
@@ -86,16 +88,16 @@ TEST(MultiplexInputStream, Seek_SET)
   // Seek back to start of second stream (covers bug 1272371)
   rv = seekStream->Seek(nsISeekableStream::NS_SEEK_SET, buf1.Length());
   ASSERT_TRUE(NS_SUCCEEDED(rv));
-  rv = multiplexStream->Available(&length);
+  rv = stream->Available(&length);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)buf2.Length() + buf3.Length(), length);
 
   // Check read is correct
-  rv = multiplexStream->Read(readBuf, 6, &count);
+  rv = stream->Read(readBuf, 6, &count);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)6, count);
-  rv = multiplexStream->Available(&length);
+  rv = stream->Available(&length);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)buf2.Length() - 6 + buf3.Length(), length);
   ASSERT_EQ(0, strncmp(readBuf, "The qu", count));
-}
\ No newline at end of file
+}

From 7973633f8454dab507c37fcb9c766fdb164aa7f1 Mon Sep 17 00:00:00 2001
From: Sebastian Hengst <archaeopteryx@coole-files.de>
Date: Tue, 19 Sep 2017 16:25:20 +0200
Subject: [PATCH 37/83] Backed out changeset 3c9e25405f59 (bug 1401204) an
 request from baku for landing with wrong bug number. r=backout

---
 dom/file/MultipartBlobImpl.cpp                |  2 +-
 dom/html/HTMLFormSubmission.cpp               | 11 +++-------
 dom/html/HTMLFormSubmission.h                 |  8 +------
 dom/network/TCPSocket.cpp                     |  6 ++---
 .../PresentationTCPSessionTransport.cpp       |  3 +--
 dom/workers/FileReaderSync.cpp                |  4 +---
 netwerk/protocol/http/nsHttpTransaction.cpp   |  3 +--
 xpcom/io/nsIMultiplexInputStream.idl          |  2 +-
 xpcom/io/nsMultiplexInputStream.cpp           |  6 ++---
 xpcom/tests/gtest/TestCloneInputStream.cpp    | 12 ++++------
 .../tests/gtest/TestMultiplexInputStream.cpp  | 22 +++++++++----------
 11 files changed, 28 insertions(+), 51 deletions(-)

diff --git a/dom/file/MultipartBlobImpl.cpp b/dom/file/MultipartBlobImpl.cpp
index 3d062f116947..73af16cf145c 100644
--- a/dom/file/MultipartBlobImpl.cpp
+++ b/dom/file/MultipartBlobImpl.cpp
@@ -85,7 +85,7 @@ MultipartBlobImpl::GetInternalStream(nsIInputStream** aStream,
     }
   }
 
-  CallQueryInterface(stream, aStream);
+  stream.forget(aStream);
 }
 
 already_AddRefed<BlobImpl>
diff --git a/dom/html/HTMLFormSubmission.cpp b/dom/html/HTMLFormSubmission.cpp
index a249282cf8e2..97fec081e15b 100644
--- a/dom/html/HTMLFormSubmission.cpp
+++ b/dom/html/HTMLFormSubmission.cpp
@@ -394,13 +394,8 @@ FSMultipartFormData::FSMultipartFormData(NotNull<const Encoding*> aEncoding,
                                          nsIContent* aOriginatingElement)
   : EncodingFormSubmission(aEncoding, aOriginatingElement)
 {
-  mPostData =
+  mPostDataStream =
     do_CreateInstance("@mozilla.org/io/multiplex-input-stream;1");
-
-  nsCOMPtr<nsIInputStream> inputStream = do_QueryInterface(mPostData);
-  MOZ_ASSERT(SameCOMIdentity(mPostData, inputStream));
-  mPostDataStream = inputStream;
-
   mTotalLength = 0;
 
   mBoundary.AssignLiteral("---------------------------");
@@ -605,7 +600,7 @@ FSMultipartFormData::AddDataChunk(const nsACString& aName,
     // here, since we're about to add the file input stream
     AddPostDataStream();
 
-    mPostData->AppendStream(aInputStream);
+    mPostDataStream->AppendStream(aInputStream);
     mTotalLength += aInputStreamSize;
   }
 
@@ -645,7 +640,7 @@ FSMultipartFormData::AddPostDataStream()
                                 mPostDataChunk);
   NS_ASSERTION(postDataChunkStream, "Could not open a stream for POST!");
   if (postDataChunkStream) {
-    mPostData->AppendStream(postDataChunkStream);
+    mPostDataStream->AppendStream(postDataChunkStream);
     mTotalLength += mPostDataChunk.Length();
   }
 
diff --git a/dom/html/HTMLFormSubmission.h b/dom/html/HTMLFormSubmission.h
index 7eea8f3924a9..138a5214fb7e 100644
--- a/dom/html/HTMLFormSubmission.h
+++ b/dom/html/HTMLFormSubmission.h
@@ -193,13 +193,7 @@ private:
    * chunks--string streams and file streams interleaved to make one big POST
    * stream.
    */
-  nsCOMPtr<nsIMultiplexInputStream> mPostData;
-
-  /**
-   * The same stream, but as an nsIInputStream.
-   * Raw pointers because it is just QI of mInputStream.
-   */
-  nsIInputStream* mPostDataStream;
+  nsCOMPtr<nsIMultiplexInputStream> mPostDataStream;
 
   /**
    * The current string chunk.  When a file is hit, the string chunk gets
diff --git a/dom/network/TCPSocket.cpp b/dom/network/TCPSocket.cpp
index d3c4b57939a0..4403e1fa55d7 100644
--- a/dom/network/TCPSocket.cpp
+++ b/dom/network/TCPSocket.cpp
@@ -210,7 +210,6 @@ TCPSocket::CreateStream()
 
   mMultiplexStream = do_CreateInstance("@mozilla.org/io/multiplex-input-stream;1", &rv);
   NS_ENSURE_SUCCESS(rv, rv);
-  nsCOMPtr<nsIInputStream> stream = do_QueryInterface(mMultiplexStream);
 
   mMultiplexStreamCopier = do_CreateInstance("@mozilla.org/network/async-stream-copier;1", &rv);
   NS_ENSURE_SUCCESS(rv, rv);
@@ -219,7 +218,7 @@ TCPSocket::CreateStream()
       do_GetService("@mozilla.org/network/socket-transport-service;1");
 
   nsCOMPtr<nsIEventTarget> target = do_QueryInterface(sts);
-  rv = mMultiplexStreamCopier->Init(stream,
+  rv = mMultiplexStreamCopier->Init(mMultiplexStream,
                                     mSocketOutputStream,
                                     target,
                                     true, /* source buffered */
@@ -597,8 +596,7 @@ TCPSocket::BufferedAmount()
   }
   if (mMultiplexStream) {
     uint64_t available = 0;
-    nsCOMPtr<nsIInputStream> stream(do_QueryInterface(mMultiplexStream));
-    stream->Available(&available);
+    mMultiplexStream->Available(&available);
     return available;
   }
   return 0;
diff --git a/dom/presentation/PresentationTCPSessionTransport.cpp b/dom/presentation/PresentationTCPSessionTransport.cpp
index 65db9b890b6c..103d388cddeb 100644
--- a/dom/presentation/PresentationTCPSessionTransport.cpp
+++ b/dom/presentation/PresentationTCPSessionTransport.cpp
@@ -240,7 +240,6 @@ PresentationTCPSessionTransport::CreateStream()
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return rv;
   }
-  nsCOMPtr<nsIInputStream> stream = do_QueryInterface(mMultiplexStream);
 
   mMultiplexStreamCopier = do_CreateInstance("@mozilla.org/network/async-stream-copier;1", &rv);
   if (NS_WARN_IF(NS_FAILED(rv))) {
@@ -254,7 +253,7 @@ PresentationTCPSessionTransport::CreateStream()
   }
 
   nsCOMPtr<nsIEventTarget> target = do_QueryInterface(sts);
-  rv = mMultiplexStreamCopier->Init(stream,
+  rv = mMultiplexStreamCopier->Init(mMultiplexStream,
                                     mSocketOutputStream,
                                     target,
                                     true, /* source buffered */
diff --git a/dom/workers/FileReaderSync.cpp b/dom/workers/FileReaderSync.cpp
index 2e02d2c92965..301f0045232b 100644
--- a/dom/workers/FileReaderSync.cpp
+++ b/dom/workers/FileReaderSync.cpp
@@ -232,9 +232,7 @@ FileReaderSync::ReadAsText(Blob& aBlob,
 
   nsAutoCString charset;
   encoding->Name(charset);
-
-  nsCOMPtr<nsIInputStream> multiplex(do_QueryInterface(multiplexStream));
-  aRv = ConvertStream(multiplex, charset.get(), aResult);
+  aRv = ConvertStream(multiplexStream, charset.get(), aResult);
   if (NS_WARN_IF(aRv.Failed())) {
     return;
   }
diff --git a/netwerk/protocol/http/nsHttpTransaction.cpp b/netwerk/protocol/http/nsHttpTransaction.cpp
index 52eb74bd7560..d6efcf0641ce 100644
--- a/netwerk/protocol/http/nsHttpTransaction.cpp
+++ b/netwerk/protocol/http/nsHttpTransaction.cpp
@@ -382,8 +382,7 @@ nsHttpTransaction::Init(uint32_t caps,
         // wrap the multiplexed input stream with a buffered input stream, so
         // that we write data in the largest chunks possible.  this is actually
         // necessary to workaround some common server bugs (see bug 137155).
-        nsCOMPtr<nsIInputStream> stream(do_QueryInterface(multi));
-        rv = NS_NewBufferedInputStream(getter_AddRefs(mRequestStream), stream,
+        rv = NS_NewBufferedInputStream(getter_AddRefs(mRequestStream), multi,
                                        nsIOService::gDefaultSegmentSize);
         if (NS_FAILED(rv)) return rv;
     } else {
diff --git a/xpcom/io/nsIMultiplexInputStream.idl b/xpcom/io/nsIMultiplexInputStream.idl
index f01d6ecacd39..d42adcbd40fa 100644
--- a/xpcom/io/nsIMultiplexInputStream.idl
+++ b/xpcom/io/nsIMultiplexInputStream.idl
@@ -11,7 +11,7 @@
  */
 
 [scriptable, uuid(a076fd12-1dd1-11b2-b19a-d53b5dffaade)]
-interface nsIMultiplexInputStream : nsISupports
+interface nsIMultiplexInputStream : nsIInputStream
 {
     /**
      * Number of streams in this multiplex-stream
diff --git a/xpcom/io/nsMultiplexInputStream.cpp b/xpcom/io/nsMultiplexInputStream.cpp
index f81057821ed3..646878cdd5d6 100644
--- a/xpcom/io/nsMultiplexInputStream.cpp
+++ b/xpcom/io/nsMultiplexInputStream.cpp
@@ -103,7 +103,7 @@ NS_IMPL_CLASSINFO(nsMultiplexInputStream, nullptr, nsIClassInfo::THREADSAFE,
 
 NS_INTERFACE_MAP_BEGIN(nsMultiplexInputStream)
   NS_INTERFACE_MAP_ENTRY(nsIMultiplexInputStream)
-  NS_INTERFACE_MAP_ENTRY(nsIInputStream)
+  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsIInputStream, nsIMultiplexInputStream)
   NS_INTERFACE_MAP_ENTRY_CONDITIONAL(nsISeekableStream, IsSeekable())
   NS_INTERFACE_MAP_ENTRY_CONDITIONAL(nsIIPCSerializableInputStream,
                                      IsIPCSerializable())
@@ -349,7 +349,7 @@ nsMultiplexInputStream::ReadSegments(nsWriteSegmentFun aWriter, void* aClosure,
 
   nsresult rv = NS_OK;
   ReadSegmentsState state;
-  state.mThisStream = this;
+  state.mThisStream = static_cast<nsIMultiplexInputStream*>(this);
   state.mOffset = 0;
   state.mWriter = aWriter;
   state.mClosure = aClosure;
@@ -1048,7 +1048,7 @@ nsMultiplexInputStream::Clone(nsIInputStream** aClone)
     return NS_ERROR_FAILURE;
   }
 
-  RefPtr<nsMultiplexInputStream> clone = new nsMultiplexInputStream();
+  nsCOMPtr<nsIMultiplexInputStream> clone = new nsMultiplexInputStream();
 
   nsresult rv;
   uint32_t len = mStreams.Length();
diff --git a/xpcom/tests/gtest/TestCloneInputStream.cpp b/xpcom/tests/gtest/TestCloneInputStream.cpp
index 678a7a65b99a..de4dd5ea3be7 100644
--- a/xpcom/tests/gtest/TestCloneInputStream.cpp
+++ b/xpcom/tests/gtest/TestCloneInputStream.cpp
@@ -116,10 +116,8 @@ TEST(CloneInputStream, NonCloneableInput_Fallback)
 
 TEST(CloneInputStream, CloneMultiplexStream)
 {
-  nsCOMPtr<nsIMultiplexInputStream> multiplexStream =
+  nsCOMPtr<nsIMultiplexInputStream> stream =
     do_CreateInstance("@mozilla.org/io/multiplex-input-stream;1");
-  ASSERT_TRUE(multiplexStream);
-  nsCOMPtr<nsIInputStream> stream(do_QueryInterface(multiplexStream));
   ASSERT_TRUE(stream);
 
   nsTArray<char> inputData;
@@ -131,7 +129,7 @@ TEST(CloneInputStream, CloneMultiplexStream)
     nsresult rv = NS_NewCStringInputStream(getter_AddRefs(base), inputString);
     ASSERT_TRUE(NS_SUCCEEDED(rv));
 
-    rv = multiplexStream->AppendStream(base);
+    rv = stream->AppendStream(base);
     ASSERT_TRUE(NS_SUCCEEDED(rv));
   }
 
@@ -158,10 +156,8 @@ TEST(CloneInputStream, CloneMultiplexStream)
 
 TEST(CloneInputStream, CloneMultiplexStreamPartial)
 {
-  nsCOMPtr<nsIMultiplexInputStream> multiplexStream =
+  nsCOMPtr<nsIMultiplexInputStream> stream =
     do_CreateInstance("@mozilla.org/io/multiplex-input-stream;1");
-  ASSERT_TRUE(multiplexStream);
-  nsCOMPtr<nsIInputStream> stream(do_QueryInterface(multiplexStream));
   ASSERT_TRUE(stream);
 
   nsTArray<char> inputData;
@@ -173,7 +169,7 @@ TEST(CloneInputStream, CloneMultiplexStreamPartial)
     nsresult rv = NS_NewCStringInputStream(getter_AddRefs(base), inputString);
     ASSERT_TRUE(NS_SUCCEEDED(rv));
 
-    rv = multiplexStream->AppendStream(base);
+    rv = stream->AppendStream(base);
     ASSERT_TRUE(NS_SUCCEEDED(rv));
   }
 
diff --git a/xpcom/tests/gtest/TestMultiplexInputStream.cpp b/xpcom/tests/gtest/TestMultiplexInputStream.cpp
index 179d612da9f2..ce2a6dca968b 100644
--- a/xpcom/tests/gtest/TestMultiplexInputStream.cpp
+++ b/xpcom/tests/gtest/TestMultiplexInputStream.cpp
@@ -34,8 +34,6 @@ TEST(MultiplexInputStream, Seek_SET)
   nsCOMPtr<nsIMultiplexInputStream> multiplexStream =
     do_CreateInstance("@mozilla.org/io/multiplex-input-stream;1");
   ASSERT_TRUE(multiplexStream);
-  nsCOMPtr<nsIInputStream> stream(do_QueryInterface(multiplexStream));
-  ASSERT_TRUE(stream);
 
   rv = multiplexStream->AppendStream(inputStream1);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
@@ -53,16 +51,16 @@ TEST(MultiplexInputStream, Seek_SET)
   // Seek forward in first input stream
   rv = seekStream->Seek(nsISeekableStream::NS_SEEK_SET, 1);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
-  rv = stream->Available(&length);
+  rv = multiplexStream->Available(&length);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)buf1.Length() + buf2.Length() + buf3.Length() - 1,
             length);
 
   // Check read is correct
-  rv = stream->Read(readBuf, 3, &count);
+  rv = multiplexStream->Read(readBuf, 3, &count);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)3, count);
-  rv = stream->Available(&length);
+  rv = multiplexStream->Available(&length);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)buf1.Length() + buf2.Length() + buf3.Length() - 4,
             length);
@@ -72,15 +70,15 @@ TEST(MultiplexInputStream, Seek_SET)
   rv = seekStream->Seek(nsISeekableStream::NS_SEEK_SET,
                         buf1.Length() + buf2.Length());
   ASSERT_TRUE(NS_SUCCEEDED(rv));
-  rv = stream->Available(&length);
+  rv = multiplexStream->Available(&length);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)buf3.Length(), length);
 
   // Check read is correct
-  rv = stream->Read(readBuf, 5, &count);
+  rv = multiplexStream->Read(readBuf, 5, &count);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)5, count);
-  rv = stream->Available(&length);
+  rv = multiplexStream->Available(&length);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)buf3.Length() - 5, length);
   ASSERT_EQ(0, strncmp(readBuf, "Foo b", count));
@@ -88,16 +86,16 @@ TEST(MultiplexInputStream, Seek_SET)
   // Seek back to start of second stream (covers bug 1272371)
   rv = seekStream->Seek(nsISeekableStream::NS_SEEK_SET, buf1.Length());
   ASSERT_TRUE(NS_SUCCEEDED(rv));
-  rv = stream->Available(&length);
+  rv = multiplexStream->Available(&length);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)buf2.Length() + buf3.Length(), length);
 
   // Check read is correct
-  rv = stream->Read(readBuf, 6, &count);
+  rv = multiplexStream->Read(readBuf, 6, &count);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)6, count);
-  rv = stream->Available(&length);
+  rv = multiplexStream->Available(&length);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)buf2.Length() - 6 + buf3.Length(), length);
   ASSERT_EQ(0, strncmp(readBuf, "The qu", count));
-}
+}
\ No newline at end of file

From 203072cfe1e84bcecaa69e5b54f950fcb8af01c4 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Tue, 19 Sep 2017 16:26:21 +0200
Subject: [PATCH 38/83] Bug 1401171 - Make nsIMultiplexInputStream not inherit
 from nsIInputStream.  r=bkelly

This is a preexisting issue that makes nsMultiplexInputStream multiple-inherit
from nsIInputStream: once via nsIMultipartInputStream and once via
nsIAsyncInputStream.  This causes problems once we end up with more multiplex
streams that are async streams, because then some assingments to
nsCOMPtr<nsIInputStream> start asserting.  This patch just removes the footgun
by getting rid of the multiple inheritance.
---
 dom/file/MultipartBlobImpl.cpp                |  2 +-
 dom/html/HTMLFormSubmission.cpp               | 11 +++++++---
 dom/html/HTMLFormSubmission.h                 |  8 ++++++-
 dom/network/TCPSocket.cpp                     |  6 +++--
 .../PresentationTCPSessionTransport.cpp       |  3 ++-
 dom/workers/FileReaderSync.cpp                |  4 +++-
 netwerk/protocol/http/nsHttpTransaction.cpp   |  3 ++-
 xpcom/io/nsIMultiplexInputStream.idl          |  2 +-
 xpcom/io/nsMultiplexInputStream.cpp           |  6 ++---
 xpcom/tests/gtest/TestCloneInputStream.cpp    | 12 ++++++----
 .../tests/gtest/TestMultiplexInputStream.cpp  | 22 ++++++++++---------
 11 files changed, 51 insertions(+), 28 deletions(-)

diff --git a/dom/file/MultipartBlobImpl.cpp b/dom/file/MultipartBlobImpl.cpp
index 73af16cf145c..3d062f116947 100644
--- a/dom/file/MultipartBlobImpl.cpp
+++ b/dom/file/MultipartBlobImpl.cpp
@@ -85,7 +85,7 @@ MultipartBlobImpl::GetInternalStream(nsIInputStream** aStream,
     }
   }
 
-  stream.forget(aStream);
+  CallQueryInterface(stream, aStream);
 }
 
 already_AddRefed<BlobImpl>
diff --git a/dom/html/HTMLFormSubmission.cpp b/dom/html/HTMLFormSubmission.cpp
index 97fec081e15b..a249282cf8e2 100644
--- a/dom/html/HTMLFormSubmission.cpp
+++ b/dom/html/HTMLFormSubmission.cpp
@@ -394,8 +394,13 @@ FSMultipartFormData::FSMultipartFormData(NotNull<const Encoding*> aEncoding,
                                          nsIContent* aOriginatingElement)
   : EncodingFormSubmission(aEncoding, aOriginatingElement)
 {
-  mPostDataStream =
+  mPostData =
     do_CreateInstance("@mozilla.org/io/multiplex-input-stream;1");
+
+  nsCOMPtr<nsIInputStream> inputStream = do_QueryInterface(mPostData);
+  MOZ_ASSERT(SameCOMIdentity(mPostData, inputStream));
+  mPostDataStream = inputStream;
+
   mTotalLength = 0;
 
   mBoundary.AssignLiteral("---------------------------");
@@ -600,7 +605,7 @@ FSMultipartFormData::AddDataChunk(const nsACString& aName,
     // here, since we're about to add the file input stream
     AddPostDataStream();
 
-    mPostDataStream->AppendStream(aInputStream);
+    mPostData->AppendStream(aInputStream);
     mTotalLength += aInputStreamSize;
   }
 
@@ -640,7 +645,7 @@ FSMultipartFormData::AddPostDataStream()
                                 mPostDataChunk);
   NS_ASSERTION(postDataChunkStream, "Could not open a stream for POST!");
   if (postDataChunkStream) {
-    mPostDataStream->AppendStream(postDataChunkStream);
+    mPostData->AppendStream(postDataChunkStream);
     mTotalLength += mPostDataChunk.Length();
   }
 
diff --git a/dom/html/HTMLFormSubmission.h b/dom/html/HTMLFormSubmission.h
index 138a5214fb7e..7eea8f3924a9 100644
--- a/dom/html/HTMLFormSubmission.h
+++ b/dom/html/HTMLFormSubmission.h
@@ -193,7 +193,13 @@ private:
    * chunks--string streams and file streams interleaved to make one big POST
    * stream.
    */
-  nsCOMPtr<nsIMultiplexInputStream> mPostDataStream;
+  nsCOMPtr<nsIMultiplexInputStream> mPostData;
+
+  /**
+   * The same stream, but as an nsIInputStream.
+   * Raw pointers because it is just QI of mInputStream.
+   */
+  nsIInputStream* mPostDataStream;
 
   /**
    * The current string chunk.  When a file is hit, the string chunk gets
diff --git a/dom/network/TCPSocket.cpp b/dom/network/TCPSocket.cpp
index 4403e1fa55d7..d3c4b57939a0 100644
--- a/dom/network/TCPSocket.cpp
+++ b/dom/network/TCPSocket.cpp
@@ -210,6 +210,7 @@ TCPSocket::CreateStream()
 
   mMultiplexStream = do_CreateInstance("@mozilla.org/io/multiplex-input-stream;1", &rv);
   NS_ENSURE_SUCCESS(rv, rv);
+  nsCOMPtr<nsIInputStream> stream = do_QueryInterface(mMultiplexStream);
 
   mMultiplexStreamCopier = do_CreateInstance("@mozilla.org/network/async-stream-copier;1", &rv);
   NS_ENSURE_SUCCESS(rv, rv);
@@ -218,7 +219,7 @@ TCPSocket::CreateStream()
       do_GetService("@mozilla.org/network/socket-transport-service;1");
 
   nsCOMPtr<nsIEventTarget> target = do_QueryInterface(sts);
-  rv = mMultiplexStreamCopier->Init(mMultiplexStream,
+  rv = mMultiplexStreamCopier->Init(stream,
                                     mSocketOutputStream,
                                     target,
                                     true, /* source buffered */
@@ -596,7 +597,8 @@ TCPSocket::BufferedAmount()
   }
   if (mMultiplexStream) {
     uint64_t available = 0;
-    mMultiplexStream->Available(&available);
+    nsCOMPtr<nsIInputStream> stream(do_QueryInterface(mMultiplexStream));
+    stream->Available(&available);
     return available;
   }
   return 0;
diff --git a/dom/presentation/PresentationTCPSessionTransport.cpp b/dom/presentation/PresentationTCPSessionTransport.cpp
index 103d388cddeb..65db9b890b6c 100644
--- a/dom/presentation/PresentationTCPSessionTransport.cpp
+++ b/dom/presentation/PresentationTCPSessionTransport.cpp
@@ -240,6 +240,7 @@ PresentationTCPSessionTransport::CreateStream()
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return rv;
   }
+  nsCOMPtr<nsIInputStream> stream = do_QueryInterface(mMultiplexStream);
 
   mMultiplexStreamCopier = do_CreateInstance("@mozilla.org/network/async-stream-copier;1", &rv);
   if (NS_WARN_IF(NS_FAILED(rv))) {
@@ -253,7 +254,7 @@ PresentationTCPSessionTransport::CreateStream()
   }
 
   nsCOMPtr<nsIEventTarget> target = do_QueryInterface(sts);
-  rv = mMultiplexStreamCopier->Init(mMultiplexStream,
+  rv = mMultiplexStreamCopier->Init(stream,
                                     mSocketOutputStream,
                                     target,
                                     true, /* source buffered */
diff --git a/dom/workers/FileReaderSync.cpp b/dom/workers/FileReaderSync.cpp
index 301f0045232b..2e02d2c92965 100644
--- a/dom/workers/FileReaderSync.cpp
+++ b/dom/workers/FileReaderSync.cpp
@@ -232,7 +232,9 @@ FileReaderSync::ReadAsText(Blob& aBlob,
 
   nsAutoCString charset;
   encoding->Name(charset);
-  aRv = ConvertStream(multiplexStream, charset.get(), aResult);
+
+  nsCOMPtr<nsIInputStream> multiplex(do_QueryInterface(multiplexStream));
+  aRv = ConvertStream(multiplex, charset.get(), aResult);
   if (NS_WARN_IF(aRv.Failed())) {
     return;
   }
diff --git a/netwerk/protocol/http/nsHttpTransaction.cpp b/netwerk/protocol/http/nsHttpTransaction.cpp
index d6efcf0641ce..52eb74bd7560 100644
--- a/netwerk/protocol/http/nsHttpTransaction.cpp
+++ b/netwerk/protocol/http/nsHttpTransaction.cpp
@@ -382,7 +382,8 @@ nsHttpTransaction::Init(uint32_t caps,
         // wrap the multiplexed input stream with a buffered input stream, so
         // that we write data in the largest chunks possible.  this is actually
         // necessary to workaround some common server bugs (see bug 137155).
-        rv = NS_NewBufferedInputStream(getter_AddRefs(mRequestStream), multi,
+        nsCOMPtr<nsIInputStream> stream(do_QueryInterface(multi));
+        rv = NS_NewBufferedInputStream(getter_AddRefs(mRequestStream), stream,
                                        nsIOService::gDefaultSegmentSize);
         if (NS_FAILED(rv)) return rv;
     } else {
diff --git a/xpcom/io/nsIMultiplexInputStream.idl b/xpcom/io/nsIMultiplexInputStream.idl
index d42adcbd40fa..f01d6ecacd39 100644
--- a/xpcom/io/nsIMultiplexInputStream.idl
+++ b/xpcom/io/nsIMultiplexInputStream.idl
@@ -11,7 +11,7 @@
  */
 
 [scriptable, uuid(a076fd12-1dd1-11b2-b19a-d53b5dffaade)]
-interface nsIMultiplexInputStream : nsIInputStream
+interface nsIMultiplexInputStream : nsISupports
 {
     /**
      * Number of streams in this multiplex-stream
diff --git a/xpcom/io/nsMultiplexInputStream.cpp b/xpcom/io/nsMultiplexInputStream.cpp
index 646878cdd5d6..f81057821ed3 100644
--- a/xpcom/io/nsMultiplexInputStream.cpp
+++ b/xpcom/io/nsMultiplexInputStream.cpp
@@ -103,7 +103,7 @@ NS_IMPL_CLASSINFO(nsMultiplexInputStream, nullptr, nsIClassInfo::THREADSAFE,
 
 NS_INTERFACE_MAP_BEGIN(nsMultiplexInputStream)
   NS_INTERFACE_MAP_ENTRY(nsIMultiplexInputStream)
-  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsIInputStream, nsIMultiplexInputStream)
+  NS_INTERFACE_MAP_ENTRY(nsIInputStream)
   NS_INTERFACE_MAP_ENTRY_CONDITIONAL(nsISeekableStream, IsSeekable())
   NS_INTERFACE_MAP_ENTRY_CONDITIONAL(nsIIPCSerializableInputStream,
                                      IsIPCSerializable())
@@ -349,7 +349,7 @@ nsMultiplexInputStream::ReadSegments(nsWriteSegmentFun aWriter, void* aClosure,
 
   nsresult rv = NS_OK;
   ReadSegmentsState state;
-  state.mThisStream = static_cast<nsIMultiplexInputStream*>(this);
+  state.mThisStream = this;
   state.mOffset = 0;
   state.mWriter = aWriter;
   state.mClosure = aClosure;
@@ -1048,7 +1048,7 @@ nsMultiplexInputStream::Clone(nsIInputStream** aClone)
     return NS_ERROR_FAILURE;
   }
 
-  nsCOMPtr<nsIMultiplexInputStream> clone = new nsMultiplexInputStream();
+  RefPtr<nsMultiplexInputStream> clone = new nsMultiplexInputStream();
 
   nsresult rv;
   uint32_t len = mStreams.Length();
diff --git a/xpcom/tests/gtest/TestCloneInputStream.cpp b/xpcom/tests/gtest/TestCloneInputStream.cpp
index de4dd5ea3be7..678a7a65b99a 100644
--- a/xpcom/tests/gtest/TestCloneInputStream.cpp
+++ b/xpcom/tests/gtest/TestCloneInputStream.cpp
@@ -116,8 +116,10 @@ TEST(CloneInputStream, NonCloneableInput_Fallback)
 
 TEST(CloneInputStream, CloneMultiplexStream)
 {
-  nsCOMPtr<nsIMultiplexInputStream> stream =
+  nsCOMPtr<nsIMultiplexInputStream> multiplexStream =
     do_CreateInstance("@mozilla.org/io/multiplex-input-stream;1");
+  ASSERT_TRUE(multiplexStream);
+  nsCOMPtr<nsIInputStream> stream(do_QueryInterface(multiplexStream));
   ASSERT_TRUE(stream);
 
   nsTArray<char> inputData;
@@ -129,7 +131,7 @@ TEST(CloneInputStream, CloneMultiplexStream)
     nsresult rv = NS_NewCStringInputStream(getter_AddRefs(base), inputString);
     ASSERT_TRUE(NS_SUCCEEDED(rv));
 
-    rv = stream->AppendStream(base);
+    rv = multiplexStream->AppendStream(base);
     ASSERT_TRUE(NS_SUCCEEDED(rv));
   }
 
@@ -156,8 +158,10 @@ TEST(CloneInputStream, CloneMultiplexStream)
 
 TEST(CloneInputStream, CloneMultiplexStreamPartial)
 {
-  nsCOMPtr<nsIMultiplexInputStream> stream =
+  nsCOMPtr<nsIMultiplexInputStream> multiplexStream =
     do_CreateInstance("@mozilla.org/io/multiplex-input-stream;1");
+  ASSERT_TRUE(multiplexStream);
+  nsCOMPtr<nsIInputStream> stream(do_QueryInterface(multiplexStream));
   ASSERT_TRUE(stream);
 
   nsTArray<char> inputData;
@@ -169,7 +173,7 @@ TEST(CloneInputStream, CloneMultiplexStreamPartial)
     nsresult rv = NS_NewCStringInputStream(getter_AddRefs(base), inputString);
     ASSERT_TRUE(NS_SUCCEEDED(rv));
 
-    rv = stream->AppendStream(base);
+    rv = multiplexStream->AppendStream(base);
     ASSERT_TRUE(NS_SUCCEEDED(rv));
   }
 
diff --git a/xpcom/tests/gtest/TestMultiplexInputStream.cpp b/xpcom/tests/gtest/TestMultiplexInputStream.cpp
index ce2a6dca968b..179d612da9f2 100644
--- a/xpcom/tests/gtest/TestMultiplexInputStream.cpp
+++ b/xpcom/tests/gtest/TestMultiplexInputStream.cpp
@@ -34,6 +34,8 @@ TEST(MultiplexInputStream, Seek_SET)
   nsCOMPtr<nsIMultiplexInputStream> multiplexStream =
     do_CreateInstance("@mozilla.org/io/multiplex-input-stream;1");
   ASSERT_TRUE(multiplexStream);
+  nsCOMPtr<nsIInputStream> stream(do_QueryInterface(multiplexStream));
+  ASSERT_TRUE(stream);
 
   rv = multiplexStream->AppendStream(inputStream1);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
@@ -51,16 +53,16 @@ TEST(MultiplexInputStream, Seek_SET)
   // Seek forward in first input stream
   rv = seekStream->Seek(nsISeekableStream::NS_SEEK_SET, 1);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
-  rv = multiplexStream->Available(&length);
+  rv = stream->Available(&length);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)buf1.Length() + buf2.Length() + buf3.Length() - 1,
             length);
 
   // Check read is correct
-  rv = multiplexStream->Read(readBuf, 3, &count);
+  rv = stream->Read(readBuf, 3, &count);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)3, count);
-  rv = multiplexStream->Available(&length);
+  rv = stream->Available(&length);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)buf1.Length() + buf2.Length() + buf3.Length() - 4,
             length);
@@ -70,15 +72,15 @@ TEST(MultiplexInputStream, Seek_SET)
   rv = seekStream->Seek(nsISeekableStream::NS_SEEK_SET,
                         buf1.Length() + buf2.Length());
   ASSERT_TRUE(NS_SUCCEEDED(rv));
-  rv = multiplexStream->Available(&length);
+  rv = stream->Available(&length);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)buf3.Length(), length);
 
   // Check read is correct
-  rv = multiplexStream->Read(readBuf, 5, &count);
+  rv = stream->Read(readBuf, 5, &count);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)5, count);
-  rv = multiplexStream->Available(&length);
+  rv = stream->Available(&length);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)buf3.Length() - 5, length);
   ASSERT_EQ(0, strncmp(readBuf, "Foo b", count));
@@ -86,16 +88,16 @@ TEST(MultiplexInputStream, Seek_SET)
   // Seek back to start of second stream (covers bug 1272371)
   rv = seekStream->Seek(nsISeekableStream::NS_SEEK_SET, buf1.Length());
   ASSERT_TRUE(NS_SUCCEEDED(rv));
-  rv = multiplexStream->Available(&length);
+  rv = stream->Available(&length);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)buf2.Length() + buf3.Length(), length);
 
   // Check read is correct
-  rv = multiplexStream->Read(readBuf, 6, &count);
+  rv = stream->Read(readBuf, 6, &count);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)6, count);
-  rv = multiplexStream->Available(&length);
+  rv = stream->Available(&length);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   ASSERT_EQ((uint64_t)buf2.Length() - 6 + buf3.Length(), length);
   ASSERT_EQ(0, strncmp(readBuf, "The qu", count));
-}
\ No newline at end of file
+}

From 0ab9d21338417ff632ffbe1b073d8a05704ed81e Mon Sep 17 00:00:00 2001
From: Tim Taubert <ttaubert@mozilla.com>
Date: Tue, 19 Sep 2017 16:45:07 +0200
Subject: [PATCH 39/83] Bug 1400559 - [u2f-hid-rs] rustfmt followup r=me

---
 dom/webauthn/u2f-hid-rs/src/linux/monitor.rs  | 63 +++++++++----------
 .../u2f-hid-rs/src/windows/monitor.rs         | 45 +++++++------
 2 files changed, 53 insertions(+), 55 deletions(-)

diff --git a/dom/webauthn/u2f-hid-rs/src/linux/monitor.rs b/dom/webauthn/u2f-hid-rs/src/linux/monitor.rs
index 7d66cf1dc829..49a75cf473ae 100644
--- a/dom/webauthn/u2f-hid-rs/src/linux/monitor.rs
+++ b/dom/webauthn/u2f-hid-rs/src/linux/monitor.rs
@@ -61,46 +61,45 @@ impl Monitor {
     pub fn new() -> io::Result<Self> {
         let (tx, rx) = channel();
 
-        let thread = RunLoop::new(
-            move |alive| -> io::Result<()> {
-                let ctx = libudev::Context::new()?;
-                let mut enumerator = libudev::Enumerator::new(&ctx)?;
-                enumerator.match_subsystem(UDEV_SUBSYSTEM)?;
+        let thread = RunLoop::new(move |alive| -> io::Result<()> {
+            let ctx = libudev::Context::new()?;
+            let mut enumerator = libudev::Enumerator::new(&ctx)?;
+            enumerator.match_subsystem(UDEV_SUBSYSTEM)?;
 
-                // Iterate all existing devices.
-                for dev in enumerator.scan_devices()? {
-                    if let Some(path) = dev.devnode().map(|p| p.to_owned().into_os_string()) {
-                        tx.send(Event::Add(path)).map_err(to_io_err)?;
-                    }
+            // Iterate all existing devices.
+            for dev in enumerator.scan_devices()? {
+                if let Some(path) = dev.devnode().map(|p| p.to_owned().into_os_string()) {
+                    tx.send(Event::Add(path)).map_err(to_io_err)?;
                 }
+            }
 
-                let mut monitor = libudev::Monitor::new(&ctx)?;
-                monitor.match_subsystem(UDEV_SUBSYSTEM)?;
+            let mut monitor = libudev::Monitor::new(&ctx)?;
+            monitor.match_subsystem(UDEV_SUBSYSTEM)?;
 
-                // Start listening for new devices.
-                let mut socket = monitor.listen()?;
-                let mut fds = vec![
-                    ::libc::pollfd {
-                        fd: socket.as_raw_fd(),
-                        events: POLLIN,
-                        revents: 0,
-                    },
-                ];
+            // Start listening for new devices.
+            let mut socket = monitor.listen()?;
+            let mut fds = vec![
+                ::libc::pollfd {
+                    fd: socket.as_raw_fd(),
+                    events: POLLIN,
+                    revents: 0,
+                },
+            ];
 
-                // Loop until we're stopped by the controlling thread, or fail.
-                while alive() {
-                    // Wait for new events, break on failure.
-                    poll(&mut fds)?;
+            // Loop until we're stopped by the controlling thread, or fail.
+            while alive() {
+                // Wait for new events, break on failure.
+                poll(&mut fds)?;
 
-                    // Send the event over.
-                    let udev_event = socket.receive_event();
-                    if let Some(event) = udev_event.and_then(Event::from_udev) {
-                        tx.send(event).map_err(to_io_err)?;
-                    }
+                // Send the event over.
+                let udev_event = socket.receive_event();
+                if let Some(event) = udev_event.and_then(Event::from_udev) {
+                    tx.send(event).map_err(to_io_err)?;
                 }
+            }
 
-                Ok(())
-            })?;
+            Ok(())
+        })?;
 
         Ok(Self { rx, thread })
     }
diff --git a/dom/webauthn/u2f-hid-rs/src/windows/monitor.rs b/dom/webauthn/u2f-hid-rs/src/windows/monitor.rs
index 6c063a10cb8c..583e50bcd63f 100644
--- a/dom/webauthn/u2f-hid-rs/src/windows/monitor.rs
+++ b/dom/webauthn/u2f-hid-rs/src/windows/monitor.rs
@@ -37,33 +37,32 @@ impl Monitor {
     pub fn new() -> io::Result<Self> {
         let (tx, rx) = channel();
 
-        let thread = RunLoop::new(
-            move |alive| -> io::Result<()> {
-                let mut stored = HashSet::new();
+        let thread = RunLoop::new(move |alive| -> io::Result<()> {
+            let mut stored = HashSet::new();
 
-                while alive() {
-                    let device_info_set = DeviceInfoSet::new()?;
-                    let devices = HashSet::from_iter(device_info_set.devices());
+            while alive() {
+                let device_info_set = DeviceInfoSet::new()?;
+                let devices = HashSet::from_iter(device_info_set.devices());
 
-                    // Remove devices that are gone.
-                    for path in stored.difference(&devices) {
-                        tx.send(Event::Remove(path.clone())).map_err(to_io_err)?;
-                    }
-
-                    // Add devices that were plugged in.
-                    for path in devices.difference(&stored) {
-                        tx.send(Event::Add(path.clone())).map_err(to_io_err)?;
-                    }
-
-                    // Remember the new set.
-                    stored = devices;
-
-                    // Wait a little before looking for devices again.
-                    thread::sleep(Duration::from_millis(100));
+                // Remove devices that are gone.
+                for path in stored.difference(&devices) {
+                    tx.send(Event::Remove(path.clone())).map_err(to_io_err)?;
                 }
 
-                Ok(())
-            })?;
+                // Add devices that were plugged in.
+                for path in devices.difference(&stored) {
+                    tx.send(Event::Add(path.clone())).map_err(to_io_err)?;
+                }
+
+                // Remember the new set.
+                stored = devices;
+
+                // Wait a little before looking for devices again.
+                thread::sleep(Duration::from_millis(100));
+            }
+
+            Ok(())
+        })?;
 
         Ok(Self {
             rx: rx,

From 14bd1247caa4113ad087352d5797defdb02e4aed Mon Sep 17 00:00:00 2001
From: Tim Taubert <ttaubert@mozilla.com>
Date: Tue, 19 Sep 2017 16:55:38 +0200
Subject: [PATCH 40/83] Bug 1401019 - Cancel the current U2F API request before
 starting a new one r=jcj

I wasn't sure what the right behavior for the U2F API is when `.sign()`
or `.register()` is called but there's an ongoing request that wasn't fulfilled
yet.

I think it makes sense to deny the request (as we currently do) when a request
of the same type is currently active. When however sign() -> register() or
vice-versa is called then we should cancel the previous request and start
the new one. From what I understand from reading the spec we definitely should
call the callback before starting the new request.

Bug #: 1401019

Differential Revision: https://phabricator.services.mozilla.com/D70
---
 dom/u2f/U2F.cpp | 31 +++++++++++++++++++++++++++++--
 dom/u2f/U2F.h   |  3 +++
 2 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/dom/u2f/U2F.cpp b/dom/u2f/U2F.cpp
index 95ece23458a6..753aac905de3 100644
--- a/dom/u2f/U2F.cpp
+++ b/dom/u2f/U2F.cpp
@@ -223,7 +223,7 @@ U2F::Register(const nsAString& aAppId,
     return;
   }
 
-  MOZ_ASSERT(!mPromiseHolder.Exists());
+  Cancel();
   MOZ_ASSERT(mRegisterCallback.isNothing());
   mRegisterCallback = Some(nsMainThreadPtrHandle<U2FRegisterCallback>(
                         new nsMainThreadPtrHolder<U2FRegisterCallback>(
@@ -320,7 +320,7 @@ U2F::Sign(const nsAString& aAppId,
     return;
   }
 
-  MOZ_ASSERT(!mPromiseHolder.Exists());
+  Cancel();
   MOZ_ASSERT(mSignCallback.isNothing());
   mSignCallback = Some(nsMainThreadPtrHandle<U2FSignCallback>(
                     new nsMainThreadPtrHolder<U2FSignCallback>(
@@ -385,5 +385,32 @@ U2F::Sign(const nsAString& aAppId,
   ->Track(mPromiseHolder);
 }
 
+void
+U2F::Cancel()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  const ErrorCode errorCode = ErrorCode::OTHER_ERROR;
+
+  if (mRegisterCallback.isSome()) {
+    RegisterResponse response;
+    response.mErrorCode.Construct(static_cast<uint32_t>(errorCode));
+    ExecuteCallback(response, mRegisterCallback);
+  }
+
+  if (mSignCallback.isSome()) {
+    SignResponse response;
+    response.mErrorCode.Construct(static_cast<uint32_t>(errorCode));
+    ExecuteCallback(response, mSignCallback);
+  }
+
+  RefPtr<U2FManager> mgr = U2FManager::Get();
+  if (mgr) {
+    mgr->Cancel(NS_ERROR_DOM_OPERATION_ERR);
+  }
+
+  mPromiseHolder.DisconnectIfExists();
+}
+
 } // namespace dom
 } // namespace mozilla
diff --git a/dom/u2f/U2F.h b/dom/u2f/U2F.h
index ac19b13d6082..8934eef9768e 100644
--- a/dom/u2f/U2F.h
+++ b/dom/u2f/U2F.h
@@ -70,6 +70,9 @@ public:
        ErrorResult& aRv);
 
 private:
+  void
+  Cancel();
+
   nsString mOrigin;
   nsCOMPtr<nsPIDOMWindowInner> mParent;
   nsCOMPtr<nsISerialEventTarget> mEventTarget;

From ebf6b994dda3e84dba595cb15b98d54f33dd4513 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Fri, 8 Sep 2017 13:56:04 -0700
Subject: [PATCH 41/83] Bug 1400466 - Implement minimum necessary to allow
 saving and loading structured clone data, r=jonco

--HG--
extra : rebase_source : ea13ebcc1b3958c99cf04e7345da1aab5536b0ee
---
 js/src/builtin/TestingFunctions.cpp | 107 ++++++++++++++++++++--------
 js/src/shell/OSObject.cpp           |   5 +-
 2 files changed, 81 insertions(+), 31 deletions(-)

diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
index a428a3fba830..9b8afdf43eee 100644
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -2358,7 +2358,7 @@ SetIonCheckGraphCoherency(JSContext* cx, unsigned argc, Value* vp)
 }
 
 class CloneBufferObject : public NativeObject {
-    static const JSPropertySpec props_[2];
+    static const JSPropertySpec props_[3];
     static const size_t DATA_SLOT   = 0;
     static const size_t LENGTH_SLOT = 1;
     static const size_t NUM_SLOTS   = 2;
@@ -2413,15 +2413,6 @@ class CloneBufferObject : public NativeObject {
 
     static bool
     setCloneBuffer_impl(JSContext* cx, const CallArgs& args) {
-        if (args.length() != 1) {
-            JS_ReportErrorASCII(cx, "clonebuffer setter requires a single string argument");
-            return false;
-        }
-        if (!args[0].isString()) {
-            JS_ReportErrorASCII(cx, "clonebuffer value must be a string");
-            return false;
-        }
-
         if (fuzzingSafe) {
             // A manually-created clonebuffer could easily trigger a crash
             args.rval().setUndefined();
@@ -2429,20 +2420,37 @@ class CloneBufferObject : public NativeObject {
         }
 
         Rooted<CloneBufferObject*> obj(cx, &args.thisv().toObject().as<CloneBufferObject>());
-        obj->discard();
 
-        char* str = JS_EncodeString(cx, args[0].toString());
-        if (!str)
-            return false;
-        size_t nbytes = JS_GetStringLength(args[0].toString());
-        MOZ_ASSERT(nbytes % sizeof(uint64_t) == 0);
-        auto buf = js::MakeUnique<JSStructuredCloneData>(0, 0, nbytes);
-        if (!buf->Init(nbytes, nbytes)) {
-            JS_free(cx, str);
+        uint8_t* data = nullptr;
+        UniquePtr<uint8_t[], JS::FreePolicy> dataOwner;
+        uint32_t nbytes;
+
+        if (args.get(0).isObject() && args[0].toObject().is<ArrayBufferObject>()) {
+            ArrayBufferObject* buffer = &args[0].toObject().as<ArrayBufferObject>();
+            bool isSharedMemory;
+            js::GetArrayBufferLengthAndData(buffer, &nbytes, &isSharedMemory, &data);
+            MOZ_ASSERT(!isSharedMemory);
+        } else {
+            JSString* str = JS::ToString(cx, args.get(0));
+            if (!str)
+                return false;
+            data = reinterpret_cast<uint8_t*>(JS_EncodeString(cx, str));
+            if (!data)
+                return false;
+            dataOwner.reset(data);
+            nbytes = JS_GetStringLength(str);
+        }
+
+        if (nbytes % sizeof(uint64_t) != 0) {
+            JS_ReportErrorASCII(cx, "Invalid length for clonebuffer data");
             return false;
         }
-        js_memcpy(buf->Start(), str, nbytes);
-        JS_free(cx, str);
+
+        auto buf = js::MakeUnique<JSStructuredCloneData>(0, 0, nbytes);
+        if (!buf->Init(nbytes, nbytes))
+            return false;
+        js_memcpy(buf->Start(), data, nbytes);
+        obj->discard();
         obj->setData(buf.release());
 
         args.rval().setUndefined();
@@ -2461,12 +2469,9 @@ class CloneBufferObject : public NativeObject {
     }
 
     static bool
-    getCloneBuffer_impl(JSContext* cx, const CallArgs& args) {
-        Rooted<CloneBufferObject*> obj(cx, &args.thisv().toObject().as<CloneBufferObject>());
-        MOZ_ASSERT(args.length() == 0);
-
+    getData(JSContext* cx, Handle<CloneBufferObject*> obj, JSStructuredCloneData** data) {
         if (!obj->data()) {
-            args.rval().setUndefined();
+            *data = nullptr;
             return true;
         }
 
@@ -2479,14 +2484,27 @@ class CloneBufferObject : public NativeObject {
             return false;
         }
 
-        size_t size = obj->data()->Size();
+        *data = obj->data();
+        return true;
+    }
+
+    static bool
+    getCloneBuffer_impl(JSContext* cx, const CallArgs& args) {
+        Rooted<CloneBufferObject*> obj(cx, &args.thisv().toObject().as<CloneBufferObject>());
+        MOZ_ASSERT(args.length() == 0);
+
+        JSStructuredCloneData* data;
+        if (!getData(cx, obj, &data))
+            return false;
+
+        size_t size = data->Size();
         UniqueChars buffer(static_cast<char*>(js_malloc(size)));
         if (!buffer) {
             ReportOutOfMemory(cx);
             return false;
         }
-        auto iter = obj->data()->Iter();
-        obj->data()->ReadBytes(iter, buffer.get(), size);
+        auto iter = data->Iter();
+        data->ReadBytes(iter, buffer.get(), size);
         JSString* str = JS_NewStringCopyN(cx, buffer.get(), size);
         if (!str)
             return false;
@@ -2500,6 +2518,36 @@ class CloneBufferObject : public NativeObject {
         return CallNonGenericMethod<is, getCloneBuffer_impl>(cx, args);
     }
 
+    static bool
+    getCloneBufferAsArrayBuffer_impl(JSContext* cx, const CallArgs& args) {
+        Rooted<CloneBufferObject*> obj(cx, &args.thisv().toObject().as<CloneBufferObject>());
+        MOZ_ASSERT(args.length() == 0);
+
+        JSStructuredCloneData* data;
+        if (!getData(cx, obj, &data))
+            return false;
+
+        size_t size = data->Size();
+        UniqueChars buffer(static_cast<char*>(js_malloc(size)));
+        if (!buffer) {
+            ReportOutOfMemory(cx);
+            return false;
+        }
+        auto iter = data->Iter();
+        data->ReadBytes(iter, buffer.get(), size);
+        JSObject* arrayBuffer = JS_NewArrayBufferWithContents(cx, size, buffer.release());
+        if (!arrayBuffer)
+            return false;
+        args.rval().setObject(*arrayBuffer);
+        return true;
+    }
+
+    static bool
+    getCloneBufferAsArrayBuffer(JSContext* cx, unsigned int argc, JS::Value* vp) {
+        CallArgs args = CallArgsFromVp(argc, vp);
+        return CallNonGenericMethod<is, getCloneBufferAsArrayBuffer_impl>(cx, args);
+    }
+
     static void Finalize(FreeOp* fop, JSObject* obj) {
         obj->as<CloneBufferObject>().discard();
     }
@@ -2524,6 +2572,7 @@ const Class CloneBufferObject::class_ = {
 
 const JSPropertySpec CloneBufferObject::props_[] = {
     JS_PSGS("clonebuffer", getCloneBuffer, setCloneBuffer, 0),
+    JS_PSG("arraybuffer", getCloneBufferAsArrayBuffer, 0),
     JS_PS_END
 };
 
diff --git a/js/src/shell/OSObject.cpp b/js/src/shell/OSObject.cpp
index b3b3455940a7..730895b52dd4 100644
--- a/js/src/shell/OSObject.cpp
+++ b/js/src/shell/OSObject.cpp
@@ -588,8 +588,9 @@ osfile_close(JSContext* cx, unsigned argc, Value* vp) {
 static const JSFunctionSpecWithHelp osfile_functions[] = {
     JS_FN_HELP("readFile", osfile_readFile, 1, 0,
 "readFile(filename, [\"binary\"])",
-"  Read filename into returned string. Filename is relative to the current\n"
-               "  working directory."),
+"  Read entire contents of filename. Returns a string, unless \"binary\" is passed\n"
+"  as the second argument, in which case it returns a Uint8Array. Filename is\n"
+"  relative to the current working directory."),
 
     JS_FN_HELP("readRelativeToScript", osfile_readRelativeToScript, 1, 0,
 "readRelativeToScript(filename, [\"binary\"])",

From a4306ab94dc7746da709471d9917e7ace3653e20 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Fri, 8 Sep 2017 14:58:26 -0700
Subject: [PATCH 42/83] Bug 1400466 - Cache the information loaded from
 src_comp.xdb into a structured clone buffer, r=jonco

Note that this requires some enhancements to the JS engine to support reading and writing structured clone data from/to files.

--HG--
extra : rebase_source : 444a2d407bd231efbba4b6b648eeb151f02177db
---
 .../devtools/rootAnalysis/analyzeHeapWrites.js  |  5 ++++-
 js/src/devtools/rootAnalysis/callgraph.js       | 17 +++++++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
index 98ab46980db8..c355c79e3c21 100644
--- a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
+++ b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
@@ -723,7 +723,10 @@ if (options.verbose) {
 }
 
 print(elapsedTime() + "Loading types...");
-loadTypes('src_comp.xdb');
+if (os.getenv("TYPECACHE"))
+    loadTypesWithCache('src_comp.xdb', os.getenv("TYPECACHE"));
+else
+    loadTypes('src_comp.xdb');
 print(elapsedTime() + "Starting analysis...");
 
 var reachable = {};
diff --git a/js/src/devtools/rootAnalysis/callgraph.js b/js/src/devtools/rootAnalysis/callgraph.js
index 0261241abd75..0f0fb772d4e5 100644
--- a/js/src/devtools/rootAnalysis/callgraph.js
+++ b/js/src/devtools/rootAnalysis/callgraph.js
@@ -216,3 +216,20 @@ function loadTypes(type_xdb_filename) {
         xdb.free_string(data);
     }
 }
+
+function loadTypesWithCache(type_xdb_filename, cache_filename) {
+    try {
+        const cacheAB = os.file.readFile(cache_filename, "binary");
+        const cb = serialize();
+        cb.clonebuffer = cacheAB.buffer;
+        const cacheData = deserialize(cb);
+        subclasses = cacheData.subclasses;
+        superclasses = cacheData.superclasses;
+        classFunctions = cacheData.classFunctions;
+    } catch (e) {
+        loadTypes(type_xdb_filename);
+        const cb = serialize({subclasses, superclasses, classFunctions});
+        os.file.writeTypedArrayToFile(cache_filename,
+                                      new Uint8Array(cb.arraybuffer));
+    }
+}

From 2434340f83819e6a7ca86128a074d0fa279ef139 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Wed, 9 Aug 2017 13:54:41 -0700
Subject: [PATCH 43/83] Bug 1400468 - Trim output, r=jonco

--HG--
extra : rebase_source : de700225cbfcfc4a3fad56327d9007eabff02859
---
 js/src/devtools/rootAnalysis/analyzeHeapWrites.js | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
index c355c79e3c21..acbff2239bdf 100644
--- a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
+++ b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
@@ -684,6 +684,12 @@ CallSite.prototype.safeString = function()
 var errorCount = 0;
 var errorLimit = 100;
 
+// We want to suppress output for functions that ended up not having any
+// hazards, for brevity of the final output. So each new toplevel function will
+// initialize this to a string, which should be printed only if an error is
+// seen.
+var errorHeader;
+
 var startTime = new Date;
 function elapsedTime()
 {
@@ -753,7 +759,7 @@ for (var bodyIndex = minStream; bodyIndex <= maxStream; bodyIndex++) {
 print(elapsedTime() + "Found " + roots.length + " roots.");
 for (var i = 0; i < roots.length; i++) {
     var root = roots[i];
-    print(elapsedTime() + "#" + (i + 1) + " Analyzing " + root + " ...");
+    errorHeader = elapsedTime() + "#" + (i + 1) + " Analyzing " + root + " ...";
     try {
         processRoot(root);
     } catch (e) {
@@ -776,6 +782,11 @@ var reachableLoops;
 
 function dumpError(entry, location, text)
 {
+    if (errorHeader) {
+        print(errorHeader);
+        errorHeader = undefined;
+    }
+
     var stack = entry.stack;
     print("Error: " + text);
     print("Location: " + entry.name + (location ? " @ " + location : "") + stack[0].safeString());

From cf00ad1217b7d9ce81ea5c471506fe9a8a16a019 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Thu, 31 Aug 2017 17:14:45 -0700
Subject: [PATCH 44/83] Bug 1400468 - Port hazard analysis test scripts to
 python3, r=jonco

--HG--
extra : rebase_source : 1cf32c7b383b2f2e8bbe44f8d09cb027b086ebbf
---
 js/src/devtools/rootAnalysis/analyze.py         |  2 +-
 js/src/devtools/rootAnalysis/run-test.py        | 11 ++++++++---
 .../devtools/rootAnalysis/t/suppression/test.py |  6 +++---
 js/src/devtools/rootAnalysis/t/testlib.py       | 17 +++++++++--------
 4 files changed, 21 insertions(+), 15 deletions(-)

diff --git a/js/src/devtools/rootAnalysis/analyze.py b/js/src/devtools/rootAnalysis/analyze.py
index 2b8263e276cc..0cd45705b8c7 100755
--- a/js/src/devtools/rootAnalysis/analyze.py
+++ b/js/src/devtools/rootAnalysis/analyze.py
@@ -256,7 +256,7 @@ if args.tag and not args.buildcommand:
 if args.jobs is not None:
     data['jobs'] = args.jobs
 if not data.get('jobs'):
-    data['jobs'] = subprocess.check_output(['nproc', '--ignore=1']).strip()
+    data['jobs'] = int(subprocess.check_output(['nproc', '--ignore=1']).strip())
 
 if args.buildcommand:
     data['buildcommand'] = args.buildcommand
diff --git a/js/src/devtools/rootAnalysis/run-test.py b/js/src/devtools/rootAnalysis/run-test.py
index 3bc9085a0aaf..2d99a728680a 100644
--- a/js/src/devtools/rootAnalysis/run-test.py
+++ b/js/src/devtools/rootAnalysis/run-test.py
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
@@ -81,9 +81,14 @@ for name in cfg.tests:
     except OSError:
         pass
 
-    test = Test(indir, outdir, cfg)
+    test = Test(indir, outdir, cfg, verbose=cfg.verbose)
 
     os.chdir(outdir)
     subprocess.call(["sh", "-c", "rm *.xdb"])
-    execfile(os.path.join(indir, "test.py"), {'test': test, 'equal': equal})
+    if cfg.verbose:
+        print("Running test %s" % name)
+    testpath = os.path.join(indir, "test.py")
+    testscript = open(testpath).read()
+    testcode = compile(testscript, testpath, 'exec')
+    exec(testcode, {'test': test, 'equal': equal})
     print("TEST-PASSED: %s" % name)
diff --git a/js/src/devtools/rootAnalysis/t/suppression/test.py b/js/src/devtools/rootAnalysis/t/suppression/test.py
index 65974cc3369a..c3dd2c3436f7 100644
--- a/js/src/devtools/rootAnalysis/t/suppression/test.py
+++ b/js/src/devtools/rootAnalysis/t/suppression/test.py
@@ -9,9 +9,9 @@ suppressed = test.load_suppressed_functions()
 
 # Only one of these is fully suppressed (ie, *always* called within the scope
 # of an AutoSuppressGC).
-assert(len(filter(lambda f: 'suppressedFunction' in f, suppressed)) == 1)
-assert(len(filter(lambda f: 'halfSuppressedFunction' in f, suppressed)) == 0)
-assert(len(filter(lambda f: 'unsuppressedFunction' in f, suppressed)) == 0)
+assert(len(list(filter(lambda f: 'suppressedFunction' in f, suppressed))) == 1)
+assert(len(list(filter(lambda f: 'halfSuppressedFunction' in f, suppressed))) == 0)
+assert(len(list(filter(lambda f: 'unsuppressedFunction' in f, suppressed))) == 0)
 
 # gcFunctions should be the inverse, but we get to rely on unmangled names here.
 gcFunctions = test.load_gcFunctions()
diff --git a/js/src/devtools/rootAnalysis/t/testlib.py b/js/src/devtools/rootAnalysis/t/testlib.py
index 438398f1ed66..198a8b7ff1de 100644
--- a/js/src/devtools/rootAnalysis/t/testlib.py
+++ b/js/src/devtools/rootAnalysis/t/testlib.py
@@ -10,7 +10,6 @@ scriptdir = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
 
 HazardSummary = namedtuple('HazardSummary', ['function', 'variable', 'type', 'GCFunction', 'location'])
 
-
 def equal(got, expected):
     if got != expected:
         print("Got '%s', expected '%s'" % (got, expected))
@@ -44,20 +43,22 @@ class Test(object):
         '''Look up an entry from an XDB database file, 'pattern' may be an exact
         matching string, or an re pattern object matching a single entry.'''
 
-        if not isinstance(pattern, basestring):
-            output = subprocess.check_output([self.binpath("xdbkeys"), dbname + ".xdb"])
-            matches = filter(lambda _: re.search(pattern, _), output.splitlines())
+        if hasattr(pattern, 'match'):
+            output = subprocess.check_output([self.binpath("xdbkeys"), dbname + ".xdb"],
+                                             universal_newlines=True)
+            matches = list(filter(lambda _: re.search(pattern, _), output.splitlines()))
             if len(matches) == 0:
                 raise Exception("entry not found")
             if len(matches) > 1:
                 raise Exception("multiple entries found")
             pattern = matches[0]
 
-        output = subprocess.check_output([self.binpath("xdbfind"), "-json", dbname + ".xdb", pattern])
+        output = subprocess.check_output([self.binpath("xdbfind"), "-json", dbname + ".xdb", pattern],
+                                         universal_newlines=True)
         return json.loads(output)
 
     def run_analysis_script(self, phase, upto=None):
-        file("defaults.py", "w").write('''\
+        open("defaults.py", "w").write('''\
 analysis_scriptdir = '{scriptdir}'
 sixgill_bin = '{bindir}'
 '''.format(scriptdir=scriptdir, bindir=self.cfg.sixgill_bin))
@@ -80,8 +81,8 @@ sixgill_bin = '{bindir}'
 
     def load_text_file(self, filename, extract=lambda l: l):
         fullpath = os.path.join(self.outdir, filename)
-        values = (extract(line.strip()) for line in file(fullpath))
-        return filter(lambda _: _ is not None, values)
+        values = (extract(line.strip()) for line in open(fullpath, "r"))
+        return list(filter(lambda _: _ is not None, values))
 
     def load_suppressed_functions(self):
         return set(self.load_text_file("suppressedFunctions.lst"))

From 5b5e84123b9a95af7365276e70de8eb881004e57 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Thu, 31 Aug 2017 11:53:14 -0700
Subject: [PATCH 45/83] Bug 1400468 - Control verbosity, r=jonco

--HG--
extra : rebase_source : 950699da0c0d8c894542c71881cce3359a8c6697
---
 js/src/devtools/rootAnalysis/analyze.py   | 5 ++++-
 js/src/devtools/rootAnalysis/t/testlib.py | 5 +++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/js/src/devtools/rootAnalysis/analyze.py b/js/src/devtools/rootAnalysis/analyze.py
index 0cd45705b8c7..c9cf32d2d1f2 100755
--- a/js/src/devtools/rootAnalysis/analyze.py
+++ b/js/src/devtools/rootAnalysis/analyze.py
@@ -231,10 +231,13 @@ parser.add_argument('--tag', '-t', type=str, nargs='?',
                     help='name of job, also sets build command to "build.<tag>"')
 parser.add_argument('--expect-file', type=str, nargs='?',
                     help='deprecated option, temporarily still present for backwards compatibility')
-parser.add_argument('--verbose', '-v', action='store_true',
+parser.add_argument('--verbose', '-v', action='count', default=1,
                     help='Display cut & paste commands to run individual steps')
+parser.add_argument('--quiet', '-q', action='count', default=0,
+                    help='Suppress output')
 
 args = parser.parse_args()
+args.verbose = max(0, args.verbose - args.quiet)
 
 for default in defaults:
     try:
diff --git a/js/src/devtools/rootAnalysis/t/testlib.py b/js/src/devtools/rootAnalysis/t/testlib.py
index 198a8b7ff1de..84970425fd89 100644
--- a/js/src/devtools/rootAnalysis/t/testlib.py
+++ b/js/src/devtools/rootAnalysis/t/testlib.py
@@ -19,10 +19,11 @@ def extract_unmangled(func):
 
 
 class Test(object):
-    def __init__(self, indir, outdir, cfg):
+    def __init__(self, indir, outdir, cfg, verbose=0):
         self.indir = indir
         self.outdir = outdir
         self.cfg = cfg
+        self.verbose = verbose
 
     def infile(self, path):
         return os.path.join(self.indir, path)
@@ -62,7 +63,7 @@ class Test(object):
 analysis_scriptdir = '{scriptdir}'
 sixgill_bin = '{bindir}'
 '''.format(scriptdir=scriptdir, bindir=self.cfg.sixgill_bin))
-        cmd = [os.path.join(scriptdir, "analyze.py"), phase]
+        cmd = [os.path.join(scriptdir, "analyze.py"), '-v' if self.verbose else '-q', phase]
         if upto:
             cmd += ["--upto", upto]
         cmd.append("--source=%s" % self.indir)

From 9f483c425926873fd4111cd63ee414a74878b381 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Fri, 15 Sep 2017 17:15:46 -0700
Subject: [PATCH 46/83] Bug 1400442 - CFG dumping utility, handy for debugging,
 r=me

--HG--
extra : rebase_source : ca41fae3c6f0507ed0be567ca5cd641e59475c8b
---
 .../rootAnalysis/analyzeHeapWrites.js         |   1 +
 js/src/devtools/rootAnalysis/dumpCFG.js       | 259 ++++++++++++++++++
 2 files changed, 260 insertions(+)
 create mode 100644 js/src/devtools/rootAnalysis/dumpCFG.js

diff --git a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
index acbff2239bdf..d2be3699733c 100644
--- a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
+++ b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
@@ -5,6 +5,7 @@
 loadRelativeToScript('utility.js');
 loadRelativeToScript('annotations.js');
 loadRelativeToScript('callgraph.js');
+loadRelativeToScript('dumpCFG.js');
 
 ///////////////////////////////////////////////////////////////////////////////
 // Annotations
diff --git a/js/src/devtools/rootAnalysis/dumpCFG.js b/js/src/devtools/rootAnalysis/dumpCFG.js
new file mode 100644
index 000000000000..fb89733f4b19
--- /dev/null
+++ b/js/src/devtools/rootAnalysis/dumpCFG.js
@@ -0,0 +1,259 @@
+// const cfg = loadCFG(scriptArgs[0]);
+// dump_CFG(cfg);
+
+function loadCFG(filename) {
+  const data = os.file.readFile(filename);
+  return JSON.parse(data);
+}
+
+function dump_CFG(cfg) {
+  for (const body of cfg)
+    dump_body(body);
+}
+
+function dump_body(body, src, dst) {
+  const {BlockId,Command,DefineVariable,Index,Location,PEdge,PPoint,Version} = body;
+
+  const [mangled, unmangled] = splitFunction(BlockId.Variable.Name[0]);
+  print(`${unmangled} at ${Location[0].CacheString}:${Location[0].Line}`);
+
+  if (src === undefined) {
+    for (const def of DefineVariable)
+      print(str_definition(def));
+    print("");
+  }
+
+  for (const edge of PEdge) {
+    if (src === undefined || edge.Index[0] == src) {
+      if (dst == undefined || edge.Index[1] == dst)
+        print(str_edge(edge, body));
+    }
+  }
+}
+
+function str_definition(def) {
+  const {Type, Variable} = def;
+  return `define ${str_Variable(Variable)} : ${str_Type(Type)}`;
+}
+
+function badFormat(what, val) {
+  printErr("Bad format of " + what + ": " + JSON.stringify(val, null, 4));
+  printErr((new Error).stack);
+}
+
+function str_Variable(variable) {
+  if (variable.Kind == 'Return')
+    return '<returnval>';
+  else if (variable.Kind == 'This')
+    return 'this';
+
+  try {
+    return variable.Name[1];
+  } catch(e) {
+    badFormat("variable", variable);
+  }
+}
+
+function str_Type(type) {
+  try {
+    const {Kind, Type, Name, TypeFunctionArguments} = type;
+    if (Kind == 'Pointer')
+      return str_Type(Type) + "*";
+    else if (Kind == 'CSU') {
+      return Name;
+    }
+
+    return Kind;
+  } catch(e) {
+    badFormat("type", type);
+  }
+}
+
+var OpCodeNames = {
+  'LessEqual': ['<=', '>'],
+  'LessThan': ['<', '>='],
+  'GreaterEqual': ['>=', '<'],
+  'Greater': ['>', '<='],
+  'Plus': '+',
+  'Minus': '-',
+};
+
+function opcode_name(opcode, invert) {
+  if (opcode in OpCodeNames) {
+    const name = OpCodeNames[opcode];
+    if (invert === undefined)
+      return name;
+    return name[invert ? 1 : 0];
+  } else {
+    if (invert === undefined)
+      return opcode;
+    return (invert ? '!' : '') + opcode;
+  }
+}
+
+function str_value(val, env, options) {
+  const {Kind, Variable, String, Exp} = val;
+  if (Kind == 'Var')
+    return str_Variable(Variable);
+  else if (Kind == 'Drf') {
+    // Suppress the vtable lookup dereference
+    if (Exp[0].Kind == 'Fld' && "FieldInstanceFunction" in Exp[0].Field)
+      return str_value(Exp[0], env);
+    const exp = str_value(Exp[0], env);
+    if (options && options.noderef)
+      return exp;
+    return "*" + exp;
+  } else if (Kind == 'Fld') {
+    const {Exp, Field} = val;
+    const name = Field.Name[0];
+    if ("FieldInstanceFunction" in Field) {
+      return Field.FieldCSU.Type.Name + "::" + name;
+    }
+    const container = str_value(Exp[0]);
+    if (container.startsWith("*"))
+      return container.substring(1) + "->" + name;
+    return container + "." + name;
+  } else if (Kind == 'Empty') {
+    return '<unknown>';
+  } else if (Kind == 'Binop') {
+    const {OpCode} = val;
+    const op = opcode_name(OpCode);
+    return `${str_value(Exp[0], env)} ${op} ${str_value(Exp[1], env)}`;
+  } else if (Kind == 'Unop') {
+    const exp = str_value(Exp[0], env);
+    const {OpCode} = val;
+    if (OpCode == 'LogicalNot')
+      return `not ${exp}`;
+    return `${OpCode}(${exp})`;
+  } else if (Kind == 'Index') {
+    const index = str_value(Exp[1], env);
+    if (Exp[0].Kind == 'Drf')
+      return `${str_value(Exp[0], env, {noderef:true})}[${index}]`;
+    else
+      return `&${str_value(Exp[0], env)}[${index}]`;
+  } else if (Kind == 'NullTest') {
+    return `nullptr == ${str_value(Exp[0], env)}`;
+  } else if (Kind == "String") {
+    return '"' + String + '"';
+  } else if (String !== undefined) {
+    return String;
+  }
+  badFormat("value", val);
+}
+
+function str_thiscall_Exp(exp) {
+  return exp.Kind == 'Drf' ? str_value(exp.Exp[0]) + "->" : str_value(exp) + ".";
+}
+
+function stripcsu(s) {
+    return s.replace("class ", "").replace("struct ", "").replace("union ");
+}
+
+function str_call(prefix, edge, env) {
+  const {Exp, Type, PEdgeCallArguments, PEdgeCallInstance} = edge;
+  const {Kind, Type:cType, TypeFunctionArguments, TypeFunctionCSU} = Type;
+
+  if (Kind == 'Function') {
+    const params = PEdgeCallArguments ? PEdgeCallArguments.Exp : [];
+    const strParams = params.map(str_value);
+
+    let func;
+    let comment = "";
+    let assign_exp;
+    if (PEdgeCallInstance) {
+      const csu = TypeFunctionCSU.Type.Name;
+      const method = str_value(Exp[0], env);
+
+      // Heuristic to only display the csu for constructors
+      if (csu.includes(method)) {
+        func = stripcsu(csu) + "::" + method;
+      } else {
+        func = method;
+        comment = "# " + csu + "::" + method + "\n";
+      }
+
+      const {Exp: thisExp} = PEdgeCallInstance;
+      func = str_thiscall_Exp(thisExp) + func;
+    } else {
+      func = str_value(Exp[0]);
+    }
+    assign_exp = Exp[1];
+
+    let assign = "";
+    if (assign_exp) {
+      assign = str_value(assign_exp) + " := ";
+    }
+    return `${comment}${prefix} Call ${assign}${func}(${strParams.join(", ")})`;
+  }
+
+  print(JSON.stringify(edge, null, 4));
+  throw "unhandled format error";
+}
+
+function str_assign(prefix, edge) {
+  const {Exp} = edge;
+  const [lhs, rhs] = Exp;
+  return `${prefix} Assign ${str_value(lhs)} := ${str_value(rhs)}`;
+}
+
+function str_loop(prefix, edge) {
+  const {BlockId: {Loop}} = edge;
+  return `${prefix} Loop ${Loop}`;
+}
+
+function str_assume(prefix, edge) {
+  const {Exp, PEdgeAssumeNonZero} = edge;
+  const cmp = PEdgeAssumeNonZero ? "" : "!";
+
+  const {Exp: aExp, Kind, OpCode} = Exp[0];
+  if (Kind == 'Binop') {
+    const [lhs, rhs] = aExp;
+    const op = opcode_name(OpCode, !PEdgeAssumeNonZero);
+    return `${prefix} Assume ${str_value(lhs)} ${op} ${str_value(rhs)}`;
+  } else if (Kind == 'Unop') {
+    return `${prefix} Assume ${cmp}${OpCode} ${str_value(aExp[0])}`;
+  } else if (Kind == 'NullTest') {
+    return `${prefix} Assume nullptr ${cmp}== ${str_value(aExp[0])}`;
+  } else if (Kind == 'Drf') {
+    return `${prefix} Assume ${cmp}${str_value(Exp[0])}`;
+  }
+
+  print(JSON.stringify(edge, null, 4));
+  throw "unhandled format error";
+}
+
+function str_edge(edge, env) {
+  const {Index, Kind} = edge;
+  const [src, dst] = Index;
+  const prefix = `[${src},${dst}]`;
+
+  if (Kind == "Call")
+    return str_call(prefix, edge, env);
+  if (Kind == 'Assign')
+    return str_assign(prefix, edge);
+  if (Kind == 'Assume')
+    return str_assume(prefix, edge);
+  if (Kind == 'Loop')
+    return str_loop(prefix, edge);
+
+  print(JSON.stringify(edge, null, 4));
+  throw "unhandled edge type";
+}
+
+function str(unknown) {
+  if ("Index" in unknown) {
+    return str_edge(unknown);
+  } else if ("Kind" in unknown) {
+    if ("BlockId" in unknown)
+      return str_Variable(unknown);
+    return str_value(unknown);
+  } else if ("Type" in unknown) {
+    return str_Type(unknown);
+  }
+  return "unknown";
+}
+
+function jdump(x) {
+  print(JSON.stringify(x, null, 4));
+  quit(0);
+}

From 3fa9c0cd2a20dfd7554ef87df2ba6623e21c1368 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Thu, 31 Aug 2017 09:47:53 -0700
Subject: [PATCH 47/83] Bug 1400442 - Propagate safety through RefPtr,
 r=bhackett

--HG--
extra : rebase_source : 187dda47209195746d88a00733d9b806da2c4f14
---
 js/src/devtools/rootAnalysis/analyzeHeapWrites.js | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
index d2be3699733c..6c7f49fcc915 100644
--- a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
+++ b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
@@ -1153,6 +1153,14 @@ function isSafeVariable(entry, variable)
                 }
             }
 
+            // RefPtr::operator->() and operator* transmit the safety of the
+            // RefPtr to the return value.
+            if (isDirectCall(edge, /RefPtr<.*?>::operator(->|\*)\(\)/) &&
+                isEdgeSafeArgument(entry, edge.PEdgeCallInstance.Exp))
+            {
+                return true;
+            }
+
             // Placement-new returns a pointer that is as safe as the pointer
             // passed to it. Exp[0] is the size, Exp[1] is the pointer/address.
             // Note that the invocation of the constructor is a separate call,

From c849aebbd6a4c14ce991e26b012c5ebc8555f42f Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Fri, 8 Sep 2017 14:37:19 -0700
Subject: [PATCH 48/83] Bug 1400442 - Annotate atof as not doing any racy
 writes, r=me

--HG--
extra : rebase_source : 206bba89c68e8dc37c135fed03490282eff61d76
---
 js/src/devtools/rootAnalysis/analyzeHeapWrites.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
index 6c7f49fcc915..3bcacfe7d75d 100644
--- a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
+++ b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
@@ -25,6 +25,7 @@ function checkExternalFunction(entry)
         "fmod",
         "floor",
         "ceil",
+        "atof",
         /memchr/,
         "strlen",
         /Servo_DeclarationBlock_GetCssText/,

From 5a2de7af69333101b74c10b0838ff008ddf2ca27 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Fri, 8 Sep 2017 15:03:22 -0700
Subject: [PATCH 49/83] Bug 1400442 - Targeted annotation for static local
 array of member pointers in LangGroupFontPrefs::Initialize, r=bhackett

The code is

    void
    LangGroupFontPrefs::Initialize(nsIAtom* aLangGroupAtom)
    {
        nsFont* fontTypes[] = {
            &mDefaultVariableFont,
            &mDefaultFixedFont,
            &mDefaultSerifFont,
            &mDefaultSansSerifFont,
            &mDefaultMonospaceFont,
            &mDefaultCursiveFont,
            &mDefaultFantasyFont
        };

        nsFont* font = fontTypes[3];
        font->size = 42;
    }

'this' is known to be a safe pointer (exclusively owned by the current thread), so a pointer to one of its members is also safe. But the analysis can't track safety across all that, so I have a special-case annotation here that says that fontTypes[3] returns a safe pointer if and only if 'this' is safe.

Note that all of those fields (eg mDefaultVariableFont) are nsFont structs, not pointers, so although you'd expect this to be one dereference away from a safe pointer's memory, it is not; assigning to font->size ends up being a write to some offset within the 'this' pointer, which is known to be safe here.

--HG--
extra : rebase_source : 60bf982911b8a66bc612cb5c7eeb04ec766ecf70
---
 .../rootAnalysis/analyzeHeapWrites.js         | 33 +++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
index 3bcacfe7d75d..4218c8ae55e4 100644
--- a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
+++ b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
@@ -245,6 +245,36 @@ function treatAsSafeArgument(entry, varName, csuName)
     return false;
 }
 
+function isSafeAssignment(entry, edge, variable)
+{
+    if (edge.Kind != 'Assign')
+        return false;
+
+    var [mangled, unmangled] = splitFunction(entry.name);
+
+    // The assignment
+    //
+    //   nsFont* font = fontTypes[eType];
+    //
+    // ends up with 'font' pointing to a member of 'this', so it should inherit
+    // the safety of 'this'.
+    if (unmangled.includes("mozilla::LangGroupFontPrefs::Initialize") &&
+        variable == 'font')
+    {
+        const [lhs, rhs] = edge.Exp;
+        const {Kind, Exp: [{Kind: indexKind, Exp: [collection, index]}]} = rhs;
+        if (Kind == 'Drf' &&
+            indexKind == 'Index' &&
+            collection.Kind == 'Var' &&
+            collection.Variable.Name[0] == 'fontTypes')
+        {
+            return entry.isSafeArgument(0); // 'this'
+        }
+    }
+
+    return false;
+}
+
 function checkFieldWrite(entry, location, fields)
 {
     var name = entry.name;
@@ -1181,6 +1211,9 @@ function isSafeVariable(entry, variable)
             }
         }
 
+        if (isSafeAssignment(entry, edge, name))
+            return true;
+
         // Watch out for variables which were assigned arguments.
         var rhsVariable = variableAssignRhs(edge);
         if (rhsVariable)

From 2c2bec029d08f3530f8e5e8be02d462a19cec32a Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Fri, 8 Sep 2017 14:54:00 -0700
Subject: [PATCH 50/83] Bug 1400442 - Annotate MOZ_CrashPrintf, r=jonco

--HG--
extra : rebase_source : 0ea91eb0373a1b0c848ce7e97f43a2006c190f29
---
 js/src/devtools/rootAnalysis/analyzeHeapWrites.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
index 4218c8ae55e4..04f60c1eee1b 100644
--- a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
+++ b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
@@ -399,6 +399,7 @@ function ignoreContents(entry)
         "abort",
         /MOZ_ReportAssertionFailure/,
         /MOZ_ReportCrash/,
+        /MOZ_CrashPrintf/,
         /AnnotateMozCrashReason/,
         /InvalidArrayIndex_CRASH/,
         /NS_ABORT_OOM/,

From ed820e5f993bce4065bdee7e292bf9d78911a0b5 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Fri, 8 Sep 2017 14:54:22 -0700
Subject: [PATCH 51/83] Bug 1400442 - Broaden the annotation for string
 appending functions to handle more types, r=jonco

--HG--
extra : rebase_source : c55d9900278cf6a31a16567e5ff658306c08e87c
---
 js/src/devtools/rootAnalysis/analyzeHeapWrites.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
index 04f60c1eee1b..dc726be12899 100644
--- a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
+++ b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
@@ -524,8 +524,8 @@ function ignoreContents(entry)
     if (entry.isSafeArgument(2)) {
         var secondArgWhitelist = [
             /nsStringBuffer::ToString/,
-            /AppendUTF8toUTF16/,
-            /AppendASCIItoUTF16/,
+            /AppendUTF\d+toUTF\d+/,
+            /AppendASCIItoUTF\d+/,
         ];
         if (entry.matches(secondArgWhitelist))
             return true;

From 5e41355433aadb2f6d691fc6ca7dbd8a55cb2f46 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Fri, 8 Sep 2017 14:57:02 -0700
Subject: [PATCH 52/83] Bug 1400442 - Fix handling of parameterNames, r=jonco

This is for nicer output only, and does not affect the computation. A WorkListEntry contains a stack of CallSites, and the top of the stack represents the entry itself and so should share parameterNames. This changes fixes cases where some names were being registered in a different table than ended up being used by printouts.

--HG--
extra : rebase_source : e52bbc9ab3e4596d748ca2d729772a61cde1430a
---
 js/src/devtools/rootAnalysis/analyzeHeapWrites.js | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
index dc726be12899..a4c532317342 100644
--- a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
+++ b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
@@ -604,12 +604,12 @@ function isZero(exp)
 // which are safe using a sorted array, so that this can be propagated down the
 // stack. Zero is |this|, and arguments are indexed starting at one.
 
-function WorklistEntry(name, safeArguments, stack)
+function WorklistEntry(name, safeArguments, stack, parameterNames)
 {
     this.name = name;
     this.safeArguments = safeArguments;
     this.stack = stack;
-    this.parameterNames = {};
+    this.parameterNames = parameterNames;
 }
 
 WorklistEntry.prototype.readable = function()
@@ -944,7 +944,7 @@ function process(entry, body, addCallee)
             switch (callee.kind) {
             case "direct":
                 var safeArguments = getEdgeSafeArguments(entry, edge, callee.name);
-                addCallee(new CallSite(callee.name, safeArguments, location, entry.parameterNames));
+                addCallee(new CallSite(callee.name, safeArguments, location, {}));
                 break;
               case "resolved-field":
                 break;
@@ -1040,7 +1040,8 @@ function maybeProcessMissingFunction(entry, addCallee)
 function processRoot(name)
 {
     var safeArguments = [];
-    var worklist = [new WorklistEntry(name, safeArguments, [new CallSite(name, safeArguments, null, {})])];
+    var parameterNames = {};
+    var worklist = [new WorklistEntry(name, safeArguments, [new CallSite(name, safeArguments, null, parameterNames)], parameterNames)];
 
     while (worklist.length > 0) {
         var entry = worklist.pop();
@@ -1081,7 +1082,7 @@ function processRoot(name)
         for (var callee of callees) {
             if (!ignoreCallEdge(entry, callee.callee)) {
                 var nstack = [callee, ...entry.stack];
-                worklist.push(new WorklistEntry(callee.callee, callee.safeArguments, nstack));
+                worklist.push(new WorklistEntry(callee.callee, callee.safeArguments, nstack, callee.parameterNames));
             }
         }
     }

From 1ec4752dd2d88f9190643097b68113fb29609c8d Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Fri, 8 Sep 2017 14:59:43 -0700
Subject: [PATCH 53/83] Bug 1400442 - Refactor the --function debugging command
 line option (and alias it to -f) to analyzeHeapWrites.js, r=me

--HG--
extra : rebase_source : b8f81284ffe70712f2a245c495158c3584650ce4
---
 .../rootAnalysis/analyzeHeapWrites.js         | 25 +++++++++++--------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
index a4c532317342..d6fc957f9609 100644
--- a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
+++ b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
@@ -775,18 +775,23 @@ xdb.open("src_body.xdb");
 
 var minStream = xdb.min_data_stream();
 var maxStream = xdb.max_data_stream();
-
 var roots = [];
-for (var bodyIndex = minStream; bodyIndex <= maxStream; bodyIndex++) {
-    var key = xdb.read_key(bodyIndex);
-    var name = key.readString();
-    if (/^Gecko_/.test(name)) {
-        var data = xdb.read_entry(key);
-        if (/ServoBindings.cpp/.test(data.readString()))
-            roots.push(name);
-        xdb.free_string(data);
+
+var [flag, arg] = scriptArgs;
+if (flag && (flag == '-f' || flag == '--function')) {
+    roots = [arg];
+} else {
+    for (var bodyIndex = minStream; bodyIndex <= maxStream; bodyIndex++) {
+        var key = xdb.read_key(bodyIndex);
+        var name = key.readString();
+        if (/^Gecko_/.test(name)) {
+            var data = xdb.read_entry(key);
+            if (/ServoBindings.cpp/.test(data.readString()))
+                roots.push(name);
+            xdb.free_string(data);
+        }
+        xdb.free_string(key);
     }
-    xdb.free_string(key);
 }
 
 print(elapsedTime() + "Found " + roots.length + " roots.");

From 2b08c335d72d329cce209c1f164fed7e39d01b6f Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Fri, 8 Sep 2017 15:00:56 -0700
Subject: [PATCH 54/83] Bug 1400442 - analyzeHeapWrites: implement a cache for
 checking whether local variables are safe pointers, r=jonco

--HG--
extra : rebase_source : fce58842604238e6102f43057301fff27ee58d6f
---
 js/src/devtools/rootAnalysis/analyzeHeapWrites.js | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
index d6fc957f9609..6e3d3cd77168 100644
--- a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
+++ b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
@@ -1153,6 +1153,18 @@ function isSafeVariable(entry, variable)
         return false;
     var name = variableName(variable);
 
+    if (!entry.safeLocals)
+        entry.safeLocals = new Map;
+    if (entry.safeLocals.has(name))
+        return entry.safeLocals.get(name);
+
+    const safe = isSafeLocalVariable(entry, name);
+    entry.safeLocals.set(name, safe);
+    return safe;
+}
+
+function isSafeLocalVariable(entry, name)
+{
     // If there is a single place where this variable has been assigned on
     // edges we are considering, look at that edge.
     var edge = singleAssignment(name);

From 6fac83771a1dffa75ba09891a278551efe26593f Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Fri, 8 Sep 2017 15:03:06 -0700
Subject: [PATCH 55/83] Bug 1400442 - analyzeHeapWrites: getter_Copies
 preserves safety (similar to getter_AddRefs), r=bhackett

--HG--
extra : rebase_source : 4ae6297aa5725532bec513055dd451b8cbcf7bde
---
 js/src/devtools/rootAnalysis/analyzeHeapWrites.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
index 6e3d3cd77168..b895a4430fba 100644
--- a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
+++ b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
@@ -1192,11 +1192,11 @@ function isSafeLocalVariable(entry, name)
                 return true;
             }
 
-            // Watch for the coerced result of a getter_AddRefs call.
+            // Watch for the coerced result of a getter_AddRefs or getter_Copies call.
             if (isDirectCall(edge, /operator /)) {
                 var otherEdge = expressionValueEdge(edge.PEdgeCallInstance.Exp);
                 if (otherEdge &&
-                    isDirectCall(otherEdge, /getter_AddRefs/) &&
+                    isDirectCall(otherEdge, /getter_(?:AddRefs|Copies)/) &&
                     isEdgeSafeArgument(entry, otherEdge.PEdgeCallArguments.Exp[0]))
                 {
                     return true;

From 22f464bca9f5f8dba58b66c89749bc7c12bd122f Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Fri, 15 Sep 2017 09:24:48 -0700
Subject: [PATCH 56/83] Bug 1400442 - Backward-compatible js::Class[Ops].trace
 annotation, r=me

--HG--
extra : rebase_source : eac8e39bab5a3979c1e18a5494c899af777a1958
---
 js/src/devtools/rootAnalysis/annotations.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/js/src/devtools/rootAnalysis/annotations.js b/js/src/devtools/rootAnalysis/annotations.js
index 316924b2db86..6c717992866c 100644
--- a/js/src/devtools/rootAnalysis/annotations.js
+++ b/js/src/devtools/rootAnalysis/annotations.js
@@ -67,6 +67,8 @@ var ignoreClasses = {
 // Ignore calls through TYPE.FIELD, where TYPE is the class or struct name containing
 // a function pointer field named FIELD.
 var ignoreCallees = {
+    "js::Class.trace" : true,
+    "js::Class.finalize" : true,
     "js::ClassOps.trace" : true,
     "js::ClassOps.finalize" : true,
     "JSRuntime.destroyPrincipals" : true,

From a4eeddfca1ea089b87dc4129f9f8590affe8260a Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Fri, 15 Sep 2017 17:18:08 -0700
Subject: [PATCH 57/83] Bug 1400442 - Annotate border colors array as being
 thread-owned by container, r=bhackett

nsStyleStruct has the field:

  nsBorderColors** mBorderColors;

It starts out nullptr, and when it is needed, it allocates an array of 4 nsBorderColors pointers. But the nsStyleStruct exclusively owns the array; nothing else can get at it. This change teaches the analysis that if 'this' is a safe nsStyleStruct*, then it should treat mBorderColors as if it were an inline length-4 array.

--HG--
extra : rebase_source : e9d4a550a728e403b3bb30e7dd61341c2680962d
---
 .../rootAnalysis/analyzeHeapWrites.js         | 40 +++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
index b895a4430fba..d9d5dce93684 100644
--- a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
+++ b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
@@ -231,6 +231,10 @@ function treatAsSafeArgument(entry, varName, csuName)
         ["Gecko_CopyAlternateValuesFrom", "aDest", null],
         ["Gecko_CounterStyle_GetName", "aResult", null],
         ["Gecko_CounterStyle_GetSingleString", "aResult", null],
+        ["Gecko_EnsureMozBorderColors", "aBorder", null],
+        ["Gecko_ClearMozBorderColors", "aBorder", null],
+        ["Gecko_AppendMozBorderColors", "aBorder", null],
+        ["Gecko_CopyMozBorderColors", "aDest", null],
     ];
     for (var [entryMatch, varMatch, csuMatch] of whitelist) {
         assert(entryMatch || varMatch || csuMatch);
@@ -890,6 +894,22 @@ function processAssign(entry, location, lhs, edge)
             variable = lhs.Exp[0].Variable;
             if (isSafeVariable(entry, variable))
                 return;
+        } else if (lhs.Exp[0].Kind == "Fld") {
+            const {
+                Type: {Kind, Type: fieldType},
+                FieldCSU: {Type: {Kind: containerTypeKind,
+                                  Name: containerTypeName}}
+            } = lhs.Exp[0].Field;
+            const [containerExpr] = lhs.Exp[0].Exp;
+
+            if (containerTypeKind == 'CSU' &&
+                Kind == 'Pointer' &&
+                isEdgeSafeArgument(entry, containerExpr) &&
+                isSafeMemberPointer(containerTypeName, fieldType))
+            {
+                return;
+            }
+
         }
         if (fields.length)
             checkFieldWrite(entry, location, fields);
@@ -1265,6 +1285,26 @@ function isSafeLocalVariable(entry, name)
     return true;
 }
 
+function isSafeMemberPointer(containerType, memberType)
+{
+    if (memberType.Kind != 'Pointer')
+        return false;
+
+    const {Type: {Kind: pointeeKind, Name: pointeeTypeName}} = memberType;
+
+    // nsStyleBorder has a member mBorderColors of type nsBorderColors**. It is
+    // lazily initialized to an array of 4 nsBorderColors, and should inherit
+    // the safety of its container.
+    if (containerType == 'nsStyleBorder' &&
+        pointeeKind == 'CSU' &&
+        pointeeTypeName == 'nsBorderColors')
+    {
+        return true;
+    }
+
+    return false;
+}
+
 // Return whether 'exp == value' holds only when execution is on the main thread.
 function testFailsOffMainThread(exp, value) {
     switch (exp.Kind) {

From a1e4291a8a024d200c3dad6626ed7abc168ae861 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Fri, 15 Sep 2017 11:00:37 -0700
Subject: [PATCH 58/83] Bug 1400442 - Annotate nsTArray::InsertElementAt as
 returning a value that propagates safety of the array, r=jonco

--HG--
extra : rebase_source : f69a5bf2e2d01f55453d6df0d077b3f9a0bfa7d4
---
 js/src/devtools/rootAnalysis/analyzeHeapWrites.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
index d9d5dce93684..0d14e371f6a4 100644
--- a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
+++ b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
@@ -1206,6 +1206,7 @@ function isSafeLocalVariable(entry, name)
             // References to the contents of an array are threadsafe if the array
             // itself is threadsafe.
             if ((isDirectCall(edge, /operator\[\]/) ||
+                 isDirectCall(edge, /nsTArray.*?::InsertElementAt\b/) ||
                  isDirectCall(edge, /nsStyleContent::ContentAt/)) &&
                 isEdgeSafeArgument(entry, edge.PEdgeCallInstance.Exp))
             {

From 724031b982ea7a4824d4ec6bd5f656584e23ae3e Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Thu, 31 Aug 2017 08:10:51 -0700
Subject: [PATCH 59/83] Bug 1400442 - Annotate
 Servo_ComputedValues_EqualCustomProperties as safe, r=manishearth

--HG--
extra : rebase_source : 9b828ee29363fcff1f5be587958b822a29f3d5be
---
 js/src/devtools/rootAnalysis/analyzeHeapWrites.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
index 0d14e371f6a4..5dead2b564a6 100644
--- a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
+++ b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
@@ -28,6 +28,7 @@ function checkExternalFunction(entry)
         "atof",
         /memchr/,
         "strlen",
+        "Servo_ComputedValues_EqualCustomProperties",
         /Servo_DeclarationBlock_GetCssText/,
         /nsIFrame::AppendOwnedAnonBoxes/,
         // Assume that atomic accesses are threadsafe.

From cd9758653e1513ce78434161a8a4542f8f03266f Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Fri, 15 Sep 2017 17:15:34 -0700
Subject: [PATCH 60/83] Bug 1400442 - stylo heap write analysis: Miscellaneous
 minor annotations, r=jonco

--HG--
extra : rebase_source : d22cdb4f63009949b538541c82d41db6fc57c7aa
---
 .../rootAnalysis/analyzeHeapWrites.js         | 25 +++++++++++--------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
index 5dead2b564a6..70497e691db0 100644
--- a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
+++ b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
@@ -292,6 +292,9 @@ function checkFieldWrite(entry, location, fields)
             return;
         if (/nsCOMPtr<.*?>.mRawPtr/.test(field))
             return;
+
+        if (/\bThreadLocal<\b/.test(field))
+            return;
     }
 
     var str = "";
@@ -419,6 +422,7 @@ function ignoreContents(entry)
         /nsCSSValue::BufferFromString/,
         /NS_strdup/,
         /Assert_NoQueryNeeded/,
+        /PlatformThread::CurrentId/,
         /imgRequestProxy::GetProgressTracker/, // Uses an AutoLock
         /Smprintf/,
         "malloc",
@@ -478,20 +482,21 @@ function ignoreContents(entry)
             /nsTArray_Impl.*?::AppendElement/,
             /nsTArray_Impl.*?::RemoveElementsAt/,
             /nsTArray_Impl.*?::ReplaceElementsAt/,
-            /nsTArray_Impl.*?::InsertElementsAt/,
+            /nsTArray_Impl.*?::InsertElementAt/,
             /nsTArray_Impl.*?::SetCapacity/,
+            /nsTArray_Impl.*?::SetLength/,
             /nsTArray_base.*?::EnsureCapacity/,
             /nsTArray_base.*?::ShiftData/,
             /AutoTArray.*?::Init/,
-            /nsTSubstring<T>::SetCapacity/,
-            /nsTSubstring<T>::SetLength/,
-            /nsTSubstring<T>::Assign/,
-            /nsTSubstring<T>::Append/,
-            /nsTSubstring<T>::Replace/,
-            /nsTSubstring<T>::Trim/,
-            /nsTSubstring<T>::Truncate/,
-            /nsTSubstring<T>::StripTaggedASCII/,
-            /nsTSubstring<T>::operator=/,
+            /(nsTSubstring<T>|nsAC?String)::SetCapacity/,
+            /(nsTSubstring<T>|nsAC?String)::SetLength/,
+            /(nsTSubstring<T>|nsAC?String)::Assign/,
+            /(nsTSubstring<T>|nsAC?String)::Append/,
+            /(nsTSubstring<T>|nsAC?String)::Replace/,
+            /(nsTSubstring<T>|nsAC?String)::Trim/,
+            /(nsTSubstring<T>|nsAC?String)::Truncate/,
+            /(nsTSubstring<T>|nsAC?String)::StripTaggedASCII/,
+            /(nsTSubstring<T>|nsAC?String)::operator=/,
             /nsTAutoStringN<T, N>::nsTAutoStringN/,
             /nsTFixedString<T>::nsTFixedString/,
 

From c044d7cad25ebb8f6cd5d8165fadca5eee8340ff Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Fri, 15 Sep 2017 17:16:34 -0700
Subject: [PATCH 61/83] Bug 1400442 - Assert that
 Gecko_ShouldCreateStyleThreadPool is only called on the main thread, r=emilio

--HG--
extra : rebase_source : 4b6354e0db13489693d7df6d3ea56c4f38c9a193
---
 layout/style/ServoBindings.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/layout/style/ServoBindings.cpp b/layout/style/ServoBindings.cpp
index 51414c94e1d0..648d812b502b 100644
--- a/layout/style/ServoBindings.cpp
+++ b/layout/style/ServoBindings.cpp
@@ -2647,6 +2647,7 @@ Gecko_RegisterNamespace(nsIAtom* aNamespace)
 bool
 Gecko_ShouldCreateStyleThreadPool()
 {
+  MOZ_ASSERT(NS_IsMainThread());
   return !mozilla::BrowserTabsRemoteAutostart() || XRE_IsContentProcess();
 }
 

From f01d6be6a444e769124aaa1ce4785420225f8b80 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Fri, 15 Sep 2017 17:17:49 -0700
Subject: [PATCH 62/83] Bug 1400442 - Special-case annotation for
 a->b->emplace(); a->b->Init(), r=bhackett

--HG--
extra : rebase_source : 0029b7764332896fd882d68e429800662d9178b2
---
 .../rootAnalysis/analyzeHeapWrites.js         | 52 ++++++++++++++-----
 1 file changed, 40 insertions(+), 12 deletions(-)

diff --git a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
index 70497e691db0..38d635194566 100644
--- a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
+++ b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
@@ -865,7 +865,7 @@ function variableAssignRhs(edge)
     return null;
 }
 
-function processAssign(entry, location, lhs, edge)
+function processAssign(body, entry, location, lhs, edge)
 {
     var fields;
     [lhs, fields] = stripFields(lhs);
@@ -879,17 +879,19 @@ function processAssign(entry, location, lhs, edge)
             // taken and indirect assignments might occur. This is an
             // unsoundness in the analysis.
 
+            let assign = [body, edge];
+
             // Chain assignments if the RHS has only been assigned once.
             var rhsVariable = variableAssignRhs(edge);
             if (rhsVariable) {
-                var rhsEdge = singleAssignment(variableName(rhsVariable));
-                if (rhsEdge)
-                    edge = rhsEdge;
+                var rhsAssign = singleAssignment(variableName(rhsVariable));
+                if (rhsAssign)
+                    assign = rhsAssign;
             }
 
             if (!(name in assignments))
                 assignments[name] = [];
-            assignments[name].push(edge);
+            assignments[name].push(assign);
         } else {
             checkVariableAssignment(entry, location, name);
         }
@@ -999,11 +1001,11 @@ function process(entry, body, addCallee)
 
         if (edge.Kind == "Assign") {
             assert(edge.Exp.length == 2);
-            processAssign(entry, location, edge.Exp[0], edge);
+            processAssign(body, entry, location, edge.Exp[0], edge);
         } else if (edge.Kind == "Call") {
             assert(edge.Exp.length <= 2);
             if (edge.Exp.length == 2)
-                processAssign(entry, location, edge.Exp[1], edge);
+                processAssign(body, entry, location, edge.Exp[1], edge);
 
             // Treat assertion failures as if they don't return, so that
             // asserting NS_IsMainThread() is sufficient to prevent the
@@ -1164,9 +1166,13 @@ function singleAssignment(name)
 }
 
 function expressionValueEdge(exp) {
-    if (exp.Kind == "Var" && exp.Variable.Kind == "Temp")
-        return singleAssignment(variableName(exp.Variable));
-    return null;
+    if (!(exp.Kind == "Var" && exp.Variable.Kind == "Temp"))
+        return null;
+    const assign = singleAssignment(variableName(exp.Variable));
+    if (!assign)
+        return null;
+    const [body, edge] = assign;
+    return edge;
 }
 
 function isSafeVariable(entry, variable)
@@ -1193,8 +1199,10 @@ function isSafeLocalVariable(entry, name)
 {
     // If there is a single place where this variable has been assigned on
     // edges we are considering, look at that edge.
-    var edge = singleAssignment(name);
-    if (edge) {
+    var assign = singleAssignment(name);
+    if (assign) {
+        const [body, edge] = assign;
+
         // Treat temporary pointers to DebugOnly contents as thread local.
         if (isDirectCall(edge, /DebugOnly.*?::operator/))
             return true;
@@ -1255,6 +1263,26 @@ function isSafeLocalVariable(entry, name)
             {
                 return true;
             }
+
+            // Special case:
+            //
+            //   keyframe->mTimingFunction.emplace()
+            //   keyframe->mTimingFunction->Init()
+            //
+            // The object calling Init should be considered safe here because
+            // we just emplaced it, though in general keyframe::operator->
+            // could do something crazy.
+            if (isDirectCall(edge, /operator->/)) do {
+                const predges = getPredecessors(body)[edge.Index[0]];
+                if (!predges || predges.length != 1)
+                    break;
+                const predge = predges[0];
+                if (!isDirectCall(predge, /\bemplace\b/))
+                    break;
+                const instance = predge.PEdgeCallInstance;
+                if (JSON.stringify(instance) == JSON.stringify(edge.PEdgeCallInstance))
+                    return true;
+            } while (false);
         }
 
         if (isSafeAssignment(entry, edge, name))

From 7997149dd2f2b100e7aeabf9fc76ef54a098fac8 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Fri, 15 Sep 2017 17:18:13 -0700
Subject: [PATCH 63/83] Bug 1400442 - Trim down whitelists to only what is
 required, and mark all known issues with bug numbers, r=jonco

I also snuck in some last-minute assertions and minor fixes into this patch:

- don't stop reporting for a callee if we've seen it already (or rather, make the reachable set local to a root rather than global to all roots). This slows down runs with hundreds of hazards, but results in every problematic root being reported, for a more accurate count.

- annotate away some thread assertions

- special-case annotation for bug 1400435 since it's a whole family of hazards

--HG--
extra : rebase_source : ac7335d45e3e0772d34cb42cc6a3f628564fd3d1
---
 .../rootAnalysis/analyzeHeapWrites.js         | 79 ++++++++++++-------
 .../scripts/builder/hazard-analysis.sh        |  2 +-
 2 files changed, 51 insertions(+), 30 deletions(-)

diff --git a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
index 38d635194566..6bd400ba4fc1 100644
--- a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
+++ b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
@@ -30,6 +30,7 @@ function checkExternalFunction(entry)
         "strlen",
         "Servo_ComputedValues_EqualCustomProperties",
         /Servo_DeclarationBlock_GetCssText/,
+        "Servo_GetArcStringData",
         /nsIFrame::AppendOwnedAnonBoxes/,
         // Assume that atomic accesses are threadsafe.
         /^__atomic_fetch_/,
@@ -224,6 +225,7 @@ function treatAsSafeArgument(entry, varName, csuName)
         ["Gecko_StyleTransition_SetUnsupportedProperty", "aTransition", null],
         ["Gecko_AddPropertyToSet", "aPropertySet", null],
         ["Gecko_CalcStyleDifference", "aAnyStyleChanged", null],
+        ["Gecko_CalcStyleDifference", "aOnlyResetStructsChanged", null],
         ["Gecko_nsStyleSVG_CopyContextProperties", "aDst", null],
         ["Gecko_nsStyleFont_PrefillDefaultForGeneric", "aFont", null],
         ["Gecko_nsStyleSVG_SetContextPropertiesLength", "aSvg", null],
@@ -300,6 +302,14 @@ function checkFieldWrite(entry, location, fields)
     var str = "";
     for (var field of fields)
         str += " " + field;
+
+    // Bug 1400435
+    if (entry.stack[entry.stack.length - 1].callee.match(/^Gecko_CSSValue_Set/) &&
+        str == " nsAutoRefCnt.mValue")
+    {
+        return;
+    }
+
     dumpError(entry, location, "Field write" + str);
 }
 
@@ -321,6 +331,11 @@ function checkDereferenceWrite(entry, location, variable)
     if (hasThreadsafeReferenceCounts(entry, /nsCOMPtr<T>::swap\(.*?\[with T = (.*?)\]/))
         return;
 
+    // ConvertToLowerCase::write writes through a local pointer into the first
+    // argument.
+    if (/ConvertToLowerCase::write/.test(name) && entry.isSafeArgument(0))
+        return;
+
     dumpError(entry, location, "Dereference write " + (variable ? variable : "<unknown>"));
 }
 
@@ -408,6 +423,7 @@ function ignoreContents(entry)
         /MOZ_ReportAssertionFailure/,
         /MOZ_ReportCrash/,
         /MOZ_CrashPrintf/,
+        /MOZ_CrashOOL/,
         /AnnotateMozCrashReason/,
         /InvalidArrayIndex_CRASH/,
         /NS_ABORT_OOM/,
@@ -422,6 +438,7 @@ function ignoreContents(entry)
         /nsCSSValue::BufferFromString/,
         /NS_strdup/,
         /Assert_NoQueryNeeded/,
+        /AssertCurrentThreadOwnsMe/,
         /PlatformThread::CurrentId/,
         /imgRequestProxy::GetProgressTracker/, // Uses an AutoLock
         /Smprintf/,
@@ -429,8 +446,6 @@ function ignoreContents(entry)
         "free",
         "realloc",
         "jemalloc_thread_local_arena",
-        /profiler_register_thread/,
-        /profiler_unregister_thread/,
 
         // These all create static strings in local storage, which is threadsafe
         // to do but not understood by the analysis yet.
@@ -439,38 +454,36 @@ function ignoreContents(entry)
         /nsCSSProps::ValueToKeyword/,
         /nsCSSKeywords::GetStringValue/,
 
-        // The analysis can't cope with the indirection used for the objects
-        // being initialized here.
-        "Gecko_GetOrCreateKeyframeAtStart",
-        "Gecko_GetOrCreateInitialKeyframe",
-        "Gecko_GetOrCreateFinalKeyframe",
-        "Gecko_NewStyleQuoteValues",
-        "Gecko_NewCSSValueSharedList",
-        "Gecko_NewNoneTransform",
-        "Gecko_NewGridTemplateAreasValue",
-        /nsCSSValue::SetCalcValue/,
-        /CSSValueSerializeCalcOps::Append/,
-        "Gecko_CSSValue_SetFunction",
-        "Gecko_CSSValue_SetArray",
-        "Gecko_CSSValue_InitSharedList",
-        "Gecko_EnsureMozBorderColors",
-        "Gecko_ClearMozBorderColors",
-        "Gecko_AppendMozBorderColors",
-        "Gecko_CopyMozBorderColors",
-        "Gecko_SetNullImageValue",
+        // These could probably be handled by treating the scope of PSAutoLock
+        // aka BaseAutoLock<PSMutex> as threadsafe.
+        /profiler_register_thread/,
+        /profiler_unregister_thread/,
 
         // The analysis thinks we'll write to mBits in the DoGetStyleFoo<false>
         // call.  Maybe the template parameter confuses it?
         /nsStyleContext::PeekStyle/,
 
-        // Needs main thread assertions or other fixes.
-        /UndisplayedMap::GetEntryFor/,
+        // The analysis can't cope with the indirection used for the objects
+        // being initialized here, from nsCSSValue::Array::Create to the return
+        // value of the Item(i) getter.
+        /nsCSSValue::SetCalcValue/,
+
+        // Unable to analyze safety of linked list initialization.
+        "Gecko_NewCSSValueSharedList",
+        "Gecko_CSSValue_InitSharedList",
+
+        // Unable to trace through dataflow, but straightforward if inspected.
+        "Gecko_NewNoneTransform",
+
+        // Bug 1368922
+        "Gecko_UnsetDirtyStyleAttr",
+
+        // Bug 1400438
+        "Gecko_AppendMozBorderColors",
+
+        // Need main thread assertions or other fixes.
         /EffectCompositor::GetServoAnimationRule/,
         /LookAndFeel::GetColor/,
-        "Gecko_CopyStyleContentsFrom",
-        "Gecko_CSSValue_SetPixelValue",
-        "Gecko_UnsetDirtyStyleAttr",
-        /nsCSSPropertyIDSet::AddProperty/,
     ];
     if (entry.matches(whitelist))
         return true;
@@ -778,8 +791,6 @@ else
     loadTypes('src_comp.xdb');
 print(elapsedTime() + "Starting analysis...");
 
-var reachable = {};
-
 var xdb = xdbLibrary();
 xdb.open("src_body.xdb");
 
@@ -828,6 +839,9 @@ var assignments;
 // All loops in the current function which are reachable off main thread.
 var reachableLoops;
 
+// Functions that are reachable from the current root.
+var reachable = {};
+
 function dumpError(entry, location, text)
 {
     if (errorHeader) {
@@ -1076,6 +1090,12 @@ function processRoot(name)
     var parameterNames = {};
     var worklist = [new WorklistEntry(name, safeArguments, [new CallSite(name, safeArguments, null, parameterNames)], parameterNames)];
 
+    reachable = {};
+
+    var armed = false;
+    if (name.includes("Gecko_CSSValue_Set"))
+        armed = true;
+
     while (worklist.length > 0) {
         var entry = worklist.pop();
 
@@ -1084,6 +1104,7 @@ function processRoot(name)
         // analyzing functions separately for each subset if simpler, ensures that
         // the stack traces we produce accurately characterize the stack arguments,
         // and should be fast enough for now.
+
         if (entry.mangledName() in reachable)
             continue;
         reachable[entry.mangledName()] = true;
diff --git a/taskcluster/scripts/builder/hazard-analysis.sh b/taskcluster/scripts/builder/hazard-analysis.sh
index 307aa5d4f44e..10d135247234 100755
--- a/taskcluster/scripts/builder/hazard-analysis.sh
+++ b/taskcluster/scripts/builder/hazard-analysis.sh
@@ -160,7 +160,7 @@ function check_hazards () {
         exit 1
     fi
 
-    NUM_ALLOWED_WRITE_HAZARDS=4
+    NUM_ALLOWED_WRITE_HAZARDS=0
     if [ $NUM_WRITE_HAZARDS -gt $NUM_ALLOWED_WRITE_HAZARDS ]; then
         echo "TEST-UNEXPECTED-FAIL $NUM_WRITE_HAZARDS heap write hazards detected out of $NUM_ALLOWED_WRITE_HAZARDS allowed" >&2
         echo "TinderboxPrint: documentation<br/><a href='https://wiki.mozilla.org/Javascript:Hazard_Builds#Diagnosing_a_heap_write_hazard_failure'>heap write hazard analysis failures</a>, visit \"Inspect Task\" link for hazard details"

From b08f501872b582982d854627a3d48cb43b137139 Mon Sep 17 00:00:00 2001
From: Joel Maher <jmaher@mozilla.com>
Date: Tue, 19 Sep 2017 11:44:02 -0400
Subject: [PATCH 64/83] Bug 1401184 - migrate mochitest-chrome from buildbot
 hardware to taskcluster VM. r=ahal

---
 layout/base/tests/chrome/chrome.ini |  1 +
 taskcluster/ci/test/tests.yml       | 12 +++++-------
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/layout/base/tests/chrome/chrome.ini b/layout/base/tests/chrome/chrome.ini
index 78986d55c5a1..3b7eaad0db26 100644
--- a/layout/base/tests/chrome/chrome.ini
+++ b/layout/base/tests/chrome/chrome.ini
@@ -31,6 +31,7 @@ skip-if = os == 'linux' && !debug # Bug 1208197
 [test_bug847890_paintFlashing.html]
 [test_bug1018265.xul]
 [test_bug1041200.xul]
+skip-if = os == 'win' && bits == 64 # Bug 1272321
 support-files =
   bug1041200_frame.html
   bug1041200_window.html
diff --git a/taskcluster/ci/test/tests.yml b/taskcluster/ci/test/tests.yml
index 6a30b85f3cb5..fced2e7faa44 100644
--- a/taskcluster/ci/test/tests.yml
+++ b/taskcluster/ci/test/tests.yml
@@ -658,7 +658,6 @@ mochitest-chrome:
     suite: mochitest/chrome
     treeherder-symbol: tc-M(c)
     loopback-video: true
-    virtualization: hardware
     instance-size:
         by-test-platform:
             android.*: xlarge
@@ -674,12 +673,8 @@ mochitest-chrome:
         by-test-platform:
             linux.*-stylo.*: ['autoland', 'mozilla-central', 'try']
             macosx64-stylo.*: ['mozilla-central', 'try']
+            windows.*-stylo.*: ['autoland', 'mozilla-central', 'try']
             default: built-projects
-    worker-type:
-        by-test-platform:
-            windows7-32.*: buildbot-bridge/buildbot-bridge
-            windows10-64.*: buildbot-bridge/buildbot-bridge
-            default: null
     mozharness:
         by-test-platform:
             android.*:
@@ -711,7 +706,10 @@ mochitest-chrome:
                             - remove_executables.py
                 extra-options:
                     - --mochitest-suite=chrome
-
+    tier:
+        by-test-platform:
+            windows10-64-asan.*: 3
+            default: default
 
 mochitest-clipboard:
     description: "Mochitest clipboard run"

From 2b9c5c615c4064287a5aa6357508c2ca303a5193 Mon Sep 17 00:00:00 2001
From: Joel Maher <jmaher@mozilla.com>
Date: Tue, 19 Sep 2017 11:44:05 -0400
Subject: [PATCH 65/83] Bug 1397258 - migrate mochitest-webgl to windows 10.
 r=ahal

---
 taskcluster/ci/test/test-sets.yml | 1 -
 taskcluster/ci/test/tests.yml     | 6 +-----
 2 files changed, 1 insertion(+), 6 deletions(-)

diff --git a/taskcluster/ci/test/test-sets.yml b/taskcluster/ci/test/test-sets.yml
index 2ac35f7878a8..1745f7b19e79 100644
--- a/taskcluster/ci/test/test-sets.yml
+++ b/taskcluster/ci/test/test-sets.yml
@@ -317,7 +317,6 @@ android-x86-tests:
 
 windows8-tests:
     - reftest-no-accel
-    - mochitest-webgl
 
 devtools-tests:
     - mochitest-devtools-chrome
diff --git a/taskcluster/ci/test/tests.yml b/taskcluster/ci/test/tests.yml
index fced2e7faa44..f5c37dc7024d 100644
--- a/taskcluster/ci/test/tests.yml
+++ b/taskcluster/ci/test/tests.yml
@@ -970,17 +970,13 @@ mochitest-webgl:
     virtualization: virtual-with-gpu
     run-on-projects:
         by-test-platform:
-            # Deactivate try on Buildbot, by default. We don't have enough machines
-            windows8-64.*: ['mozilla-release', 'mozilla-beta', 'mozilla-central', 'mozilla-inbound', 'autoland']
-            windows8-64-devedition/opt: built-projects  # No dev edition outside of supported branches
-            windows10.*: []
             linux.*-stylo.*: ['autoland', 'mozilla-central', 'try']
             macosx64-stylo.*: ['mozilla-central', 'try']
             windows7-32-stylo.*: ['autoland', 'mozilla-central', 'try']
             default: built-projects
     worker-type:
         by-test-platform:
-            windows8-64.*: buildbot-bridge/buildbot-bridge
+            windows10-64.*: buildbot-bridge/buildbot-bridge
             default: null
     chunks:
         by-test-platform:

From f4b8f26ddb5a57070a4be9e4bdfa53921d259085 Mon Sep 17 00:00:00 2001
From: Joel Maher <jmaher@mozilla.com>
Date: Tue, 19 Sep 2017 11:44:07 -0400
Subject: [PATCH 66/83] Bug 1398910 - make reftest-no-accel run on windows 10
 (hardware) instead of windows 8. r=ahal,jet

---
 layout/reftests/abs-pos/reftest.list          |  2 +-
 layout/reftests/columns/reftest.list          |  2 +-
 layout/reftests/forms/fieldset/reftest.list   |  2 +-
 layout/reftests/forms/input/text/reftest.list |  2 +-
 layout/reftests/forms/reftest.list            |  2 +-
 .../relative/reftest.list                     |  8 +++----
 layout/reftests/scrolling/reftest.list        |  2 +-
 .../reftests/svg/svg-integration/reftest.list |  2 +-
 layout/reftests/text-overflow/reftest.list    |  2 +-
 taskcluster/ci/test/test-platforms.yml        | 22 -------------------
 taskcluster/ci/test/test-sets.yml             |  3 ---
 taskcluster/ci/test/tests.yml                 | 15 ++++---------
 12 files changed, 16 insertions(+), 48 deletions(-)

diff --git a/layout/reftests/abs-pos/reftest.list b/layout/reftests/abs-pos/reftest.list
index e4c41c4e3cea..3e42aaea5960 100644
--- a/layout/reftests/abs-pos/reftest.list
+++ b/layout/reftests/abs-pos/reftest.list
@@ -53,7 +53,7 @@ fuzzy-if(gtkWidget,1,1) fuzzy-if(Android,9,185) fuzzy-if(asyncPan&&!layersGPUAcc
 fuzzy-if(gtkWidget,1,8) == select-1.html select-1-ref.html
 fuzzy-if(gtkWidget,1,8) == select-1-dynamic.html select-1-ref.html
 == select-2.html select-2-ref.html
-fuzzy-if(gtkWidget,1,19) fuzzy-if(Android,17,726) fuzzy-if(asyncPan&&!layersGPUAccelerated,110,114) fuzzy-if(browserIsRemote&&winWidget,110,114) == select-3.html select-3-ref.html
+fuzzy-if(gtkWidget,1,19) fuzzy-if(Android,17,726) fuzzy-if(asyncPan&&!layersGPUAccelerated,110,114) fuzzy-if(browserIsRemote&&winWidget,143,114) == select-3.html select-3-ref.html
 == multi-column-1.html multi-column-1-ref.html
 == button-1.html button-1-ref.html
 == button-2.html button-2-ref.html
diff --git a/layout/reftests/columns/reftest.list b/layout/reftests/columns/reftest.list
index 30f0768e3b9e..94d6c649bfd6 100644
--- a/layout/reftests/columns/reftest.list
+++ b/layout/reftests/columns/reftest.list
@@ -34,7 +34,7 @@ HTTP(..) == columnfill-auto-3.html columnfill-auto-2-ref.html
 == columnrule-overflow.html columnrule-overflow-ref.html
 == columns-table-caption-000.html columns-table-caption-000-ref.html
 == positioning-transforms-bug1112501.html positioning-transforms-bug1112501-ref.html
-fuzzy-if(browserIsRemote&&winWidget,140,276) == fieldset-columns-001.html fieldset-columns-001-ref.html
+fuzzy-if(browserIsRemote&&winWidget,142,276) == fieldset-columns-001.html fieldset-columns-001-ref.html
 == dynamic-change-with-overflow-1.html dynamic-change-with-overflow-1-ref.html
 == dynamic-text-indent-1.html dynamic-text-indent-1-ref.html
 == dynamic-text-indent-2.html dynamic-text-indent-2-ref.html
diff --git a/layout/reftests/forms/fieldset/reftest.list b/layout/reftests/forms/fieldset/reftest.list
index 93182d45fa3e..efc303924e57 100644
--- a/layout/reftests/forms/fieldset/reftest.list
+++ b/layout/reftests/forms/fieldset/reftest.list
@@ -5,7 +5,7 @@ fuzzy-if(skiaContent,2,13) == dynamic-legend-scroll-1.html dynamic-legend-scroll
 == fieldset-scroll-1.html fieldset-scroll-1-ref.html
 == fieldset-scrolled-1.html fieldset-scrolled-1-ref.html
 == fieldset-overflow-auto-1.html fieldset-overflow-auto-1-ref.html
-fuzzy-if(winWidget&&!layersGPUAccelerated,140,276) == positioned-container-1.html positioned-container-1-ref.html
+fuzzy-if(winWidget&&!layersGPUAccelerated,142,276) == positioned-container-1.html positioned-container-1-ref.html
 == relpos-legend-1.html relpos-legend-1-ref.html
 == relpos-legend-2.html relpos-legend-2-ref.html
 == relpos-legend-3.html relpos-legend-3-ref.html
diff --git a/layout/reftests/forms/input/text/reftest.list b/layout/reftests/forms/input/text/reftest.list
index 7f75af36a5e2..d900c1897139 100644
--- a/layout/reftests/forms/input/text/reftest.list
+++ b/layout/reftests/forms/input/text/reftest.list
@@ -1,5 +1,5 @@
 == bounds-1.html bounds-1-ref.html
-fuzzy-if(asyncPan&&!layersGPUAccelerated,140,111) == size-1.html size-1-ref.html
+fuzzy-if(asyncPan&&!layersGPUAccelerated,151,111) == size-1.html size-1-ref.html
 == size-2.html size-2-ref.html
 HTTP(..) == baseline-1.html baseline-1-ref.html
 HTTP(..) == centering-1.xul centering-1-ref.xul
diff --git a/layout/reftests/forms/reftest.list b/layout/reftests/forms/reftest.list
index 80a91faf5bbb..c6a3f29b3753 100644
--- a/layout/reftests/forms/reftest.list
+++ b/layout/reftests/forms/reftest.list
@@ -1,5 +1,5 @@
 fuzzy-if(skiaContent,1,10) HTTP(..) == text-control-baseline-1.html text-control-baseline-1-ref.html
-fuzzy-if(cocoaWidget,16,64) fuzzy-if(Android,52,64) fuzzy-if(winWidget,88,400) == display-block-baselines-1.html display-block-baselines-1-ref.html # anti-aliasing issues
+fuzzy-if(cocoaWidget,16,64) fuzzy-if(Android,52,64) fuzzy-if(winWidget,88,624) == display-block-baselines-1.html display-block-baselines-1-ref.html # anti-aliasing issues
 == display-block-baselines-2.html display-block-baselines-2-ref.html
 == display-block-baselines-3.html display-block-baselines-3-ref.html
 == display-block-baselines-4.html display-block-baselines-4-ref.html
diff --git a/layout/reftests/position-dynamic-changes/relative/reftest.list b/layout/reftests/position-dynamic-changes/relative/reftest.list
index f4a02bcd974a..6c2142c4194c 100644
--- a/layout/reftests/position-dynamic-changes/relative/reftest.list
+++ b/layout/reftests/position-dynamic-changes/relative/reftest.list
@@ -1,5 +1,5 @@
-fuzzy-if(cocoaWidget,1,2) fuzzy-if(d2d,47,26) fuzzy-if(asyncPan&&!layersGPUAccelerated,140,716) == move-right-bottom.html move-right-bottom-ref.html
-fuzzy-if(cocoaWidget,1,2) fuzzy-if(asyncPan&&!layersGPUAccelerated,140,716) == move-top-left.html move-top-left-ref.html # Bug 688545
-fuzzy-if(cocoaWidget,1,3) fuzzy-if(asyncPan&&!layersGPUAccelerated,140,580) == move-right-bottom-table.html move-right-bottom-table-ref.html
-fuzzy-if(cocoaWidget,1,3) fuzzy-if(asyncPan&&!layersGPUAccelerated,140,580) == move-top-left-table.html move-top-left-table-ref.html # Bug 688545
+fuzzy-if(cocoaWidget,1,2) fuzzy-if(d2d,47,26) fuzzy-if(asyncPan&&!layersGPUAccelerated,149,716) == move-right-bottom.html move-right-bottom-ref.html
+fuzzy-if(cocoaWidget,1,2) fuzzy-if(asyncPan&&!layersGPUAccelerated,149,716) == move-top-left.html move-top-left-ref.html # Bug 688545
+fuzzy-if(cocoaWidget,1,3) fuzzy-if(asyncPan&&!layersGPUAccelerated,144,580) == move-right-bottom-table.html move-right-bottom-table-ref.html
+fuzzy-if(cocoaWidget,1,3) fuzzy-if(asyncPan&&!layersGPUAccelerated,144,580) == move-top-left-table.html move-top-left-table-ref.html # Bug 688545
 == percent.html percent-ref.html
diff --git a/layout/reftests/scrolling/reftest.list b/layout/reftests/scrolling/reftest.list
index 636d1145f360..653629460d4f 100644
--- a/layout/reftests/scrolling/reftest.list
+++ b/layout/reftests/scrolling/reftest.list
@@ -29,7 +29,7 @@ fuzzy-if(d2d,1,4) HTTP == transformed-1.html transformed-1.html?ref
 HTTP == transformed-1.html?up transformed-1.html?ref
 fuzzy-if(Android,5,20000) == uncovering-1.html uncovering-1-ref.html
 fuzzy-if(Android,5,20000) == uncovering-2.html uncovering-2-ref.html
-fuzzy-if(asyncPan&&!layersGPUAccelerated,140,4520) == less-than-scrollbar-height.html less-than-scrollbar-height-ref.html
+fuzzy-if(asyncPan&&!layersGPUAccelerated,149,4520) == less-than-scrollbar-height.html less-than-scrollbar-height-ref.html
 == huge-horizontal-overflow.html huge-horizontal-overflow-ref.html
 == huge-vertical-overflow.html huge-vertical-overflow-ref.html
 fuzzy-if(asyncPan&&!layersGPUAccelerated,102,6818) == iframe-scrolling-attr-1.html iframe-scrolling-attr-ref.html
diff --git a/layout/reftests/svg/svg-integration/reftest.list b/layout/reftests/svg/svg-integration/reftest.list
index e384b46f8543..cd056e134a2b 100644
--- a/layout/reftests/svg/svg-integration/reftest.list
+++ b/layout/reftests/svg/svg-integration/reftest.list
@@ -48,5 +48,5 @@ fuzzy(1,5000) == mask-clipPath-opacity-01e.xhtml mask-clipPath-opacity-01-ref.xh
 
 # box-decoration-break tests
 fuzzy-if(Android,4,10) == box-decoration-break-01.xhtml box-decoration-break-01-ref.xhtml
-fuzzy(56,14) == box-decoration-break-02.xhtml box-decoration-break-02-ref.xhtml
+fuzzy(62,14) == box-decoration-break-02.xhtml box-decoration-break-02-ref.xhtml
 fuzzy(67,234) == box-decoration-break-03.xhtml box-decoration-break-01-ref.xhtml
diff --git a/layout/reftests/text-overflow/reftest.list b/layout/reftests/text-overflow/reftest.list
index 9557dbb38e52..ce648d9c7b83 100644
--- a/layout/reftests/text-overflow/reftest.list
+++ b/layout/reftests/text-overflow/reftest.list
@@ -4,7 +4,7 @@ fuzzy-if(Android,16,244) HTTP(..) == marker-basic.html marker-basic-ref.html  #
 HTTP(..) == marker-string.html marker-string-ref.html
 skip-if(Android) HTTP(..) == bidi-simple.html bidi-simple-ref.html # Fails on Android due to anti-aliasing
 skip-if(!gtkWidget) fuzzy-if(gtkWidget,2,289) HTTP(..) == bidi-simple-scrolled.html bidi-simple-scrolled-ref.html # Fails on Windows and OSX due to anti-aliasing
-fuzzy-if(Android,24,4000) fuzzy-if(cocoaWidget,1,40) fuzzy-if(asyncPan&&!layersGPUAccelerated,140,1836) HTTP(..) == scroll-rounding.html scroll-rounding-ref.html # bug 760264
+fuzzy-if(Android,24,4000) fuzzy-if(cocoaWidget,1,40) fuzzy-if(asyncPan&&!layersGPUAccelerated,149,1836) HTTP(..) == scroll-rounding.html scroll-rounding-ref.html # bug 760264
 fuzzy(2,453) fuzzy-if(skiaContent,9,2100) fails-if(gtkWidget) HTTP(..) == anonymous-block.html anonymous-block-ref.html # gtkWidget:bug 1309103
 HTTP(..) == false-marker-overlap.html false-marker-overlap-ref.html
 HTTP(..) == visibility-hidden.html visibility-hidden-ref.html
diff --git a/taskcluster/ci/test/test-platforms.yml b/taskcluster/ci/test/test-platforms.yml
index db07b82e678b..88a246caeff4 100644
--- a/taskcluster/ci/test/test-platforms.yml
+++ b/taskcluster/ci/test/test-platforms.yml
@@ -249,28 +249,6 @@ windows10-64-asan/opt:
     test-sets:
         - common-tests
 
-# Windows8 tests; all via BBB
-windows8-64/debug:
-    build-platform: win64/debug
-    test-sets:
-        - windows8-tests
-windows8-64/opt:
-    build-platform: win64/opt
-    test-sets:
-        - windows8-tests
-windows8-64-pgo/opt:
-    build-platform: win64-pgo/opt
-    test-sets:
-        - windows8-tests
-windows8-64-nightly/opt:
-    build-platform: win64-nightly/opt
-    test-sets:
-        - windows8-tests
-windows8-64-devedition/opt:
-    build-platform: win64-devedition-nightly/opt
-    test-sets:
-        - windows8-tests
-
 ##
 # MacOS X platforms (matching /macosx.*/)
 
diff --git a/taskcluster/ci/test/test-sets.yml b/taskcluster/ci/test/test-sets.yml
index 1745f7b19e79..1db48aaa098d 100644
--- a/taskcluster/ci/test/test-sets.yml
+++ b/taskcluster/ci/test/test-sets.yml
@@ -315,8 +315,5 @@ android-x86-tests:
     - mochitest-chrome
     - xpcshell
 
-windows8-tests:
-    - reftest-no-accel
-
 devtools-tests:
     - mochitest-devtools-chrome
diff --git a/taskcluster/ci/test/tests.yml b/taskcluster/ci/test/tests.yml
index f5c37dc7024d..1a278cc2fccd 100644
--- a/taskcluster/ci/test/tests.yml
+++ b/taskcluster/ci/test/tests.yml
@@ -1148,22 +1148,15 @@ reftest-no-accel:
     suite: reftest/reftest-no-accel
     treeherder-symbol: tc-R(Ru)
     virtualization: virtual-with-gpu
-    run-on-projects:
-        by-test-platform:
-            windows10.*: []
-            # Deactivate try on Buildbot, by default. We don't have enough machines
-            windows8-64.*: ['mozilla-release', 'mozilla-beta', 'mozilla-central', 'mozilla-inbound', 'autoland']
-            windows8-64-devedition/opt: built-projects  # No dev edition outside of supported branches
-            default: built-projects
     worker-type:
         by-test-platform:
-            windows8-64.*: buildbot-bridge/buildbot-bridge
+            windows10-64.*: buildbot-bridge/buildbot-bridge
             default: null
     chunks:
         by-test-platform:
             macosx.*: 1
-            windows8-64.*/debug: 2
-            windows8-64.*/opt: 1
+            windows10-64.*/debug: 2
+            windows10-64.*/opt: 1
             default: 8
     e10s:
         by-test-platform:
@@ -1175,7 +1168,7 @@ reftest-no-accel:
         no-read-buildbot-config: true
         chunked:
             by-test-platform:
-                windows8-64.*/opt: false
+                windows10-64.*/opt: false
                 macosx.*: false
                 default: true
         config:

From fd7d739519837b689419bc4ca747c4a002bbc460 Mon Sep 17 00:00:00 2001
From: Andrea Marchesini <amarchesini@mozilla.com>
Date: Tue, 19 Sep 2017 17:52:28 +0200
Subject: [PATCH 67/83] Bug 1401204 - Get rid of NS_BackgroundInputStream and
 NS_BackgroundOutputStream, r=valentin

---
 netwerk/base/nsNetUtil.cpp | 42 --------------------------------------
 netwerk/base/nsNetUtil.h   | 16 ---------------
 2 files changed, 58 deletions(-)

diff --git a/netwerk/base/nsNetUtil.cpp b/netwerk/base/nsNetUtil.cpp
index 5d50e1cb54c8..47c5b7b81e38 100644
--- a/netwerk/base/nsNetUtil.cpp
+++ b/netwerk/base/nsNetUtil.cpp
@@ -1338,48 +1338,6 @@ NS_NewLocalFileStream(nsIFileStream **result,
     return rv;
 }
 
-nsresult
-NS_BackgroundInputStream(nsIInputStream **result,
-                         nsIInputStream  *stream,
-                         uint32_t         segmentSize /* = 0 */,
-                         uint32_t         segmentCount /* = 0 */)
-{
-    nsresult rv;
-    nsCOMPtr<nsIStreamTransportService> sts =
-        do_GetService(NS_STREAMTRANSPORTSERVICE_CONTRACTID, &rv);
-    if (NS_SUCCEEDED(rv)) {
-        nsCOMPtr<nsITransport> inTransport;
-        rv = sts->CreateInputTransport(stream, int64_t(-1), int64_t(-1),
-                                       true, getter_AddRefs(inTransport));
-        if (NS_SUCCEEDED(rv))
-            rv = inTransport->OpenInputStream(nsITransport::OPEN_BLOCKING,
-                                              segmentSize, segmentCount,
-                                              result);
-    }
-    return rv;
-}
-
-nsresult
-NS_BackgroundOutputStream(nsIOutputStream **result,
-                          nsIOutputStream  *stream,
-                          uint32_t          segmentSize  /* = 0 */,
-                          uint32_t          segmentCount /* = 0 */)
-{
-    nsresult rv;
-    nsCOMPtr<nsIStreamTransportService> sts =
-        do_GetService(NS_STREAMTRANSPORTSERVICE_CONTRACTID, &rv);
-    if (NS_SUCCEEDED(rv)) {
-        nsCOMPtr<nsITransport> inTransport;
-        rv = sts->CreateOutputTransport(stream, int64_t(-1), int64_t(-1),
-                                        true, getter_AddRefs(inTransport));
-        if (NS_SUCCEEDED(rv))
-            rv = inTransport->OpenOutputStream(nsITransport::OPEN_BLOCKING,
-                                               segmentSize, segmentCount,
-                                               result);
-    }
-    return rv;
-}
-
 nsresult
 NS_NewBufferedOutputStream(nsIOutputStream **result,
                            nsIOutputStream  *str,
diff --git a/netwerk/base/nsNetUtil.h b/netwerk/base/nsNetUtil.h
index 0e825288d519..8154072ab2dd 100644
--- a/netwerk/base/nsNetUtil.h
+++ b/netwerk/base/nsNetUtil.h
@@ -512,22 +512,6 @@ nsresult NS_NewLocalFileStream(nsIFileStream **result,
                                int32_t         perm          = -1,
                                int32_t         behaviorFlags = 0);
 
-// returns the input end of a pipe.  the output end of the pipe
-// is attached to the original stream.  data from the original
-// stream is read into the pipe on a background thread.
-nsresult NS_BackgroundInputStream(nsIInputStream **result,
-                                  nsIInputStream  *stream,
-                                  uint32_t         segmentSize  = 0,
-                                  uint32_t         segmentCount = 0);
-
-// returns the output end of a pipe.  the input end of the pipe
-// is attached to the original stream.  data written to the pipe
-// is copied to the original stream on a background thread.
-nsresult NS_BackgroundOutputStream(nsIOutputStream **result,
-                                   nsIOutputStream  *stream,
-                                   uint32_t          segmentSize  = 0,
-                                   uint32_t          segmentCount = 0);
-
 MOZ_MUST_USE nsresult
 NS_NewBufferedInputStream(nsIInputStream **result,
                           nsIInputStream  *str,

From a7712cd24a5b6c4731a07bd74261baa3c083a229 Mon Sep 17 00:00:00 2001
From: Tim Taubert <ttaubert@mozilla.com>
Date: Tue, 19 Sep 2017 18:00:39 +0200
Subject: [PATCH 68/83] Bug 1400940 - Fix WebAuthn deadlock when cancelling a
 request on tab switch r=jcj

This should be an easy solution. We can't stop the sign() or register()
runloop from calling the callback, so we need the callback to simply return
early when the U2FHIDTokenManager shuts down.

Bug #: 1400940

Differential Revision: https://phabricator.services.mozilla.com/D67
---
 dom/webauthn/U2FHIDTokenManager.cpp | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/dom/webauthn/U2FHIDTokenManager.cpp b/dom/webauthn/U2FHIDTokenManager.cpp
index bb4656a8e780..c7da2746385c 100644
--- a/dom/webauthn/U2FHIDTokenManager.cpp
+++ b/dom/webauthn/U2FHIDTokenManager.cpp
@@ -18,7 +18,7 @@ static void
 u2f_register_callback(uint64_t aTransactionId, rust_u2f_result* aResult)
 {
   StaticMutexAutoLock lock(gInstanceMutex);
-  if (NS_WARN_IF(!gInstance || !gPBackgroundThread)) {
+  if (!gInstance || NS_WARN_IF(!gPBackgroundThread)) {
     return;
   }
 
@@ -35,7 +35,7 @@ static void
 u2f_sign_callback(uint64_t aTransactionId, rust_u2f_result* aResult)
 {
   StaticMutexAutoLock lock(gInstanceMutex);
-  if (NS_WARN_IF(!gInstance || !gPBackgroundThread)) {
+  if (!gInstance || NS_WARN_IF(!gPBackgroundThread)) {
     return;
   }
 
@@ -63,15 +63,21 @@ U2FHIDTokenManager::U2FHIDTokenManager() : mTransactionId(0)
 
 U2FHIDTokenManager::~U2FHIDTokenManager()
 {
-  StaticMutexAutoLock lock(gInstanceMutex);
-  MOZ_ASSERT(NS_GetCurrentThread() == gPBackgroundThread);
+  {
+    StaticMutexAutoLock lock(gInstanceMutex);
+    MOZ_ASSERT(NS_GetCurrentThread() == gPBackgroundThread);
 
-  mRegisterPromise.RejectIfExists(NS_ERROR_DOM_UNKNOWN_ERR, __func__);
-  mSignPromise.RejectIfExists(NS_ERROR_DOM_UNKNOWN_ERR, __func__);
+    mRegisterPromise.RejectIfExists(NS_ERROR_DOM_UNKNOWN_ERR, __func__);
+    mSignPromise.RejectIfExists(NS_ERROR_DOM_UNKNOWN_ERR, __func__);
 
+    gInstance = nullptr;
+  }
+
+  // Release gInstanceMutex before we call U2FManager::drop(). It will wait
+  // for the work queue thread to join, and that requires the
+  // u2f_{register,sign}_callback to lock and return.
   rust_u2f_mgr_free(mU2FManager);
   mU2FManager = nullptr;
-  gInstance = nullptr;
 }
 
 // A U2F Register operation causes a new key pair to be generated by the token.

From be7d259acc1a96a6f897e5eda9ea0353f93da9af Mon Sep 17 00:00:00 2001
From: Rail Aliiev <rail@mozilla.com>
Date: Tue, 19 Sep 2017 06:09:23 -0400
Subject: [PATCH 69/83] Bug 1395697 - Use BZ2 MAR compression for versions less
 than 56.0 r=sfraser

MozReview-Commit-ID: LutFJRayTOX

--HG--
extra : rebase_source : 17c71e4384d5f4106660214f04bf0e67df0ed719
---
 .../funsize-update-generator/scripts/funsize.py       | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/taskcluster/docker/funsize-update-generator/scripts/funsize.py b/taskcluster/docker/funsize-update-generator/scripts/funsize.py
index 65a080775d54..142dd311c79f 100755
--- a/taskcluster/docker/funsize-update-generator/scripts/funsize.py
+++ b/taskcluster/docker/funsize-update-generator/scripts/funsize.py
@@ -248,9 +248,16 @@ def main():
                 verify_signature(dest, signing_certs)
             complete_mars["%s_size" % mar_type] = os.path.getsize(dest)
             complete_mars["%s_hash" % mar_type] = get_hash(dest)
-            if mar_type == 'to' and not is_lzma_compressed_mar(dest):
-                use_old_format = True
             unpack(work_env, dest, unpack_dir)
+            if mar_type == 'from':
+                version = get_option(unpack_dir, filename="application.ini",
+                                     section="App", option="Version")
+                major = int(version.split(".")[0])
+                # The updater for versions less than 56.0 requires BZ2
+                # compressed MAR files
+                if major < 56:
+                    use_old_format = True
+                    log.info("Forcing BZ2 compression for %s", f)
             log.info("AV-scanning %s ...", unpack_dir)
             sh.clamscan("-r", unpack_dir, _timeout=600, _err_to_out=True)
             log.info("Done.")

From 50a371672c9cb321da96681936f16674092704d7 Mon Sep 17 00:00:00 2001
From: Joel Maher <jmaher@mozilla.com>
Date: Tue, 19 Sep 2017 12:15:11 -0400
Subject: [PATCH 70/83] Bug 1370783 - Disable
 netwerk/test/browser/browser_child_resource.js on debug for frequent
 failures. r=me, a=test-only

---
 netwerk/test/browser/browser.ini | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/netwerk/test/browser/browser.ini b/netwerk/test/browser/browser.ini
index f4d3a59da312..b365de4efd04 100644
--- a/netwerk/test/browser/browser.ini
+++ b/netwerk/test/browser/browser.ini
@@ -5,7 +5,7 @@ support-files =
 [browser_about_cache.js]
 [browser_NetUtil.js]
 [browser_child_resource.js]
-skip-if = !crashreporter || (e10s && debug && os == "linux" && bits == 64)
+skip-if = !crashreporter || (e10s && debug && os == "linux" && bits == 64) || debug # Bug 1370783
 [browser_post_file.js]
 [browser_nsIFormPOSTActionChannel.js]
 skip-if = e10s # protocol handler and channel does not work in content process

From e801d6d6ae6120905b36d0861942a2e31dd818fc Mon Sep 17 00:00:00 2001
From: Joel Maher <jmaher@mozilla.com>
Date: Tue, 19 Sep 2017 12:15:46 -0400
Subject: [PATCH 71/83] Bug 1398766 - Disable
 toolkit/mozapps/extensions/test/browser/browser_gmpProvider.js on linux debug
 for frequent failures. r=me, a=test-only

---
 toolkit/mozapps/extensions/test/browser/browser.ini | 1 +
 1 file changed, 1 insertion(+)

diff --git a/toolkit/mozapps/extensions/test/browser/browser.ini b/toolkit/mozapps/extensions/test/browser/browser.ini
index fff0867fe9bd..da33cd2a7ca5 100644
--- a/toolkit/mozapps/extensions/test/browser/browser.ini
+++ b/toolkit/mozapps/extensions/test/browser/browser.ini
@@ -49,6 +49,7 @@ skip-if = buildapp == 'mulet'
 [browser_file_xpi_no_process_switch.js]
 [browser_getmorethemes.js]
 [browser_gmpProvider.js]
+skip-if = os == 'linux' && !debug # Bug 1398766
 [browser_install.js]
 [browser_installssl.js]
 [browser_legacy.js]

From 9b750573b6a1eb15bb93b953981b4f2fab593c2f Mon Sep 17 00:00:00 2001
From: Stephen A Pohl <spohl.mozilla.bugs@gmail.com>
Date: Tue, 19 Sep 2017 12:17:05 -0400
Subject: [PATCH 72/83] Bug 1398582: Prevent drawing titles in title bars on
 macOS 10.13 when we don't want them. r=mstange

---
 widget/cocoa/nsCocoaWindow.mm | 39 +++++++++++++++++++++++++----------
 1 file changed, 28 insertions(+), 11 deletions(-)

diff --git a/widget/cocoa/nsCocoaWindow.mm b/widget/cocoa/nsCocoaWindow.mm
index f582215b3335..b76a08aee38f 100644
--- a/widget/cocoa/nsCocoaWindow.mm
+++ b/widget/cocoa/nsCocoaWindow.mm
@@ -82,6 +82,20 @@ enum NSWindowOcclusionState {
 
 #endif
 
+#if !defined(MAC_OS_X_VERSION_10_10) || \
+    MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_10
+
+enum NSWindowTitleVisibility {
+  NSWindowTitleVisible = 0,
+  NSWindowTitleHidden  = 1
+};
+
+@interface NSWindow(TitleVisibility)
+- (void)setTitleVisibility:(NSWindowTitleVisibility)visibility;
+@end
+
+#endif
+
 #if !defined(MAC_OS_X_VERSION_10_12) || \
     MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_12
 
@@ -472,6 +486,11 @@ nsresult nsCocoaWindow::CreateNativeWindow(const NSRect &aRect,
   mWindow = [[windowClass alloc] initWithContentRect:contentRect styleMask:features 
                                  backing:NSBackingStoreBuffered defer:YES];
 
+  if ([mWindow respondsToSelector:@selector(setTitleVisibility)]) {
+    // By default, hide window titles.
+    [mWindow setTitleVisibility:NSWindowTitleHidden];
+  }
+
   // setup our notification delegate. Note that setDelegate: does NOT retain.
   mDelegate = [[WindowDelegate alloc] initWithGeckoWindow:this];
   [mWindow setDelegate:mDelegate];
@@ -1830,21 +1849,15 @@ nsCocoaWindow::SetTitle(const nsAString& aTitle)
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSRESULT;
 
-  if (!mWindow)
+  if (!mWindow) {
     return NS_OK;
+  }
 
   const nsString& strTitle = PromiseFlatString(aTitle);
-  NSString* title = [NSString stringWithCharacters:reinterpret_cast<const unichar*>(strTitle.get())
+  const unichar* uniTitle = reinterpret_cast<const unichar*>(strTitle.get());
+  NSString* title = [NSString stringWithCharacters:uniTitle
                                             length:strTitle.Length()];
-
-  if ([mWindow drawsContentsIntoWindowFrame] && ![mWindow wantsTitleDrawn]) {
-    // Don't cause invalidations.
-    [mWindow disableSetNeedsDisplay];
-    [mWindow setTitle:title];
-    [mWindow enableSetNeedsDisplay];
-  } else {
-    [mWindow setTitle:title];
-  }
+  [mWindow setTitle:title];
 
   return NS_OK;
 
@@ -3140,6 +3153,10 @@ static const NSString* kStateCollectionBehavior = @"collectionBehavior";
   if (changed) {
     [self updateContentViewSize];
     [self reflowTitlebarElements];
+    if ([self respondsToSelector:@selector(setTitleVisibility)]) {
+      [self setTitleVisibility:mDrawsIntoWindowFrame ? NSWindowTitleHidden :
+                                                       NSWindowTitleVisible];
+    }
   }
 }
 

From 3a05f43e129e539540274bbd55a466e80232c791 Mon Sep 17 00:00:00 2001
From: Michal Novotny <michal.novotny@gmail.com>
Date: Tue, 19 Sep 2017 18:37:40 +0200
Subject: [PATCH 73/83] Backed out changeset from bug 1392841 due to
 speedometer regression. r=backout

---
 modules/libpref/init/all.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index 4e1cfa7d34a3..ea1e4ca3abac 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -1822,7 +1822,7 @@ pref("network.http.enforce-framing.soft", true);
 pref("network.http.max_response_header_size", 393216);
 
 // If we should attempt to race the cache and network
-pref("network.http.rcwn.enabled", true);
+pref("network.http.rcwn.enabled", false);
 pref("network.http.rcwn.cache_queue_normal_threshold", 8);
 pref("network.http.rcwn.cache_queue_priority_threshold", 2);
 // We might attempt to race the cache with the network only if a resource

From 3d4de91391e04635b2ce672e9485b820680eec08 Mon Sep 17 00:00:00 2001
From: Kai Engert <kaie@kuix.de>
Date: Tue, 19 Sep 2017 18:43:02 +0200
Subject: [PATCH 74/83] Bug 1393854, land NSPR_4_18_RTM, no code change, only
 version numbers, r=me UPGRADE_NSPR_RELEASE DONTBUILD

---
 nsprpub/TAG-INFO            | 2 +-
 nsprpub/config/prdepend.h   | 1 -
 nsprpub/pr/include/prinit.h | 4 ++--
 old-configure.in            | 2 +-
 4 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/nsprpub/TAG-INFO b/nsprpub/TAG-INFO
index 68c9e3c74fd3..b30aac8d1a81 100644
--- a/nsprpub/TAG-INFO
+++ b/nsprpub/TAG-INFO
@@ -1 +1 @@
-NSPR_4_17_BETA2
+NSPR_4_17_RTM
diff --git a/nsprpub/config/prdepend.h b/nsprpub/config/prdepend.h
index 6c66b37ca0fc..e49e92677e3e 100644
--- a/nsprpub/config/prdepend.h
+++ b/nsprpub/config/prdepend.h
@@ -10,4 +10,3 @@
  */
 
 #error "Do not include this header file."
-
diff --git a/nsprpub/pr/include/prinit.h b/nsprpub/pr/include/prinit.h
index 3a90e8e1e42e..3a83a229dff2 100644
--- a/nsprpub/pr/include/prinit.h
+++ b/nsprpub/pr/include/prinit.h
@@ -31,11 +31,11 @@ PR_BEGIN_EXTERN_C
 ** The format of the version string is
 **     "<major version>.<minor version>[.<patch level>] [<Beta>]"
 */
-#define PR_VERSION  "4.17 Beta"
+#define PR_VERSION  "4.17"
 #define PR_VMAJOR   4
 #define PR_VMINOR   17
 #define PR_VPATCH   0
-#define PR_BETA     PR_TRUE
+#define PR_BETA     PR_FALSE
 
 /*
 ** PRVersionCheck
diff --git a/old-configure.in b/old-configure.in
index d217aed3c118..a092294f0ad8 100644
--- a/old-configure.in
+++ b/old-configure.in
@@ -48,7 +48,7 @@ dnl ========================================================
 MOZJPEG=62
 MOZPNG=10631
 NSPR_VERSION=4
-NSPR_MINVER=4.16
+NSPR_MINVER=4.17
 NSS_VERSION=3
 
 dnl Set the minimum version of toolkit libs used by mozilla

From 8ae1a159b8d634dd945dad30af87a363f7c2f814 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Sun, 30 Jul 2017 15:51:57 -0700
Subject: [PATCH 75/83] Bug 1386344 - JS shell: implement help(/pattern/),
 r=tcampbell

--HG--
extra : rebase_source : b3b6ab2109f6af9e474ea164f0c520f02233dd45
---
 js/src/builtin/TestingFunctions.cpp | 17 +++---
 js/src/shell/js.cpp                 | 89 ++++++++++++++++++++++-------
 js/src/shell/jsshell.cpp            | 28 +++++----
 3 files changed, 94 insertions(+), 40 deletions(-)

diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
index 9b8afdf43eee..cf2f0e3ecc2a 100644
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -4594,7 +4594,7 @@ static const JSFunctionSpecWithHelp TestingFunctions[] = {
     JS_FN_HELP("oomThreadTypes", OOMThreadTypes, 0, 0,
 "oomThreadTypes()",
 "  Get the number of thread types that can be used as an argument for\n"
-"oomAfterAllocations() and oomAtAllocation()."),
+"  oomAfterAllocations() and oomAtAllocation()."),
 
     JS_FN_HELP("oomAfterAllocations", OOMAfterAllocations, 2, 0,
 "oomAfterAllocations(count [,threadType])",
@@ -4748,8 +4748,8 @@ gc::ZealModeHelpText),
 
     JS_FN_HELP("enableOsiPointRegisterChecks", EnableOsiPointRegisterChecks, 0, 0,
 "enableOsiPointRegisterChecks()",
-"Emit extra code to verify live regs at the start of a VM call are not\n"
-"modified before its OsiPoint."),
+"  Emit extra code to verify live regs at the start of a VM call are not\n"
+"  modified before its OsiPoint."),
 
     JS_FN_HELP("displayName", DisplayName, 1, 0,
 "displayName(fn)",
@@ -4768,7 +4768,7 @@ gc::ZealModeHelpText),
 
     JS_FN_HELP("getJitCompilerOptions", GetJitCompilerOptions, 0, 0,
 "getCompilerOptions()",
-"Return an object describing some of the JIT compiler options.\n"),
+"  Return an object describing some of the JIT compiler options.\n"),
 
     JS_FN_HELP("isAsmJSModule", IsAsmJSModule, 1, 0,
 "isAsmJSModule(fn)",
@@ -4821,7 +4821,7 @@ gc::ZealModeHelpText),
 
     JS_FN_HELP("isRelazifiableFunction", IsRelazifiableFunction, 1, 0,
 "isRelazifiableFunction(fun)",
-"  Ture if fun is a JSFunction with a relazifiable JSScript."),
+"  True if fun is a JSFunction with a relazifiable JSScript."),
 
     JS_FN_HELP("enableShellAllocationMetadataBuilder", EnableShellAllocationMetadataBuilder, 0, 0,
 "enableShellAllocationMetadataBuilder()",
@@ -4874,11 +4874,10 @@ gc::ZealModeHelpText),
 "  Serialize 'data' using JS_WriteStructuredClone. Returns a structured\n"
 "  clone buffer object. 'policy' may be an options hash. Valid keys:\n"
 "    'SharedArrayBuffer' - either 'allow' (the default) or 'deny'\n"
-"    to specify whether SharedArrayBuffers may be serialized.\n"
-"\n"
+"      to specify whether SharedArrayBuffers may be serialized.\n"
 "    'scope' - SameProcessSameThread, SameProcessDifferentThread, or\n"
-"    DifferentProcess. Determines how some values will be serialized.\n"
-"    Clone buffers may only be deserialized with a compatible scope."),
+"      DifferentProcess. Determines how some values will be serialized.\n"
+"      Clone buffers may only be deserialized with a compatible scope."),
 
     JS_FN_HELP("deserialize", Deserialize, 1, 0,
 "deserialize(clonebuffer[, opts])",
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index 452dfe556d0f..2bb7e97120a7 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -63,6 +63,7 @@
 #include "shellmoduleloader.out.h"
 
 #include "builtin/ModuleObject.h"
+#include "builtin/RegExp.h"
 #include "builtin/TestingFunctions.h"
 #include "frontend/Parser.h"
 #include "gc/GCInternals.h"
@@ -6284,7 +6285,7 @@ static const JSFunctionSpecWithHelp shell_functions[] = {
 "  Return the current time with sub-ms precision."),
 
     JS_FN_HELP("help", Help, 0, 0,
-"help([name ...])",
+"help([function or interface object or /pattern/])",
 "  Display usage and help messages."),
 
     JS_FN_HELP("quit", Quit, 0, 0,
@@ -6862,22 +6863,56 @@ PrintHelp(JSContext* cx, HandleObject obj)
 }
 
 static bool
-PrintEnumeratedHelp(JSContext* cx, HandleObject obj, bool brief)
+PrintEnumeratedHelp(JSContext* cx, HandleObject obj, HandleObject pattern, bool brief)
 {
     AutoIdVector idv(cx);
     if (!GetPropertyKeys(cx, obj, JSITER_OWNONLY | JSITER_HIDDEN, &idv))
         return false;
 
+    Rooted<RegExpObject*> regex(cx);
+    if (pattern)
+        regex = &UncheckedUnwrap(pattern)->as<RegExpObject>();
+
     for (size_t i = 0; i < idv.length(); i++) {
         RootedValue v(cx);
         RootedId id(cx, idv[i]);
         if (!JS_GetPropertyById(cx, obj, id, &v))
             return false;
-        if (v.isObject()) {
-            RootedObject funcObj(cx, &v.toObject());
-            if (!PrintHelp(cx, funcObj))
+        if (!v.isObject())
+            continue;
+
+        RootedObject funcObj(cx, &v.toObject());
+        if (regex) {
+            // Only pay attention to objects with a 'help' property, which will
+            // either be documented functions or interface objects.
+            if (!JS_GetProperty(cx, funcObj, "help", &v))
                 return false;
+            if (!v.isString())
+                continue;
+
+            // For functions, match against the name. For interface objects,
+            // match against the usage string.
+            if (!JS_GetProperty(cx, funcObj, "name", &v))
+                return false;
+            if (!v.isString()) {
+                if (!JS_GetProperty(cx, funcObj, "usage", &v))
+                    return false;
+                if (!v.isString())
+                    continue;
+            }
+
+            size_t ignored = 0;
+            if (!JSString::ensureLinear(cx, v.toString()))
+                return false;
+            RootedLinearString input(cx, &v.toString()->asLinear());
+            if (!ExecuteRegExpLegacy(cx, nullptr, regex, input, &ignored, true, &v))
+                return false;
+            if (v.isNull())
+                continue;
         }
+
+        if (!PrintHelp(cx, funcObj))
+            return false;
     }
 
     return true;
@@ -6892,28 +6927,42 @@ Help(JSContext* cx, unsigned argc, Value* vp)
     }
 
     CallArgs args = CallArgsFromVp(argc, vp);
+    args.rval().setUndefined();
+    RootedObject global(cx, JS::CurrentGlobalOrNull(cx));
 
-    RootedObject obj(cx);
+    // help() - display the version and dump out help for all functions on the
+    // global.
     if (args.length() == 0) {
         fprintf(gOutFile->fp, "%s\n", JS_GetImplementationVersion());
 
-        RootedObject global(cx, JS::CurrentGlobalOrNull(cx));
-        if (!PrintEnumeratedHelp(cx, global, false))
+        if (!PrintEnumeratedHelp(cx, global, nullptr, false))
             return false;
-    } else {
-        for (unsigned i = 0; i < args.length(); i++) {
-            if (args[i].isPrimitive()) {
-                JS_ReportErrorASCII(cx, "primitive arg");
-                return false;
-            }
-            obj = args[i].toObjectOrNull();
-            if (!PrintHelp(cx, obj))
-                return false;
-        }
+        return true;
     }
 
-    args.rval().setUndefined();
-    return true;
+    RootedValue v(cx);
+
+    if (args[0].isPrimitive()) {
+        // help("foo")
+        JS_ReportErrorASCII(cx, "primitive arg");
+        return false;
+    }
+
+    RootedObject obj(cx, &args[0].toObject());
+    if (!obj)
+        return true;
+    bool isRegexp;
+    if (!JS_ObjectIsRegExp(cx, obj, &isRegexp))
+        return false;
+
+    if (isRegexp) {
+        // help(/pattern/)
+        return PrintEnumeratedHelp(cx, global, obj, false);
+    }
+
+    // help(function)
+    // help(namespace_obj)
+    return PrintHelp(cx, obj);
 }
 
 static const JSErrorFormatString jsShell_ErrorFormatString[JSShellErr_Limit] = {
diff --git a/js/src/shell/jsshell.cpp b/js/src/shell/jsshell.cpp
index b62a7ce8a87d..9038e7c7c339 100644
--- a/js/src/shell/jsshell.cpp
+++ b/js/src/shell/jsshell.cpp
@@ -8,6 +8,8 @@
 
 #include "shell/jsshell.h"
 
+#include "mozilla/Sprintf.h"
+
 #include "jsapi.h"
 #include "jsfriendapi.h"
 
@@ -38,14 +40,7 @@ GenerateInterfaceHelp(JSContext* cx, HandleObject obj, const char* name)
         return false;
 
     StringBuffer buf(cx);
-    if (!buf.append(name, strlen(name)) || !buf.append(" - interface object", 19))
-        return false;
-    RootedString s(cx, buf.finishString());
-    if (!s || !JS_DefineProperty(cx, obj, "usage", s, 0))
-        return false;
-    buf.clear();
-
-    bool first = true;
+    int numEntries = 0;
     for (size_t i = 0; i < idv.length(); i++) {
         RootedId id(cx, idv[i]);
         RootedValue v(cx);
@@ -64,9 +59,9 @@ GenerateInterfaceHelp(JSContext* cx, HandleObject obj, const char* name)
         if (!usage.isString() && !help.isString())
             continue;
 
-        if (!first && !buf.append("\n"))
+        if (numEntries && !buf.append("\n"))
             return false;
-        first = false;
+        numEntries++;
 
         if (!buf.append("  ", 2))
             return false;
@@ -75,10 +70,21 @@ GenerateInterfaceHelp(JSContext* cx, HandleObject obj, const char* name)
             return false;
     }
 
-    s = buf.finishString();
+    RootedString s(cx, buf.finishString());
     if (!s || !JS_DefineProperty(cx, obj, "help", s, 0))
         return false;
 
+    buf.clear();
+    if (!buf.append(name, strlen(name)) || !buf.append(" - interface object with ", 25))
+        return false;
+    char cbuf[100];
+    SprintfLiteral(cbuf, "%d %s", numEntries, numEntries == 1 ? "entry" : "entries");
+    if (!buf.append(cbuf, strlen(cbuf)))
+        return false;
+    s = buf.finishString();
+    if (!s || !JS_DefineProperty(cx, obj, "usage", s, 0))
+        return false;
+
     return true;
 }
 

From 2e41783ce179c0e628fd4f3ae5025c8535f19f7f Mon Sep 17 00:00:00 2001
From: Andrea Marchesini <amarchesini@mozilla.com>
Date: Tue, 19 Sep 2017 19:46:40 +0200
Subject: [PATCH 76/83] Bug 1401156 - Cleanup ini files for WPT FileAPI, r=qdot

---
 .../meta/FileAPI/idlharness.html.ini          | 21 ---------
 .../meta/FileAPI/idlharness.worker.js.ini     | 44 -------------------
 .../url/url_createobjecturl_blob.html.ini     |  5 ---
 3 files changed, 70 deletions(-)
 delete mode 100644 testing/web-platform/meta/FileAPI/url/url_createobjecturl_blob.html.ini

diff --git a/testing/web-platform/meta/FileAPI/idlharness.html.ini b/testing/web-platform/meta/FileAPI/idlharness.html.ini
index 043beae786e7..922e19ff83b6 100644
--- a/testing/web-platform/meta/FileAPI/idlharness.html.ini
+++ b/testing/web-platform/meta/FileAPI/idlharness.html.ini
@@ -1,26 +1,5 @@
 [idlharness.html]
   type: testharness
-  [URL interface: operation createFor(Blob)]
-    expected: FAIL
-
-  [Blob interface: attribute isClosed]
-    expected: FAIL
-
-  [Blob interface: operation close()]
-    expected: FAIL
-
-  [Blob interface: new Blob(["TEST"\]) must inherit property "isClosed" with the proper type (2)]
-    expected: FAIL
-
-  [Blob interface: new Blob(["TEST"\]) must inherit property "close" with the proper type (4)]
-    expected: FAIL
-
-  [Blob interface: new File(["myFileBits"\], "myFileName") must inherit property "isClosed" with the proper type (2)]
-    expected: FAIL
-
-  [Blob interface: new File(["myFileBits"\], "myFileName") must inherit property "close" with the proper type (4)]
-    expected: FAIL
-
   [FileReaderSync interface object length]
     expected: FAIL
 
diff --git a/testing/web-platform/meta/FileAPI/idlharness.worker.js.ini b/testing/web-platform/meta/FileAPI/idlharness.worker.js.ini
index cdbf6cf9407c..901f4d273382 100644
--- a/testing/web-platform/meta/FileAPI/idlharness.worker.js.ini
+++ b/testing/web-platform/meta/FileAPI/idlharness.worker.js.ini
@@ -1,26 +1,4 @@
 [idlharness.worker]
-  type: testharness
-  [URL interface: operation createFor(Blob)]
-    expected: FAIL
-
-  [Blob interface: attribute isClosed]
-    expected: FAIL
-
-  [Blob interface: operation close()]
-    expected: FAIL
-
-  [Blob interface: new Blob(["TEST"\]) must inherit property "isClosed" with the proper type (2)]
-    expected: FAIL
-
-  [Blob interface: new Blob(["TEST"\]) must inherit property "close" with the proper type (4)]
-    expected: FAIL
-
-  [Blob interface: new File(["myFileBits"\], "myFileName") must inherit property "isClosed" with the proper type (2)]
-    expected: FAIL
-
-  [Blob interface: new File(["myFileBits"\], "myFileName") must inherit property "close" with the proper type (4)]
-    expected: FAIL
-
   [ArrayBuffer interface: existence and properties of interface object]
     expected: FAIL
 
@@ -39,30 +17,8 @@
   [ArrayBuffer interface: existence and properties of interface object]
     expected: FAIL
 
-  [URL interface: operation createFor(Blob)]
-    expected: FAIL
-
   [EventTarget interface: existence and properties of interface object]
     expected: FAIL
 
   [Event interface: existence and properties of interface object]
     expected: FAIL
-
-  [Blob interface: attribute isClosed]
-    expected: FAIL
-
-  [Blob interface: operation close()]
-    expected: FAIL
-
-  [Blob interface: new Blob(["TEST"\]) must inherit property "isClosed" with the proper type (2)]
-    expected: FAIL
-
-  [Blob interface: new Blob(["TEST"\]) must inherit property "close" with the proper type (4)]
-    expected: FAIL
-
-  [Blob interface: new File(["myFileBits"\], "myFileName") must inherit property "isClosed" with the proper type (2)]
-    expected: FAIL
-
-  [Blob interface: new File(["myFileBits"\], "myFileName") must inherit property "close" with the proper type (4)]
-    expected: FAIL
-
diff --git a/testing/web-platform/meta/FileAPI/url/url_createobjecturl_blob.html.ini b/testing/web-platform/meta/FileAPI/url/url_createobjecturl_blob.html.ini
deleted file mode 100644
index 92400cd1d652..000000000000
--- a/testing/web-platform/meta/FileAPI/url/url_createobjecturl_blob.html.ini
+++ /dev/null
@@ -1,5 +0,0 @@
-[url_createobjecturl_blob.html]
-  type: testharness
-  [Check if the Blob URI starts with 'blob' using createFor()]
-    expected: FAIL
-

From 2b102d3c56f29ce47144226f762e9637967956bd Mon Sep 17 00:00:00 2001
From: Tobias Schneider <schneider@jancona.com>
Date: Tue, 19 Sep 2017 10:50:10 -0700
Subject: [PATCH 77/83] Bug 1399605 - [intersection-observer] Check if target
 is actually being observed when unobserving. r=mrbkap

--HG--
extra : rebase_source : d3c8c012dba2941b230cdfbf332ab3c77b7a26ef
---
 dom/base/DOMIntersectionObserver.cpp |  4 ++++
 dom/base/test/mochitest.ini          |  1 +
 dom/base/test/test_bug1399605.html   | 31 ++++++++++++++++++++++++++++
 3 files changed, 36 insertions(+)
 create mode 100644 dom/base/test/test_bug1399605.html

diff --git a/dom/base/DOMIntersectionObserver.cpp b/dom/base/DOMIntersectionObserver.cpp
index 0299cefe4507..606a1de5ed8c 100644
--- a/dom/base/DOMIntersectionObserver.cpp
+++ b/dom/base/DOMIntersectionObserver.cpp
@@ -161,6 +161,10 @@ DOMIntersectionObserver::Observe(Element& aTarget)
 void
 DOMIntersectionObserver::Unobserve(Element& aTarget)
 {
+  if (!mObservationTargets.Contains(&aTarget)) {
+    return;
+  }
+
   if (mObservationTargets.Length() == 1) {
     Disconnect();
     return;
diff --git a/dom/base/test/mochitest.ini b/dom/base/test/mochitest.ini
index cc0baeddb7a5..bb6640465339 100644
--- a/dom/base/test/mochitest.ini
+++ b/dom/base/test/mochitest.ini
@@ -623,6 +623,7 @@ skip-if = toolkit == 'android'
 [test_bug1375050.html]
 [test_bug1381710.html]
 [test_bug1384658.html]
+[test_bug1399605.html]
 skip-if = toolkit == 'android'
 [test_caretPositionFromPoint.html]
 [test_change_policy.html]
diff --git a/dom/base/test/test_bug1399605.html b/dom/base/test/test_bug1399605.html
new file mode 100644
index 000000000000..ae7f119061a6
--- /dev/null
+++ b/dom/base/test/test_bug1399605.html
@@ -0,0 +1,31 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 1399605</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1399605">Mozilla Bug 1399605</a>
+<p id="display"></p>
+<div id="content">
+  <div id="target"></div>
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+  let observer = new IntersectionObserver(function() {
+    ok(true, "we are still observing");
+    SimpleTest.finish();
+  });
+  observer.observe(document.getElementById('target'));
+  observer.unobserve(document.getElementById('content'));
+  SimpleTest.waitForExplicitFinish();
+
+</script>
+</pre>
+<div id="log">
+</div>
+</body>
+</html>

From d017b0874eac0358e88d2a557a01fcb3facc7db9 Mon Sep 17 00:00:00 2001
From: Nick Alexander <nalexander@mozilla.com>
Date: Mon, 18 Sep 2017 15:38:22 -0400
Subject: [PATCH 78/83] Bug 1396098 - part 1 - base `android-build` on Debian
 instead of CentOS; r=glandium,dustin

CentOS 6 is pinned to glibc 2.12, but newer Android build-tools (like
aapt) require glibc 2.14.  It's not possible to safely upgrade CentOS
6 distributions to glibc 2.14.

CentOS 7 is pinned to glibc 2.17, which is new enough for newer
Android build-tools. However, I had great difficulty bringing forward
our existing centos:6 Docker image to centos:7.  In particular,
installing recent enough Mercurial, git, Python, and pip versions was
difficult enough that I elected to not pursue this approach.

Instead, I've elected to follow glandium's suggestion from
https://bugzilla.mozilla.org/show_bug.cgi?id=1370119#c5: base on
Debian with snapshots.debian.org for reproducibility.

The most significant changes here:

- using Debian's snapshots repository
- using Python and related tools provided by Debian and baked into the
  build image
- using the JDK and JRE provided by Debian and baked into the build
  image, rather than versions from tooltool (or eventually a toolchain
  build)

Moving the builds over to use this image will follow in the patches
ahead.
---
 taskcluster/docker/android-build/Dockerfile   | 153 ++++++++++++------
 .../docker/android-build/buildprops.json      |   9 --
 taskcluster/docker/android-build/oauth.txt    |   2 -
 taskcluster/docker/android-build/sources.list |   3 +
 .../recipes/debian-build-system-setup.sh      |  11 ++
 .../docker/recipes/install-mercurial.sh       |  17 ++
 .../build-android-dependencies/after.sh       |  11 +-
 .../build-android-dependencies/before.sh      |  23 ++-
 8 files changed, 144 insertions(+), 85 deletions(-)
 delete mode 100644 taskcluster/docker/android-build/buildprops.json
 delete mode 100644 taskcluster/docker/android-build/oauth.txt
 create mode 100644 taskcluster/docker/android-build/sources.list
 create mode 100644 taskcluster/docker/recipes/debian-build-system-setup.sh
 mode change 100644 => 100755 taskcluster/docker/recipes/install-mercurial.sh
 mode change 100644 => 100755 taskcluster/scripts/builder/build-android-dependencies/after.sh
 mode change 100644 => 100755 taskcluster/scripts/builder/build-android-dependencies/before.sh

diff --git a/taskcluster/docker/android-build/Dockerfile b/taskcluster/docker/android-build/Dockerfile
index c3da2ad9e9ba..c5a9a24e2b19 100644
--- a/taskcluster/docker/android-build/Dockerfile
+++ b/taskcluster/docker/android-build/Dockerfile
@@ -1,18 +1,90 @@
-# TODO remove VOLUME below when the base image is updated next.
-FROM          taskcluster/centos6-build-upd:0.1.8.20170808150401
-MAINTAINER    Nick Alexander <nalexander@mozilla.com>
+FROM debian:stretch-20170620
+MAINTAINER Nick Alexander <nalexander@mozilla.com>
 
-# BEGIN ../desktop-build/Dockerfile
+### Add worker user and setup its workspace.
+RUN mkdir -p /builds && \
+    groupadd -g 500 worker && \
+    useradd -u 500 -g 500 -d /builds/worker -s /bin/bash -m worker && \
+    chown -R worker:worker /builds && \
+    mkdir -p /builds/worker/workspace && \
+    chown -R worker:worker /builds/worker/workspace
+
+# Declare default working folder
+WORKDIR /builds/worker
 
 VOLUME /builds/worker/checkouts
 VOLUME /builds/worker/workspace
 VOLUME /builds/worker/tooltool-cache
 
+# Add build scripts; these are the entry points from the taskcluster worker, and
+# operate on environment variables
+# %include taskcluster/docker/desktop-build/bin/
+COPY topsrcdir/taskcluster/docker/desktop-build/bin/ /builds/worker/bin/
+RUN chmod +x /builds/worker/bin/*
+
+# Add common hg configuration.
+# %include taskcluster/docker/centos6-build/hgrc
+COPY topsrcdir/taskcluster/docker/centos6-build/hgrc /builds/worker/.hgrc
+RUN chown worker:worker /builds/worker/.hgrc
+
+# Set variables normally configured at login, by the shell' parent process,
+# these are taken from GNU su manual.  Also set DEBIAN_FRONTEND to advise
+# apt-get of our situation.
+ENV HOME=/builds/worker \
+    SHELL=/bin/bash \
+    USER=worker \
+    LOGNAME=worker \
+    HOSTNAME=taskcluster-worker \
+    DEBIAN_FRONTEND=noninteractive
+
+# Set a default command useful for debugging.
+CMD ["/bin/bash", "--login"]
+
+# Set apt sources list to a snapshot.
+COPY sources.list /etc/apt/
+
+# We need i386 packages for the Android SDK.
+# Once https://bugzilla.mozilla.org/show_bug.cgi?id=1370119 is in-tree, we
+# will have 64-bit builds of everything, and we can then remove this and
+# the :i386 packages we install below.
+RUN dpkg --add-architecture i386
+
+RUN apt-get update -q && \
+    apt-get install -yyq --no-install-recommends \
+      autoconf2.13 \
+      build-essential \
+      base-files \
+      ca-certificates \
+      ccache \
+      cmake \
+      curl \
+      file \
+      gnupg \
+      make \
+      procps \
+      python \
+      python-cryptography \
+      python-dev \
+      python-pip \
+      python-setuptools \
+      python-virtualenv \
+      sudo \
+      tar \
+      unzip \
+      uuid \
+      wget \
+      xz-utils \
+      yasm \
+      zip \
+      libstdc++6:i386 \
+      libgcc1:i386 \
+      zlib1g:i386 \
+      libncurses5:i386 \
+    && \
+    apt-get clean
+
 # %include python/mozbuild/mozbuild/action/tooltool.py
-COPY topsrcdir/python/mozbuild/mozbuild/action/tooltool.py /build/tooltool.py
-COPY topsrcdir/python/mozbuild/mozbuild/action/tooltool.py /builds/tooltool.py
 COPY topsrcdir/python/mozbuild/mozbuild/action/tooltool.py /setup/tooltool.py
-COPY topsrcdir/python/mozbuild/mozbuild/action/tooltool.py /tmp/tooltool.py
 
 # %include testing/mozharness/external_tools/robustcheckout.py
 COPY topsrcdir/testing/mozharness/external_tools/robustcheckout.py /usr/local/mercurial/robustcheckout.py
@@ -29,70 +101,52 @@ COPY topsrcdir/taskcluster/docker/recipes/install-make.sh /setup/install-make.sh
 # %include taskcluster/docker/recipes/install-cmake.sh
 COPY topsrcdir/taskcluster/docker/recipes/install-cmake.sh /setup/install-cmake.sh
 
-# %include taskcluster/docker/recipes/centos6-build-system-setup.sh
-COPY topsrcdir/taskcluster/docker/recipes/centos6-build-system-setup.sh /setup/system-setup.sh
-
-# %include taskcluster/docker/recipes/centos-install-debug-symbols.sh
-COPY topsrcdir/taskcluster/docker/recipes/centos-install-debug-symbols.sh /setup/install-debug-symbols.sh
-
-# TODO remove once base image doesn't install Mercurial
-RUN pip uninstall -y Mercurial
+# %include taskcluster/docker/recipes/debian-build-system-setup.sh
+COPY topsrcdir/taskcluster/docker/recipes/debian-build-system-setup.sh /setup/system-setup.sh
 
 RUN bash /setup/system-setup.sh
 
-# Add wrapper scripts for xvfb allowing tasks to easily retry starting up xvfb
+# Add wrapper scripts for xvfb allowing tasks to easily retry starting up xvfb.
 # %include taskcluster/docker/recipes/xvfb.sh
 COPY topsrcdir/taskcluster/docker/recipes/xvfb.sh /builds/worker/scripts/xvfb.sh
 
 # %include taskcluster/docker/recipes/run-task
 COPY topsrcdir/taskcluster/docker/recipes/run-task /builds/worker/bin/run-task
 
-# Add configuration
-COPY            dot-config                    /builds/worker/.config
-
-# Generate machine uuid file
-RUN dbus-uuidgen --ensure=/var/lib/dbus/machine-id
+# Add pip configuration, among other things.
+COPY dot-config /builds/worker/.config
 
 # Stubbed out credentials; mozharness looks for this file an issues a WARNING
 # if it's not found, which causes the build to fail.  Note that this needs to
 # be in the parent of the workspace directory and in the directory where
 # mozharness is run (not its --work-dir).  See Bug 1169652.
-ADD           oauth.txt /builds/worker/
+# %include taskcluster/docker/desktop-build/oauth.txt
+COPY topsrcdir/taskcluster/docker/desktop-build/oauth.txt /builds/worker/
 
-# stubbed out buildprops, which keeps mozharness from choking
+# Add a stubbed out buildprops, which keeps mozharness from choking.
 # Note that this needs to be in the parent of the workspace directory and in
-# the directory where mozharness is run (not its --work-dir)
-ADD           buildprops.json /builds/worker/
-
-# END ../desktop-build/Dockerfile
+# the directory where mozharness is run (not its --work-dir).
+# %include taskcluster/docker/desktop-build/buildprops.json
+COPY topsrcdir/taskcluster/docker/desktop-build/buildprops.json /builds/worker/
 
 # Reset user/workdir from parent image so we can install software.
 WORKDIR /
 USER root
 
-# Update base.
-RUN rpm --rebuilddb && yum upgrade -y
-
 # Install Sonatype Nexus.  Cribbed directly from
 # https://github.com/sonatype/docker-nexus/blob/fffd2c61b2368292040910c055cf690c8e76a272/oss/Dockerfile.
 
-# Install the screen package here to use with xvfb.
-# Move installation to base centos6-build image once Bug 1272629 is fixed
-# tzdata-java is symlinked from the JRE: see https://bugzilla.redhat.com/show_bug.cgi?id=1130800
-RUN rpm --rebuilddb && yum install -y \
-  createrepo \
-  curl \
-  screen \
-  sudo \
-  tar \
-  tzdata-java \
-  unzip \
-  wget \
-  zip \
-  && yum clean all
+# Observe missing --no-install-recommends, in order to install glib2.0/gconf/etc.
+RUN apt-get install -yyq \
+      libgconf2-4 \
+      libgnome2-0 \
+      openjdk-8-jdk-headless \
+    && \
+    apt-get clean
 
-ENV NEXUS_VERSION 2.12.0-01
-ENV NEXUS_SHA1SUM 1a9aaad8414baffe0a2fd46eed1f41b85f4049e6
+ENV NEXUS_VERSION=2.12.0-01 \
+    NEXUS_SHA1SUM=1a9aaad8414baffe0a2fd46eed1f41b85f4049e6 \
+    NEXUS_WORK=/builds/worker/workspace/nexus
 
 RUN mkdir -p /opt/sonatype/nexus
 
@@ -111,10 +165,7 @@ RUN tar zxf nexus-${NEXUS_VERSION}-bundle.tar.gz \
   && rm -rf /tmp/nexus-${NEXUS_VERSION}-bundle.tar.gz
 
 # So that we don't have to RUN_AS_USER=root.
-RUN chown -R worker:worker /opt/sonatype/nexus/
+RUN chown -R worker:worker /opt/sonatype
 
-# Back to the centos6-build workdir, matching desktop-build.
+# Back to the workdir, matching desktop-build.
 WORKDIR /builds/worker
-
-# Set a default command useful for debugging
-CMD ["/bin/bash", "--login"]
diff --git a/taskcluster/docker/android-build/buildprops.json b/taskcluster/docker/android-build/buildprops.json
deleted file mode 100644
index f38b7d788e0b..000000000000
--- a/taskcluster/docker/android-build/buildprops.json
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-  "properties": {
-    "buildername": ""
-  },
-  "sourcestamp": {
-    "changes": []
-  },
-  "comments": "TaskCluster Job"
-}
diff --git a/taskcluster/docker/android-build/oauth.txt b/taskcluster/docker/android-build/oauth.txt
deleted file mode 100644
index e56c71f577cc..000000000000
--- a/taskcluster/docker/android-build/oauth.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-taskcluster_clientId = None
-taskcluster_accessToken = None
diff --git a/taskcluster/docker/android-build/sources.list b/taskcluster/docker/android-build/sources.list
new file mode 100644
index 000000000000..41987f8e8dc5
--- /dev/null
+++ b/taskcluster/docker/android-build/sources.list
@@ -0,0 +1,3 @@
+deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/20170830T000511Z/ stretch main
+deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/20170830T000511Z/ stretch-updates main
+deb [check-valid-until=no] http://snapshot.debian.org/archive/debian-security/20170830T000511Z/ stretch/updates main
diff --git a/taskcluster/docker/recipes/debian-build-system-setup.sh b/taskcluster/docker/recipes/debian-build-system-setup.sh
new file mode 100644
index 000000000000..bf1d2c78aed0
--- /dev/null
+++ b/taskcluster/docker/recipes/debian-build-system-setup.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+cd /setup
+
+. /setup/common.sh
+. /setup/install-mercurial.sh
+
+rm -rf /setup
diff --git a/taskcluster/docker/recipes/install-mercurial.sh b/taskcluster/docker/recipes/install-mercurial.sh
old mode 100644
new mode 100755
index 0c977225caff..5b5d55dbded1
--- a/taskcluster/docker/recipes/install-mercurial.sh
+++ b/taskcluster/docker/recipes/install-mercurial.sh
@@ -27,6 +27,23 @@ if [ -f /etc/lsb-release ]; then
 
     CERT_PATH=/etc/ssl/certs/ca-certificates.crt
 
+elif [ -f /etc/os-release ]; then
+    . /etc/os-release
+
+    if [ "${ID}" = "debian" -a "${VERSION_ID}" = "9" ]; then
+        if [ -f /usr/bin/pip2 ]; then
+            PIP_PATH=/usr/bin/pip2
+        else
+            echo "We currently require Python 2.7 and /usr/bin/pip2 to run Mercurial"
+            exit 1
+        fi
+    else
+        echo "Unsupported debian-like system with ID '${ID}' and VERSION_ID '${VERSION_ID}'"
+        exit 1
+    fi
+
+    CERT_PATH=/etc/ssl/certs/ca-certificates.crt
+
 elif [ -f /etc/centos-release ]; then
     CENTOS_VERSION=`rpm -q --queryformat '%{VERSION}' centos-release`
     if [ "${CENTOS_VERSION}" = "6" ]; then
diff --git a/taskcluster/scripts/builder/build-android-dependencies/after.sh b/taskcluster/scripts/builder/build-android-dependencies/after.sh
old mode 100644
new mode 100755
index b11a2590d520..16e218c190d4
--- a/taskcluster/scripts/builder/build-android-dependencies/after.sh
+++ b/taskcluster/scripts/builder/build-android-dependencies/after.sh
@@ -19,17 +19,10 @@ tar cJf android-sdk-linux.tar.xz android-sdk-linux
 mkdir -p /builds/worker/private/android-sdk
 mv android-sdk-linux.tar.xz /builds/worker/private/android-sdk
 
-cp -R $WORKSPACE/build/src/java_home java_home
-tar cJf java_home.tar.xz java_home
-
-# We can't redistribute Java publicly.
-mkdir -p /builds/worker/private/java_home
-mv java_home.tar.xz /builds/worker/private/java_home
-
-cp -R $WORKSPACE/nexus/storage/jcenter jcenter
+cp -R ${NEXUS_WORK}/storage/jcenter jcenter
 tar cJf jcenter.tar.xz jcenter
 
-cp -R $WORKSPACE/nexus/storage/google google
+cp -R ${NEXUS_WORK}/storage/google google
 tar cJf google.tar.xz google
 
 # The Gradle wrapper will have downloaded and verified the hash of exactly one
diff --git a/taskcluster/scripts/builder/build-android-dependencies/before.sh b/taskcluster/scripts/builder/build-android-dependencies/before.sh
old mode 100644
new mode 100755
index 46df2a437a18..79942ffdbb9f
--- a/taskcluster/scripts/builder/build-android-dependencies/before.sh
+++ b/taskcluster/scripts/builder/build-android-dependencies/before.sh
@@ -8,21 +8,10 @@ echo "running as" $(id)
 
 set -v
 
-mkdir -p ${WORKSPACE}/nexus/conf
-cp /builds/worker/workspace/build/src/taskcluster/scripts/builder/build-android-dependencies/nexus.xml ${WORKSPACE}/nexus/conf/nexus.xml
+mkdir -p ${NEXUS_WORK}/conf
+cp /builds/worker/workspace/build/src/taskcluster/scripts/builder/build-android-dependencies/nexus.xml ${NEXUS_WORK}/conf/nexus.xml
 
-# Populate /builds/worker/workspace/build/src/java_home.
-. $WORKSPACE/build/src/taskcluster/scripts/builder/build-android-dependencies/repackage-jdk-centos.sh
-
-mv $WORKSPACE/java/usr/lib/jvm/java_home $WORKSPACE/build/src/java_home
-
-export JAVA_HOME=$WORKSPACE/build/src/java_home
-export PATH=$PATH:$JAVA_HOME/bin
-
-# Populate /builds/worker/.mozbuild/android-sdk-linux.
-python2.7 $WORKSPACE/build/src/python/mozboot/mozboot/android.py --artifact-mode --no-interactive
-
-RUN_AS_USER=worker NEXUS_WORK=$WORKSPACE/nexus /opt/sonatype/nexus/bin/nexus restart
+RUN_AS_USER=worker /opt/sonatype/nexus/bin/nexus restart
 
 # Wait "a while" for Nexus to actually start.  Don't fail if this fails.
 wget --quiet --retry-connrefused --waitretry=2 --tries=100 \
@@ -34,3 +23,9 @@ curl http://localhost:8081/nexus/service/local/status || true
 
 # Verify Nexus has actually started.  Fail if this fails.
 curl --fail --silent --location http://localhost:8081/nexus/service/local/status | grep '<state>STARTED</state>'
+
+# It's helpful when debugging to see the repository configurations.
+curl http://localhost:8081/nexus/service/local/repositories || true
+
+# Populate /builds/worker/.mozbuild/android-sdk-linux.
+python2.7 /builds/worker/workspace/build/src/python/mozboot/mozboot/android.py --artifact-mode --no-interactive

From 1a9b063e961c1651f56519d8d72f9a03ec2fac84 Mon Sep 17 00:00:00 2001
From: Nathan Froyd <froydnj@mozilla.com>
Date: Fri, 15 Sep 2017 15:31:16 -0400
Subject: [PATCH 79/83] Bug 1396098 - part 2 - make android-* fire off of
 mozconfig changes; r=nalexander

This seems like the obvious thing to want to happen.
---
 taskcluster/ci/build/android-stuff.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/taskcluster/ci/build/android-stuff.yml b/taskcluster/ci/build/android-stuff.yml
index c415f852f0df..6bbe7eb0e933 100644
--- a/taskcluster/ci/build/android-stuff.yml
+++ b/taskcluster/ci/build/android-stuff.yml
@@ -85,6 +85,7 @@ android-test/opt:
     optimizations:
       - - skip-unless-changed
         - - "mobile/android/base/**"
+          - "mobile/android/config/**"
           - "mobile/android/tests/background/junit4/**"
           - "**/*.gradle"
 
@@ -148,6 +149,7 @@ android-lint/opt:
           - "mobile/android/**/*.svg"
           - "mobile/android/**/*.xml" # Manifest & android resources
           - "mobile/android/**/Makefile.in"
+          - "mobile/android/config/**"
           - "mobile/android/**/moz.build"
           - "**/*.gradle"
 
@@ -195,6 +197,7 @@ android-checkstyle/opt:
         - - "mobile/android/**/checkstyle.xml"
           - "mobile/android/**/*.java"
           - "mobile/android/**/Makefile.in"
+          - "mobile/android/config/**"
           - "mobile/android/**/moz.build"
           - "**/*.gradle"
 
@@ -247,5 +250,6 @@ android-findbugs/opt:
       - - skip-unless-changed
         - - "mobile/android/**/*.java"
           - "mobile/android/**/Makefile.in"
+          - "mobile/android/config/**"
           - "mobile/android/**/moz.build"
           - "**/*.gradle"

From d0cd12af04243d3a066a4571171402f72530cbaa Mon Sep 17 00:00:00 2001
From: Nathan Froyd <froydnj@mozilla.com>
Date: Fri, 15 Sep 2017 15:31:16 -0400
Subject: [PATCH 80/83] Bug 1396098 - part 3 - move android builds to new
 docker image; r=glandium

Now that we have a Docker image with newer library versions on it, we
can move our builds over.  The new images differ from the old
CentOS-based images in two important ways, though:

1) The system compilers in the new image are new enough to be used as
   host compilers; additionally, our CentOS-built GCC compilers will not
   work.  We need to change the Android mozconfigs to reflect that.  We
   also need to change the Android tasks to not depend on the GCC
   toolchain builds.

2) In a similar fashion, we can use the system JDK; we no longer need to
   use the JDK from the Android NDK, which we had packaged up via the
   Android dependencies task.

Both of these changes come with caveats: our l10n repack jobs continue
to run on the CentOS-based images; l10n repacks have not been completely
converted to Taskcluster.  So we need to:

1) Retain the use of our custom GCC toolchain for HOST_CC/HOST_CXX on
   the CentOS-based images.

2) Retain the JDK packages in the tooltool manifests, and referencing
   them when we build on the CentOS-based images.
---
 mobile/android/config/mozconfigs/common | 25 ++++++++++++++-----------
 taskcluster/ci/build/android-stuff.yml  |  8 ++++----
 taskcluster/ci/build/android.yml        | 24 ++++++++++++------------
 3 files changed, 30 insertions(+), 27 deletions(-)

diff --git a/mobile/android/config/mozconfigs/common b/mobile/android/config/mozconfigs/common
index 7a7e428690d8..cc473ed21307 100644
--- a/mobile/android/config/mozconfigs/common
+++ b/mobile/android/config/mozconfigs/common
@@ -10,19 +10,27 @@ fi
 MOZ_AUTOMATION_L10N_CHECK=0
 . "$topsrcdir/build/mozconfig.common"
 
-# In TaskCluster, the Java JRE/JDK are installed from tooltool, but that
-# install doesn't work on the old Buildbot mock builders (CentOS 6.2), so
-# the relevant env vars are not set up in that case, leaving the build to
-# run from the JRE/JDK in /usr/lib/jvm.
-if [ ! -f /etc/redhat-release ] || [ "$(< /etc/redhat-release)" != "CentOS release 6.2 (Final)" ]; then
+# For actual Android builds in TaskCluster, the system image is Debian,
+# and we use the Java JRE/JDK from the system, as well as the system
+# GCC for the host compiler.  l10n builds are still special, however:
+# they are run on older CentOS systems, and l10n builds on release are
+# still run on Buildbot.  So we have to set things up so this mozconfig
+# works in all cases.
+if [ -f /etc/debian_version ]; then
+    # We're on Debian, there's nothing to do.
+    true
+elif [ ! -f /etc/redhat-release ] || [ "$(< /etc/redhat-release)" != "CentOS release 6.2 (Final)" ]; then
     # set JAVA_HOME to find the JRE/JDK from tooltool.  Several scripts in the JDK
     # assume `java` is in PATH, so set that too.  To see how this tarball is built,
-    # see taskcluster/scripts/misc/repackage-jdk.sh
+    # see taskcluster/scripts/builder/build-android-dependencies/repackage-jdk-centos.sh
     export JAVA_HOME="$topsrcdir/java_home"
     export PATH="$PATH:$topsrcdir/java_home/bin"
 
     mk_add_options "export JAVA_HOME=$topsrcdir/java_home"
     mk_add_options "export PATH=$PATH:$topsrcdir/java_home/bin"
+
+    HOST_CC="$topsrcdir/gcc/bin/gcc"
+    HOST_CXX="$topsrcdir/gcc/bin/g++"
 fi
 
 ac_add_options --enable-elf-hack
@@ -98,11 +106,6 @@ export SOCORRO_SYMBOL_UPLOAD_TOKEN_FILE=/builds/crash-stats-api.token
 # Package js shell.
 export MOZ_PACKAGE_JSSHELL=1
 
-# Use ccache
-
-HOST_CC="$topsrcdir/gcc/bin/gcc"
-HOST_CXX="$topsrcdir/gcc/bin/g++"
-
 . "$topsrcdir/build/unix/mozconfig.stdcxx"
 
 # Use libc++ as our C++ standard library
diff --git a/taskcluster/ci/build/android-stuff.yml b/taskcluster/ci/build/android-stuff.yml
index 6bbe7eb0e933..473239c51cf5 100644
--- a/taskcluster/ci/build/android-stuff.yml
+++ b/taskcluster/ci/build/android-stuff.yml
@@ -58,7 +58,7 @@ android-test/opt:
         symbol: tc(test)
     worker-type: aws-provisioner-v1/gecko-{level}-b-android
     worker:
-        docker-image: {in-tree: desktop-build}
+        docker-image: {in-tree: android-build}
         env:
             GRADLE_USER_HOME: "/builds/worker/workspace/build/src/dotgradle"
             PERFHERDER_EXTRA_OPTIONS: android-test
@@ -101,7 +101,7 @@ android-lint/opt:
         symbol: tc(lint)
     worker-type: aws-provisioner-v1/gecko-{level}-b-android
     worker:
-        docker-image: {in-tree: desktop-build}
+        docker-image: {in-tree: android-build}
         env:
             GRADLE_USER_HOME: "/builds/worker/workspace/build/src/dotgradle"
             PERFHERDER_EXTRA_OPTIONS: android-lint
@@ -165,7 +165,7 @@ android-checkstyle/opt:
         symbol: tc(checkstyle)
     worker-type: aws-provisioner-v1/gecko-{level}-b-android
     worker:
-        docker-image: {in-tree: desktop-build}
+        docker-image: {in-tree: android-build}
         env:
             GRADLE_USER_HOME: "/builds/worker/workspace/build/src/dotgradle"
             PERFHERDER_EXTRA_OPTIONS: android-checkstyle
@@ -213,7 +213,7 @@ android-findbugs/opt:
         symbol: tc(findbugs)
     worker-type: aws-provisioner-v1/gecko-{level}-b-android
     worker:
-        docker-image: {in-tree: desktop-build}
+        docker-image: {in-tree: android-build}
         env:
             GRADLE_USER_HOME: "/builds/worker/workspace/build/src/dotgradle"
             PERFHERDER_EXTRA_OPTIONS: android-findbugs
diff --git a/taskcluster/ci/build/android.yml b/taskcluster/ci/build/android.yml
index 7540cca2d4f1..a684ea6360a4 100644
--- a/taskcluster/ci/build/android.yml
+++ b/taskcluster/ci/build/android.yml
@@ -8,6 +8,7 @@ android-api-16/debug:
         symbol: tc(B)
     worker-type: aws-provisioner-v1/gecko-{level}-b-android
     worker:
+        docker-image: {in-tree: android-build}
         max-run-time: 7200
         env:
             TOOLTOOL_MANIFEST: "mobile/android/config/tooltool-manifests/android/releng.manifest"
@@ -23,7 +24,6 @@ android-api-16/debug:
         custom-build-variant-cfg: api-16-debug
         tooltool-downloads: internal
     toolchains:
-        - linux64-gcc
         - linux64-sccache
 
 android-x86/opt:
@@ -36,6 +36,7 @@ android-x86/opt:
         symbol: tc(B)
     worker-type: aws-provisioner-v1/gecko-{level}-b-android
     worker:
+        docker-image: {in-tree: android-build}
         max-run-time: 7200
         env:
             TOOLTOOL_MANIFEST: "mobile/android/config/tooltool-manifests/android-x86/releng.manifest"
@@ -51,7 +52,6 @@ android-x86/opt:
         custom-build-variant-cfg: x86
         tooltool-downloads: internal
     toolchains:
-        - linux64-gcc
         - linux64-sccache
 
 android-x86-nightly/opt:
@@ -67,6 +67,7 @@ android-x86-nightly/opt:
         symbol: tc(N)
     worker-type: aws-provisioner-v1/gecko-{level}-b-android
     worker:
+        docker-image: {in-tree: android-build}
         max-run-time: 7200
         env:
             TOOLTOOL_MANIFEST: "mobile/android/config/tooltool-manifests/android-x86/releng.manifest"
@@ -83,7 +84,6 @@ android-x86-nightly/opt:
         custom-build-variant-cfg: x86
         tooltool-downloads: internal
     toolchains:
-        - linux64-gcc
         - linux64-sccache
 
 android-api-16/opt:
@@ -96,6 +96,7 @@ android-api-16/opt:
         symbol: tc(B)
     worker-type: aws-provisioner-v1/gecko-{level}-b-android
     worker:
+        docker-image: {in-tree: android-build}
         max-run-time: 7200
         env:
             TOOLTOOL_MANIFEST: "mobile/android/config/tooltool-manifests/android/releng.manifest"
@@ -111,7 +112,6 @@ android-api-16/opt:
         custom-build-variant-cfg: api-16
         tooltool-downloads: internal
     toolchains:
-        - linux64-gcc
         - linux64-sccache
 
 android-api-16-nightly/opt:
@@ -127,6 +127,7 @@ android-api-16-nightly/opt:
         symbol: tc(N)
     worker-type: aws-provisioner-v1/gecko-{level}-b-android
     worker:
+        docker-image: {in-tree: android-build}
         max-run-time: 7200
         env:
             TOOLTOOL_MANIFEST: "mobile/android/config/tooltool-manifests/android/releng.manifest"
@@ -143,7 +144,6 @@ android-api-16-nightly/opt:
         custom-build-variant-cfg: api-16
         tooltool-downloads: internal
     toolchains:
-        - linux64-gcc
         - linux64-sccache
 
 android-x86-old-id/opt:
@@ -156,6 +156,7 @@ android-x86-old-id/opt:
         symbol: tc(B)
     worker-type: aws-provisioner-v1/gecko-{level}-b-android
     worker:
+        docker-image: {in-tree: android-build}
         max-run-time: 7200
         env:
             TOOLTOOL_MANIFEST: "mobile/android/config/tooltool-manifests/android-x86/releng.manifest"
@@ -172,7 +173,6 @@ android-x86-old-id/opt:
         tooltool-downloads: internal
     run-on-projects: [ 'mozilla-central' ]
     toolchains:
-        - linux64-gcc
         - linux64-sccache
 
 android-x86-old-id-nightly/opt:
@@ -188,6 +188,7 @@ android-x86-old-id-nightly/opt:
         symbol: tc(N)
     worker-type: aws-provisioner-v1/gecko-{level}-b-android
     worker:
+        docker-image: {in-tree: android-build}
         max-run-time: 7200
         env:
             TOOLTOOL_MANIFEST: "mobile/android/config/tooltool-manifests/android-x86/releng.manifest"
@@ -205,7 +206,6 @@ android-x86-old-id-nightly/opt:
         tooltool-downloads: internal
     run-on-projects: [ 'mozilla-central' ]
     toolchains:
-        - linux64-gcc
         - linux64-sccache
 
 android-api-16-old-id/opt:
@@ -218,6 +218,7 @@ android-api-16-old-id/opt:
         symbol: tc(B)
     worker-type: aws-provisioner-v1/gecko-{level}-b-android
     worker:
+        docker-image: {in-tree: android-build}
         max-run-time: 7200
         env:
             TOOLTOOL_MANIFEST: "mobile/android/config/tooltool-manifests/android/releng.manifest"
@@ -234,7 +235,6 @@ android-api-16-old-id/opt:
         tooltool-downloads: internal
     run-on-projects: [ 'mozilla-central' ]
     toolchains:
-        - linux64-gcc
         - linux64-sccache
 
 android-api-16-old-id-nightly/opt:
@@ -250,6 +250,7 @@ android-api-16-old-id-nightly/opt:
         symbol: tc(N)
     worker-type: aws-provisioner-v1/gecko-{level}-b-android
     worker:
+        docker-image: {in-tree: android-build}
         max-run-time: 7200
         env:
             TOOLTOOL_MANIFEST: "mobile/android/config/tooltool-manifests/android/releng.manifest"
@@ -267,7 +268,6 @@ android-api-16-old-id-nightly/opt:
         tooltool-downloads: internal
     run-on-projects: [ 'mozilla-central' ]
     toolchains:
-        - linux64-gcc
         - linux64-sccache
 
 android-api-16-gradle/opt:
@@ -281,6 +281,7 @@ android-api-16-gradle/opt:
         tier: 2
     worker-type: aws-provisioner-v1/gecko-{level}-b-android
     worker:
+        docker-image: {in-tree: android-build}
         max-run-time: 7200
         env:
             # Bug 1292762 - Set GRADLE_USER_HOME to avoid sdk-manager-plugin intermittent
@@ -308,7 +309,6 @@ android-api-16-gradle/opt:
         custom-build-variant-cfg: api-16-gradle
         tooltool-downloads: internal
     toolchains:
-        - linux64-gcc
         - linux64-sccache
 
 android-aarch64/opt:
@@ -321,6 +321,7 @@ android-aarch64/opt:
         symbol: tc(B)
     worker-type: aws-provisioner-v1/gecko-{level}-b-android
     worker:
+        docker-image: {in-tree: android-build}
         max-run-time: 7200
         env:
             TOOLTOOL_MANIFEST: "mobile/android/config/tooltool-manifests/android/releng.manifest"
@@ -336,7 +337,6 @@ android-aarch64/opt:
         custom-build-variant-cfg: aarch64
         tooltool-downloads: internal
     toolchains:
-        - linux64-gcc
         - linux64-sccache
 
 android-aarch64-nightly/opt:
@@ -352,6 +352,7 @@ android-aarch64-nightly/opt:
         symbol: tc(N)
     worker-type: aws-provisioner-v1/gecko-{level}-b-android
     worker:
+        docker-image: {in-tree: android-build}
         max-run-time: 7200
         env:
             TOOLTOOL_MANIFEST: "mobile/android/config/tooltool-manifests/android/releng.manifest"
@@ -368,5 +369,4 @@ android-aarch64-nightly/opt:
         custom-build-variant-cfg: aarch64
         tooltool-downloads: internal
     toolchains:
-        - linux64-gcc
         - linux64-sccache

From 6293af8a7a238d796e3f4efa5056c51db407423e Mon Sep 17 00:00:00 2001
From: "J.C. Jones" <jjones@mozilla.com>
Date: Mon, 18 Sep 2017 21:43:40 -0700
Subject: [PATCH 81/83] Bug 1399334 - Add more debugging to see why
 certificates aren't valid. r=ttaubert

There's an intermittent that is showing up now that test_register_sign.html
checks state.attestationCert.verify(); to ensure hte SoftToken's certificate
is valid. This patch prints the offending certificate when it's encountered,
to help diagnose the root cause.

MozReview-Commit-ID: 4QSobq9fBGK
---
 dom/u2f/tests/frame_register_sign.html | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/dom/u2f/tests/frame_register_sign.html b/dom/u2f/tests/frame_register_sign.html
index f8e34799e9ca..9bce4d5b46c5 100644
--- a/dom/u2f/tests/frame_register_sign.html
+++ b/dom/u2f/tests/frame_register_sign.html
@@ -104,17 +104,20 @@ async function doTests() {
     var signedData = assembleRegistrationSignedData(state.appParam, state.challengeParam, state.keyHandleBytes, state.publicKeyBytes);
     return verifySignature(attestationPublicKey, signedData, state.attestationSig);
   }).then(function(verified) {
-    local_ok(verified, "Attestation Certificate signature verified")
+    local_ok(verified, "Attestation Certificate signature verified");
      // Import the public key of the U2F token into WebCrypto
-    return importPublicKey(state.publicKeyBytes)
+    return importPublicKey(state.publicKeyBytes);
   }).then(function(key) {
     state.publicKey = key;
-    local_ok(true, "Imported public key")
+    local_ok(true, "Imported public key");
 
     // Ensure the attestation certificate is properly self-signed
-    return state.attestationCert.verify()
+    return state.attestationCert.verify();
   }).then(function(verified) {
-    local_ok(verified, "Register attestation signature verified")
+    if (!verified) {
+      local_ok(verified, "Cert problem: " + bytesToBase64UrlSafe(state.attestation));
+    }
+    local_ok(verified, "Register attestation signature verified");
   });
 
   state.regKey = {

From 6353638e7aa07065b9be9e53fc8e058c52d64083 Mon Sep 17 00:00:00 2001
From: ffxbld <none@none>
Date: Tue, 19 Sep 2017 10:33:21 -0700
Subject: [PATCH 82/83] No bug, Automated HSTS preload list update from host
 bld-linux64-spot-304 - a=hsts-update

---
 security/manager/ssl/nsSTSPreloadList.errors | 256 ++++++++++---------
 security/manager/ssl/nsSTSPreloadList.inc    | 217 ++++++++--------
 2 files changed, 235 insertions(+), 238 deletions(-)

diff --git a/security/manager/ssl/nsSTSPreloadList.errors b/security/manager/ssl/nsSTSPreloadList.errors
index 4057a5a03978..4226bed5845a 100644
--- a/security/manager/ssl/nsSTSPreloadList.errors
+++ b/security/manager/ssl/nsSTSPreloadList.errors
@@ -35,12 +35,12 @@
 127011-networks.ch: could not connect to host
 12vpn.org: could not connect to host
 12vpnchina.com: could not connect to host
+13318522.com: could not connect to host
 1536.cf: could not connect to host
 163pwd.com: could not connect to host
 166166.com: could not connect to host
 16deza.com: did not receive HSTS header
 16packets.com: could not connect to host
-173vpn.cn: could not connect to host
 188betwarriors.co.uk: could not connect to host
 188trafalgar.ca: did not receive HSTS header
 1921958389.rsc.cdn77.org: did not receive HSTS header
@@ -62,7 +62,6 @@
 24hourpaint.com: could not connect to host
 24sihu.com: could not connect to host
 25daysof.io: could not connect to host
-27728522.com: could not connect to host
 2859cc.com: could not connect to host
 28spots.net: could not connect to host
 2acbi-asso.fr: did not receive HSTS header
@@ -72,28 +71,25 @@
 2intermediate.co.uk: did not receive HSTS header
 2or3.tk: could not connect to host
 2programmers.net: could not connect to host
-2ss.jp: could not connect to host
+2ss.jp: did not receive HSTS header
 300651.ru: did not receive HSTS header
 300m.com: did not receive HSTS header
 300mbmovies4u.cc: could not connect to host
 301.website: could not connect to host
 302.nyc: could not connect to host
-314chan.org: could not connect to host
 32ph.com: could not connect to host
 33338522.com: could not connect to host
 3338522.com: could not connect to host
 33drugstore.com: did not receive HSTS header
-341.mg: could not connect to host
+341.mg: did not receive HSTS header
 3555aa.com: could not connect to host
 35792.de: could not connect to host
 360gradus.com: did not receive HSTS header
-360live.fr: did not receive HSTS header
 365.or.jp: could not connect to host
 368mibn.com: could not connect to host
 3778xl.com: did not receive HSTS header
 38sihu.com: could not connect to host
 39sihu.com: could not connect to host
-3ags.de: did not receive HSTS header
 3chit.cf: could not connect to host
 3click-loan.com: could not connect to host
 3d-bastler.de: could not connect to host
@@ -120,7 +116,6 @@
 4sqsu.eu: could not connect to host
 4w-performers.link: could not connect to host
 50millionablaze.org: could not connect to host
-517vpn.cn: could not connect to host
 540.co: did not receive HSTS header
 54bf.com: could not connect to host
 55558522.com: could not connect to host
@@ -348,14 +343,15 @@ alarme-gps.ch: could not connect to host
 alarmegps.ch: could not connect to host
 alarmsystemreviews.com: did not receive HSTS header
 alaundeil.xyz: could not connect to host
-albanien.guide: did not receive HSTS header
 alberguecimballa.es: could not connect to host
 albertbogdanowicz.pl: did not receive HSTS header
 albertopimienta.com: did not receive HSTS header
 alcazaar.com: could not connect to host
 alecvannoten.be: did not receive HSTS header
+alela.fr: could not connect to host
 alenan.org: could not connect to host
 alessandro.pw: did not receive HSTS header
+alessandroz.pro: could not connect to host
 alethearose.com: did not receive HSTS header
 alexandre.sh: did not receive HSTS header
 alexbaker.org: did not receive HSTS header
@@ -609,11 +605,14 @@ askfit.cz: did not receive HSTS header
 asm-x.com: could not connect to host
 asmui.ga: could not connect to host
 asmui.ml: could not connect to host
-asr.cloud: could not connect to host
+asr.li: could not connect to host
+asr.rocks: could not connect to host
+asr.solar: could not connect to host
 ass.org.au: did not receive HSTS header
 assekuranzjobs.de: could not connect to host
 asset-alive.com: did not receive HSTS header
 asset-alive.net: did not receive HSTS header
+assindia.nl: could not connect to host
 astrath.net: could not connect to host
 astrolpost.com: could not connect to host
 astromelody.com: did not receive HSTS header
@@ -669,7 +668,6 @@ automobiles5.com: could not connect to host
 autotsum.com: could not connect to host
 autumnwindsagility.com: could not connect to host
 auverbox.ovh: could not connect to host
-auvernet.org: could not connect to host
 aux-arts-de-la-table.com: did not receive HSTS header
 auxetek.se: could not connect to host
 auxiliumincrementum.co.uk: could not connect to host
@@ -678,7 +676,6 @@ avantmfg.com: did not receive HSTS header
 avec-ou-sans-ordonnance.fr: could not connect to host
 avepol.cz: did not receive HSTS header
 avepol.eu: did not receive HSTS header
-avi9526.pp.ua: could not connect to host
 aviacao.pt: did not receive HSTS header
 aviodeals.com: could not connect to host
 avonlearningcampus.com: could not connect to host
@@ -721,6 +718,7 @@ bagiobella.com: max-age too low: 0
 baiduaccount.com: could not connect to host
 bailbondsaffordable.com: did not receive HSTS header
 bair.io: could not connect to host
+baiyangliu.com: could not connect to host
 bakhansen.com: did not receive HSTS header
 bakingstone.com: could not connect to host
 bakkerdesignandbuild.com: did not receive HSTS header
@@ -736,6 +734,7 @@ banchethai.com: did not receive HSTS header
 bandally.net: did not receive HSTS header
 bandb.xyz: could not connect to host
 bandrcrafts.com: did not receive HSTS header
+bangzafran.com: max-age too low: 36000
 banqingdiao.com: could not connect to host
 barely.sexy: did not receive HSTS header
 bariller.fr: could not connect to host
@@ -802,11 +801,9 @@ beichtgenerator.de: did not receive HSTS header
 beier.io: could not connect to host
 beikeil.de: did not receive HSTS header
 belairsewvac.com: could not connect to host
-belegit.org: could not connect to host
 belewpictures.com: did not receive HSTS header
-belgien.guide: did not receive HSTS header
 belize-firmengruendung.com: could not connect to host
-belliash.eu.org: did not receive HSTS header
+belliash.eu.org: could not connect to host
 belltower.io: could not connect to host
 belmontprom.com: could not connect to host
 bemyvictim.com: max-age too low: 2678400
@@ -878,6 +875,7 @@ bierbringer.at: could not connect to host
 big-black.de: did not receive HSTS header
 bigbbqbrush.bid: could not connect to host
 bigbrownpromotions.com.au: did not receive HSTS header
+biglou.com: max-age too low: 3153600
 bigshinylock.minazo.net: could not connect to host
 biguixhe.net: did not receive HSTS header
 bijouxdegriffe.com.br: did not receive HSTS header
@@ -916,7 +914,6 @@ bitheus.com: could not connect to host
 bithosting.io: did not receive HSTS header
 bitlish.com: max-age too low: 86400
 bitnet.io: did not receive HSTS header
-bitpod.de: could not connect to host
 bitrage.de: could not connect to host
 bitraum.io: could not connect to host
 bitsafe.systems: could not connect to host
@@ -939,8 +936,6 @@ blakerandall.xyz: could not connect to host
 blantik.net: could not connect to host
 blauerhunger.de: could not connect to host
 blauwwit.be: did not receive HSTS header
-blayne.me: could not connect to host
-blayneallan.com: could not connect to host
 blazor.nl: did not receive HSTS header
 blendlecdn.com: could not connect to host
 blenheimchalcot.com: did not receive HSTS header
@@ -1012,6 +1007,7 @@ borscheid-wenig.com: did not receive HSTS header
 boschee.net: could not connect to host
 botox.bz: did not receive HSTS header
 botserver.de: could not connect to host
+bouncourseplanner.net: could not connect to host
 bouwbedrijfpurmerend.nl: could not connect to host
 bowlroll.net: max-age too low: 0
 boxcryptor.com: did not receive HSTS header
@@ -1031,7 +1027,6 @@ brandnewdays.nl: could not connect to host
 brandon.so: could not connect to host
 brandred.net: could not connect to host
 brandspray.com: could not connect to host
-brasilien.guide: did not receive HSTS header
 brasilmorar.com: did not receive HSTS header
 bratteng.xyz: could not connect to host
 brava.bg: did not receive HSTS header
@@ -1045,6 +1040,7 @@ brickyardbuffalo.com: did not receive HSTS header
 bridholm.se: could not connect to host
 brightstarkids.com.au: did not receive HSTS header
 brilliantbuilders.co.uk: did not receive HSTS header
+britishsciencefestival.org: could not connect to host
 britzer-toner.de: did not receive HSTS header
 brks.xyz: could not connect to host
 broken-oak.com: could not connect to host
@@ -1086,17 +1082,16 @@ buildingclouds.fr: could not connect to host
 buildsaver.co.za: did not receive HSTS header
 built.by: did not receive HSTS header
 bukatv.cz: could not connect to host
-bulgarien.guide: did not receive HSTS header
 bulkbuy.tech: could not connect to host
 bulletpoint.cz: could not connect to host
 bullterrier.me: could not connect to host
 bulmafox.com: could not connect to host
+bumarkamoda.com: did not receive HSTS header
 bunaken.asia: did not receive HSTS header
 bunbomenu.de: could not connect to host
 bunsenlabs.org: max-age too low: 2592000
 bupu.ml: could not connect to host
 bureaubolster.nl: did not receive HSTS header
-burgers.io: could not connect to host
 burian-server.cz: could not connect to host
 burningcrash.de: max-age too low: 600000
 burpsuite.site: could not connect to host
@@ -1106,6 +1101,7 @@ burtrum.me: could not connect to host
 burtrum.top: could not connect to host
 buryat-mongol.cf: could not connect to host
 business.lookout.com: could not connect to host
+businessadviceperth.com.au: did not receive HSTS header
 businesshosting.nl: did not receive HSTS header
 businessloanconnection.org: did not receive HSTS header
 busold.ws: could not connect to host
@@ -1230,7 +1226,7 @@ carwashvapeur.be: could not connect to host
 casc.cz: did not receive HSTS header
 casedi.org: max-age too low: 0
 casefall.com: could not connect to host
-cash-pos.com: did not receive HSTS header
+cash-pos.com: could not connect to host
 cashlink.io: did not receive HSTS header
 cashmyphone.ch: could not connect to host
 casino-cashflow.ru: did not receive HSTS header
@@ -1302,7 +1298,6 @@ chat-porc.eu: did not receive HSTS header
 chatbot.me: did not receive HSTS header
 chateauconstellation.ch: did not receive HSTS header
 chatup.cf: could not connect to host
-chazay.net: could not connect to host
 chcemvediet.sk: max-age too low: 1555200
 cheapdns.org: could not connect to host
 cheazey.net: did not receive HSTS header
@@ -1328,6 +1323,7 @@ childcaresolutionscny.org: did not receive HSTS header
 chinacdn.org: could not connect to host
 chinawhale.com: did not receive HSTS header
 chirgui.eu: could not connect to host
+chloe.re: could not connect to host
 chlouis.net: could not connect to host
 chm.vn: did not receive HSTS header
 chodobien.com: could not connect to host
@@ -1350,7 +1346,7 @@ christophercolumbusfoundation.gov: could not connect to host
 christophersole.com: could not connect to host
 christophheich.me: could not connect to host
 chrisupjohn.com: could not connect to host
-chrisvicmall.com: could not connect to host
+chrisvicmall.com: did not receive HSTS header
 chrome-devtools-frontend.appspot.com: did not receive HSTS header (error ignored - included regardless)
 chrome.google.com: did not receive HSTS header (error ignored - included regardless)
 chrst.ph: could not connect to host
@@ -1397,13 +1393,13 @@ clickgram.biz: could not connect to host
 clicn.bio: could not connect to host
 clicnbio.com: did not receive HSTS header
 cliftons.com: did not receive HSTS header
+cliniquepariseau.com: could not connect to host
 clintonbloodworth.com: could not connect to host
 clintonbloodworth.io: could not connect to host
 clintwilson.technology: max-age too low: 2592000
 clip.ovh: could not connect to host
 clipped4u.com: could not connect to host
 cloud-project.com: could not connect to host
-cloud.bugatti: could not connect to host
 cloud.wtf: could not connect to host
 cloudapi.vc: could not connect to host
 cloudbleed.info: could not connect to host
@@ -1458,7 +1454,6 @@ codelitmus.com: did not receive HSTS header
 codelove.de: did not receive HSTS header
 codemonkeyrawks.net: could not connect to host
 codepoet.de: could not connect to host
-codepult.com: could not connect to host
 codepx.com: did not receive HSTS header
 codercross.com: could not connect to host
 codes.pk: did not receive HSTS header
@@ -1508,10 +1503,9 @@ compucorner.com.mx: could not connect to host
 computeremergency.com.au: did not receive HSTS header
 computersystems.guru: did not receive HSTS header
 computertal.de: could not connect to host
-conaudisa.com: could not connect to host
+conaudisa.com: did not receive HSTS header
 conception.sk: could not connect to host
 concord-group.co.jp: did not receive HSTS header
-confidential.network: did not receive HSTS header
 confirm365.com: could not connect to host
 conformal.com: could not connect to host
 cong5.net: max-age too low: 0
@@ -1541,6 +1535,7 @@ coole-meister.de: could not connect to host
 coolrc.me: could not connect to host
 cooxa.com: did not receive HSTS header
 copshop.com.br: did not receive HSTS header
+copytrack.com: could not connect to host
 cor-ser.es: could not connect to host
 coralproject.net: did not receive HSTS header
 coralrosado.com.br: did not receive HSTS header
@@ -1560,9 +1555,9 @@ correctpaardbatterijnietje.nl: did not receive HSTS header
 corruption-mc.net: could not connect to host
 corruption-rsps.net: could not connect to host
 corruption-server.net: could not connect to host
-costa-rica-reisen.de: did not receive HSTS header
 costow.club: could not connect to host
 count.sh: could not connect to host
+countryoutlaws.ca: could not connect to host
 couponcodeq.com: did not receive HSTS header
 couragewhispers.ca: could not connect to host
 coursdeprogrammation.com: could not connect to host
@@ -1680,6 +1675,7 @@ cyberpunk.ca: could not connect to host
 cybershambles.com: could not connect to host
 cybersmart.co.uk: did not receive HSTS header
 cycleluxembourg.lu: did not receive HSTS header
+cyclingjunkies.com: could not connect to host
 cydia-search.io: could not connect to host
 cynoshair.com: could not connect to host
 cyphertite.com: could not connect to host
@@ -1697,6 +1693,7 @@ dah5.com: could not connect to host
 dahl-pind.dk: could not connect to host
 dai-rin.co.jp: could not connect to host
 dailybits.be: did not receive HSTS header
+dailylifefinancial.com: could not connect to host
 dailystormerpodcasts.com: could not connect to host
 daimadi.com: could not connect to host
 daisuki.pw: could not connect to host
@@ -1704,6 +1701,7 @@ dakerealestate.com: did not receive HSTS header
 dakrib.net: could not connect to host
 daku.gdn: could not connect to host
 dalingk.co: could not connect to host
+daltonedwards.me: did not receive HSTS header
 damianuv-blog.cz: did not receive HSTS header
 danbarrett.com.au: did not receive HSTS header
 dancerdates.net: could not connect to host
@@ -1719,7 +1717,6 @@ danielworthy.com: did not receive HSTS header
 danijobs.com: could not connect to host
 danishenanigans.com: could not connect to host
 dankeblog.com: could not connect to host
-danmark.guide: did not receive HSTS header
 dannycrichton.com: did not receive HSTS header
 danrl.de: could not connect to host
 danwillenberg.com: did not receive HSTS header
@@ -1747,6 +1744,7 @@ dashnimorad.com: did not receive HSTS header
 data-abundance.com: could not connect to host
 data.haus: could not connect to host
 data.qld.gov.au: did not receive HSTS header
+datajapan.co.jp: could not connect to host
 datarank.com: max-age too low: 0
 dataretention.solutions: could not connect to host
 datasnitch.co.uk: could not connect to host
@@ -1779,7 +1777,6 @@ dcurt.is: did not receive HSTS header
 dcw.io: did not receive HSTS header
 ddatsh.com: could not connect to host
 ddepot.us: did not receive HSTS header
-de-servers.de: could not connect to host
 deadsoul.net: could not connect to host
 debank.tv: did not receive HSTS header
 debatch.se: could not connect to host
@@ -1825,6 +1822,7 @@ denh.am: did not receive HSTS header
 denisjean.fr: could not connect to host
 dentaldomain.org: did not receive HSTS header
 dentaldomain.ph: did not receive HSTS header
+denvercybersecurity.com: did not receive HSTS header
 denverprophit.us: did not receive HSTS header
 depijl-mz.nl: did not receive HSTS header
 depixion.agency: could not connect to host
@@ -1864,8 +1862,7 @@ devh.net: could not connect to host
 deviltraxxx.de: could not connect to host
 devincrow.me: could not connect to host
 devisonline.ch: could not connect to host
-devkit.cc: could not connect to host
-devmsg.com: could not connect to host
+devmsg.com: did not receive HSTS header
 devnsec.com: could not connect to host
 devnull.team: could not connect to host
 devopps.me: did not receive HSTS header
@@ -1879,12 +1876,14 @@ dhaynes.xyz: could not connect to host
 dhpcs.com: did not receive HSTS header
 dhpiggott.net: did not receive HSTS header
 dhuy.net: could not connect to host
+diablofan.hopto.org: could not connect to host
 diablotine.rocks: could not connect to host
 dianlujitao.com: did not receive HSTS header
 diannaobos.com: did not receive HSTS header
 dicando.com: max-age too low: 2592000
 dicelab.co.uk: could not connect to host
 dicionariofinanceiro.com: did not receive HSTS header
+didierlaumen.be: did not receive HSTS header
 die-borts.ch: could not connect to host
 dierenkruiden.nl: could not connect to host
 diewebstube.de: could not connect to host
@@ -1936,6 +1935,8 @@ dmwall.cn: could not connect to host
 dmz.ninja: could not connect to host
 dndtools.net: could not connect to host
 dns.google.com: did not receive HSTS header (error ignored - included regardless)
+dnsbird.net: could not connect to host
+dnsbird.org: could not connect to host
 dnsknowledge.com: did not receive HSTS header
 do-do.tk: could not connect to host
 do.search.yahoo.com: did not receive HSTS header
@@ -1964,7 +1965,6 @@ dolphinswithlasers.com: did not receive HSTS header
 domaine-aigoual-cevennes.com: did not receive HSTS header
 domaris.de: could not connect to host
 domenicocatelli.com: did not receive HSTS header
-dominikanskarepubliken.guide: did not receive HSTS header
 dominikkulaga.pl: max-age too low: 2592000
 dominioanimal.com: could not connect to host
 dominique-mueller.de: did not receive HSTS header
@@ -2015,7 +2015,6 @@ drhopeson.com: could not connect to host
 drinknaturespower.com: could not connect to host
 drishti.guru: could not connect to host
 drivercopilot.com: could not connect to host
-drogoz.moe: could not connect to host
 droidboss.com: did not receive HSTS header
 droncentrum.pl: could not connect to host
 droomhuis-in-brielle-kopen.nl: could not connect to host
@@ -2070,8 +2069,8 @@ e-pokupki.eu: did not receive HSTS header
 e-rickroll-r.pw: could not connect to host
 e-sa.com: did not receive HSTS header
 e-verify.gov: could not connect to host
+e30gruppe.com: did not receive HSTS header
 e3amn2l.com: could not connect to host
-eames-clayton.us: could not connect to host
 earga.sm: could not connect to host
 earlybirdsnacks.com: could not connect to host
 earthrise16.com: could not connect to host
@@ -2175,6 +2174,7 @@ elektronring.com: could not connect to host
 elemenx.com: did not receive HSTS header
 elemprendedor.com.ve: did not receive HSTS header
 elenag.ga: could not connect to host
+elenagherta.ga: could not connect to host
 elenoon.ir: did not receive HSTS header
 elgacien.de: could not connect to host
 elimdengelen.com: did not receive HSTS header
@@ -2183,7 +2183,6 @@ elitefishtank.com: could not connect to host
 elmar-kraamzorg.nl: did not receive HSTS header
 elnutricionista.es: did not receive HSTS header
 elohna.ch: did not receive HSTS header
-eloxt.com: could not connect to host
 elpo.xyz: could not connect to host
 elsamakhin.com: could not connect to host
 elsemanario.com: did not receive HSTS header
@@ -2220,8 +2219,9 @@ endlesshorizon.net: could not connect to host
 endlesstone.com: did not receive HSTS header
 endohaus.ca: could not connect to host
 endohaus.com: could not connect to host
-endohaus.eu: did not receive HSTS header
+endohaus.eu: could not connect to host
 enefan.jp: could not connect to host
+enfield-kitchens.co.uk: did not receive HSTS header
 engelwerbung.com: did not receive HSTS header
 enginsight.com: did not receive HSTS header
 englishyamal.ru: did not receive HSTS header
@@ -2255,6 +2255,7 @@ eqim.me: could not connect to host
 equate.net.au: did not receive HSTS header
 equatetechnologies.com.au: did not receive HSTS header
 equilibre-yoga-jennifer-will.com: could not connect to host
+equitee.co: did not receive HSTS header
 erawanarifnugroho.com: did not receive HSTS header
 eressea.xyz: could not connect to host
 ergorium.com: did not receive HSTS header
@@ -2292,12 +2293,10 @@ espo.com.ua: did not receive HSTS header
 espra.com: could not connect to host
 esquonic.com: could not connect to host
 essenzialeenxovais.com.br: did not receive HSTS header
-esseriumani.com: could not connect to host
 essexghosthunters.co.uk: could not connect to host
 estaciona.guru: could not connect to host
 estebanborges.com: did not receive HSTS header
 estilosapeca.com: could not connect to host
-estland.guide: did not receive HSTS header
 et-buchholz.de: could not connect to host
 et180.com: could not connect to host
 etangs-magazine.com: could not connect to host
@@ -2329,6 +2328,7 @@ eupho.me: could not connect to host
 euren.se: could not connect to host
 eurocamping.se: could not connect to host
 euroshop24.net: could not connect to host
+eurospecautowerks.com: did not receive HSTS header
 eurotime.ua: did not receive HSTS header
 evafojtova.cz: did not receive HSTS header
 evanhandgraaf.nl: did not receive HSTS header
@@ -2355,7 +2355,6 @@ exousiakaidunamis.xyz: could not connect to host
 expertmile.com: did not receive HSTS header
 expo-designers.com: did not receive HSTS header
 expoundite.net: could not connect to host
-expressemotion.net: could not connect to host
 expressfinance.co.za: did not receive HSTS header
 extrathemeshowcase.net: could not connect to host
 extratorrentlive.xyz: could not connect to host
@@ -2422,6 +2421,7 @@ fatgeekflix.net: could not connect to host
 fatherhood.gov: did not receive HSTS header
 fatlossguide.xyz: could not connect to host
 fatwin.pw: could not connect to host
+fatzebra.com.au: max-age too low: 0
 fayolle.info: did not receive HSTS header
 fbox.li: could not connect to host
 fdj.im: could not connect to host
@@ -2505,7 +2505,6 @@ fjruiz.es: did not receive HSTS header
 fkcovering.be: could not connect to host
 flags.ninja: could not connect to host
 flairbros.at: could not connect to host
-flajshans.cz: could not connect to host
 flamewall.net: could not connect to host
 flamingkeys.com.au: could not connect to host
 flareon.net: could not connect to host
@@ -2531,7 +2530,7 @@ fluidojobs.com: could not connect to host
 flukethoughts.com: could not connect to host
 flurrybridge.com: did not receive HSTS header
 flushstudios.com: did not receive HSTS header
-flyaces.com: did not receive HSTS header
+flyaces.com: could not connect to host
 fm83.nl: could not connect to host
 fmi.gov: did not receive HSTS header
 fnvsecurity.com: could not connect to host
@@ -2544,6 +2543,7 @@ foodiebox.no: did not receive HSTS header
 foodies.my: did not receive HSTS header
 foodievenues.com: could not connect to host
 foodsafetyworkinggroup.gov: could not connect to host
+fooster.io: did not receive HSTS header
 footballmapped.com: could not connect to host
 footlegende.fr: did not receive HSTS header
 forafifty.co.za: could not connect to host
@@ -2589,7 +2589,6 @@ freeflow.tv: could not connect to host
 freelanced.co.za: could not connect to host
 freelo.cz: did not receive HSTS header
 freematthale.net: could not connect to host
-freenetproject.org: did not receive HSTS header
 freesoftwaredriver.com: did not receive HSTS header
 freethought.org.au: could not connect to host
 freeutopia.org: did not receive HSTS header
@@ -2603,7 +2602,6 @@ friendlyfiregameshow.com: could not connect to host
 friendlysiberia.com: could not connect to host
 frimons.com: could not connect to host
 froggstack.de: could not connect to host
-front-end.dog: could not connect to host
 frontisme.nl: could not connect to host
 frontmin.com: did not receive HSTS header
 frost-ci.xyz: could not connect to host
@@ -2640,6 +2638,7 @@ futos.de: could not connect to host
 futurestarsusa.org: did not receive HSTS header
 futuretechnologi.es: could not connect to host
 futureyouhealth.com: did not receive HSTS header
+fuvpn.com: did not receive HSTS header
 fuwafuwa.moe: could not connect to host
 fuxwerk.de: could not connect to host
 fwest.ovh: did not receive HSTS header
@@ -2712,11 +2711,9 @@ garfieldairlines.net: did not receive HSTS header
 gatapro.net: could not connect to host
 gatorsa.es: did not receive HSTS header
 gaussorgues.me: could not connect to host
-gazellegames.net: could not connect to host
 gbc-radio.nl: did not receive HSTS header
 gc.net: could not connect to host
 gdegem.org: did not receive HSTS header
-geaskb.nl: could not connect to host
 gebn.co.uk: did not receive HSTS header
 gebn.uk: could not connect to host
 gedankenbude.info: could not connect to host
@@ -2783,7 +2780,6 @@ gheorghe-sarcov.ga: could not connect to host
 gheorghesarcov.ga: could not connect to host
 gheorghesarcov.tk: could not connect to host
 ghostcir.com: could not connect to host
-ghrelinblocker.org: did not receive HSTS header
 giakki.eu: could not connect to host
 gianlucapartengo.photography: did not receive HSTS header
 gibraltar-firma.com: did not receive HSTS header
@@ -2918,7 +2914,6 @@ greg.red: could not connect to host
 gregmilton.com: could not connect to host
 gregmilton.org: could not connect to host
 gregorytlee.me: could not connect to host
-grekland.guide: did not receive HSTS header
 gremots.com: could not connect to host
 greplin.com: could not connect to host
 gresb.com: did not receive HSTS header
@@ -3034,6 +3029,7 @@ haman.nl: could not connect to host
 hancc.net: could not connect to host
 handenafvanhetmedischdossier.nl: could not connect to host
 handicapindeles.nl: did not receive HSTS header
+handinhandfoundation.org.uk: could not connect to host
 handiworker.com: could not connect to host
 handleidingkwijt.com: did not receive HSTS header
 hanfu.la: could not connect to host
@@ -3055,10 +3051,8 @@ harambe.site: could not connect to host
 harbor-light.net: could not connect to host
 harbourweb.net: could not connect to host
 hardline.xyz: could not connect to host
-hardrain980.com: did not receive HSTS header
 haribosupermix.com: could not connect to host
 harisht.me: could not connect to host
-harlan.cc: could not connect to host
 harlentimberproducts.co.uk: did not receive HSTS header
 harmonycosmetic.com: max-age too low: 300
 harristony.com: could not connect to host
@@ -3114,6 +3108,7 @@ hebaus.com: could not connect to host
 hebriff.com: could not connect to host
 heidilein.info: did not receive HSTS header
 heimnetze.org: could not connect to host
+heimonen.eu: did not receive HSTS header
 helencrump.co.uk: did not receive HSTS header
 helgakristoffer.com: could not connect to host
 helgakristoffer.wedding: could not connect to host
@@ -3125,7 +3120,7 @@ helpmij.cf: did not receive HSTS header
 hemdal.se: could not connect to host
 hencagon.com: could not connect to host
 henriknoerr.com: could not connect to host
-hepteract.us: did not receive HSTS header
+hepteract.us: could not connect to host
 herbandpat.org: could not connect to host
 herbertmouwen.nl: could not connect to host
 heritagedentistry.ca: did not receive HSTS header
@@ -3261,7 +3256,7 @@ humblefinances.com: did not receive HSTS header
 humeurs.net: could not connect to host
 humortuga.pt: could not connect to host
 humpi.at: could not connect to host
-humpteedumptee.in: could not connect to host
+humpteedumptee.in: did not receive HSTS header
 hunger.im: could not connect to host
 huodongweb.com: could not connect to host
 hup.blue: could not connect to host
@@ -3270,7 +3265,7 @@ hxying.com: could not connect to host
 hycken.com: did not receive HSTS header
 hydaelyn.com: could not connect to host
 hydra.ws: could not connect to host
-hydrodipcenter.nl: could not connect to host
+hydrodipcenter.nl: did not receive HSTS header
 hydronium.cf: could not connect to host
 hydronium.ga: could not connect to host
 hydronium.me: could not connect to host
@@ -3321,6 +3316,7 @@ idedr.com: could not connect to host
 idemo.in: could not connect to host
 identitylabs.uk: could not connect to host
 idgsupply.com: did not receive HSTS header
+idinby.dk: did not receive HSTS header
 idisplay.es: did not receive HSTS header
 idlekernel.com: could not connect to host
 idontexist.me: did not receive HSTS header
@@ -3359,7 +3355,6 @@ imakepoems.net: could not connect to host
 imanolbarba.net: could not connect to host
 ime.moe: could not connect to host
 imim.pw: could not connect to host
-imjad.cn: did not receive HSTS header
 imjiangtao.com: could not connect to host
 immoprotect.ca: did not receive HSTS header
 immoralgamingco.com: could not connect to host
@@ -3380,6 +3375,7 @@ immunicity.top: could not connect to host
 immunicity.win: could not connect to host
 immunicity.works: did not receive HSTS header
 immunicity.world: did not receive HSTS header
+imolug.org: did not receive HSTS header
 imoni-blog.net: could not connect to host
 imoto.me: could not connect to host
 imouto.my: max-age too low: 5184000
@@ -3392,7 +3388,6 @@ incendiary-arts.com: could not connect to host
 inche-ali.com: did not receive HSTS header
 inchomatic.com: did not receive HSTS header
 indiecert.net: could not connect to host
-indien.guide: did not receive HSTS header
 indochina.io: could not connect to host
 indoorskiassen.nl: did not receive HSTS header
 indredouglas.me: could not connect to host
@@ -3425,7 +3420,6 @@ inhelix.com: could not connect to host
 injertoshorticolas.com: did not receive HSTS header
 injigo.com: did not receive HSTS header
 injust.cf: could not connect to host
-injust.eu.org: could not connect to host
 injust.ga: could not connect to host
 injust.gq: could not connect to host
 injust.me: could not connect to host
@@ -3515,9 +3509,7 @@ iraqidinar.org: did not receive HSTS header
 irazimina.ru: did not receive HSTS header
 irccloud.com: did not receive HSTS header
 irelandesign.com: could not connect to host
-irf2.pl: could not connect to host
 irisdina.de: did not receive HSTS header
-irland.guide: did not receive HSTS header
 irmtrudjurke.de: did not receive HSTS header
 irugs.ch: did not receive HSTS header
 irugs.co.uk: did not receive HSTS header
@@ -3548,12 +3540,12 @@ items.lv: did not receive HSTS header
 itemton.com: did not receive HSTS header
 ithakama.com: did not receive HSTS header
 ithakama.cz: did not receive HSTS header
+ithenrik.com: did not receive HSTS header
 itinsight.hu: did not receive HSTS header
 itos.asia: did not receive HSTS header
 itos.pl: did not receive HSTS header
 itpros.ru: could not connect to host
 itriskltd.com: could not connect to host
-its4living.com: could not connect to host
 itsadog.co.uk: did not receive HSTS header
 itsagadget.com: did not receive HSTS header
 itsamurai.ru: max-age too low: 2592000
@@ -3740,6 +3732,7 @@ jrgold.me: could not connect to host
 jrmd.io: could not connect to host
 jrvar.com: could not connect to host
 jsanders.us: did not receive HSTS header
+jsbentertainment.nl: could not connect to host
 jsg-technologies.de: did not receive HSTS header
 jualautoclave.com: did not receive HSTS header
 jualssh.com: could not connect to host
@@ -3780,6 +3773,7 @@ k1cp.com: could not connect to host
 ka-clan.com: could not connect to host
 kabinapp.com: could not connect to host
 kabuabc.com: could not connect to host
+kabus.org: could not connect to host
 kackscharf.de: could not connect to host
 kadioglumakina.com.tr: did not receive HSTS header
 kaela.design: could not connect to host
@@ -3788,11 +3782,9 @@ kaisers.de: did not receive HSTS header
 kaiyuewu.com: could not connect to host
 kalami.nl: could not connect to host
 kaleidomarketing.com: did not receive HSTS header
-kambodja.guide: did not receive HSTS header
 kamcvicit.sk: could not connect to host
 kamikano.com: could not connect to host
 kamikatse.net: could not connect to host
-kanada.guide: did not receive HSTS header
 kaneo-gmbh.de: did not receive HSTS header
 kaniklani.co.za: could not connect to host
 kanscooking.org: did not receive HSTS header
@@ -3803,7 +3795,6 @@ kaplatz.is: could not connect to host
 kapseli.net: could not connect to host
 kapucini.si: max-age too low: 0
 kaputt.com: could not connect to host
-kapverde.guide: did not receive HSTS header
 karaoketonight.com: could not connect to host
 karloskontana.tk: could not connect to host
 karpanhellas.com: did not receive HSTS header
@@ -3849,6 +3840,7 @@ kgxtech.com: max-age too low: 2592000
 khaganat.net: did not receive HSTS header
 ki-on.net: did not receive HSTS header
 kialo.com: did not receive HSTS header
+kiapartscenter.net: did not receive HSTS header
 kickass-proxies.org: could not connect to host
 kickass.al: could not connect to host
 kickasstorrents.gq: could not connect to host
@@ -3858,7 +3850,6 @@ kiel-media.de: did not receive HSTS header
 killerit.in: could not connect to host
 kimberg.co.uk: could not connect to host
 kimpost.org: could not connect to host
-kina.guide: did not receive HSTS header
 kinderly.co.uk: did not receive HSTS header
 kinderwagen-test24.de: could not connect to host
 kindlyfire.com: could not connect to host
@@ -3936,6 +3927,7 @@ kontorhaus-schlachte.de: could not connect to host
 koopjesnel.nl: could not connect to host
 koordinate.net: could not connect to host
 kori.ml: did not receive HSTS header
+korinar.com: could not connect to host
 koriyoukai.net: did not receive HSTS header
 kornersafe.com: did not receive HSTS header
 korni22.org: did not receive HSTS header
@@ -3959,7 +3951,7 @@ kreb.io: could not connect to host
 kredietpaspoort.nl: could not connect to host
 kredite.sale: could not connect to host
 krestanskydarek.cz: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsISiteSecurityService.processHeader]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: /builds/slave/m-cen-l64-periodicupdate-00000/getHSTSPreloadList.js :: processStsHeader :: line 119"  data: no]
-kriegt.es: could not connect to host
+kriegt.es: did not receive HSTS header
 kristjanrang.eu: did not receive HSTS header
 kristofferkoch.com: could not connect to host
 krizevackapajdasija.hr: could not connect to host
@@ -3973,13 +3965,13 @@ kryptomech.com: could not connect to host
 ksfh-mail.de: could not connect to host
 kstan.me: could not connect to host
 kswriter.com: could not connect to host
-kuba.guide: did not receive HSTS header
 kucom.it: did not receive HSTS header
 kuechenplan.online: did not receive HSTS header
 kueulangtahunanak.net: could not connect to host
 kum.com: could not connect to host
 kummerlaender.eu: did not receive HSTS header
 kupelne-ptacek.sk: did not receive HSTS header
+kupiec.eu.org: could not connect to host
 kuppingercole.com: did not receive HSTS header
 kura.io: could not connect to host
 kurehun.org: could not connect to host
@@ -4135,7 +4127,6 @@ libertyrp.org: did not receive HSTS header
 library.linode.com: did not receive HSTS header
 librechan.net: could not connect to host
 libreduca.com: could not connect to host
-libskia.so: could not connect to host
 lichess4545.com: did not receive HSTS header
 lichess4545.tv: did not receive HSTS header
 lidl-selection.at: could not connect to host
@@ -4313,6 +4304,7 @@ m2tc.fr: could not connect to host
 m3-gmbh.de: did not receive HSTS header
 m82labs.com: did not receive HSTS header
 maarten.nyc: could not connect to host
+maartenterpstra.xyz: could not connect to host
 mac-torrents.me: did not receive HSTS header
 macbolo.com: could not connect to host
 macchaberrycream.com: could not connect to host
@@ -4345,11 +4337,10 @@ mailing-jbgg.com: did not receive HSTS header
 main-street-seo.com: did not receive HSTS header
 maintainerheaven.ch: could not connect to host
 majesnix.org: did not receive HSTS header
+majncloud.tk: could not connect to host
 make-pizza.info: could not connect to host
-makedonien.guide: did not receive HSTS header
 makeitdynamic.com: could not connect to host
 makerstuff.net: did not receive HSTS header
-maldiverna.guide: did not receive HSTS header
 malena.com.ua: did not receive HSTS header
 malerversand.de: did not receive HSTS header
 malfait.nl: could not connect to host
@@ -4374,7 +4365,6 @@ manageforall.com: could not connect to host
 manageforall.de: could not connect to host
 managemynetsuite.com: did not receive HSTS header
 manageprojects.com: did not receive HSTS header
-manager-efficacement.com: could not connect to host
 manantial.mx: did not receive HSTS header
 mandpress.com: did not receive HSTS header
 maniadeprazer.com.br: could not connect to host
@@ -4405,7 +4395,6 @@ marie-curie.fr: could not connect to host
 marie-elisabeth.dk: did not receive HSTS header
 marie-en-provence.com: did not receive HSTS header
 marienschule-sundern.de: did not receive HSTS header
-mariposah.ch: could not connect to host
 markaconnor.com: did not receive HSTS header
 markayapilandirma.com: could not connect to host
 markcp.me: could not connect to host
@@ -4446,13 +4435,11 @@ mastodon.my: could not connect to host
 mastodon.pl: could not connect to host
 mastodones.club: could not connect to host
 masty.nl: did not receive HSTS header
-matatall.com: did not receive HSTS header
+matatall.com: could not connect to host
 matchneedle.com: could not connect to host
 maternalsafety.org: did not receive HSTS header
-maternum.com: did not receive HSTS header
 mateusmeyer.com.br: could not connect to host
 mathers.ovh: did not receive HSTS header
-matillat.ovh: could not connect to host
 matomeplus.co: could not connect to host
 matrict.com: could not connect to host
 matrip.de: could not connect to host
@@ -4475,6 +4462,7 @@ maur.cz: did not receive HSTS header
 maurus-automation.de: did not receive HSTS header
 mavisang.cf: could not connect to host
 mawe.red: could not connect to host
+maximiliankrieg.de: could not connect to host
 maximov.space: could not connect to host
 maxr1998.de: did not receive HSTS header
 maxserver.com: did not receive HSTS header
@@ -4488,9 +4476,11 @@ mcard.vn: did not receive HSTS header
 mcc.re: could not connect to host
 mcdonalds.ru: did not receive HSTS header
 mcga.media: could not connect to host
+mcgavocknissanwichitaparts.com: did not receive HSTS header
 mclab.su: could not connect to host
 mclist.it: could not connect to host
 mdfnet.se: did not receive HSTS header
+mdkr.nl: did not receive HSTS header
 mdscomp.net: did not receive HSTS header
 meadowfen.farm: could not connect to host
 meadowfenfarm.com: could not connect to host
@@ -4527,6 +4517,7 @@ meinebo.it: could not connect to host
 mekatrotekno.com: did not receive HSTS header
 melangebrasil.com: could not connect to host
 meledia.com: could not connect to host
+melenchatsmelenchiens.fr: could not connect to host
 melhoresdominios.net: could not connect to host
 melted.pw: could not connect to host
 memberpress.com: max-age too low: 86400
@@ -4567,6 +4558,7 @@ mfcatalin.com: could not connect to host
 mfedderke.com: could not connect to host
 mfxbe.de: did not receive HSTS header
 mgdigital.fr: did not receive HSTS header
+mgiay.com: did not receive HSTS header
 mh-bloemen.co.jp: could not connect to host
 mhdsyarif.com: did not receive HSTS header
 mhealthdemocamp.com: could not connect to host
@@ -4575,6 +4567,7 @@ mhict.nl: could not connect to host
 mht-travel.com: could not connect to host
 mhx.pw: could not connect to host
 mi80.com: could not connect to host
+mianfei-vpn.com: did not receive HSTS header
 michaeldemuth.com: could not connect to host
 michaelfitzpatrickruth.com: could not connect to host
 michaelmorpurgo.com: did not receive HSTS header
@@ -4681,7 +4674,6 @@ mlpchan.net: could not connect to host
 mlpepilepsy.org: could not connect to host
 mmgazhomeloans.com: did not receive HSTS header
 mmmm.com: could not connect to host
-mmstick.tk: could not connect to host
 mnec.io: could not connect to host
 mnemotiv.com: could not connect to host
 mnetworkingsolutions.co.uk: could not connect to host
@@ -4718,6 +4710,7 @@ moelord.org: could not connect to host
 moen.io: did not receive HSTS header
 mogry.net: could not connect to host
 moho.kr: could not connect to host
+mohs.es: could not connect to host
 moitur.com: could not connect to host
 mokhtarmial.com: did not receive HSTS header
 mols.me: could not connect to host
@@ -4733,12 +4726,13 @@ mondar.io: could not connect to host
 mondopoint.com: did not receive HSTS header
 mondwandler.de: could not connect to host
 moneromerchant.com: could not connect to host
-moneycrownmedia.com: did not receive HSTS header
+moneycrownmedia.com: could not connect to host
 monika-sokol.de: did not receive HSTS header
 monitaure.io: could not connect to host
 monitman.com: did not receive HSTS header
 monsieurbureau.com: did not receive HSTS header
 montanacures.org: could not connect to host
+montanwerk.de: could not connect to host
 montenero.pl: could not connect to host
 montonicms.com: could not connect to host
 moobo.xyz: could not connect to host
@@ -4777,7 +4771,6 @@ mountainmusicpromotions.com: did not receive HSTS header
 moviedollars.com: did not receive HSTS header
 moviesabout.net: could not connect to host
 moy-gorod.od.ua: did not receive HSTS header
-moy.cat: could not connect to host
 mozoa.net: could not connect to host
 mp3juices.is: could not connect to host
 mpkossen.com: did not receive HSTS header
@@ -4853,6 +4846,7 @@ mydriversedge.com: did not receive HSTS header
 myepass.bg: could not connect to host
 myepass.de: could not connect to host
 myfdic.gov: could not connect to host
+mygallery.homelinux.net: could not connect to host
 mygate.at: could not connect to host
 mygivingcircle.org: did not receive HSTS header
 mygooder.com: did not receive HSTS header
@@ -4908,10 +4902,12 @@ nan.zone: could not connect to host
 nandex.org: could not connect to host
 naniki.co.uk: did not receive HSTS header
 nanogeneinc.com: could not connect to host
+nanogi.ga: could not connect to host
 nanokamo.com: did not receive HSTS header
 nanrenba.net: could not connect to host
 nansay.cn: could not connect to host
 nanto.eu: could not connect to host
+napolinissanctparts.com: did not receive HSTS header
 nashira.cz: did not receive HSTS header
 natalia-fadeeva.ru: could not connect to host
 natalia.io: could not connect to host
@@ -4942,7 +4938,7 @@ nedwave.com: could not connect to host
 nedzad.me: could not connect to host
 neftaly.com: did not receive HSTS header
 negativecurvature.net: could not connect to host
-neilgreen.net: could not connect to host
+neilgreen.net: did not receive HSTS header
 neko-life.com: did not receive HSTS header
 neko-system.com: did not receive HSTS header
 nemno.de: could not connect to host
@@ -5026,7 +5022,7 @@ niho.jp: did not receive HSTS header
 nikcub.com: could not connect to host
 niklas.pw: did not receive HSTS header
 niklaslindblad.se: did not receive HSTS header
-nikobradshaw.com: did not receive HSTS header
+nikolasbradshaw.com: did not receive HSTS header
 ninchisho-online.com: did not receive HSTS header
 ninespec.com: could not connect to host
 ninhs.org: could not connect to host
@@ -5034,6 +5030,7 @@ ninjaspiders.com: did not receive HSTS header
 nippler.org: did not receive HSTS header
 nippombashi.net: did not receive HSTS header
 nipponcareers.com: did not receive HSTS header
+nitropanel.com: did not receive HSTS header
 nixien.fr: could not connect to host
 nixmag.net: did not receive HSTS header
 nkb.in.th: could not connect to host
@@ -5066,11 +5063,11 @@ nopol.de: could not connect to host
 norandom.com: could not connect to host
 norb.at: could not connect to host
 nordlicht.photography: did not receive HSTS header
-norge.guide: did not receive HSTS header
 northcutt.com: did not receive HSTS header
 nosecretshop.com: could not connect to host
 notadd.com: did not receive HSTS header
 notadd.io: could not connect to host
+notarankastojkovic.me: could not connect to host
 notenoughtime.de: could not connect to host
 nothing.net.nz: max-age too low: 7776000
 notjustbitchy.com: did not receive HSTS header
@@ -5080,7 +5077,6 @@ nouvelle-vague-saint-cast.fr: did not receive HSTS header
 nova-elearning.com: did not receive HSTS header
 novaco.in: max-age too low: 3600
 novacoast.com: did not receive HSTS header
-novascan.net: could not connect to host
 novatrucking.de: could not connect to host
 novavoidhowl.com: did not receive HSTS header
 novelabs.de: could not connect to host
@@ -5091,6 +5087,7 @@ noworrywp.com: could not connect to host
 nozoe.jp: could not connect to host
 np.search.yahoo.com: did not receive HSTS header
 npol.de: could not connect to host
+nq7.pl: could not connect to host
 nrd.li: could not connect to host
 nrechn.de: could not connect to host
 nrizzio.me: could not connect to host
@@ -5129,7 +5126,6 @@ nuttyveg.com: could not connect to host
 nwa.xyz: could not connect to host
 nweb.co.nz: could not connect to host
 nwork.media: could not connect to host
-nyazeeland.guide: did not receive HSTS header
 nycroth.com: could not connect to host
 nyesider.org: could not connect to host
 nyored.com: did not receive HSTS header
@@ -5146,7 +5142,6 @@ o-rickroll-y.pw: could not connect to host
 o0o.one: could not connect to host
 oasis.mobi: did not receive HSTS header
 oblast45.ru: did not receive HSTS header
-obscur.us: could not connect to host
 obscuredfiles.com: could not connect to host
 obsydian.org: could not connect to host
 occentus.net: did not receive HSTS header
@@ -5377,7 +5372,6 @@ parithy.net: could not connect to host
 parkingplus.co.il: could not connect to host
 parkrocker.com: did not receive HSTS header
 parkwithark.com: could not connect to host
-parleur.net: could not connect to host
 parpaing-paillette.net: could not connect to host
 particonpsplus.it: did not receive HSTS header
 partirkyoto.jp: did not receive HSTS header
@@ -5401,6 +5395,7 @@ pataua.kiwi: could not connect to host
 paternitydnatest.com: could not connect to host
 paterno-gaming.com: did not receive HSTS header
 patfs.com: did not receive HSTS header
+pathwaytofaith.com: could not connect to host
 patientinsight.net: did not receive HSTS header
 patt.us: could not connect to host
 patterson.mp: could not connect to host
@@ -5493,6 +5488,7 @@ phdsupply.com: did not receive HSTS header
 phdwuda.com: could not connect to host
 phelx.de: could not connect to host
 phil.tw: could not connect to host
+phillipgoldfarb.com: could not connect to host
 phillmoore.com: did not receive HSTS header
 phillprice.com: could not connect to host
 philpropertygroup.com: could not connect to host
@@ -5558,7 +5554,6 @@ pkschat.com: could not connect to host
 placefade.com: could not connect to host
 placollection.org: could not connect to host
 plaettliaktion.ch: did not receive HSTS header
-plainmark.com: did not receive HSTS header
 planpharmacy.com: could not connect to host
 plant.ml: did not receive HSTS header
 plass.hamburg: could not connect to host
@@ -5587,6 +5582,7 @@ plur.com.au: did not receive HSTS header
 pm13-media.cz: could not connect to host
 pmac.pt: could not connect to host
 pmnts.io: could not connect to host
+pnukee.com: did not receive HSTS header
 po.gl: did not receive HSTS header
 pochaneko.com: did not receive HSTS header
 pocketsix.com: could not connect to host
@@ -5601,11 +5597,11 @@ pokeduel.me: did not receive HSTS header
 pol.in.th: could not connect to host
 polarityschule.com: did not receive HSTS header
 pole.net.nz: could not connect to host
-polen.guide: did not receive HSTS header
 policeiwitness.sg: could not connect to host
 polimat.org: could not connect to host
 politically-incorrect.xyz: could not connect to host
 politologos.org: did not receive HSTS header
+polsport.live: could not connect to host
 polycoise.com: could not connect to host
 polycrypt.us: could not connect to host
 polypho.nyc: could not connect to host
@@ -5629,6 +5625,7 @@ portofacil.com: did not receive HSTS header
 poshpak.com: max-age too low: 86400
 postback.io: did not receive HSTS header
 postcodewise.co.uk: did not receive HSTS header
+posterspy.com: did not receive HSTS header
 postscheduler.org: could not connect to host
 posylka.de: did not receive HSTS header
 potatoheads.net: could not connect to host
@@ -5655,6 +5652,7 @@ practodev.com: did not receive HSTS header
 pratinav.xyz: could not connect to host
 prattpokemon.com: could not connect to host
 praxis-research.info: did not receive HSTS header
+precisionaeroimaging.com: did not receive HSTS header
 prediksisydney.com: could not connect to host
 preezzie.com: could not connect to host
 prefis.com: did not receive HSTS header
@@ -5764,7 +5762,7 @@ pwnsdx.pw: could not connect to host
 pwntr.com: could not connect to host
 py.search.yahoo.com: did not receive HSTS header
 pyol.org: could not connect to host
-pypi-mirrors.org: could not connect to host
+pypi-mirrors.org: did not receive HSTS header
 pypi-status.org: could not connect to host
 pyplo.org: did not receive HSTS header
 pypt.lt: did not receive HSTS header
@@ -5809,6 +5807,7 @@ queryplayground.com: could not connect to host
 questsandrewards.com: could not connect to host
 quickandroid.tools: could not connect to host
 quickpayservice.com: could not connect to host
+quizionic.com: did not receive HSTS header
 quizmemes.org: could not connect to host
 quli.nl: did not receive HSTS header
 quotehex.com: could not connect to host
@@ -5844,7 +5843,7 @@ randomcage.com: did not receive HSTS header
 randomcloud.net: could not connect to host
 randomhero.cloud: could not connect to host
 randomwinpicker.de: could not connect to host
-ranegroup.hosting: did not receive HSTS header
+ranegroup.hosting: could not connect to host
 rankthespot.com: could not connect to host
 ranktopay.com: did not receive HSTS header
 rannseier.org: did not receive HSTS header
@@ -6042,6 +6041,7 @@ rockz.io: did not receive HSTS header
 rodney.id.au: did not receive HSTS header
 rodneybrooksjr.com: did not receive HSTS header
 rodosto.com: could not connect to host
+rodzina-kupiec.eu.org: could not connect to host
 roeper.party: could not connect to host
 roesemann.email: could not connect to host
 rofrank.space: could not connect to host
@@ -6064,7 +6064,6 @@ rootwpn.com: could not connect to host
 rop.io: could not connect to host
 rossen.be: did not receive HSTS header
 rosslug.org.uk: could not connect to host
-roten.email: could not connect to host
 rough.nu: could not connect to host
 roundtheme.com: did not receive HSTS header
 rous.se: could not connect to host
@@ -6091,12 +6090,9 @@ rubecodeberg.com: could not connect to host
 rubenschulz.nl: could not connect to host
 rubi-ka.net: max-age too low: 0
 ruborr.se: did not receive HSTS header
-rubyquincunx.com: could not connect to host
-rubyquincunx.org: could not connect to host
 rubysecurity.org: did not receive HSTS header
 rubyshop.nl: max-age too low: 604800
 rudeotter.com: did not receive HSTS header
-rue-de-la-vieille.fr: could not connect to host
 rugirlfriend.com: could not connect to host
 rugs.ca: did not receive HSTS header
 ruig.jp: could not connect to host
@@ -6121,7 +6117,6 @@ rxt.social: could not connect to host
 rxv.cc: could not connect to host
 ryanteck.uk: did not receive HSTS header
 rylin.net: did not receive HSTS header
-ryssland.guide: did not receive HSTS header
 s-rickroll-p.pw: could not connect to host
 s.how: could not connect to host
 saabwa.org: could not connect to host
@@ -6214,7 +6209,6 @@ schroettle.com: did not receive HSTS header
 schulterglatzen-altenwalde.de: could not connect to host
 schultzflorists.com: could not connect to host
 schwarzkopfforyou.de: did not receive HSTS header
-schweiz.guide: did not receive HSTS header
 schweizerbolzonello.net: did not receive HSTS header
 schwetz.net: could not connect to host
 scicasts.com: max-age too low: 7776000
@@ -6240,7 +6234,7 @@ scribbleserver.com: could not connect to host
 scribe.systems: could not connect to host
 scrion.com: could not connect to host
 script.google.com: did not receive HSTS header (error ignored - included regardless)
-scriptenforcer.net: could not connect to host
+scriptenforcer.net: did not receive HSTS header
 scriptict.nl: could not connect to host
 scrollstory.com: did not receive HSTS header
 sdhmanagementgroup.com: could not connect to host
@@ -6330,7 +6324,6 @@ seowarp.net: did not receive HSTS header
 sepalandseed.com: did not receive HSTS header
 seq.tf: did not receive HSTS header
 serathius.ovh: could not connect to host
-serbien.guide: did not receive HSTS header
 serenitycreams.com: did not receive HSTS header
 serfdom.io: did not receive HSTS header
 serized.pw: could not connect to host
@@ -6352,14 +6345,20 @@ seyahatsagliksigortalari.com: could not connect to host
 sfashion.si: did not receive HSTS header
 sfhobbies.com.br: could not connect to host
 sfsltd.com: did not receive HSTS header
+sgtsnookums.net: could not connect to host
 shadoom.com: did not receive HSTS header
 shadow-socks.net: could not connect to host
+shadow-socks.org: did not receive HSTS header
 shadowguardian507-irl.tk: did not receive HSTS header
 shadowguardian507.tk: did not receive HSTS header
 shadowmorph.info: did not receive HSTS header
 shadowshocks.net: could not connect to host
+shadowsocks.gift: did not receive HSTS header
 shadowsocks.net: could not connect to host
+shadowsocks.vc: did not receive HSTS header
 shadowsocks.wiki: did not receive HSTS header
+shadowsocksvpn.com: did not receive HSTS header
+shadowsoks.com: could not connect to host
 shakebox.de: could not connect to host
 shanekoster.net: could not connect to host
 shanesage.com: could not connect to host
@@ -6452,10 +6451,12 @@ simplelearner.com: could not connect to host
 simplepractice.com: did not receive HSTS header
 simplixos.org: could not connect to host
 simply-premium.com: did not receive HSTS header
+simplyfixit.co.uk: did not receive HSTS header
 sin30.net: could not connect to host
 sincai666.com: could not connect to host
 sincron.org: could not connect to host
 sinful.pw: could not connect to host
+sinfulforums.net: did not receive HSTS header
 singul4rity.com: could not connect to host
 sinneserweiterung.de: could not connect to host
 sinosky.org: did not receive HSTS header
@@ -6465,6 +6466,7 @@ sitehost.io: did not receive HSTS header
 sitennisclub.com: did not receive HSTS header
 siterip.org: could not connect to host
 sites.google.com: did not receive HSTS header (error ignored - included regardless)
+sitesforward.com: did not receive HSTS header
 sitesten.com: did not receive HSTS header
 sixtwentyten.com: did not receive HSTS header
 sizingservers.be: did not receive HSTS header
@@ -6477,11 +6479,13 @@ skillproxy.org: could not connect to host
 skk.io: could not connect to host
 skoda-clever-lead.de: could not connect to host
 skoda-nurdiebesten.de: did not receive HSTS header
+skoda-service-team-cup.de: did not receive HSTS header
 skotty.io: did not receive HSTS header
 skpdev.net: could not connect to host
 skullhouse.nyc: did not receive HSTS header
 skyasker.cn: could not connect to host
 skyflix.me: could not connect to host
+skyline.link: could not connect to host
 skyoy.com: did not receive HSTS header
 skyrunners.ch: could not connect to host
 slanterns.net: could not connect to host
@@ -6593,12 +6597,12 @@ souyar.net: could not connect to host
 souyar.us: could not connect to host
 sovereignshare.com: could not connect to host
 sown.dyndns.org: could not connect to host
+soz6.com: could not connect to host
 spacedust.xyz: could not connect to host
 spacefish.biz: could not connect to host
 spacehq.org: could not connect to host
 spaggel.nl: could not connect to host
 spamloco.net: did not receive HSTS header
-spanien.guide: did not receive HSTS header
 sparelib.com: max-age too low: 3650
 spark.team: could not connect to host
 sparklingsparklers.com: did not receive HSTS header
@@ -6639,7 +6643,7 @@ spresso.me: did not receive HSTS header
 sprk.fitness: did not receive HSTS header
 sproutconnections.com: did not receive HSTS header
 sprutech.de: did not receive HSTS header
-spyroszarzonis.com: could not connect to host
+spyroszarzonis.com: did not receive HSTS header
 square.gs: could not connect to host
 squatldf.org: did not receive HSTS header
 sqzryang.com: did not receive HSTS header
@@ -6728,7 +6732,6 @@ stole-my.tv: could not connect to host
 stolkschepen.nl: did not receive HSTS header
 stonecutterscommunity.com: could not connect to host
 stopwoodfin.org: could not connect to host
-storbritannien.guide: did not receive HSTS header
 storecove.com: did not receive HSTS header
 storeden.com: did not receive HSTS header
 storefrontify.com: did not receive HSTS header
@@ -6785,7 +6788,6 @@ sumoatm.com: did not receive HSTS header
 sumoscout.de: could not connect to host
 suncountrymarine.com: did not receive HSTS header
 sundanceusa.com: did not receive HSTS header
-sunflyer.cn: did not receive HSTS header
 sunfulong.me: could not connect to host
 sunlandsg.vn: did not receive HSTS header
 sunnyfruit.ru: could not connect to host
@@ -6812,11 +6814,13 @@ supersecurefancydomain.com: could not connect to host
 supertramp-dafonseca.com: did not receive HSTS header
 superuser.fi: could not connect to host
 superwally.org: could not connect to host
+support4server.de: did not receive HSTS header
 suprlink.net: could not connect to host
 supweb.ovh: did not receive HSTS header
 surfeasy.com: did not receive HSTS header
 surfone-leucate.com: did not receive HSTS header
 susc.org.uk: did not receive HSTS header
+sushifrick.de: could not connect to host
 suzukikenichi.com: did not receive HSTS header
 sv.search.yahoo.com: did not receive HSTS header
 svatba-frantovi.cz: could not connect to host
@@ -6836,8 +6840,6 @@ sxbk.pw: could not connect to host
 syam.cc: could not connect to host
 sydgrabber.tk: could not connect to host
 sykl.us: could not connect to host
-sylvan.me: could not connect to host
-sylvangarden.net: could not connect to host
 sylvangarden.org: could not connect to host
 sylvanorder.com: could not connect to host
 symphonos.it: did not receive HSTS header
@@ -6971,7 +6973,6 @@ tedxkmitl.com: could not connect to host
 tefl.io: could not connect to host
 tegelsensanitaironline.nl: could not connect to host
 tehotuotanto.net: could not connect to host
-teknogeek.id: did not receive HSTS header
 teknologi.or.id: max-age too low: 0
 teknotes.co.uk: could not connect to host
 tekshrek.com: did not receive HSTS header
@@ -7000,6 +7001,7 @@ terra.by: did not receive HSTS header
 terrax.berlin: could not connect to host
 terrax.info: could not connect to host
 testandroid.xyz: could not connect to host
+tetramax.eu: did not receive HSTS header
 teufelsystem.de: could not connect to host
 teulon.eu: could not connect to host
 texte-zur-taufe.de: did not receive HSTS header
@@ -7072,13 +7074,13 @@ themimitoof.fr: did not receive HSTS header
 themoderate.xyz: could not connect to host
 thenextstep.events: could not connect to host
 theodorejones.info: could not connect to host
-theojones.name: could not connect to host
 thepartywarehouse.co.uk: did not receive HSTS header
 thepcweb.tk: could not connect to host
 thepiratebay.al: could not connect to host
 thepiratebay.poker: could not connect to host
 thepiratebay.tech: could not connect to host
 therewill.be: could not connect to host
+thesecurityteam.net: could not connect to host
 thesplit.is: could not connect to host
 thestack.xyz: could not connect to host
 thestagchorleywood.co.uk: did not receive HSTS header
@@ -7113,7 +7115,7 @@ thomaskliszowski.fr: did not receive HSTS header
 thomasmeester.nl: did not receive HSTS header
 thomasnet.fr: could not connect to host
 thomasschweizer.net: could not connect to host
-thomspooren.nl: could not connect to host
+thorbis.com: could not connect to host
 thorgames.nl: did not receive HSTS header
 thorncreek.net: did not receive HSTS header
 thriveapproach.co.uk: did not receive HSTS header
@@ -7121,6 +7123,8 @@ throughthelookingglasslens.co.uk: could not connect to host
 thumbtack.com: did not receive HSTS header
 thundercampaign.com: could not connect to host
 ti.blog.br: could not connect to host
+tianxing.pro: did not receive HSTS header
+tianxingvpn.pro: could not connect to host
 tibbitshall.ca: did not receive HSTS header
 tickopa.co.uk: could not connect to host
 tickreport.com: did not receive HSTS header
@@ -7173,10 +7177,10 @@ tittarpuls.se: could not connect to host
 titties.ml: could not connect to host
 tjc.host: did not receive HSTS header
 tjc.wiki: could not connect to host
-tjeckien.guide: did not receive HSTS header
 tjullrich.de: could not connect to host
 tkappertjedemetamorfose.nl: could not connect to host
 tkonstantopoulos.tk: could not connect to host
+tlach.cz: did not receive HSTS header
 tlcdn.net: could not connect to host
 tlo.hosting: could not connect to host
 tlo.link: could not connect to host
@@ -7207,6 +7211,7 @@ todobazar.es: could not connect to host
 tofu.im: could not connect to host
 togelonlinecommunity.com: did not receive HSTS header
 tokenloan.com: could not connect to host
+tokobungadijambi.com: could not connect to host
 tokoone.com: did not receive HSTS header
 tokotamz.net: could not connect to host
 tokoyo.biz: could not connect to host
@@ -7222,6 +7227,7 @@ tomli.me: could not connect to host
 tommsy.com: did not receive HSTS header
 tommyads.com: could not connect to host
 tomphill.co.uk: could not connect to host
+tongmu.me: did not receive HSTS header
 tonyfantjr.com: could not connect to host
 toomanypillows.com: could not connect to host
 tooolroc.org: could not connect to host
@@ -7236,6 +7242,7 @@ torchl.it: could not connect to host
 torlock.download: could not connect to host
 torproject.org.uk: could not connect to host
 torrentdownloads.bid: did not receive HSTS header
+torrentpier.me: could not connect to host
 torrentz.website: could not connect to host
 torsten-schmitz.net: could not connect to host
 tortugalife.de: could not connect to host
@@ -7325,9 +7332,7 @@ tucker.wales: could not connect to host
 tunai.id: could not connect to host
 tunca.it: did not receive HSTS header
 tunebitfm.de: could not connect to host
-turkiet.guide: did not receive HSTS header
 turkrock.com: did not receive HSTS header
-turn-sticks.com: did not receive HSTS header
 turnik-67.ru: could not connect to host
 turniker.ru: could not connect to host
 turnsticks.com: could not connect to host
@@ -7336,7 +7341,6 @@ tussengelegenwoningverkopen.nl: could not connect to host
 tuturulianda.com: could not connect to host
 tuvalie.com: could not connect to host
 tuxcall.de: could not connect to host
-tuxcloud.net: could not connect to host
 tuxz.net: did not receive HSTS header
 tv.search.yahoo.com: could not connect to host
 tvtubeflix.com: did not receive HSTS header
@@ -7381,7 +7385,6 @@ typeofweb.com: did not receive HSTS header
 typingrevolution.com: did not receive HSTS header
 tyrelius.com: did not receive HSTS header
 tyroproducts.eu: did not receive HSTS header
-tyskland.guide: did not receive HSTS header
 tzappa.net: could not connect to host
 u-blox.com: max-age too low: 0
 u.nu: could not connect to host
@@ -7389,7 +7392,6 @@ ua.search.yahoo.com: did not receive HSTS header
 uadp.pw: did not receive HSTS header
 uber.com.au: did not receive HSTS header
 uberfunction.com: did not receive HSTS header
-ubi.gg: could not connect to host
 ubicloud.de: could not connect to host
 ublox.com: did not receive HSTS header
 uborcare.com: could not connect to host
@@ -7444,10 +7446,10 @@ unccdesign.club: could not connect to host
 unclegen.xyz: could not connect to host
 undeadbrains.de: could not connect to host
 under30stravelinsurance.com.au: did not receive HSTS header
+underskatten.tk: could not connect to host
 unfiltered.nyc: did not receive HSTS header
-ungern.guide: did not receive HSTS header
 uni-games.com: could not connect to host
-unicooo.com: did not receive HSTS header
+unicooo.com: could not connect to host
 uniformecomgas.com.br: could not connect to host
 unikitty-on-tour.com: could not connect to host
 unionstationapp.com: could not connect to host
@@ -7480,6 +7482,7 @@ ur-lauber.de: did not receive HSTS header
 urandom.eu.org: did not receive HSTS header
 urban-garden.lt: could not connect to host
 urban-garden.lv: could not connect to host
+urbanstylestaging.com: did not receive HSTS header
 urbpic.com: could not connect to host
 urlchomp.com: did not receive HSTS header
 urphp.com: could not connect to host
@@ -7535,6 +7538,7 @@ valkyrja.xyz: could not connect to host
 valleyridgepta.org: could not connect to host
 vallis.net: did not receive HSTS header
 valmagus.com: could not connect to host
+vamoaeturismo.com.br: could not connect to host
 vampirism.eu: could not connect to host
 vanacht.co.za: did not receive HSTS header
 vande-walle.eu: did not receive HSTS header
@@ -7559,7 +7563,7 @@ veblen.com: could not connect to host
 vechkasov.ru: did not receive HSTS header
 vedatkamer.com: did not receive HSTS header
 vega.dyndns.info: could not connect to host
-veganosonline.com: did not receive HSTS header
+veganosonline.com: could not connect to host
 veggiefasting.com: could not connect to host
 veggiesbourg.fr: did not receive HSTS header
 vegis.ro: did not receive HSTS header
@@ -7610,6 +7614,7 @@ viktor-machnik.de: could not connect to host
 viktorsvantesson.net: did not receive HSTS header
 villacarmela.com.br: did not receive HSTS header
 villenvinkit.com: did not receive HSTS header
+viltsu.net: did not receive HSTS header
 vinasec.se: could not connect to host
 vincentkooijman.at: did not receive HSTS header
 vincentkooijman.nl: did not receive HSTS header
@@ -7652,7 +7657,6 @@ vodpay.com: could not connect to host
 vodpay.net: could not connect to host
 vodpay.org: could not connect to host
 voicesuk.co.uk: did not receive HSTS header
-void-zero.com: max-age too low: 0
 voidpay.com: could not connect to host
 voidpay.net: could not connect to host
 voidpay.org: could not connect to host
@@ -7706,6 +7710,7 @@ w4xzr.xyz: could not connect to host
 waaw.tv: did not receive HSTS header
 wachtwoordencheck.nl: could not connect to host
 wafa4hw.com: could not connect to host
+wafairhaven.com.au: did not receive HSTS header
 wahhoi.net: did not receive HSTS header
 wait.moe: could not connect to host
 waixingrenfuli7.vip: could not connect to host
@@ -7740,19 +7745,18 @@ warrencreative.com: did not receive HSTS header
 warsentech.com: could not connect to host
 warsh.moe: did not receive HSTS header
 washingtonviews.com: did not receive HSTS header
-watchface.watch: did not receive HSTS header
 watchium.com: did not receive HSTS header
 waterforlife.net.au: did not receive HSTS header
 waterpoint.com.br: did not receive HSTS header
 watersb.org: could not connect to host
 watersportmarkt.net: did not receive HSTS header
 watsonhall.uk: could not connect to host
+wattechweb.com: did not receive HSTS header
 wave.is: could not connect to host
 wavefloatrooms.com: did not receive HSTS header
 wavefrontsystemstech.com: could not connect to host
 we-bb.com: could not connect to host
 wear2work.nl: did not receive HSTS header
-weather-and-climate.com: could not connect to host
 weaverhairextensions.nl: could not connect to host
 web-industry.fr: could not connect to host
 web-insider.net: could not connect to host
@@ -7764,7 +7768,6 @@ web4pro.fr: could not connect to host
 webandwords.com.au: could not connect to host
 webapps.directory: could not connect to host
 webassadors.com: could not connect to host
-webbx.se: did not receive HSTS header
 webchat.domains: did not receive HSTS header
 webdeflect.com: could not connect to host
 webdesign-kronberg.de: did not receive HSTS header
@@ -7787,6 +7790,7 @@ webproshosting.tk: could not connect to host
 webpublica.pt: could not connect to host
 webrebels.org: could not connect to host
 webreslist.com: could not connect to host
+websiteadvice.com.au: did not receive HSTS header
 webstationservice.fr: could not connect to host
 webstellung.com: could not connect to host
 webstory.xyz: did not receive HSTS header
@@ -7815,7 +7819,7 @@ wendalyncheng.com: did not receive HSTS header
 werdeeintimo.de: did not receive HSTS header
 werkenbijkfc.nl: did not receive HSTS header
 werkplaatsoost.nl: did not receive HSTS header
-werkruimtebottendaal.nl: did not receive HSTS header
+werkruimtebottendaal.nl: could not connect to host
 wesleyharris.ca: did not receive HSTS header
 westendzone.com: max-age too low: 0
 westerhoud.nl: did not receive HSTS header
@@ -7895,7 +7899,6 @@ wohnungsbau-ludwigsburg.de: did not receive HSTS header
 woima.fi: max-age too low: 604800
 wolfesden.com: could not connect to host
 wolfie.ovh: could not connect to host
-womb.city: could not connect to host
 womosale.de: could not connect to host
 wonderfall.xyz: could not connect to host
 wondy.com: could not connect to host
@@ -7933,8 +7936,10 @@ wrightdoumawedding.com: could not connect to host
 writeapp.me: did not receive HSTS header
 wrldevelopment.com: did not receive HSTS header
 wrwg.ca: could not connect to host
+wsdezign.com: could not connect to host
 wsscompany.com.ve: could not connect to host
 wsup.social: could not connect to host
+wubocong.com: could not connect to host
 wubthecaptain.eu: could not connect to host
 wufu.org: did not receive HSTS header
 wuhengmin.com: could not connect to host
@@ -7982,7 +7987,6 @@ wxrlab.com: could not connect to host
 wxukang.cn: could not connect to host
 wybmabiity.com: could not connect to host
 wygluszanie.eu: did not receive HSTS header
-wzrd.in: could not connect to host
 x-power-detox.com: could not connect to host
 x-ripped-hd.com: could not connect to host
 x2w.io: could not connect to host
@@ -8001,6 +8005,7 @@ xehoivn.vn: did not receive HSTS header
 xellos.ga: could not connect to host
 xellos.ml: could not connect to host
 xenesisziarovky.sk: could not connect to host
+xerhost.de: could not connect to host
 xett.com: did not receive HSTS header
 xf-liam.com: did not receive HSTS header
 xfive.de: could not connect to host
@@ -8045,6 +8050,7 @@ xn--ekr87w7se89ay98ezcs.biz: did not receive HSTS header
 xn--gmq92k.nagoya: could not connect to host
 xn--hfk-allgu-schwaben-stb.de: could not connect to host
 xn--jobbrse-d1a.de: did not receive HSTS header
+xn--jp-6l5cs1yf3ivjsglphyv.net: could not connect to host
 xn--lgb3a8bcpn.cf: could not connect to host
 xn--lgb3a8bcpn.ga: could not connect to host
 xn--lgb3a8bcpn.gq: could not connect to host
@@ -8106,7 +8112,6 @@ yenniferallulli.es: did not receive HSTS header
 yenniferallulli.moda: could not connect to host
 yenniferallulli.nl: could not connect to host
 yesdevnull.net: did not receive HSTS header
-yesiammaisey.me: could not connect to host
 yestees.com: did not receive HSTS header
 yetcore.io: could not connect to host
 yetii.net: could not connect to host
@@ -8114,7 +8119,6 @@ yhong.me: did not receive HSTS header
 yhrd.org: did not receive HSTS header
 yikzu.cn: could not connect to host
 yin.roma.it: did not receive HSTS header
-yin8888.tv: did not receive HSTS header
 yingsuo.ltd: could not connect to host
 yingyj.com: did not receive HSTS header
 yinhe12.net: did not receive HSTS header
@@ -8133,6 +8137,7 @@ yoloboatrentals.com: did not receive HSTS header
 yoloprod.fr: could not connect to host
 yoloseo.com: could not connect to host
 yomepre.com: could not connect to host
+yoramvandevelde.net: could not connect to host
 yoru.me: did not receive HSTS header
 youcanmakeit.at: could not connect to host
 youcontrol.ru: could not connect to host
@@ -8151,7 +8156,7 @@ ytvwld.de: did not receive HSTS header
 yu7.jp: did not receive HSTS header
 yuan.ga: did not receive HSTS header
 yugege.cf: could not connect to host
-yuhen.ru: did not receive HSTS header
+yuhen.ru: could not connect to host
 yukiminami.net: could not connect to host
 yuko.moe: could not connect to host
 yummyfamilyrecipes.com: could not connect to host
@@ -8171,7 +8176,6 @@ yzal.io: could not connect to host
 z3liff.com: could not connect to host
 z3liff.net: could not connect to host
 za.search.yahoo.com: did not receive HSTS header
-zachgibbens.org: could not connect to host
 zadieheimlich.com: did not receive HSTS header
 zahyantechnologies.com: could not connect to host
 zakoncontrol.com: could not connect to host
@@ -8226,7 +8230,7 @@ zigcore.com.br: could not connect to host
 zihao.me: did not receive HSTS header
 zinc-x.com: did not receive HSTS header
 zinenapse.info: could not connect to host
-zippy-download.com: did not receive HSTS header
+zippy-download.com: could not connect to host
 zippy-download.de: could not connect to host
 zirtue.io: did not receive HSTS header
 zixo.sk: could not connect to host
diff --git a/security/manager/ssl/nsSTSPreloadList.inc b/security/manager/ssl/nsSTSPreloadList.inc
index 2d9bb15dccbb..ace87714cf55 100644
--- a/security/manager/ssl/nsSTSPreloadList.inc
+++ b/security/manager/ssl/nsSTSPreloadList.inc
@@ -8,7 +8,7 @@
 /*****************************************************************************/
 
 #include <stdint.h>
-const PRTime gPreloadListExpirationTime = INT64_C(1516642313822000);
+const PRTime gPreloadListExpirationTime = INT64_C(1516728603032000);
 %%
 0-1.party, 1
 0.me.uk, 1
@@ -114,7 +114,6 @@ const PRTime gPreloadListExpirationTime = INT64_C(1516642313822000);
 12vpn.net, 1
 130.ua, 1
 132kv.ch, 1
-13318522.com, 1
 1359826938.rsc.cdn77.org, 1
 13826145000.com, 1
 1391kj.com, 1
@@ -130,6 +129,7 @@ const PRTime gPreloadListExpirationTime = INT64_C(1516642313822000);
 1600esplanade.com, 1
 16164f.com, 1
 1644091933.rsc.cdn77.org, 1
+173vpn.cn, 1
 174.net.nz, 1
 1750studios.com, 0
 17hats.com, 1
@@ -202,6 +202,7 @@ const PRTime gPreloadListExpirationTime = INT64_C(1516642313822000);
 2600edinburgh.org, 1
 2600hq.com, 1
 263.info, 1
+27728522.com, 1
 281180.de, 1
 29227.com, 1
 2bas.nl, 1
@@ -231,6 +232,7 @@ const PRTime gPreloadListExpirationTime = INT64_C(1516642313822000);
 300mbmovie24.com, 1
 3133780x.com, 1
 314166.com, 1
+314chan.org, 1
 31klabs.com, 1
 31tv.ru, 1
 321live.nl, 1
@@ -241,6 +243,7 @@ const PRTime gPreloadListExpirationTime = INT64_C(1516642313822000);
 33scc.com, 1
 3473-wiki.de, 1
 360ds.co.in, 1
+360live.fr, 1
 360woodworking.com, 1
 365365.com, 1
 365beautyworld.com, 1
@@ -252,6 +255,7 @@ const PRTime gPreloadListExpirationTime = INT64_C(1516642313822000);
 38888msc.com, 1
 393335.ml, 1
 398.info, 1
+3ags.de, 1
 3bakayottu.com, 1
 3bigking.com, 1
 3c-d.de, 1
@@ -328,6 +332,7 @@ const PRTime gPreloadListExpirationTime = INT64_C(1516642313822000);
 500p.xyz, 1
 50plusnet.nl, 1
 513vpn.net, 1
+517vpn.cn, 1
 518maicai.com, 1
 525.info, 1
 52neptune.com, 1
@@ -994,6 +999,7 @@ alastairs-place.net, 1
 alauda-home.de, 1
 alaxyjewellers.co.za, 1
 alb-flirt.de, 1
+albanien.guide, 1
 albersdruck.de, 1
 albertathome.org, 1
 albion2.org, 1
@@ -1013,7 +1019,6 @@ alecpapierniak.com, 1
 alecrust.com, 1
 aleksejjocic.tk, 1
 aleksib.fi, 1
-alela.fr, 1
 aleph.land, 1
 alertaenlinea.gov, 1
 alertboxx.com, 1
@@ -1021,7 +1026,6 @@ alertonline.nl, 1
 alerts.sg, 1
 alertwire.com, 1
 alessandroonline.com.br, 1
-alessandroz.pro, 1
 aletm.it, 1
 alex-ross.co.uk, 1
 alex97000.de, 1
@@ -1887,9 +1891,7 @@ asphyxia.su, 1
 aspiescentral.com, 1
 aspires.co.jp, 1
 aspisdata.com, 1
-asr.li, 1
-asr.rocks, 1
-asr.solar, 1
+asr.cloud, 1
 asra.gr, 1
 asrob.eu, 0
 assdecoeur.org, 1
@@ -1900,7 +1902,6 @@ assessoriati.com.br, 1
 assetsupervision.com, 1
 assetvault.co.za, 1
 assguidesporrentruy.ch, 1
-assindia.nl, 1
 assistance-personnes-agees.ch, 1
 assumptionpj.org, 1
 assurancesmons.be, 1
@@ -2104,6 +2105,7 @@ autoterminus-used.be, 1
 autoverzekeringafsluiten.com, 1
 autoxy.it, 1
 autozane.com, 1
+auvernet.org, 1
 auxquatrevents.ch, 1
 ava-creative.de, 0
 avaaz.org, 1
@@ -2125,6 +2127,7 @@ avenueeyecare.com, 1
 averam.net, 1
 averen.co.uk, 1
 avg.club, 1
+avi9526.pp.ua, 1
 aviationstrategy.aero, 1
 avid.blue, 1
 avidcruiser.com, 1
@@ -2281,7 +2284,6 @@ baiker.info, 1
 bailakomigo.com.br, 1
 baileebee.com, 1
 baitulongbaycruises.com, 1
-baiyangliu.com, 1
 bajic.ch, 1
 baka.network, 1
 bakabt.info, 1
@@ -2335,7 +2337,6 @@ bangdream.ga, 1
 bangkok-dark-night.com, 1
 bangkok.dating, 1
 bangkokcity.de, 1
-bangzafran.com, 0
 bank.simple.com, 0
 bankbranchlocator.com, 1
 bankcardoffer.com, 1
@@ -2577,10 +2578,12 @@ belarto.pl, 1
 belastingdienst-in-beeld.nl, 1
 belastingmiddeling.nl, 1
 belcompany.nl, 0
+belegit.org, 1
 belfastlocks.com, 1
 belfasttechservices.co.uk, 1
 belge.rs, 1
 belgers.com, 1
+belgien.guide, 1
 belhopro.be, 1
 belics.com, 1
 belien-tweedehandswagens.be, 1
@@ -2828,7 +2831,6 @@ bigerbio.com, 1
 biggreenexchange.com, 1
 bight.ca, 1
 bigio.com.br, 1
-biglou.com, 1
 bigsisterchannel.com, 1
 bigskymontanalandforsale.com, 1
 biilo.com, 1
@@ -2992,6 +2994,7 @@ bitmoe.com, 1
 bitmon.net, 1
 bitok.com, 1
 bitplay.space, 1
+bitpod.de, 1
 bitpoll.de, 1
 bitpoll.org, 1
 bitpumpe.net, 1
@@ -3099,6 +3102,8 @@ blancodent.com, 1
 blankersfamily.com, 1
 blastersklan.com, 1
 blaudev.es, 1
+blayne.me, 1
+blayneallan.com, 1
 blazeit.io, 1
 bleche-onlineshop.de, 1
 blechinger.io, 1
@@ -3343,7 +3348,6 @@ bougeret.fr, 1
 boukoubengo.com, 1
 bounceboxspc.com, 1
 bouncecoffee.com, 1
-bouncourseplanner.net, 1
 bouncyball.eu, 0
 bouncyballs.org, 1
 bountyfactory.io, 1
@@ -3441,6 +3445,7 @@ brasal.ma, 1
 brasalcosmetics.com, 1
 brashear.me, 1
 brasilbombas.com.br, 1
+brasilien.guide, 1
 brasserie-mino.fr, 1
 brasspipedreams.org, 1
 bratislava-airport-taxi.com, 1
@@ -3524,7 +3529,6 @@ britishbeef.com, 1
 britishbookmakers.co.uk, 1
 britishgroupsg.com, 1
 britishmeat.com, 1
-britishsciencefestival.org, 1
 britishscienceweek.org, 1
 britneyclause.com, 1
 britton-photography.com, 1
@@ -3652,6 +3656,7 @@ bulario.com, 1
 bulbcompare.com, 1
 bulbgenie.com, 1
 buldogueingles.com.br, 1
+bulgarien.guide, 1
 bulkcandystore.com, 1
 bulkingtime.com, 1
 bulktrade.de, 1
@@ -3663,7 +3668,6 @@ bulletbabu.com, 1
 bullettags.com, 1
 bullterrier.nu, 1
 bulmastife.com.br, 1
-bumarkamoda.com, 0
 bumshow.ru, 1
 bunadarbankinn.is, 1
 bunbun.be, 0
@@ -3679,6 +3683,7 @@ bupropion.com, 1
 burcevo.info, 1
 burckardtnet.de, 1
 bureaugravity.com, 1
+burgers.io, 1
 buri.be, 0
 buricloud.fr, 1
 burke.services, 1
@@ -3702,7 +3707,6 @@ busindre.com, 1
 business-garden.com, 1
 business.facebook.com, 0
 business.medbank.com.mt, 1
-businessadviceperth.com.au, 1
 businessamongus.com, 1
 businesscentermarin.ch, 1
 businessesdirectory.eu, 1
@@ -4378,6 +4382,7 @@ chaulootz.com, 0
 chaurocks.com, 1
 chaz6.com, 1
 chazalet.fr, 1
+chazay.net, 0
 chbs.me, 1
 chch.it, 1
 chdgaming.xyz, 1
@@ -4471,7 +4476,6 @@ chirpstory.com, 1
 chiru.no, 1
 chisago-isantidfl.com, 1
 chit.search.yahoo.com, 0
-chloe.re, 1
 chloeallison.co.uk, 1
 chloehorler.com, 1
 chmsoft.com.ua, 1
@@ -4737,7 +4741,6 @@ clinicadelogopedia.net, 1
 clinicaferrusbratos.com, 1
 clinicaltrials.gov, 1
 cliniko.com, 1
-cliniquepariseau.com, 0
 clintonlibrary.gov, 1
 clip.mx, 0
 clipclip.com, 1
@@ -4760,6 +4763,7 @@ closient.com, 1
 closingholding.com, 1
 cloud-crowd.com.au, 1
 cloud-surfer.net, 1
+cloud.bugatti, 1
 cloud.fail, 1
 cloud.google.com, 1
 cloud.gov, 1
@@ -4908,6 +4912,7 @@ codenode.io, 1
 codeplay.org, 1
 codepoints.net, 1
 codepref.com, 1
+codepult.com, 1
 codera.co.uk, 1
 codercy.com, 1
 codereview.appspot.com, 0
@@ -5120,6 +5125,7 @@ condosforcash.com, 1
 condroz-motors.be, 1
 conectalmeria.com, 1
 confiancefoundation.org, 1
+confidential.network, 1
 config.schokokeks.org, 0
 confiwall.de, 1
 conflux.tw, 1
@@ -5223,7 +5229,6 @@ coptic-treasures.com, 1
 copycrafter.net, 1
 copypoison.com, 1
 copyright-watch.org, 1
-copytrack.com, 1
 coramcdaniel.com, 1
 corbax.com, 0
 corbinhesse.com, 1
@@ -5284,6 +5289,7 @@ cosmundi.de, 1
 cosplayer.com, 1
 cospol.ch, 1
 costa-rica-reisen.ch, 1
+costa-rica-reisen.de, 1
 costablancavoorjou.com, 1
 costreportdata.com, 0
 coteries.com, 1
@@ -5302,7 +5308,6 @@ countingto.one, 1
 countryattire.com, 1
 countrybrewer.com.au, 1
 countryhouseresort.com, 1
-countryoutlaws.ca, 1
 countybankdel.com, 1
 countyjailinmatesearch.com, 1
 coup-dun-soir.ch, 1
@@ -5692,7 +5697,6 @@ cybozulive-dev.com, 1
 cybozulive.com, 1
 cyclebeads.com, 1
 cyclehackluxembourgcity.lu, 1
-cyclingjunkies.com, 1
 cydetec.com, 1
 cyfly.org, 1
 cygnatus.com, 1
@@ -5769,7 +5773,6 @@ dailybunda.com, 1
 dailyenglishchallenge.com, 1
 dailyhealthguard.com, 1
 dailykos.com, 1
-dailylifefinancial.com, 0
 dailytopix.com, 1
 daintymeal.com, 1
 dairyshrine.org, 1
@@ -5791,7 +5794,6 @@ dallaslu.com, 1
 dallinbryce.com, 1
 dallmeier.net, 1
 dalmatiersheusden.be, 1
-daltonedwards.me, 1
 dam74.com.ar, 1
 damaged.org, 1
 damasexpress.com, 1
@@ -5843,6 +5845,7 @@ dankim.de, 0
 dankredues.com, 1
 danla.nl, 1
 danmaby.com, 1
+danmark.guide, 1
 danminkevitch.com, 1
 danny.fm, 1
 dannyrohde.de, 1
@@ -5928,7 +5931,6 @@ datadyne.technology, 1
 dataformers.at, 1
 datahove.no, 0
 dataisme.com, 1
-datajapan.co.jp, 1
 datakick.org, 1
 datalysis.ch, 1
 datamatic.ru, 1
@@ -6060,6 +6062,7 @@ de-gucci.com, 1
 de-mail.info, 1
 de-medici.nl, 1
 de-rwa.de, 1
+de-servers.de, 1
 de-spil.be, 1
 de.search.yahoo.com, 0
 deadbeef.ninja, 1
@@ -6228,7 +6231,6 @@ dentallaborgeraeteservice.de, 1
 dentistglasgow.com, 1
 dentrassi.de, 1
 dentystabirmingham.co.uk, 1
-denvercybersecurity.com, 1
 deontology.com, 1
 depaddestoeltjes.be, 1
 depechemode-live.com, 1
@@ -6344,6 +6346,7 @@ devisnow.fr, 1
 devistravaux.org, 1
 devjack.de, 1
 devkid.net, 1
+devkit.cc, 1
 devklog.net, 1
 devlamvzw.org, 1
 devlatron.net, 1
@@ -6391,7 +6394,6 @@ dhl-smart.ch, 1
 dhlinux.org, 1
 dhome.at, 1
 dhxxls.com, 1
-diablofan.hopto.org, 0
 diabolic.chat, 1
 diadorafitness.es, 1
 diadorafitness.it, 1
@@ -6431,7 +6433,6 @@ dicoding.com, 1
 didacte.com, 1
 didche.net, 1
 diddens.de, 1
-didierlaumen.be, 1
 die-besten-weisheiten.de, 1
 die-blahuts.de, 1
 die-gruenen-teufel.de, 1
@@ -6654,7 +6655,7 @@ dlaspania.pl, 1
 dlde.ru, 1
 dldl.fr, 1
 dlfsymposium.nl, 1
-dlg.im, 0
+dlg.im, 1
 dlitz.net, 1
 dlld.com, 1
 dlouwrink.nl, 1
@@ -6685,8 +6686,6 @@ dns-control.eu, 1
 dns-manager.info, 1
 dns.google.com, 1
 dns8.online, 1
-dnsbird.net, 1
-dnsbird.org, 1
 dnscrypt.org, 1
 dnscurve.io, 1
 dnshallinta.fi, 1
@@ -6775,6 +6774,7 @@ domesticcleaners.co.uk, 1
 domfee.com, 1
 domhaase.me, 1
 dominationgame.co.uk, 1
+dominikanskarepubliken.guide, 1
 dominioanimal.com.br, 1
 dominoknihy.cz, 1
 dominomatrix.com, 1
@@ -6988,6 +6988,7 @@ drlangsdon.com, 1
 drlazarina.net, 1
 drms.us, 1
 drobniuch.pl, 0
+drogoz.moe, 1
 drogueriaelbarco.com, 1
 droidapp.nl, 1
 droidgyan.com, 1
@@ -7181,7 +7182,6 @@ e-worksmedia.com, 1
 e.mail.ru, 1
 e11even.nl, 1
 e30.ee, 1
-e30gruppe.com, 1
 e3kids.com, 1
 e3q.de, 1
 e5tv.hu, 1
@@ -7198,6 +7198,7 @@ eagleyecs.com, 1
 eaimty.com, 1
 ealev.de, 1
 eam-gmbh.com, 1
+eames-clayton.us, 1
 eapestudioweb.com, 1
 earl.org.uk, 1
 earlyyearshub.com, 1
@@ -7521,7 +7522,6 @@ elementalsoftware.org, 1
 elementarywave.com, 1
 elements.guide, 1
 elena-baykova.ru, 1
-elenagherta.ga, 1
 elenorsmadness.org, 1
 elephants.net, 1
 elephpant.cz, 1
@@ -7579,6 +7579,7 @@ elodieclerc.ch, 1
 eloge.se, 1
 elonbase.com, 1
 elosrah.com, 1
+eloxt.com, 1
 elpado.de, 1
 elpay.kz, 1
 elpo.net, 1
@@ -7705,7 +7706,6 @@ energyled.com.br, 1
 enersec.co.uk, 1
 enet-navigator.de, 1
 enfantsdelarue.ch, 1
-enfield-kitchens.co.uk, 1
 enfoqueseguro.com, 1
 enfu.se, 1
 engarde.net, 1
@@ -7819,7 +7819,6 @@ equinox.io, 1
 equipedefrance.tv, 1
 equipeferramentas.com.br, 1
 equipsupply.com, 1
-equitee.co, 1
 equityflows.com, 1
 er-music.com, 1
 er.tl, 1
@@ -7953,6 +7952,7 @@ essenceofvitalitydetox.com, 1
 essencesdeprana.org, 1
 essentialoilsimports.com, 1
 essentiel-physique.com, 1
+esseriumani.com, 1
 essexcosmeticdentists.co.uk, 0
 essite.net, 1
 essoduke.org, 1
@@ -7967,6 +7967,7 @@ estcequonmetenprodaujourdhui.info, 1
 esteam.se, 1
 esteticanorte.com.br, 1
 estilopack-loja.com.br, 1
+estland.guide, 1
 estoic.net, 1
 estoniantrade.ee, 1
 estonoentraenelexamen.com, 1
@@ -8065,7 +8066,6 @@ europop.com, 1
 eurora.de, 1
 euroscot.de, 1
 euroshop.or.at, 1
-eurospecautowerks.com, 1
 eurostrategy.vn.ua, 1
 eurotramp.com, 1
 eurotravelstar.eu, 1
@@ -8212,6 +8212,7 @@ exporta.cz, 1
 expowerhps.com, 1
 express-shina.ru, 1
 express-vpn.com, 1
+expressemotion.net, 1
 expresshosting.org, 1
 expressmarket.ru, 1
 expressvpn.com, 1
@@ -8443,7 +8444,6 @@ fatedata.com, 1
 fatimamoldes.com.br, 1
 fator25.com.br, 1
 fatox.de, 1
-fatzebra.com.au, 0
 faucetbox.com, 0
 faulty.equipment, 1
 fauvettes.be, 1
@@ -8760,6 +8760,7 @@ flagfic.com, 1
 flagshop.jp, 1
 flagspot.net, 1
 flair.co, 1
+flajshans.cz, 1
 flam.io, 1
 flamer-scene.com, 0
 flamingcow.tv, 1
@@ -8936,7 +8937,6 @@ fooishbar.org, 0
 foolip.org, 1
 foolwealth.com, 1
 foorack.com, 1
-fooster.io, 1
 footballforum.de, 1
 for.care, 1
 foray-jero.me, 1
@@ -9146,6 +9146,7 @@ freemanning.de, 1
 freemedforms.com, 1
 freemyipod.org, 1
 freend.me, 1
+freenetproject.org, 1
 freergform.org, 1
 freeshell.de, 1
 freesitemapgenerator.com, 1
@@ -9227,6 +9228,7 @@ fromix.de, 1
 fromlemaytoz.com, 1
 fromscratch.rocks, 1
 fromthesoutherncross.com, 1
+front-end.dog, 1
 fronteers.nl, 0
 frontline.cloud, 1
 frontline6.com, 1
@@ -9348,7 +9350,6 @@ futuresonline.com, 1
 futurezone.at, 1
 futuristarchitecture.com, 1
 futurope.com, 1
-fuvpn.com, 1
 fuyu.moe, 1
 fuzoku-sodan.com, 1
 fuzzing-project.org, 1
@@ -9516,6 +9517,7 @@ gaysfisting.com, 1
 gaytorrent.ru, 1
 gayxsite.com, 1
 gazee.net, 1
+gazellegames.net, 1
 gbcsummercamps.com, 1
 gbl.selfip.net, 1
 gc-mc.de, 1
@@ -9541,6 +9543,7 @@ ge3k.net, 0
 gear-acquisition-syndrome.community, 1
 gearev.net, 1
 gearset.com, 1
+geaskb.nl, 1
 geass.xyz, 1
 geblitzt.de, 1
 geboortestoeltje.com, 1
@@ -9760,6 +9763,7 @@ ghkim.net, 1
 ghostblog.info, 1
 ghostwritershigh.com, 1
 ghrelinblocker.info, 1
+ghrelinblocker.org, 1
 giacomodrago.com, 1
 giacomodrago.it, 1
 giacomopelagatti.it, 1
@@ -10158,6 +10162,7 @@ gregorkofler.com, 1
 gregorykelleher.com, 1
 gregoryrealestategroup.com, 1
 gregorywiest.com, 1
+grekland.guide, 1
 grenadiercorps-kaarst.de, 1
 grenadiere-kaarst.de, 1
 grenadierkorps-kaarst.de, 1
@@ -10457,7 +10462,6 @@ hanakaraku.com, 1
 hanashi.eu, 1
 handcraft.eu.org, 1
 handgelenkbandage-test.de, 1
-handinhandfoundation.org.uk, 1
 handlecoin.com, 1
 handmade-workshop.de, 1
 handmadegobelin.com, 1
@@ -10513,6 +10517,7 @@ hardesec.com, 1
 hardfalcon.net, 1
 hardforum.com, 1
 hardh.at, 1
+hardrain980.com, 1
 hardtfrieden.de, 1
 hardtime.ru, 1
 hardyboyplant.com, 1
@@ -10689,7 +10694,6 @@ heidisheroes.org, 1
 heijblok.com, 1
 heiland.io, 1
 heimatverein-eitensheim.de, 1
-heimonen.eu, 1
 heimprofis.de, 1
 heinpost.nl, 0
 heinzelmann.co, 1
@@ -11452,7 +11456,6 @@ idexxpublicationportal.com, 1
 idgard.de, 1
 idhosts.co.id, 1
 idid.tk, 1
-idinby.dk, 1
 idiopolis.org, 1
 idiotentruppe.de, 1
 idmanagement.gov, 1
@@ -11619,6 +11622,7 @@ imguploaden.nl, 1
 imi-rhapsody.eu, 1
 imirhil.fr, 1
 imitza.com, 1
+imjad.cn, 1
 imkerei-freilinger.de, 1
 imkerverein-moenchswald.de, 1
 imlonghao.com, 1
@@ -11637,7 +11641,6 @@ immobilier92.net, 1
 immobiza.com, 1
 immortal.run, 1
 imokuri123.com, 1
-imolug.org, 1
 imoner.com, 1
 imoner.ga, 1
 imouyang.com, 1
@@ -11701,6 +11704,7 @@ indiawise.co.uk, 1
 indicateurs-flash.fr, 1
 indiegame.space, 1
 indiemods.com, 1
+indien.guide, 1
 indievelopment.nl, 1
 indigosakura.com, 1
 indilens.com, 1
@@ -11779,6 +11783,7 @@ inishbofin.ie, 1
 initq.net, 1
 initramfs.io, 1
 initrd.net, 1
+injust.eu.org, 1
 ink.horse, 1
 inkbunny.net, 0
 inkhor.se, 1
@@ -12033,6 +12038,7 @@ ircmett.de, 1
 iready.ro, 1
 ireef.tv, 1
 irenekauer.com, 1
+irf2.pl, 1
 irfan.id, 1
 irgit.pl, 1
 iridiumbrowser.de, 1
@@ -12046,6 +12052,7 @@ irish.dating, 1
 irishmusic.nu, 1
 irisjieun.com, 1
 irland-firma.com, 1
+irland.guide, 1
 irmag.ru, 1
 irmgard-woelfle.de, 1
 irmgardkoch.com, 1
@@ -12064,7 +12071,7 @@ isaacpartnership.co.uk, 1
 isaacpartnership.com, 1
 isaacphysics.org, 1
 isabelle-delpech.com, 1
-isamiok.com, 1
+isamiok.com, 0
 isara.com, 1
 isbc-telecom.ru, 1
 isbengrumpy.com, 1
@@ -12185,7 +12192,6 @@ itfaq.nl, 1
 itfh.eu, 1
 itfix.cz, 1
 itforge.nl, 1
-ithenrik.com, 1
 itilo.de, 1
 itiomassagem.com.br, 1
 itis.gov, 1
@@ -12208,6 +12214,7 @@ its-future.com, 1
 its-gutachten.de, 1
 its-schindler.de, 1
 its-v.de, 1
+its4living.com, 1
 itsanicedoor.co.uk, 1
 itsatrap.nl, 0
 itsdcdn.com, 1
@@ -12662,7 +12669,7 @@ joelle.me, 1
 joelleandpeter.co.uk, 1
 joelmunch.com, 1
 joepitt.co.uk, 0
-joerg-wellpott.de, 1
+joerg-wellpott.de, 0
 joerss.at, 1
 joespaintingpgh.com, 1
 joestead.codes, 1
@@ -12809,7 +12816,6 @@ jross.me, 1
 jrtapsell.co.uk, 0
 jrxpress.com, 1
 js-online.net, 1
-jsbentertainment.nl, 1
 jschumacher.info, 1
 jsd-cog.org, 1
 jsevilleja.org, 1
@@ -12942,7 +12948,6 @@ kabat-fans.cz, 1
 kabeuchi.com, 1
 kaboom.pw, 1
 kabu-abc.com, 1
-kabus.org, 1
 kachlikova2.cz, 1
 kack.website, 1
 kadmec.com, 1
@@ -12989,11 +12994,13 @@ kaloix.de, 1
 kaltenbrunner.it, 1
 kalterersee.ch, 1
 kamalame.co, 1
+kambodja.guide, 1
 kamikaichimaru.com, 1
 kamitech.ch, 1
 kamixa.se, 1
 kana.me, 1
 kanaanonline.org, 1
+kanada.guide, 1
 kanaete-uranai.com, 1
 kanagawachuo-hospital.jp, 1
 kanal-tv-haensch.de, 1
@@ -13031,6 +13038,7 @@ kapo.info, 1
 kappit.dk, 1
 kaptadata.com, 1
 kaptamedia.com, 1
+kapverde.guide, 1
 karabas.com, 1
 karabijnhaken.nl, 0
 karachi.dating, 1
@@ -13270,7 +13278,6 @@ khs1994.com, 1
 kiadoapartman.hu, 1
 kiahoriane.com, 1
 kiano.net, 1
-kiapartscenter.net, 1
 kiapartsdepartment.com, 1
 kiapps.ovh, 1
 kibibit.net, 1
@@ -13319,6 +13326,7 @@ kimmel.in, 1
 kimoota.net, 0
 kimotodental.com, 1
 kimsufi-jordi.tk, 1
+kina.guide, 1
 kinderbasar-luhe.de, 1
 kinderbuecher-kostenlos.de, 1
 kinderopvangengeltjes.nl, 1
@@ -13583,7 +13591,6 @@ kopular.com, 1
 kopykatz.org, 0
 korea.dating, 1
 koretech.nl, 1
-korinar.com, 1
 korobi.io, 1
 korobkovsky.ru, 1
 korono.de, 1
@@ -13708,6 +13715,7 @@ kualo.com, 1
 kualo.in, 1
 kuaza.com, 1
 kub.hr, 1
+kuba.guide, 1
 kubik-rubik.de, 0
 kubiwa.net, 1
 kubkprf.ru, 1
@@ -13742,7 +13750,6 @@ kungerkueken.de, 1
 kunstundunrat.de, 1
 kuoruan.com, 1
 kupferstichshop.com, 1
-kupiec.eu.org, 1
 kupimlot.ru, 1
 kuponrazzi.com, 1
 kuponydoher.cz, 1
@@ -14330,6 +14337,7 @@ libreoffice-from-collabora.com, 1
 libreofficefromcollabora.com, 1
 librervac.org, 1
 libscode.com, 0
+libskia.so, 1
 libsodium.org, 1
 libstock.si, 1
 licence-registry.com, 1
@@ -14963,7 +14971,6 @@ ma-plancha.ch, 1
 ma2t.com, 1
 maartenderaedemaeker.be, 1
 maartenprovo.be, 1
-maartenterpstra.xyz, 1
 maartenvandekamp.nl, 1
 mabulledu.net, 1
 mac-i-tea.ch, 1
@@ -15047,7 +15054,7 @@ magi.systems, 1
 magicball.co, 1
 magicbroccoli.de, 0
 magiclen.org, 1
-magicspaceninjapirates.de, 1
+magicspaceninjapirates.de, 0
 magictable.com, 1
 magilio.com, 1
 magnacumlaude.co, 1
@@ -15101,9 +15108,9 @@ majahoidja.ee, 1
 majaweb.cz, 1
 majemedia.com, 1
 majid.info, 1
-majncloud.tk, 1
 makaleci.com, 1
 makedin.net, 1
+makedonien.guide, 1
 makeit-so.de, 1
 makemejob.com, 1
 makenaiyo-fx.com, 1
@@ -15120,6 +15127,7 @@ malash.me, 1
 malasuk.com, 1
 malaysia.search.yahoo.com, 0
 malaysian.dating, 1
+maldiverna.guide, 1
 maleexcel.com, 1
 malenyflorist.com.au, 1
 malesbdsm.com, 1
@@ -15163,6 +15171,7 @@ management-companie.ro, 1
 management-ethics.com, 1
 managementboek.nl, 1
 managementfeedback.com, 1
+manager-efficacement.com, 1
 manager.linode.com, 0
 managewp.org, 1
 manatees.net, 1
@@ -15274,6 +15283,7 @@ marines-shop.com, 1
 mario.party, 1
 marioabela.com, 1
 mariogeckler.de, 1
+mariposah.ch, 1
 marisamorby.com, 1
 maritim.go.id, 1
 mariushubatschek.de, 1
@@ -15410,6 +15420,7 @@ matchboxdesigngroup.com, 1
 materiaischiquinho.com.br, 1
 material-world-fuyouhin.com, 1
 materialism.com, 1
+maternum.com, 1
 mathembedded.com, 1
 mathhire.org, 1
 mathiasbynens.be, 1
@@ -15420,6 +15431,7 @@ mathijskingma.nl, 1
 maths.network, 1
 mathspace.co, 1
 matildajaneclothing.com, 1
+matillat.ovh, 1
 matjaz.it, 1
 matlabjo.ir, 1
 matlss.com, 1
@@ -15486,7 +15498,6 @@ maximelouet.me, 1
 maximilian-graf.de, 1
 maximilian-greger.com, 1
 maximiliankaul.de, 1
-maximiliankrieg.de, 1
 maxims-travel.com, 1
 maxipcalls.com, 1
 maxkaul.de, 1
@@ -15500,7 +15511,7 @@ may24.tw, 1
 mayavi.co.in, 1
 maybeul.com, 1
 mayerbrownllz.com, 1
-maynardnetworks.com, 1
+maynardnetworks.com, 0
 mayoristassexshop.com, 1
 maypolevilla.co.uk, 1
 mayrhofer.eu.org, 1
@@ -15546,7 +15557,6 @@ mce55.eu, 1
 mcea-hld.jp, 1
 mceconferencecentre.eu, 1
 mcgarderen.nl, 1
-mcgavocknissanwichitaparts.com, 1
 mcgovernance.com, 1
 mchopkins.net, 1
 mchristopher.com, 1
@@ -15581,7 +15591,6 @@ mdcloudps.com, 1
 mdek.at, 1
 mdewendt.de, 1
 mdf-bis.com, 1
-mdkr.nl, 1
 mdma.net, 1
 mdmed.clinic, 1
 mdosch.de, 1
@@ -15705,7 +15714,6 @@ melcher.it, 1
 melchizedek-forum.de, 1
 meldcode-assistent.nl, 1
 melearning.university, 0
-melenchatsmelenchiens.fr, 1
 melf.nl, 1
 melhoresdominios.com, 1
 melhoresmarcasdenotebook.com.br, 1
@@ -15841,7 +15849,6 @@ mflodin.se, 1
 mfrsgb45.org, 1
 mft.global, 1
 mghiorzi.com.ar, 0
-mgiay.com, 1
 mgknet.com, 1
 mgoessel.de, 1
 mgrossklaus.de, 1
@@ -15858,7 +15865,6 @@ mi-so-ji.com, 1
 mia.to, 1
 miagexport.com, 1
 miamicityballet.org, 1
-mianfei-vpn.com, 1
 miaoubox.com, 1
 miaowo.org, 1
 miasarafina.de, 1
@@ -16173,6 +16179,7 @@ mmin.us, 1
 mmmarco.com, 1
 mmogah.com, 1
 mmonit.com, 1
+mmstick.tk, 1
 mmt.my, 1
 mmucha.de, 1
 mncloud.de, 1
@@ -16252,7 +16259,6 @@ moeyi.xyz, 0
 mofohome.dyndns.org, 1
 moha-swiss.com, 1
 mohanmekap.com, 1
-mohs.es, 1
 moin.jp, 1
 moipourtoit.ch, 1
 moipourtoit.com, 1
@@ -16322,7 +16328,6 @@ montage-kaika.de, 1
 montagne-tendance.ch, 1
 montanana.com, 1
 montand.com, 1
-montanwerk.de, 1
 montarfotoaki.com, 1
 montas.io, 1
 montazer.net, 1
@@ -16583,7 +16588,7 @@ murakami-sah.com, 1
 murdercube.com, 1
 murfy.nz, 1
 murgi.de, 1
-murmel.it, 1
+murmel.it, 0
 murof.com.br, 1
 murraycoin.org, 1
 mursu.directory, 1
@@ -16715,7 +16720,6 @@ myfunworld.de, 1
 myg21.com, 1
 mygadgetguardian.lookout.com, 0
 mygalgame.com, 1
-mygallery.homelinux.net, 1
 mygeneral.org, 1
 mygeotrip.com, 1
 mygpsite.com, 1
@@ -16915,7 +16919,6 @@ nanch.com, 1
 nanderson.me, 1
 nanfangstone.com, 1
 nankiseamansclub.com, 1
-nanogi.ga, 1
 nanotechnologist.com, 1
 nanpuyue.com, 1
 nanubo.com, 1
@@ -16925,7 +16928,6 @@ naotone.com, 1
 napcae.de, 1
 naphex.rocks, 1
 napisynapomniky.cz, 1
-napolinissanctparts.com, 1
 narach.com, 1
 narada.com.ua, 1
 naralogics.com, 1
@@ -17444,8 +17446,8 @@ nikkila.me, 1
 nikklassen.ca, 1
 nikksno.io, 1
 niklasbabel.com, 1
+nikobradshaw.com, 1
 nikolaichik.photo, 1
-nikolasbradshaw.com, 1
 nikolasgrottendieck.com, 1
 nikomo.fi, 0
 nikz.in, 1
@@ -17483,7 +17485,6 @@ nitaonline.org, 1
 nitifilter.com, 1
 nitrix.me, 1
 nitrokey.com, 1
-nitropanel.com, 1
 nitropur.com, 1
 nitropur.de, 1
 nitrous-networks.com, 1
@@ -17584,6 +17585,7 @@ nordseeblicke.de, 1
 nordwaldzendo.de, 1
 noref.tk, 1
 noreply.mx, 1
+norge.guide, 1
 normaculta.com.br, 1
 normalady.com, 1
 norman-preusser-gmbh.de, 1
@@ -17626,7 +17628,6 @@ notalone.gov, 1
 notar-glagowski.com, 1
 notar-glagowski.de, 1
 notar-peikert.com, 1
-notarankastojkovic.me, 1
 notarobot.fr, 1
 notarvysocina.cz, 1
 notbolaget.se, 1
@@ -17656,6 +17657,7 @@ novabench.com, 1
 novacraft.me, 1
 novafreixo.pt, 1
 novaopcaofestas.com.br, 1
+novascan.net, 1
 novawave.ca, 1
 novelfeed.com, 1
 novelinglife.net, 1
@@ -17676,7 +17678,6 @@ npath.de, 1
 npm.li, 1
 npmcdn.com, 1
 npw.net, 1
-nq7.pl, 1
 nqesh.com, 1
 nrdstd.io, 1
 nrev.ch, 1
@@ -17774,6 +17775,7 @@ nxinfo.ch, 1
 nyan.it, 1
 nyanpasu.tv, 1
 nyantec.com, 1
+nyazeeland.guide, 1
 nycoyote.org, 1
 nyffo.com, 1
 nyiad.edu, 1
@@ -17818,6 +17820,7 @@ objekt-textil.ch, 1
 oblikdom.pro, 1
 oblikdom.ru, 1
 obrienlab.com, 1
+obscur.us, 1
 observatory.se, 1
 obsidianirc.net, 1
 obsproject.com, 1
@@ -18582,7 +18585,6 @@ patechmasters.com, 1
 patentfamily.de, 1
 patflix.com, 1
 pathwaystoresilience.org, 1
-pathwaytofaith.com, 1
 patikabiztositas.hu, 1
 patouille-et-gribouille.fr, 1
 patralos.at, 0
@@ -18922,7 +18924,6 @@ philippbirkholz.de, 1
 philipperoose.be, 1
 philippheenen.de, 1
 philippkeschl.at, 1
-phillipgoldfarb.com, 1
 phillippi.me, 1
 philonas.net, 1
 philosoftware.com.br, 1
@@ -19147,6 +19148,7 @@ placehold.co, 1
 placeralplato.com, 1
 placker.com, 1
 plainjs.com, 0
+plainmark.com, 1
 plaintech.net.au, 1
 plaintray.com, 1
 plan-immobilier.fr, 1
@@ -19270,7 +19272,6 @@ pneuhaus-lemp.ch, 1
 pnmhomecheckup.com, 1
 pnona.cz, 1
 pnsc.is, 1
-pnukee.com, 1
 pnut.io, 0
 pnyxnet.com, 1
 poba.fr, 1
@@ -19309,6 +19310,7 @@ polaire.org, 1
 pole-emotion.ch, 1
 poleacademie.com, 1
 poleartschool.com, 0
+polen.guide, 1
 poles4pilots.com, 1
 policedriver.com, 1
 polis.or.at, 1
@@ -19325,7 +19327,6 @@ pollet-ghys.be, 1
 polletmera.com, 1
 pollingplace.uk, 1
 pollpodium.nl, 1
-polsport.live, 1
 polyfill.io, 1
 polymake.org, 1
 polymathematician.com, 1
@@ -19417,7 +19418,6 @@ postdarwinian.com, 1
 postdarwinism.com, 1
 postdeck.de, 1
 posteo.de, 0
-posterspy.com, 1
 postfinance.ch, 1
 postmatescode.com, 1
 postn.eu, 1
@@ -19490,7 +19490,6 @@ prc.gov, 1
 precedecaritas.com.br, 1
 preciouslife.fr, 1
 preciscx.com, 1
-precisionaeroimaging.com, 1
 predoiu.ro, 1
 preexport.com, 1
 preferredathlete.com, 1
@@ -20009,7 +20008,6 @@ quinnlabs.com, 1
 quinoa24.com, 1
 quintessa.org, 1
 quire.io, 1
-quizionic.com, 1
 quizogames.com, 1
 qul.link, 1
 quocdesign.ch, 1
@@ -20769,7 +20767,6 @@ rodichi.net, 1
 rodolfo.gs, 1
 rodomonte.org, 1
 rodrigocarvalho.blog.br, 1
-rodzina-kupiec.eu.org, 1
 roeckx.be, 1
 roeitijd.nl, 1
 roeldevries.me, 1
@@ -20876,6 +20873,7 @@ rospa100.com, 1
 rosset.me, 1
 rosset.net, 1
 rot47.net, 1
+roten.email, 1
 rotex1840.de, 1
 rothkranz.net, 1
 rothnater.ch, 1
@@ -20972,6 +20970,8 @@ rublacklist.net, 1
 ruby-auf-schienen.de, 1
 rubyist.today, 1
 rubymartin.com.au, 1
+rubyquincunx.com, 1
+rubyquincunx.org, 1
 rubytune.com, 1
 rucnerobene.eu, 1
 ruconsole.com, 1
@@ -20981,6 +20981,7 @@ ruderverein-gelsenkirchen.de, 1
 rudloff.pro, 0
 rudolph.life, 1
 rudrastyh.com, 1
+rue-de-la-vieille.fr, 1
 ruedirrenggli.ch, 1
 ruerte.net, 1
 rufabula-com.appspot.com, 1
@@ -21061,6 +21062,7 @@ ryazan-region.ru, 1
 rychlikoderi.cz, 1
 rylore.com, 1
 rynekpierwotny.pl, 1
+ryssland.guide, 1
 rythgs.co, 0
 ryuu.es, 1
 rzegroup.com, 1
@@ -21496,6 +21498,7 @@ schwarzhenri.ch, 1
 schwarztrade.cz, 1
 schwarzwald-flirt.de, 1
 schwarzwaldcon.de, 1
+schweiz.guide, 1
 schwinabart.com, 1
 schwinger.me, 1
 schwuppengrillen.de, 1
@@ -21818,6 +21821,7 @@ sera.jp, 1
 serafin.tech, 1
 seraph.tokyo, 1
 serbanpaun.ro, 1
+serbien.guide, 1
 sereema.com, 1
 serenaden.at, 1
 serf.io, 1
@@ -21908,7 +21912,6 @@ sgroup-hitoduma.com, 1
 sgroup-rec.com, 1
 sgtcodfish.com, 1
 sgthotshot.com, 1
-sgtsnookums.net, 1
 sgtt.ch, 1
 sh-heppelmann.de, 1
 sh-network.de, 0
@@ -21921,7 +21924,6 @@ shadesofgraylaw.com, 1
 shadex.net, 1
 shadigee.org, 1
 shadiku.com, 1
-shadow-socks.org, 1
 shadow-socks.pro, 1
 shadowict.net, 1
 shadowict.tech, 1
@@ -21934,12 +21936,8 @@ shadowsing.com, 1
 shadowsocks.com, 1
 shadowsocks.com.au, 1
 shadowsocks.com.hk, 1
-shadowsocks.gift, 1
 shadowsocks.la, 1
 shadowsocks.software, 1
-shadowsocks.vc, 1
-shadowsocksvpn.com, 1
-shadowsoks.com, 1
 shadowsworldonline.co.uk, 1
 shag-shag.ru, 1
 shagi29.ru, 1
@@ -22293,7 +22291,6 @@ simplidesigns.nl, 1
 simplycharlottemason.com, 1
 simplycloud.de, 1
 simplyenak.com, 0
-simplyfixit.co.uk, 1
 simplyhelen.de, 1
 simplymozzo.se, 1
 simplystudio.com, 1
@@ -22311,7 +22308,6 @@ sinatrafamily.com, 1
 sinefili.com, 1
 sinergy.ch, 1
 sinfield.com, 0
-sinfulforums.net, 1
 singaporemint.com, 1
 singapurfirma.com, 1
 singee.site, 1
@@ -22361,7 +22357,6 @@ sitehoster.org, 1
 sitemaxiphilippe.ch, 1
 siterencontre.me, 1
 sites.google.com, 1
-sitesforward.com, 1
 sitesko.de, 1
 sitsy.ru, 0
 sivyerge.com, 1
@@ -22417,7 +22412,6 @@ sklepsamsung.pl, 1
 sklotechnik.cz, 1
 skocia.net, 1
 skoda-im-dialog.de, 1
-skoda-service-team-cup.de, 1
 skogsbruket.fi, 1
 skogskultur.fi, 1
 skol.bzh, 1
@@ -22439,7 +22433,6 @@ skydragoness.com, 1
 skydrive.live.com, 0
 skylgenet.nl, 1
 skylightcreative.com.au, 1
-skyline.link, 1
 skyline.tw, 1
 skylinertech.com, 1
 skylocker.net, 1
@@ -22864,7 +22857,6 @@ souvik.me, 1
 soved.eu, 1
 sowingseasons.com, 1
 sowncloud.de, 1
-soz6.com, 1
 sozialy.com, 1
 sozon.ca, 1
 sp.com.pl, 1
@@ -22885,6 +22877,7 @@ spacountryexplorer.org.au, 1
 spam.lol, 1
 spamwc.de, 1
 spangehlassociates.com, 1
+spanien.guide, 1
 sparkasse.de, 1
 sparkbase.cn, 1
 sparkforautism.org, 1
@@ -23328,6 +23321,7 @@ stopakwardhandshakes.org, 1
 stopbullying.gov, 1
 stopfraud.gov, 1
 stopthethyroidmadness.com, 1
+storbritannien.guide, 1
 store-host.com, 1
 store10.de, 1
 storedsafe.com, 1
@@ -23506,6 +23500,7 @@ sundaycooks.com, 1
 sundayfundayjapan.com, 1
 suneilpatel.com, 1
 sunfireshop.com.br, 1
+sunflyer.cn, 0
 sunfox.cz, 1
 sungo.wtf, 1
 sunjaydhama.com, 1
@@ -23541,7 +23536,6 @@ supplementler.com, 1
 supplies24.at, 1
 supplies24.es, 1
 support.mayfirst.org, 0
-support4server.de, 1
 supportericking.org, 1
 supportme123.com, 1
 suprem.biz, 1
@@ -23572,7 +23566,6 @@ susastudentenjobs.de, 1
 susconam.org, 1
 sush.us, 1
 sushi101tempe.com, 0
-sushifrick.de, 1
 sushikatze.de, 1
 susosudon.com, 1
 suspension-shop.com, 1
@@ -23673,6 +23666,8 @@ syleam.in, 1
 syllogi.xyz, 1
 sylvaindurand.fr, 1
 sylvaindurand.org, 1
+sylvan.me, 1
+sylvangarden.net, 1
 sylve.ch, 1
 symb.ch, 1
 symbiose-bien-etre.ch, 1
@@ -24051,6 +24046,7 @@ teixobactin.com, 1
 tekiro.com, 1
 teknemodus.com.au, 1
 teknik.io, 1
+teknogeek.id, 1
 tekstschrijvers.net, 1
 tektoria.de, 0
 tektuts.com, 1
@@ -24156,7 +24152,6 @@ testpornsite.com, 1
 testsuite.org, 1
 testuje.net, 1
 tetedelacourse.ch, 1
-tetramax.eu, 1
 tetrarch.co, 1
 tetsugakunomichi.jp, 1
 tetsumaki.net, 1
@@ -24357,6 +24352,7 @@ theocharis.org, 1
 theodorahome.co, 1
 theodorahome.com.br, 1
 theofleck.com, 1
+theojones.name, 1
 theokonst.tk, 1
 theokouzelis.com, 1
 theoldbrewhouse.info, 1
@@ -24410,7 +24406,6 @@ theschool.jp, 1
 thescientists.nl, 1
 thesearchnerds.co.uk, 1
 thesecondsposts.com, 1
-thesecurityteam.net, 1
 theseed.io, 1
 theseedbox.xyz, 1
 thesehighsandlows.com, 1
@@ -24504,9 +24499,9 @@ thomasvt.xyz, 1
 thomaswoo.com, 1
 thompsonfamily.cloud, 1
 thomsonscleaning.co.uk, 1
+thomspooren.nl, 1
 thomwiggers.nl, 1
 thor.edu, 1
-thorbis.com, 1
 thorbiswebsitedesign.com, 1
 thorsten-schaefer.com, 1
 thorstenschaefer.name, 1
@@ -24555,8 +24550,6 @@ tianshili.me, 1
 tianxicaipiao.com, 1
 tianxicaipiao.win, 1
 tianxicp.com, 1
-tianxing.pro, 1
-tianxingvpn.pro, 1
 tianya.tv, 1
 tibipg.com, 1
 tibovanheule.site, 1
@@ -24667,6 +24660,7 @@ tittelbach.at, 0
 titusetcompagnies.net, 1
 tivido.nl, 1
 tjandpals.com, 1
+tjeckien.guide, 1
 tjenestetorvet.dk, 1
 tjl.rocks, 1
 tjp.ch, 1
@@ -24679,7 +24673,6 @@ tkjg.fi, 1
 tkn.tokyo, 1
 tkts.cl, 1
 tkusano.jp, 1
-tlach.cz, 1
 tlehseasyads.com, 1
 tlo.xyz, 1
 tloxygen.com, 1
@@ -24768,7 +24761,6 @@ tokic.hr, 1
 tokio.fi, 1
 tokke.dk, 1
 tokkee.org, 1
-tokobungadijambi.com, 1
 tokoindo.top, 1
 tokotimbangandigitalmurah.web.id, 0
 tokototech.com, 1
@@ -24849,7 +24841,6 @@ tonermaus.de, 1
 tonermonster.de, 1
 tonex.de, 1
 tonex.nl, 1
-tongmu.me, 1
 tonkinson.com, 1
 tonkinwilsonvillenissanparts.com, 1
 tonsit.com, 1
@@ -24911,7 +24902,6 @@ torprojects.com, 1
 torquato.de, 0
 torrent.fedoraproject.org, 1
 torrent.is, 1
-torrentpier.me, 1
 torrenttop100.net, 1
 torrentz2.eu, 1
 torresygutierrez.com, 1
@@ -25303,7 +25293,9 @@ tupeuxpastest.ch, 1
 tupizm.com, 1
 turbobit.ch, 1
 turismo.cl, 1
+turkiet.guide, 1
 turkish.dating, 1
+turn-sticks.com, 1
 turncircles.com, 1
 turnoffthelights.com, 1
 turnonsocial.com, 1
@@ -25322,6 +25314,7 @@ tutorio.ga, 1
 tuts4you.com, 1
 tuttimundi.org, 1
 tuttoandroid.net, 1
+tuxcloud.net, 1
 tuxflow.de, 1
 tuxgeo.com, 0
 tuxhound.org, 1
@@ -25408,6 +25401,7 @@ tyroremotes.eu, 1
 tyroremotes.fr, 1
 tyroremotes.nl, 1
 tyroremotes.no, 1
+tyskland.guide, 1
 tysox.de, 1
 tysye.ca, 1
 tyuo-keibi.co.jp, 1
@@ -25432,6 +25426,7 @@ uberboxen.net, 1
 ubertt.org, 1
 uberwald.de, 1
 uberwald.ws, 1
+ubi.gg, 1
 ubicv.com, 1
 ubineering.de, 1
 ublaboo.org, 1
@@ -25526,7 +25521,6 @@ undercovercondoms.com, 1
 underkin.com, 1
 underlined.fr, 1
 undernet.uy, 0
-underskatten.tk, 1
 undo.co.il, 1
 undone.me, 1
 unearaigneeauplafond.fr, 0
@@ -25537,6 +25531,7 @@ unfettered.net, 0
 unfuddle.cn, 1
 unga.dk, 1
 ungegamere.dk, 1
+ungern.guide, 1
 unhu.fr, 1
 uni2share.com, 1
 unicef-karten.at, 1
@@ -25675,7 +25670,6 @@ urbanietz-immobilien.de, 1
 urbanmelbourne.info, 1
 urbannewsservice.com, 1
 urbansparrow.in, 1
-urbanstylestaging.com, 1
 urbanwildlifealliance.org, 1
 urbexdk.nl, 1
 urcentral.com, 1
@@ -25819,7 +25813,6 @@ valsk.is, 1
 valskis.lt, 1
 valtoaho.com, 1
 valueseed.net, 1
-vamoaeturismo.com.br, 1
 van11y.net, 1
 vanajahosting.com, 1
 vanbinnenuit.nl, 1
@@ -26073,7 +26066,6 @@ villasforsale-bali.com, 1
 villek.fi, 1
 villenavedornon.fr, 1
 vilog.me, 1
-viltsu.net, 1
 vima.ch, 1
 vimeo.com, 1
 vimeosucks.nyc, 1
@@ -26211,6 +26203,7 @@ vogt.tech, 1
 voice-of-design.com, 1
 voicu.ch, 1
 void-it.nl, 1
+void-zero.com, 1
 voidi.ca, 1
 voidptr.eu, 1
 voidserv.net, 1
@@ -26336,7 +26329,6 @@ wadsworth.gallery, 1
 wadvisor.com, 1
 waelisch.de, 1
 waelti.xxx, 1
-wafairhaven.com.au, 1
 waffle.at, 1
 wafni.com, 1
 wahidhasan.com, 1
@@ -26411,6 +26403,7 @@ wassim.is, 1
 wastrel.ch, 1
 watashi.bid, 1
 watch-wiki.org, 1
+watchface.watch, 1
 watchfreeonline.co.uk, 1
 watchinventory.com, 1
 watchstyle.com, 1
@@ -26419,7 +26412,6 @@ waterfedpole.com, 1
 watermonitor.gov, 1
 watertrails.io, 1
 watsonwork.me, 1
-wattechweb.com, 1
 wave-ola.es, 1
 wavesboardshop.com, 1
 wavesoftime.com, 1
@@ -26460,6 +26452,7 @@ wearepapermill.co, 1
 wearesouthafricans.com, 1
 wearewithyou.org, 1
 wearvr.com, 1
+weather-and-climate.com, 0
 weathermyway.rocks, 1
 web-design.co.il, 1
 web-hotel.gr, 1
@@ -26480,6 +26473,7 @@ webart-factory.de, 1
 webbhuset.se, 0
 webbiz.co.uk, 1
 webbson.net, 1
+webbx.se, 1
 webcamtoy.com, 1
 webcatechism.com, 1
 webcollect.org.uk, 1
@@ -26545,7 +26539,6 @@ webseitendesigner.com, 0
 webseitenserver.com, 1
 websenat.de, 1
 websharks.org, 1
-websiteadvice.com.au, 1
 websitedesign.bg, 1
 websiteforlease.ca, 1
 websitesdallas.com, 1
@@ -26996,6 +26989,7 @@ wolfy1339.com, 1
 wolkenspeicher.org, 1
 wollekorb.de, 1
 wollwerk.org, 1
+womb.city, 1
 wombatalla.com.au, 1
 wombats.net, 1
 women-only.net, 1
@@ -27128,7 +27122,6 @@ wscales.com, 1
 wscbiolo.id, 1
 wsdcap.com, 1
 wsdcapital.com, 1
-wsdezign.com, 0
 wselektro.de, 1
 wsgvet.com, 1
 wss.com.ve, 1
@@ -27143,7 +27136,6 @@ wtfismyip.com, 1
 wth.in, 1
 wtpmj.com, 1
 wubify.com, 1
-wubocong.com, 1
 wuchipc.com, 1
 wuetix.de, 1
 wug.jp, 1
@@ -27245,6 +27237,7 @@ wypemagazine.se, 1
 wyssmuller.ch, 1
 wyzphoto.nl, 1
 wyzwaniemilosci.com, 1
+wzrd.in, 1
 wzyboy.org, 1
 x-iweb.ru, 1
 x-lan.be, 1
@@ -27289,7 +27282,6 @@ xenoworld.de, 1
 xeonlab.com, 1
 xeonlab.de, 1
 xerblade.com, 1
-xerhost.de, 0
 xetown.com, 1
 xfd3.de, 1
 xferion.com, 1
@@ -27385,7 +27377,6 @@ xn--i2ru8q2qg.com, 1
 xn--internetlnen-1cb.com, 1
 xn--jbs-tna.de, 1
 xn--jda.tk, 1
-xn--jp-6l5cs1yf3ivjsglphyv.net, 1
 xn--jp8hx8f.ws, 1
 xn--jywq5uqwqxhd2onsij.jp, 1
 xn--kda.tk, 1
@@ -27602,6 +27593,7 @@ yemekbaz.az, 1
 yep-pro.ch, 1
 yepbitcoin.com, 1
 yesfone.com.br, 1
+yesiammaisey.me, 1
 yesonline.asia, 0
 yesonline.me, 0
 yeswehack.com, 1
@@ -27615,6 +27607,7 @@ yhb.io, 1
 yhori.xyz, 1
 yii2.cc, 1
 yikeyong.com, 1
+yin8888.tv, 1
 yinfor.com, 1
 ying299.com, 1
 ying299.net, 1
@@ -27660,7 +27653,6 @@ yomena.in, 1
 yoonas.com, 1
 yooooex.com, 1
 yopers.com, 1
-yoramvandevelde.net, 1
 yorcom.nl, 0
 yorkshireterrier.com.br, 1
 yorname.ml, 1
@@ -27811,6 +27803,7 @@ zabszk.net, 1
 zacarias.com.ar, 1
 zacavi.com.br, 1
 zachborboa.com, 1
+zachgibbens.org, 1
 zachpeters.org, 1
 zaclys.com, 1
 zadarkside.ro, 1

From d08b24e613cac8c9c5a4131452459241010701e0 Mon Sep 17 00:00:00 2001
From: ffxbld <none@none>
Date: Tue, 19 Sep 2017 10:33:25 -0700
Subject: [PATCH 83/83] No bug, Automated HPKP preload list update from host
 bld-linux64-spot-304 - a=hpkp-update

---
 security/manager/ssl/StaticHPKPins.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/manager/ssl/StaticHPKPins.h b/security/manager/ssl/StaticHPKPins.h
index 0a19d63fbfc7..f8b7c49ed4b4 100644
--- a/security/manager/ssl/StaticHPKPins.h
+++ b/security/manager/ssl/StaticHPKPins.h
@@ -1140,4 +1140,4 @@ static const TransportSecurityPreload kPublicKeyPinningPreloadList[] = {
 
 static const int32_t kUnknownId = -1;
 
-static const PRTime kPreloadPKPinsExpirationTime = INT64_C(1514223123051000);
+static const PRTime kPreloadPKPinsExpirationTime = INT64_C(1514309412515000);