From abdda6fd968829b3f96e2030893f1e626ad4442b Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Tue, 16 Jun 2015 08:50:35 -0700
Subject: [PATCH 1/9] Bug 1174712 - Tolerate singleton objects with uncacheable
 prototypes in Ion caches, r=jandem.

---
 js/src/jit/IonCaches.cpp | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/js/src/jit/IonCaches.cpp b/js/src/jit/IonCaches.cpp
index a86eb30b831c..75b61175e96d 100644
--- a/js/src/jit/IonCaches.cpp
+++ b/js/src/jit/IonCaches.cpp
@@ -424,10 +424,16 @@ GeneratePrototypeGuards(JSContext* cx, IonScript* ion, MacroAssembler& masm, JSO
         return;
     while (pobj != holder) {
         if (pobj->hasUncacheableProto()) {
-            MOZ_ASSERT(!pobj->isSingleton());
             masm.movePtr(ImmGCPtr(pobj), scratchReg);
             Address groupAddr(scratchReg, JSObject::offsetOfGroup());
-            masm.branchPtr(Assembler::NotEqual, groupAddr, ImmGCPtr(pobj->group()), failures);
+            if (pobj->isSingleton()) {
+                // Singletons can have their group's |proto| mutated directly.
+                masm.loadPtr(groupAddr, scratchReg);
+                Address protoAddr(scratchReg, ObjectGroup::offsetOfProto());
+                masm.branchPtr(Assembler::NotEqual, protoAddr, ImmGCPtr(pobj->getProto()), failures);
+            } else {
+                masm.branchPtr(Assembler::NotEqual, groupAddr, ImmGCPtr(pobj->group()), failures);
+            }
         }
         pobj = pobj->getProto();
     }

From cc43ed138508c5bde3921b9789067ce2dcbe548b Mon Sep 17 00:00:00 2001
From: Bobby Holley <bobbyholley@gmail.com>
Date: Mon, 15 Jun 2015 18:35:12 -0700
Subject: [PATCH 2/9] Bug 1174971 - Introduce two variants of
 getOwnPropertyFromTargetIfSafe. r=gabor,r=arai

---
 js/xpconnect/wrappers/XrayWrapper.cpp | 34 ++++++++++++++++-----------
 js/xpconnect/wrappers/XrayWrapper.h   |  7 ++++++
 2 files changed, 27 insertions(+), 14 deletions(-)

diff --git a/js/xpconnect/wrappers/XrayWrapper.cpp b/js/xpconnect/wrappers/XrayWrapper.cpp
index 9ff580e608f9..9922a45b391d 100644
--- a/js/xpconnect/wrappers/XrayWrapper.cpp
+++ b/js/xpconnect/wrappers/XrayWrapper.cpp
@@ -263,6 +263,21 @@ ReportWrapperDenial(JSContext* cx, HandleId id, WrapperDenialType type, const ch
     return true;
 }
 
+bool JSXrayTraits::getOwnPropertyFromWrapperIfSafe(JSContext* cx,
+                                                   HandleObject wrapper,
+                                                   HandleId id,
+                                                   MutableHandle<JSPropertyDescriptor> outDesc)
+{
+    MOZ_ASSERT(js::IsObjectInContextCompartment(wrapper, cx));
+    RootedObject target(cx, getTargetObject(wrapper));
+    {
+        JSAutoCompartment ac(cx, target);
+        if (!getOwnPropertyFromTargetIfSafe(cx, target, wrapper, id, outDesc))
+            return false;
+    }
+    return JS_WrapPropertyDescriptor(cx, outDesc);
+}
+
 bool JSXrayTraits::getOwnPropertyFromTargetIfSafe(JSContext* cx,
                                                   HandleObject target,
                                                   HandleObject wrapper,
@@ -376,12 +391,7 @@ JSXrayTraits::resolveOwnProperty(JSContext* cx, const Wrapper& jsWrapper,
         // "should" look like over Xrays, the underlying object is squishy enough
         // that it makes sense to just treat them like Objects for Xray purposes.
         if (key == JSProto_Object || key == JSProto_Array) {
-            {
-                JSAutoCompartment ac(cx, target);
-                if (!getOwnPropertyFromTargetIfSafe(cx, target, wrapper, id, desc))
-                    return false;
-            }
-            return JS_WrapPropertyDescriptor(cx, desc);
+            return getOwnPropertyFromWrapperIfSafe(cx, wrapper, id, desc);
         } else if (IsTypedArrayKey(key)) {
             if (IsArrayIndex(GetArrayIndexFromId(cx, id))) {
                 JS_ReportError(cx, "Accessing TypedArray data over Xrays is slow, and forbidden "
@@ -444,10 +454,8 @@ JSXrayTraits::resolveOwnProperty(JSContext* cx, const Wrapper& jsWrapper,
                 return true;
             }
         } else if (key == JSProto_RegExp) {
-            if (id == GetRTIdByIndex(cx, XPCJSRuntime::IDX_LASTINDEX)) {
-                JSAutoCompartment ac(cx, target);
-                return getOwnPropertyFromTargetIfSafe(cx, target, wrapper, id, desc);
-            }
+            if (id == GetRTIdByIndex(cx, XPCJSRuntime::IDX_LASTINDEX))
+                return getOwnPropertyFromWrapperIfSafe(cx, wrapper, id, desc);
         }
 
         // The rest of this function applies only to prototypes.
@@ -493,10 +501,8 @@ JSXrayTraits::resolveOwnProperty(JSContext* cx, const Wrapper& jsWrapper,
     }
 
     // Handle the 'lastIndex' property for RegExp prototypes.
-    if (key == JSProto_RegExp && id == GetRTIdByIndex(cx, XPCJSRuntime::IDX_LASTINDEX)) {
-        JSAutoCompartment ac(cx, target);
-        return getOwnPropertyFromTargetIfSafe(cx, target, wrapper, id, desc);
-    }
+    if (key == JSProto_RegExp && id == GetRTIdByIndex(cx, XPCJSRuntime::IDX_LASTINDEX))
+        return getOwnPropertyFromWrapperIfSafe(cx, wrapper, id, desc);
 
     // Grab the JSClass. We require all Xrayable classes to have a ClassSpec.
     const js::Class* clasp = js::GetObjectClass(target);
diff --git a/js/xpconnect/wrappers/XrayWrapper.h b/js/xpconnect/wrappers/XrayWrapper.h
index 29e6b8726b3e..c6e6bd79ba29 100644
--- a/js/xpconnect/wrappers/XrayWrapper.h
+++ b/js/xpconnect/wrappers/XrayWrapper.h
@@ -313,6 +313,13 @@ public:
         return static_cast<JSProtoKey>(key);
     }
 
+    // Operates in the wrapper compartment.
+    static bool getOwnPropertyFromWrapperIfSafe(JSContext* cx,
+                                                JS::HandleObject wrapper,
+                                                JS::HandleId id,
+                                                JS::MutableHandle<JSPropertyDescriptor> desc);
+
+    // Like the above, but operates in the target compartment.
     static bool getOwnPropertyFromTargetIfSafe(JSContext* cx,
                                                JS::HandleObject target,
                                                JS::HandleObject wrapper,

From 75de7c95ec72434a0d38421f24424e427cbf88f4 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Tue, 16 Jun 2015 12:17:57 -0400
Subject: [PATCH 3/9] Bug 1165851 part 1.  Back out bug 1060938 and bug 1075702
 pending spec changes because they are implementing a spec that's not web
 compatible.  r=smaug

---
 dom/base/Attr.cpp                  |  4 +-
 dom/base/Element.cpp               |  4 +-
 dom/base/nsDOMAttributeMap.cpp     | 85 ++++++++++++++----------------
 dom/base/nsDOMAttributeMap.h       |  2 -
 dom/base/test/mochitest.ini        |  2 -
 dom/base/test/test_bug1060938.html | 44 ----------------
 dom/base/test/test_bug1075702.html | 69 ------------------------
 dom/base/test/test_bug469304.html  | 36 ++++++-------
 8 files changed, 60 insertions(+), 186 deletions(-)
 delete mode 100644 dom/base/test/test_bug1060938.html
 delete mode 100644 dom/base/test/test_bug1075702.html

diff --git a/dom/base/Attr.cpp b/dom/base/Attr.cpp
index 5fcec09247ee..95fceeae52e7 100644
--- a/dom/base/Attr.cpp
+++ b/dom/base/Attr.cpp
@@ -184,7 +184,7 @@ Attr::GetValue(nsAString& aValue)
 {
   Element* element = GetElement();
   if (element) {
-    nsCOMPtr<nsIAtom> nameAtom = mNodeInfo->NameAtom();
+    nsCOMPtr<nsIAtom> nameAtom = GetNameAtom(element);
     element->GetAttr(mNodeInfo->NamespaceID(), nameAtom, aValue);
   }
   else {
@@ -203,7 +203,7 @@ Attr::SetValue(const nsAString& aValue, ErrorResult& aRv)
     return;
   }
 
-  nsCOMPtr<nsIAtom> nameAtom = mNodeInfo->NameAtom();
+  nsCOMPtr<nsIAtom> nameAtom = GetNameAtom(element);
   aRv = element->SetAttr(mNodeInfo->NamespaceID(),
                          nameAtom,
                          mNodeInfo->GetPrefixAtom(),
diff --git a/dom/base/Element.cpp b/dom/base/Element.cpp
index 4799eff73276..b9c275141a0d 100644
--- a/dom/base/Element.cpp
+++ b/dom/base/Element.cpp
@@ -1235,9 +1235,7 @@ Element::RemoveAttributeNode(Attr& aAttribute,
   }
 
   OwnerDoc()->WarnOnceAbout(nsIDocument::eRemoveAttributeNode);
-  nsAutoString nameSpaceURI;
-  aAttribute.NodeInfo()->GetNamespaceURI(nameSpaceURI);
-  return Attributes()->RemoveNamedItemNS(nameSpaceURI, aAttribute.NodeInfo()->LocalName(), aError);
+  return Attributes()->RemoveNamedItem(aAttribute.NodeName(), aError);
 }
 
 void
diff --git a/dom/base/nsDOMAttributeMap.cpp b/dom/base/nsDOMAttributeMap.cpp
index 1022aabdc69a..7f94a66ed556 100644
--- a/dom/base/nsDOMAttributeMap.cpp
+++ b/dom/base/nsDOMAttributeMap.cpp
@@ -300,51 +300,46 @@ nsDOMAttributeMap::SetNamedItemInternal(Attr& aAttr,
   }
 
   // Get nodeinfo and preexisting attribute (if it exists)
-  nsRefPtr<NodeInfo> oldNi;
-
-  if (!aWithNS) {
-    nsAutoString name;
-    aAttr.GetName(name);
-    oldNi = mContent->GetExistingAttrNameFromQName(name);
-  }
-  else {
-    uint32_t i, count = mContent->GetAttrCount();
-    for (i = 0; i < count; ++i) {
-      const nsAttrName* name = mContent->GetAttrNameAt(i);
-      int32_t attrNS = name->NamespaceID();
-      nsIAtom* nameAtom = name->LocalName();
-
-      // we're purposefully ignoring the prefix.
-      if (aAttr.NodeInfo()->Equals(nameAtom, attrNS)) {
-        oldNi = mContent->NodeInfo()->NodeInfoManager()->
-          GetNodeInfo(nameAtom, name->GetPrefix(), aAttr.NodeInfo()->NamespaceID(),
-                      nsIDOMNode::ATTRIBUTE_NODE);
-        break;
-      }
-    }
-  }
+  nsAutoString name;
+  nsRefPtr<mozilla::dom::NodeInfo> ni;
 
   nsRefPtr<Attr> attr;
+  // SetNamedItemNS()
+  if (aWithNS) {
+    // Return existing attribute, if present
+    ni = aAttr.NodeInfo();
 
-  if (oldNi) {
-    nsRefPtr<Attr> oldAttr = GetAttribute(oldNi, true);
-
-    if (oldAttr == &aAttr) {
-      return oldAttr.forget();
+    if (mContent->HasAttr(ni->NamespaceID(), ni->NameAtom())) {
+      attr = RemoveAttribute(ni);
     }
+  } else { // SetNamedItem()
+    aAttr.GetName(name);
 
-    if (oldAttr) {
-      attr = RemoveNamedItem(oldNi, aError);
-      NS_ASSERTION(attr->NodeInfo()->NameAndNamespaceEquals(oldNi),
-        "RemoveNamedItem() called, attr->NodeInfo() should be equal to oldNi!");
+    // get node-info of old attribute
+    ni = mContent->GetExistingAttrNameFromQName(name);
+    if (ni) {
+      attr = RemoveAttribute(ni);
+    }
+    else {
+      if (mContent->IsInHTMLDocument() &&
+          mContent->IsHTMLElement()) {
+        nsContentUtils::ASCIIToLower(name);
+      }
+
+      rv = mContent->NodeInfo()->NodeInfoManager()->
+        GetNodeInfo(name, nullptr, kNameSpaceID_None,
+                    nsIDOMNode::ATTRIBUTE_NODE, getter_AddRefs(ni));
+      if (NS_FAILED(rv)) {
+        aError.Throw(rv);
+        return nullptr;
+      }
+      // value is already empty
     }
   }
 
   nsAutoString value;
   aAttr.GetValue(value);
 
-  nsRefPtr<NodeInfo> ni = aAttr.NodeInfo();
-
   // Add the new attribute to the attribute map before updating
   // its value in the element. @see bug 364413.
   nsAttrKey attrkey(ni->NamespaceID(), ni->NameAtom());
@@ -361,15 +356,6 @@ nsDOMAttributeMap::SetNamedItemInternal(Attr& aAttr,
   return attr.forget();
 }
 
-already_AddRefed<Attr>
-nsDOMAttributeMap::RemoveNamedItem(NodeInfo* aNodeInfo, ErrorResult& aError)
-{
-  nsRefPtr<Attr> attribute = GetAttribute(aNodeInfo, true);
-  // This removes the attribute node from the attribute map.
-  aError = mContent->UnsetAttr(aNodeInfo->NamespaceID(), aNodeInfo->NameAtom(), true);
-  return attribute.forget();
-}
-
 NS_IMETHODIMP
 nsDOMAttributeMap::RemoveNamedItem(const nsAString& aName,
                                    nsIDOMAttr** aReturn)
@@ -395,7 +381,11 @@ nsDOMAttributeMap::RemoveNamedItem(const nsAString& aName, ErrorResult& aError)
     return nullptr;
   }
 
-  return RemoveNamedItem(ni, aError);
+  nsRefPtr<Attr> attribute = GetAttribute(ni, true);
+
+  // This removes the attribute node from the attribute map.
+  aError = mContent->UnsetAttr(ni->NamespaceID(), ni->NameAtom(), true);
+  return attribute.forget();
 }
 
 
@@ -493,7 +483,6 @@ nsDOMAttributeMap::GetAttrNodeInfo(const nsAString& aNamespaceURI,
     int32_t attrNS = name->NamespaceID();
     nsIAtom* nameAtom = name->LocalName();
 
-    // we're purposefully ignoring the prefix.
     if (nameSpaceID == attrNS &&
         nameAtom->Equals(aLocalName)) {
       nsRefPtr<mozilla::dom::NodeInfo> ni;
@@ -530,7 +519,11 @@ nsDOMAttributeMap::RemoveNamedItemNS(const nsAString& aNamespaceURI,
     return nullptr;
   }
 
-  return RemoveNamedItem(ni, aError);
+  nsRefPtr<Attr> attr = RemoveAttribute(ni);
+  mozilla::dom::NodeInfo* attrNi = attr->NodeInfo();
+  mContent->UnsetAttr(attrNi->NamespaceID(), attrNi->NameAtom(), true);
+
+  return attr.forget();
 }
 
 uint32_t
diff --git a/dom/base/nsDOMAttributeMap.h b/dom/base/nsDOMAttributeMap.h
index c52ee1f5b0af..f77a0615a766 100644
--- a/dom/base/nsDOMAttributeMap.h
+++ b/dom/base/nsDOMAttributeMap.h
@@ -152,8 +152,6 @@ public:
     return SetNamedItemInternal(aAttr, false, aError);
   }
   already_AddRefed<Attr>
-  RemoveNamedItem(mozilla::dom::NodeInfo* aNodeInfo, ErrorResult& aError);
-  already_AddRefed<Attr>
   RemoveNamedItem(const nsAString& aName, ErrorResult& aError);
  
   Attr* Item(uint32_t aIndex);
diff --git a/dom/base/test/mochitest.ini b/dom/base/test/mochitest.ini
index cb92be425c36..300abc0f9eb5 100644
--- a/dom/base/test/mochitest.ini
+++ b/dom/base/test/mochitest.ini
@@ -260,7 +260,6 @@ skip-if = buildapp == 'mulet'
 [test_bug999456.html]
 [test_bug1022229.html]
 [test_bug1043106.html]
-[test_bug1060938.html]
 [test_bug1064481.html]
 [test_clearTimeoutIntervalNoArg.html]
 [test_consoleEmptyStack.html]
@@ -666,7 +665,6 @@ skip-if = buildapp == 'mulet' || buildapp == 'b2g' || toolkit == 'android' || e1
 [test_bug982153.html]
 [test_bug1057176.html]
 [test_bug1070015.html]
-[test_bug1075702.html]
 [test_bug1101364.html]
 skip-if = buildapp == 'mulet' || buildapp == 'b2g' || toolkit == 'android'
 [test_bug1163743.html]
diff --git a/dom/base/test/test_bug1060938.html b/dom/base/test/test_bug1060938.html
deleted file mode 100644
index a93627e57285..000000000000
--- a/dom/base/test/test_bug1060938.html
+++ /dev/null
@@ -1,44 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=1060938
--->
-  <head>
-    <meta charset="utf-8">
-    <title> Test for Bug 1060938 </title>
-    <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"> </script>
-    <script type="application/javascript" src="/tests/SimpleTest/EventUtils.js"> </script>
-    <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-  </head>
-  <body>
-  <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1060938"> Mozilla Bug 1060938 </a>
-  <p id="display"></p>
-
-  <pre id="test">
-  <script type="application/javascript">
-
-    /** Test for Bug 1060938 **/
-    // test: Element.removeAttributeNode()
-
-    parent = document.getElementsByTagName("p")[0];
-    parent.setAttributeNS("www.test1.com", "ID", "Test1");
-    parent.setAttributeNS("www.test2.com", "Class", "Test2");
-    parent.setAttribute("id", "www.test3.com");
-    parent.className = "www.test4.com";
-
-    allAttributes = parent.attributes;
-
-    function removeAttr(iter){
-      var removed_attribute = allAttributes[0];
-      is(removed_attribute, parent.removeAttributeNode(removed_attribute),
-          "(" + iter + ")" + " Returned attribute and remove attribute should be same.");
-    }
-
-    removeAttr(1);
-    removeAttr(2);
-    removeAttr(3);
-    removeAttr(4);
-
-  </script>
-  </body>
-</html>
diff --git a/dom/base/test/test_bug1075702.html b/dom/base/test/test_bug1075702.html
deleted file mode 100644
index 02dfeaa8a068..000000000000
--- a/dom/base/test/test_bug1075702.html
+++ /dev/null
@@ -1,69 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=1075702
--->
-<head>
-  <meta charset="utf-8">
-  <title> Test for Bug 1075702 </title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"> </script>
-  <script type="application/javascript" src="/tests/SimpleTest/EventUtils.js"> </script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1075702"> Mozilla Bug 1075702 </a>
-<p id="display"></p>
-
-<pre id="test">
-<script type="application/javascript">
-
-  /** Test for Bug 1075702 **/
-  // test: Element.removeAttributeNode()
-
-  var a1 = document.createAttribute("aa");
-  a1.nodeValue = "lowercase";
-
-  var a2 = document.createAttribute("AA");
-  a2.nodeValue = "UPPERCASE";
-
-  document.documentElement.setAttributeNode(a1);
-  document.documentElement.setAttributeNode(a2);
-
-  is(document.documentElement.getAttributeNS("", "aa"), null, "Should be NULL!");
-  is(document.documentElement.getAttributeNS("", "AA"), "UPPERCASE", "Should be UPPERCASE!");
-
-  var removedNodeAccordingToEvent;
-
-  function mutationHandler(aEvent) {
-    removedNodeAccordingToEvent = aEvent.relatedNode;
-  }
-
-  var test1 = document.createElement("div");
-  test1.setAttribute("x", "y");
-  removedNodeAccordingToEvent = null;
-
-  function testremoveNamedItemNS() {
-    test1.addEventListener("DOMAttrModified", mutationHandler, true);
-    var removedNodeAccordingToRemoveNamedItemNS = test1.attributes.removeNamedItemNS(null, "x");
-    test1.removeEventListener("DOMAttrModified", mutationHandler, true);
-    is(removedNodeAccordingToEvent, removedNodeAccordingToRemoveNamedItemNS, "Node removed according to event is not same as node removed by removeNamedItemNS.");
-  }
-
-  testremoveNamedItemNS();
-
-  var test2 = document.createElement("div");
-  test2.setAttribute("x", "y");
-  removedNodeAccordingToEvent = null;
-
-  function testremoveNamedItem() {
-    test2.addEventListener("DOMAttrModified", mutationHandler, true);
-    var removedNodeAccordingToRemoveNamedItem = test2.attributes.removeNamedItem("x");
-    test2.removeEventListener("DOMAttrModified", mutationHandler, true);
-    is(removedNodeAccordingToEvent, removedNodeAccordingToRemoveNamedItem, "Node removed according to event is not same as node removed by removeNamedItem.");
-  }
-
-  testremoveNamedItem();
-
-</script>
-</body>
-</html>
diff --git a/dom/base/test/test_bug469304.html b/dom/base/test/test_bug469304.html
index 09a1ce9014bc..234e90256027 100644
--- a/dom/base/test/test_bug469304.html
+++ b/dom/base/test/test_bug469304.html
@@ -27,10 +27,8 @@ function testGetAttribute() {
   document.body.setAttributeNode(a1);
   document.body.setAttributeNode(a2);
   var log = document.getElementById("log");
-  is(document.body.getAttribute('aa'), null, "Attribute has the localName AA and not aa.");
-  is(document.body.getAttribute('AA'), null, "Attribute has the localName AA and not aa.");
-  is(document.body.getAttributeNS("", "aa"), null, "Attribute should have localName AA.");
-  is(document.body.getAttributeNS("", "AA"), "UPPERCASE", "Attribute should have value UPPERCASE!");
+  is(document.body.getAttribute('aa'), "UPPERCASE", "Wrong value (1)");
+  is(document.body.getAttribute('AA'), "UPPERCASE", "Wrong value (2)");
 
   var s = "";
   for (var i = 0; i < document.body.attributes.length; ++i) {
@@ -42,11 +40,13 @@ function testGetAttribute() {
   is(document.body.getAttributeNode("aa"), document.body.getAttributeNode("AA"),
      "Wrong node!");
 
-  document.body.getAttributeNodeNS("", "AA").nodeValue = "FOO";
-  is(document.body.getAttributeNS("", "AA"), "FOO", "Wrong value!");
+  document.body.getAttributeNode("AA").nodeValue = "FOO";
+  is(document.body.getAttribute("AA"), "FOO", "Wrong value!");
 
-  document.body.removeAttributeNode(document.body.getAttributeNodeNS("", "AA"));
+  document.body.removeAttributeNode(document.body.getAttributeNode("AA"));
+  ok(!document.body.hasAttribute("AA"), "Should not have attribute!");
   ok(!document.body.getAttributeNode("AA"), "Should not have attribute node!");
+  ok(!document.body.hasAttribute("aa"), "Should not have attribute!");
   ok(!document.body.getAttributeNode("aa"), "Should not have attribute node!");
 
   is(a2.nodeValue, "FOO", "Wrong value!");
@@ -54,10 +54,10 @@ function testGetAttribute() {
   is(a2.nodeValue, "UPPERCASE", "Wrong value!");
 
   document.body.setAttributeNode(a2);
-  is(document.body.getAttributeNS("", "AA"), "UPPERCASE", "Wrong value!");
-  ok(document.body.getAttributeNodeNS("", "AA"), "Should have attribute node!");
-  is(document.body.getAttributeNS("", "aa"), null, "No attribute has the localName aa.");
-  ok(!document.body.getAttributeNodeNS("", "aa"), "Should not have attribute node!");
+  is(document.body.getAttribute("AA"), "UPPERCASE", "wrong value!");
+  ok(document.body.getAttributeNode("AA"), "Should have attribute node!");
+  is(document.body.getAttribute("aa"), "UPPERCASE", "wrong value!");
+  ok(document.body.getAttributeNode("aa"), "Should have attribute node!");
 }
 testGetAttribute();
 
@@ -75,7 +75,7 @@ function testGetAttributeNodeMixedCase() {
   var a = div.ownerDocument.createAttribute("mixedCaseAttrib");
   a.nodeValue = "x";
   div.setAttributeNode(a);
-  return div.getAttributeNS("", "mixedCaseAttrib");
+  return div.getAttribute("mixedCaseAttrib");
 }
 is(testGetAttributeNodeMixedCase(), "x", "(2)");
 
@@ -114,7 +114,7 @@ function testAttribNodeNamePreservesCaseGetNode() {
   var a = body.ownerDocument.createAttribute("A");
   a.nodeValue = "x";
   body.setAttributeNode(a);
-  a = document.body.getAttributeNodeNS("", "A");
+  a = document.body.getAttributeNode("A");
   if (!a)
       return "FAIL";
   var result = [ a.name, a.nodeName ];
@@ -127,14 +127,14 @@ function testAttribNodeNamePreservesCaseGetNode2() {
   var a = body.ownerDocument.createAttribute("B");
   a.nodeValue = "x";
   body.setAttributeNode(a);
-  a = document.body.getAttributeNodeNS("", "B");
+  a = document.body.getAttributeNode("B");
   if (!a)
       return "FAIL";
   // Now create node second time
   a = body.ownerDocument.createAttribute("B");
   a.nodeValue = "x";
   body.setAttributeNode(a);
-  a = document.body.getAttributeNodeNS("", "B");
+  a = document.body.getAttributeNode("B");
   var result = [ a.name, a.nodeName ];
   return result.join(",");
 }
@@ -158,9 +158,9 @@ attrib.nodeValue = "XXX";
 node.setAttributeNode(attrib);
 // Note, this is different to what WebKit does
 is((new XMLSerializer).serializeToString(node),
-   "<div xmlns=\"http://www.w3.org/1999/xhtml\" myAttrib=\"XXX\"></div>", "(9)");
-is(node.getAttributeNodeNS("", "myAttrib").name, "myAttrib", "(10)");
-is(node.getAttributeNodeNS("", "myattrib"), null, "(11)");
+   "<div xmlns=\"http://www.w3.org/1999/xhtml\" myattrib=\"XXX\"></div>", "(9)");
+is(node.getAttributeNode('myAttrib').name, "myAttrib", "(10)");
+is(node.getAttributeNode('myattrib').name, "myAttrib", "(11)");
 is(attrib.name, "myAttrib", "(12)");
 
 var o = document.createElement("div");

From ffcc1e5e8dabb260f4fc8407eadb6e92f60a5450 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Tue, 16 Jun 2015 12:18:00 -0400
Subject: [PATCH 4/9] Bug 1165851 part 2.  Add a test for the desired
 createAttribute/getAttribute behavior.  r=smaug

---
 dom/base/test/mochitest.ini                       |  1 +
 .../test_getAttribute_after_createAttribute.html  | 15 +++++++++++++++
 2 files changed, 16 insertions(+)
 create mode 100644 dom/base/test/test_getAttribute_after_createAttribute.html

diff --git a/dom/base/test/mochitest.ini b/dom/base/test/mochitest.ini
index 300abc0f9eb5..b256fb1a14e7 100644
--- a/dom/base/test/mochitest.ini
+++ b/dom/base/test/mochitest.ini
@@ -787,6 +787,7 @@ skip-if = buildapp == 'mulet' || buildapp == 'b2g'
 [test_bug1118689.html]
 skip-if = buildapp == 'mulet' || buildapp == 'b2g'
 [test_integer_attr_with_leading_zero.html]
+[test_getAttribute_after_createAttribute.html]
 [test_script_loader_crossorigin_data_url.html]
 [test_file_negative_date.html]
 [test_nonascii_blob_url.html]
diff --git a/dom/base/test/test_getAttribute_after_createAttribute.html b/dom/base/test/test_getAttribute_after_createAttribute.html
new file mode 100644
index 000000000000..5e2f4ec30698
--- /dev/null
+++ b/dom/base/test/test_getAttribute_after_createAttribute.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<title>Test for ...</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+test(function() {
+   var div = document.createElement("div");
+   var attr = document.createAttribute("FOO");
+   attr.value = "bar";
+   div.setAttributeNode(attr);
+   assert_equals(div.getAttribute("FOO"), "bar");
+}, "getAttribute should be able to get an attribute created via createAttribute");
+</script>

From 13e1b690407531ac35d349a4e2879d5d19f8455d Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Tue, 16 Jun 2015 12:18:17 -0400
Subject: [PATCH 5/9] Bug 1173913.  Indicate what webidl generated files were
 generated from, if they were generated for a particular webidl file. 
 r=peterv

---
 dom/bindings/Codegen.py | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index 8ef745c2f64c..f8f2193f3fc6 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -15,7 +15,9 @@ from WebIDL import BuiltinTypes, IDLBuiltinType, IDLNullValue, IDLSequenceType,
 from Configuration import NoSuchDescriptorError, getTypesFromDescriptor, getTypesFromDictionary, getTypesFromCallback, getAllTypes, Descriptor, MemberIsUnforgeable
 
 AUTOGENERATED_WARNING_COMMENT = \
-    "/* THIS FILE IS AUTOGENERATED - DO NOT EDIT */\n\n"
+    "/* THIS FILE IS AUTOGENERATED BY Codegen.py - DO NOT EDIT */\n\n"
+AUTOGENERATED_WITH_SOURCE_WARNING_COMMENT = \
+    "/* THIS FILE IS AUTOGENERATED FROM %s BY Codegen.py - DO NOT EDIT */\n\n"
 ADDPROPERTY_HOOK_NAME = '_addProperty'
 FINALIZE_HOOK_NAME = '_finalize'
 OBJECT_MOVED_HOOK_NAME = '_objectMoved'
@@ -12708,7 +12710,10 @@ class CGBindingRoot(CGThing):
         curr = CGIncludeGuard(prefix, curr)
 
         # Add the auto-generated comment.
-        curr = CGWrapper(curr, pre=AUTOGENERATED_WARNING_COMMENT)
+        curr = CGWrapper(
+            curr,
+            pre=(AUTOGENERATED_WITH_SOURCE_WARNING_COMMENT %
+                 os.path.basename(webIDLFile)))
 
         # Store the final result.
         self.root = curr
@@ -15382,7 +15387,10 @@ class CGEventRoot(CGThing):
         # And now some include guards
         self.root = CGIncludeGuard(interfaceName, self.root)
 
-        self.root = CGWrapper(self.root, pre=AUTOGENERATED_WARNING_COMMENT)
+        self.root = CGWrapper(
+            self.root,
+            pre=(AUTOGENERATED_WITH_SOURCE_WARNING_COMMENT %
+                 os.path.basename(descriptor.interface.filename())))
 
         self.root = CGWrapper(self.root, pre=dedent("""
             /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */

From 83d61e27879117774a7f7162bef8d60c8c7a1827 Mon Sep 17 00:00:00 2001
From: Ralph Giles <giles@mozilla.com>
Date: Mon, 15 Jun 2015 08:53:00 -0700
Subject: [PATCH 6/9] Bug 1174356 - Add missing MediaData include. r=jya

Needed for separate compilation of MP4Metadata.h in unit tests.

--HG--
extra : rebase_source : 13d6298ff6a5e6706ab42a8d6fe2cadb15dba631
---
 media/libstagefright/binding/include/mp4_demuxer/Index.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/media/libstagefright/binding/include/mp4_demuxer/Index.h b/media/libstagefright/binding/include/mp4_demuxer/Index.h
index b8d27b1d6666..9f8babf2754a 100644
--- a/media/libstagefright/binding/include/mp4_demuxer/Index.h
+++ b/media/libstagefright/binding/include/mp4_demuxer/Index.h
@@ -5,6 +5,7 @@
 #ifndef INDEX_H_
 #define INDEX_H_
 
+#include "MediaData.h"
 #include "MediaResource.h"
 #include "mozilla/Monitor.h"
 #include "mp4_demuxer/Interval.h"

From be1dbef6699485cda2326c768a1d8750dfcdc76a Mon Sep 17 00:00:00 2001
From: Valentin Gosu <valentin.gosu@gmail.com>
Date: Tue, 16 Jun 2015 19:46:18 +0300
Subject: [PATCH 7/9] Bug 1093611 - Stage 2 - Tests that hash getters don't do
 percent decoding r=smaug

---
 dom/base/test/test_url.html                                  | 2 +-
 dom/workers/test/urlApi_worker.js                            | 2 +-
 .../meta/workers/WorkerLocation_hash_encoding.htm.ini        | 5 -----
 3 files changed, 2 insertions(+), 7 deletions(-)
 delete mode 100644 testing/web-platform/meta/workers/WorkerLocation_hash_encoding.htm.ini

diff --git a/dom/base/test/test_url.html b/dom/base/test/test_url.html
index f498bb4da761..572f9aeb0780 100644
--- a/dom/base/test/test_url.html
+++ b/dom/base/test/test_url.html
@@ -116,7 +116,7 @@
     { url: 'http://example.com/carrot#question%3f',
       base: undefined,
       error: false,
-      hash: '#question?'
+      hash: '#question%3f'
     },
     { url: 'https://example.com:4443?',
       base: undefined,
diff --git a/dom/workers/test/urlApi_worker.js b/dom/workers/test/urlApi_worker.js
index 0fb3ae1c9eb0..a8b88e046fa3 100644
--- a/dom/workers/test/urlApi_worker.js
+++ b/dom/workers/test/urlApi_worker.js
@@ -111,7 +111,7 @@ onmessage = function() {
     { url: 'http://example.com/carrot#question%3f',
       base: undefined,
       error: false,
-      hash: '#question?'
+      hash: '#question%3f'
     },
     { url: 'https://example.com:4443?',
       base: undefined,
diff --git a/testing/web-platform/meta/workers/WorkerLocation_hash_encoding.htm.ini b/testing/web-platform/meta/workers/WorkerLocation_hash_encoding.htm.ini
deleted file mode 100644
index f285c02dbe37..000000000000
--- a/testing/web-platform/meta/workers/WorkerLocation_hash_encoding.htm.ini
+++ /dev/null
@@ -1,5 +0,0 @@
-[WorkerLocation_hash_encoding.htm]
-  type: testharness
-  [ WorkerLocation.hash with url encoding string ]
-    expected: FAIL
-

From c852d75d5c5f70cfafb554e0e64237cad96adac6 Mon Sep 17 00:00:00 2001
From: Valentin Gosu <valentin.gosu@gmail.com>
Date: Tue, 16 Jun 2015 19:46:31 +0300
Subject: [PATCH 8/9] Bug 1093611 - Stage 2 - Make hash getters not do percent
 decoding if dom.url.getters_decode_hash is false r=smaug

---
 dom/base/Link.cpp             | 2 +-
 dom/base/URL.cpp              | 2 +-
 dom/base/nsContentUtils.cpp   | 4 ++++
 dom/base/nsContentUtils.h     | 9 +++++++++
 dom/base/nsLocation.cpp       | 2 +-
 dom/workers/WorkerPrivate.cpp | 2 +-
 modules/libpref/init/all.js   | 2 ++
 7 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/dom/base/Link.cpp b/dom/base/Link.cpp
index d9881aec2f0d..856f3e329654 100644
--- a/dom/base/Link.cpp
+++ b/dom/base/Link.cpp
@@ -444,7 +444,7 @@ Link::GetHash(nsAString &_hash, ErrorResult& aError)
   nsresult rv = uri->GetRef(ref);
   if (NS_SUCCEEDED(rv) && !ref.IsEmpty()) {
     _hash.Assign(char16_t('#'));
-    if (nsContentUtils::EncodeDecodeURLHash()) {
+    if (nsContentUtils::GettersDecodeURLHash()) {
       NS_UnescapeURL(ref); // XXX may result in random non-ASCII bytes!
     }
     AppendUTF8toUTF16(ref, _hash);
diff --git a/dom/base/URL.cpp b/dom/base/URL.cpp
index 5ab46d5fd99c..438c3ddfd221 100644
--- a/dom/base/URL.cpp
+++ b/dom/base/URL.cpp
@@ -525,7 +525,7 @@ URL::GetHash(nsAString& aHash, ErrorResult& aRv) const
   nsresult rv = mURI->GetRef(ref);
   if (NS_SUCCEEDED(rv) && !ref.IsEmpty()) {
     aHash.Assign(char16_t('#'));
-    if (nsContentUtils::EncodeDecodeURLHash()) {
+    if (nsContentUtils::GettersDecodeURLHash()) {
       NS_UnescapeURL(ref); // XXX may result in random non-ASCII bytes!
     }
     AppendUTF8toUTF16(ref, aHash);
diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp
index 1ab2db68db32..a55084531b36 100644
--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@@ -255,6 +255,7 @@ bool nsContentUtils::sIsResourceTimingEnabled = false;
 bool nsContentUtils::sIsUserTimingLoggingEnabled = false;
 bool nsContentUtils::sIsExperimentalAutocompleteEnabled = false;
 bool nsContentUtils::sEncodeDecodeURLHash = false;
+bool nsContentUtils::sGettersDecodeURLHash = false;
 bool nsContentUtils::sPrivacyResistFingerprinting = false;
 
 uint32_t nsContentUtils::sHandlingInputTimeout = 1000;
@@ -537,6 +538,9 @@ nsContentUtils::Init()
   Preferences::AddBoolVarCache(&sEncodeDecodeURLHash,
                                "dom.url.encode_decode_hash", false);
 
+  Preferences::AddBoolVarCache(&sGettersDecodeURLHash,
+                               "dom.url.getters_decode_hash", false);
+
   Preferences::AddBoolVarCache(&sPrivacyResistFingerprinting,
                                "privacy.resistFingerprinting", false);
 
diff --git a/dom/base/nsContentUtils.h b/dom/base/nsContentUtils.h
index 5104cc3a9dc9..14bd6cb8d67b 100644
--- a/dom/base/nsContentUtils.h
+++ b/dom/base/nsContentUtils.h
@@ -1942,6 +1942,14 @@ public:
     return sEncodeDecodeURLHash;
   }
 
+  /*
+   * Returns true if URL getters should percent decode the value of the segment
+   */
+  static bool GettersDecodeURLHash()
+  {
+    return sGettersDecodeURLHash && sEncodeDecodeURLHash;
+  }
+
   /*
    * Returns true if the browser should attempt to prevent content scripts
    * from collecting distinctive information about the browser that could
@@ -2492,6 +2500,7 @@ private:
   static bool sIsUserTimingLoggingEnabled;
   static bool sIsExperimentalAutocompleteEnabled;
   static bool sEncodeDecodeURLHash;
+  static bool sGettersDecodeURLHash;
   static bool sPrivacyResistFingerprinting;
 
   static nsHtml5StringParser* sHTMLFragmentParser;
diff --git a/dom/base/nsLocation.cpp b/dom/base/nsLocation.cpp
index f578deaafffe..6e2cc280b2bb 100644
--- a/dom/base/nsLocation.cpp
+++ b/dom/base/nsLocation.cpp
@@ -299,7 +299,7 @@ nsLocation::GetHash(nsAString& aHash)
 
   rv = uri->GetRef(ref);
 
-  if (nsContentUtils::EncodeDecodeURLHash()) {
+  if (nsContentUtils::GettersDecodeURLHash()) {
     if (NS_SUCCEEDED(rv)) {
       nsCOMPtr<nsITextToSubURI> textToSubURI(
           do_GetService(NS_ITEXTTOSUBURI_CONTRACTID, &rv));
diff --git a/dom/workers/WorkerPrivate.cpp b/dom/workers/WorkerPrivate.cpp
index ac29fc04989c..3dcc464c08b0 100644
--- a/dom/workers/WorkerPrivate.cpp
+++ b/dom/workers/WorkerPrivate.cpp
@@ -4000,7 +4000,7 @@ WorkerPrivateParent<Derived>::SetBaseURI(nsIURI* aBaseURI)
   if (NS_SUCCEEDED(aBaseURI->GetRef(temp)) && !temp.IsEmpty()) {
     nsCOMPtr<nsITextToSubURI> converter =
       do_GetService(NS_ITEXTTOSUBURI_CONTRACTID);
-    if (converter && nsContentUtils::EncodeDecodeURLHash()) {
+    if (converter && nsContentUtils::GettersDecodeURLHash()) {
       nsCString charset;
       nsAutoString unicodeRef;
       if (NS_SUCCEEDED(aBaseURI->GetOriginCharset(charset)) &&
diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index 16bd239bec74..321d92a9102b 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -169,6 +169,8 @@ pref("dom.undo_manager.enabled", false);
 // Whether URL,nsLocation,Link::GetHash should be percent encoded
 // in setter and percent decoded in getter (old behaviour = true)
 pref("dom.url.encode_decode_hash", true);
+// Whether ::GetHash should do percent decoding (old behaviour = true)
+pref("dom.url.getters_decode_hash", false);
 
 // Whether to run add-on code in different compartments from browser code. This
 // causes a separate compartment for each (addon, global) combination, which may

From 1e9634367f63df5bc8a816c658a3a5f5c1877db2 Mon Sep 17 00:00:00 2001
From: Ryan VanderMeulen <ryanvm@gmail.com>
Date: Tue, 16 Jun 2015 15:37:37 -0400
Subject: [PATCH 9/9] Backed out changesets a08167680328 and b008f158e91f (bug
 1093611) for talos svgr timeouts. a=merge

--HG--
extra : source : 137e8a950be5aa2da34ebac2fd6eae67cc68c319
extra : amend_source : b99b2654576b7302ae21ae1f76cb0067454db0bf
---
 dom/base/Link.cpp                                        | 2 +-
 dom/base/URL.cpp                                         | 2 +-
 dom/base/nsContentUtils.cpp                              | 4 ----
 dom/base/nsContentUtils.h                                | 9 ---------
 dom/base/nsLocation.cpp                                  | 2 +-
 dom/base/test/test_url.html                              | 2 +-
 dom/workers/WorkerPrivate.cpp                            | 2 +-
 dom/workers/test/urlApi_worker.js                        | 2 +-
 modules/libpref/init/all.js                              | 2 --
 .../meta/workers/WorkerLocation_hash_encoding.htm.ini    | 5 +++++
 10 files changed, 11 insertions(+), 21 deletions(-)
 create mode 100644 testing/web-platform/meta/workers/WorkerLocation_hash_encoding.htm.ini

diff --git a/dom/base/Link.cpp b/dom/base/Link.cpp
index 856f3e329654..d9881aec2f0d 100644
--- a/dom/base/Link.cpp
+++ b/dom/base/Link.cpp
@@ -444,7 +444,7 @@ Link::GetHash(nsAString &_hash, ErrorResult& aError)
   nsresult rv = uri->GetRef(ref);
   if (NS_SUCCEEDED(rv) && !ref.IsEmpty()) {
     _hash.Assign(char16_t('#'));
-    if (nsContentUtils::GettersDecodeURLHash()) {
+    if (nsContentUtils::EncodeDecodeURLHash()) {
       NS_UnescapeURL(ref); // XXX may result in random non-ASCII bytes!
     }
     AppendUTF8toUTF16(ref, _hash);
diff --git a/dom/base/URL.cpp b/dom/base/URL.cpp
index 438c3ddfd221..5ab46d5fd99c 100644
--- a/dom/base/URL.cpp
+++ b/dom/base/URL.cpp
@@ -525,7 +525,7 @@ URL::GetHash(nsAString& aHash, ErrorResult& aRv) const
   nsresult rv = mURI->GetRef(ref);
   if (NS_SUCCEEDED(rv) && !ref.IsEmpty()) {
     aHash.Assign(char16_t('#'));
-    if (nsContentUtils::GettersDecodeURLHash()) {
+    if (nsContentUtils::EncodeDecodeURLHash()) {
       NS_UnescapeURL(ref); // XXX may result in random non-ASCII bytes!
     }
     AppendUTF8toUTF16(ref, aHash);
diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp
index a55084531b36..1ab2db68db32 100644
--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@@ -255,7 +255,6 @@ bool nsContentUtils::sIsResourceTimingEnabled = false;
 bool nsContentUtils::sIsUserTimingLoggingEnabled = false;
 bool nsContentUtils::sIsExperimentalAutocompleteEnabled = false;
 bool nsContentUtils::sEncodeDecodeURLHash = false;
-bool nsContentUtils::sGettersDecodeURLHash = false;
 bool nsContentUtils::sPrivacyResistFingerprinting = false;
 
 uint32_t nsContentUtils::sHandlingInputTimeout = 1000;
@@ -538,9 +537,6 @@ nsContentUtils::Init()
   Preferences::AddBoolVarCache(&sEncodeDecodeURLHash,
                                "dom.url.encode_decode_hash", false);
 
-  Preferences::AddBoolVarCache(&sGettersDecodeURLHash,
-                               "dom.url.getters_decode_hash", false);
-
   Preferences::AddBoolVarCache(&sPrivacyResistFingerprinting,
                                "privacy.resistFingerprinting", false);
 
diff --git a/dom/base/nsContentUtils.h b/dom/base/nsContentUtils.h
index 14bd6cb8d67b..5104cc3a9dc9 100644
--- a/dom/base/nsContentUtils.h
+++ b/dom/base/nsContentUtils.h
@@ -1942,14 +1942,6 @@ public:
     return sEncodeDecodeURLHash;
   }
 
-  /*
-   * Returns true if URL getters should percent decode the value of the segment
-   */
-  static bool GettersDecodeURLHash()
-  {
-    return sGettersDecodeURLHash && sEncodeDecodeURLHash;
-  }
-
   /*
    * Returns true if the browser should attempt to prevent content scripts
    * from collecting distinctive information about the browser that could
@@ -2500,7 +2492,6 @@ private:
   static bool sIsUserTimingLoggingEnabled;
   static bool sIsExperimentalAutocompleteEnabled;
   static bool sEncodeDecodeURLHash;
-  static bool sGettersDecodeURLHash;
   static bool sPrivacyResistFingerprinting;
 
   static nsHtml5StringParser* sHTMLFragmentParser;
diff --git a/dom/base/nsLocation.cpp b/dom/base/nsLocation.cpp
index 6e2cc280b2bb..f578deaafffe 100644
--- a/dom/base/nsLocation.cpp
+++ b/dom/base/nsLocation.cpp
@@ -299,7 +299,7 @@ nsLocation::GetHash(nsAString& aHash)
 
   rv = uri->GetRef(ref);
 
-  if (nsContentUtils::GettersDecodeURLHash()) {
+  if (nsContentUtils::EncodeDecodeURLHash()) {
     if (NS_SUCCEEDED(rv)) {
       nsCOMPtr<nsITextToSubURI> textToSubURI(
           do_GetService(NS_ITEXTTOSUBURI_CONTRACTID, &rv));
diff --git a/dom/base/test/test_url.html b/dom/base/test/test_url.html
index 572f9aeb0780..f498bb4da761 100644
--- a/dom/base/test/test_url.html
+++ b/dom/base/test/test_url.html
@@ -116,7 +116,7 @@
     { url: 'http://example.com/carrot#question%3f',
       base: undefined,
       error: false,
-      hash: '#question%3f'
+      hash: '#question?'
     },
     { url: 'https://example.com:4443?',
       base: undefined,
diff --git a/dom/workers/WorkerPrivate.cpp b/dom/workers/WorkerPrivate.cpp
index 3dcc464c08b0..ac29fc04989c 100644
--- a/dom/workers/WorkerPrivate.cpp
+++ b/dom/workers/WorkerPrivate.cpp
@@ -4000,7 +4000,7 @@ WorkerPrivateParent<Derived>::SetBaseURI(nsIURI* aBaseURI)
   if (NS_SUCCEEDED(aBaseURI->GetRef(temp)) && !temp.IsEmpty()) {
     nsCOMPtr<nsITextToSubURI> converter =
       do_GetService(NS_ITEXTTOSUBURI_CONTRACTID);
-    if (converter && nsContentUtils::GettersDecodeURLHash()) {
+    if (converter && nsContentUtils::EncodeDecodeURLHash()) {
       nsCString charset;
       nsAutoString unicodeRef;
       if (NS_SUCCEEDED(aBaseURI->GetOriginCharset(charset)) &&
diff --git a/dom/workers/test/urlApi_worker.js b/dom/workers/test/urlApi_worker.js
index a8b88e046fa3..0fb3ae1c9eb0 100644
--- a/dom/workers/test/urlApi_worker.js
+++ b/dom/workers/test/urlApi_worker.js
@@ -111,7 +111,7 @@ onmessage = function() {
     { url: 'http://example.com/carrot#question%3f',
       base: undefined,
       error: false,
-      hash: '#question%3f'
+      hash: '#question?'
     },
     { url: 'https://example.com:4443?',
       base: undefined,
diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index 321d92a9102b..16bd239bec74 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -169,8 +169,6 @@ pref("dom.undo_manager.enabled", false);
 // Whether URL,nsLocation,Link::GetHash should be percent encoded
 // in setter and percent decoded in getter (old behaviour = true)
 pref("dom.url.encode_decode_hash", true);
-// Whether ::GetHash should do percent decoding (old behaviour = true)
-pref("dom.url.getters_decode_hash", false);
 
 // Whether to run add-on code in different compartments from browser code. This
 // causes a separate compartment for each (addon, global) combination, which may
diff --git a/testing/web-platform/meta/workers/WorkerLocation_hash_encoding.htm.ini b/testing/web-platform/meta/workers/WorkerLocation_hash_encoding.htm.ini
new file mode 100644
index 000000000000..f285c02dbe37
--- /dev/null
+++ b/testing/web-platform/meta/workers/WorkerLocation_hash_encoding.htm.ini
@@ -0,0 +1,5 @@
+[WorkerLocation_hash_encoding.htm]
+  type: testharness
+  [ WorkerLocation.hash with url encoding string ]
+    expected: FAIL
+