Merge mozilla-inbound to mozilla-central. a=merge

accessible/tests/browser/browser.ini

@@ -11,7 +11,7 @@ support-files =
 [browser_shutdown_multi_acc_reference_doc.js]
 [browser_shutdown_multi_reference.js]
 [browser_shutdown_parent_own_reference.js]
-skip-if = !e10s || (os == 'win' && os_version == '5.1') || (verify && debug && (os == 'win')) # e10s specific test for a11y start/shutdown between parent and content.
+skip-if = !e10s || (verify && debug && (os == 'win')) # e10s specific test for a11y start/shutdown between parent and content.
 [browser_shutdown_pref.js]
 [browser_shutdown_proxy_acc_reference.js]
 skip-if = !e10s || (os == 'win') # e10s specific test for a11y start/shutdown between parent and content.
@@ -22,11 +22,11 @@ skip-if = !e10s || (os == 'win') || (verify && debug && (os == 'linux')) # e10s
 [browser_shutdown_multi_proxy_acc_reference_obj.js]
 skip-if = !e10s || (os == 'win') || (verify && debug && (os == 'linux')) # e10s specific test for a11y start/shutdown between parent and content.
 [browser_shutdown_remote_no_reference.js]
-skip-if = !e10s || (os == 'win' && os_version == '5.1') || (verify && debug && (os == 'win')) # e10s specific test for a11y start/shutdown between parent and content.
+skip-if = !e10s || (verify && debug && (os == 'win')) # e10s specific test for a11y start/shutdown between parent and content.
 [browser_shutdown_remote_only.js]
-skip-if = !e10s || (os == 'win' && os_version == '5.1') # e10s specific test for a11y start/shutdown between parent and content.
+skip-if = !e10s # e10s specific test for a11y start/shutdown between parent and content.
 [browser_shutdown_remote_own_reference.js]
-skip-if = !e10s || (os == 'win' && os_version == '5.1') # e10s specific test for a11y start/shutdown between parent and content.
+skip-if = !e10s # e10s specific test for a11y start/shutdown between parent and content.
 [browser_shutdown_scope_lifecycle.js]
 [browser_shutdown_start_restart.js]
 skip-if = (verify && debug)

browser/components/sessionstore/SessionStore.jsm

@@ -1626,7 +1626,13 @@ var SessionStoreInternal = {
           const observeTopic = topic => {
             let deferred = PromiseUtils.defer();
             const cleanup = () => Services.obs.removeObserver(deferred.resolve, topic);
-            Services.obs.addObserver(deferred.resolve, topic);
+            Services.obs.addObserver(subject => {
+              // Skip abort on ipc:content-shutdown if not abnormal/crashed
+              subject.QueryInterface(Ci.nsIPropertyBag2);
+              if (!(topic == "ipc:content-shutdown" && !subject.get("abnormal"))) {
+                deferred.resolve();
+              }
+            }, topic);
             deferred.promise.then(cleanup, cleanup);
             return deferred;
           };

browser/modules/BrowserWindowTracker.jsm

@@ -211,7 +211,9 @@ this.BrowserWindowTracker = {
    */
   orderedWindows: {
     * [Symbol.iterator]() {
-      for (let window of _trackedWindows)
+      // Clone the windows array immediately as it may change during iteration,
+      // we'd rather have an outdated order than skip/revisit windows.
+      for (let window of [..._trackedWindows])
         yield window;
     }
   },

dom/push/PushService.jsm

@@ -32,6 +32,9 @@ const CONNECTION_PROTOCOLS = (function() {
 XPCOMUtils.defineLazyServiceGetter(this, "gPushNotifier",
                                    "@mozilla.org/push/Notifier;1",
                                    "nsIPushNotifier");
+XPCOMUtils.defineLazyServiceGetter(this, "eTLDService",
+                                   "@mozilla.org/network/effective-tld-service;1",
+                                   "nsIEffectiveTLDService");
 
 var EXPORTED_SYMBOLS = ["PushService"];
 
@@ -85,33 +88,6 @@ function errorWithResult(message, result = Cr.NS_ERROR_FAILURE) {
   return error;
 }
 
-/**
- * Copied from ForgetAboutSite.jsm.
- *
- * Returns true if the string passed in is part of the root domain of the
- * current string.  For example, if this is "www.mozilla.org", and we pass in
- * "mozilla.org", this will return true.  It would return false the other way
- * around.
- */
-function hasRootDomain(str, aDomain)
-{
-  let index = str.indexOf(aDomain);
-  // If aDomain is not found, we know we do not have it as a root domain.
-  if (index == -1)
-    return false;
-
-  // If the strings are the same, we obviously have a match.
-  if (str == aDomain)
-    return true;
-
-  // Otherwise, we have aDomain as our root domain iff the index of aDomain is
-  // aDomain.length subtracted from our length and (since we do not have an
-  // exact match) the character before the index is a dot or slash.
-  let prevChar = str[index - 1];
-  return (index == (str.length - aDomain.length)) &&
-         (prevChar == "." || prevChar == "/");
-}
-
 /**
  * The implementation of the push system. It uses WebSockets
  * (PushServiceWebSocket) to communicate with the server and PushDB (IndexedDB)
@@ -1134,7 +1110,7 @@ var PushService = {
       .then(_ => {
         return this._dropRegistrationsIf(record =>
           info.domain == "*" ||
-          (record.uri && hasRootDomain(record.uri.prePath, info.domain))
+          (record.uri && eTLDService.hasRootDomain(record.uri.prePath, info.domain))
         );
       })
       .catch(e => {

dom/serviceworkers/ServiceWorkerManager.cpp

@@ -9,6 +9,7 @@
 #include "nsAutoPtr.h"
 #include "nsIConsoleService.h"
 #include "nsIDocument.h"
+#include "nsIEffectiveTLDService.h"
 #include "nsIScriptSecurityManager.h"
 #include "nsIStreamLoader.h"
 #include "nsIHttpChannel.h"
@@ -2801,50 +2802,6 @@ ServiceWorkerManager::RemoveRegistration(ServiceWorkerRegistrationInfo* aRegistr
   RemoveScopeAndRegistration(aRegistration);
 }
 
-namespace {
-/**
- * See toolkit/modules/sessionstore/Utils.jsm function hasRootDomain().
- *
- * Returns true if the |url| passed in is part of the given root |domain|.
- * For example, if |url| is "www.mozilla.org", and we pass in |domain| as
- * "mozilla.org", this will return true. It would return false the other way
- * around.
- */
-bool
-HasRootDomain(nsIURI* aURI, const nsACString& aDomain)
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  MOZ_ASSERT(aURI);
-
-  nsAutoCString host;
-  nsresult rv = aURI->GetHost(host);
-  if (NS_WARN_IF(NS_FAILED(rv))) {
-    return false;
-  }
-
-  nsACString::const_iterator start, end;
-  host.BeginReading(start);
-  host.EndReading(end);
-  if (!FindInReadable(aDomain, start, end)) {
-    return false;
-  }
-
-  if (host.Equals(aDomain)) {
-    return true;
-  }
-
-  // Beginning of the string matches, can't look at the previous char.
-  if (start.get() == host.BeginReading()) {
-    // Equals failed so this is fine.
-    return false;
-  }
-
-  char prevChar = *(--start);
-  return prevChar == '.';
-}
-
-} // namespace
-
 NS_IMETHODIMP
 ServiceWorkerManager::GetAllRegistrations(nsIArray** aResult)
 {
@@ -2900,6 +2857,12 @@ ServiceWorkerManager::Remove(const nsACString& aHost)
 {
   MOZ_ASSERT(NS_IsMainThread());
 
+  nsCOMPtr<nsIEffectiveTLDService> tldService =
+    do_GetService(NS_EFFECTIVETLDSERVICE_CONTRACTID);
+  if (NS_WARN_IF(!tldService)) {
+    return;
+  }
+
   for (auto it1 = mRegistrationInfos.Iter(); !it1.Done(); it1.Next()) {
     ServiceWorkerManager::RegistrationDataPerPrincipal* data = it1.UserData();
     for (auto it2 = data->mInfos.Iter(); !it2.Done(); it2.Next()) {
@@ -2907,8 +2870,24 @@ ServiceWorkerManager::Remove(const nsACString& aHost)
       nsCOMPtr<nsIURI> scopeURI;
       nsresult rv = NS_NewURI(getter_AddRefs(scopeURI), it2.Key(),
                               nullptr, nullptr);
+      if (NS_WARN_IF(NS_FAILED(rv))) {
+        continue;
+      }
+
+      nsAutoCString host;
+      rv = scopeURI->GetHost(host);
+      if (NS_WARN_IF(NS_FAILED(rv))) {
+        continue;
+      }
+
       // This way subdomains are also cleared.
-      if (NS_SUCCEEDED(rv) && HasRootDomain(scopeURI, aHost)) {
+      bool hasRootDomain = false;
+      rv = tldService->HasRootDomain(host, aHost, &hasRootDomain);
+      if (NS_WARN_IF(NS_FAILED(rv))) {
+        continue;
+      }
+
+      if (hasRootDomain) {
         ForceUnregister(data, reg);
       }
     }

js/public/Wrapper.h

@@ -143,7 +143,7 @@ class JS_FRIEND_API(Wrapper) : public ForwardingProxyHandler
 
     static JSObject* Renew(JSObject* existing, JSObject* obj, const Wrapper* handler);
 
-    static const Wrapper* wrapperHandler(JSObject* wrapper);
+    static const Wrapper* wrapperHandler(const JSObject* wrapper);
 
     static JSObject* wrappedObject(JSObject* wrapper);
 
@@ -335,7 +335,7 @@ extern JSObject*
 TransparentObjectWrapper(JSContext* cx, HandleObject existing, HandleObject obj);
 
 inline bool
-IsWrapper(JSObject* obj)
+IsWrapper(const JSObject* obj)
 {
     return IsProxy(obj) && GetProxyHandler(obj)->family() == &Wrapper::family;
 }

js/src/builtin/Eval.cpp

@@ -222,8 +222,7 @@ EvalKernel(JSContext* cx, HandleValue v, EvalType evalType, AbstractFramePtr cal
     MOZ_ASSERT_IF(evalType == INDIRECT_EVAL, IsGlobalLexicalEnvironment(env));
     AssertInnerizedEnvironmentChain(cx, *env);
 
-    Rooted<GlobalObject*> envGlobal(cx, &env->global());
-    if (!GlobalObject::isRuntimeCodeGenEnabled(cx, envGlobal)) {
+    if (!GlobalObject::isRuntimeCodeGenEnabled(cx, cx->global())) {
         JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_CSP_BLOCKED_EVAL);
         return false;
     }
@@ -325,8 +324,7 @@ js::DirectEvalStringFromIon(JSContext* cx,
 {
     AssertInnerizedEnvironmentChain(cx, *env);
 
-    Rooted<GlobalObject*> envGlobal(cx, &env->global());
-    if (!GlobalObject::isRuntimeCodeGenEnabled(cx, envGlobal)) {
+    if (!GlobalObject::isRuntimeCodeGenEnabled(cx, cx->global())) {
         JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_CSP_BLOCKED_EVAL);
         return false;
     }
@@ -401,8 +399,7 @@ js::IndirectEval(JSContext* cx, unsigned argc, Value* vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    Rooted<GlobalObject*> global(cx, &args.callee().global());
-    RootedObject globalLexical(cx, &global->lexicalEnvironment());
+    RootedObject globalLexical(cx, &cx->global()->lexicalEnvironment());
 
     // Note we'll just pass |undefined| here, then return it directly (or throw
     // if runtime codegen is disabled), if no argument is provided.

js/src/builtin/Promise.cpp

@@ -755,7 +755,7 @@ EnqueuePromiseReactionJob(JSContext* cx, HandleObject reactionObj,
     if (objectFromIncumbentGlobal) {
         objectFromIncumbentGlobal = CheckedUnwrap(objectFromIncumbentGlobal);
         MOZ_ASSERT(objectFromIncumbentGlobal);
-        global = &objectFromIncumbentGlobal->global();
+        global = &objectFromIncumbentGlobal->nonCCWGlobal();
     }
 
     // Note: the global we pass here might be from a different compartment
@@ -1027,7 +1027,7 @@ RejectMaybeWrappedPromise(JSContext *cx, HandleObject promiseObj, HandleValue re
             // floor.
             RootedObject realReason(cx, UncheckedUnwrap(&reason.toObject()));
             RootedValue realReasonVal(cx, ObjectValue(*realReason));
-            RootedObject realGlobal(cx, &realReason->global());
+            RootedObject realGlobal(cx, &realReason->nonCCWGlobal());
             ReportErrorToGlobal(cx, realGlobal, realReasonVal);
 
             // Async stacks are only properly adopted if there's at least one

js/src/builtin/TestingFunctions.cpp

@@ -5178,7 +5178,7 @@ ObjectGlobal(JSContext* cx, unsigned argc, Value* vp)
         return true;
     }
 
-    obj = ToWindowProxyIfWindow(&obj->global());
+    obj = ToWindowProxyIfWindow(&obj->nonCCWGlobal());
 
     args.rval().setObject(*obj);
     return true;

js/src/jit/BaselineIC.cpp

@@ -2350,9 +2350,7 @@ DoCallFallback(JSContext* cx, BaselineFrame* frame, ICCall_Fallback* stub_, uint
         if (!ConstructFromStack(cx, callArgs))
             return false;
         res.set(callArgs.rval());
-    } else if ((op == JSOP_EVAL || op == JSOP_STRICTEVAL) &&
-               frame->environmentChain()->global().valueIsEval(callee))
-    {
+    } else if ((op == JSOP_EVAL || op == JSOP_STRICTEVAL) && cx->global()->valueIsEval(callee)) {
         if (!DirectEval(cx, callArgs.get(0), res))
             return false;
     } else {

js/src/jit/CacheIR.cpp

@@ -1111,7 +1111,7 @@ GetPropIRGenerator::tryAttachCrossCompartmentWrapper(HandleObject obj, ObjOperan
     // Take the unwrapped object's global, and wrap in a
     // this-compartment wrapper. This is what will be stored in the IC
     // keep the compartment alive.
-    RootedObject wrappedTargetGlobal(cx_, &unwrapped->global());
+    RootedObject wrappedTargetGlobal(cx_, &unwrapped->deprecatedGlobal());
     if (!cx_->compartment()->wrap(cx_, &wrappedTargetGlobal))
         return false;
 

js/src/jsapi.cpp

@@ -1215,7 +1215,7 @@ JS_GetGlobalForObject(JSContext* cx, JSObject* obj)
 {
     AssertHeapIsIdle();
     assertSameCompartment(cx, obj);
-    return &obj->global();
+    return &obj->deprecatedGlobal();
 }
 
 extern JS_PUBLIC_API(bool)

js/src/jsfriendapi.cpp

@@ -385,7 +385,7 @@ js::IsFunctionObject(JSObject* obj)
 JS_FRIEND_API(JSObject*)
 js::GetGlobalForObjectCrossCompartment(JSObject* obj)
 {
-    return &obj->global();
+    return &obj->deprecatedGlobal();
 }
 
 JS_FRIEND_API(JSObject*)
@@ -533,11 +533,9 @@ js::GetStaticPrototype(JSObject* obj)
 }
 
 JS_FRIEND_API(bool)
-js::GetOriginalEval(JSContext* cx, HandleObject scope, MutableHandleObject eval)
+js::GetRealmOriginalEval(JSContext* cx, MutableHandleObject eval)
 {
-    assertSameCompartment(cx, scope);
-    Rooted<GlobalObject*> global(cx, &scope->global());
-    return GlobalObject::getOrCreateEval(cx, global, eval);
+    return GlobalObject::getOrCreateEval(cx, cx->global(), eval);
 }
 
 JS_FRIEND_API(void)
@@ -1505,7 +1503,7 @@ JS_FRIEND_API(JSObject*)
 js::ToWindowIfWindowProxy(JSObject* obj)
 {
     if (IsWindowProxy(obj))
-        return &obj->global();
+        return &obj->nonCCWGlobal();
     return obj;
 }
 

js/src/jsfriendapi.h

@@ -675,7 +675,7 @@ JS_FRIEND_API(bool)
 IsFunctionObject(JSObject* obj);
 
 JS_FRIEND_API(bool)
-IsCrossCompartmentWrapper(JSObject* obj);
+IsCrossCompartmentWrapper(const JSObject* obj);
 
 static MOZ_ALWAYS_INLINE JS::Compartment*
 GetObjectCompartment(JSObject* obj)
@@ -743,8 +743,7 @@ extern JS_FRIEND_API(JSObject*)
 GetStaticPrototype(JSObject* obj);
 
 JS_FRIEND_API(bool)
-GetOriginalEval(JSContext* cx, JS::HandleObject scope,
-                JS::MutableHandleObject eval);
+GetRealmOriginalEval(JSContext* cx, JS::MutableHandleObject eval);
 
 inline void*
 GetObjectPrivate(JSObject* obj)

js/src/proxy/CrossCompartmentWrapper.cpp

@@ -492,7 +492,7 @@ CrossCompartmentWrapper::boxedValue_unbox(JSContext* cx, HandleObject wrapper, M
 const CrossCompartmentWrapper CrossCompartmentWrapper::singleton(0u);
 
 bool
-js::IsCrossCompartmentWrapper(JSObject* obj)
+js::IsCrossCompartmentWrapper(const JSObject* obj)
 {
     return IsWrapper(obj) &&
            !!(Wrapper::wrapperHandler(obj)->flags() & Wrapper::CROSS_COMPARTMENT);

js/src/proxy/Wrapper.cpp

@@ -330,7 +330,7 @@ Wrapper::Renew(JSObject* existing, JSObject* obj, const Wrapper* handler)
 }
 
 const Wrapper*
-Wrapper::wrapperHandler(JSObject* wrapper)
+Wrapper::wrapperHandler(const JSObject* wrapper)
 {
     MOZ_ASSERT(wrapper->is<WrapperObject>());
     return static_cast<const Wrapper*>(wrapper->as<ProxyObject>().handler());

js/src/vm/Compartment.cpp

@@ -198,15 +198,15 @@ Compartment::wrap(JSContext* cx, MutableHandleBigInt bi)
 bool
 Compartment::getNonWrapperObjectForCurrentCompartment(JSContext* cx, MutableHandleObject obj)
 {
-    // Ensure that we have entered a compartment.
+    // Ensure that we have entered a realm.
     MOZ_ASSERT(cx->global());
 
     // If we have a cross-compartment wrapper, make sure that the cx isn't
-    // associated with the self-hosting global. We don't want to create
+    // associated with the self-hosting zone. We don't want to create
     // wrappers for objects in other runtimes, which may be the case for the
-    // self-hosting global.
-    MOZ_ASSERT(!cx->runtime()->isSelfHostingGlobal(cx->global()));
-    MOZ_ASSERT(!cx->runtime()->isSelfHostingGlobal(&obj->global()));
+    // self-hosting zone.
+    MOZ_ASSERT(!cx->runtime()->isSelfHostingZone(cx->zone()));
+    MOZ_ASSERT(!cx->runtime()->isSelfHostingZone(obj->zone()));
 
     // The object is already in the right compartment. Normally same-
     // compartment returns the object itself, however, windows are always

js/src/vm/Debugger.cpp

@@ -3951,8 +3951,8 @@ Debugger::construct(JSContext* cx, unsigned argc, Value* vp)
 
     /* Add the initial debuggees, if any. */
     for (unsigned i = 0; i < args.length(); i++) {
-        Rooted<GlobalObject*>
-            debuggee(cx, &args[i].toObject().as<ProxyObject>().private_().toObject().global());
+        JSObject& wrappedObj = args[i].toObject().as<ProxyObject>().private_().toObject();
+        Rooted<GlobalObject*> debuggee(cx, &wrappedObj.deprecatedGlobal());
         if (!debugger->addDebuggeeGlobal(cx, debuggee))
             return false;
     }
@@ -9960,7 +9960,7 @@ DebuggerObject::getGlobal(JSContext* cx, HandleDebuggerObject object,
     RootedObject referent(cx, object->referent());
     Debugger* dbg = object->owner();
 
-    RootedObject global(cx, &referent->global());
+    RootedObject global(cx, &referent->deprecatedGlobal());
     return dbg->wrapDebuggeeObject(cx, global, result);
 }
 
@@ -10821,7 +10821,7 @@ DebuggerEnvironment_checkThis(JSContext* cx, const CallArgs& args, const char* f
      */
     if (requireDebuggee) {
         Rooted<Env*> env(cx, static_cast<Env*>(nthisobj->getPrivate()));
-        if (!Debugger::fromChildJSObject(nthisobj)->observesGlobal(&env->global())) {
+        if (!Debugger::fromChildJSObject(nthisobj)->observesGlobal(&env->nonCCWGlobal())) {
             JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_DEBUG_NOT_DEBUGGEE,
                                       "Debugger.Environment", "environment");
             return nullptr;
@@ -11171,7 +11171,7 @@ DebuggerEnvironment::isDebuggee() const
     MOZ_ASSERT(referent());
     MOZ_ASSERT(!referent()->is<EnvironmentObject>());
 
-    return owner()->observesGlobal(&referent()->global());
+    return owner()->observesGlobal(&referent()->nonCCWGlobal());
 }
 
 bool

js/src/vm/EnvironmentObject-inl.h

@@ -78,7 +78,7 @@ JSObject::enclosingEnvironment() const
         return nullptr;
 
     MOZ_ASSERT_IF(is<JSFunction>(), as<JSFunction>().isInterpreted());
-    return &global();
+    return &nonCCWGlobal();
 }
 
 #endif /* vm_EnvironmentObject_inl_h */

js/src/vm/Interpreter.cpp

@@ -233,7 +233,7 @@ GetNameOperation(JSContext* cx, InterpreterFrame* fp, jsbytecode* pc, MutableHan
      * before the global object.
      */
     if (IsGlobalOp(JSOp(*pc)) && !fp->script()->hasNonSyntacticScope())
-        envChain = &envChain->global().lexicalEnvironment();
+        envChain = &cx->global()->lexicalEnvironment();
 
     /* Kludge to allow (typeof foo == "undefined") tests. */
     JSOp op2 = JSOp(pc[JSOP_GETNAME_LENGTH]);
@@ -3029,7 +3029,7 @@ CASE(JSOP_STRICTEVAL)
                   "eval and stricteval must be the same size");
 
     CallArgs args = CallArgsFromSp(GET_ARGC(REGS.pc), REGS.sp);
-    if (REGS.fp()->environmentChain()->global().valueIsEval(args.calleev())) {
+    if (cx->global()->valueIsEval(args.calleev())) {
         if (!DirectEval(cx, args.get(0), args.rval()))
             goto error;
     } else {

js/src/vm/JSFunction.cpp

@@ -1750,7 +1750,7 @@ CreateDynamicFunction(JSContext* cx, const CallArgs& args, GeneratorKind generat
 {
     // Steps 1-5.
     // Block this call if security callbacks forbid it.
-    Rooted<GlobalObject*> global(cx, &args.callee().global());
+    Handle<GlobalObject*> global = cx->global();
     if (!GlobalObject::isRuntimeCodeGenEnabled(cx, global)) {
         JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_CSP_BLOCKED_FUNCTION);
         return false;

js/src/vm/JSObject-inl.h

@@ -391,8 +391,16 @@ SetNewObjectMetadata(JSContext* cx, T* obj)
 } // namespace js
 
 inline js::GlobalObject&
-JSObject::global() const
+JSObject::deprecatedGlobal() const
 {
+    return *realm()->unsafeUnbarrieredMaybeGlobal();
+}
+
+inline js::GlobalObject&
+JSObject::nonCCWGlobal() const
+{
+    MOZ_ASSERT(!js::IsCrossCompartmentWrapper(this));
+
     /*
      * The global is read-barriered so that it is kept live by access through
      * the Realm. When accessed through a JSObject, however, the global will be

js/src/vm/JSObject.cpp

@@ -2199,7 +2199,7 @@ js::GetObjectFromIncumbentGlobal(JSContext* cx, MutableHandleObject obj)
 static bool
 IsStandardPrototype(JSObject* obj, JSProtoKey key)
 {
-    Value v = obj->global().getPrototype(key);
+    Value v = obj->nonCCWGlobal().getPrototype(key);
     return v.isObject() && obj == &v.toObject();
 }
 
@@ -2241,7 +2241,7 @@ JS::IdentifyStandardConstructor(JSObject* obj)
     if (!obj->is<JSFunction>() || !(obj->as<JSFunction>().flags() & JSFunction::NATIVE_CTOR))
         return JSProto_Null;
 
-    GlobalObject& global = obj->global();
+    GlobalObject& global = obj->as<JSFunction>().global();
     for (size_t k = 0; k < JSProto_LIMIT; ++k) {
         JSProtoKey key = static_cast<JSProtoKey>(k);
         if (global.getConstructor(key) == ObjectValue(*obj))
@@ -3559,9 +3559,14 @@ void
 JSObject::dump(js::GenericPrinter& out) const
 {
     const JSObject* obj = this;
-    JSObject* globalObj = &global();
     out.printf("object %p\n", obj);
+
+    if (IsCrossCompartmentWrapper(this)) {
+        out.printf("  compartment %p\n", compartment());
+    } else {
+        JSObject* globalObj = &nonCCWGlobal();
         out.printf("  global %p [%s]\n", globalObj, globalObj->getClass()->name);
+    }
 
     const Class* clasp = obj->getClass();
     out.printf("  class %p %s\n", clasp, clasp->name);

js/src/vm/JSObject.h

@@ -429,7 +429,12 @@ class JSObject : public js::gc::Cell
      */
     inline JSObject* enclosingEnvironment() const;
 
-    inline js::GlobalObject& global() const;
+    // Deprecated: call nonCCWGlobal or NativeObject::global() instead!
+    inline js::GlobalObject& deprecatedGlobal() const;
+
+    // Cross-compartment wrappers are not associated with a single realm/global,
+    // so this method asserts the object is not a CCW.
+    inline js::GlobalObject& nonCCWGlobal() const;
 
     // In some rare cases the global object's compartment's global may not be
     // the same global object. For this reason, we need to take extra care when

js/src/vm/NativeObject-inl.h

@@ -669,6 +669,12 @@ NativeObject::allocKindForTenure() const
     return GetBackgroundAllocKind(kind);
 }
 
+inline js::GlobalObject&
+NativeObject::global() const
+{
+    return nonCCWGlobal();
+}
+
 inline js::gc::AllocKind
 PlainObject::allocKindForTenure() const
 {

js/src/vm/NativeObject.h

@@ -1472,6 +1472,10 @@ class NativeObject : public ShapedObject
     void sweepDictionaryListPointer();
     void updateDictionaryListPointerAfterMinorGC(NativeObject* old);
 
+    // Native objects are never wrappers, so a native object always has a realm
+    // and global.
+    inline js::GlobalObject& global() const;
+
     /* JIT Accessors */
     static size_t offsetOfElements() { return offsetof(NativeObject, elements_); }
     static size_t offsetOfFixedElements() {

js/src/vm/Shape.cpp

@@ -2021,7 +2021,7 @@ Shape::dumpSubtree(int level, js::GenericPrinter& out) const
 #endif
 
 static bool
-IsOriginalProto(GlobalObject* global, JSProtoKey key, JSObject& proto)
+IsOriginalProto(GlobalObject* global, JSProtoKey key, NativeObject& proto)
 {
     if (global->getPrototype(key) != ObjectValue(proto))
         return false;
@@ -2051,9 +2051,9 @@ IsOriginalProto(GlobalObject* global, JSProtoKey key, JSObject& proto)
 static JSProtoKey
 GetInitialShapeProtoKey(TaggedProto proto, JSContext* cx)
 {
-    if (proto.isObject() && proto.toObject()->hasStaticPrototype()) {
+    if (proto.isObject() && proto.toObject()->isNative()) {
         GlobalObject* global = cx->global();
-        JSObject& obj = *proto.toObject();
+        NativeObject& obj = proto.toObject()->as<NativeObject>();
         MOZ_ASSERT(global == &obj.global());
 
         if (IsOriginalProto(global, JSProto_Object, obj))

js/src/vm/Stack-inl.h

@@ -24,6 +24,7 @@
 #include "jit/BaselineFrame-inl.h"
 #include "vm/JSObject-inl.h"
 #include "vm/JSScript-inl.h"
+#include "vm/NativeObject-inl.h"
 
 namespace js {
 
@@ -36,7 +37,7 @@ InterpreterFrame::environmentChain() const
 inline GlobalObject&
 InterpreterFrame::global() const
 {
-    return environmentChain()->global();
+    return script()->global();
 }
 
 inline JSObject&

js/src/wasm/WasmTypes.cpp

@@ -24,6 +24,7 @@
 #include "wasm/WasmSerialize.h"
 
 #include "vm/JSObject-inl.h"
+#include "vm/NativeObject-inl.h"
 
 using namespace js;
 using namespace js::jit;

js/xpconnect/wrappers/XrayWrapper.cpp

@@ -1438,7 +1438,7 @@ XrayTraits::resolveOwnProperty(JSContext* cx, HandleObject wrapper, HandleObject
             found = true;
         } else if (id == GetJSIDByIndex(cx, XPCJSContext::IDX_EVAL)) {
             RootedObject eval(cx);
-            if (!js::GetOriginalEval(cx, target, &eval))
+            if (!js::GetRealmOriginalEval(cx, &eval))
                 return false;
             desc.value().set(ObjectValue(*eval));
             found = true;

layout/style/Loader.cpp

@@ -978,9 +978,12 @@ Loader::CreateSheet(nsIURI* aURI,
       // Make sure it hasn't been forced to have a unique inner;
       // that is an indication that its rules have been exposed to
       // CSSOM and so we can't use it.
-      if (sheet->HasForcedUniqueInner()) {
+      //
+      // Similarly, if the sheet doesn't have the right parsing mode just bail.
+      if (sheet->HasForcedUniqueInner() ||
+          sheet->ParsingMode() != aParsingMode) {
         LOG(("  Not cloning completed sheet %p because it has a "
-             "forced unique inner",
+             "forced unique inner or the wrong parsing mode",
              sheet.get()));
         sheet = nullptr;
         fromCompleteSheets = false;

layout/style/nsCSSScanner.h

@@ -163,7 +163,16 @@ struct nsCSSToken {
 class nsCSSScannerPosition {
   friend class nsCSSScanner;
 public:
-  nsCSSScannerPosition() : mInitialized(false) { }
+  nsCSSScannerPosition()
+    : mOffset(0)
+    , mLineNumber(0)
+    , mLineOffset(0)
+    , mTokenLineNumber(0)
+    , mTokenLineOffset(0)
+    , mTokenOffset(0)
+    , mInitialized(false)
+  {
+  }
 
   uint32_t LineNumber() {
     MOZ_ASSERT(mInitialized);

layout/style/nsComputedDOMStyle.cpp

@@ -322,6 +322,9 @@ nsComputedDOMStyle::nsComputedDOMStyle(dom::Element* aElement,
   , mComputedStyleGeneration(0)
   , mExposeVisitedStyle(false)
   , mResolvedComputedStyle(false)
+#ifdef DEBUG
+  , mFlushedPendingReflows(false)
+#endif
 {
   MOZ_ASSERT(aElement && aPresShell);
   MOZ_ASSERT(aPresShell->GetPresContext());

layout/style/nsFontFaceLoader.cpp

@@ -52,10 +52,11 @@ nsFontFaceLoader::nsFontFaceLoader(gfxUserFontEntry* aUserFontEntry,
                                    nsIURI* aFontURI,
                                    FontFaceSet* aFontFaceSet,
                                    nsIChannel* aChannel)
-  : mUserFontEntry(aUserFontEntry),
-    mFontURI(aFontURI),
-    mFontFaceSet(aFontFaceSet),
-    mChannel(aChannel)
+  : mUserFontEntry(aUserFontEntry)
+  , mFontURI(aFontURI)
+  , mFontFaceSet(aFontFaceSet)
+  , mChannel(aChannel)
+  , mStreamLoader(nullptr)
 {
   MOZ_ASSERT(mFontFaceSet,
              "We should get a valid FontFaceSet from the caller!");

layout/style/nsStyleStruct.cpp

@@ -2289,6 +2289,7 @@ CachedBorderImageData::GetSubImage(uint8_t aIndex)
 
 nsStyleImage::nsStyleImage()
   : mType(eStyleImageType_Null)
+  , mImage(nullptr)
   , mCropRect(nullptr)
 {
   MOZ_COUNT_CTOR(nsStyleImage);

layout/style/nsStyleStruct.h

@@ -872,7 +872,15 @@ struct nsCSSShadowItem
   bool mHasColor; // Whether mColor should be used
   bool mInset;
 
-  nsCSSShadowItem() : mHasColor(false) {
+  nsCSSShadowItem()
+    : mXOffset(0)
+    , mYOffset(0)
+    , mRadius(0)
+    , mSpread(0)
+    , mColor(NS_RGB(0, 0, 0))
+    , mHasColor(false)
+    , mInset(false)
+  {
     MOZ_COUNT_CTOR(nsCSSShadowItem);
   }
   ~nsCSSShadowItem() {

layout/style/nsStyleTransformMatrix.h

@@ -74,11 +74,19 @@ namespace nsStyleTransformMatrix {
 
     explicit TransformReferenceBox()
       : mFrame(nullptr)
+      , mX(0)
+      , mY(0)
+      , mWidth(0)
+      , mHeight(0)
       , mIsCached(false)
     {}
 
     explicit TransformReferenceBox(const nsIFrame* aFrame)
       : mFrame(aFrame)
+      , mX(0)
+      , mY(0)
+      , mWidth(0)
+      , mHeight(0)
       , mIsCached(false)
     {
       MOZ_ASSERT(mFrame);
@@ -86,6 +94,10 @@ namespace nsStyleTransformMatrix {
 
     explicit TransformReferenceBox(const nsIFrame* aFrame,
                                    const nsSize& aFallbackDimensions)
+      : mX(0)
+      , mY(0)
+      , mWidth(0)
+      , mHeight(0)
     {
       mFrame = aFrame;
       mIsCached = false;

layout/style/nsTimingFunction.h

@@ -32,8 +32,10 @@ struct nsTimingFunction
            aType != Type::Frames;
   }
 
-  explicit nsTimingFunction(int32_t aTimingFunctionType
-                              = NS_STYLE_TRANSITION_TIMING_FUNCTION_EASE)
+  explicit nsTimingFunction(
+    int32_t aTimingFunctionType = NS_STYLE_TRANSITION_TIMING_FUNCTION_EASE)
+    : mType(Type::Ease)
+    , mFunc{}
   {
     AssignFromKeyword(aTimingFunctionType);
   }

layout/svg/nsSVGImageFrame.h

@@ -26,11 +26,6 @@
 #include "nsIReflowCallback.h"
 #include "mozilla/Unused.h"
 
-using namespace mozilla;
-using namespace mozilla::dom;
-using namespace mozilla::gfx;
-using namespace mozilla::image;
-
 class nsSVGImageFrame;
 
 class nsSVGImageListener final : public imgINotificationObserver
@@ -50,7 +45,7 @@ private:
 };
 
 class nsSVGImageFrame final
-  : public SVGGeometryFrame
+  : public mozilla::SVGGeometryFrame
   , public nsIReflowCallback
 {
   friend nsIFrame*
@@ -110,9 +105,9 @@ public:
   void SetForceSyncDecoding(bool aForce) { mForceSyncDecoding = aForce; }
 
 private:
-  gfx::Matrix GetRasterImageTransform(int32_t aNativeWidth,
+  mozilla::gfx::Matrix GetRasterImageTransform(int32_t aNativeWidth,
                                                int32_t aNativeHeight);
-  gfx::Matrix GetVectorImageTransform();
+  mozilla::gfx::Matrix GetVectorImageTransform();
   bool TransformContextForPainting(gfxContext* aGfxContext,
                                    const gfxMatrix& aTransform);
 

layout/tables/nsTableFrame.h

@@ -34,8 +34,6 @@ class StackingContextHelper;
 }
 } // namespace mozilla
 
-using namespace mozilla;
-
 struct BCPropertyData;
 
 static inline bool

layout/xul/nsListItemFrame.cpp

@@ -15,6 +15,8 @@
 #include "nsBoxLayout.h"
 #include "nsIContent.h"
 
+using namespace mozilla;
+
 nsListItemFrame::nsListItemFrame(ComputedStyle* aStyle,
                                  bool aIsRoot,
                                  nsBoxLayout* aLayoutManager)

layout/xul/nsListItemFrame.h

@@ -7,10 +7,8 @@
 #include "mozilla/Attributes.h"
 #include "nsGridRowLeafFrame.h"
 
-using namespace mozilla;
-
 nsIFrame* NS_NewListItemFrame(nsIPresShell* aPresShell,
-                              ComputedStyle* aStyle);
+                              mozilla::ComputedStyle* aStyle);
 
 class nsListItemFrame final : public nsGridRowLeafFrame
 {

netwerk/base/Dashboard.cpp

@@ -147,7 +147,10 @@ public:
     void StartTimer(uint32_t aTimeout);
     void StopTimer();
 
-    explicit ConnectionData(Dashboard *target)
+    explicit ConnectionData(Dashboard* target)
+        : mPort(0)
+        , mProtocol(nullptr)
+        , mTimeout(0)
     {
         mEventTarget = nullptr;
         mDashboard = target;
@@ -287,7 +290,11 @@ public:
     NS_DECL_THREADSAFE_ISUPPORTS
     NS_DECL_NSIDNSLISTENER
 
-    LookupHelper() = default;
+    LookupHelper()
+        : mEventTarget{ nullptr }
+        , mStatus{ NS_ERROR_NOT_INITIALIZED }
+    {
+    }
 
     nsresult ConstructAnswer(LookupArgument *aArgument);
 public:

netwerk/base/MemoryDownloader.cpp

@@ -17,6 +17,7 @@ NS_IMPL_ISUPPORTS(MemoryDownloader,
 
 MemoryDownloader::MemoryDownloader(IObserver* aObserver)
 : mObserver(aObserver)
+, mStatus(NS_ERROR_NOT_INITIALIZED)
 {
 }
 

netwerk/base/Predictor.cpp

@@ -262,6 +262,9 @@ NS_IMPL_ISUPPORTS(Predictor,
 
 Predictor::Predictor()
   :mInitialized(false)
+  ,mCleanedUp(false)
+  ,mStartupTime(0)
+  ,mLastStartupTime(0)
   ,mStartupCount(1)
 {
   MOZ_ASSERT(!sSelf, "multiple Predictor instances!");

netwerk/base/RequestContextService.cpp

@@ -464,7 +464,8 @@ RequestContextService *RequestContextService::sSelf = nullptr;
 NS_IMPL_ISUPPORTS(RequestContextService, nsIRequestContextService, nsIObserver)
 
 RequestContextService::RequestContextService()
-  : mNextRCID(1)
+  : mRCIDNamespace(0)
+  , mNextRCID(1)
 {
   MOZ_ASSERT(!sSelf, "multiple rcs instances!");
   MOZ_ASSERT(NS_IsMainThread());

netwerk/base/TCPFastOpenLayer.cpp

@@ -58,7 +58,17 @@ public:
     : mState(WAITING_FOR_CONNECT)
     , mFirstPacketBufLen(0)
     , mCondition(0)
-  {}
+  {
+    this->mAddr.raw.family = 0;
+    this->mAddr.inet.family = 0;
+    this->mAddr.inet.port = 0;
+    this->mAddr.inet.ip = 0;
+    this->mAddr.ipv6.family = 0;
+    this->mAddr.ipv6.port = 0;
+    this->mAddr.ipv6.flowinfo = 0;
+    this->mAddr.ipv6.scope_id = 0;
+    this->mAddr.local.family = 0;
+  }
 
   enum {
     CONNECTED,

netwerk/base/nsAsyncStreamCopier.cpp

@@ -74,6 +74,8 @@ nsAsyncStreamCopier::nsAsyncStreamCopier()
     , mChunkSize(nsIOService::gDefaultSegmentSize)
     , mStatus(NS_OK)
     , mIsPending(false)
+    , mCloseSource{ false }
+    , mCloseSink{ false }
     , mShouldSniffBuffering(false)
 {
     LOG(("Creating nsAsyncStreamCopier @%p\n", this));

netwerk/base/nsBaseChannel.cpp

@@ -59,6 +59,7 @@ nsBaseChannel::nsBaseChannel()
   , mAllowThreadRetargeting(true)
   , mWaitingOnAsyncRedirect(false)
   , mOpenRedirectChannel(false)
+  , mRedirectFlags{ 0 }
   , mStatus(NS_OK)
   , mContentDispositionHint(UINT32_MAX)
   , mContentLength(-1)

netwerk/base/nsBufferedStreams.cpp

@@ -46,7 +46,8 @@ using mozilla::Some;
 // nsBufferedStream
 
 nsBufferedStream::nsBufferedStream()
-    : mBuffer(nullptr),
+    : mBufferSize(0),
+      mBuffer(nullptr),
       mBufferStartOffset(0),
       mCursor(0),
       mFillPoint(0),

netwerk/base/nsIURIMutatorUtils.cpp

@@ -18,6 +18,7 @@ NS_MutateURI::NS_MutateURI(nsIURI* aURI)
 }
 
 NS_MutateURI::NS_MutateURI(const char * aContractID)
+  : mStatus(NS_ERROR_NOT_INITIALIZED)
 {
   mMutator = do_CreateInstance(aContractID, &mStatus);
   MOZ_ASSERT(NS_SUCCEEDED(mStatus), "Called with wrong aContractID");

netwerk/base/nsInputStreamPump.cpp

@@ -38,9 +38,13 @@ static mozilla::LazyLogModule gStreamPumpLog("nsStreamPump");
 nsInputStreamPump::nsInputStreamPump()
     : mState(STATE_IDLE)
     , mStreamOffset(0)
+    , mStreamLength(0)
+    , mSegSize(0)
+    , mSegCount(0)
     , mStatus(NS_OK)
     , mSuspendCount(0)
     , mLoadFlags(LOAD_NORMAL)
+    , mIsPending(false)
     , mProcessingCallbacks(false)
     , mWaitingForInputStreamReady(false)
     , mCloseWhenDone(false)

netwerk/base/nsPACMan.cpp

@@ -277,6 +277,7 @@ PendingPACQuery::PendingPACQuery(nsPACMan* pacMan,
                                  nsPACManCallback* callback,
                                  bool mainThreadResponse)
   : Runnable("net::PendingPACQuery")
+  , mPort(0)
   , mPACMan(pacMan)
   , mCallback(callback)
   , mOnMainThreadOnly(mainThreadResponse)

netwerk/base/nsServerSocket.cpp

@@ -44,6 +44,15 @@ nsServerSocket::nsServerSocket()
   , mAttached(false)
   , mKeepWhenOffline(false)
 {
+  this->mAddr.raw.family = 0;
+  this->mAddr.inet.family = 0;
+  this->mAddr.inet.port = 0;
+  this->mAddr.inet.ip = 0;
+  this->mAddr.ipv6.family = 0;
+  this->mAddr.ipv6.port = 0;
+  this->mAddr.ipv6.flowinfo = 0;
+  this->mAddr.ipv6.scope_id = 0;
+  this->mAddr.local.family = 0;
   // we want to be able to access the STS directly, and it may not have been
   // constructed yet.  the STS constructor sets gSocketTransportService.
   if (!gSocketTransportService)

netwerk/base/nsSocketTransport2.cpp

@@ -794,6 +794,10 @@ nsSocketTransport::nsSocketTransport()
     , mFirstRetryError(NS_OK)
     , mDoNotRetryToConnect(false)
 {
+    this->mNetAddr.raw.family = 0;
+    this->mNetAddr.inet = {};
+    this->mSelfAddr.raw.family = 0;
+    this->mSelfAddr.inet = {};
     SOCKET_LOG(("creating nsSocketTransport @%p\n", this));
 
     mTimeouts[TIMEOUT_CONNECT]    = UINT16_MAX; // no timeout

netwerk/base/nsStandardURL.h

@@ -474,7 +474,9 @@ public:
             return NS_OK;
         }
 
-        explicit TemplatedMutator() = default;
+        explicit TemplatedMutator() : mMarkedFileURL(false)
+        {
+        }
     private:
         virtual ~TemplatedMutator() = default;
 

netwerk/base/nsUDPSocket.cpp

@@ -264,6 +264,7 @@ nsUDPSocket::nsUDPSocket()
   , mByteReadCount(0)
   , mByteWriteCount(0)
 {
+  this->mAddr.inet = {};
   mAddr.raw.family = PR_AF_UNSPEC;
   // we want to be able to access the STS directly, and it may not have been
   // constructed yet.  the STS constructor sets gSocketTransportService.

netwerk/cache/nsCacheEntry.cpp

@@ -27,13 +27,16 @@ nsCacheEntry::nsCacheEntry(const nsACString &   key,
       mFetchCount(0),
       mLastFetched(0),
       mLastModified(0),
+      mLastValidated(0),
       mExpirationTime(nsICache::NO_EXPIRATION_TIME),
       mFlags(0),
       mPredictedDataSize(-1),
       mDataSize(0),
       mCacheDevice(nullptr),
       mCustomDevice(nullptr),
-      mData(nullptr)
+      mData(nullptr),
+      mRequestQ{},
+      mDescriptorQ{}
 {
     MOZ_COUNT_CTOR(nsCacheEntry);
     PR_INIT_CLIST(this);

netwerk/cache/nsCacheEntryDescriptor.h

@@ -123,6 +123,7 @@ private:
           : nsInputStreamWrapper(desc, off)
           , mReadBuffer(nullptr)
           , mReadBufferLen(0)
+          , mZstream{}
           , mStreamInitialized(false)
           , mStreamEnded(false)
          {
@@ -203,6 +204,7 @@ private:
           : nsOutputStreamWrapper(desc, off)
           , mWriteBuffer(nullptr)
           , mWriteBufferLen(0)
+          , mZstream{}
           , mStreamInitialized(false)
           , mStreamEnded(false)
           , mUncompressedCount(0)

netwerk/cache/nsCacheService.cpp

@@ -1103,9 +1103,11 @@ nsCacheService::nsCacheService()
       mClearingEntries(false),
       mEnableMemoryDevice(true),
       mEnableDiskDevice(true),
+      mEnableOfflineDevice(false),
       mMemoryDevice(nullptr),
       mDiskDevice(nullptr),
       mOfflineDevice(nullptr),
+      mDoomedEntries{},
       mTotalEntries(0),
       mCacheHits(0),
       mCacheMisses(0),

netwerk/cache/nsDiskCacheStreams.h

@@ -43,7 +43,17 @@ public:
 
     // GCC 2.95.2 requires this to be defined, although we never call it.
     // and OS/2 requires that it not be private
-    nsDiskCacheStreamIO() { NS_NOTREACHED("oops"); }
+    nsDiskCacheStreamIO()
+        : mBinding(nullptr),
+          mDevice(nullptr),
+          mFD(nullptr),
+          mStreamEnd(0),
+          mBufSize(0),
+          mBuffer(nullptr),
+          mOutputStreamIsOpen(false)
+    {
+        NS_NOTREACHED("oops");
+    }
 
 private:
     virtual ~nsDiskCacheStreamIO();

netwerk/cache2/CacheFileIOManager.cpp

@@ -1065,6 +1065,11 @@ public:
     , mHasHasAltData(false)
     , mHasOnStartTime(false)
     , mHasOnStopTime(false)
+    , mFrecency(0)
+    , mExpirationTime(0)
+    , mHasAltData(false)
+    , mOnStartTime(0)
+    , mOnStopTime(0)
   {
     if (aFrecency) {
       mHasFrecency = true;
@@ -4279,9 +4284,11 @@ public:
                         nsTArray<CacheFileHandle*> const& specialHandles)
     : Runnable("net::SizeOfHandlesRunnable")
     , mMonitor("SizeOfHandlesRunnable.mMonitor")
+    , mMonitorNotified(false)
     , mMallocSizeOf(mallocSizeOf)
     , mHandles(handles)
     , mSpecialHandles(specialHandles)
+    , mSize(0)
   {
   }
 

netwerk/cache2/CacheIndex.h

@@ -1209,6 +1209,7 @@ private:
     explicit DiskConsumptionObserver(nsWeakPtr const& aWeakObserver)
       : Runnable("net::CacheIndex::DiskConsumptionObserver")
       , mObserver(aWeakObserver)
+      , mSize(0)
     {
     }
     virtual ~DiskConsumptionObserver() {

netwerk/cache2/CacheStorageService.cpp

@@ -368,6 +368,7 @@ public:
     : WalkCacheRunnable(aVisitor, aVisitEntries)
     , mLoadInfo(aLoadInfo)
     , mPass(COLLECT_STATS)
+    , mCount(0)
   {
   }
 
@@ -396,6 +397,11 @@ private:
     explicit OnCacheEntryInfoRunnable(WalkDiskCacheRunnable* aWalker)
       : Runnable("net::WalkDiskCacheRunnable::OnCacheEntryInfoRunnable")
       , mWalker(aWalker)
+      , mDataSize(0)
+      , mFetchCount(0)
+      , mLastModifiedTime(0)
+      , mExpirationTime(0)
+      , mPinned(false)
     {
     }
 
@@ -1633,7 +1639,10 @@ public:
   NS_DECL_NSIRUNNABLE
 
   explicit CacheEntryDoomByKeyCallback(nsICacheEntryDoomCallback* aCallback)
-    : mCallback(aCallback) { }
+    : mCallback(aCallback)
+    , mResult(NS_ERROR_NOT_INITIALIZED)
+  {
+  }
 
 private:
   virtual ~CacheEntryDoomByKeyCallback();

netwerk/dns/DNS.cpp

@@ -283,6 +283,8 @@ NetAddr::operator < (const NetAddr& other) const
 
 NetAddrElement::NetAddrElement(const PRNetAddr *prNetAddr)
 {
+  this->mAddress.raw.family = 0;
+  this->mAddress.inet = {};
   PRNetAddrToNetAddr(prNetAddr, &mAddress);
 }
 

netwerk/dns/TRR.h

@@ -108,6 +108,7 @@ public:
   explicit TRR(AHostResolver *aResolver, bool aPB)
     : mozilla::Runnable("TRR")
     , mHostResolver(aResolver)
+    , mType(TRRTYPE_A)
     , mBodySize(0)
     , mFailed(false)
     , mPB(aPB)

netwerk/dns/nsDNSService2.cpp

@@ -493,10 +493,16 @@ nsDNSService::nsDNSService()
     : mLock("nsDNSServer.mLock")
     , mDisableIPv6(false)
     , mDisablePrefetch(false)
+    , mBlockDotOnion(false)
     , mNotifyResolution(false)
     , mOfflineLocalhost(false)
     , mForceResolveOn(false)
+    , mProxyType(0)
     , mTrrService(nullptr)
+    , mResCacheEntries(0)
+    , mResCacheExpiration(0)
+    , mResCacheGrace(0)
+    , mResolverPrefsUpdated(false)
 {
 }
 

netwerk/dns/nsHostResolver.cpp

@@ -183,6 +183,7 @@ nsHostRecord::nsHostRecord(const nsHostKey& key)
     , addr_info(nullptr)
     , addr(nullptr)
     , negative(false)
+    , mResolverMode(MODE_NATIVEONLY)
     , mResolving(0)
     , mTRRSuccess(0)
     , mNativeSuccess(0)

netwerk/dns/nsIDNService.cpp

@@ -141,6 +141,7 @@ void nsIDNService::prefsChanged(nsIPrefBranch *prefBranch, const char16_t *pref)
 nsIDNService::nsIDNService()
   : mLock("DNService pref value lock")
   , mShowPunycode(false)
+  , mRestrictionProfile(static_cast<restrictionProfile>(0))
   , mIDNUseWhitelist(false)
 {
   MOZ_ASSERT(NS_IsMainThread());

netwerk/ipc/NeckoMessageUtils.h

@@ -27,7 +27,12 @@ struct Permission
   uint32_t capability, expireType;
   int64_t expireTime;
 
-  Permission() { }
+  Permission()
+    : capability(0)
+    , expireType(0)
+    , expireTime(0)
+  {}
+  
   Permission(const nsCString& aOrigin,
              const nsCString& aType,
              const uint32_t aCapability,

netwerk/protocol/file/nsFileChannel.cpp

@@ -257,7 +257,8 @@ nsFileUploadContentStream::OnCopyComplete()
 //-----------------------------------------------------------------------------
 
 nsFileChannel::nsFileChannel(nsIURI *uri)
-  : mFileURI(uri)
+  : mUploadLength(0)
+  , mFileURI(uri)
 {
 }
 

netwerk/protocol/ftp/nsFtpConnectionThread.cpp

@@ -75,6 +75,7 @@ nsFtpState::nsFtpState()
     , mState(FTP_INIT)
     , mNextState(FTP_S_USER)
     , mKeepRunning(true)
+    , mResponseCode(0)
     , mReceivedControlData(false)
     , mTryingCachedControl(false)
     , mRETRFailed(false)
@@ -94,6 +95,8 @@ nsFtpState::nsFtpState()
     , mControlStatus(NS_OK)
     , mDeferredCallbackPending(false)
 {
+    this->mServerAddress.raw.family = 0;
+    this->mServerAddress.inet = {};
     LOG_INFO(("FTP:(%p) nsFtpState created", this));
 
     // make sure handler stays around

netwerk/protocol/ftp/nsFtpControlConnection.cpp

@@ -66,8 +66,12 @@ nsFtpControlConnection::OnInputStreamReady(nsIAsyncInputStream *stream)
 
 nsFtpControlConnection::nsFtpControlConnection(const nsACString& host,
                                                uint32_t port)
-    : mServerType(0), mSessionId(gFtpHandler->GetSessionId())
-    , mUseUTF8(false), mHost(host), mPort(port)
+    : mServerType(0)
+    , mSuspendedWrite(0)
+    , mSessionId(gFtpHandler->GetSessionId())
+    , mUseUTF8(false)
+    , mHost(host)
+    , mPort(port)
 {
     LOG_INFO(("FTP:CC created @%p", this));
 }

netwerk/protocol/http/Http2Compression.h

@@ -100,6 +100,11 @@ class Http2Decompressor final : public Http2BaseCompressor
 {
 public:
   Http2Decompressor()
+    : mOffset(0)
+    , mData(nullptr)
+    , mDataLen(0)
+    , mSeenNonColonHeader(false)
+    , mIsPush(false)
   {
     mPeakSizeID = Telemetry::HPACK_PEAK_SIZE_DECOMPRESSOR;
     mPeakCountID = Telemetry::HPACK_PEAK_COUNT_DECOMPRESSOR;

netwerk/protocol/http/Http2Session.cpp

@@ -114,6 +114,7 @@ Http2Session::Http2Session(nsISocketTransport *aSocketTransport, enum SpdyVersio
   , mLastReadEpoch(PR_IntervalNow())
   , mPingSentEpoch(0)
   , mPreviousUsed(false)
+  , mAggregatedHeaderSize(0)
   , mWaitingForSettingsAck(false)
   , mGoAwayOnPush(false)
   , mUseH2Deps(false)

netwerk/protocol/http/HttpBaseChannel.cpp

@@ -199,6 +199,7 @@ HttpBaseChannel::HttpBaseChannel()
   , mReferrerPolicy(NS_GetDefaultReferrerPolicy())
   , mRedirectCount(0)
   , mInternalRedirectCount(0)
+  , mChannelCreationTime(0)
   , mForcePending(false)
   , mCorsIncludeCredentials(false)
   , mCorsMode(nsIHttpChannelInternal::CORS_MODE_NO_CORS)
@@ -219,10 +220,13 @@ HttpBaseChannel::HttpBaseChannel()
   , mAltDataForChild(false)
   , mForceMainDocumentChannel(false)
   , mIsTrackingResource(false)
+  , mChannelId(0)
   , mLastRedirectFlags(0)
   , mReqContentLength(0U)
   , mPendingInputStreamLengthOperation(false)
 {
+  this->mSelfAddr.inet = {};
+  this->mPeerAddr.inet = {};
   LOG(("Creating HttpBaseChannel @%p\n", this));
 
   // Subfields of unions cannot be targeted in an initializer list.

netwerk/protocol/http/NullHttpChannel.cpp

@@ -15,6 +15,8 @@ NS_IMPL_ISUPPORTS(NullHttpChannel, nsINullChannel,
                   nsIHttpChannel, nsITimedChannel)
 
 NullHttpChannel::NullHttpChannel()
+  : mAllRedirectsSameOrigin(false)
+  , mAllRedirectsPassTimingAllowCheck(false)
 {
   mChannelCreationTime = PR_Now();
   mChannelCreationTimestamp = TimeStamp::Now();
@@ -22,6 +24,8 @@ NullHttpChannel::NullHttpChannel()
 }
 
 NullHttpChannel::NullHttpChannel(nsIHttpChannel * chan)
+  : mAllRedirectsSameOrigin(false)
+  , mAllRedirectsPassTimingAllowCheck(false)
 {
   nsIScriptSecurityManager* ssm = nsContentUtils::GetSecurityManager();
   ssm->GetChannelURIPrincipal(chan, getter_AddRefs(mResourcePrincipal));

netwerk/protocol/http/TunnelUtils.cpp

@@ -43,7 +43,9 @@ TLSFilterTransaction::TLSFilterTransaction(nsAHttpTransaction *aWrapped,
   , mEncryptedTextSize(0)
   , mSegmentReader(aReader)
   , mSegmentWriter(aWriter)
+  , mFilterReadCode(NS_ERROR_NOT_INITIALIZED)
   , mForce(false)
+  , mReadSegmentBlocked(false)
   , mNudgeCounter(0)
 {
   MOZ_ASSERT(OnSocketThread(), "not on socket thread");

netwerk/protocol/http/nsCORSListenerProxy.cpp

@@ -419,6 +419,9 @@ nsCORSListenerProxy::nsCORSListenerProxy(nsIStreamListener* aOuter,
     mWithCredentials(aWithCredentials && !gDisableCORSPrivateData),
     mRequestApproved(false),
     mHasBeenCrossSite(false),
+#ifdef DEBUG
+    mInited(false),
+#endif
     mMutex("nsCORSListenerProxy")
 {
 }

netwerk/protocol/http/nsHttpAuthCache.h

@@ -43,6 +43,8 @@ public:
                        const char16_t *user,
                        const char16_t *password)
         : mUser(nullptr)
+        , mPass{ nullptr }
+        , mDomain{ nullptr }
     {
         DebugOnly<nsresult> rv = Set(domain, user, password);
         MOZ_ASSERT(NS_SUCCEEDED(rv));
@@ -106,6 +108,8 @@ private:
         : mRoot(nullptr)
         , mTail(nullptr)
         , mRealm(nullptr)
+        , mCreds{ nullptr }
+        , mChallenge{ nullptr }
     {
         DebugOnly<nsresult> rv = Set(path, realm, creds, challenge, ident, metadata);
         MOZ_ASSERT(NS_SUCCEEDED(rv));

netwerk/protocol/http/nsHttpAuthManager.cpp

@@ -16,6 +16,12 @@ namespace net {
 
 NS_IMPL_ISUPPORTS(nsHttpAuthManager, nsIHttpAuthManager)
 
+nsHttpAuthManager::nsHttpAuthManager()
+  : mAuthCache(nullptr)
+  , mPrivateAuthCache(nullptr)
+{
+}
+
 nsresult nsHttpAuthManager::Init()
 {
   // get reference to the auth cache.  we assume that we will live

netwerk/protocol/http/nsHttpAuthManager.h

@@ -19,7 +19,7 @@ public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSIHTTPAUTHMANAGER
 
-  nsHttpAuthManager() = default;
+  nsHttpAuthManager();
   MOZ_MUST_USE nsresult Init();
 
 protected:

netwerk/protocol/http/nsHttpChannel.cpp

@@ -304,6 +304,7 @@ nsHttpChannel::nsHttpChannel()
     , mRequestTime(0)
     , mOfflineCacheLastModifiedTime(0)
     , mSuspendTotalTime(0)
+    , mRedirectType(0)
     , mCacheOpenWithPriority(false)
     , mCacheQueueSizeWhenOpen(0)
     , mCachedContentIsValid(false)
@@ -333,6 +334,7 @@ nsHttpChannel::nsHttpChannel()
     , mUsedNetwork(0)
     , mAuthConnectionRestartable(0)
     , mPushedStream(nullptr)
+    , mLocalBlocklist(false)
     , mOnTailUnblock(nullptr)
     , mWarningReporter(nullptr)
     , mIsReadingFromCache(false)

netwerk/protocol/http/nsHttpConnection.cpp

@@ -46,9 +46,14 @@ namespace net {
 //-----------------------------------------------------------------------------
 
 nsHttpConnection::nsHttpConnection()
-    : mTransaction(nullptr)
+    : mSocketInCondition(NS_ERROR_NOT_INITIALIZED)
+    , mSocketOutCondition(NS_ERROR_NOT_INITIALIZED)
+    , mTransaction(nullptr)
     , mHttpHandler(gHttpHandler)
     , mCallbacksLock("nsHttpConnection::mCallbacksLock")
+    , mLastReadTime(0)
+    , mLastWriteTime(0)
+    , mMaxHangTime(0)
     , mConsiderReusedAfterInterval(0)
     , mConsiderReusedAfterEpoch(0)
     , mCurrentBytesRead(0)
@@ -56,6 +61,7 @@ nsHttpConnection::nsHttpConnection()
     , mTotalBytesRead(0)
     , mTotalBytesWritten(0)
     , mContentBytesWritten(0)
+    , mRtt(0)
     , mUrgentStartPreferred(false)
     , mUrgentStartPreferredKnown(false)
     , mConnectedTransport(false)
@@ -70,6 +76,7 @@ nsHttpConnection::nsHttpConnection()
     , mExperienced(false)
     , mInSpdyTunnel(false)
     , mForcePlainText(false)
+    , mTrafficCount(0)
     , mTrafficStamp(false)
     , mHttp1xTransactionCount(0)
     , mRemainingConnectionUses(0xffffffff)

netwerk/protocol/http/nsHttpConnectionMgr.cpp

@@ -464,7 +464,14 @@ nsHttpConnectionMgr::DoShiftReloadConnectionCleanup(nsHttpConnectionInfo *aCI)
 class SpeculativeConnectArgs : public ARefBase
 {
 public:
-    SpeculativeConnectArgs() { mOverridesOK = false; }
+    SpeculativeConnectArgs()
+        : mParallelSpeculativeConnectLimit(0)
+        , mIgnoreIdle(false)
+        , mIsFromPredictor(false)
+        , mAllow1918(false)
+    {
+        mOverridesOK = false;
+    }
     NS_INLINE_DECL_THREADSAFE_REFCOUNTING(SpeculativeConnectArgs, override)
 
 public: // intentional!

netwerk/protocol/http/nsHttpHandler.cpp

@@ -226,6 +226,7 @@ nsHttpHandler::nsHttpHandler()
     , mTailDelayQuantum(600)
     , mTailDelayQuantumAfterDCL(100)
     , mTailDelayMax(6000)
+    , mTailTotalMax(0)
     , mRedirectionLimit(10)
     , mPhishyUserPassLength(1)
     , mQoSBits(0x00)

netwerk/protocol/http/nsHttpNTLMAuth.h

@@ -15,7 +15,7 @@ public:
     NS_DECL_ISUPPORTS
     NS_DECL_NSIHTTPAUTHENTICATOR
 
-    nsHttpNTLMAuth() = default;
+    nsHttpNTLMAuth() : mUseNative(false) {}
 
 private:
     virtual ~nsHttpNTLMAuth() = default;

netwerk/protocol/http/nsHttpTransaction.cpp

@@ -146,6 +146,8 @@ nsHttpTransaction::nsHttpTransaction()
     , mEarlyDataDisposition(EARLY_NONE)
     , mFastOpenStatus(TFO_NOT_TRIED)
 {
+    this->mSelfAddr.inet = {};
+    this->mPeerAddr.inet = {};
     LOG(("Creating nsHttpTransaction @%p\n", this));
 
 #ifdef MOZ_VALGRIND

netwerk/protocol/viewsource/nsViewSourceChannel.h

@@ -46,7 +46,8 @@ public:
     // nsViewSourceChannel methods:
     nsViewSourceChannel()
         : mIsDocument(false)
-        , mOpened(false) {}
+        , mOpened(false)
+        , mIsSrcdocChannel(false) {}
 
     MOZ_MUST_USE nsresult Init(nsIURI* uri);
 

netwerk/protocol/websocket/WebSocketChannel.cpp

@@ -787,6 +787,28 @@ public:
     , mResetDeflater(false)
     , mMessageDeflated(false)
   {
+    this->mDeflater.next_in = nullptr;
+    this->mDeflater.avail_in = 0;
+    this->mDeflater.total_in = 0;
+    this->mDeflater.next_out = nullptr;
+    this->mDeflater.avail_out = 0;
+    this->mDeflater.total_out = 0;
+    this->mDeflater.msg = nullptr;
+    this->mDeflater.state = nullptr;
+    this->mDeflater.data_type = 0;
+    this->mDeflater.adler = 0;
+    this->mDeflater.reserved = 0;
+    this->mInflater.next_in = nullptr;
+    this->mInflater.avail_in = 0;
+    this->mInflater.total_in = 0;
+    this->mInflater.next_out = nullptr;
+    this->mInflater.avail_out = 0;
+    this->mInflater.total_out = 0;
+    this->mInflater.msg = nullptr;
+    this->mInflater.state = nullptr;
+    this->mInflater.data_type = 0;
+    this->mInflater.adler = 0;
+    this->mInflater.reserved = 0;
     MOZ_COUNT_CTOR(PMCECompression);
 
     mDeflater.zalloc = mInflater.zalloc = Z_NULL;
@@ -1158,6 +1180,7 @@ WebSocketChannel::WebSocketChannel() :
   mOpenTimeout(20000),
   mConnecting(NOT_CONNECTING),
   mMaxConcurrentConnections(200),
+  mInnerWindowID(0),
   mGotUpgradeOK(0),
   mRecvdHttpUpgradeTransport(0),
   mAutoFollowRedirects(0),
@@ -1184,6 +1207,8 @@ WebSocketChannel::WebSocketChannel() :
   mBufferSize(kIncomingBufferInitialSize),
   mCurrentOut(nullptr),
   mCurrentOutSent(0),
+  mHdrOutToSend(0),
+  mHdrOut(nullptr),
   mDynamicOutputSize(0),
   mDynamicOutput(nullptr),
   mPrivateBrowsing(false),

netwerk/socket/nsSOCKSIOLayer.cpp

@@ -231,6 +231,7 @@ nsSOCKSSocketInfo::nsSOCKSSocketInfo()
     , mDataLength(0)
     , mReadOffset(0)
     , mAmountToRead(0)
+    , mLookupStatus(NS_ERROR_NOT_INITIALIZED)
     , mFD(nullptr)
     , mVersion(-1)
     , mDestinationFamily(AF_INET)
@@ -238,6 +239,24 @@ nsSOCKSSocketInfo::nsSOCKSSocketInfo()
     , mTlsFlags(0)
     , mTimeout(PR_INTERVAL_NO_TIMEOUT)
 {
+    this->mInternalProxyAddr.inet.family = 0;
+    this->mInternalProxyAddr.inet6.family = 0;
+    this->mInternalProxyAddr.inet6.port = 0;
+    this->mInternalProxyAddr.inet6.flowinfo = 0;
+    this->mInternalProxyAddr.inet6.scope_id = 0;
+    this->mInternalProxyAddr.local.family = 0;
+    this->mExternalProxyAddr.inet.family = 0;
+    this->mExternalProxyAddr.inet6.family = 0;
+    this->mExternalProxyAddr.inet6.port = 0;
+    this->mExternalProxyAddr.inet6.flowinfo = 0;
+    this->mExternalProxyAddr.inet6.scope_id = 0;
+    this->mExternalProxyAddr.local.family = 0;
+    this->mDestinationAddr.inet.family = 0;
+    this->mDestinationAddr.inet6.family = 0;
+    this->mDestinationAddr.inet6.port = 0;
+    this->mDestinationAddr.inet6.flowinfo = 0;
+    this->mDestinationAddr.inet6.scope_id = 0;
+    this->mDestinationAddr.local.family = 0;
     mData = new uint8_t[BUFFER_SIZE];
 
     mInternalProxyAddr.raw.family = AF_INET;

netwerk/streamconv/converters/nsDirIndexParser.cpp

@@ -25,6 +25,11 @@ NS_IMPL_ISUPPORTS(nsDirIndexParser,
                   nsIStreamListener,
                   nsIDirIndexParser)
 
+nsDirIndexParser::nsDirIndexParser()
+  : mLineStart(0)
+  , mHasDescription(false) {
+}
+
 nsresult
 nsDirIndexParser::Init() {
   mLineStart = 0;

netwerk/streamconv/converters/nsDirIndexParser.h

@@ -26,7 +26,7 @@ public:
     NS_DECL_NSIREQUESTOBSERVER
     NS_DECL_NSIDIRINDEXPARSER
 
-    nsDirIndexParser() = default;
+    nsDirIndexParser();
     nsresult Init();
 
     enum fieldType {

netwerk/streamconv/converters/nsHTTPCompressConv.cpp

@@ -46,6 +46,8 @@ nsHTTPCompressConv::nsHTTPCompressConv()
   , mCheckHeaderDone(false)
   , mStreamEnded(false)
   , mStreamInitialized(false)
+  , mDummyStreamInitialised(false)
+  , d_stream{}
   , mLen(0)
   , hMode(0)
   , mSkipCount(0)

netwerk/streamconv/converters/nsHTTPCompressConv.h

@@ -61,6 +61,9 @@ public:
     : mTotalOut(0)
     , mStatus(NS_OK)
     , mBrotliStateIsStreamEnd(false)
+    , mRequest(nullptr)
+    , mContext(nullptr)
+    , mSourceOffset(0)
   {
     BrotliDecoderStateInit(&mState, 0, 0, 0);
   }

netwerk/streamconv/converters/nsIndexedToHTML.cpp

@@ -54,6 +54,11 @@ static void AppendNonAsciiToNCR(const nsAString& in, nsCString& out)
   }
 }
 
+nsIndexedToHTML::nsIndexedToHTML()
+    : mExpectAbsLoc(false)
+{
+}
+
 nsresult
 nsIndexedToHTML::Create(nsISupports *aOuter, REFNSIID aIID, void **aResult) {
     nsresult rv;

netwerk/streamconv/converters/nsIndexedToHTML.h

@@ -27,7 +27,7 @@ public:
     NS_DECL_NSISTREAMLISTENER
     NS_DECL_NSIDIRINDEXLISTENER
 
-    nsIndexedToHTML() = default;
+    nsIndexedToHTML();
 
     nsresult Init(nsIStreamListener *aListener);
 

netwerk/streamconv/converters/nsMultiMixedConv.cpp

@@ -27,6 +27,8 @@ nsPartChannel::nsPartChannel(nsIChannel *aMultipartChannel, uint32_t aPartID,
   mMultipartChannel(aMultipartChannel),
   mListener(aListener),
   mStatus(NS_OK),
+  mLoadFlags(0),
+  mContentDisposition(0),
   mContentLength(UINT64_MAX),
   mIsByteRangeRequest(false),
   mByteRangeStart(0),
@@ -813,6 +815,7 @@ nsMultiMixedConv::SwitchToControlParsing()
 nsMultiMixedConv::nsMultiMixedConv() :
     mCurrentPartID(0),
     mInOnDataAvailable(false),
+    mResponseHeader(HEADER_UNKNOWN),
     // XXX: This is a hack to bypass the raw pointer to refcounted object in
     // lambda analysis. It should be removed and replaced when the
     // IncrementalTokenizer API is improved to avoid the need for such

netwerk/test/TestUDPSocket.cpp

@@ -213,7 +213,8 @@ protected:
 
 public:
   explicit MulticastTimerCallback(WaitForCondition* waiter)
-    : mWaiter(waiter)
+    : mResult(NS_ERROR_NOT_INITIALIZED)
+    , mWaiter(waiter)
   { }
 
   NS_DECL_THREADSAFE_ISUPPORTS

parser/html/nsHtml5SpeculativeLoad.cpp

@@ -9,13 +9,10 @@
 using namespace mozilla;
 
 nsHtml5SpeculativeLoad::nsHtml5SpeculativeLoad()
-  :
-#ifdef DEBUG
-  mOpCode(eSpeculativeLoadUninitialized)
-  ,
-#endif
-  mIsAsync(false)
+  : mOpCode(eSpeculativeLoadUninitialized)
+  , mIsAsync(false)
   , mIsDefer(false)
+  , mEncoding(nullptr)
 {
   MOZ_COUNT_CTOR(nsHtml5SpeculativeLoad);
   new (&mCharsetOrSrcset) nsString;