Merge mozilla-central to fx-team

b2g/chrome/content/content.css

@@ -30,19 +30,14 @@ html xul|scrollbar {
   pointer-events: none;
 }
 
+/* Scrollbar code will reset the margin to the correct side depending on
+   layout.scrollbar.side pref */
 xul|scrollbar[orient="vertical"] {
-  -moz-margin-start: -8px;
+  margin-left: -8px;
   min-width: 8px;
   max-width: 8px;
 }
 
-/* workaround for bug 1119057: as -moz-margin-start may not work as expected,
- * force a right margin value in RTL mode.  */
-[dir="rtl"] xul|scrollbar[root="true"][orient="vertical"] {
-  -moz-margin-start: unset;
-  margin-right: -8px;
-}
-
 xul|scrollbar[orient="vertical"] xul|thumb {
   max-width: 6px !important;
   min-width: 6px !important;

browser/themes/linux/devtools/floating-scrollbars.css

@@ -9,8 +9,10 @@ scrollbar {
   padding: 2px;
 }
 
+/* Scrollbar code will reset the margin to the correct side depending on
+   layout.scrollbar.side pref */
 scrollbar[orient="vertical"] {
-  -moz-margin-start: -10px;
+  margin-left: -10px;
   min-width: 10px;
   max-width: 10px;
 }

browser/themes/osx/devtools/floating-scrollbars.css

@@ -10,8 +10,10 @@ scrollbar {
   padding: 2px;
 }
 
+/* Scrollbar code will reset the margin to the correct side depending on
+   layout.scrollbar.side pref */
 scrollbar[orient="vertical"] {
-  -moz-margin-start: -8px;
+  margin-left: -8px;
   min-width: 8px;
   max-width: 8px;
 }

browser/themes/windows/devtools/floating-scrollbars.css

@@ -9,8 +9,10 @@ scrollbar {
   padding: 2px;
 }
 
+/* Scrollbar code will reset the margin to the correct side depending on
+   layout.scrollbar.side pref */
 scrollbar[orient="vertical"] {
-  -moz-margin-start: -10px;
+  margin-left: -10px;
   min-width: 10px;
   max-width: 10px;
 }

build/autoconf/icu.m4

@@ -99,6 +99,12 @@ if test -n "$USE_ICU"; then
                     MOZ_ICU_DBG_SUFFIX=d
                 fi
                 ;;
+            Android)
+                if test -z "$gonkdir"; then
+                    AC_MSG_ERROR([ECMAScript Internationalization API is not yet supported on this platform])
+                fi
+                ICU_LIB_NAMES="icui18n icuuc icudata"
+                ;;
             Darwin|Linux|DragonFly|FreeBSD|NetBSD|OpenBSD|GNU/kFreeBSD|SunOS)
                 ICU_LIB_NAMES="icui18n icuuc icudata"
                 ;;
@@ -271,6 +277,10 @@ if test -z "$BUILDING_JS" -o -n "$JS_STANDALONE"; then
     	fi
         fi
 
+        if test -n "$gonkdir"; then
+            ICU_CXXFLAGS="-I$gonkdir/abi/cpp/include $ICU_CXXFLAGS"
+        fi
+
         if test -z "$MOZ_SHARED_ICU"; then
           ICU_CXXFLAGS="$ICU_CXXFLAGS -DU_STATIC_IMPLEMENTATION"
           ICU_CFLAGS="$ICU_CFLAGS -DU_STATIC_IMPLEMENTATION"

config/external/icu/moz.build

@@ -16,3 +16,8 @@ else:
             l,
             CONFIG['MOZ_ICU_DBG_SUFFIX']
         )]
+
+    if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'gonk':
+        OS_LIBS += [
+            'gabi++',
+        ]

config/system-headers

@@ -1346,6 +1346,7 @@ unicode/ucol.h
 unicode/udat.h
 unicode/udatpg.h
 unicode/uenum.h
+unicode/unorm.h
 unicode/unum.h
 unicode/ustring.h
 unicode/utypes.h

docshell/base/nsAboutRedirector.cpp

@@ -147,7 +147,7 @@ nsAboutRedirector::NewChannel(nsIURI* aURI,
 
       tempChannel->SetOriginalURI(aURI);
 
-      NS_ADDREF(*aResult = tempChannel);
+      tempChannel.forget(aResult);
       return rv;
     }
   }
@@ -186,9 +186,6 @@ nsAboutRedirector::GetIndexedDBOriginPostfix(nsIURI* aURI, nsAString& aResult)
 nsresult
 nsAboutRedirector::Create(nsISupports* aOuter, REFNSIID aIID, void** aResult)
 {
-  nsAboutRedirector* about = new nsAboutRedirector();
-  NS_ADDREF(about);
-  nsresult rv = about->QueryInterface(aIID, aResult);
-  NS_RELEASE(about);
-  return rv;
+  nsRefPtr<nsAboutRedirector> about = new nsAboutRedirector();
+  return about->QueryInterface(aIID, aResult);
 }

docshell/base/nsDefaultURIFixup.cpp

@@ -105,9 +105,7 @@ nsDefaultURIFixup::CreateExposableURI(nsIURI* aURI, nsIURI** aReturn)
     uri->SetUserPass(EmptyCString());
   }
 
-  // return the fixed-up URI
-  *aReturn = uri;
-  NS_ADDREF(*aReturn);
+  uri.forget(aReturn);
   return NS_OK;
 }
 

docshell/base/nsDocShell.cpp

@@ -1139,8 +1139,7 @@ nsDocShell::GetInterface(const nsIID& aIID, void** aSink)
     nsCOMPtr<nsISHistory> shistory;
     nsresult rv = GetSessionHistory(getter_AddRefs(shistory));
     if (NS_SUCCEEDED(rv) && shistory) {
-      *aSink = shistory;
-      NS_ADDREF((nsISupports*)*aSink);
+      shistory.forget(aSink);
       return NS_OK;
     }
     return NS_NOINTERFACE;
@@ -1158,8 +1157,7 @@ nsDocShell::GetInterface(const nsIID& aIID, void** aSink)
     nsCOMPtr<nsIEditingSession> editingSession;
     mEditorData->GetEditingSession(getter_AddRefs(editingSession));
     if (editingSession) {
-      *aSink = editingSession;
-      NS_ADDREF((nsISupports*)*aSink);
+      editingSession.forget(aSink);
       return NS_OK;
     }
 
@@ -1757,8 +1755,7 @@ nsDocShell::CreateLoadInfo(nsIDocShellLoadInfo** aLoadInfo)
   NS_ENSURE_TRUE(loadInfo, NS_ERROR_OUT_OF_MEMORY);
   nsCOMPtr<nsIDocShellLoadInfo> localRef(loadInfo);
 
-  *aLoadInfo = localRef;
-  NS_ADDREF(*aLoadInfo);
+  localRef.forget(aLoadInfo);
   return NS_OK;
 }
 
@@ -6253,7 +6250,7 @@ nsDocShell::GetOnePermittedSandboxedNavigator(nsIDocShell** aSandboxedNavigator)
   NS_ENSURE_ARG_POINTER(aSandboxedNavigator);
   nsCOMPtr<nsIDocShell> permittedNavigator =
     do_QueryReferent(mOnePermittedSandboxedNavigator);
-  NS_IF_ADDREF(*aSandboxedNavigator = permittedNavigator);
+  permittedNavigator.forget(aSandboxedNavigator);
   return NS_OK;
 }
 
@@ -11966,8 +11963,7 @@ nsDocShell::AddToSessionHistory(nsIURI* aURI, nsIChannel* aChannel,
   if (aNewEntry) {
     *aNewEntry = nullptr;
     if (NS_SUCCEEDED(rv)) {
-      *aNewEntry = entry;
-      NS_ADDREF(*aNewEntry);
+      entry.forget(aNewEntry);
     }
   }
 

docshell/shistory/src/nsSHistory.cpp

@@ -10,6 +10,7 @@
 
 // Helper Classes
 #include "mozilla/Preferences.h"
+#include "mozilla/StaticPtr.h"
 
 // Interfaces Needed
 #include "nsILayoutHistoryState.h"
@@ -178,7 +179,7 @@ protected:
   ~nsSHistoryObserver() {}
 };
 
-static nsSHistoryObserver* gObserver = nullptr;
+StaticRefPtr<nsSHistoryObserver> gObserver;
 
 NS_IMPL_ISUPPORTS(nsSHistoryObserver, nsIObserver)
 
@@ -360,7 +361,6 @@ nsSHistory::Startup()
   // but keep the per SHistory cached viewer limit constant
   if (!gObserver) {
     gObserver = new nsSHistoryObserver();
-    NS_ADDREF(gObserver);
     Preferences::AddStrongObservers(gObserver, kObservedPrefs);
 
     nsCOMPtr<nsIObserverService> obsSvc =
@@ -393,7 +393,7 @@ nsSHistory::Shutdown()
       obsSvc->RemoveObserver(gObserver, "cacheservice:empty-cache");
       obsSvc->RemoveObserver(gObserver, "memory-pressure");
     }
-    NS_RELEASE(gObserver);
+    gObserver = nullptr;
   }
 }
 
@@ -540,8 +540,7 @@ nsSHistory::GetTransactionAtIndex(int32_t aIndex, nsISHTransaction ** aResult)
     if (NS_SUCCEEDED(rv) && ptr) {
       cnt++;
       if (cnt == aIndex) {
-        *aResult = ptr;
-        NS_ADDREF(*aResult);
+        ptr.forget(aResult);
         break;
       }
       else {

dom/base/nsFrameLoader.cpp

@@ -1389,6 +1389,9 @@ nsFrameLoader::StartDestroy()
     if (mRemoteBrowser) {
       mRemoteBrowser->CacheFrameLoader(this);
     }
+    if (mChildMessageManager) {
+      mChildMessageManager->CacheFrameLoader(this);
+    }
   }
 
   // If the TabParent has installed any event listeners on the window, this is
@@ -1532,6 +1535,9 @@ nsFrameLoader::DestroyComplete()
     if (mRemoteBrowser) {
       mRemoteBrowser->CacheFrameLoader(nullptr);
     }
+    if (mChildMessageManager) {
+      mChildMessageManager->CacheFrameLoader(nullptr);
+    }
   }
 
   // Call TabParent::Destroy if we haven't already (in case of a crash).
@@ -2443,7 +2449,7 @@ public:
       static_cast<nsInProcessTabChildGlobal*>(mFrameLoader->mChildMessageManager.get());
     if (tabChild && tabChild->GetInnerManager()) {
       nsCOMPtr<nsIXPConnectJSObjectHolder> kungFuDeathGrip(tabChild->GetGlobal());
-      ReceiveMessage(static_cast<EventTarget*>(tabChild),
+      ReceiveMessage(static_cast<EventTarget*>(tabChild), mFrameLoader,
                      tabChild->GetInnerManager());
     }
     return NS_OK;

dom/base/nsFrameMessageManager.cpp

@@ -995,6 +995,7 @@ public:
 
 nsresult
 nsFrameMessageManager::ReceiveMessage(nsISupports* aTarget,
+                                      nsIFrameLoader* aTargetFrameLoader,
                                       const nsAString& aMessage,
                                       bool aIsSync,
                                       const StructuredCloneData* aCloneData,
@@ -1002,12 +1003,13 @@ nsFrameMessageManager::ReceiveMessage(nsISupports* aTarget,
                                       nsIPrincipal* aPrincipal,
                                       InfallibleTArray<nsString>* aJSONRetVal)
 {
-  return ReceiveMessage(aTarget, mClosed, aMessage, aIsSync,
+  return ReceiveMessage(aTarget, aTargetFrameLoader, mClosed, aMessage, aIsSync,
                         aCloneData, aCpows, aPrincipal, aJSONRetVal);
 }
 
 nsresult
 nsFrameMessageManager::ReceiveMessage(nsISupports* aTarget,
+                                      nsIFrameLoader* aTargetFrameLoader,
                                       bool aTargetClosed,
                                       const nsAString& aMessage,
                                       bool aIsSync,
@@ -1114,6 +1116,16 @@ nsFrameMessageManager::ReceiveMessage(nsISupports* aTarget,
                 JS_DefineProperty(cx, param, "objects", cpowsv, JSPROP_ENUMERATE);
       NS_ENSURE_TRUE(ok, NS_ERROR_UNEXPECTED);
 
+      if (aTargetFrameLoader) {
+        JS::Rooted<JS::Value> targetFrameLoaderv(cx);
+        nsresult rv = nsContentUtils::WrapNative(cx, aTargetFrameLoader, &targetFrameLoaderv);
+        NS_ENSURE_SUCCESS(rv, rv);
+
+        ok = JS_DefineProperty(cx, param, "targetFrameLoader", targetFrameLoaderv,
+                               JSPROP_ENUMERATE);
+        NS_ENSURE_TRUE(ok, NS_ERROR_UNEXPECTED);
+      }
+
       // message.principal == null
       if (!aPrincipal) {
         bool ok = JS_DefineProperty(cx, param, "principal",
@@ -1190,7 +1202,8 @@ nsFrameMessageManager::ReceiveMessage(nsISupports* aTarget,
     }
   }
   nsRefPtr<nsFrameMessageManager> kungfuDeathGrip = mParentManager;
-  return mParentManager ? mParentManager->ReceiveMessage(aTarget, aTargetClosed, aMessage,
+  return mParentManager ? mParentManager->ReceiveMessage(aTarget, aTargetFrameLoader,
+                                                         aTargetClosed, aMessage,
                                                          aIsSync, aCloneData,
                                                          aCpows, aPrincipal,
                                                          aJSONRetVal) : NS_OK;
@@ -1769,7 +1782,7 @@ public:
   NS_IMETHOD Run()
   {
     nsFrameMessageManager* ppm = nsFrameMessageManager::GetChildProcessManager();
-    ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm), ppm);
+    ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm), nullptr, ppm);
     return NS_OK;
   }
 };
@@ -1924,7 +1937,7 @@ public:
   virtual nsresult HandleMessage() override
   {
     nsFrameMessageManager* ppm = nsFrameMessageManager::sSameProcessParentManager;
-    ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm), ppm);
+    ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm), nullptr, ppm);
     return NS_OK;
   }
 };
@@ -1958,7 +1971,7 @@ public:
     if (nsFrameMessageManager::sSameProcessParentManager) {
       SameProcessCpowHolder cpows(js::GetRuntime(aCx), aCpows);
       nsRefPtr<nsFrameMessageManager> ppm = nsFrameMessageManager::sSameProcessParentManager;
-      ppm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm.get()), aMessage,
+      ppm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm.get()), nullptr, aMessage,
                           true, &aData, &cpows, aPrincipal, aJSONRetVal);
     }
     return true;
@@ -2089,6 +2102,7 @@ nsSameProcessAsyncMessageBase::nsSameProcessAsyncMessageBase(JSContext* aCx,
 
 void
 nsSameProcessAsyncMessageBase::ReceiveMessage(nsISupports* aTarget,
+                                              nsIFrameLoader* aTargetFrameLoader,
                                               nsFrameMessageManager* aManager)
 {
   if (aManager) {
@@ -2100,7 +2114,7 @@ nsSameProcessAsyncMessageBase::ReceiveMessage(nsISupports* aTarget,
     SameProcessCpowHolder cpows(mRuntime, mCpows);
 
     nsRefPtr<nsFrameMessageManager> mm = aManager;
-    mm->ReceiveMessage(aTarget, mMessage, false, &data, &cpows,
+    mm->ReceiveMessage(aTarget, aTargetFrameLoader, mMessage, false, &data, &cpows,
                        mPrincipal, nullptr);
   }
 }

dom/base/nsFrameMessageManager.h

@@ -31,6 +31,8 @@
 #include "mozilla/dom/StructuredCloneUtils.h"
 #include "mozilla/jsipc/CpowHolder.h"
 
+class nsIFrameLoader;
+
 namespace mozilla {
 namespace dom {
 
@@ -229,7 +231,8 @@ public:
   static nsFrameMessageManager*
   NewProcessMessageManager(bool aIsRemote);
 
-  nsresult ReceiveMessage(nsISupports* aTarget, const nsAString& aMessage,
+  nsresult ReceiveMessage(nsISupports* aTarget, nsIFrameLoader* aTargetFrameLoader,
+                          const nsAString& aMessage,
                           bool aIsSync, const StructuredCloneData* aCloneData,
                           mozilla::jsipc::CpowHolder* aCpows, nsIPrincipal* aPrincipal,
                           InfallibleTArray<nsString>* aJSONRetVal);
@@ -293,7 +296,8 @@ private:
                        JS::MutableHandle<JS::Value> aRetval,
                        bool aIsSync);
 
-  nsresult ReceiveMessage(nsISupports* aTarget, bool aTargetClosed, const nsAString& aMessage,
+  nsresult ReceiveMessage(nsISupports* aTarget, nsIFrameLoader* aTargetFrameLoader,
+                          bool aTargetClosed, const nsAString& aMessage,
                           bool aIsSync, const StructuredCloneData* aCloneData,
                           mozilla::jsipc::CpowHolder* aCpows, nsIPrincipal* aPrincipal,
                           InfallibleTArray<nsString>* aJSONRetVal);
@@ -369,7 +373,8 @@ public:
                                 JS::Handle<JSObject*> aCpows,
                                 nsIPrincipal* aPrincipal);
 
-  void ReceiveMessage(nsISupports* aTarget, nsFrameMessageManager* aManager);
+  void ReceiveMessage(nsISupports* aTarget, nsIFrameLoader* aTargetFrameLoader,
+                      nsFrameMessageManager* aManager);
 
 private:
   nsSameProcessAsyncMessageBase(const nsSameProcessAsyncMessageBase&);

dom/base/nsGlobalWindow.cpp

@@ -8884,8 +8884,8 @@ nsGlobalWindow::IsInModalState()
   nsGlobalWindow *topWin = GetScriptableTop();
 
   if (!topWin) {
-    NS_ERROR("Uh, IsInModalState() called w/o a reachable top window?");
-
+    // IsInModalState() getting called w/o a reachable top window is a bit
+    // iffy, but valid enough not to make noise about it.  See bug 404828
     return false;
   }
 

dom/base/nsIMessageManager.idl

@@ -8,6 +8,7 @@
 interface nsIDOMWindow;
 interface nsIDocShell;
 interface nsIContent;
+interface nsIFrameLoader;
 interface nsIPrincipal;
 
 /**
@@ -383,10 +384,11 @@ interface nsIContentFrameMessageManager : nsIMessageManagerGlobal
   readonly attribute nsIDocShell docShell;
 };
 
-[uuid(a9e07e89-7125-48e3-bf73-2cbae7fc5b1c)]
+[uuid(9c6bd4d7-88d2-46d6-8606-f2d57d46f051)]
 interface nsIInProcessContentFrameMessageManager : nsIContentFrameMessageManager
 {
   [notxpcom] nsIContent getOwnerContent();
+  [notxpcom] void cacheFrameLoader(in nsIFrameLoader aFrameLoader);
 };
 
 [scriptable, builtinclass, uuid(d0c799a2-d5ff-4a75-acbb-b8c8347944a6)]

dom/base/nsInProcessTabChildGlobal.cpp

@@ -42,7 +42,8 @@ nsInProcessTabChildGlobal::DoSendBlockingMessage(JSContext* aCx,
   if (mChromeMessageManager) {
     SameProcessCpowHolder cpows(js::GetRuntime(aCx), aCpows);
     nsRefPtr<nsFrameMessageManager> mm = mChromeMessageManager;
-    mm->ReceiveMessage(mOwner, aMessage, true, &aData, &cpows, aPrincipal,
+    nsCOMPtr<nsIFrameLoader> fl = GetFrameLoader();
+    mm->ReceiveMessage(mOwner, fl, aMessage, true, &aData, &cpows, aPrincipal,
                        aJSONRetVal);
   }
   return true;
@@ -65,7 +66,8 @@ public:
 
   virtual nsresult HandleMessage() override
   {
-    ReceiveMessage(mTabChild->mOwner, mTabChild->mChromeMessageManager);
+    nsCOMPtr<nsIFrameLoader> fl = mTabChild->GetFrameLoader();
+    ReceiveMessage(mTabChild->mOwner, fl, mTabChild->mChromeMessageManager);
     return NS_OK;
   }
   nsRefPtr<nsInProcessTabChildGlobal> mTabChild;
@@ -175,6 +177,12 @@ NS_INTERFACE_MAP_END_INHERITING(DOMEventTargetHelper)
 NS_IMPL_ADDREF_INHERITED(nsInProcessTabChildGlobal, DOMEventTargetHelper)
 NS_IMPL_RELEASE_INHERITED(nsInProcessTabChildGlobal, DOMEventTargetHelper)
 
+void
+nsInProcessTabChildGlobal::CacheFrameLoader(nsIFrameLoader* aFrameLoader)
+{
+  mFrameLoader = aFrameLoader;
+}
+
 NS_IMETHODIMP
 nsInProcessTabChildGlobal::GetContent(nsIDOMWindow** aContent)
 {
@@ -336,3 +344,14 @@ nsInProcessTabChildGlobal::LoadFrameScript(const nsAString& aURL, bool aRunInGlo
   LoadScriptInternal(aURL, aRunInGlobalScope);
   mLoadingScript = tmp;
 }
+
+already_AddRefed<nsIFrameLoader>
+nsInProcessTabChildGlobal::GetFrameLoader()
+{
+  nsCOMPtr<nsIFrameLoaderOwner> owner = do_QueryInterface(mOwner);
+  nsCOMPtr<nsIFrameLoader> fl = owner ? owner->GetFrameLoader() : nullptr;
+  if (!fl) {
+    fl = mFrameLoader;
+  }
+  return fl.forget();
+}

dom/base/nsInProcessTabChildGlobal.h

@@ -150,6 +150,9 @@ public:
   {
     MOZ_CRASH("nsInProcessTabChildGlobal doesn't use DOM bindings!");
   }
+
+  already_AddRefed<nsIFrameLoader> GetFrameLoader();
+
 protected:
   virtual ~nsInProcessTabChildGlobal();
 
@@ -165,6 +168,11 @@ protected:
   // PreHandleEvent.
   bool mIsBrowserOrAppFrame;
   bool mPreventEventsEscaping;
+
+  // We keep a strong reference to the frameloader after we've started
+  // teardown. This allows us to dispatch message manager messages during this
+  // time.
+  nsCOMPtr<nsIFrameLoader> mFrameLoader;
 public:
   nsIContent* mOwner;
   nsFrameMessageManager* mChromeMessageManager;

dom/base/nsPerformance.cpp

@@ -261,7 +261,9 @@ nsPerformanceTiming::DomainLookupEndHighRes()
   if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized()) {
     return mZeroTime;
   }
-  return TimeStampToDOMHighResOrFetchStart(mDomainLookupEnd);
+  // Bug 1155008 - nsHttpTransaction is racy. Return DomainLookupStart when null
+  return mDomainLookupEnd.IsNull() ? DomainLookupStartHighRes()
+                                   : TimeStampToDOMHighRes(mDomainLookupEnd);
 }
 
 DOMTimeMilliSec
@@ -292,7 +294,8 @@ nsPerformanceTiming::ConnectEndHighRes()
   if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized()) {
     return mZeroTime;
   }
-  return mConnectEnd.IsNull() ? DomainLookupEndHighRes()
+  // Bug 1155008 - nsHttpTransaction is racy. Return ConnectStart when null
+  return mConnectEnd.IsNull() ? ConnectStartHighRes()
                               : TimeStampToDOMHighRes(mConnectEnd);
 }
 
@@ -346,7 +349,9 @@ nsPerformanceTiming::ResponseEndHighRes()
      (!mCacheReadEnd.IsNull() && mCacheReadEnd < mResponseEnd)) {
     mResponseEnd = mCacheReadEnd;
   }
-  return TimeStampToDOMHighResOrFetchStart(mResponseEnd);
+  // Bug 1155008 - nsHttpTransaction is racy. Return ResponseStart when null
+  return mResponseEnd.IsNull() ? ResponseStartHighRes()
+                               : TimeStampToDOMHighRes(mResponseEnd);
 }
 
 DOMTimeMilliSec

dom/base/test/browser.ini

@@ -7,6 +7,7 @@ skip-if = e10s # Bug ?????? - test directly touches content (contentWindow.ifram
 [browser_bug902350.js]
 skip-if = e10s # Bug ?????? - test e10s utils don't support load events from iframe etc, which this test relies on.
 [browser_messagemanager_loadprocessscript.js]
+[browser_messagemanager_targetframeloader.js]
 [browser_pagehide_on_tab_close.js]
 skip-if = e10s # this tests non-e10s behavior. it's not expected to work in e10s.
 [browser_messagemanager_unload.js]

dom/base/test/browser_messagemanager_targetframeloader.js

@@ -0,0 +1,31 @@
+function frameScript()
+{
+  sendSyncMessage("Test:Message");
+  sendAsyncMessage("Test:Message");
+  sendAsyncMessage("Test:Done");
+}
+
+function test() {
+  waitForExplicitFinish();
+
+  var newTab = gBrowser.addTab("about:blank");
+  gBrowser.selectedTab = newTab;
+
+  let browser = newTab.linkedBrowser;
+  let frameLoader = browser.frameLoader;
+  ok(frameLoader !== null, "frameLoader looks okay");
+
+  browser.messageManager.loadFrameScript("data:,(" + frameScript.toString() + ")()", false);
+
+  browser.messageManager.addMessageListener("Test:Message", (msg) => {
+    ok(msg.target === browser, "<browser> is correct");
+    ok(msg.targetFrameLoader === frameLoader, "frameLoader is correct");
+    ok(browser.frameLoader === msg.targetFrameLoader, "browser frameloader is correct");
+  });
+
+  browser.messageManager.addMessageListener("Test:Done", () => {
+    info("Finished");
+    gBrowser.removeCurrentTab();
+    finish();
+  });
+}

dom/base/test/browser_messagemanager_unload.js

@@ -70,6 +70,8 @@ function test() {
   gBrowser.selectedTab = newTab;
 
   let browser = newTab.linkedBrowser;
+  let frameLoader = browser.frameLoader;
+  ok(frameLoader !== null, "frameLoader looks okay");
 
   browser.messageManager.loadFrameScript("data:,(" + frameScript.toString() + ")()", false);
 
@@ -80,6 +82,8 @@ function test() {
   let index = 0;
   browser.messageManager.addMessageListener("Test:Event", (msg) => {
     ok(msg.target === browser, "<browser> is correct");
+    ok(msg.targetFrameLoader === frameLoader, "frameLoader is correct");
+    ok(browser.frameLoader === null, "browser frameloader null during teardown");
 
     info(JSON.stringify(msg.data));
 

dom/canvas/WebGL2ContextUniforms.cpp

@@ -11,8 +11,7 @@
 #include "WebGLVertexAttribData.h"
 #include "mozilla/dom/WebGL2RenderingContextBinding.h"
 
-using namespace mozilla;
-using namespace mozilla::dom;
+namespace mozilla {
 
 typedef union { GLint i; GLfloat f; GLuint u; } fi_t;
 
@@ -538,39 +537,7 @@ WebGL2Context::GetUniformBlockIndex(WebGLProgram* program,
     if (!ValidateObject("getUniformBlockIndex: program", program))
         return 0;
 
-    // Leave this unchecked for now.
-
-    const NS_LossyConvertUTF16toASCII cname(uniformBlockName);
-
-    GLuint progname = program->mGLName;
-
-    MakeContextCurrent();
-    return gl->fGetUniformBlockIndex(progname, cname.BeginReading());
-}
-
-static bool
-GetUniformBlockActiveUniforms(gl::GLContext* gl, JSContext* cx,
-                              WebGL2Context* owner, GLuint progname,
-                              GLuint uniformBlockIndex,
-                              JS::MutableHandleObject out_array)
-{
-    GLint length = 0;
-    gl->fGetActiveUniformBlockiv(progname, uniformBlockIndex,
-                                 LOCAL_GL_UNIFORM_BLOCK_ACTIVE_UNIFORMS, &length);
-    JS::RootedObject obj(cx, Uint32Array::Create(cx, owner, length, nullptr));
-    if (!obj)
-        return false;
-
-    Uint32Array result;
-    DebugOnly<bool> inited = result.Init(obj);
-    MOZ_ASSERT(inited);
-    result.ComputeLengthAndData();
-    gl->fGetActiveUniformBlockiv(progname, uniformBlockIndex,
-                                 LOCAL_GL_UNIFORM_BLOCK_ACTIVE_UNIFORM_INDICES,
-                                 (GLint*) result.Data());
-
-    out_array.set(obj);
-    return true;
+    return program->GetUniformBlockIndex(uniformBlockName);
 }
 
 void
@@ -586,46 +553,25 @@ WebGL2Context::GetActiveUniformBlockParameter(JSContext* cx, WebGLProgram* progr
     if (!ValidateObject("getActiveUniformBlockParameter: program", program))
         return;
 
-    GLuint progname = program->mGLName;
-    GLint param = 0;
-
     MakeContextCurrent();
 
     switch(pname) {
     case LOCAL_GL_UNIFORM_BLOCK_REFERENCED_BY_VERTEX_SHADER:
     case LOCAL_GL_UNIFORM_BLOCK_REFERENCED_BY_FRAGMENT_SHADER:
-        gl->fGetActiveUniformBlockiv(progname, uniformBlockIndex, pname, &param);
-        retval.SetValue().SetAsBoolean() = (param != 0);
-        return;
-
     case LOCAL_GL_UNIFORM_BLOCK_BINDING:
     case LOCAL_GL_UNIFORM_BLOCK_DATA_SIZE:
-    case LOCAL_GL_UNIFORM_BLOCK_NAME_LENGTH:
     case LOCAL_GL_UNIFORM_BLOCK_ACTIVE_UNIFORMS:
-        gl->fGetActiveUniformBlockiv(progname, uniformBlockIndex, pname, &param);
-        retval.SetValue().SetAsUnsignedLong() = param;
+        program->GetActiveUniformBlockParam(uniformBlockIndex, pname, retval);
         return;
 
     case LOCAL_GL_UNIFORM_BLOCK_ACTIVE_UNIFORM_INDICES:
-        JS::RootedObject array(cx);
-        if (!GetUniformBlockActiveUniforms(gl, cx, this, progname, uniformBlockIndex,
-                                           &array))
-        {
-            rv = NS_ERROR_OUT_OF_MEMORY;
-            return;
-        }
-
-        DebugOnly<bool> inited = retval.SetValue().SetAsUint32Array().Init(array);
-        MOZ_ASSERT(inited);
-
+        program->GetActiveUniformBlockActiveUniforms(cx, uniformBlockIndex, retval, rv);
         return;
     }
 
     ErrorInvalidEnumInfo("getActiveUniformBlockParameter: parameter", pname);
 }
 
-#define WEBGL_MAX_UNIFORM_BLOCK_NAME_LENGTH 256
-
 void
 WebGL2Context::GetActiveUniformBlockName(WebGLProgram* program, GLuint uniformBlockIndex,
                                          nsAString& retval)
@@ -636,19 +582,9 @@ WebGL2Context::GetActiveUniformBlockName(WebGLProgram* program, GLuint uniformBl
     if (!ValidateObject("getActiveUniformBlockName: program", program))
         return;
 
-    GLuint progname = program->mGLName;
-    GLchar nameBuffer[WEBGL_MAX_UNIFORM_BLOCK_NAME_LENGTH];
-    GLsizei length = 0;
-
-    MakeContextCurrent();
-    gl->fGetActiveUniformBlockName(progname, uniformBlockIndex,
-                                   WEBGL_MAX_UNIFORM_BLOCK_NAME_LENGTH, &length,
-                                   nameBuffer);
-    retval.Assign(NS_ConvertASCIItoUTF16(nsDependentCString(nameBuffer)));
+    program->GetActiveUniformBlockName(uniformBlockIndex, retval);
 }
 
-#undef WEBGL_MAX_UNIFORM_BLOCK_NAME_LENGTH
-
 void
 WebGL2Context::UniformBlockBinding(WebGLProgram* program, GLuint uniformBlockIndex,
                                    GLuint uniformBlockBinding)
@@ -659,8 +595,7 @@ WebGL2Context::UniformBlockBinding(WebGLProgram* program, GLuint uniformBlockInd
     if (!ValidateObject("uniformBlockBinding: program", program))
         return;
 
-    GLuint progname = program->mGLName;
-
-    MakeContextCurrent();
-    gl->fUniformBlockBinding(progname, uniformBlockIndex, uniformBlockBinding);
+    program->UniformBlockBinding(uniformBlockIndex, uniformBlockBinding);
 }
+
+} // namespace mozilla

dom/canvas/WebGLActiveInfo.cpp

@@ -29,9 +29,9 @@ ElemSizeFromType(GLenum elemType)
     case LOCAL_GL_INT_SAMPLER_CUBE:
     case LOCAL_GL_INT_SAMPLER_2D_ARRAY:
     case LOCAL_GL_UNSIGNED_INT_SAMPLER_2D:
-    case LOCAL_GL_UNSIGNED_INT_SAMPLER_2D_ARRAY:
     case LOCAL_GL_UNSIGNED_INT_SAMPLER_3D:
     case LOCAL_GL_UNSIGNED_INT_SAMPLER_CUBE:
+    case LOCAL_GL_UNSIGNED_INT_SAMPLER_2D_ARRAY:
         return 1;
 
     case LOCAL_GL_BOOL_VEC2:

dom/canvas/WebGLProgram.cpp

@@ -78,6 +78,16 @@ AddActiveInfo(WebGLContext* webgl, GLint elemCount, GLenum elemType, bool isArra
     infoLocMap->insert(std::make_pair(info->mBaseUserName, info.get()));
 }
 
+static void
+AddActiveBlockInfo(const nsACString& baseUserName,
+                   const nsACString& baseMappedName,
+                   std::vector<RefPtr<webgl::UniformBlockInfo>>* activeInfoList)
+{
+    RefPtr<webgl::UniformBlockInfo> info = new webgl::UniformBlockInfo(baseUserName, baseMappedName);
+
+    activeInfoList->push_back(info);
+}
+
 //#define DUMP_SHADERVAR_MAPPINGS
 
 static TemporaryRef<const webgl::LinkedProgramInfo>
@@ -97,9 +107,18 @@ QueryProgramInfo(WebGLProgram* prog, gl::GLContext* gl)
     if (maxUniformLenWithNull < 1)
         maxUniformLenWithNull = 1;
 
+    GLuint maxUniformBlockLenWithNull = 0;
+    if (gl->IsSupported(gl::GLFeature::uniform_buffer_object)) {
+        gl->fGetProgramiv(prog->mGLName, LOCAL_GL_ACTIVE_UNIFORM_BLOCK_MAX_NAME_LENGTH,
+                          (GLint*)&maxUniformBlockLenWithNull);
+        if (maxUniformBlockLenWithNull < 1)
+            maxUniformBlockLenWithNull = 1;
+    }
+
 #ifdef DUMP_SHADERVAR_MAPPINGS
     printf_stderr("maxAttribLenWithNull: %d\n", maxAttribLenWithNull);
     printf_stderr("maxUniformLenWithNull: %d\n", maxUniformLenWithNull);
+    printf_stderr("maxUniformBlockLenWithNull: %d\n", maxUniformBlockLenWithNull);
 #endif
 
     // Attribs
@@ -204,6 +223,54 @@ QueryProgramInfo(WebGLProgram* prog, gl::GLContext* gl)
                       baseMappedName, &info->activeUniforms, &info->uniformMap);
     }
 
+    // Uniform Blocks
+
+    if (gl->IsSupported(gl::GLFeature::uniform_buffer_object)) {
+        GLuint numActiveUniformBlocks = 0;
+        gl->fGetProgramiv(prog->mGLName, LOCAL_GL_ACTIVE_UNIFORM_BLOCKS,
+                          (GLint*)&numActiveUniformBlocks);
+
+        for (GLuint i = 0; i < numActiveAttribs; i++) {
+            nsAutoCString mappedName;
+            mappedName.SetLength(maxUniformBlockLenWithNull - 1);
+
+            GLint lengthWithoutNull;
+            gl->fGetActiveUniformBlockiv(prog->mGLName, i, LOCAL_GL_UNIFORM_BLOCK_NAME_LENGTH, &lengthWithoutNull);
+            gl->fGetActiveUniformBlockName(prog->mGLName, i, maxUniformBlockLenWithNull, &lengthWithoutNull, mappedName.BeginWriting());
+            mappedName.SetLength(lengthWithoutNull);
+
+            nsAutoCString baseMappedName;
+            bool isArray;
+            size_t arrayIndex;
+            if (!ParseName(mappedName, &baseMappedName, &isArray, &arrayIndex))
+                MOZ_CRASH("Failed to parse `mappedName` received from driver.");
+
+            nsAutoCString baseUserName;
+            if (!prog->FindUniformBlockByMappedName(baseMappedName, &baseUserName, &isArray)) {
+                baseUserName = baseMappedName;
+
+                if (needsCheckForArrays && !isArray) {
+                    std::string mappedName = baseMappedName.BeginReading();
+                    mappedName += "[0]";
+
+                    GLuint loc = gl->fGetUniformBlockIndex(prog->mGLName, mappedName.c_str());
+                    if (loc != LOCAL_GL_INVALID_INDEX)
+                        isArray = true;
+                }
+            }
+
+#ifdef DUMP_SHADERVAR_MAPPINGS
+            printf_stderr("[uniform block %i] %s/%i/%s/%s\n", i, mappedName.BeginReading(),
+                          (int)isArray, baseMappedName.BeginReading(),
+                          baseUserName.BeginReading());
+            printf_stderr("    lengthWithoutNull: %d\n", lengthWithoutNull);
+            printf_stderr("    isArray: %d\n", (int)isArray);
+#endif
+
+            AddActiveBlockInfo(baseUserName, baseMappedName, &info->uniformBlocks);
+        }
+    }
+
     return info.forget();
 }
 
@@ -496,6 +563,141 @@ WebGLProgram::GetProgramParameter(GLenum pname) const
     }
 }
 
+GLuint
+WebGLProgram::GetUniformBlockIndex(const nsAString& userName_wide) const
+{
+    if (!ValidateGLSLVariableName(userName_wide, mContext, "getUniformBlockIndex"))
+        return LOCAL_GL_INVALID_INDEX;
+
+    if (!IsLinked()) {
+        mContext->ErrorInvalidOperation("getUniformBlockIndex: `program` must be linked.");
+        return LOCAL_GL_INVALID_INDEX;
+    }
+
+    const NS_LossyConvertUTF16toASCII userName(userName_wide);
+
+    nsDependentCString baseUserName;
+    bool isArray;
+    size_t arrayIndex;
+    if (!ParseName(userName, &baseUserName, &isArray, &arrayIndex))
+        return LOCAL_GL_INVALID_INDEX;
+
+    RefPtr<const webgl::UniformBlockInfo> info;
+    if (!LinkInfo()->FindUniformBlock(baseUserName, &info)) {
+        return LOCAL_GL_INVALID_INDEX;
+    }
+
+    const nsCString& baseMappedName = info->mBaseMappedName;
+    nsAutoCString mappedName(baseMappedName);
+    if (isArray) {
+        mappedName.AppendLiteral("[");
+        mappedName.AppendInt(uint32_t(arrayIndex));
+        mappedName.AppendLiteral("]");
+    }
+
+    gl::GLContext* gl = mContext->GL();
+    gl->MakeCurrent();
+
+    return gl->fGetUniformBlockIndex(mGLName, mappedName.BeginReading());
+}
+
+void
+WebGLProgram::GetActiveUniformBlockName(GLuint uniformBlockIndex, nsAString& retval) const
+{
+    if (!IsLinked()) {
+        mContext->ErrorInvalidOperation("getActiveUniformBlockName: `program` must be linked.");
+        return;
+    }
+
+    const webgl::LinkedProgramInfo* linkInfo = LinkInfo();
+    GLuint uniformBlockCount = (GLuint) linkInfo->uniformBlocks.size();
+    if (uniformBlockIndex >= uniformBlockCount) {
+        mContext->ErrorInvalidValue("getActiveUniformBlockName: index %u invalid.", uniformBlockIndex);
+        return;
+    }
+
+    const webgl::UniformBlockInfo* blockInfo = linkInfo->uniformBlocks[uniformBlockIndex];
+
+    retval.Assign(NS_ConvertASCIItoUTF16(blockInfo->mBaseUserName));
+}
+
+void
+WebGLProgram::GetActiveUniformBlockParam(GLuint uniformBlockIndex, GLenum pname,
+                                         Nullable<dom::OwningUnsignedLongOrUint32ArrayOrBoolean>& retval) const
+{
+    retval.SetNull();
+    if (!IsLinked()) {
+        mContext->ErrorInvalidOperation("getActiveUniformBlockParameter: `program` must be linked.");
+        return;
+    }
+
+    const webgl::LinkedProgramInfo* linkInfo = LinkInfo();
+    GLuint uniformBlockCount = (GLuint)linkInfo->uniformBlocks.size();
+    if (uniformBlockIndex >= uniformBlockCount) {
+        mContext->ErrorInvalidValue("getActiveUniformBlockParameter: index %u invalid.", uniformBlockIndex);
+        return;
+    }
+
+    gl::GLContext* gl = mContext->GL();
+    GLint param = 0;
+
+    switch (pname) {
+    case LOCAL_GL_UNIFORM_BLOCK_REFERENCED_BY_VERTEX_SHADER:
+    case LOCAL_GL_UNIFORM_BLOCK_REFERENCED_BY_FRAGMENT_SHADER:
+        gl->fGetActiveUniformBlockiv(mGLName, uniformBlockIndex, pname, &param);
+        retval.SetValue().SetAsBoolean() = (param != 0);
+        return;
+
+    case LOCAL_GL_UNIFORM_BLOCK_BINDING:
+    case LOCAL_GL_UNIFORM_BLOCK_DATA_SIZE:
+    case LOCAL_GL_UNIFORM_BLOCK_ACTIVE_UNIFORMS:
+        gl->fGetActiveUniformBlockiv(mGLName, uniformBlockIndex, pname, &param);
+        retval.SetValue().SetAsUnsignedLong() = param;
+        return;
+    }
+}
+
+void
+WebGLProgram::GetActiveUniformBlockActiveUniforms(JSContext* cx, GLuint uniformBlockIndex,
+                                                  Nullable<dom::OwningUnsignedLongOrUint32ArrayOrBoolean>& retval,
+                                                  ErrorResult& rv) const
+{
+    if (!IsLinked()) {
+        mContext->ErrorInvalidOperation("getActiveUniformBlockParameter: `program` must be linked.");
+        return;
+    }
+
+    const webgl::LinkedProgramInfo* linkInfo = LinkInfo();
+    GLuint uniformBlockCount = (GLuint)linkInfo->uniformBlocks.size();
+    if (uniformBlockIndex >= uniformBlockCount) {
+        mContext->ErrorInvalidValue("getActiveUniformBlockParameter: index %u invalid.", uniformBlockIndex);
+        return;
+    }
+
+    gl::GLContext* gl = mContext->GL();
+    GLint activeUniformCount = 0;
+    gl->fGetActiveUniformBlockiv(mGLName, uniformBlockIndex,
+                                 LOCAL_GL_UNIFORM_BLOCK_ACTIVE_UNIFORMS,
+                                 &activeUniformCount);
+    JS::RootedObject obj(cx, dom::Uint32Array::Create(cx, mContext, activeUniformCount,
+                                                      nullptr));
+    if (!obj) {
+        rv = NS_ERROR_OUT_OF_MEMORY;
+        return;
+    }
+
+    dom::Uint32Array result;
+    DebugOnly<bool> inited = result.Init(obj);
+    MOZ_ASSERT(inited);
+    result.ComputeLengthAndData();
+    gl->fGetActiveUniformBlockiv(mGLName, uniformBlockIndex,
+                                 LOCAL_GL_UNIFORM_BLOCK_ACTIVE_UNIFORM_INDICES,
+                                 (GLint*)result.Data());
+
+    inited = retval.SetValue().SetAsUint32Array().Init(obj);
+    MOZ_ASSERT(inited);
+}
+
 already_AddRefed<WebGLUniformLocation>
 WebGLProgram::GetUniformLocation(const nsAString& userName_wide) const
 {
@@ -540,6 +742,31 @@ WebGLProgram::GetUniformLocation(const nsAString& userName_wide) const
     return locObj.forget();
 }
 
+void
+WebGLProgram::UniformBlockBinding(GLuint uniformBlockIndex, GLuint uniformBlockBinding) const
+{
+    if (!IsLinked()) {
+        mContext->ErrorInvalidOperation("getActiveUniformBlockName: `program` must be linked.");
+        return;
+    }
+
+    const webgl::LinkedProgramInfo* linkInfo = LinkInfo();
+    GLuint uniformBlockCount = (GLuint)linkInfo->uniformBlocks.size();
+    if (uniformBlockIndex >= uniformBlockCount) {
+        mContext->ErrorInvalidValue("getActiveUniformBlockName: index %u invalid.", uniformBlockIndex);
+        return;
+    }
+
+    if (uniformBlockBinding > mContext->mGLMaxUniformBufferBindings) {
+        mContext->ErrorInvalidEnum("getActiveUniformBlockName: binding %u invalid.", uniformBlockBinding);
+        return;
+    }
+
+    gl::GLContext* gl = mContext->GL();
+    gl->MakeCurrent();
+    gl->fUniformBlockBinding(mGLName, uniformBlockIndex, uniformBlockBinding);
+}
+
 bool
 WebGLProgram::LinkProgram()
 {
@@ -707,6 +934,20 @@ WebGLProgram::FindUniformByMappedName(const nsACString& mappedName,
     return false;
 }
 
+bool
+WebGLProgram::FindUniformBlockByMappedName(const nsACString& mappedName,
+                                           nsCString* const out_userName,
+                                           bool* const out_isArray) const
+{
+    if (mVertShader->FindUniformBlockByMappedName(mappedName, out_userName, out_isArray))
+        return true;
+
+    if (mFragShader->FindUniformBlockByMappedName(mappedName, out_userName, out_isArray))
+        return true;
+
+    return false;
+}
+
 ////////////////////////////////////////////////////////////////////////////////
 
 JSObject*

dom/canvas/WebGLProgram.h

@@ -9,6 +9,7 @@
 #include <map>
 #include "mozilla/CheckedInt.h"
 #include "mozilla/LinkedList.h"
+#include "mozilla/dom/WebGL2RenderingContextBinding.h"
 #include "nsString.h"
 #include "nsWrapperCache.h"
 #include <set>
@@ -24,6 +25,21 @@ class WebGLUniformLocation;
 
 namespace webgl {
 
+struct UniformBlockInfo final
+    : public RefCounted<UniformBlockInfo>
+{
+    MOZ_DECLARE_REFCOUNTED_TYPENAME(UniformBlockInfo);
+
+    const nsCString mBaseUserName;
+    const nsCString mBaseMappedName;
+
+    UniformBlockInfo(const nsACString& baseUserName,
+                     const nsACString& baseMappedName)
+        : mBaseUserName(baseUserName)
+        , mBaseMappedName(baseMappedName)
+    {}
+};
+
 struct LinkedProgramInfo final
     : public RefCounted<LinkedProgramInfo>
     , public SupportsWeakPtr<LinkedProgramInfo>
@@ -40,6 +56,8 @@ struct LinkedProgramInfo final
     std::map<nsCString, const WebGLActiveInfo*> uniformMap;
     std::map<nsCString, const nsCString>* fragDataMap;
 
+    std::vector<RefPtr<UniformBlockInfo>> uniformBlocks;
+
     // Needed for draw call validation.
     std::set<GLuint> activeAttribLocs;
 
@@ -67,6 +85,20 @@ struct LinkedProgramInfo final
         return true;
     }
 
+    bool FindUniformBlock(const nsCString& baseUserName,
+                          RefPtr<const UniformBlockInfo>* const out_info) const
+    {
+        const size_t count = uniformBlocks.size();
+        for (size_t i = 0; i < count; i++) {
+            if (baseUserName == uniformBlocks[i]->mBaseUserName) {
+                *out_info = uniformBlocks[i].get();
+                return true;
+            }
+        }
+
+        return false;
+    }
+
     bool FindFragData(const nsCString& baseUserName,
                       nsCString* const out_baseMappedName) const
     {
@@ -115,7 +147,16 @@ public:
     GLint GetFragDataLocation(const nsAString& name) const;
     void GetProgramInfoLog(nsAString* const out) const;
     JS::Value GetProgramParameter(GLenum pname) const;
+    GLuint GetUniformBlockIndex(const nsAString& name) const;
+    void GetActiveUniformBlockName(GLuint uniformBlockIndex, nsAString& name) const;
+    void GetActiveUniformBlockParam(GLuint uniformBlockIndex, GLenum pname,
+                                    Nullable<dom::OwningUnsignedLongOrUint32ArrayOrBoolean>& retval) const;
+    void GetActiveUniformBlockActiveUniforms(JSContext* cx, GLuint uniformBlockIndex,
+                                             Nullable<dom::OwningUnsignedLongOrUint32ArrayOrBoolean>& retval,
+                                             ErrorResult& rv) const;
     already_AddRefed<WebGLUniformLocation> GetUniformLocation(const nsAString& name) const;
+    void UniformBlockBinding(GLuint uniformBlockIndex, GLuint uniformBlockBinding) const;
+
     bool LinkProgram();
     bool UseProgram() const;
     void ValidateProgram() const;
@@ -127,6 +168,9 @@ public:
     bool FindUniformByMappedName(const nsACString& mappedName,
                                  nsCString* const out_userName,
                                  bool* const out_isArray) const;
+    bool FindUniformBlockByMappedName(const nsACString& mappedName,
+                                      nsCString* const out_userName,
+                                      bool* const out_isArray) const;
 
     bool IsLinked() const { return mMostRecentLinkInfo; }
 

dom/canvas/WebGLShader.cpp

@@ -345,6 +345,15 @@ WebGLShader::FindUniformByMappedName(const nsACString& mappedName,
     return true;
 }
 
+bool
+WebGLShader::FindUniformBlockByMappedName(const nsACString& mappedName,
+                                          nsCString* const out_userName,
+                                          bool* const out_isArray) const
+{
+    // TODO: Extract block information from shader validator.
+    return false;
+}
+
 ////////////////////////////////////////////////////////////////////////////////
 // Boilerplate
 

dom/canvas/WebGLShader.h

@@ -51,6 +51,9 @@ public:
     bool FindUniformByMappedName(const nsACString& mappedName,
                                  nsCString* const out_userName,
                                  bool* const out_isArray) const;
+    bool FindUniformBlockByMappedName(const nsACString& mappedName,
+                                      nsCString* const out_userName,
+                                      bool* const out_isArray) const;
 
     bool IsCompiled() const {
         return mTranslationSuccessful && mCompilationSuccessful;

dom/events/test/chrome.ini

@@ -18,4 +18,7 @@ support-files =
 [test_bug617528.xul]
 [test_bug679494.xul]
 [test_bug930374-chrome.html]
+[test_bug1128787-1.html]
+[test_bug1128787-2.html]
+[test_bug1128787-3.html]
 [test_eventctors.xul]

dom/events/test/test_bug1128787-1.html

@@ -0,0 +1,54 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1128787
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 1128787</title>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="chrome://global/skin"/>
+  <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"/>
+  <script type="application/javascript">
+
+  /** Test for Bug 1128787 **/
+  SimpleTest.waitForExplicitFinish();
+
+  window.onload = function (aEvent) {
+    var blurEventFired = false;
+    var input = document.getElementsByTagName("input")[0];
+    input.addEventListener("blur", function (aEvent) {
+      input.removeEventListener("blur", arguments.callee);
+      ok(true, "input element gets blur event correctly");
+
+      var utils = SpecialPowers.getDOMWindowUtils(window);
+      is(utils.IMEStatus, utils.IME_STATUS_ENABLED, "IME should be enabled");
+
+      SimpleTest.executeSoon(function () {
+        document.designMode = "off";
+
+        // XXX Should be fixed.
+        todo_is(utils.IMEStatus, utils.IME_STATUS_DISABLED, "IME should be disabled");
+
+        SimpleTest.finish();
+      });
+    });
+    document.designMode = "on";
+  }
+  </script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1128787">Mozilla Bug 1128787</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<input type="button"/>
+<script>
+var input = document.getElementsByTagName("input")[0];
+input.focus();
+</script>
+<pre id="test">
+</pre>
+</body>
+</html>

dom/events/test/test_bug1128787-2.html

@@ -0,0 +1,55 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1128787
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 1128787</title>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="chrome://global/skin"/>
+  <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"/>
+  <script type="application/javascript">
+
+  /** Test for Bug 1128787 **/
+  SimpleTest.waitForExplicitFinish();
+
+  window.onload = function (aEvent) {
+    var blurEventFired = false;
+    var input = document.getElementsByTagName("input")[0];
+    input.addEventListener("blur", function (aEvent) {
+      input.removeEventListener("blur", arguments.callee);
+      ok(true, "input element gets blur event correctly");
+
+      var utils = SpecialPowers.getDOMWindowUtils(window);
+      is(utils.IMEStatus, utils.IME_STATUS_ENABLED, "IME should be enabled");
+
+      SimpleTest.executeSoon(function () {
+        document.designMode = "off";
+
+        // XXX Should be fixed.
+        todo_is(utils.IMEStatus, utils.IME_STATUS_DISABLED, "IME should be disabled");
+
+        SimpleTest.finish();
+      });
+    });
+    document.designMode = "on";
+  }
+  </script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1128787">Mozilla Bug 1128787</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<p contenteditable="true"></p>
+<input type="button"/>
+<script>
+var input = document.getElementsByTagName("input")[0];
+input.focus();
+</script>
+<pre id="test">
+</pre>
+</body>
+</html>

dom/events/test/test_bug1128787-3.html

@@ -0,0 +1,54 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1128787
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 1128787</title>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="chrome://global/skin"/>
+  <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"/>
+  <script type="application/javascript">
+
+  /** Test for Bug 1128787 **/
+  SimpleTest.waitForExplicitFinish();
+
+  window.onload = function (aEvent) {
+    var blurEventFired = false;
+    var input = document.getElementsByTagName("input")[0];
+    input.addEventListener("blur", function (aEvent) {
+      input.removeEventListener("blur", arguments.callee);
+      ok(true, "input element gets blur event correctly");
+
+      var utils = SpecialPowers.getDOMWindowUtils(window);
+      is(utils.IMEStatus, utils.IME_STATUS_ENABLED, "IME should be enabled");
+
+      is(document.designMode, "on",
+         "designMode should be \"on\" when blur event caused by enabling designMode is fired");
+      document.designMode = "off";
+      is(document.designMode, "off",
+         "designMode should become \"off\" even if it's reset by the blur event handler caused by enabling designMode");
+
+      todo_is(utils.IMEStatus, utils.IME_STATUS_DISABLED, "IME should be disabled");
+      SimpleTest.finish();
+    });
+    document.designMode = "on";
+  }
+  </script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1128787">Mozilla Bug 1128787</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<input type="button"/>
+<script>
+var input = document.getElementsByTagName("input")[0];
+input.focus();
+</script>
+<pre id="test">
+</pre>
+</body>
+</html>

dom/html/nsHTMLDocument.cpp

@@ -110,6 +110,9 @@
 #include "nsCharsetSource.h"
 #include "nsIStringBundle.h"
 #include "nsDOMClassInfo.h"
+#include "nsFocusManager.h"
+#include "nsIFrame.h"
+#include "nsIContent.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
@@ -2723,7 +2726,7 @@ nsHTMLDocument::EditingStateChanged()
   }
 
   if (mEditingState == eSettingUp || mEditingState == eTearingDown) {
-    // XXX We shouldn't recurse.
+    // XXX We shouldn't recurse
     return NS_OK;
   }
 
@@ -2787,12 +2790,91 @@ nsHTMLDocument::EditingStateChanged()
   bool makeWindowEditable = mEditingState == eOff;
   bool updateState = false;
   bool spellRecheckAll = false;
+  bool putOffToRemoveScriptBlockerUntilModifyingEditingState = false;
   nsCOMPtr<nsIEditor> editor;
 
   {
     EditingState oldState = mEditingState;
     nsAutoEditingState push(this, eSettingUp);
 
+    nsCOMPtr<nsIPresShell> presShell = GetShell();
+    NS_ENSURE_TRUE(presShell, NS_ERROR_FAILURE);
+
+    // Before making this window editable, we need to modify UA style sheet
+    // because new style may change whether focused element will be focusable
+    // or not.
+    nsCOMArray<nsIStyleSheet> agentSheets;
+    rv = presShell->GetAgentStyleSheets(agentSheets);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    nsCOMPtr<nsIURI> uri;
+    rv = NS_NewURI(getter_AddRefs(uri),
+                   NS_LITERAL_STRING("resource://gre/res/contenteditable.css"));
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    nsRefPtr<CSSStyleSheet> sheet;
+    rv = LoadChromeSheetSync(uri, true, getter_AddRefs(sheet));
+    NS_ENSURE_TRUE(sheet, rv);
+
+    bool result = agentSheets.AppendObject(sheet);
+    NS_ENSURE_TRUE(result, NS_ERROR_OUT_OF_MEMORY);
+
+    // Should we update the editable state of all the nodes in the document? We
+    // need to do this when the designMode value changes, as that overrides
+    // specific states on the elements.
+    if (designMode) {
+      // designMode is being turned on (overrides contentEditable).
+      rv = NS_NewURI(getter_AddRefs(uri),
+                     NS_LITERAL_STRING("resource://gre/res/designmode.css"));
+      NS_ENSURE_SUCCESS(rv, rv);
+
+      rv = LoadChromeSheetSync(uri, true, getter_AddRefs(sheet));
+      NS_ENSURE_TRUE(sheet, rv);
+
+      result = agentSheets.AppendObject(sheet);
+      NS_ENSURE_TRUE(result, NS_ERROR_OUT_OF_MEMORY);
+
+      updateState = true;
+      spellRecheckAll = oldState == eContentEditable;
+    }
+    else if (oldState == eDesignMode) {
+      // designMode is being turned off (contentEditable is still on).
+      RemoveFromAgentSheets(agentSheets,
+        NS_LITERAL_STRING("resource://gre/res/designmode.css"));
+
+      updateState = true;
+    }
+
+    rv = presShell->SetAgentStyleSheets(agentSheets);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    presShell->ReconstructStyleData();
+
+    // Adjust focused element with new style but blur event shouldn't be fired
+    // until mEditingState is modified with newState.
+    nsAutoScriptBlocker scriptBlocker;
+    if (designMode) {
+      nsCOMPtr<nsPIDOMWindow> focusedWindow;
+      nsIContent* focusedContent =
+        nsFocusManager::GetFocusedDescendant(window, false,
+                                             getter_AddRefs(focusedWindow));
+      if (focusedContent) {
+        nsIFrame* focusedFrame = focusedContent->GetPrimaryFrame();
+        bool clearFocus = focusedFrame ? !focusedFrame->IsFocusable() :
+                                         !focusedContent->IsFocusable();
+        if (clearFocus) {
+          nsFocusManager* fm = nsFocusManager::GetFocusManager();
+          if (fm) {
+            fm->ClearFocus(window);
+            // If we need to dispatch blur event, we should put off after
+            // modifying mEditingState since blur event handler may change
+            // designMode state again.
+            putOffToRemoveScriptBlockerUntilModifyingEditingState = true;
+          }
+        }
+      }
+    }
+
     if (makeWindowEditable) {
       // Editing is being turned on (through designMode or contentEditable)
       // Turn on editor.
@@ -2808,61 +2890,26 @@ nsHTMLDocument::EditingStateChanged()
     if (!editor)
       return NS_ERROR_FAILURE;
 
-    nsCOMPtr<nsIPresShell> presShell = GetShell();
-    NS_ENSURE_TRUE(presShell, NS_ERROR_FAILURE);
-
     // If we're entering the design mode, put the selection at the beginning of
     // the document for compatibility reasons.
     if (designMode && oldState == eOff) {
       editor->BeginningOfDocument();
     }
 
-    nsCOMArray<nsIStyleSheet> agentSheets;
-    rv = presShell->GetAgentStyleSheets(agentSheets);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    nsCOMPtr<nsIURI> uri;
-    rv = NS_NewURI(getter_AddRefs(uri), NS_LITERAL_STRING("resource://gre/res/contenteditable.css"));
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    nsRefPtr<CSSStyleSheet> sheet;
-    rv = LoadChromeSheetSync(uri, true, getter_AddRefs(sheet));
-    NS_ENSURE_TRUE(sheet, rv);
-
-    bool result = agentSheets.AppendObject(sheet);
-    NS_ENSURE_TRUE(result, NS_ERROR_OUT_OF_MEMORY);
-
-    // Should we update the editable state of all the nodes in the document? We
-    // need to do this when the designMode value changes, as that overrides
-    // specific states on the elements.
-    if (designMode) {
-      // designMode is being turned on (overrides contentEditable).
-      rv = NS_NewURI(getter_AddRefs(uri), NS_LITERAL_STRING("resource://gre/res/designmode.css"));
-      NS_ENSURE_SUCCESS(rv, rv);
-
-      rv = LoadChromeSheetSync(uri, true, getter_AddRefs(sheet));
-      NS_ENSURE_TRUE(sheet, rv);
-
-      result = agentSheets.AppendObject(sheet);
-      NS_ENSURE_TRUE(result, NS_ERROR_OUT_OF_MEMORY);
-
-      updateState = true;
-      spellRecheckAll = oldState == eContentEditable;
+    if (putOffToRemoveScriptBlockerUntilModifyingEditingState) {
+      nsContentUtils::AddScriptBlocker();
     }
-    else if (oldState == eDesignMode) {
-      // designMode is being turned off (contentEditable is still on).
-      RemoveFromAgentSheets(agentSheets, NS_LITERAL_STRING("resource://gre/res/designmode.css"));
-
-      updateState = true;
-    }
-
-    rv = presShell->SetAgentStyleSheets(agentSheets);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    presShell->ReconstructStyleData();
   }
 
   mEditingState = newState;
+  if (putOffToRemoveScriptBlockerUntilModifyingEditingState) {
+    nsContentUtils::RemoveScriptBlocker();
+    // If mEditingState is overwritten by another call and already disabled
+    // the editing, we shouldn't keep making window editable.
+    if (mEditingState == eOff) {
+      return NS_OK;
+    }
+  }
 
   if (makeWindowEditable) {
     // Set the editor to not insert br's on return when in p

dom/indexedDB/ActorsParent.cpp

@@ -5492,7 +5492,7 @@ private:
   ~WaitForTransactionsHelper()
   {
     MOZ_ASSERT(!mCallback);
-    MOZ_ASSERT(mState = State_Complete);
+    MOZ_ASSERT(mState == State_Complete);
   }
 
   void
@@ -7877,7 +7877,7 @@ private:
   {
     MOZ_ASSERT(!mQuotaClient);
     MOZ_ASSERT(!mCallback);
-    MOZ_ASSERT(mState = State_Complete);
+    MOZ_ASSERT(mState == State_Complete);
   }
 
   void

dom/ipc/ContentChild.cpp

@@ -2019,7 +2019,7 @@ ContentChild::RecvAsyncMessage(const nsString& aMsg,
     if (cpm) {
         StructuredCloneData cloneData = ipc::UnpackClonedMessageDataForChild(aData);
         CrossProcessCpowHolder cpows(this, aCpows);
-        cpm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(cpm.get()),
+        cpm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(cpm.get()), nullptr,
                             aMsg, false, &cloneData, &cpows, aPrincipal, nullptr);
     }
     return true;

dom/ipc/ContentParent.cpp

@@ -1703,7 +1703,7 @@ ContentParent::ShutDownMessageManager()
   }
 
   mMessageManager->ReceiveMessage(
-            static_cast<nsIContentFrameMessageManager*>(mMessageManager.get()),
+            static_cast<nsIContentFrameMessageManager*>(mMessageManager.get()), nullptr,
             CHILD_PROCESS_SHUTDOWN_MESSAGE, false,
             nullptr, nullptr, nullptr, nullptr);
 
@@ -1883,11 +1883,6 @@ struct DelayedDeleteContentParentTask : public nsRunnable
 void
 ContentParent::ActorDestroy(ActorDestroyReason why)
 {
-#ifdef MOZ_CRASHREPORTER
-    CrashReporter::AnnotateCrashReport(NS_LITERAL_CSTRING("ChildShutdownState"),
-                                       NS_LITERAL_CSTRING("ActorDestroy"));
-#endif
-
     if (mForceKillTimer) {
         mForceKillTimer->Cancel();
         mForceKillTimer = nullptr;
@@ -2049,12 +2044,6 @@ ContentParent::NotifyTabDestroying(PBrowserParent* aTab)
     StartForceKillTimer();
 }
 
-static int32_t
-ForceKillTimeout()
-{
-    return Preferences::GetInt("dom.ipc.tabs.shutdownTimeoutSecs", 5);
-}
-
 void
 ContentParent::StartForceKillTimer()
 {
@@ -2062,7 +2051,7 @@ ContentParent::StartForceKillTimer()
         return;
     }
 
-    int32_t timeoutSecs = ForceKillTimeout();
+    int32_t timeoutSecs = Preferences::GetInt("dom.ipc.tabs.shutdownTimeoutSecs", 5);
     if (timeoutSecs > 0) {
         mForceKillTimer = do_CreateInstance("@mozilla.org/timer;1");
         MOZ_ASSERT(mForceKillTimer);
@@ -2933,27 +2922,13 @@ ContentParent::Observe(nsISupports* aSubject,
 {
     if (mSubprocess && (!strcmp(aTopic, "profile-before-change") ||
                         !strcmp(aTopic, "xpcom-shutdown"))) {
-#ifdef MOZ_CRASHREPORTER
-        CrashReporter::AnnotateCrashReport(NS_LITERAL_CSTRING("ChildShutdownState"),
-                                           NS_LITERAL_CSTRING("Begin"));
-#endif
-
         // Okay to call ShutDownProcess multiple times.
         ShutDownProcess(SEND_SHUTDOWN_MESSAGE);
 
-        int32_t timeout = ForceKillTimeout();
-
-        // Make sure we have a KillHard timer before we start waiting.
-        MOZ_RELEASE_ASSERT(!timeout || !mIPCOpen || mCalledKillHard || mForceKillTimer);
-
         // Wait for shutdown to complete, so that we receive any shutdown
         // data (e.g. telemetry) from the child before we quit.
         // This loop terminate prematurely based on mForceKillTimer.
-        while (mIPCOpen) {
-            // If we clear the KillHard timer, it should only be because we
-            // called KillHard. In that case, ActorDestroy should happen
-            // momentarily.
-            MOZ_RELEASE_ASSERT(!timeout || mCalledKillHard || mForceKillTimer);
+        while (mIPCOpen && !mCalledKillHard) {
             NS_ProcessNextEvent(nullptr, true);
         }
         NS_ASSERTION(!mSubprocess, "Close should have nulled mSubprocess");
@@ -3400,11 +3375,6 @@ ContentParent::ForceKillTimerCallback(nsITimer* aTimer, void* aClosure)
 void
 ContentParent::KillHard(const char* aReason)
 {
-#ifdef MOZ_CRASHREPORTER
-    CrashReporter::AnnotateCrashReport(NS_LITERAL_CSTRING("ChildShutdownState"),
-                                       NS_LITERAL_CSTRING("KillHard"));
-#endif
-
     // On Windows, calling KillHard multiple times causes problems - the
     // process handle becomes invalid on the first call, causing a second call
     // to crash our process - more details in bug 890840.

dom/ipc/TabChild.cpp

@@ -496,7 +496,7 @@ TabChildBase::DispatchMessageManagerMessage(const nsAString& aMessageName,
     // content manipulate the frame state.
     nsRefPtr<nsFrameMessageManager> mm =
       static_cast<nsFrameMessageManager*>(mTabChildGlobal->mMessageManager.get());
-    mm->ReceiveMessage(static_cast<EventTarget*>(mTabChildGlobal),
+    mm->ReceiveMessage(static_cast<EventTarget*>(mTabChildGlobal), nullptr,
                        aMessageName, false, &cloneData, nullptr, nullptr, nullptr);
 }
 
@@ -2488,6 +2488,11 @@ TabChild::RecvRealKeyEvent(const WidgetKeyboardEvent& event,
   AutoCacheNativeKeyCommands autoCache(widget);
 
   if (event.message == NS_KEY_PRESS) {
+    // If content code called preventDefault() on a keydown event, then we don't
+    // want to process any following keypress events.
+    if (mIgnoreKeyPressEvent) {
+      return true;
+    }
     if (aBindings.type() == MaybeNativeKeyBinding::TNativeKeyBinding) {
       const NativeKeyBinding& bindings = aBindings;
       autoCache.Cache(bindings.singleLineCommands(),
@@ -2497,11 +2502,6 @@ TabChild::RecvRealKeyEvent(const WidgetKeyboardEvent& event,
       autoCache.CacheNoCommands();
     }
   }
-  // If content code called preventDefault() on a keydown event, then we don't
-  // want to process any following keypress events.
-  if (event.message == NS_KEY_PRESS && mIgnoreKeyPressEvent) {
-    return true;
-  }
 
   WidgetKeyboardEvent localEvent(event);
   localEvent.widget = mWidget;
@@ -2689,7 +2689,7 @@ TabChild::RecvAsyncMessage(const nsString& aMessage,
     nsRefPtr<nsFrameMessageManager> mm =
       static_cast<nsFrameMessageManager*>(mTabChildGlobal->mMessageManager.get());
     CrossProcessCpowHolder cpows(Manager(), aCpows);
-    mm->ReceiveMessage(static_cast<EventTarget*>(mTabChildGlobal),
+    mm->ReceiveMessage(static_cast<EventTarget*>(mTabChildGlobal), nullptr,
                        aMessage, false, &cloneData, &cpows, aPrincipal, nullptr);
   }
   return true;

dom/ipc/TabParent.cpp

@@ -2484,6 +2484,7 @@ TabParent::ReceiveMessage(const nsString& aMessage,
       frameLoader->GetFrameMessageManager();
 
     manager->ReceiveMessage(mFrameElement,
+                            frameLoader,
                             aMessage,
                             aSync,
                             aCloneData,

dom/ipc/nsIContentChild.cpp

@@ -117,7 +117,7 @@ nsIContentChild::RecvAsyncMessage(const nsString& aMsg,
   if (cpm) {
     StructuredCloneData cloneData = ipc::UnpackClonedMessageDataForChild(aData);
     CrossProcessCpowHolder cpows(this, aCpows);
-    cpm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(cpm.get()),
+    cpm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(cpm.get()), nullptr,
                         aMsg, false, &cloneData, &cpows, aPrincipal, nullptr);
   }
   return true;

dom/ipc/nsIContentParent.cpp

@@ -194,7 +194,7 @@ nsIContentParent::RecvSyncMessage(const nsString& aMsg,
   if (ppm) {
     StructuredCloneData cloneData = ipc::UnpackClonedMessageDataForParent(aData);
     CrossProcessCpowHolder cpows(this, aCpows);
-    ppm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm.get()),
+    ppm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm.get()), nullptr,
                         aMsg, true, &cloneData, &cpows, aPrincipal, aRetvals);
   }
   return true;
@@ -221,7 +221,7 @@ nsIContentParent::RecvRpcMessage(const nsString& aMsg,
   if (ppm) {
     StructuredCloneData cloneData = ipc::UnpackClonedMessageDataForParent(aData);
     CrossProcessCpowHolder cpows(this, aCpows);
-    ppm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm.get()),
+    ppm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm.get()), nullptr,
                         aMsg, true, &cloneData, &cpows, aPrincipal, aRetvals);
   }
   return true;
@@ -247,7 +247,7 @@ nsIContentParent::RecvAsyncMessage(const nsString& aMsg,
   if (ppm) {
     StructuredCloneData cloneData = ipc::UnpackClonedMessageDataForParent(aData);
     CrossProcessCpowHolder cpows(this, aCpows);
-    ppm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm.get()),
+    ppm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm.get()), nullptr,
                         aMsg, false, &cloneData, &cpows, aPrincipal, nullptr);
   }
   return true;

dom/media/AbstractThread.cpp

@@ -85,6 +85,8 @@ public:
     return mTailDispatcher.ref();
   }
 
+  virtual nsIThread* AsXPCOMThread() override { return mTarget; }
+
 private:
   nsRefPtr<nsIThread> mTarget;
   Maybe<AutoTaskDispatcher> mTailDispatcher;

dom/media/AbstractThread.h

@@ -17,6 +17,7 @@
 
 namespace mozilla {
 
+class MediaTaskQueue;
 class TaskDispatcher;
 
 /*
@@ -66,6 +67,9 @@ public:
   // tasks to go through the tail dispatcher.
   bool RequiresTailDispatch() const { return mRequireTailDispatch; }
 
+  virtual MediaTaskQueue* AsTaskQueue() { MOZ_CRASH("Not a task queue!"); }
+  virtual nsIThread* AsXPCOMThread() { MOZ_CRASH("Not an XPCOM thread!"); }
+
   // Convenience method for getting an AbstractThread for the main thread.
   static AbstractThread* MainThread();
 

dom/media/MediaInfo.h

@@ -112,6 +112,7 @@ public:
     , mDisplay(nsIntSize(aWidth, aHeight))
     , mStereoMode(StereoMode::MONO)
     , mImage(nsIntSize(aWidth, aHeight))
+    , mCodecSpecificConfig(new MediaByteBuffer)
     , mExtraData(new MediaByteBuffer)
   {
   }
@@ -130,7 +131,7 @@ public:
 
   // Size in pixels of decoded video's image.
   nsIntSize mImage;
-
+  nsRefPtr<MediaByteBuffer> mCodecSpecificConfig;
   nsRefPtr<MediaByteBuffer> mExtraData;
 };
 

dom/media/MediaTaskQueue.h

@@ -42,6 +42,8 @@ public:
 
   TaskDispatcher& TailDispatcher() override;
 
+  MediaTaskQueue* AsTaskQueue() override { return this; }
+
   void Dispatch(already_AddRefed<nsIRunnable> aRunnable,
                 DispatchFailureHandling aFailureHandling = AssertDispatchSuccess,
                 DispatchReason aReason = NormalDispatch) override

dom/media/fmp4/MP4Reader.cpp

@@ -345,6 +345,7 @@ bool
 MP4Reader::IsSupportedVideoMimeType(const nsACString& aMimeType)
 {
   return (aMimeType.EqualsLiteral("video/mp4") ||
+          aMimeType.EqualsLiteral("video/mp4v-es") ||
           aMimeType.EqualsLiteral("video/avc") ||
           aMimeType.EqualsLiteral("video/x-vnd.on2.vp6")) &&
          mPlatform->SupportsMimeType(aMimeType);

dom/media/fmp4/eme/EMEDecoderModule.cpp

@@ -241,7 +241,7 @@ EMEDecoderModule::CreateVideoDecoder(const VideoInfo& aConfig,
   nsRefPtr<MediaDataDecoder> emeDecoder(new EMEDecryptor(decoder,
                                                          aCallback,
                                                          mProxy,
-                                                         static_cast<MediaTaskQueue*>(AbstractThread::GetCurrent())));
+                                                         AbstractThread::GetCurrent()->AsTaskQueue()));
   return emeDecoder.forget();
 }
 
@@ -272,7 +272,7 @@ EMEDecoderModule::CreateAudioDecoder(const AudioInfo& aConfig,
   nsRefPtr<MediaDataDecoder> emeDecoder(new EMEDecryptor(decoder,
                                                          aCallback,
                                                          mProxy,
-                                                         static_cast<MediaTaskQueue*>(AbstractThread::GetCurrent())));
+                                                         AbstractThread::GetCurrent()->AsTaskQueue()));
   return emeDecoder.forget();
 }
 

dom/media/fmp4/eme/EMEDecoderModule.h

@@ -13,7 +13,6 @@
 namespace mozilla {
 
 class CDMProxy;
-class FlushableMediaTaskQueue;
 
 class EMEDecoderModule : public PlatformDecoderModule {
 private:
@@ -48,7 +47,7 @@ private:
   // Will be null if CDM has decoding capability.
   nsRefPtr<PlatformDecoderModule> mPDM;
   // We run the PDM on its own task queue.
-  nsRefPtr<FlushableMediaTaskQueue> mTaskQueue;
+  nsRefPtr<MediaTaskQueue> mTaskQueue;
   bool mCDMDecodesAudio;
   bool mCDMDecodesVideo;
 

dom/media/fmp4/gonk/GonkDecoderModule.cpp

@@ -61,4 +61,12 @@ GonkDecoderModule::DecoderNeedsConversion(const TrackInfo& aConfig) const
   }
 }
 
+bool
+GonkDecoderModule::SupportsMimeType(const nsACString& aMimeType)
+{
+  return aMimeType.EqualsLiteral("audio/mp4a-latm") ||
+    aMimeType.EqualsLiteral("video/mp4") ||
+    aMimeType.EqualsLiteral("video/mp4v-es") ||
+    aMimeType.EqualsLiteral("video/avc");
+}
 } // namespace mozilla

dom/media/fmp4/gonk/GonkDecoderModule.h

@@ -34,6 +34,9 @@ public:
 
   virtual ConversionRequired
   DecoderNeedsConversion(const TrackInfo& aConfig) const override;
+
+  virtual bool SupportsMimeType(const nsACString& aMimeType) override;
+
 };
 
 } // namespace mozilla

dom/media/fmp4/gonk/GonkMediaDataDecoder.cpp

@@ -175,7 +175,7 @@ GonkMediaDataDecoder::ProcessDecode(MediaRawData* aSample)
 {
   nsresult rv = mManager->Input(aSample);
   if (rv != NS_OK) {
-    NS_WARNING("GonkAudioDecoder failed to input data");
+    NS_WARNING("GonkMediaDataDecoder failed to input data");
     GMDD_LOG("Failed to input data err: %d",int(rv));
     mCallback->Error();
     return;

dom/media/fmp4/gonk/GonkVideoDecoderManager.cpp

@@ -57,12 +57,14 @@ GonkVideoDecoderManager::GonkVideoDecoderManager(
   NS_ASSERTION(!NS_IsMainThread(), "Should not be on main thread.");
   MOZ_ASSERT(mImageContainer);
   MOZ_COUNT_CTOR(GonkVideoDecoderManager);
+  mMimeType = aConfig.mMimeType;
   mVideoWidth  = aConfig.mDisplay.width;
   mVideoHeight = aConfig.mDisplay.height;
   mDisplayWidth = aConfig.mDisplay.width;
   mDisplayHeight = aConfig.mDisplay.height;
   mInfo.mVideo = aConfig;
 
+  mCodecSpecificData = aConfig.mCodecSpecificConfig;
   nsIntRect pictureRect(0, 0, mVideoWidth, mVideoHeight);
   nsIntSize frameSize(mVideoWidth, mVideoHeight);
   mPicture = pictureRect;
@@ -105,9 +107,8 @@ GonkVideoDecoderManager::Init(MediaDataDecoderCallback* aCallback)
   if (mLooper->start() != OK || mManagerLooper->start() != OK ) {
     return nullptr;
   }
-  mDecoder = MediaCodecProxy::CreateByType(mLooper, "video/avc", false, mVideoListener);
+  mDecoder = MediaCodecProxy::CreateByType(mLooper, mMimeType.get(), false, mVideoListener);
   mDecoder->AskMediaCodecAndWait();
-
   uint32_t capability = MediaCodecProxy::kEmptyCapability;
   if (mDecoder->getCapability(&capability) == OK && (capability &
       MediaCodecProxy::kCanExposeGraphicBuffer)) {
@@ -390,10 +391,12 @@ GonkVideoDecoderManager::Output(int64_t aStreamOffset,
       if (mDecoder->UpdateOutputBuffers()) {
         return Output(aStreamOffset, aOutData);
       }
+      GVDM_LOG("Fails to update output buffers!");
       return NS_ERROR_FAILURE;
     }
     case -EAGAIN:
     {
+      GVDM_LOG("Need to try again!");
       return NS_ERROR_NOT_AVAILABLE;
     }
     case android::ERROR_END_OF_STREAM:
@@ -493,7 +496,8 @@ GonkVideoDecoderManager::codecReserved()
   sp<Surface> surface;
 
   // Fixed values
-  format->setString("mime", "video/avc");
+  GVDM_LOG("Configure mime type: %s, widht:%d, height:%d", mMimeType.get(), mVideoWidth, mVideoHeight);
+  format->setString("mime", mMimeType.get());
   format->setInt32("width", mVideoWidth);
   format->setInt32("height", mVideoHeight);
   if (mNativeWindow != nullptr) {
@@ -501,6 +505,12 @@ GonkVideoDecoderManager::codecReserved()
   }
   mDecoder->configure(format, surface, nullptr, 0);
   mDecoder->Prepare();
+  status_t rv = mDecoder->Input(mCodecSpecificData->Elements(), mCodecSpecificData->Length(), 0,
+                                android::MediaCodec::BUFFER_FLAG_CODECCONFIG);
+  if (rv != OK) {
+    GVDM_LOG("Failed to configure codec!!!!");
+    mReaderCallback->Error();
+  }
 }
 
 void

dom/media/fmp4/gonk/GonkVideoDecoderManager.h

@@ -147,6 +147,7 @@ private:
 
   android::MediaBuffer* mVideoBuffer;
 
+  nsRefPtr<MediaByteBuffer>  mCodecSpecificData;
   MediaDataDecoderCallback*  mReaderCallback;
   MediaInfo mInfo;
   android::sp<VideoResourceListener> mVideoListener;
@@ -176,6 +177,8 @@ private:
   Vector<android::MediaBuffer*> mPendingVideoBuffers;
   // The lock protects mPendingVideoBuffers.
   Mutex mPendingVideoBuffersLock;
+
+  nsAutoCString mMimeType;
 };
 
 } // namespace mozilla

dom/tests/mochitest/bugs/test_bug61098.html

@@ -21,7 +21,6 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=61098
 <script class="testbody" type="text/javascript">
 /** Test for Bug 61098 **/
 
-SimpleTest.expectAssertions(8);
 SimpleTest.waitForExplicitFinish();
 
 var mockPromptServiceRegisterer, mockPromptFactoryRegisterer;

editor/libeditor/crashtests/1128787.html

@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Bug 1128787</title>
+</head>
+<body>
+  <input type="button"/>
+  <script>
+    window.onload = function () {
+        document.designMode = "on";
+    }
+    var input = document.getElementsByTagName("input")[0];
+    input.focus();
+    input.type = "text";
+  </script>
+</body>
+</html>

editor/libeditor/crashtests/crashtests.list

@@ -59,4 +59,5 @@ load 772282.html
 load 776323.html
 needs-focus load 793866.html
 load 1057677.html
+needs-focus load 1128787.html
 load 1134545.html

embedding/components/webbrowserpersist/nsWebBrowserPersist.cpp

@@ -2087,7 +2087,8 @@ nsWebBrowserPersist::MakeFilenameFromURI(nsIURI *aURI, nsString &aFilename)
         if (mPersistFlags & PERSIST_FLAGS_DONT_CHANGE_FILENAMES)
         {
             fileName.AssignWithConversion(NS_UnescapeURL(nameFromURL).get());
-            goto end;
+            aFilename = fileName;
+            return NS_OK;
         }
         if (!nameFromURL.IsEmpty())
         {
@@ -2127,7 +2128,6 @@ nsWebBrowserPersist::MakeFilenameFromURI(nsIURI *aURI, nsString &aFilename)
         fileName.Append(char16_t('a')); // 'a' is for arbitrary
     }
 
-end:
     aFilename = fileName;
     return NS_OK;
 }

gfx/2d/BaseMargin.h

@@ -89,11 +89,11 @@ struct BaseMargin {
 
   T& Side(SideT aSide) {
     // This is ugly!
-    return *(&top + T(aSide));
+    return *(&top + int(aSide));
   }
   T Side(SideT aSide) const {
     // This is ugly!
-    return *(&top + T(aSide));
+    return *(&top + int(aSide));
   }
 
   void ApplySkipSides(Sides aSkipSides)

gfx/layers/RotatedBuffer.cpp

@@ -650,7 +650,7 @@ RotatedContentBuffer::BeginPaint(PaintedLayer* aLayer,
                          &destDTBuffer, &destDTBufferOnWhite);
             if (!destDTBuffer ||
                 (!destDTBufferOnWhite && (bufferFlags & BUFFER_COMPONENT_ALPHA))) {
-              gfxCriticalError() << "Failed 1 buffer db=" << hexa(destDTBuffer.get()) << " dw=" << hexa(destDTBufferOnWhite.get()) << " for " << destBufferRect.x << ", " << destBufferRect.y << ", " << destBufferRect.width << ", " << destBufferRect.height;
+              gfxCriticalError(CriticalLog::DefaultOptions(Factory::ReasonableSurfaceSize(IntSize(destBufferRect.width, destBufferRect.height)))) << "Failed 1 buffer db=" << hexa(destDTBuffer.get()) << " dw=" << hexa(destDTBufferOnWhite.get()) << " for " << destBufferRect.x << ", " << destBufferRect.y << ", " << destBufferRect.width << ", " << destBufferRect.height;
               return result;
             }
           }
@@ -672,7 +672,7 @@ RotatedContentBuffer::BeginPaint(PaintedLayer* aLayer,
                  &destDTBuffer, &destDTBufferOnWhite);
     if (!destDTBuffer ||
         (!destDTBufferOnWhite && (bufferFlags & BUFFER_COMPONENT_ALPHA))) {
-      gfxCriticalError() << "Failed 2 buffer db=" << hexa(destDTBuffer.get()) << " dw=" << hexa(destDTBufferOnWhite.get()) << " for " << destBufferRect.x << ", " << destBufferRect.y << ", " << destBufferRect.width << ", " << destBufferRect.height;
+      gfxCriticalError(CriticalLog::DefaultOptions(Factory::ReasonableSurfaceSize(IntSize(destBufferRect.width, destBufferRect.height)))) << "Failed 2 buffer db=" << hexa(destDTBuffer.get()) << " dw=" << hexa(destDTBufferOnWhite.get()) << " for " << destBufferRect.x << ", " << destBufferRect.y << ", " << destBufferRect.width << ", " << destBufferRect.height;
       return result;
     }
   }
@@ -753,9 +753,8 @@ RotatedContentBuffer::BorrowDrawTargetForPainting(PaintState& aPaintState,
   if (aPaintState.mMode == SurfaceMode::SURFACE_COMPONENT_ALPHA) {
     if (!mDTBuffer || !mDTBufferOnWhite) {
       // This can happen in release builds if allocating one of the two buffers
-      // failed. This is pretty bad and the reason for the failure is already
-      // reported through gfxCriticalError.
-      MOZ_ASSERT(false);
+      // failed. This in turn can happen if unreasonably large textures are
+      // requested.
       return nullptr;
     }
     nsIntRegionRectIterator iter(*drawPtr);

gfx/layers/ipc/CompositorParent.cpp

@@ -1648,6 +1648,8 @@ public:
   virtual bool SetTestSampleTime(LayerTransactionParent* aLayerTree,
                                  const TimeStamp& aTime) override;
   virtual void LeaveTestMode(LayerTransactionParent* aLayerTree) override;
+  virtual void ApplyAsyncProperties(LayerTransactionParent* aLayerTree)
+               override;
   virtual void GetAPZTestData(const LayerTransactionParent* aLayerTree,
                               APZTestData* aOutData) override;
   virtual void SetConfirmedTargetAPZC(const LayerTransactionParent* aLayerTree,
@@ -2025,6 +2027,22 @@ CrossProcessCompositorParent::LeaveTestMode(LayerTransactionParent* aLayerTree)
   state->mParent->LeaveTestMode(aLayerTree);
 }
 
+void
+CrossProcessCompositorParent::ApplyAsyncProperties(
+    LayerTransactionParent* aLayerTree)
+{
+  uint64_t id = aLayerTree->GetId();
+  MOZ_ASSERT(id != 0);
+  const CompositorParent::LayerTreeState* state =
+    CompositorParent::GetIndirectShadowTree(id);
+  if (!state) {
+    return;
+  }
+
+  MOZ_ASSERT(state->mParent);
+  state->mParent->ApplyAsyncProperties(aLayerTree);
+}
+
 void
 CrossProcessCompositorParent::GetAPZTestData(const LayerTransactionParent* aLayerTree,
                                              APZTestData* aOutData)

gfx/layers/ipc/ShadowLayersManager.h

@@ -35,7 +35,7 @@ public:
     virtual bool SetTestSampleTime(LayerTransactionParent* aLayerTree,
                                    const TimeStamp& aTime) { return true; }
     virtual void LeaveTestMode(LayerTransactionParent* aLayerTree) { }
-    virtual void ApplyAsyncProperties(LayerTransactionParent* aLayerTree) { }
+    virtual void ApplyAsyncProperties(LayerTransactionParent* aLayerTree) = 0;
     virtual void GetAPZTestData(const LayerTransactionParent* aLayerTree,
                                 APZTestData* aOutData) { }
     virtual void SetConfirmedTargetAPZC(const LayerTransactionParent* aLayerTree,

gfx/src/nsFont.cpp

@@ -49,7 +49,7 @@ nsFont::Init()
 {
   systemFont = false;
   smoothing = NS_FONT_SMOOTHING_AUTO;
-  sizeAdjust = 0.0;
+  sizeAdjust = -1.0f;
   kerning = NS_FONT_KERNING_AUTO;
   synthesis = NS_FONT_SYNTHESIS_WEIGHT | NS_FONT_SYNTHESIS_STYLE;
 

gfx/src/nsFont.h

@@ -92,8 +92,8 @@ struct NS_GFX nsFont {
 
   // The aspect-value (ie., the ratio actualsize:actualxheight) that any
   // actual physical font created from this font structure must have when
-  // rendering or measuring a string. A value of 0 means no adjustment
-  // needs to be done.
+  // rendering or measuring a string. A value of -1.0 means no adjustment
+  // needs to be done; otherwise the value must be nonnegative.
   float sizeAdjust;
 
   // -- list of value tags for font-specific alternate features

gfx/thebes/gfxDWriteFonts.cpp

@@ -162,7 +162,7 @@ gfxDWriteFont::ComputeMetrics(AntialiasOption anAAOption)
         mFontFace->GetMetrics(&fontMetrics);
     }
 
-    if (mStyle.sizeAdjust != 0.0) {
+    if (mStyle.sizeAdjust >= 0.0) {
         gfxFloat aspect = (gfxFloat)fontMetrics.xHeight /
                    fontMetrics.designUnitsPerEm;
         mAdjustedSize = mStyle.GetAdjustedSize(aspect);

gfx/thebes/gfxFT2FontBase.cpp

@@ -114,7 +114,8 @@ gfxFT2FontBase::GetHorizontalMetrics()
     if (mHasMetrics)
         return mMetrics;
 
-    if (MOZ_UNLIKELY(GetStyle()->size <= 0.0)) {
+    if (MOZ_UNLIKELY(GetStyle()->size <= 0.0) ||
+        MOZ_UNLIKELY(GetStyle()->sizeAdjust == 0.0)) {
         new(&mMetrics) gfxFont::Metrics(); // zero initialize
         mSpaceGlyph = GetGlyph(' ');
     } else {

gfx/thebes/gfxFont.cpp

@@ -2201,6 +2201,7 @@ gfxFont::Measure(gfxTextRun *aTextRun,
         ((aBoundingBoxType == LOOSE_INK_EXTENTS &&
             !needsGlyphExtents &&
             !aTextRun->HasDetailedGlyphs()) ||
+         (MOZ_UNLIKELY(GetStyle()->sizeAdjust == 0.0)) ||
          (MOZ_UNLIKELY(GetStyle()->size == 0))) ? nullptr
         : GetOrCreateGlyphExtents(aTextRun->GetAppUnitsPerDevUnit());
     double x = 0;
@@ -3332,7 +3333,7 @@ gfxFont::SanitizeMetrics(gfxFont::Metrics *aMetrics, bool aIsBadUnderlineFont)
 {
     // Even if this font size is zero, this font is created with non-zero size.
     // However, for layout and others, we should return the metrics of zero size font.
-    if (mStyle.size == 0.0) {
+    if (mStyle.size == 0.0 || mStyle.sizeAdjust == 0.0) {
         memset(aMetrics, 0, sizeof(gfxFont::Metrics));
         return;
     }
@@ -3652,7 +3653,7 @@ gfxFontStyle::ParseFontLanguageOverride(const nsString& aLangTag)
 
 gfxFontStyle::gfxFontStyle() :
     language(nsGkAtoms::x_western),
-    size(DEFAULT_PIXEL_FONT_SIZE), sizeAdjust(0.0f), baselineOffset(0.0f),
+    size(DEFAULT_PIXEL_FONT_SIZE), sizeAdjust(-1.0f), baselineOffset(0.0f),
     languageOverride(NO_FONT_LANGUAGE_OVERRIDE),
     weight(NS_FONT_WEIGHT_NORMAL), stretch(NS_FONT_STRETCH_NORMAL),
     systemFont(true), printerFont(false), useGrayscaleAntialiasing(false),
@@ -3697,7 +3698,7 @@ gfxFontStyle::gfxFontStyle(uint8_t aStyle, uint16_t aWeight, int16_t aStretch,
 
     if (size >= FONT_MAX_SIZE) {
         size = FONT_MAX_SIZE;
-        sizeAdjust = 0.0;
+        sizeAdjust = -1.0f;
     } else if (size < 0.0) {
         NS_WARNING("negative font size");
         size = 0.0;

gfx/thebes/gfxFont.h

@@ -103,8 +103,8 @@ struct gfxFontStyle {
 
     // The aspect-value (ie., the ratio actualsize:actualxheight) that any
     // actual physical font created from this font structure must have when
-    // rendering or measuring a string. A value of 0 means no adjustment
-    // needs to be done.
+    // rendering or measuring a string. A value of -1.0 means no adjustment
+    // needs to be done; otherwise the value must be nonnegative.
     float sizeAdjust;
 
     // baseline offset, used when simulating sub/superscript glyphs
@@ -162,9 +162,9 @@ struct gfxFontStyle {
     uint8_t variantSubSuper;
 
     // Return the final adjusted font size for the given aspect ratio.
-    // Not meant to be called when sizeAdjust = 0.
+    // Not meant to be called when sizeAdjust = -1.0.
     gfxFloat GetAdjustedSize(gfxFloat aspect) const {
-        NS_ASSERTION(sizeAdjust != 0.0, "Not meant to be called when sizeAdjust = 0");
+        NS_ASSERTION(sizeAdjust >= 0.0, "Not meant to be called when sizeAdjust = -1.0");
         gfxFloat adjustedSize = std::max(NS_round(size*(sizeAdjust/aspect)), 1.0);
         return std::min(adjustedSize, FONT_MAX_SIZE);
     }
@@ -1387,7 +1387,9 @@ public:
     }
 
     virtual gfxFloat GetAdjustedSize() const {
-        return mAdjustedSize > 0.0 ? mAdjustedSize : mStyle.size;
+        return mAdjustedSize > 0.0
+                 ? mAdjustedSize
+                 : (mStyle.sizeAdjust == 0.0 ? 0.0 : mStyle.size);
     }
 
     float FUnitsToDevUnitsFactor() const {

gfx/thebes/gfxGDIFont.cpp

@@ -194,7 +194,7 @@ gfxGDIFont::Initialize()
 
     if (mAdjustedSize == 0.0) {
         mAdjustedSize = mStyle.size;
-        if (mStyle.sizeAdjust != 0.0 && mAdjustedSize > 0.0) {
+        if (mStyle.sizeAdjust > 0.0 && mAdjustedSize > 0.0) {
             // to implement font-size-adjust, we first create the "unadjusted" font
             FillLogFont(logFont, mAdjustedSize,
                         wantFakeItalic && !useCairoFakeItalic);
@@ -213,6 +213,8 @@ gfxGDIFont::Initialize()
             mFont = nullptr;
             delete mMetrics;
             mMetrics = nullptr;
+        } else if (mStyle.sizeAdjust == 0.0) {
+            mAdjustedSize = 0.0;
         }
     }
 

gfx/thebes/gfxMacFont.cpp

@@ -254,7 +254,7 @@ gfxMacFont::InitMetrics()
         mMetrics.xHeight = ::CGFontGetXHeight(mCGFont) * cgConvFactor;
     }
 
-    if (mStyle.sizeAdjust != 0.0 && mStyle.size > 0.0 &&
+    if (mStyle.sizeAdjust > 0.0 && mStyle.size > 0.0 &&
         mMetrics.xHeight > 0.0) {
         // apply font-size-adjust, and recalculate metrics
         gfxFloat aspect = mMetrics.xHeight / mStyle.size;

gfx/thebes/gfxPangoFonts.cpp

@@ -1853,7 +1853,7 @@ gfxPangoFontGroup::GetBaseFontSet()
         MakeFontSet(mPangoLanguage, mSizeAdjustFactor, &pattern);
 
     double size = GetPixelSize(pattern);
-    if (size != 0.0 && mStyle.sizeAdjust != 0.0) {
+    if (size != 0.0 && mStyle.sizeAdjust > 0.0) {
         gfxFcFont *font = fontSet->GetFontAt(0, GetStyle());
         if (font) {
             const gfxFont::Metrics& metrics =

gfx/thebes/gfxTextRun.cpp

@@ -1358,7 +1358,8 @@ gfxTextRun::FetchGlyphExtents(gfxContext *aRefContext)
     for (i = 0; i < runCount; ++i) {
         const GlyphRun& run = mGlyphRuns[i];
         gfxFont *font = run.mFont;
-        if (MOZ_UNLIKELY(font->GetStyle()->size == 0)) {
+        if (MOZ_UNLIKELY(font->GetStyle()->size == 0) ||
+            MOZ_UNLIKELY(font->GetStyle()->sizeAdjust == 0.0f)) {
             continue;
         }
 
@@ -2007,7 +2008,8 @@ gfxFontGroup::MakeSpaceTextRun(const Parameters *aParams, uint32_t aFlags)
     }
 
     gfxFont *font = GetFirstValidFont();
-    if (MOZ_UNLIKELY(GetStyle()->size == 0)) {
+    if (MOZ_UNLIKELY(GetStyle()->size == 0) ||
+        MOZ_UNLIKELY(GetStyle()->sizeAdjust == 0.0f)) {
         // Short-circuit for size-0 fonts, as Windows and ATSUI can't handle
         // them, and always create at least size 1 fonts, i.e. they still
         // render something for size 0 fonts.
@@ -2106,7 +2108,8 @@ gfxFontGroup::MakeTextRun(const uint8_t *aString, uint32_t aLength,
 
     aFlags |= TEXT_IS_8BIT;
 
-    if (GetStyle()->size == 0) {
+    if (MOZ_UNLIKELY(GetStyle()->size == 0) ||
+        MOZ_UNLIKELY(GetStyle()->sizeAdjust == 0.0f)) {
         // Short-circuit for size-0 fonts, as Windows and ATSUI can't handle
         // them, and always create at least size 1 fonts, i.e. they still
         // render something for size 0 fonts.
@@ -2137,7 +2140,8 @@ gfxFontGroup::MakeTextRun(const char16_t *aString, uint32_t aLength,
     if (aLength == 1 && aString[0] == ' ') {
         return MakeSpaceTextRun(aParams, aFlags);
     }
-    if (GetStyle()->size == 0) {
+    if (MOZ_UNLIKELY(GetStyle()->size == 0) ||
+        MOZ_UNLIKELY(GetStyle()->sizeAdjust == 0.0f)) {
         return MakeBlankTextRun(aLength, aParams, aFlags);
     }
 

ipc/glue/MessageChannel.cpp

@@ -522,7 +522,7 @@ MessageChannel::Echo(Message* aMsg)
     MonitorAutoLock lock(*mMonitor);
 
     if (!Connected()) {
-        ReportConnectionError("MessageChannel");
+        ReportConnectionError("MessageChannel", msg);
         return false;
     }
 
@@ -545,7 +545,7 @@ MessageChannel::Send(Message* aMsg)
 
     MonitorAutoLock lock(*mMonitor);
     if (!Connected()) {
-        ReportConnectionError("MessageChannel");
+        ReportConnectionError("MessageChannel", msg);
         return false;
     }
     mLink->SendMessage(msg.forget());
@@ -778,7 +778,7 @@ MessageChannel::Send(Message* aMsg, Message* aReply)
     nsAutoPtr<Message> msg(aMsg);
 
     if (!Connected()) {
-        ReportConnectionError("MessageChannel::SendAndWait");
+        ReportConnectionError("MessageChannel::SendAndWait", msg);
         return false;
     }
 
@@ -871,7 +871,7 @@ MessageChannel::Call(Message* aMsg, Message* aReply)
 
     MonitorAutoLock lock(*mMonitor);
     if (!Connected()) {
-        ReportConnectionError("MessageChannel::Call");
+        ReportConnectionError("MessageChannel::Call", aMsg);
         return false;
     }
 
@@ -1527,7 +1527,7 @@ MessageChannel::ReportMessageRouteError(const char* channelName) const
 }
 
 void
-MessageChannel::ReportConnectionError(const char* aChannelName) const
+MessageChannel::ReportConnectionError(const char* aChannelName, Message* aMsg) const
 {
     AssertWorkerThread();
     mMonitor->AssertCurrentThreadOwns();
@@ -1554,7 +1554,16 @@ MessageChannel::ReportConnectionError(const char* aChannelName) const
         NS_RUNTIMEABORT("unreached");
     }
 
+    if (aMsg) {
+        char reason[512];
+        PR_snprintf(reason, sizeof(reason),
+                    "(msgtype=0x%lX,name=%s) %s",
+                    aMsg->type(), aMsg->name(), errorMsg);
+
+        PrintErrorMessage(mSide, aChannelName, reason);
+    } else {
         PrintErrorMessage(mSide, aChannelName, errorMsg);
+    }
 
     MonitorAutoUnlock unlock(*mMonitor);
     mListener->OnProcessingError(MsgDropped, errorMsg);

ipc/glue/MessageChannel.h

@@ -215,7 +215,7 @@ class MessageChannel : HasResultCodes
 
     void PostErrorNotifyTask();
     void OnNotifyMaybeChannelError();
-    void ReportConnectionError(const char* aChannelName) const;
+    void ReportConnectionError(const char* aChannelName, Message* aMsg = nullptr) const;
     void ReportMessageRouteError(const char* channelName) const;
     bool MaybeHandleError(Result code, const Message& aMsg, const char* channelName);
 

js/src/builtin/TestingFunctions.cpp

@@ -1423,7 +1423,7 @@ DisplayName(JSContext* cx, unsigned argc, jsval* vp)
 }
 
 static JSObject*
-ShellObjectMetadataCallback(JSContext* cx)
+ShellObjectMetadataCallback(JSContext* cx, JSObject*)
 {
     RootedObject obj(cx, NewBuiltinClassInstance<PlainObject>(cx));
     if (!obj)

js/src/doc/Debugger/Debugger.Memory.md

@@ -198,14 +198,16 @@ Function Properties of the `Debugger.Memory.prototype` Object
     <pre class='language-js'><code>
     {
       "timestamp": <i>timestamp</i>,
-      "frame": <i>allocationSite</i>
+      "frame": <i>allocationSite</i>,
+      "class": <i>className</i>
     }
     </code></pre>
 
-    Here <i>timestamp</i> is the [timestamp][timestamps] of the allocation event and
-    <i>allocationSite</i> is an allocation site (as a
-    [captured stack][saved-frame]).  <i>allocationSite</i> is `null` for objects
-    allocated with no JavaScript frames on the stack.
+    Here <i>timestamp</i> is the [timestamp][timestamps] of the allocation
+    event, <i>allocationSite</i> is an allocation site (as a
+    [captured stack][saved-frame]), and <i>className</i> is the string name of
+    the allocated object's internal `[[Class]]` property.  <i>allocationSite</i>
+    is `null` for objects allocated with no JavaScript frames on the stack.
 
     When `trackingAllocationSites` is `false`, `drainAllocationsLog()` throws an
     `Error`.

js/src/jit-test/tests/debug/Memory-drainAllocationsLog-15.js

@@ -0,0 +1,31 @@
+// Test drainAllocationsLog() and [[Class]] names.
+
+const root = newGlobal();
+const dbg = new Debugger();
+const wrappedRoot = dbg.addDebuggee(root)
+
+root.eval(
+  `
+  this.tests = [
+    { expected: "Object",    test: () => new Object    },
+    { expected: "Array",     test: () => []            },
+    { expected: "Date",      test: () => new Date      },
+    { expected: "RegExp",    test: () => /problems/    },
+    { expected: "Int8Array", test: () => new Int8Array },
+    { expected: "Promise",   test: makeFakePromise     },
+  ];
+  `
+);
+
+
+for (let { expected, test } of root.tests) {
+  print(expected);
+
+  dbg.memory.trackingAllocationSites = true;
+  test();
+  let allocs = dbg.memory.drainAllocationsLog();
+  dbg.memory.trackingAllocationSites = false;
+
+  assertEq(allocs.some(a => a.class === expected), true);
+}
+

js/src/jit/none/Architecture-none.h

@@ -25,7 +25,7 @@ class Registers
         r0 = 0,
         invalid_reg
     };
-    typedef RegisterID Code;
+    typedef uint8_t Code;
     typedef RegisterID Encoding;
     union RegisterContent {
         uintptr_t r;
@@ -39,8 +39,8 @@ class Registers
     static const char* GetName(Code) { MOZ_CRASH(); }
     static Code FromName(const char*) { MOZ_CRASH(); }
 
-    static const Code StackPointer = invalid_reg;
-    static const Code Invalid = invalid_reg;
+    static const Encoding StackPointer = invalid_reg;
+    static const Encoding Invalid = invalid_reg;
     static const uint32_t Total = 1;
     static const uint32_t TotalPhys = 0;
     static const uint32_t Allocatable = 0;

js/src/jscompartment.cpp

@@ -713,7 +713,7 @@ JSCompartment::setNewObjectMetadata(JSContext* cx, JSObject* obj)
 {
     MOZ_ASSERT(this == cx->compartment());
 
-    if (JSObject* metadata = objectMetadataCallback(cx)) {
+    if (JSObject* metadata = objectMetadataCallback(cx, obj)) {
         if (!objectMetadataTable) {
             objectMetadataTable = cx->new_<ObjectWeakMap>(cx);
             if (!objectMetadataTable)

js/src/jsfriendapi.h

@@ -2622,7 +2622,7 @@ class JS_FRIEND_API(AutoCTypesActivityCallback) {
 };
 
 typedef JSObject*
-(* ObjectMetadataCallback)(JSContext* cx);
+(* ObjectMetadataCallback)(JSContext* cx, JSObject* obj);
 
 /*
  * Specify a callback to invoke when creating each JS object in the current

js/src/jsobjinlines.h

@@ -246,7 +246,8 @@ SetNewObjectMetadata(ExclusiveContext* cxArg, JSObject* obj)
             // callback, and any reentering of JS via Invoke() etc.
             AutoEnterAnalysis enter(cx);
 
-            cx->compartment()->setNewObjectMetadata(cx, obj);
+            RootedObject hobj(cx, obj);
+            cx->compartment()->setNewObjectMetadata(cx, hobj);
         }
     }
 }

js/src/vm/Debugger.cpp

@@ -1695,8 +1695,8 @@ Debugger::slowPathOnNewGlobalObject(JSContext* cx, Handle<GlobalObject*> global)
 }
 
 /* static */ bool
-Debugger::slowPathOnLogAllocationSite(JSContext* cx, HandleSavedFrame frame, int64_t when,
-                                      GlobalObject::DebuggerVector& dbgs)
+Debugger::slowPathOnLogAllocationSite(JSContext* cx, HandleObject obj, HandleSavedFrame frame,
+                                      int64_t when, GlobalObject::DebuggerVector& dbgs)
 {
     MOZ_ASSERT(!dbgs.empty());
     mozilla::DebugOnly<Debugger**> begin = dbgs.begin();
@@ -1708,7 +1708,7 @@ Debugger::slowPathOnLogAllocationSite(JSContext* cx, HandleSavedFrame frame, int
 
         if ((*dbgp)->trackingAllocationSites &&
             (*dbgp)->enabled &&
-            !(*dbgp)->appendAllocationSite(cx, frame, when))
+            !(*dbgp)->appendAllocationSite(cx, obj, frame, when))
         {
             return false;
         }
@@ -1725,14 +1725,15 @@ Debugger::isDebuggee(const JSCompartment* compartment) const
 }
 
 bool
-Debugger::appendAllocationSite(JSContext* cx, HandleSavedFrame frame, int64_t when)
+Debugger::appendAllocationSite(JSContext* cx, HandleObject obj, HandleSavedFrame frame,
+                               int64_t when)
 {
     AutoCompartment ac(cx, object);
-    RootedObject wrapped(cx, frame);
-    if (!cx->compartment()->wrap(cx, &wrapped))
+    RootedObject wrappedFrame(cx, frame);
+    if (!cx->compartment()->wrap(cx, &wrappedFrame))
         return false;
 
-    AllocationSite* allocSite = cx->new_<AllocationSite>(wrapped, when);
+    AllocationSite* allocSite = cx->new_<AllocationSite>(wrappedFrame, when, obj->getClass()->name);
     if (!allocSite)
         return false;
 

js/src/vm/Debugger.h

@@ -255,11 +255,17 @@ class Debugger : private mozilla::LinkedListElement<Debugger>
 
     struct AllocationSite : public mozilla::LinkedListElement<AllocationSite>
     {
-        AllocationSite(HandleObject frame, int64_t when) : frame(frame), when(when) {
+        AllocationSite(HandleObject frame, int64_t when, const char* className)
+            : frame(frame),
+              when(when),
+              className(className)
+        {
             MOZ_ASSERT_IF(frame, UncheckedUnwrap(frame)->is<SavedFrame>());
         };
+
         RelocatablePtrObject frame;
         int64_t when;
+        const char* className;
     };
     typedef mozilla::LinkedList<AllocationSite> AllocationSiteList;
 
@@ -305,7 +311,8 @@ class Debugger : private mozilla::LinkedListElement<Debugger>
 
     static const size_t DEFAULT_MAX_ALLOCATIONS_LOG_LENGTH = 5000;
 
-    bool appendAllocationSite(JSContext* cx, HandleSavedFrame frame, int64_t when);
+    bool appendAllocationSite(JSContext* cx, HandleObject obj, HandleSavedFrame frame,
+                              int64_t when);
     void emptyAllocationsLog();
 
     /*
@@ -515,7 +522,7 @@ class Debugger : private mozilla::LinkedListElement<Debugger>
     static JSTrapStatus slowPathOnExceptionUnwind(JSContext* cx, AbstractFramePtr frame);
     static void slowPathOnNewScript(JSContext* cx, HandleScript script);
     static void slowPathOnNewGlobalObject(JSContext* cx, Handle<GlobalObject*> global);
-    static bool slowPathOnLogAllocationSite(JSContext* cx, HandleSavedFrame frame,
+    static bool slowPathOnLogAllocationSite(JSContext* cx, HandleObject obj, HandleSavedFrame frame,
                                             int64_t when, GlobalObject::DebuggerVector& dbgs);
     static void slowPathPromiseHook(JSContext* cx, Hook hook, HandleObject promise);
     static JSTrapStatus dispatchHook(JSContext* cx, MutableHandleValue vp, Hook which,
@@ -666,7 +673,8 @@ class Debugger : private mozilla::LinkedListElement<Debugger>
 
     static inline void onNewScript(JSContext* cx, HandleScript script);
     static inline void onNewGlobalObject(JSContext* cx, Handle<GlobalObject*> global);
-    static inline bool onLogAllocationSite(JSContext* cx, HandleSavedFrame frame, int64_t when);
+    static inline bool onLogAllocationSite(JSContext* cx, JSObject* obj, HandleSavedFrame frame,
+                                           int64_t when);
     static inline void onGarbageCollection(JSRuntime* rt, const gcstats::Statistics& stats);
     static JSTrapStatus onTrap(JSContext* cx, MutableHandleValue vp);
     static JSTrapStatus onSingleStep(JSContext* cx, MutableHandleValue vp);
@@ -975,12 +983,13 @@ Debugger::onNewGlobalObject(JSContext* cx, Handle<GlobalObject*> global)
 }
 
 /* static */ bool
-Debugger::onLogAllocationSite(JSContext* cx, HandleSavedFrame frame, int64_t when)
+Debugger::onLogAllocationSite(JSContext* cx, JSObject* obj, HandleSavedFrame frame, int64_t when)
 {
     GlobalObject::DebuggerVector* dbgs = cx->global()->getDebuggers();
     if (!dbgs || dbgs->empty())
         return true;
-    return Debugger::slowPathOnLogAllocationSite(cx, frame, when, *dbgs);
+    RootedObject hobj(cx, obj);
+    return Debugger::slowPathOnLogAllocationSite(cx, hobj, frame, when, *dbgs);
 }
 
 /* static */ void

js/src/vm/DebuggerMemory.cpp

@@ -209,6 +209,13 @@ DebuggerMemory::drainAllocationsLog(JSContext* cx, unsigned argc, Value* vp)
         if (!DefineProperty(cx, obj, cx->names().timestamp, timestampValue))
             return false;
 
+        RootedString className(cx, Atomize(cx, allocSite->className, strlen(allocSite->className)));
+        if (!className)
+            return false;
+        RootedValue classNameValue(cx, StringValue(className));
+        if (!DefineProperty(cx, obj, cx->names().class_, classNameValue))
+            return false;
+
         result->setDenseElement(i, ObjectValue(*obj));
 
         // Pop the front queue entry, and delete it immediately, so that

js/src/vm/SavedStacks.cpp

@@ -1180,8 +1180,10 @@ SavedStacks::chooseSamplingProbability(JSContext* cx)
 }
 
 JSObject*
-SavedStacksMetadataCallback(JSContext* cx)
+SavedStacksMetadataCallback(JSContext* cx, JSObject* target)
 {
+    RootedObject obj(cx, target);
+
     SavedStacks& stacks = cx->compartment()->savedStacks();
     if (stacks.allocationSkipCount > 0) {
         stacks.allocationSkipCount--;
@@ -1221,7 +1223,7 @@ SavedStacksMetadataCallback(JSContext* cx)
     if (!stacks.saveCurrentStack(cx, &frame))
         CrashAtUnhandlableOOM("SavedStacksMetadataCallback");
 
-    if (!Debugger::onLogAllocationSite(cx, frame, PRMJ_Now()))
+    if (!Debugger::onLogAllocationSite(cx, obj, frame, PRMJ_Now()))
         CrashAtUnhandlableOOM("SavedStacksMetadataCallback");
 
     return frame;

js/src/vm/SavedStacks.h

@@ -260,7 +260,7 @@ struct SavedFrame::HashPolicy
 inline void AssertObjectIsSavedFrameOrWrapper(JSContext* cx, HandleObject stack);
 
 class SavedStacks {
-    friend JSObject* SavedStacksMetadataCallback(JSContext* cx);
+    friend JSObject* SavedStacksMetadataCallback(JSContext* cx, JSObject* target);
 
   public:
     SavedStacks()
@@ -400,7 +400,7 @@ class SavedStacks {
     bool getLocation(JSContext* cx, const FrameIter& iter, MutableHandleLocationValue locationp);
 };
 
-JSObject* SavedStacksMetadataCallback(JSContext* cx);
+JSObject* SavedStacksMetadataCallback(JSContext* cx, JSObject* target);
 
 } /* namespace js */
 

layout/forms/nsListControlFrame.cpp

@@ -1760,7 +1760,7 @@ nsListControlFrame::GetIndexFromDOMEvent(nsIDOMEvent* aMouseEvent,
   return NS_ERROR_FAILURE;
 }
 
-static void
+static bool
 FireShowDropDownEvent(nsIContent* aContent)
 {
   if (XRE_GetProcessType() == GeckoProcessType_Content &&
@@ -1768,7 +1768,10 @@ FireShowDropDownEvent(nsIContent* aContent)
     nsContentUtils::DispatchChromeEvent(aContent->OwnerDoc(), aContent,
                                         NS_LITERAL_STRING("mozshowdropdown"), true,
                                         false);
+    return true;
   }
+
+  return false;
 }
 
 nsresult
@@ -1818,7 +1821,9 @@ nsListControlFrame::MouseDown(nsIDOMEvent* aMouseEvent)
   } else {
     // NOTE: the combo box is responsible for dropping it down
     if (mComboboxFrame) {
-      FireShowDropDownEvent(mContent);
+      if (FireShowDropDownEvent(mContent)) {
+        return NS_OK;
+      }
 
       if (!IgnoreMouseEventForSelection(aMouseEvent)) {
         return NS_OK;
@@ -2059,8 +2064,9 @@ nsListControlFrame::DropDownToggleKey(nsIDOMEvent* aKeyEvent)
   if (IsInDropDownMode() && !nsComboboxControlFrame::ToolkitHasNativePopup()) {
     aKeyEvent->PreventDefault();
     if (!mComboboxFrame->IsDroppedDown()) {
-      FireShowDropDownEvent(mContent);
+      if (!FireShowDropDownEvent(mContent)) {
         mComboboxFrame->ShowDropDown(true);
+      }
     } else {
       nsWeakFrame weakFrame(this);
       // mEndSelectionIndex is the last item that got selected.

layout/generic/nsGfxScrollFrame.cpp

@@ -395,7 +395,7 @@ nsHTMLScrollFrame::TryLayout(ScrollReflowState* aState,
   aState->mShowVScrollbar = aAssumeVScroll;
   nsPoint scrollPortOrigin(aState->mComputedBorder.left,
                            aState->mComputedBorder.top);
-  if (!mHelper.IsScrollbarOnRight()) {
+  if (mHelper.GetScrollbarSide() == ScrollFrameHelper::eScrollbarOnLeft) {
     scrollPortOrigin.x += vScrollbarActualWidth;
   }
   mHelper.mScrollPort = nsRect(scrollPortOrigin, scrollPortSize);
@@ -1009,7 +1009,7 @@ ScrollFrameHelper::GetDesiredScrollbarSizes(nsBoxLayoutState* aState)
   if (mVScrollbarBox) {
     nsSize size = mVScrollbarBox->GetPrefSize(*aState);
     nsBox::AddMargin(mVScrollbarBox, size);
-    if (IsScrollbarOnRight())
+    if (GetScrollbarSide() == eScrollbarOnRight)
       result.left = size.width;
     else
       result.right = size.width;
@@ -3766,7 +3766,7 @@ ScrollFrameHelper::CreateAnonymousContent(
     nsAutoString dir;
     switch (resizeStyle) {
       case NS_STYLE_RESIZE_HORIZONTAL:
-        if (IsScrollbarOnRight()) {
+        if (GetScrollbarSide() == eScrollbarOnRight) {
           dir.AssignLiteral("right");
         }
         else {
@@ -4213,8 +4213,8 @@ ScrollFrameHelper::IsLTR() const
   return wm.IsVertical() ? wm.IsVerticalLR() : wm.IsBidiLTR();
 }
 
-bool
-ScrollFrameHelper::IsScrollbarOnRight() const
+ScrollFrameHelper::eScrollbarSide
+ScrollFrameHelper::GetScrollbarSide() const
 {
   nsPresContext *presContext = mOuter->PresContext();
 
@@ -4222,18 +4222,19 @@ ScrollFrameHelper::IsScrollbarOnRight() const
   // layout.scrollbar.side. For non-top-level elements, it depends only on the
   // directionaliy of the element (equivalent to a value of "1" for the pref).
   if (!mIsRoot)
-    return IsLTR();
+    return IsLTR() ? eScrollbarOnRight : eScrollbarOnLeft;
   switch (presContext->GetCachedIntPref(kPresContext_ScrollbarSide)) {
     default:
     case 0: // UI directionality
-      return presContext->GetCachedIntPref(kPresContext_BidiDirection)
-             == IBMBIDI_TEXTDIRECTION_LTR;
+      return (presContext->GetCachedIntPref(kPresContext_BidiDirection)
+              == IBMBIDI_TEXTDIRECTION_LTR)
+        ? eScrollbarOnRight : eScrollbarOnLeft;
     case 1: // Document / content directionality
-      return IsLTR();
+      return IsLTR() ? eScrollbarOnRight : eScrollbarOnLeft;
     case 2: // Always right
-      return true;
+      return eScrollbarOnRight;
     case 3: // Always left
-      return false;
+      return eScrollbarOnLeft;
   }
 }
 
@@ -4271,7 +4272,8 @@ ScrollFrameHelper::IsScrollingActive(nsDisplayListBuilder* aBuilder) const
 nsresult
 nsXULScrollFrame::Layout(nsBoxLayoutState& aState)
 {
-  bool scrollbarRight = mHelper.IsScrollbarOnRight();
+  bool scrollbarRight =
+    (mHelper.GetScrollbarSide() == ScrollFrameHelper::eScrollbarOnRight);
   bool scrollbarBottom = true;
 
   // get the content rect
@@ -4738,7 +4740,7 @@ ScrollFrameHelper::LayoutScrollbars(nsBoxLayoutState& aState,
                "This should have been suppressed");
 
   bool hasResizer = HasResizer();
-  bool scrollbarOnLeft = !IsScrollbarOnRight();
+  bool scrollbarOnLeft = (GetScrollbarSide() == eScrollbarOnLeft);
 
   // place the scrollcorner
   if (mScrollCornerBox || mResizerBox) {
@@ -4804,10 +4806,15 @@ ScrollFrameHelper::LayoutScrollbars(nsBoxLayoutState& aState,
     vRect.width = aContentArea.width - mScrollPort.width;
     vRect.x = scrollbarOnLeft ? aContentArea.x : mScrollPort.XMost();
     if (mHasVerticalScrollbar) {
+      nsScrollbarFrame* scrollbar = do_QueryFrame(mVScrollbarBox);
+      NS_ASSERTION(scrollbar, "Frame must be a scrollbar");
+
+      if (scrollbar) {
         nsMargin margin;
-      mVScrollbarBox->GetMargin(margin);
+        scrollbar->GetScrollbarMargin(margin, GetScrollbarSide());
         vRect.Deflate(margin);
       }
+    }
     AdjustScrollbarRectForResizer(mOuter, presContext, vRect, hasResizer, true);
   }
 

layout/generic/nsGfxScrollFrame.h

@@ -307,7 +307,8 @@ public:
   nsMargin GetDesiredScrollbarSizes(nsBoxLayoutState* aState);
   nscoord GetNondisappearingScrollbarWidth(nsBoxLayoutState* aState);
   bool IsLTR() const;
-  bool IsScrollbarOnRight() const;
+  enum eScrollbarSide { eScrollbarOnLeft, eScrollbarOnRight };
+  eScrollbarSide GetScrollbarSide() const;
   bool IsScrollingActive(nsDisplayListBuilder* aBuilder) const;
   bool IsMaybeScrollingActive() const;
   bool IsProcessingAsyncScroll() const {

layout/moz.build

@@ -19,6 +19,7 @@ DIRS += [
     'mathml',
     'inspector',
     'tools/recording',
+    'reftests',
 ]
 
 if CONFIG['NS_PRINTING']:
@@ -33,11 +34,4 @@ DIRS += ['build', 'media']
 if CONFIG['MOZ_DEBUG']:
     TEST_DIRS += ['tools/layout-debug']
 
-MOCHITEST_MANIFESTS += [
-    'reftests/fonts/math/mochitest.ini',
-    'reftests/fonts/mochitest.ini',
-    'reftests/fonts/mplus/mochitest.ini'
-]
-
-REFTEST_MANIFESTS += ['reftests/reftest.list']
 CRASHTEST_MANIFESTS += ['../testing/crashtest/crashtests.list']

layout/reftests/moz.build

@@ -0,0 +1,274 @@
+# -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+MOCHITEST_MANIFESTS += [
+    'fonts/math/mochitest.ini',
+    'fonts/mochitest.ini',
+    'fonts/mplus/mochitest.ini'
+]
+
+REFTEST_MANIFESTS += ['reftest.list']
+
+with Files('abs-pos/**'):
+    BUG_COMPONENT = ('Core', 'Layout: R & A Pos')
+with Files('async-scrolling/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('backgrounds/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('bidi/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+with Files('border-image/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('border-radius/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('box/**'):
+    BUG_COMPONENT = ('Core', 'XP Toolkit/Widgets: XUL')
+with Files('box-ordinal/**'):
+    BUG_COMPONENT = ('Core', 'XP Toolkit/Widgets: XUL')
+with Files('box-properties/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('box-shadow/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('box-sizing/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('bugs/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('canvas/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Images')
+with Files('columns/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('counter-style/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('counters/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('css-animations/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('css-blending/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('css-break/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('css-calc/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('css-charset/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('css-default/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Form Controls')
+with Files('css-disabled/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Form Controls')
+with Files('css-display/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('css-enabled/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Form Controls')
+with Files('css-gradients/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('css-grid/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('css-import/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('css-invalid/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Form Controls')
+with Files('css-mediaqueries/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('css-optional/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Form Controls')
+with Files('css-parsing/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('css-placeholder/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Form Controls')
+with Files('css-required/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Form Controls')
+with Files('css-ruby/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('css-selectors/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('css-submit-invalid/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Form Controls')
+with Files('css-transitions/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('css-ui-invalid/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Form Controls')
+with Files('css-ui-valid/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Form Controls')
+with Files('css-valid/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Form Controls')
+with Files('css-valuesandunits/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('css-variables/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('css-visited/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('cssom/**'):
+    BUG_COMPONENT = ('Core', 'DOM: CSS Object Model')
+with Files('datalist/**'):
+    BUG_COMPONENT = ('Core', 'DOM: Core & HTML')
+with Files('dom/**'):
+    BUG_COMPONENT = ('Core', 'DOM: Core & HTML')
+with Files('filters.svg'):
+    BUG_COMPONENT = ('Core', 'SVG')
+with Files('first-letter/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('first-line/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('flexbox/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('floats/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Floats')
+with Files('font-face/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('font-features/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+with Files('font-inflation/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+with Files('font-loading-api/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('font-matching/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+with Files('fonts/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+with Files('forms/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Form Controls')
+with Files('generated-content/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('ib-split/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('image/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Images')
+with Files('image-element/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Images')
+with Files('image-rect/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('image-region/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Images')
+with Files('indic-shaping/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+with Files('inline/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('inline-borderpadding/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('invalidation/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('layers/**'):
+    BUG_COMPONENT = ('Core', 'Graphics: Layers')
+with Files('line-breaking/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('list-item/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('margin-collapsing/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('marquee/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('mathml/**'):
+    BUG_COMPONENT = ('Core', 'MathML')
+with Files('native-theme/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('object/**'):
+    BUG_COMPONENT = ('Core', 'DOM')
+with Files('ogg-video/**'):
+    BUG_COMPONENT = ('Core', 'Video/Audio')
+with Files('outline/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('pagination/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('percent-overflow-sizing/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('pixel-rounding/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('position-dynamic-changes/**'):
+    BUG_COMPONENT = ('Core', 'Layout: R & A Pos')
+with Files('position-relative/**'):
+    BUG_COMPONENT = ('Core', 'Layout: R & A Pos')
+with Files('position-sticky/**'):
+    BUG_COMPONENT = ('Core', 'Layout: R & A Pos')
+with Files('printing/**'):
+    BUG_COMPONENT = ('Core', 'Printing: Output')
+with Files('reftest-sanity/**'):
+    BUG_COMPONENT = ('Testing', 'Reftest')
+with Files('scoped-style/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('scrolling/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('selection/**'):
+    BUG_COMPONENT = ('Core', 'Selection')
+with Files('svg/**'):
+    BUG_COMPONENT = ('Core', 'SVG')
+with Files('tab-size/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+with Files('table-anonymous-boxes/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Tables')
+with Files('table-background/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Tables')
+with Files('table-bordercollapse/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Tables')
+with Files('table-dom/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Tables')
+with Files('table-overflow/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Tables')
+with Files('table-width/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Tables')
+with Files('text/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+with Files('text-decoration/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('text-indent/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('text-overflow/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+with Files('text-shadow/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+with Files('text-svgglyphs/**'):
+    BUG_COMPONENT = ('Core', 'SVG')
+with Files('text-transform/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+with Files('transform/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('transform-3d/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('unicode/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('view-source/**'):
+    BUG_COMPONENT = ('Core', 'HTML: Parser')
+with Files('w3c-css/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('w3c-css/received/css3-conditional/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('w3c-css/received/css3-namespace/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('w3c-css/submitted/conditional3/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('w3c-css/submitted/css21/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('w3c-css/submitted/flexbox/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('w3c-css/submitted/fonts3/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+with Files('w3c-css/submitted/images3/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('w3c-css/submitted/lists-3/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('w3c-css/submitted/multicol3/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('w3c-css/submitted/ruby/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('w3c-css/submitted/text-decor-3/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('w3c-css/submitted/ui3/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('w3c-css/submitted/values3/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('w3c-css/submitted/variables/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('webcomponents/**'):
+    BUG_COMPONENT = ('Core', 'DOM')
+with Files('webm-video/**'):
+    BUG_COMPONENT = ('Core', 'Video/Audio')
+with Files('writing-mode/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('xul/**'):
+    BUG_COMPONENT = ('Core', 'XP Toolkit/Widgets: XUL')
+with Files('xul-document-load/**'):
+    BUG_COMPONENT = ('Core', 'XP Toolkit/Widgets: XUL')
+with Files('z-index/**'):
+    BUG_COMPONENT = ('Core', 'Layout')

layout/reftests/table-overflow/reftest.list

@@ -1,5 +1,5 @@
 == bug785684-x.html bug785684-ref.html
 == bug785684-y.html bug785684-ref.html
-== table-row-pagination.html table-row-pagination-ref.html
+skip-if(B2G||Mulet) == table-row-pagination.html table-row-pagination-ref.html # Frequently failing on b2g (bug 1155426)
 == 963441.html 963441-ref.html
 == table-caption-scroll.html table-caption-scroll-ref.html

layout/reftests/w3c-css/submitted/fonts3/font-size-adjust-zero-1.html

@@ -0,0 +1,19 @@
+<!DOCTYPE HTML>
+<title>CSS Test: font-size-adjust: 0</title>
+<link rel="author" title="L. David Baron" href="http://dbaron.org/">
+<link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-size-adjust-prop">
+<link rel="help" href="http://www.w3.org/TR/CSS21/box.html#collapsing-margins">
+<link rel="match" href="font-size-zero-2-ref.html">
+<meta name="flags" content="">
+<style>
+/* spec ambiguous whether font-size-adjust influences line-height: normal */
+body { line-height: 1.2 }
+
+p { margin: 1em 0 }
+p.zero { font-size-adjust: 0 }
+</style>
+
+<p>before</p>
+<p class="zero">zero</p>
+<p>after</p>

layout/reftests/w3c-css/submitted/fonts3/font-size-adjust-zero-2.html

@@ -0,0 +1,20 @@
+<!DOCTYPE HTML>
+<title>CSS Test: font-size-adjust: 0</title>
+<link rel="author" title="L. David Baron" href="http://dbaron.org/">
+<link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-size-adjust-prop">
+<link rel="help" href="http://www.w3.org/TR/CSS21/box.html#collapsing-margins">
+<link rel="match" href="font-size-zero-2-ref.html">
+<meta name="flags" content="">
+<style>
+/* spec ambiguous whether font-size-adjust influences line-height: normal */
+body { line-height: 1.2 }
+span { line-height: 0 }
+
+p { margin: 1em 0 }
+span.zero { font-size-adjust: 0 }
+</style>
+
+<p>before</p>
+<p><span class="zero">zero</span></p>
+<p>after</p>

layout/reftests/w3c-css/submitted/fonts3/font-size-zero-1-notref.html

@@ -0,0 +1,13 @@
+<!DOCTYPE HTML>
+<title>CSS Test Reference</title>
+<link rel="author" title="L. David Baron" href="http://dbaron.org/">
+<link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+<meta name="flags" content="">
+<style>
+/* spec ambiguous whether font-size-adjust influences line-height: normal */
+body { line-height: 1.2 }
+</style>
+
+<p>before</p>
+<p>zero</p>
+<p>after</p>

layout/reftests/w3c-css/submitted/fonts3/font-size-zero-1-ref.html

@@ -0,0 +1,16 @@
+<!DOCTYPE HTML>
+<title>CSS Test Reference</title>
+<link rel="author" title="L. David Baron" href="http://dbaron.org/">
+<link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+<link rel="mismatch" href="font-size-zero-1-notref.html">
+<meta name="flags" content="">
+<style>
+/* spec ambiguous whether font-size-adjust influences line-height: normal */
+body { line-height: 1.2 }
+
+p { margin: 1em 0 }
+p.first { margin-bottom: 2em }
+</style>
+
+<p class="first">before</p>
+<p>after</p>

layout/reftests/w3c-css/submitted/fonts3/font-size-zero-1.html

@@ -0,0 +1,19 @@
+<!DOCTYPE HTML>
+<title>CSS Test: font-size: 0</title>
+<link rel="author" title="L. David Baron" href="http://dbaron.org/">
+<link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-size-prop">
+<link rel="help" href="http://www.w3.org/TR/CSS21/box.html#collapsing-margins">
+<link rel="match" href="font-size-zero-1-ref.html">
+<meta name="flags" content="">
+<style>
+/* spec ambiguous whether font-size-adjust influences line-height: normal */
+body { line-height: 1.2 }
+
+p { margin: 1em 0 }
+p.zero { font-size: 0 }
+</style>
+
+<p>before</p>
+<p class="zero">zero</p>
+<p>after</p>

layout/reftests/w3c-css/submitted/fonts3/font-size-zero-2-ref.html

@@ -0,0 +1,15 @@
+<!DOCTYPE HTML>
+<title>CSS Test Reference</title>
+<link rel="author" title="L. David Baron" href="http://dbaron.org/">
+<link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-size-prop">
+<link rel="help" href="http://www.w3.org/TR/CSS21/box.html#collapsing-margins">
+<meta name="flags" content="">
+<style>
+/* spec ambiguous whether font-size-adjust influences line-height: normal */
+body { line-height: 1.2 }
+</style>
+
+<p>before</p>
+<p>&nbsp;</p>
+<p>after</p>

layout/reftests/w3c-css/submitted/fonts3/font-size-zero-2.html

@@ -0,0 +1,19 @@
+<!DOCTYPE HTML>
+<title>CSS Test: font-size: 0</title>
+<link rel="author" title="L. David Baron" href="http://dbaron.org/">
+<link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-size-prop">
+<link rel="help" href="http://www.w3.org/TR/CSS21/box.html#collapsing-margins">
+<link rel="match" href="font-size-zero-2-ref.html">
+<meta name="flags" content="">
+<style>
+/* spec ambiguous whether font-size-adjust influences line-height: normal */
+body { line-height: 1.2 }
+
+p { margin: 1em 0 }
+span.zero { font-size: 0 }
+</style>
+
+<p>before</p>
+<p><span class="zero">zero</span></p>
+<p>after</p>

layout/reftests/w3c-css/submitted/fonts3/reftest.list

@@ -0,0 +1,5 @@
+== font-size-zero-1.html font-size-zero-1-ref.html
+!= font-size-zero-1-ref.html font-size-zero-1-notref.html
+== font-size-zero-2.html font-size-zero-2-ref.html
+== font-size-adjust-zero-1.html font-size-zero-2-ref.html
+== font-size-adjust-zero-2.html font-size-zero-2-ref.html

layout/reftests/w3c-css/submitted/reftest.list

@@ -23,7 +23,7 @@ include conditional3/reftest.list
 include flexbox/reftest.list
 
 # Fonts Level 3
-# include fonts3/reftest.list
+include fonts3/reftest.list
 
 # Image Values and Replaced Content Level 3
 include images3/reftest.list

layout/style/StyleAnimationValue.cpp

@@ -3440,8 +3440,8 @@ StyleAnimationValue::ExtractComputedValue(nsCSSProperty aProperty,
       aComputedValue.SetFloatValue(*static_cast<const float*>(
         StyleDataAtOffset(styleStruct, ssOffset)));
       if (aProperty == eCSSProperty_font_size_adjust &&
-          aComputedValue.GetFloatValue() == 0.0f) {
-        // In nsStyleFont, we set mFont.sizeAdjust to 0 to represent
+          aComputedValue.GetFloatValue() == -1.0f) {
+        // In nsStyleFont, we set mFont.sizeAdjust to -1.0 to represent
         // font-size-adjust: none.  Here, we have to treat this as a keyword
         // instead of a float value, to make sure we don't end up doing
         // interpolation with it.