From 66a3f4b7a1b01f1ffa5d819d7ea3f55adec0dee1 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Wed, 20 Sep 2017 11:47:58 -0700
Subject: [PATCH 01/29] Bug 1401319 - Implement xulRuntime.is64Bit for manifest
 tests, r=jonco

--HG--
extra : rebase_source : cb6a7a12821a5b26ff09aad79b8c628a29f6721e
extra : source : 6998422519778a38cfde7e901d05919fde0b023b
---
 js/src/tests/js1_5/Array/regress-157652.js   |  2 +-
 js/src/tests/js1_5/Regress/regress-422348.js |  2 +-
 js/src/tests/lib/manifest.py                 | 12 ++++++++----
 3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/js/src/tests/js1_5/Array/regress-157652.js b/js/src/tests/js1_5/Array/regress-157652.js
index 6916fe1790d4..00dca0b9443d 100644
--- a/js/src/tests/js1_5/Array/regress-157652.js
+++ b/js/src/tests/js1_5/Array/regress-157652.js
@@ -1,4 +1,4 @@
-// |reftest| skip-if(xulRuntime.XPCOMABI.match(/x86_64|aarch64|ppc64|ppc64le|s390x/)||Android) -- No test results
+// |reftest| skip-if(xulRuntime.is64Bit||Android) -- No test results
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
diff --git a/js/src/tests/js1_5/Regress/regress-422348.js b/js/src/tests/js1_5/Regress/regress-422348.js
index 7ae83f4a6c8e..c1839b5e1adf 100644
--- a/js/src/tests/js1_5/Regress/regress-422348.js
+++ b/js/src/tests/js1_5/Regress/regress-422348.js
@@ -1,4 +1,4 @@
-// |reftest| skip-if(xulRuntime.XPCOMABI.match(/x86_64|aarch64|ppc64|ppc64le|s390x/)) -- On 64-bit, takes forever rather than throwing
+// |reftest| skip-if(xulRuntime.is64Bit) -- On 64-bit, takes forever rather than throwing
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
diff --git a/js/src/tests/lib/manifest.py b/js/src/tests/lib/manifest.py
index 4828736342c3..ced06e096cc1 100644
--- a/js/src/tests/lib/manifest.py
+++ b/js/src/tests/lib/manifest.py
@@ -21,9 +21,10 @@ def split_path_into_dirs(path):
     return dirs
 
 class XULInfo:
-    def __init__(self, abi, os, isdebug):
+    def __init__(self, abi, os, is64Bit, isdebug):
         self.abi = abi
         self.os = os
+        self.is64Bit = is64Bit
         self.isdebug = isdebug
         self.browserIsRemote = False
 
@@ -31,11 +32,12 @@ class XULInfo:
         """Return JS that when executed sets up variables so that JS expression
         predicates on XUL build info evaluate properly."""
 
-        return ('var xulRuntime = {{ OS: "{}", XPCOMABI: "{}", shell: true }};'
+        return ('var xulRuntime = {{ OS: "{}", is64Bit: {}, XPCOMABI: "{}", shell: true }};'
                 'var release_or_beta = getBuildConfiguration().release_or_beta;'
                 'var isDebugBuild={}; var Android={}; '
                 'var browserIsRemote={}'.format(
                     self.os,
+                    "true" if self.is64Bit else "false",
                     self.abi,
                     str(self.isdebug).lower(),
                     str(self.os == "Android").lower(),
@@ -64,8 +66,8 @@ class XULInfo:
             sys.exit(1)
 
         # Read the values.
-        val_re = re.compile(r'(TARGET_XPCOM_ABI|OS_TARGET|MOZ_DEBUG)\s*=\s*(.*)')
-        kw = {'isdebug': False}
+        val_re = re.compile(r'(TARGET_XPCOM_ABI|OS_TARGET|MOZ_DEBUG|HAVE_64BIT_BUILD)\s*=\s*(.*)')
+        kw = {'isdebug': False, 'is64Bit': False}
         for line in open(path):
             m = val_re.match(line)
             if m:
@@ -75,6 +77,8 @@ class XULInfo:
                     kw['abi'] = val
                 if key == 'OS_TARGET':
                     kw['os'] = val
+                if key == 'HAVE_64BIT_BUILD':
+                    kw['is64Bit'] = (val == '1')
                 if key == 'MOZ_DEBUG':
                     kw['isdebug'] = (val == '1')
         return cls(**kw)

From 811aaaffad059e3db18a6ca4276149e1fda5d0c4 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Thu, 21 Sep 2017 09:59:02 -0700
Subject: [PATCH 02/29] Bug 1402504 - Switch to using in-source annotations
 more directly, r=jonco

--HG--
extra : rebase_source : 477173b9c98df724b4a922de5ae7e3bda38cf76e
---
 js/src/devtools/rootAnalysis/CFG.js           | 12 ++-
 js/src/devtools/rootAnalysis/analyzeRoots.js  | 10 +-
 js/src/devtools/rootAnalysis/annotations.js   | 64 ++++++------
 .../devtools/rootAnalysis/computeCallgraph.js |  4 +-
 .../devtools/rootAnalysis/computeGCTypes.js   | 97 +++++++++++--------
 js/src/devtools/rootAnalysis/dumpCFG.js       |  5 +-
 js/src/devtools/rootAnalysis/utility.js       |  8 +-
 7 files changed, 118 insertions(+), 82 deletions(-)

diff --git a/js/src/devtools/rootAnalysis/CFG.js b/js/src/devtools/rootAnalysis/CFG.js
index 6e9facaa1201..97781e1b61a0 100644
--- a/js/src/devtools/rootAnalysis/CFG.js
+++ b/js/src/devtools/rootAnalysis/CFG.js
@@ -40,6 +40,14 @@ function isMatchingDestructor(constructor, edge)
     if (variable.Name[1].charAt(0) != '~')
         return false;
 
+    // Note that in some situations, a regular function can begin with '~', so
+    // we don't necessarily have a destructor in hand. This is probably a
+    // sixgill artifact, but in js::wasm::ModuleGenerator::~ModuleGenerator, a
+    // templatized static inline EraseIf is invoked, and it gets named ~EraseIf
+    // for some reason.
+    if (!("PEdgeCallInstance" in edge))
+        return false;
+
     var constructExp = constructor.PEdgeCallInstance.Exp;
     assert(constructExp.Kind == "Var");
 
@@ -55,7 +63,7 @@ function isMatchingDestructor(constructor, edge)
 // treat each instance separately, such as when different regions of a function
 // body were guarded by these constructors and you needed to do something
 // different with each.)
-function allRAIIGuardedCallPoints(bodies, body, isConstructor)
+function allRAIIGuardedCallPoints(typeInfo, bodies, body, isConstructor)
 {
     if (!("PEdge" in body))
         return [];
@@ -70,7 +78,7 @@ function allRAIIGuardedCallPoints(bodies, body, isConstructor)
             continue;
         var variable = callee.Variable;
         assert(variable.Kind == "Func");
-        if (!isConstructor(edge.Type, variable.Name))
+        if (!isConstructor(typeInfo, edge.Type, variable.Name))
             continue;
         if (!("PEdgeCallInstance" in edge))
             continue;
diff --git a/js/src/devtools/rootAnalysis/analyzeRoots.js b/js/src/devtools/rootAnalysis/analyzeRoots.js
index 61b46e387a77..0f1913284941 100644
--- a/js/src/devtools/rootAnalysis/analyzeRoots.js
+++ b/js/src/devtools/rootAnalysis/analyzeRoots.js
@@ -5,6 +5,7 @@
 loadRelativeToScript('utility.js');
 loadRelativeToScript('annotations.js');
 loadRelativeToScript('CFG.js');
+loadRelativeToScript('dumpCFG.js');
 
 var sourceRoot = (os.getenv('SOURCE') || '') + '/'
 
@@ -29,8 +30,6 @@ var batch = (scriptArgs[5]|0) || 1;
 var numBatches = (scriptArgs[6]|0) || 1;
 var tmpfile = scriptArgs[7] || "tmp.txt";
 
-GCSuppressionTypes = loadTypeInfo(typeInfoFile)["Suppress GC"] || [];
-
 var gcFunctions = {};
 var text = snarf("gcFunctions.lst").split("\n");
 assert(text.pop().length == 0);
@@ -45,6 +44,8 @@ for (var line of text) {
 }
 text = null;
 
+var typeInfo = loadTypeInfo(typeInfoFile);
+
 var gcEdges = {};
 text = snarf(gcEdgesFile).split('\n');
 assert(text.pop().length == 0);
@@ -749,7 +750,8 @@ function printEntryTrace(functionName, entry)
 
 function isRootedType(type)
 {
-    return type.Kind == "CSU" && isRootedTypeName(type.Name);
+    return type.Kind == "CSU" && ((type.Name in typeInfo.RootedPointers) ||
+                                  (type.Name in typeInfo.RootedGCThings));
 }
 
 function typeDesc(type)
@@ -841,7 +843,7 @@ function process(name, json) {
     for (var body of functionBodies)
         body.suppressed = [];
     for (var body of functionBodies) {
-        for (var [pbody, id] of allRAIIGuardedCallPoints(functionBodies, body, isSuppressConstructor))
+        for (var [pbody, id] of allRAIIGuardedCallPoints(typeInfo, functionBodies, body, isSuppressConstructor))
             pbody.suppressed[id] = true;
     }
     processBodies(functionName);
diff --git a/js/src/devtools/rootAnalysis/annotations.js b/js/src/devtools/rootAnalysis/annotations.js
index 6c717992866c..042b58194b51 100644
--- a/js/src/devtools/rootAnalysis/annotations.js
+++ b/js/src/devtools/rootAnalysis/annotations.js
@@ -2,10 +2,6 @@
 
 "use strict";
 
-// RAII types within which we should assume GC is suppressed, eg
-// AutoSuppressGC.
-var GCSuppressionTypes = [];
-
 // Ignore calls made through these function pointers
 var ignoreIndirectCalls = {
     "mallocSizeOf" : true,
@@ -43,11 +39,20 @@ function indirectCallCannotGC(fullCaller, fullVariable)
         return true;
 
     // template method called during marking and hence cannot GC
-    if (name == "op" && caller.indexOf("bool js::WeakMap<Key, Value, HashPolicy>::keyNeedsMark(JSObject*)") != -1)
+    if (name == "op" && caller.includes("bool js::WeakMap<Key, Value, HashPolicy>::keyNeedsMark(JSObject*)"))
     {
         return true;
     }
 
+    // Call through a 'callback' function pointer, in a place where we're going
+    // to be throwing a JS exception.
+    if (name == "callback" && caller.includes("js::ErrorToException"))
+        return true;
+
+    // The math cache only gets called with non-GC math functions.
+    if (name == "f" && caller.includes("js::MathCache::lookup"))
+        return true;
+
     return false;
 }
 
@@ -218,6 +223,8 @@ var ignoreFunctions = {
     "uint32 js::TenuringTracer::moveObjectToTenured(JSObject*, JSObject*, int32)" : true,
     "void js::Nursery::freeMallocedBuffers()" : true,
 
+    "void js::AutoEnterOOMUnsafeRegion::crash(uint64, int8*)" : true,
+
     // It would be cool to somehow annotate that nsTHashtable<T> will use
     // nsTHashtable<T>::s_MatchEntry for its matchEntry function pointer, but
     // there is no mechanism for that. So we will just annotate a particularly
@@ -287,11 +294,11 @@ function ignoreGCFunction(mangled)
         return true;
 
     // Templatized function
-    if (fun.indexOf("void nsCOMPtr<T>::Assert_NoQueryNeeded()") >= 0)
+    if (fun.includes("void nsCOMPtr<T>::Assert_NoQueryNeeded()"))
         return true;
 
     // These call through an 'op' function pointer.
-    if (fun.indexOf("js::WeakMap<Key, Value, HashPolicy>::getDelegate(") >= 0)
+    if (fun.includes("js::WeakMap<Key, Value, HashPolicy>::getDelegate("))
         return true;
 
     // XXX modify refillFreeList<NoGC> to not need data flow analysis to understand it cannot GC.
@@ -307,9 +314,27 @@ function stripUCSAndNamespace(name)
     return name;
 }
 
-function isRootedGCTypeName(name)
+function extraRootedGCThings()
 {
-    return (name == "JSAddonId");
+    return [ 'JSAddonId' ];
+}
+
+function extraRootedPointers()
+{
+    return [
+        'ModuleValidator',
+        'JSErrorResult',
+        'WrappableJSErrorResult',
+
+        // These are not actually rooted, but are only used in the context of
+        // AutoKeepAtoms.
+        'js::frontend::TokenStream',
+        'js::frontend::TokenStream::Position',
+
+        'mozilla::ErrorResult',
+        'mozilla::IgnoredErrorResult',
+        'mozilla::dom::binding_detail::FastErrorResult',
+    ];
 }
 
 function isRootedGCPointerTypeName(name)
@@ -319,33 +344,16 @@ function isRootedGCPointerTypeName(name)
     if (name.startsWith('MaybeRooted<'))
         return /\(js::AllowGC\)1u>::RootType/.test(name);
 
-    if (name == "ErrorResult" ||
-        name == "JSErrorResult" ||
-        name == "WrappableJSErrorResult" ||
-        name == "binding_detail::FastErrorResult" ||
-        name == "IgnoredErrorResult" ||
-        name == "frontend::TokenStream" ||
-        name == "frontend::TokenStream::Position" ||
-        name == "ModuleValidator")
-    {
-        return true;
-    }
-
     return name.startsWith('Rooted') || name.startsWith('PersistentRooted');
 }
 
-function isRootedTypeName(name)
-{
-    return isRootedGCTypeName(name) || isRootedGCPointerTypeName(name);
-}
-
 function isUnsafeStorage(typeName)
 {
     typeName = stripUCSAndNamespace(typeName);
     return typeName.startsWith('UniquePtr<');
 }
 
-function isSuppressConstructor(edgeType, varName)
+function isSuppressConstructor(typeInfo, edgeType, varName)
 {
     // Check whether this could be a constructor
     if (edgeType.Kind != 'Function')
@@ -357,7 +365,7 @@ function isSuppressConstructor(edgeType, varName)
 
     // Check whether the type is a known suppression type.
     var type = edgeType.TypeFunctionCSU.Type.Name;
-    if (GCSuppressionTypes.indexOf(type) == -1)
+    if (!(type in typeInfo.GCSuppressors))
         return false;
 
     // And now make sure this is the constructor, not some other method on a
diff --git a/js/src/devtools/rootAnalysis/computeCallgraph.js b/js/src/devtools/rootAnalysis/computeCallgraph.js
index 9e3e931106a8..8d27601de45d 100644
--- a/js/src/devtools/rootAnalysis/computeCallgraph.js
+++ b/js/src/devtools/rootAnalysis/computeCallgraph.js
@@ -128,7 +128,7 @@ function processBody(functionName, body)
     }
 }
 
-GCSuppressionTypes = loadTypeInfo(typeInfo_filename)["Suppress GC"] || [];
+var typeInfo = loadTypeInfo(typeInfo_filename);
 
 loadTypes("src_comp.xdb");
 
@@ -155,7 +155,7 @@ function process(functionName, functionBodies)
         body.suppressed = [];
 
     for (var body of functionBodies) {
-        for (var [pbody, id] of allRAIIGuardedCallPoints(functionBodies, body, isSuppressConstructor))
+        for (var [pbody, id] of allRAIIGuardedCallPoints(typeInfo, functionBodies, body, isSuppressConstructor))
             pbody.suppressed[id] = true;
     }
 
diff --git a/js/src/devtools/rootAnalysis/computeGCTypes.js b/js/src/devtools/rootAnalysis/computeGCTypes.js
index af4d703896e1..337adfabfed9 100644
--- a/js/src/devtools/rootAnalysis/computeGCTypes.js
+++ b/js/src/devtools/rootAnalysis/computeGCTypes.js
@@ -8,12 +8,16 @@ loadRelativeToScript('annotations.js');
 var gcTypes_filename = scriptArgs[0] || "gcTypes.txt";
 var typeInfo_filename = scriptArgs[1] || "typeInfo.txt";
 
-var annotations = {
+var typeInfo = {
     'GCPointers': [],
     'GCThings': [],
     'NonGCTypes': {}, // unused
     'NonGCPointers': {},
+    'RootedGCThings': {},
     'RootedPointers': {},
+
+    // RAII types within which we should assume GC is suppressed, eg
+    // AutoSuppressGC.
     'GCSuppressors': {},
 };
 
@@ -22,6 +26,7 @@ var gDescriptors = new Map; // Map from descriptor string => Set of typeName
 var structureParents = {}; // Map from field => list of <parent, fieldName>
 var pointerParents = {}; // Map from field => list of <parent, fieldName>
 var baseClasses = {}; // Map from struct name => list of base class name strings
+var subClasses = {}; // Map from struct name => list of subclass  name strings
 
 var gcTypes = {}; // map from parent struct => Set of GC typed children
 var gcPointers = {}; // map from parent struct => Set of GC typed children
@@ -61,17 +66,17 @@ function processCSU(csu, body)
             continue;
 
         if (tag == 'GC Pointer')
-            annotations.GCPointers.push(csu);
+            typeInfo.GCPointers.push(csu);
         else if (tag == 'Invalidated by GC')
-            annotations.GCPointers.push(csu);
+            typeInfo.GCPointers.push(csu);
         else if (tag == 'GC Thing')
-            annotations.GCThings.push(csu);
+            typeInfo.GCThings.push(csu);
         else if (tag == 'Suppressed GC Pointer')
-            annotations.NonGCPointers[csu] = true;
+            typeInfo.NonGCPointers[csu] = true;
         else if (tag == 'Rooted Pointer')
-            annotations.RootedPointers[csu] = true;
+            typeInfo.RootedPointers[csu] = true;
         else if (tag == 'Suppress GC')
-            annotations.GCSuppressors[csu] = true;
+            typeInfo.GCSuppressors[csu] = true;
     }
 }
 
@@ -91,6 +96,9 @@ function addBaseClass(csu, base) {
     if (!(csu in baseClasses))
         baseClasses[csu] = [];
     baseClasses[csu].push(base);
+    if (!(base in subClasses))
+        subClasses[base] = [];
+    subClasses[base].push(csu);
     var k = baseClasses[csu].length;
     addNestedStructure(csu, base, `<base-${k}>`);
 }
@@ -119,22 +127,24 @@ for (var csuIndex = minStream; csuIndex <= maxStream; csuIndex++) {
     xdb.free_string(data);
 }
 
+for (const typename of extraRootedGCThings())
+    typeInfo.RootedGCThings[typename] = true;
+
+for (const typename of extraRootedPointers())
+    typeInfo.RootedPointers[typename] = true;
+
 // Now that we have the whole hierarchy set up, add all the types and propagate
 // info.
-for (let csu of annotations.GCThings)
+for (const csu of typeInfo.GCThings)
     addGCType(csu);
-for (let csu of annotations.GCPointers)
+for (const csu of typeInfo.GCPointers)
     addGCPointer(csu);
 
-function stars(n) { return n ? '*' + stars(n-1) : '' };
-
 // "typeName is a (pointer to a)^'typePtrLevel' GC type because it contains a field
 // named 'child' of type 'why' (or pointer to 'why' if fieldPtrLevel == 1), which is
 // itself a GCThing or GCPointer."
 function markGCType(typeName, child, why, typePtrLevel, fieldPtrLevel, indent)
 {
-    //printErr(`${indent}${typeName}${stars(typePtrLevel)} may be a gctype/ptr because of its child '${child}' of type ${why}${stars(fieldPtrLevel)}`);
-
     // Some types, like UniquePtr, do not mark/trace/relocate their contained
     // pointers and so should not hold them live across a GC. UniquePtr in
     // particular should be the only thing pointing to a structure containing a
@@ -166,19 +176,22 @@ function markGCType(typeName, child, why, typePtrLevel, fieldPtrLevel, indent)
     if (ptrLevel > 2)
         return;
 
-    if (ptrLevel == 0 && isRootedGCTypeName(typeName))
+    if (isRootedGCPointerTypeName(typeName) && !(typeName in typeInfo.RootedPointers))
+        printErr("FIXME: use in-source annotation for " + typeName);
+
+    if (ptrLevel == 0 && (typeName in typeInfo.RootedGCThings))
         return;
-    if (ptrLevel == 1 && isRootedGCPointerTypeName(typeName))
+    if (ptrLevel == 1 && (isRootedGCPointerTypeName(typeName) || (typeName in typeInfo.RootedPointers)))
         return;
 
     if (ptrLevel == 0) {
-        if (typeName in annotations.NonGCTypes)
+        if (typeName in typeInfo.NonGCTypes)
             return;
         if (!(typeName in gcTypes))
             gcTypes[typeName] = new Set();
         gcTypes[typeName].add(why);
     } else if (ptrLevel == 1) {
-        if (typeName in annotations.NonGCPointers)
+        if (typeName in typeInfo.NonGCPointers)
             return;
         if (!(typeName in gcPointers))
             gcPointers[typeName] = new Set();
@@ -215,28 +228,34 @@ function addGCPointer(typeName)
     markGCType(typeName, '<pointer-annotation>', '(annotation)', 1, 0, "");
 }
 
-// Add an arbitrary descriptor to a type, and apply it recursively to all base
-// structs and structs that contain the given typeName as a field.
-function addDescriptor(typeName, descriptor)
+// Call a function for a type and every type that contains the type in a field
+// or as a base class (which internally is pretty much the same thing --
+// sublcasses are structs beginning with the base class and adding on their
+// local fields.)
+function foreachContainingStruct(typeName, func, seen = new Set())
 {
-    if (!gDescriptors.has(descriptor))
-        gDescriptors.set(descriptor, new Set);
-    let descriptorTypes = gDescriptors.get(descriptor);
-    if (!descriptorTypes.has(typeName)) {
-        descriptorTypes.add(typeName);
-        if (typeName in structureParents) {
-            for (let [holder, field] of structureParents[typeName])
-                addDescriptor(holder, descriptor);
+    function recurse(container, typeName) {
+        if (seen.has(typeName))
+            return;
+        seen.add(typeName);
+
+        func(container, typeName);
+
+        if (typeName in subClasses) {
+            for (const sub of subClasses[typeName])
+                recurse("subclass of " + typeName, sub);
         }
-        if (typeName in baseClasses) {
-            for (let base of baseClasses[typeName])
-                addDescriptor(base, descriptor);
+        if (typeName in structureParents) {
+            for (const [holder, field] of structureParents[typeName])
+                recurse(field + " : " + typeName, holder);
         }
     }
+
+    recurse('<annotation>', typeName);
 }
 
 for (var type of listNonGCPointers())
-    annotations.NonGCPointers[type] = true;
+    typeInfo.NonGCPointers[type] = true;
 
 function explain(csu, indent, seen) {
     if (!seen)
@@ -288,12 +307,14 @@ for (var csu in gcPointers) {
 // Redirect output to the typeInfo file and close the gcTypes file.
 os.file.close(os.file.redirect(typeInfo_filename));
 
-for (let csu in annotations.GCSuppressors)
-    addDescriptor(csu, 'Suppress GC');
+// Compute the set of types that suppress GC within their RAII scopes (eg
+// AutoSuppressGC, AutoSuppressGCForAnalysis).
+var seen = new Set();
+for (let csu in typeInfo.GCSuppressors)
+    foreachContainingStruct(csu,
+                            (holder, typeName) => { typeInfo.GCSuppressors[typeName] = holder },
+                            seen);
 
-for (let [descriptor, types] of gDescriptors) {
-    for (let csu of types)
-        print(descriptor + "$$" + csu);
-}
+print(JSON.stringify(typeInfo, null, 4));
 
 os.file.close(os.file.redirect(origOut));
diff --git a/js/src/devtools/rootAnalysis/dumpCFG.js b/js/src/devtools/rootAnalysis/dumpCFG.js
index fb89733f4b19..cecb785a65cf 100644
--- a/js/src/devtools/rootAnalysis/dumpCFG.js
+++ b/js/src/devtools/rootAnalysis/dumpCFG.js
@@ -241,7 +241,10 @@ function str_edge(edge, env) {
 }
 
 function str(unknown) {
-  if ("Index" in unknown) {
+  if ("Name" in unknown) {
+    return str_Variable(unknown);
+  } else if ("Index" in unknown) {
+    // Note: Variable also has .Index, with a different meaning.
     return str_edge(unknown);
   } else if ("Kind" in unknown) {
     if ("BlockId" in unknown)
diff --git a/js/src/devtools/rootAnalysis/utility.js b/js/src/devtools/rootAnalysis/utility.js
index 71d9a3fa58c2..eb8f8f66ceca 100644
--- a/js/src/devtools/rootAnalysis/utility.js
+++ b/js/src/devtools/rootAnalysis/utility.js
@@ -267,11 +267,5 @@ function addToKeyedList(collection, key, entry)
 
 function loadTypeInfo(filename)
 {
-    var info = {};
-    for (var line of readFileLines_gen(filename)) {
-        line = line.replace(/\n/, "");
-        let [property, name] = line.split("$$");
-        addToKeyedList(info, property, name);
-    }
-    return info;
+    return JSON.parse(os.file.readFile(filename));
 }

From 997340b49200d54cef1f5796d53d4f9ac193e331 Mon Sep 17 00:00:00 2001
From: Randall Barker <rbarker@mozilla.com>
Date: Mon, 25 Sep 2017 12:09:49 -0700
Subject: [PATCH 03/29] Bug 1402594 - Fix regression where toolbar does not
 become visible when link is pressed r=jchen

MozReview-Commit-ID: B5ppPaQXo5e
---
 mobile/android/base/java/org/mozilla/gecko/BrowserApp.java | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mobile/android/base/java/org/mozilla/gecko/BrowserApp.java b/mobile/android/base/java/org/mozilla/gecko/BrowserApp.java
index be9fcdf9f62c..fee84d4093ab 100644
--- a/mobile/android/base/java/org/mozilla/gecko/BrowserApp.java
+++ b/mobile/android/base/java/org/mozilla/gecko/BrowserApp.java
@@ -677,6 +677,7 @@ public class BrowserApp extends GeckoApp
         });
 
         mProgressView = (AnimatedProgressBar) findViewById(R.id.page_progress);
+        mDynamicToolbar.setLayerView(mLayerView);
         mProgressView.setDynamicToolbar(mDynamicToolbar);
         mBrowserToolbar.setProgressBar(mProgressView);
 

From 117526801f3e6469320d2fc27b22c516aa9e7ee4 Mon Sep 17 00:00:00 2001
From: Towkir Ahmed <towkir17@gmail.com>
Date: Fri, 22 Sep 2017 11:52:00 -0400
Subject: [PATCH 04/29] Bug 1363028 - Update bookmark toolbar icons to photon
 styles. r=johannh

---
 browser/themes/linux/browser.css              |  42 ----------
 browser/themes/linux/jar.mn                   |   2 -
 browser/themes/linux/places/calendar.png      | Bin 670 -> 0 bytes
 browser/themes/linux/places/query.png         | Bin 678 -> 0 bytes
 browser/themes/osx/browser.css                |  77 ------------------
 browser/themes/osx/jar.mn                     |   5 --
 browser/themes/osx/page-livemarks@2x.png      | Bin 1167 -> 0 bytes
 browser/themes/osx/places/history.png         | Bin 843 -> 0 bytes
 browser/themes/osx/places/history@2x.png      | Bin 1872 -> 0 bytes
 browser/themes/osx/places/query.png           | Bin 549 -> 0 bytes
 browser/themes/osx/places/query@2x.png        | Bin 1055 -> 0 bytes
 .../themes/shared/toolbarbutton-icons.inc.css |  51 ++++++++++++
 browser/themes/windows/browser.css            |  54 ------------
 browser/themes/windows/jar.mn                 |   3 -
 browser/themes/windows/livemark-folder.png    | Bin 619 -> 0 bytes
 browser/themes/windows/places/calendar.png    | Bin 567 -> 0 bytes
 browser/themes/windows/places/query.png       | Bin 601 -> 0 bytes
 17 files changed, 51 insertions(+), 183 deletions(-)
 delete mode 100644 browser/themes/linux/places/calendar.png
 delete mode 100644 browser/themes/linux/places/query.png
 delete mode 100644 browser/themes/osx/page-livemarks@2x.png
 delete mode 100644 browser/themes/osx/places/history.png
 delete mode 100644 browser/themes/osx/places/history@2x.png
 delete mode 100644 browser/themes/osx/places/query.png
 delete mode 100644 browser/themes/osx/places/query@2x.png
 delete mode 100644 browser/themes/windows/livemark-folder.png
 delete mode 100644 browser/themes/windows/places/calendar.png
 delete mode 100644 browser/themes/windows/places/query.png

diff --git a/browser/themes/linux/browser.css b/browser/themes/linux/browser.css
index 34f43182f8ca..a2857dbc31fe 100644
--- a/browser/themes/linux/browser.css
+++ b/browser/themes/linux/browser.css
@@ -124,48 +124,6 @@ menuitem.bookmark-item {
   list-style-image: url(chrome://browser/skin/places/toolbarDropMarker.png);
 }
 
-/* Bookmark items */
-.bookmark-item {
-  list-style-image: url("chrome://mozapps/skin/places/defaultFavicon.svg");
-}
-
-.bookmark-item[container] {
-  list-style-image: url("moz-icon://stock/gtk-directory?size=menu");
-}
-
-.bookmark-item[container][livemark] {
-  list-style-image: url("chrome://browser/skin/feeds/feedIcon16.png");
-}
-
-.bookmark-item[container][livemark] .bookmark-item {
-  list-style-image: url("chrome://browser/skin/places/livemark-item.png");
-  -moz-image-region: rect(0px, 16px, 16px, 0px);
-}
-
-.bookmark-item[container][livemark] .bookmark-item[visited] {
-  -moz-image-region: rect(0px, 32px, 16px, 16px);
-}
-
-.bookmark-item[container][query] {
-  list-style-image: url("chrome://browser/skin/places/query.png");
-}
-
-.bookmark-item[query][tagContainer] {
-  list-style-image: url("chrome://browser/skin/places/tag.png");
-}
-
-.bookmark-item[query][dayContainer] {
-  list-style-image: url("chrome://browser/skin/places/calendar.png");
-}
-
-.bookmark-item[query][hostContainer] {
-  list-style-image: url("moz-icon://stock/gtk-directory?size=menu");
-}
-
-.bookmark-item[query][hostContainer][open] {
-  list-style-image: url("moz-icon://stock/gtk-directory?size=menu");
-}
-
 .bookmark-item[cutting] > .toolbarbutton-icon,
 .bookmark-item[cutting] > .menu-iconic-left > .menu-iconic-icon {
   opacity: 0.5;
diff --git a/browser/themes/linux/jar.mn b/browser/themes/linux/jar.mn
index e4b0de0923f5..b0fe075ebea5 100644
--- a/browser/themes/linux/jar.mn
+++ b/browser/themes/linux/jar.mn
@@ -41,14 +41,12 @@ browser.jar:
   skin/classic/browser/places/bookmarksMenu.png       (places/bookmarksMenu.png)
   skin/classic/browser/places/bookmarksToolbar.png    (places/bookmarksToolbar.png)
   skin/classic/browser/places/bookmarks-menu-arrow.png           (places/bookmarks-menu-arrow.png)
-  skin/classic/browser/places/calendar.png            (places/calendar.png)
 * skin/classic/browser/places/editBookmarkOverlay.css (places/editBookmarkOverlay.css)
   skin/classic/browser/places/livemark-item.png       (places/livemark-item.png)
   skin/classic/browser/places/starred48.png           (places/starred48.png)
 * skin/classic/browser/places/places.css              (places/places.css)
   skin/classic/browser/places/organizer.css           (places/organizer.css)
   skin/classic/browser/places/organizer.xml           (places/organizer.xml)
-  skin/classic/browser/places/query.png               (places/query.png)
   skin/classic/browser/places/tag.png                 (places/tag.png)
   skin/classic/browser/places/toolbarDropMarker.png   (places/toolbarDropMarker.png)
   skin/classic/browser/places/unsortedBookmarks.png   (places/unsortedBookmarks.png)
diff --git a/browser/themes/linux/places/calendar.png b/browser/themes/linux/places/calendar.png
deleted file mode 100644
index f7128685c0dd4e836aab11cbe861c2fb5ec17fde..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 670
zcmV;P0%84$P)<h;3K|Lk000e1NJLTq000mG000mO1^@s6AM^iV00004b3#c}2nYxW
zd<bNS00009a7bBm000fw000fw0YWI7cmMzZ8FWQhbW?9;ba!ELWdL_~cP?peYja~^
zaAhuUa%Y?FJQ@H10vkz0K~y-6jgsF>(@_}4Kj(apIuo}pTm;4!EW>hAF&kTE6jVge
zZPZN!F^Qnd{uD1KLSf-wU|<yexR@;#MGQePS(HXvQ>Sy^ot@Lg=5SkCFT6bOb2vOa
z?+;<E1z_Uw!%SCKuxI)E(!%XqcS8T-R6~5sq%TV$6C3M!H!>Jy`uS734|TJ-vBlqb
z@IWxDwT?#z&rVAzWTMCIbr%;u^J(@2xnDU3j-6sJ-q+jj8e<Xw(pcmAeC_!C0baj+
zgWn$@m;1RV-`C!O=Xvf<3pUhug0;0A{~Lk8eqOwK#>ER)gaWV@zN{9RoLQk&3C<l{
zMhc0srU@O#Vff5>wAKJftu@wKCTCWNUpm5ip-lMXX>?it5k0SnwYDapb_80KWOQnd
z79~lglWc8nF*cq+DTTELDIHSjB+_x}1f(u$z*5qN`&W-r(uPPl#{B#OH?H4gd%Hj+
z9K%{mBpkz(%Ybceq0xa-iiszW@cG(FrIT#t^Nfur$Yf?498?7w9fSt@xjS-?&_I8^
zqe20oQGg}~LWnw4Efq(do&JhIY1a^U&tP<Fjz~DhyZ3L2gkz-ANrs}s3`K|8SviR2
zE%;h14m#SXO*@rN($?lf2w6KKA*gFXSwnVp^@sc5+F^tc)jSS}+GnU00DN2eiVz|T
zpo(5GK9fo&yprb{V=%^2!Aja%U46F(<*01YE5-qS1AAeFKnN=qumAu607*qoM6N<$
Ef|S}GAOHXW

diff --git a/browser/themes/linux/places/query.png b/browser/themes/linux/places/query.png
deleted file mode 100644
index 2420dee0e8a4eef6e2b8cf9245d03514d7e37933..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 678
zcmV;X0$KfuP)<h;3K|Lk000e1NJLTq000mG000mO1^@s6AM^iV00004b3#c}2nYxW
zd<bNS00009a7bBm000fw000fw0YWI7cmMzZ8FWQhbW?9;ba!ELWdL_~cP?peYja~^
zaAhuUa%Y?FJQ@H10wYO8K~y-6rIJrb(_t9LKkx7N+i!m~XKjV$-?XHE3JanV1fy<2
zT|^ShLV{4Dy6g}h%uZb@!&5S%5JZpRB@Z5=XoqN#JCq())7r9PqPej-_j@~RZgWiv
zdN1$$ywCS}p6~bjzCudL|19C_u?~_<^dk**Q^stYba|rZ{?<Svndq;)a9b@*d>tP+
z`!5VMq@e%=yw9?i^(W7Rl*+qHYH|zW5|jC%%M*2L2q6K15Rm6bW#^srfDB$rKmrI1
z0pBJDuLEukkTR77!`MJDKQ)3H`BHRtYUf^R&Rhl~WdabsE~KJck>sYE?7OJz8$q#@
zZ7Me6zX(3+Be56&DRGTTp$Sc=ac~->kp;$r?+Hx|5Dm;=*;9+Hu?gK#f$nUi?wSXo
zn)!IEg`7rdu<V}zVC_eU=<EloyN9sVw-5`wX5r}#IFKH&_Hzz<b0-J^fKsS2Hs`16
z;(a3CG5ozwBHl5ox*rgm^XH+`z87r}4+kk}Xl3cuIAurEyS3&R@o=zM{htjiwfk6|
zoyKwc3M(^S9H)9nE`?A_?VFxiY{j5te=`eDZnEuQ8;9=&aJKbAY8~tDLoB~}k)x3D
zKr3uuDtA(TqLuGccS$_HiqNfSr4=-|pYwURot3vQu^;KkYRLRF1$$FRK0~%2&jpK<
zLwp);N8eFRA{<4g*0UZ6Ul&qndL|NCZ5tG`XQ7b)-HrGvu2Cs|1C?RH9*EjQDF6Tf
M07*qoM6N<$g3fj$b^rhX

diff --git a/browser/themes/osx/browser.css b/browser/themes/osx/browser.css
index e373ca4a5889..9db1cd7599cc 100644
--- a/browser/themes/osx/browser.css
+++ b/browser/themes/osx/browser.css
@@ -186,79 +186,6 @@
   -moz-box-align: center;
 }
 
-/* ----- BOOKMARK BUTTONS ----- */
-
-.bookmark-item[container] {
-  list-style-image: url("chrome://global/skin/tree/folder.png");
-}
-
-.bookmark-item[container][livemark] {
-  list-style-image: url("chrome://browser/skin/page-livemarks.png");
-}
-
-.bookmark-item[container][livemark] .bookmark-item {
-  list-style-image: url("chrome://browser/skin/places/livemark-item.png");
-  -moz-image-region: rect(0px, 16px, 16px, 0px);
-}
-
-.bookmark-item[container][livemark] .bookmark-item[visited] {
-  -moz-image-region: rect(0px, 32px, 16px, 16px);
-}
-
-.bookmark-item[container][query] {
-  list-style-image: url("chrome://browser/skin/places/query.png");
-}
-
-.bookmark-item[query][tagContainer] {
-  list-style-image: url("chrome://browser/skin/places/tag.png");
-}
-
-.bookmark-item[query][dayContainer] {
-  list-style-image: url("chrome://browser/skin/places/history.png");
-}
-
-.bookmark-item[query][hostContainer] {
-  list-style-image: url("chrome://global/skin/tree/folder.png");
-}
-
-.bookmark-item[query][hostContainer][open] {
-  list-style-image: url("chrome://global/skin/tree/folder.png");
-}
-
-@media (min-resolution: 2dppx) {
-  .bookmark-item[container] {
-    list-style-image: url("chrome://global/skin/tree/folder@2x.png");
-  }
-
-  .bookmark-item[container][livemark] {
-    list-style-image: url("chrome://browser/skin/page-livemarks@2x.png");
-  }
-
-  .bookmark-item[container][livemark] .bookmark-item {
-    list-style-image: url("chrome://browser/skin/places/livemark-item.png");
-  }
-
-  .bookmark-item[container][query] {
-    list-style-image: url("chrome://browser/skin/places/query@2x.png");
-  }
-
-  .bookmark-item[query][tagContainer] {
-    list-style-image: url("chrome://browser/skin/places/tag@2x.png");
-  }
-
-  .bookmark-item[query][dayContainer] {
-    list-style-image: url("chrome://browser/skin/places/history@2x.png");
-  }
-
-  .bookmark-item[query][hostContainer] {
-    list-style-image: url("chrome://global/skin/tree/folder@2x.png");
-  }
-
-  .bookmark-item[query][hostContainer][open] {
-    list-style-image: url("chrome://global/skin/tree/folder@2x.png");
-  }
-}
-
 /* Workaround for native menubar inheritance */
 .openintabs-menuitem,
 .openlivemarksite-menuitem,
@@ -829,10 +756,6 @@ html|span.ac-emphasize-text-url {
   text-shadow: none;
 }
 
-.bookmark-item {
-  list-style-image: url("chrome://mozapps/skin/places/defaultFavicon.svg");
-}
-
 .openintabs-menuitem {
   list-style-image: none;
 }
diff --git a/browser/themes/osx/jar.mn b/browser/themes/osx/jar.mn
index 3ce3e7448621..2afdcc877c5b 100644
--- a/browser/themes/osx/jar.mn
+++ b/browser/themes/osx/jar.mn
@@ -23,7 +23,6 @@ browser.jar:
   skin/classic/browser/panel-expander-open@2x.png
   skin/classic/browser/panel-plus-sign.png
   skin/classic/browser/page-livemarks.png
-  skin/classic/browser/page-livemarks@2x.png
   skin/classic/browser/pageInfo.css
   skin/classic/browser/searchbar.css
   skin/classic/browser/slowStartup-16.png
@@ -46,13 +45,9 @@ browser.jar:
   skin/classic/browser/places/allBookmarks.png              (places/allBookmarks.png)
 * skin/classic/browser/places/places.css                    (places/places.css)
   skin/classic/browser/places/organizer.css                 (places/organizer.css)
-  skin/classic/browser/places/query.png                     (places/query.png)
-  skin/classic/browser/places/query@2x.png                  (places/query@2x.png)
   skin/classic/browser/places/bookmarksMenu.png             (places/bookmarksMenu.png)
   skin/classic/browser/places/bookmarksToolbar.png          (places/bookmarksToolbar.png)
   skin/classic/browser/places/bookmarksToolbar@2x.png       (places/bookmarksToolbar@2x.png)
-  skin/classic/browser/places/history.png                   (places/history.png)
-  skin/classic/browser/places/history@2x.png                (places/history@2x.png)
   skin/classic/browser/places/toolbar.png                   (places/toolbar.png)
   skin/classic/browser/places/toolbarDropMarker.png         (places/toolbarDropMarker.png)
   skin/classic/browser/places/editBookmarkOverlay.css       (places/editBookmarkOverlay.css)
diff --git a/browser/themes/osx/page-livemarks@2x.png b/browser/themes/osx/page-livemarks@2x.png
deleted file mode 100644
index 7b170897cc04d914e4163b915d155b804a45625c..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1167
zcmV;A1aSL_P)<h;3K|Lk000e1NJLTq001BW001Be1^@s6b9#F8000D5Nkl<Zc-qa=
zT~L%&9LMo<>2%pNW8+0#b5&TDO1^<_WF<x*pddIVY9Oo#h`^vCiZG^_%49?~jOCz!
zNCJ%$HN{{_q_Cmw0ug}=EV~OVJi8C<%dc||oHI2K1yW!aAC~98=bZ0>*(Dox);>}H
zs|y5DCJHlPq?Y_A7g!%tBbX>Wh9Sy_BL4<iA6+AWNjm44R_K8yOs;RGo}$QXk#+RP
zf~VhPuV8d%9n(rYqaY~m4kq_pX8UJj9lyYi>Oji0Ea+3L2`fWH^3O98n%IQpTS`Fp
z%?fL>Hd#x5p|G09gX0<zo}`~Cww~`>N)LQotjXFWAgUV7#qu$f)Q-;w-V$9B5P1vK
ze8nZvCH~uQfyuw3;`n71X@yRtT$mH=Y}Vi{(IsoPeE}x>6O~Io@6@mid7(JH=y>Eo
zU6Tui6=VEBxn|~MM|9-{j(+T9ru^Q!J<zZYdr?(Cj>Cm)&5X&8yuj*+DlkWioZNu|
zhsJk5T3{MbG429f?!Owedr@39Ce}_zc0`w~3a<i_b;-#ko^fdG%rqi0^*(lGG~v`o
zMtpPE0*BL!v2jSZ@4BGV?A4GR(IqRxZi31D(829Lt!N}nzQ*U<u_vbw(HREBA8$sZ
zeh?1TE7dfNvvvPOc0`w~*m@I8`b7s9m#1hvGJDW#@t~o_h2lyTy7v|AJ2`}?)K*k|
z-G@<!S1PF<6Z@tjJEBWggjRw%bY9{1=8kF%k9z-%U*<}UihcCGs5B$KtRIl?nQb1V
zejv`#kR8z_uZ2{CNhwgc*ql*~YqcgcJs3g1)eW27D}DQu3wuw{OB^yl-=@fUO@k`-
zYKV^L62EtDfH`<}l-rd(q7j~KL`Xt2!gP(uFKS1}?<y>V9`5s6CtYJla-IPLwuxEq
zfE(|fn({2!5nZx8xB`ss^e7i|WaMu}XAL7FwHq;MEiiPd^grT3Prn;+G!~g|#_a|x
zn{fr7DN~&xJEBXLy<Gt&A#a4+k!jb+DN>+sccHbzjoe}dk%z6wI@bo%fQP$Orto#g
zE_BJ+jk+n%k{!_{OShDRiO(J3wx`=Q9(1_qU+Uo={_5hht;s#O|BHjqzWQF_vzQDM
zy89;9{h)VDb(ZXiE_pSm9L%0<JH-wj*3cWB=rXyv)^=6SORLR%X6PJ87<~>+vZ2K=
zv9`0vh456(S+XO#<dw~3py=&~xy|u|8c8P%Xf~+0_t1%hCk=9*S7bs*H@kof!HE;I
zsyZ8=>5VFabvDgeq9eLw$y?XKY)cv9Htx1*tc~uXpV&KGK=f~N?jPAkKS=cqeYW!1
z%CLLvnXYZXhIcKRvqVR9$;)qC2NRMw$oWTG=aTG*E_rFwH87iEtq9(4!>UNjTw)F0
z5?!)5@M{0!*Gusv(6*WQ_#NBryYZ^oH?S1*i8gzE{Eo(wXBIAcj(U;uoo6pl&$A0G
hpq`}`&9jB9{RcDB(eT=9a9;ob002ovPDHLkV1f)$HIe`T

diff --git a/browser/themes/osx/places/history.png b/browser/themes/osx/places/history.png
deleted file mode 100644
index e5a00b56d38ca5af9b9d912e6ee2121ebfc90bbf..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 843
zcmV-R1GM~!P)<h;3K|Lk000e1NJLTq000mG000mO1^@s6AM^iV0009LNkl<Zc-mc)
zTTGH+7{^)KrI)qUeO<P-uG?yJ^FrBjMV?QnXh15NXU%4%PF)ADa<g375=BtK6CjFb
zO)^D1;|ULlf`XvH_Zd&m`^~xZ+kShWJ@5bdzt8s`SO9Q=%>38akRU{e6rLeC%U!#y
zKM!8y75gE<rB&4xQ+k8e;W#p%o}N+!5|bR6Lk%0bdci=HTjYntDY{gRG)=pGJ|FB`
zZLnlqfrTX_n0GDU_ITm=_{1acR5qeEp46NhWaJdGyVM$~4?nx(2viy^G|5__t-XUl
zV$Ah{*|G-?r^|;XEm#x67^G$8UoR=Is-kdZhtml%xdN1G4One9aJgLI^?I3ZR6QDK
zk+(A@yL<bdqLQ+Yq?RSj%nQ*?P7VIWwtEMLNHG>sK+&gQn4Kddfyt@Vz0f~20()rK
z-P1e97v->70#VM(gM&l!q1_H*X$!7q1viR46b%xojEn@5Bb_jsy?ra_XXh-*{EPzD
zvy7~AilW?$%SMp4%E4}TfCt5dx9>{NV}#71Mgi+46D+T+dg4<A)vT1X%nD+lH_SnE
ziyYl;xZ@N<a0nX`xQUQoPzVj;CfG4s7|q&-iJXo%HYxQJD_JPYwb~AL=N1;>r$k1a
z!FhZFCm!zwNY1#r#%Oje7Wk$6ZHr3ay<sKs(?dtcCq@^SmZ4MG1B#Ar*xoUN({&6d
zZV!RPB*)D44~}3bX86(2G#MVljbm|BpWnzXDE_>@Ve*bo=s<#JE^qIIMZ7?!&20jS
zG1mpsHU(^MZNcpPJk1lPe}BY@xW!zgc%I;?SRzx7P3U|>W8>tApuV9A#LY5>di;NN
zpBC0|^NcI2zRC~P+9#2*ygPUAU11F3lKK8fTFsX_rAFKD9T*;g=@|pe;5{(R&%^5a
zI<f(O^m@9q@_ipCGVay=hk*eX9#d>$sy`B*Cd&R+Q(HIPrszD-^!3vNL&J2pN^^)g
zJvT)lejFane-IcHaQQW!6T?lp8J)lj!wo76i;Dk>tJQKMVk@yQi5<$hP1^on{|{sR
V@W4oA(0l*@002ovPDHLkV1m;SkPrX>

diff --git a/browser/themes/osx/places/history@2x.png b/browser/themes/osx/places/history@2x.png
deleted file mode 100644
index 684b374ff5732cfa75ec8d81201874eaaef679a9..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1872
zcmV-W2e0^vP)<h;3K|Lk000e1NJLTq001BW001Be1^@s6b9#F8000LUNkl<Zc-p0x
zSxl5y6vs!~m-ewQP1C2QX`7}#^{EfGPfgRr+Eh^s2+9oGFbuMY$SR;{T+$R|7X$&>
zQITbaeHjKAMNniB6l6d^0Rd&$Mg~vM|E8Zx1O=JoA3p9q=l8$M`R?425z%`U5FGY3
zYd6b>by(7gQ)m34H`@?{SmdmS{T}1cFIe_0-(%qse#NDl_`d#!I+MvXvb?;!ME`&A
zj5hQk2C>LNE*KjgfPc`jEv)S<-_YYH{cqoCFE*RaGqlbRVv&PfFu($HJp+LGN31_t
zM{@ECqUPr2#wGBQ#X<{<W}2Owr{|{G6+#>O5F>q%n^$l(8Z0oue&+y=28L{5{l)UD
z*EM8G%M9?d=QA`p{fzGQ-lv+ndb(D4ow9RsDK{^lii%6nhCaj~7CF-PSik}kY<R3a
zfPmm%SpJ-l^O8SHOBR}X_M9drr>OmI2W4jGP<%onB_&^^Y<|9S^%`Bda+NZ(veAY<
z#2^+qB6n#?%;6=NV8dh80dUoP$@0(4&W*vS7Zw+3Y~m>mk3OctqGF1RPXJuZl=qkJ
z_x005;~@1t9H5^256~w1vN#5@$U*Md_ymCkCfM+R*INVNO>ztgJ$`I<c5Y&Rex61+
zdFatFmRZcKs;Zj0@Ac5|$S6%tO_OPMmc|)w;{C@n+R%p>#3Bc|V1NZC*zkbYiUIf@
z4g7``)N-p;Yc{{2q2Uo4<iu;&iv&ooZ=`|2A)4a-T{N398=;n#7P{BdBmIv)#2^+q
z$OQu|!36tOYnv8c@O(W0zW|${;Lxyzg@qXe_751TvDrW|v2j$(%Zgc`uq+mfFp`wV
z1z1>ExS|a)h(!+XI~ZUICfMv@f){(*iUAxx;{ORNxKvY?H8nj=y$|}to?c8zrTl^`
z*ke)IT#yW3UZJS-(G(pM`&K(*k%Qa<E>y6<1REaOvhpnU41u@I$M@*>tgr`t{jCV-
z;yu*y@|};4p&K__L=i16E@EbH>G+8g6c!e~Y9Dft%iD@Uf+^VWfEPUBE%WyE`;`?w
zJUlvnx1)=oYlTH()V=&(PfbnZRa#YEUf!hkIJ9Oza__TY>ZLTnl=$$1C%k1|hmTmX
zP7DkVF17Ki1YJr?r$R0s?BmRgiC(-|T2*p|BiZh^TeBazU|cUM7EFl`FL=UR=IP^W
z9}pCBx}&R`Zt`+L7m|{xvbu&wpN!FrX%?p%Yf)%^Vd0hb?A=E@{@5x0THDx?!qJI5
zc~!!~!zm&00##I2iQ=oStrJX%4=;GaTjuF~_+UU_@L2=zcaz};B$BIm0FQY9;}cKU
zl$W=U7{IRGR<!SLYjTh)Nae03-y?n$aq^Tnru(@N@g{*O@!<tec*_oX`Rw!X@;P0n
z(_3`<CW4ZA|FLY3hDT6Hn-UHujYcb&62GpY(E?9+%RD^2e^+~YpDEFnP1e@y2+Auc
z5PQbo@APDBd{e>-q-R_fOo<OKc*0wzKIFBHbuJ?-x2vkAmY_;LN+YA9=}vnGjXoaZ
ztr-6xA-DZ*C(aAOl=$$1C%k3u9-g1F&Yt@>T3gOV1L+#{;vCSFmE%}NF@BJct1Yhp
zOE4uqyx<9MaTKf6hg_Uhp7BMcnz^!yN(6}_jEsz;*0$TI1)j~54GDYScKZ&m<aw|J
z6YOI4fEPSpeHXa7d;H*}bdQdXPr6xNSxu0>$v~I0vhn)x;n695tF22Ia7SmCD7?#=
zS%M{T;Q=r9-1d3^D)knnO6{j`Ri_r0YG*2|Yl+1(Xs6_hsg#_YB4#sS9K_7lG)5m{
za5qRvO`{~_@w3EZwn^@yPK6gdSKJ4bZth>no!nxBLnBIRYU`J4>QJ!_Jd<v|@#Ii!
zTs*!+aN7~bt8s7$s{-K}=ey`DE3e?#1mxhr5e%@v3=WGZQ8>HB!E4nknTt}j(@yS^
z92pbe+|bxakiMyjdU|_F&(GKn94NSGU|*Y>4cy*D6}-1NbP_KlAqKG`r?I)2Bo3Hh
z!(+`mp{vqutE010Y3tye5)+qbXg1tfHr%*L5b9vSXrwkSN{zORa(ECpE7H?5C_ldd
zZ75j8h*&AF$zXU17MRR-g~vOu<u0zuj}IzbR5k~k(!wLol=BSd0G8Cr%ZlYT8V7m#
zAJNdzBN`YmqD}O@8H?QGr_NS_1t!?*`eEYiqTFid;B3W-mkv0oGBb1Y@9|a2j6GhD
z5Q`k-f&mto8~$mw|De;i*7lAktq(Y++bLW#{)vj!6>GFZhL)B&e$AG<y1NO&GuqIH
z7{nq6xi$wJzx&|dhS1MDY_?k2%75CsUmj>}uSjEMNRqp#vY|KI5QA9cAa@f#PT$sV
zyX-#OW$mziw~d268+h-rl?Ot2MjQGNvk|83^B;F^Mq8lGF#ZE_Rn=mqA|HqV0000<
KMNUMnLSTa2xs%oa

diff --git a/browser/themes/osx/places/query.png b/browser/themes/osx/places/query.png
deleted file mode 100644
index 0ccb8470256d32b201cfb508c7276310b7d7e46b..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 549
zcmV+=0^0qFP)<h;3K|Lk000e1NJLTq000mG000mO1^@s6AM^iV0000PbVXQnQ*UN;
zcVTj606}DLVr3vnZDD6+Qe|Oed2z{QJOBUz$4Nv%RCwB?Q_C*{K^*>VcTu7QO&a2r
zxOmhfk~VRXN+c4FPENw1{tE{O4*miT#LY!qaB}EPQ0m|&LDNW6>bcs^?#}F*N4r~T
zQ^F>*nfbooe81;NmSw?zK85|l^BY@);DusBmX+<zou$QJ39!qdQ0N;GiA0#-&jQr@
zDbiGUeS7>yAng<8W>+ib=c#WwQ>gdg@=CaboSGR1D07`d`MRyI?FM-Y>BlT+8nKN`
z(*l=Eg7cFkKL^HIZOjh6%H`C+&`mHj6GS~MI6k@uNs^$W%fqq5y<1@2nw;*Y#T6o!
zSyV)w3TV0$K~HZJAcR4#7GB!A>cQ<+027lgVM9!j2Di|tabX?o-$42)1K1!iIO64t
z?HR_nf*r~kP6W9e1BG;ZX9Hl}f{cM7aj$YLqhgywIg+0f$q_)v5$N}OAr?(hLkw3J
zDLXB9tpY=SAH2RG5xT2bfU4^GE<7Yucur?&&Q-Q(ja%jz<78RXMUsk&$Z}$xC=lZl
zoxBT|=OTj9fRA?}mCOLaq;!;-cf&AkFcJUYv(h)v%+K+=cP?D+-Eo0v?6~}_URQnx
nb+wJaGHGY~KfdPdmjD9*$A{ukNh|z>00000NkvXXu0mjfQMC8L

diff --git a/browser/themes/osx/places/query@2x.png b/browser/themes/osx/places/query@2x.png
deleted file mode 100644
index 20b458aaca5ec3f06510c9d12ea1ffb70a48fe67..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1055
zcmV+)1mOFLP)<h;3K|Lk000e1NJLTq001BW001Be1^@s6b9#F8000B#Nkl<Zc-qaD
z-%p!W7{_~Qyf&HPLa)72W7HV0jFQ<b=yZmamX@{yx_01fVMrLX9l?PcTf3DN${1}a
zY_wFml!3rNSmuu@kxUTSU>j^kjC$jL@b!64@}7{iFDr9^7oWG!d(Ly7&$ov(L1Q(v
z?JEDP09s<5Kn^SuuRqlQQl2~i5HCH=0AQk>^N*$0nNUJ35YPU{00B*2-fR2`CK8%|
zEa8qhI2|$WXCi$5Nnp3eVhCu7^#dPxQBu^3CeKh#G}I>X$^J&rxhI01?ABQHfpr2V
zT`P_si=)Y%&Kd6Ka|a5%TZWzN<^W)R`hFdY^MCIM>{7fk0B!6f8v~pNbL+d`@$K|)
zn7aNDlVfY!0?%d#yA-bsaC7RBU}AJNXWo9Rh}p^+>B$IiWAc$;d}LLX6YdxSzG3;U
zEA%q*z4gmMxa-54&5#}$z)TNjdg7sA?An8@G<tfmH~$C<_Bm1QY=^$kjY>zCK(BMd
zb+nE4T+r^VfVZJXZI1K^uLw|d4$L>>Yl5%S_p{Q`HV&iyB<!{h9J2VuXYH|sz+nra
z)N&4v!yy<AEx6P<r8Y-;6t4_0Il3kozIrb!W5W+{vN3_GqkX8Uio^A3FDmR^4A;CS
z_L`dp_?xQDk)DhI*GE<bLxU@-SWGQ&k;F;D&#NOC8Cqhv<~6Zrrk+h^NY91<elVky
znz=f#oWYxK9K=3t6%LsLsCFe#X1#z^avtfgRv4~%P3&3C=ed{9WSb>DidR!Y4`w8N
zUoaTIn?e4&4w#D1&~-=Ys*@-w_Mta2EBE`TrZwK<9`5Bc*=9+P;*|lerS1s^F5k&u
zVsuSlFAvgH_oLL>4zsZt;fpiq4*keAuhHHW>S>q#S!OAo4FPn1FzMuqARb#%rLHE1
zO1l7h-6{IXxfrg+TE*cWG}QHNHbZ(8F9q;{NhR(IE=Lx!;;D<{;}1P>lt*yH7KOd6
z8@AFehHIA7UYL5^_`;h~n<G7nR|ZI4xg&^O`ZX(`Rfg~p1uz+W@YD~W%yNOQJ1Qu%
z2H`%QfU(Gj{RM8+xFTwEq(=rY(SzylSrT-&&t;`Qx=4S5UIhKqh*MuGz6?X5pW#|u
zumAKoy!CPVri*HGq(|{mfU_Xv|9e5-tSS-Ozu0zLzQ6a5lacRT!Cw##&22VAdK9n5
zbdU<7GjLnrYo5uOzVHIGl{3<#cx8a#*;&D<6SuY#>DdtA3>bgQ3<9TrMzi~eZG|1|
zQoNet!qz{HRO|-i{!63HuPo<c7vz7upI>RyJhvzB1>zOr)g9(#;zbVd4DmdXx5MmV
Z_rJhNzO~NC{we?f002ovPDHLkV1l@m15*G1

diff --git a/browser/themes/shared/toolbarbutton-icons.inc.css b/browser/themes/shared/toolbarbutton-icons.inc.css
index ec21d06f17dc..904db14a7b3c 100644
--- a/browser/themes/shared/toolbarbutton-icons.inc.css
+++ b/browser/themes/shared/toolbarbutton-icons.inc.css
@@ -521,3 +521,54 @@ toolbar[brighttext] {
   animation-duration: 2s;
   animation-timing-function: ease-out;
 }
+
+/* ----- BOOKMARK BUTTONS ----- */
+
+.bookmark-item {
+  list-style-image: url("chrome://mozapps/skin/places/defaultFavicon.svg");
+  -moz-context-properties: fill;
+  fill: currentColor;
+}
+
+.bookmark-item[container] {
+  list-style-image: url("chrome://browser/skin/places/folder.svg");
+}
+
+.bookmark-item[container][livemark] {
+  list-style-image: url("chrome://browser/skin/places/folder-live.svg");
+}
+
+.bookmark-item[container][livemark] .bookmark-item {
+  list-style-image: url("chrome://browser/skin/places/livemark-item.png");
+  -moz-image-region: rect(0px, 16px, 16px, 0px);
+}
+
+.bookmark-item[container][livemark] .bookmark-item[visited] {
+  -moz-image-region: rect(0px, 32px, 16px, 16px);
+}
+
+.bookmark-item[container][query] {
+  list-style-image: url("chrome://browser/skin/places/folder-smart.svg");
+}
+
+.bookmark-item[query][tagContainer] {
+  list-style-image: url("chrome://browser/skin/places/tag.png");
+  -moz-image-region: auto;
+}
+
+.bookmark-item[query][dayContainer] {
+  list-style-image: url("chrome://browser/skin/places/history.svg");
+  -moz-image-region: auto;
+}
+
+.bookmark-item[query][hostContainer] {
+  list-style-image: url("chrome://browser/skin/places/folder.svg");
+}
+
+%ifdef XP_MACOSX
+@media (min-resolution: 2dppx) {
+  .bookmark-item[query][tagContainer] {
+    list-style-image: url("chrome://browser/skin/places/tag@2x.png");
+  }
+}
+%endif
diff --git a/browser/themes/windows/browser.css b/browser/themes/windows/browser.css
index 1999ec16fa4a..a96d2420efa3 100644
--- a/browser/themes/windows/browser.css
+++ b/browser/themes/windows/browser.css
@@ -340,60 +340,6 @@ menuitem.bookmark-item {
   padding-inline-start: 0px;
 }
 
-/* ::::: bookmark items ::::: */
-
-.bookmark-item  {
-  list-style-image: url("chrome://mozapps/skin/places/defaultFavicon.svg");
-}
-
-.bookmark-item[container] {
-  list-style-image: url("chrome://global/skin/icons/folder-item.png");
-  -moz-image-region: rect(0px, 32px, 16px, 16px);
-}
-
-.bookmark-item[container][open] {
-  -moz-image-region: rect(16px, 32px, 32px, 16px);
-}
-
-.bookmark-item[container][livemark] {
-  list-style-image: url("chrome://browser/skin/livemark-folder.png");
-  -moz-image-region: auto;
-}
-
-.bookmark-item[container][livemark] .bookmark-item {
-  list-style-image: url("chrome://browser/skin/places/livemark-item.png");
-  -moz-image-region: rect(0px, 16px, 16px, 0px);
-}
-
-.bookmark-item[container][livemark] .bookmark-item[visited] {
-  -moz-image-region: rect(0px, 32px, 16px, 16px);
-}
-
-.bookmark-item[container][query] {
-  list-style-image: url("chrome://browser/skin/places/query.png");
-  -moz-image-region: auto;
-}
-
-.bookmark-item[query][tagContainer] {
-  list-style-image: url("chrome://browser/skin/places/tag.png");
-  -moz-image-region: auto;
-}
-
-.bookmark-item[query][dayContainer] {
-  list-style-image: url("chrome://browser/skin/places/calendar.png");
-  -moz-image-region: auto;
-}
-
-.bookmark-item[query][hostContainer] {
-  list-style-image: url("chrome://global/skin/icons/folder-item.png");
-  -moz-image-region: rect(0px, 32px, 16px, 16px);
-}
-
-.bookmark-item[query][hostContainer][open] {
-  list-style-image: url("chrome://global/skin/icons/folder-item.png");
-  -moz-image-region: rect(16px, 32px, 32px, 16px);
-}
-
 .bookmark-item[cutting] > .toolbarbutton-icon,
 .bookmark-item[cutting] > .menu-iconic-left > .menu-iconic-icon {
   opacity: 0.5;
diff --git a/browser/themes/windows/jar.mn b/browser/themes/windows/jar.mn
index 1edff722440e..11f7b9c82a70 100644
--- a/browser/themes/windows/jar.mn
+++ b/browser/themes/windows/jar.mn
@@ -10,7 +10,6 @@ browser.jar:
 * skin/classic/browser/syncedtabs/sidebar.css     (syncedtabs/sidebar.css)
 * skin/classic/browser/browser.css
 * skin/classic/browser/compacttheme.css
-  skin/classic/browser/livemark-folder.png
   skin/classic/browser/menuPanel-customize.png
   skin/classic/browser/menuPanel-customize@2x.png
   skin/classic/browser/menuPanel-exit.png
@@ -42,10 +41,8 @@ browser.jar:
   skin/classic/browser/notification-icons/geo.svg              (notification-icons/geo.svg)
 * skin/classic/browser/places/places.css                       (places/places.css)
 * skin/classic/browser/places/organizer.css                    (places/organizer.css)
-  skin/classic/browser/places/query.png                        (places/query.png)
   skin/classic/browser/places/bookmarksMenu.png                (places/bookmarksMenu.png)
   skin/classic/browser/places/bookmarksToolbar.png             (places/bookmarksToolbar.png)
-  skin/classic/browser/places/calendar.png                     (places/calendar.png)
   skin/classic/browser/places/toolbarDropMarker.png            (places/toolbarDropMarker.png)
   skin/classic/browser/places/editBookmarkOverlay.css          (places/editBookmarkOverlay.css)
   skin/classic/browser/places/libraryToolbar.png               (places/libraryToolbar.png)
diff --git a/browser/themes/windows/livemark-folder.png b/browser/themes/windows/livemark-folder.png
deleted file mode 100644
index 0be774e636aa662e5ed9f542030d1abf1aac1d3b..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 619
zcmV-x0+juUP)<h;3K|Lk000e1NJLTq000mG000mO1^@s6AM^iV0006qNkl<Zc-oDU
z&r6h16o#KWV`z*qrhzm?B$c%)OUcRtg&-LtqbQ&v4T^Trs$DIEwrv!uC`12%q_R~4
z8YUqk1V$w)QKinLqw~$Ld+!OpZ^q%n&Af29oA-V0Ip<y_BFv6m`+(3&DN+pA9q(@g
z5E04%w6?8vO}7DsCjqe_f?(Ve6e5<n$(O#1T!1m+#jKMzi)$udBE~I6(DN3x-T|Q2
z!xX~#ptukXi0j<|$ms&rZQBbK0M@uCRwGLC-l78D2wrgL!8t~I?lL{}oaEv>Vl{|H
zY%X6K5#jTji(7pFou4b(eU`>!wNxgCnCiR7?8iZ@$zZjEm@KK-6rSJCjJ>|lT?A-v
zQLB14!CjY$oPWiM&UW<I0Vet$kxTx?Xa}8+0dVNljjEisJ-#JcqnUg6nB^5vq3s;J
zbd!B&BCLGsWoGz2dro&!kj?zYXj|bML3E1xu3nn2-=U#C&E&I(By=U=1MP&D$8i>Z
zQIN^T-HdOEVpAj*eh^z)MK#~2rKOgc!2y!hN2!YhiGP`(C@)j|NLCP&;ah(%<*eeI
z?4))_2m60M;otl;p-?@c#qYr0BEb4O5UkB{r0p<`4b_ArJIQXTAzT3_zC=P-Q5{TB
zP)-}Hl{J3{Hj8Pvila7Bp8exK-&*u3+cJv?3Te6m@o@k~hDVn-R|IbXC=p@sMRdey
z+d>H{D^ufvKp@)D^)@CV9zZEo15^RQ5*QAU1kxgs`VVSwVwKedhq(X%002ovPDHLk
FV1hDX8N~nq

diff --git a/browser/themes/windows/places/calendar.png b/browser/themes/windows/places/calendar.png
deleted file mode 100644
index 4127e59880945cc3d5ff68fd278615e0c385125e..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 567
zcmV-70?7S|P)<h;3K|Lk000e1NJLTq000mG000mO1^@s6AM^iV00060Nkl<Zc-o~=
zJ!lkB5dKy|Dzy<rP|&ke)11PoNi7zFT6k6#B4{g|jg1Og34)Ea#DI;&NGc19vq+Sv
zc#7AWm|#RiPaz?H`@R|H&3l;TT4#55zTKVq=9_s%yWLjwnW~x#C>BK^(HY+f<|rhZ
z&1NwGvm=e8SfOGm5PwSI_lDr-2Jvg176W>Qd!^WSdd?~ptzHMwwp99J^xj<*RXv5@
z(D+nE{l%!EWDM*l09rS0dX@UqD;;NugI8M6Oc6rxI6x8ugM-+PWCwO^g~m$($<@@&
z_Y*s}SyVh5dzlna#KH5KPIOPa)BS;4-S3XCeOScR_lsV9>Fok8%*-3EC=e2rv7LQY
z1nU$;>ZQ`KsN?05u>EENZjKOJoov)0`3P?x+7*f19~|CeF@1l0Y;PV#L54JfG5KPy
zfBc44=c^}NHmMiiEI<V~_v#DIPR~LNpPrh-ndvzQw7SILjLYeKGZw6gc;Xrf=B~)5
zT7ayKpa$;OcgG)I^r&G{k;o=S_CrNI=jrhpG>=1JCJ4dhoqs)#(!i798ct1p_Qc7N
znn|7oym%kped;={4-J8oL{O66b%iv7#Gcjmolb$O$-fcG(hDYrO={l!q{)_y$E|ak
z+dEeXvVy>X@v(=#6b5slV`0RSu*IsYMDj#X#IFBie*w9<rCkpnxp4ph002ovPDHLk
FV1nWP3wi(m

diff --git a/browser/themes/windows/places/query.png b/browser/themes/windows/places/query.png
deleted file mode 100644
index 18b65bd71a4c0ce3dca6482a241f8018c5fa9f97..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 601
zcmV-f0;c_mP)<h;3K|Lk000e1NJLTq000mG000mO1^@s6AM^iV0006YNkl<ZILnQb
zu}@QB6vcn<J&>9j1f5OP1a(8OP!R=O9E7kVL?>4hXa59OqluHV8dr!CDA8yFF@c2W
zLa;<BEg)4X_LcYDdmSEaY2v_5zU_SHoSb{EXJ$Njy*!J@5Jwp!^L!$86CeyjngB%H
z(A}#S8*pl19*9#6@H|j8UVdI_5NZN26#&Xn42Br2fSMs1zaa2x*aiX>0l=uME7U$#
zN$~2}Mh6nb1QwI*M~<o43=4~k7|`9>$zcC=nrW(GtK-KR$boXKG&wWF@>-6Okx_<+
zNBNT7;N9FDqKcU@@$_x`e=|@6QDr5+&8>lJbak8~5=9N(&oA(GyF{g2B4}z^9e*<U
z5P0Fo88}1@r%EVBvh@_XjRM(X$hVy`Kk|8!t?lfTWBX$R-EAuFSv^D*oGP2U6~v5_
zCyukQv_xTR3pFE~%Q4v3hXVk%_8h8`I258I6ve5L$xM^oC~)TNdDg$Lfk8Ue!=(!y
zEN|`sP%KB7xOxU6LKrF2(^IUhu9E6a)8BIi-@kz<?1qj%6>Uhr8hq@)3ERaYxqOb^
zbeh!VF4linkZKpqNHzzJjds$wg=Dgod*gQ?I7Xoq#UBAVSglj5t49tqEgd3IDxyT*
zF)I5;qB*ElSyXFntj?$TkH3PJ#C-tI%ouz8>VvBEALST5KbZG@|Mr_l<3GbNj0qBn
n#A%=n2#&z<7ubuhIV}GJTuEr78E^BV00000NkvXXu0mjfQkMyv


From 6321dc4d1a7c4ff6381c3d338c13fe12cd75c33b Mon Sep 17 00:00:00 2001
From: Jim Mathies <jmathies@mozilla.com>
Date: Mon, 25 Sep 2017 13:07:45 -0500
Subject: [PATCH 05/29] Bug 1401561 - Avoid prompting about compatibility
 issues with JAWS when e10s is pref'd off. r=jaws

MozReview-Commit-ID: 2ejZ7Ga2lLk
---
 browser/components/nsBrowserGlue.js | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/browser/components/nsBrowserGlue.js b/browser/components/nsBrowserGlue.js
index cd786acf81f1..9f1ab475f628 100644
--- a/browser/components/nsBrowserGlue.js
+++ b/browser/components/nsBrowserGlue.js
@@ -2850,8 +2850,10 @@ var JawsScreenReaderVersionCheck = {
   },
 
   _checkVersionAndPrompt() {
-    // This executes a JAWS version check.
-    if (!Services.appinfo.shouldBlockIncompatJaws) {
+    // Make sure we only prompt for versions of JAWS we do not
+    // support and never prompt if e10s is disabled.
+    if (!Services.appinfo.shouldBlockIncompatJaws ||
+        !Services.appinfo.browserTabsRemoteAutostart) {
       return;
     }
 

From f7588f7e26f765a07ea5c0dbd0256389932d9557 Mon Sep 17 00:00:00 2001
From: Oriol Brufau <oriol-bugzilla@hotmail.com>
Date: Wed, 30 Aug 2017 11:50:00 -0400
Subject: [PATCH 06/29] Bug 1395276 - Make $ and $$ console commands throw
 errors created in the debuggee global. r=jimb

---
 devtools/server/actors/webconsole/utils.js    | 15 +++++++++++--
 .../test/test_jsterm_queryselector.html       | 22 +++++++++++++++++++
 2 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/devtools/server/actors/webconsole/utils.js b/devtools/server/actors/webconsole/utils.js
index 8e99efef1025..d88085215533 100644
--- a/devtools/server/actors/webconsole/utils.js
+++ b/devtools/server/actors/webconsole/utils.js
@@ -308,7 +308,12 @@ exports.WebConsoleCommands = WebConsoleCommands;
  *         The result of calling document.querySelector(selector).
  */
 WebConsoleCommands._registerOriginal("$", function (owner, selector) {
-  return owner.window.document.querySelector(selector);
+  try {
+    return owner.window.document.querySelector(selector);
+  } catch (err) {
+    // Throw an error like `err` but that belongs to `owner.window`.
+    throw new owner.window.DOMException(err.message, err.name);
+  }
 });
 
 /**
@@ -320,7 +325,13 @@ WebConsoleCommands._registerOriginal("$", function (owner, selector) {
  *         Returns the result of document.querySelectorAll(selector).
  */
 WebConsoleCommands._registerOriginal("$$", function (owner, selector) {
-  let nodes = owner.window.document.querySelectorAll(selector);
+  let nodes;
+  try {
+    nodes = owner.window.document.querySelectorAll(selector);
+  } catch (err) {
+    // Throw an error like `err` but that belongs to `owner.window`.
+    throw new owner.window.DOMException(err.message, err.name);
+  }
 
   // Calling owner.window.Array.from() doesn't work without accessing the
   // wrappedJSObject, so just loop through the results instead.
diff --git a/devtools/shared/webconsole/test/test_jsterm_queryselector.html b/devtools/shared/webconsole/test/test_jsterm_queryselector.html
index fe2df25c9483..0528e1db610f 100644
--- a/devtools/shared/webconsole/test/test_jsterm_queryselector.html
+++ b/devtools/shared/webconsole/test/test_jsterm_queryselector.html
@@ -34,6 +34,7 @@ function startTest() {
       checkQuerySelector,
       checkQuerySelectorAll,
       checkQuerySelectorAllNotExist,
+      checkQuerySelectorException,
       checkQuerySelectorAllException
     ];
     runTests(tests, testEnd);
@@ -87,6 +88,25 @@ let checkQuerySelectorAllNotExist = Task.async(function*() {
   nextTest();
 });
 
+let checkQuerySelectorException = Task.async(function*() {
+  info ("$ returns an exception if an invalid selector was provided");
+  let response = yield evaluateJS("$(':foo')");
+  checkObject(response, {
+    input: "$(':foo')",
+    exceptionMessage: "SyntaxError: ':foo' is not a valid selector",
+    exception: {
+      type: "object",
+      class: "DOMException",
+      preview: {
+        kind: "DOMException",
+        name: "SyntaxError",
+        message: "':foo' is not a valid selector"
+      }
+    }
+  });
+  nextTest();
+});
+
 let checkQuerySelectorAllException = Task.async(function*() {
   info ("$$ returns an exception if an invalid selector was provided");
   let response = yield evaluateJS("$$(':foo')");
@@ -94,6 +114,8 @@ let checkQuerySelectorAllException = Task.async(function*() {
     input: "$$(':foo')",
     exceptionMessage: "SyntaxError: ':foo' is not a valid selector",
     exception: {
+      type: "object",
+      class: "DOMException",
       preview: {
         kind: "DOMException",
         name: "SyntaxError",

From 60f43f2bbd78329c8dc6727c0e4111736cd2fd3d Mon Sep 17 00:00:00 2001
From: Jessica Jong <jjong@mozilla.com>
Date: Mon, 25 Sep 2017 02:46:00 -0400
Subject: [PATCH 07/29] Bug 1392970 - Part 1: Make CustomElementDefinition
 ref-counted and put it in CustomElementData. r=smaug

MozReview-Commit-ID: DIQN3JFxkT8
---
 dom/base/CustomElementRegistry.cpp | 110 +++++++++++++++++------------
 dom/base/CustomElementRegistry.h   |  27 ++++++-
 dom/base/Element.cpp               |  20 ++++++
 dom/base/Element.h                 |  16 +++++
 dom/base/FragmentOrElement.cpp     |  14 +++-
 dom/base/nsDocument.cpp            |   5 +-
 dom/bindings/BindingUtils.cpp      |   2 +
 7 files changed, 144 insertions(+), 50 deletions(-)

diff --git a/dom/base/CustomElementRegistry.cpp b/dom/base/CustomElementRegistry.cpp
index 727704286554..037ca52321b5 100644
--- a/dom/base/CustomElementRegistry.cpp
+++ b/dom/base/CustomElementRegistry.cpp
@@ -158,46 +158,15 @@ private:
 NS_IMPL_CYCLE_COLLECTION_CLASS(CustomElementRegistry)
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(CustomElementRegistry)
-  tmp->mCustomDefinitions.Clear();
   tmp->mConstructors.clear();
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mCustomDefinitions)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mWhenDefinedPromiseMap)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mWindow)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_PRESERVED_WRAPPER
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(CustomElementRegistry)
-  for (auto iter = tmp->mCustomDefinitions.Iter(); !iter.Done(); iter.Next()) {
-    auto& callbacks = iter.UserData()->mCallbacks;
-
-    if (callbacks->mAttributeChangedCallback.WasPassed()) {
-      NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb,
-        "mCustomDefinitions->mCallbacks->mAttributeChangedCallback");
-      cb.NoteXPCOMChild(callbacks->mAttributeChangedCallback.Value());
-    }
-
-    if (callbacks->mCreatedCallback.WasPassed()) {
-      NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb,
-        "mCustomDefinitions->mCallbacks->mCreatedCallback");
-      cb.NoteXPCOMChild(callbacks->mCreatedCallback.Value());
-    }
-
-    if (callbacks->mAttachedCallback.WasPassed()) {
-      NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb,
-        "mCustomDefinitions->mCallbacks->mAttachedCallback");
-      cb.NoteXPCOMChild(callbacks->mAttachedCallback.Value());
-    }
-
-    if (callbacks->mDetachedCallback.WasPassed()) {
-      NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb,
-        "mCustomDefinitions->mCallbacks->mDetachedCallback");
-      cb.NoteXPCOMChild(callbacks->mDetachedCallback.Value());
-    }
-
-    NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb,
-      "mCustomDefinitions->mConstructor");
-    cb.NoteXPCOMChild(iter.UserData()->mConstructor);
-  }
-
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mCustomDefinitions)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mWhenDefinedPromiseMap)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mWindow)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
@@ -248,7 +217,7 @@ CustomElementRegistry::LookupCustomElementDefinition(const nsAString& aLocalName
   nsCOMPtr<nsIAtom> localNameAtom = NS_Atomize(aLocalName);
   nsCOMPtr<nsIAtom> typeAtom = aIs ? NS_Atomize(*aIs) : localNameAtom;
 
-  CustomElementDefinition* data = mCustomDefinitions.Get(typeAtom);
+  CustomElementDefinition* data = mCustomDefinitions.GetWeak(typeAtom);
   if (data && data->mLocalName == localNameAtom) {
     return data;
   }
@@ -267,7 +236,7 @@ CustomElementRegistry::LookupCustomElementDefinition(JSContext* aCx,
     return nullptr;
   }
 
-  CustomElementDefinition* definition = mCustomDefinitions.Get(ptr->value());
+  CustomElementDefinition* definition = mCustomDefinitions.GetWeak(ptr->value());
   MOZ_ASSERT(definition, "Definition must be found in mCustomDefinitions");
 
   return definition;
@@ -286,7 +255,7 @@ CustomElementRegistry::RegisterUnresolvedElement(Element* aElement, nsIAtom* aTy
     typeName = info->NameAtom();
   }
 
-  if (mCustomDefinitions.Get(typeName)) {
+  if (mCustomDefinitions.GetWeak(typeName)) {
     return;
   }
 
@@ -358,7 +327,7 @@ CustomElementRegistry::CreateCustomElementCallback(
     nsCOMPtr<nsIAtom> typeAtom = elementData ?
       elementData->mType.get() : info->NameAtom();
 
-    definition = mCustomDefinitions.Get(typeAtom);
+    definition = mCustomDefinitions.GetWeak(typeAtom);
     if (!definition || definition->mLocalName != info->NameAtom()) {
       // Trying to enqueue a callback for an element that is not
       // a custom element. We are done, nothing to do.
@@ -458,7 +427,7 @@ CustomElementRegistry::EnqueueLifecycleCallback(nsIDocument::ElementCallbackType
     nsCOMPtr<nsIAtom> typeAtom = elementData ?
       elementData->mType.get() : info->NameAtom();
 
-    definition = mCustomDefinitions.Get(typeAtom);
+    definition = mCustomDefinitions.GetWeak(typeAtom);
     if (!definition || definition->mLocalName != info->NameAtom()) {
       return;
     }
@@ -493,7 +462,8 @@ void
 CustomElementRegistry::GetCustomPrototype(nsIAtom* aAtom,
                                           JS::MutableHandle<JSObject*> aPrototype)
 {
-  mozilla::dom::CustomElementDefinition* definition = mCustomDefinitions.Get(aAtom);
+  mozilla::dom::CustomElementDefinition* definition =
+    mCustomDefinitions.GetWeak(aAtom);
   if (definition) {
     aPrototype.set(definition->mPrototype);
   } else {
@@ -631,7 +601,7 @@ CustomElementRegistry::Define(const nsAString& aName,
    * 3. If this CustomElementRegistry contains an entry with name name, then
    *    throw a "NotSupportedError" DOMException and abort these steps.
    */
-  if (mCustomDefinitions.Get(nameAtom)) {
+  if (mCustomDefinitions.GetWeak(nameAtom)) {
     aRv.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
     return;
   }
@@ -642,7 +612,7 @@ CustomElementRegistry::Define(const nsAString& aName,
    */
   const auto& ptr = mConstructors.lookup(constructorUnwrapped);
   if (ptr) {
-    MOZ_ASSERT(mCustomDefinitions.Get(ptr->value()),
+    MOZ_ASSERT(mCustomDefinitions.GetWeak(ptr->value()),
                "Definition must be found in mCustomDefinitions");
     aRv.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
     return;
@@ -834,7 +804,7 @@ CustomElementRegistry::Define(const nsAString& aName,
     return;
   }
 
-  CustomElementDefinition* definition =
+  RefPtr<CustomElementDefinition> definition =
     new CustomElementDefinition(nameAtom,
                                 localNameAtom,
                                 &aFunctionConstructor,
@@ -843,7 +813,8 @@ CustomElementRegistry::Define(const nsAString& aName,
                                 callbacks,
                                 0 /* TODO dependent on HTML imports. Bug 877072 */);
 
-  mCustomDefinitions.Put(nameAtom, definition);
+  CustomElementDefinition* def = definition.get();
+  mCustomDefinitions.Put(nameAtom, definition.forget());
 
   MOZ_ASSERT(mCustomDefinitions.Count() == mConstructors.count(),
              "Number of entries should be the same");
@@ -851,7 +822,7 @@ CustomElementRegistry::Define(const nsAString& aName,
   /**
    * 13. 14. 15. Upgrade candidates
    */
-  UpgradeCandidates(nameAtom, definition, aRv);
+  UpgradeCandidates(nameAtom, def, aRv);
 
   /**
    * 16. If this CustomElementRegistry's when-defined promise map contains an
@@ -874,7 +845,7 @@ CustomElementRegistry::Get(JSContext* aCx, const nsAString& aName,
                            JS::MutableHandle<JS::Value> aRetVal)
 {
   nsCOMPtr<nsIAtom> nameAtom(NS_Atomize(aName));
-  CustomElementDefinition* data = mCustomDefinitions.Get(nameAtom);
+  CustomElementDefinition* data = mCustomDefinitions.GetWeak(nameAtom);
 
   if (!data) {
     aRetVal.setUndefined();
@@ -900,7 +871,7 @@ CustomElementRegistry::WhenDefined(const nsAString& aName, ErrorResult& aRv)
     return promise.forget();
   }
 
-  if (mCustomDefinitions.Get(nameAtom)) {
+  if (mCustomDefinitions.GetWeak(nameAtom)) {
     promise->MaybeResolve(JS::UndefinedHandleValue);
     return promise.forget();
   }
@@ -1004,6 +975,9 @@ CustomElementRegistry::Upgrade(Element* aElement,
   // Step 8.
   data->mState = CustomElementData::State::eCustom;
 
+  // Step 9.
+  aElement->SetCustomElementDefinition(aDefinition);
+
   // This is for old spec.
   nsContentUtils::EnqueueLifecycleCallback(aElement->OwnerDoc(),
                                            nsIDocument::eCreated,
@@ -1156,6 +1130,50 @@ CustomElementReactionsStack::InvokeReactions(ElementQueue* aElementQueue,
 //-----------------------------------------------------
 // CustomElementDefinition
 
+NS_IMPL_CYCLE_COLLECTION_CLASS(CustomElementDefinition)
+
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(CustomElementDefinition)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mConstructor)
+  tmp->mPrototype = nullptr;
+  tmp->mCallbacks = nullptr;
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(CustomElementDefinition)
+  mozilla::dom::LifecycleCallbacks* callbacks = tmp->mCallbacks.get();
+
+  if (callbacks->mAttributeChangedCallback.WasPassed()) {
+    NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb,
+      "mCallbacks->mAttributeChangedCallback");
+    cb.NoteXPCOMChild(callbacks->mAttributeChangedCallback.Value());
+  }
+
+  if (callbacks->mCreatedCallback.WasPassed()) {
+    NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mCallbacks->mCreatedCallback");
+    cb.NoteXPCOMChild(callbacks->mCreatedCallback.Value());
+  }
+
+  if (callbacks->mAttachedCallback.WasPassed()) {
+    NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mCallbacks->mAttachedCallback");
+    cb.NoteXPCOMChild(callbacks->mAttachedCallback.Value());
+  }
+
+  if (callbacks->mDetachedCallback.WasPassed()) {
+    NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mCallbacks->mDetachedCallback");
+    cb.NoteXPCOMChild(callbacks->mDetachedCallback.Value());
+  }
+
+  NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mConstructor");
+  cb.NoteXPCOMChild(tmp->mConstructor);
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+
+NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN(CustomElementDefinition)
+  NS_IMPL_CYCLE_COLLECTION_TRACE_JS_MEMBER_CALLBACK(mPrototype)
+NS_IMPL_CYCLE_COLLECTION_TRACE_END
+
+NS_IMPL_CYCLE_COLLECTION_ROOT_NATIVE(CustomElementDefinition, AddRef)
+NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(CustomElementDefinition, Release)
+
+
 CustomElementDefinition::CustomElementDefinition(nsIAtom* aType,
                                                  nsIAtom* aLocalName,
                                                  Function* aConstructor,
diff --git a/dom/base/CustomElementRegistry.h b/dom/base/CustomElementRegistry.h
index bf8c46448681..3ec4baf7f280 100644
--- a/dom/base/CustomElementRegistry.h
+++ b/dom/base/CustomElementRegistry.h
@@ -14,7 +14,9 @@
 #include "mozilla/dom/BindingDeclarations.h"
 #include "mozilla/dom/Element.h"
 #include "mozilla/dom/FunctionBinding.h"
+#include "mozilla/dom/WebComponentsBinding.h"
 #include "nsCycleCollectionParticipant.h"
+#include "nsGenericHTMLElement.h"
 #include "nsWrapperCache.h"
 #include "nsContentUtils.h"
 
@@ -25,7 +27,6 @@ namespace dom {
 
 struct CustomElementData;
 struct ElementDefinitionOptions;
-struct LifecycleCallbacks;
 class CallbackFunction;
 class CustomElementReaction;
 class Function;
@@ -117,6 +118,22 @@ struct CustomElementData
   // e.g., create an element, insert a node.
   AutoTArray<UniquePtr<CustomElementReaction>, 3> mReactionQueue;
 
+  RefPtr<CustomElementDefinition> mCustomElementDefinition;
+
+  void
+  SetCustomElementDefinition(CustomElementDefinition* aDefinition)
+  {
+    MOZ_ASSERT(!mCustomElementDefinition);
+
+    mCustomElementDefinition = aDefinition;
+  }
+
+  CustomElementDefinition*
+  GetCustomElementDefinition()
+  {
+    return mCustomElementDefinition;
+  }
+
 private:
   virtual ~CustomElementData() {}
 };
@@ -127,6 +144,9 @@ private:
 // https://html.spec.whatwg.org/multipage/scripting.html#custom-element-definition
 struct CustomElementDefinition
 {
+  NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_NATIVE_CLASS(CustomElementDefinition)
+  NS_INLINE_DECL_CYCLE_COLLECTING_NATIVE_REFCOUNTING(CustomElementDefinition)
+
   CustomElementDefinition(nsIAtom* aType,
                           nsIAtom* aLocalName,
                           Function* aConstructor,
@@ -172,6 +192,9 @@ struct CustomElementDefinition
 
     return mObservedAttributes.Contains(aName);
   }
+
+private:
+  ~CustomElementDefinition() {}
 };
 
 class CustomElementReaction
@@ -394,7 +417,7 @@ private:
                          CustomElementDefinition* aDefinition,
                          ErrorResult& aRv);
 
-  typedef nsClassHashtable<nsISupportsHashKey, CustomElementDefinition>
+  typedef nsRefPtrHashtable<nsISupportsHashKey, CustomElementDefinition>
     DefinitionMap;
   typedef nsClassHashtable<nsISupportsHashKey, nsTArray<nsWeakPtr>>
     CandidateMap;
diff --git a/dom/base/Element.cpp b/dom/base/Element.cpp
index 8bde05023cfd..dd52f9053981 100644
--- a/dom/base/Element.cpp
+++ b/dom/base/Element.cpp
@@ -4214,6 +4214,26 @@ Element::SetCustomElementData(CustomElementData* aData)
   slots->mCustomElementData = aData;
 }
 
+CustomElementDefinition*
+Element::GetCustomElementDefinition() const
+{
+  CustomElementData* data = GetCustomElementData();
+  if (!data) {
+    return nullptr;
+  }
+
+  return data->GetCustomElementDefinition();
+}
+
+void
+Element::SetCustomElementDefinition(CustomElementDefinition* aDefinition)
+{
+  CustomElementData* data = GetCustomElementData();
+  MOZ_ASSERT(data);
+
+  data->SetCustomElementDefinition(aDefinition);
+}
+
 MOZ_DEFINE_MALLOC_SIZE_OF(ServoElementMallocSizeOf)
 MOZ_DEFINE_MALLOC_ENCLOSING_SIZE_OF(ServoElementMallocEnclosingSizeOf)
 
diff --git a/dom/base/Element.h b/dom/base/Element.h
index 83735d24fc08..58e4d3e1ce0e 100644
--- a/dom/base/Element.h
+++ b/dom/base/Element.h
@@ -553,6 +553,22 @@ public:
    */
   void SetCustomElementData(CustomElementData* aData);
 
+  /**
+   * Gets the custom element definition used by web components custom element.
+   *
+   * @return The custom element definition or null if element is not a custom
+   *         element or custom element is not defined yet.
+   */
+  CustomElementDefinition* GetCustomElementDefinition() const;
+
+  /**
+   * Sets the custom element definition, called when custom element is created
+   * or upgraded.
+   *
+   * @param aDefinition The custom element definition.
+   */
+  void SetCustomElementDefinition(CustomElementDefinition* aDefinition);
+
 protected:
   /**
    * Method to get the _intrinsic_ content state of this element.  This is the
diff --git a/dom/base/FragmentOrElement.cpp b/dom/base/FragmentOrElement.cpp
index 41b8066b3ec3..cd606b5792e4 100644
--- a/dom/base/FragmentOrElement.cpp
+++ b/dom/base/FragmentOrElement.cpp
@@ -812,6 +812,13 @@ FragmentOrElement::nsDOMSlots::Traverse(nsCycleCollectionTraversalCallback &cb)
         mExtendedSlots->mCustomElementData->mReactionQueue[i]->Traverse(cb);
       }
     }
+
+    if (mExtendedSlots->mCustomElementData->mCustomElementDefinition) {
+      NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb,
+        "mExtendedSlots->mCustomElementData->mCustomElementDefinition");
+      cb.NoteNativeChild(mExtendedSlots->mCustomElementData->mCustomElementDefinition,
+        NS_CYCLE_COLLECTION_PARTICIPANT(CustomElementDefinition));
+    }
   }
 
   for (auto iter = mExtendedSlots->mRegisteredIntersectionObservers.Iter();
@@ -848,7 +855,12 @@ FragmentOrElement::nsDOMSlots::Unlink()
   mExtendedSlots->mContainingShadow = nullptr;
   MOZ_ASSERT(!(mExtendedSlots->mXBLBinding));
   mExtendedSlots->mXBLInsertionParent = nullptr;
-  mExtendedSlots->mCustomElementData = nullptr;
+  if (mExtendedSlots->mCustomElementData) {
+    if (mExtendedSlots->mCustomElementData->mCustomElementDefinition) {
+      mExtendedSlots->mCustomElementData->mCustomElementDefinition = nullptr;
+    }
+    mExtendedSlots->mCustomElementData = nullptr;
+  }
   mExtendedSlots->mRegisteredIntersectionObservers.Clear();
   nsCOMPtr<nsIFrameLoader> frameLoader =
     do_QueryInterface(mExtendedSlots->mFrameLoaderOrOpener);
diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
index e9a1c3922085..825c97389543 100644
--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -6313,7 +6313,8 @@ nsDocument::CustomElementConstructor(JSContext* aCx, unsigned aArgc, JS::Value*
   }
 
   nsCOMPtr<nsIAtom> typeAtom(NS_Atomize(elemName));
-  CustomElementDefinition* definition = registry->mCustomDefinitions.Get(typeAtom);
+  CustomElementDefinition* definition =
+    registry->mCustomDefinitions.GetWeak(typeAtom);
   if (!definition) {
     return true;
   }
@@ -6383,6 +6384,8 @@ nsDocument::CustomElementConstructor(JSContext* aCx, unsigned aArgc, JS::Value*
       new CustomElementData(definition->mType,
                             CustomElementData::State::eCustom));
 
+    element->SetCustomElementDefinition(definition);
+
     // It'll be removed when we deprecate custom elements v0.
     nsContentUtils::SyncInvokeReactions(nsIDocument::eCreated, element,
                                         definition);
diff --git a/dom/bindings/BindingUtils.cpp b/dom/bindings/BindingUtils.cpp
index 0a90d1ff2e2b..9b8c3f58e666 100644
--- a/dom/bindings/BindingUtils.cpp
+++ b/dom/bindings/BindingUtils.cpp
@@ -3682,6 +3682,8 @@ CreateHTMLElement(const GlobalObject& aGlobal, const JS::CallArgs& aCallArgs,
     newElement->SetCustomElementData(
       new CustomElementData(definition->mType, CustomElementData::State::eCustom));
 
+    newElement->SetCustomElementDefinition(definition);
+
     return newElement.forget();
   }
 

From 2d66d1067a2d0f70c05c95225eb9a1c3c6e76b45 Mon Sep 17 00:00:00 2001
From: Jessica Jong <jjong@mozilla.com>
Date: Mon, 25 Sep 2017 02:47:00 -0400
Subject: [PATCH 08/29] Bug 1392970 - Part 2: Get CustomElementDefinition from
 CustomElementData when possible. r=smaug

MozReview-Commit-ID: L6DCtGXBesX
---
 dom/base/CustomElementRegistry.cpp | 66 ++++++++++++------------------
 dom/base/nsContentUtils.cpp        |  7 +---
 2 files changed, 27 insertions(+), 46 deletions(-)

diff --git a/dom/base/CustomElementRegistry.cpp b/dom/base/CustomElementRegistry.cpp
index 037ca52321b5..c609dfa92d1e 100644
--- a/dom/base/CustomElementRegistry.cpp
+++ b/dom/base/CustomElementRegistry.cpp
@@ -36,8 +36,20 @@ CustomElementCallback::Call()
       // enqueue attached callback for ELEMENT.
       nsIDocument* document = mThisObject->GetComposedDoc();
       if (document && document->GetDocShell()) {
+        NodeInfo* ni = mThisObject->NodeInfo();
+        nsDependentAtomString extType(mOwnerData->mType);
+
+        // We need to do this because at this point, CustomElementDefinition is
+        // not set to CustomElementData yet, so EnqueueLifecycleCallback will
+        // fail to find the CE definition for this custom element.
+        // This will go away eventually since there is no created callback in v1.
+        CustomElementDefinition* definition =
+          nsContentUtils::LookupCustomElementDefinition(document,
+            ni->LocalName(), ni->NamespaceID(),
+            extType.IsEmpty() ? nullptr : &extType);
+
         nsContentUtils::EnqueueLifecycleCallback(
-          document, nsIDocument::eAttached, mThisObject);
+          document, nsIDocument::eAttached, mThisObject, nullptr, definition);
       }
 
       static_cast<LifecycleCreatedCallback *>(mCallback.get())->Call(mThisObject, rv);
@@ -314,51 +326,35 @@ CustomElementRegistry::CreateCustomElementCallback(
   nsIDocument::ElementCallbackType aType, Element* aCustomElement,
   LifecycleCallbackArgs* aArgs, CustomElementDefinition* aDefinition)
 {
+  MOZ_ASSERT(aDefinition, "CustomElementDefinition should not be null");
+
   RefPtr<CustomElementData> elementData = aCustomElement->GetCustomElementData();
   MOZ_ASSERT(elementData, "CustomElementData should exist");
 
-  // Let DEFINITION be ELEMENT's definition
-  CustomElementDefinition* definition = aDefinition;
-  if (!definition) {
-    mozilla::dom::NodeInfo* info = aCustomElement->NodeInfo();
-
-    // Make sure we get the correct definition in case the element
-    // is a extended custom element e.g. <button is="x-button">.
-    nsCOMPtr<nsIAtom> typeAtom = elementData ?
-      elementData->mType.get() : info->NameAtom();
-
-    definition = mCustomDefinitions.GetWeak(typeAtom);
-    if (!definition || definition->mLocalName != info->NameAtom()) {
-      // Trying to enqueue a callback for an element that is not
-      // a custom element. We are done, nothing to do.
-      return nullptr;
-    }
-  }
-
   // Let CALLBACK be the callback associated with the key NAME in CALLBACKS.
   CallbackFunction* func = nullptr;
   switch (aType) {
     case nsIDocument::eCreated:
-      if (definition->mCallbacks->mCreatedCallback.WasPassed()) {
-        func = definition->mCallbacks->mCreatedCallback.Value();
+      if (aDefinition->mCallbacks->mCreatedCallback.WasPassed()) {
+        func = aDefinition->mCallbacks->mCreatedCallback.Value();
       }
       break;
 
     case nsIDocument::eAttached:
-      if (definition->mCallbacks->mAttachedCallback.WasPassed()) {
-        func = definition->mCallbacks->mAttachedCallback.Value();
+      if (aDefinition->mCallbacks->mAttachedCallback.WasPassed()) {
+        func = aDefinition->mCallbacks->mAttachedCallback.Value();
       }
       break;
 
     case nsIDocument::eDetached:
-      if (definition->mCallbacks->mDetachedCallback.WasPassed()) {
-        func = definition->mCallbacks->mDetachedCallback.Value();
+      if (aDefinition->mCallbacks->mDetachedCallback.WasPassed()) {
+        func = aDefinition->mCallbacks->mDetachedCallback.Value();
       }
       break;
 
     case nsIDocument::eAttributeChanged:
-      if (definition->mCallbacks->mAttributeChangedCallback.WasPassed()) {
-        func = definition->mCallbacks->mAttributeChangedCallback.Value();
+      if (aDefinition->mCallbacks->mAttributeChangedCallback.WasPassed()) {
+        func = aDefinition->mCallbacks->mAttributeChangedCallback.Value();
       }
       break;
   }
@@ -414,21 +410,11 @@ CustomElementRegistry::EnqueueLifecycleCallback(nsIDocument::ElementCallbackType
                                                 LifecycleCallbackArgs* aArgs,
                                                 CustomElementDefinition* aDefinition)
 {
-  RefPtr<CustomElementData> elementData = aCustomElement->GetCustomElementData();
-  MOZ_ASSERT(elementData, "CustomElementData should exist");
-
-  // Let DEFINITION be ELEMENT's definition
   CustomElementDefinition* definition = aDefinition;
   if (!definition) {
-    mozilla::dom::NodeInfo* info = aCustomElement->NodeInfo();
-
-    // Make sure we get the correct definition in case the element
-    // is a extended custom element e.g. <button is="x-button">.
-    nsCOMPtr<nsIAtom> typeAtom = elementData ?
-      elementData->mType.get() : info->NameAtom();
-
-    definition = mCustomDefinitions.GetWeak(typeAtom);
-    if (!definition || definition->mLocalName != info->NameAtom()) {
+    definition = aCustomElement->GetCustomElementDefinition();
+    if (!definition ||
+        definition->mLocalName != aCustomElement->NodeInfo()->NameAtom()) {
       return;
     }
   }
diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp
index 93e58deaffc4..264f236b3f2d 100644
--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@@ -10122,13 +10122,8 @@ nsContentUtils::GetElementDefinitionIfObservingAttr(Element* aCustomElement,
                                                     nsIAtom* aExtensionType,
                                                     nsIAtom* aAttrName)
 {
-  nsString extType = nsDependentAtomString(aExtensionType);
-  NodeInfo *ni = aCustomElement->NodeInfo();
-
   CustomElementDefinition* definition =
-    LookupCustomElementDefinition(aCustomElement->OwnerDoc(), ni->LocalName(),
-                                  ni->NamespaceID(),
-                                  extType.IsEmpty() ? nullptr : &extType);
+    aCustomElement->GetCustomElementDefinition();
 
   // Custom element not defined yet or attribute is not in the observed
   // attribute list.

From 1acc8a8271eff531846d9ac8c3e9a9a9c243e526 Mon Sep 17 00:00:00 2001
From: Kim Moir <kmoir@mozilla.com>
Date: Mon, 25 Sep 2017 16:44:54 -0400
Subject: [PATCH 09/29] Bug 1402955 - Fix bouncer_firefox_beta.py syntax.
 r=rail DONTBUILD

MozReview-Commit-ID: 1vsc16wC7hO

--HG--
extra : rebase_source : 5ffbf596d68dabf3e21e111dd9dd0681523217ea
---
 testing/mozharness/configs/releases/bouncer_firefox_beta.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/testing/mozharness/configs/releases/bouncer_firefox_beta.py b/testing/mozharness/configs/releases/bouncer_firefox_beta.py
index 823d4ce70447..01acaa47387d 100644
--- a/testing/mozharness/configs/releases/bouncer_firefox_beta.py
+++ b/testing/mozharness/configs/releases/bouncer_firefox_beta.py
@@ -106,7 +106,6 @@ config = {
             },
         },
     },
-    },
     "partials": {
         "releases-dir": {
             "product-name": "Firefox-%(version)s-Partial-%(prev_version)s",

From ccdca224ca1f82a2935ee927b49bcb8c5b800cbb Mon Sep 17 00:00:00 2001
From: Sebastian Hengst <archaeopteryx@coole-files.de>
Date: Mon, 25 Sep 2017 22:53:35 +0200
Subject: [PATCH 10/29] Backed out changeset 86d7b2f346f0 (bug 1401319) for
 running and failing modified tests. r=backout

---
 js/src/tests/js1_5/Array/regress-157652.js   |  2 +-
 js/src/tests/js1_5/Regress/regress-422348.js |  2 +-
 js/src/tests/lib/manifest.py                 | 12 ++++--------
 3 files changed, 6 insertions(+), 10 deletions(-)

diff --git a/js/src/tests/js1_5/Array/regress-157652.js b/js/src/tests/js1_5/Array/regress-157652.js
index 00dca0b9443d..6916fe1790d4 100644
--- a/js/src/tests/js1_5/Array/regress-157652.js
+++ b/js/src/tests/js1_5/Array/regress-157652.js
@@ -1,4 +1,4 @@
-// |reftest| skip-if(xulRuntime.is64Bit||Android) -- No test results
+// |reftest| skip-if(xulRuntime.XPCOMABI.match(/x86_64|aarch64|ppc64|ppc64le|s390x/)||Android) -- No test results
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
diff --git a/js/src/tests/js1_5/Regress/regress-422348.js b/js/src/tests/js1_5/Regress/regress-422348.js
index c1839b5e1adf..7ae83f4a6c8e 100644
--- a/js/src/tests/js1_5/Regress/regress-422348.js
+++ b/js/src/tests/js1_5/Regress/regress-422348.js
@@ -1,4 +1,4 @@
-// |reftest| skip-if(xulRuntime.is64Bit) -- On 64-bit, takes forever rather than throwing
+// |reftest| skip-if(xulRuntime.XPCOMABI.match(/x86_64|aarch64|ppc64|ppc64le|s390x/)) -- On 64-bit, takes forever rather than throwing
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
diff --git a/js/src/tests/lib/manifest.py b/js/src/tests/lib/manifest.py
index ced06e096cc1..4828736342c3 100644
--- a/js/src/tests/lib/manifest.py
+++ b/js/src/tests/lib/manifest.py
@@ -21,10 +21,9 @@ def split_path_into_dirs(path):
     return dirs
 
 class XULInfo:
-    def __init__(self, abi, os, is64Bit, isdebug):
+    def __init__(self, abi, os, isdebug):
         self.abi = abi
         self.os = os
-        self.is64Bit = is64Bit
         self.isdebug = isdebug
         self.browserIsRemote = False
 
@@ -32,12 +31,11 @@ class XULInfo:
         """Return JS that when executed sets up variables so that JS expression
         predicates on XUL build info evaluate properly."""
 
-        return ('var xulRuntime = {{ OS: "{}", is64Bit: {}, XPCOMABI: "{}", shell: true }};'
+        return ('var xulRuntime = {{ OS: "{}", XPCOMABI: "{}", shell: true }};'
                 'var release_or_beta = getBuildConfiguration().release_or_beta;'
                 'var isDebugBuild={}; var Android={}; '
                 'var browserIsRemote={}'.format(
                     self.os,
-                    "true" if self.is64Bit else "false",
                     self.abi,
                     str(self.isdebug).lower(),
                     str(self.os == "Android").lower(),
@@ -66,8 +64,8 @@ class XULInfo:
             sys.exit(1)
 
         # Read the values.
-        val_re = re.compile(r'(TARGET_XPCOM_ABI|OS_TARGET|MOZ_DEBUG|HAVE_64BIT_BUILD)\s*=\s*(.*)')
-        kw = {'isdebug': False, 'is64Bit': False}
+        val_re = re.compile(r'(TARGET_XPCOM_ABI|OS_TARGET|MOZ_DEBUG)\s*=\s*(.*)')
+        kw = {'isdebug': False}
         for line in open(path):
             m = val_re.match(line)
             if m:
@@ -77,8 +75,6 @@ class XULInfo:
                     kw['abi'] = val
                 if key == 'OS_TARGET':
                     kw['os'] = val
-                if key == 'HAVE_64BIT_BUILD':
-                    kw['is64Bit'] = (val == '1')
                 if key == 'MOZ_DEBUG':
                     kw['isdebug'] = (val == '1')
         return cls(**kw)

From afddc5d2030ed45a441643d063fb25c10ad671b5 Mon Sep 17 00:00:00 2001
From: Towkir Ahmed <towkir17@gmail.com>
Date: Mon, 25 Sep 2017 23:42:03 +0200
Subject: [PATCH 11/29] Bug 1394933 - Bookmarks toolbar dropzone icon updated;
 r=dao

MozReview-Commit-ID: A9vO96djx99

--HG--
rename : browser/themes/shared/icons/toolbar.svg => browser/themes/shared/icons/bookmarks-toolbar.svg
---
 browser/themes/shared/icons/bookmarks-toolbar.svg | 7 +++++++
 browser/themes/shared/icons/toolbar.svg           | 6 ------
 browser/themes/shared/jar.inc.mn                  | 2 +-
 browser/themes/shared/menupanel.inc.css           | 2 +-
 browser/themes/shared/toolbarbutton-icons.inc.css | 2 +-
 5 files changed, 10 insertions(+), 9 deletions(-)
 create mode 100644 browser/themes/shared/icons/bookmarks-toolbar.svg
 delete mode 100644 browser/themes/shared/icons/toolbar.svg

diff --git a/browser/themes/shared/icons/bookmarks-toolbar.svg b/browser/themes/shared/icons/bookmarks-toolbar.svg
new file mode 100644
index 000000000000..c418162a5beb
--- /dev/null
+++ b/browser/themes/shared/icons/bookmarks-toolbar.svg
@@ -0,0 +1,7 @@
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16">
+  <path d="M13 1H3a3 3 0 0 0-3 3v8a3 3 0 0 0 3 3h11a2 2 0 0 0 2-2V4a3 3 0 0 0-3-3zm1 11a1 1 0 0 1-1 1H3a1 1 0 0 1-1-1V4a1 1 0 0 1 1-1h10a1 1 0 0 1 1 1z"/>
+  <path d="M9.466 6.269l-.964-1.934-.185-.305-.662.028-1.101 2.211-2.039.364-.329.084-.184.613L5.67 9.123 5.365 11.3l-.023.351.552.356 2.116-1.102 1.844.96.319.138.525-.395-.347-2.485 1.462-1.573.214-.268-.227-.596-2.334-.417z"/>
+</svg>
diff --git a/browser/themes/shared/icons/toolbar.svg b/browser/themes/shared/icons/toolbar.svg
deleted file mode 100644
index f1f635c15d78..000000000000
--- a/browser/themes/shared/icons/toolbar.svg
+++ /dev/null
@@ -1,6 +0,0 @@
-<!-- This Source Code Form is subject to the terms of the Mozilla Public
-   - License, v. 2.0. If a copy of the MPL was not distributed with this
-   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
-<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16">
-  <path fill="context-fill" fill-opacity="context-fill-opacity" d="M13 1H3a3.007 3.007 0 0 0-3 3v8a3.009 3.009 0 0 0 3 3h10a3.005 3.005 0 0 0 3-3V4a3.012 3.012 0 0 0-3-3zM3 3h10a1 1 0 0 1 1 1v1H2V4a1 1 0 0 1 1-1zm11 3v1H2V6zm-1 7H3a1 1 0 0 1-1-1V8h12v4a1 1 0 0 1-1 1z"/>
-</svg>
diff --git a/browser/themes/shared/jar.inc.mn b/browser/themes/shared/jar.inc.mn
index 4a27b4d834a6..5bb84f1e768b 100644
--- a/browser/themes/shared/jar.inc.mn
+++ b/browser/themes/shared/jar.inc.mn
@@ -170,7 +170,7 @@
   skin/classic/browser/stop-to-reload.svg             (../shared/icons/stop-to-reload.svg)
   skin/classic/browser/sync.svg                       (../shared/icons/sync.svg)
   skin/classic/browser/synced-tabs.svg                (../shared/icons/synced-tabs.svg)
-  skin/classic/browser/toolbar.svg                    (../shared/icons/toolbar.svg)
+  skin/classic/browser/bookmarks-toolbar.svg          (../shared/icons/bookmarks-toolbar.svg)
   skin/classic/browser/webIDE.svg                     (../shared/icons/webIDE.svg)
   skin/classic/browser/window.svg                     (../shared/icons/window.svg)
   skin/classic/browser/zoom-in.svg                    (../shared/icons/zoom-in.svg)
diff --git a/browser/themes/shared/menupanel.inc.css b/browser/themes/shared/menupanel.inc.css
index 65208d162d56..bf57a024540c 100644
--- a/browser/themes/shared/menupanel.inc.css
+++ b/browser/themes/shared/menupanel.inc.css
@@ -97,7 +97,7 @@
 }
 
 #panelMenu_viewBookmarksToolbar {
-  list-style-image: url("chrome://browser/skin/toolbar.svg");
+  list-style-image: url("chrome://browser/skin/bookmarks-toolbar.svg");
 }
 
 #appMenu-library-bookmarks-button,
diff --git a/browser/themes/shared/toolbarbutton-icons.inc.css b/browser/themes/shared/toolbarbutton-icons.inc.css
index 904db14a7b3c..e9038108a13a 100644
--- a/browser/themes/shared/toolbarbutton-icons.inc.css
+++ b/browser/themes/shared/toolbarbutton-icons.inc.css
@@ -186,7 +186,7 @@ toolbar[brighttext] {
 
 #bookmarks-toolbar-button,
 #bookmarks-toolbar-placeholder {
-  list-style-image: url("chrome://browser/skin/bookmark-hollow.svg");
+  list-style-image: url("chrome://browser/skin/bookmarks-toolbar.svg");
 }
 
 #bookmarks-menu-button {

From 8e30ba31d05cef9404c1bf6b8f7246c5be277076 Mon Sep 17 00:00:00 2001
From: Michael Layzell <michael@thelayzells.com>
Date: Thu, 7 Sep 2017 17:05:51 -0400
Subject: [PATCH 12/29] Bug 1384915 - Part 1: Refactor RangeBoundary out of
 nsRange so it can be used by other classes, r=masayuki

---
 dom/base/RangeBoundary.h | 243 +++++++++++++++++++++++++++++++++++++++
 dom/base/moz.build       |   1 +
 dom/base/nsRange.cpp     |   6 +-
 dom/base/nsRange.h       | 212 +---------------------------------
 4 files changed, 249 insertions(+), 213 deletions(-)
 create mode 100644 dom/base/RangeBoundary.h

diff --git a/dom/base/RangeBoundary.h b/dom/base/RangeBoundary.h
new file mode 100644
index 000000000000..f632e3488e9d
--- /dev/null
+++ b/dom/base/RangeBoundary.h
@@ -0,0 +1,243 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_RangeBoundary_h
+#define mozilla_RangeBoundary_h
+
+namespace mozilla {
+
+// This class will maintain a reference to the child immediately
+// before the boundary's offset. We try to avoid computing the
+// offset as much as possible and just ensure mRef points to the
+// correct child.
+//
+// mParent
+//    |
+// [child0] [child1] [child2]
+//            /      |
+//         mRef    mOffset=2
+//
+// If mOffset == 0, mRef is null.
+// For text nodes, mRef will always be null and the offset will
+// be kept up-to-date.
+
+template<typename ParentType, typename RefType>
+class RangeBoundaryBase;
+
+typedef RangeBoundaryBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent>> RangeBoundary;
+typedef RangeBoundaryBase<nsINode*, nsIContent*> RawRangeBoundary;
+
+// This class has two specializations, one using reference counting
+// pointers and one using raw pointers. This helps us avoid unnecessary
+// AddRef/Release calls.
+template<typename ParentType, typename RefType>
+class RangeBoundaryBase
+{
+  template<typename T, typename U>
+  friend class RangeBoundaryBase;
+
+  friend void ImplCycleCollectionTraverse(nsCycleCollectionTraversalCallback&,
+                                          RangeBoundary&, const char*,
+                                          uint32_t);
+  friend void ImplCycleCollectionUnlink(RangeBoundary&);
+
+public:
+  RangeBoundaryBase(nsINode* aContainer, nsIContent* aRef)
+    : mParent(aContainer)
+    , mRef(aRef)
+  {
+    if (!mRef) {
+      mOffset = mozilla::Some(0);
+    } else {
+      mOffset.reset();
+    }
+  }
+
+  RangeBoundaryBase(nsINode* aContainer, int32_t aOffset)
+    : mParent(aContainer)
+    , mRef(nullptr)
+    , mOffset(mozilla::Some(aOffset))
+  {
+    if (mParent && mParent->IsContainerNode()) {
+      // Find a reference node
+      if (aOffset == static_cast<int32_t>(aContainer->GetChildCount())) {
+        mRef = aContainer->GetLastChild();
+      } else if (aOffset != 0) {
+        mRef = mParent->GetChildAt(aOffset - 1);
+        MOZ_ASSERT(mRef);
+      }
+
+      MOZ_ASSERT_IF(!mRef, aOffset == 0);
+    }
+
+    MOZ_ASSERT_IF(mRef, mRef->GetParentNode() == mParent);
+  }
+
+  RangeBoundaryBase()
+    : mParent(nullptr)
+    , mRef(nullptr)
+  {
+  }
+
+  // Needed for initializing RawRangeBoundary from an existing RangeBoundary.
+  template<typename PT, typename RT>
+  explicit RangeBoundaryBase(const RangeBoundaryBase<PT, RT>& aOther)
+    : mParent(aOther.mParent)
+    , mRef(aOther.mRef)
+    , mOffset(aOther.mOffset)
+  {
+  }
+
+  nsIContent*
+  Ref() const
+  {
+    return mRef;
+  }
+
+  nsINode*
+  Container() const
+  {
+    return mParent;
+  }
+
+  nsIContent*
+  GetChildAtOffset() const
+  {
+    if (!mParent || !mParent->IsContainerNode()) {
+      return nullptr;
+    }
+    if (!mRef) {
+      MOZ_ASSERT(Offset() == 0);
+      return mParent->GetFirstChild();
+    }
+    MOZ_ASSERT(mParent->GetChildAt(Offset()) == mRef->GetNextSibling());
+    return mRef->GetNextSibling();
+  }
+
+  uint32_t
+  Offset() const
+  {
+    if (mOffset.isSome()) {
+      return mOffset.value();
+    }
+
+    if (!mParent) {
+      return 0;
+    }
+
+    MOZ_ASSERT(mRef);
+    MOZ_ASSERT(mRef->GetParentNode() == mParent);
+    mOffset = mozilla::Some(mParent->IndexOf(mRef) + 1);
+
+    return mOffset.value();
+  }
+
+  void
+  InvalidateOffset()
+  {
+    MOZ_ASSERT(mParent);
+    MOZ_ASSERT(mParent->IsContainerNode(), "Range is positioned on a text node!");
+
+    if (!mRef) {
+      MOZ_ASSERT(mOffset.isSome() && mOffset.value() == 0);
+      return;
+    }
+    mOffset.reset();
+  }
+
+  void
+  Set(nsINode* aContainer, int32_t aOffset)
+  {
+    mParent = aContainer;
+    if (mParent && mParent->IsContainerNode()) {
+      // Find a reference node
+      if (aOffset == static_cast<int32_t>(aContainer->GetChildCount())) {
+        mRef = aContainer->GetLastChild();
+      } else if (aOffset == 0) {
+        mRef = nullptr;
+      } else {
+        mRef = mParent->GetChildAt(aOffset - 1);
+        MOZ_ASSERT(mRef);
+      }
+
+      MOZ_ASSERT_IF(!mRef, aOffset == 0);
+    } else {
+      mRef = nullptr;
+    }
+
+    mOffset = mozilla::Some(aOffset);
+    MOZ_ASSERT_IF(mRef, mRef->GetParentNode() == mParent);
+  }
+
+  void
+  SetAfterRef(nsINode* aParent, nsIContent* aRef)
+  {
+    mParent = aParent;
+    mRef = aRef;
+    if (!mRef) {
+      mOffset = mozilla::Some(0);
+    } else {
+      mOffset.reset();
+    }
+  }
+
+  bool
+  IsSet() const
+  {
+    return mParent && (mRef || mOffset.isSome());
+  }
+
+  // Convenience methods for switching between the two types
+  // of RangeBoundary.
+  RangeBoundaryBase<nsINode*, nsIContent*>
+  AsRaw() const
+  {
+    return RangeBoundaryBase<nsINode*, nsIContent*>(*this);
+  }
+
+  template<typename A, typename B>
+  RangeBoundaryBase& operator=(const RangeBoundaryBase<A,B>& aOther)
+  {
+    mParent = aOther.mParent;
+    mRef = aOther.mRef;
+    mOffset = aOther.mOffset;
+    return *this;
+  }
+
+  template<typename A, typename B>
+  bool operator==(const RangeBoundaryBase<A, B>& aOther) const
+  {
+    return mParent == aOther.mParent &&
+      (mRef ? mRef == aOther.mRef : mOffset == aOther.mOffset);
+  }
+
+private:
+  ParentType mParent;
+  RefType mRef;
+
+  mutable mozilla::Maybe<uint32_t> mOffset;
+};
+
+inline void
+ImplCycleCollectionUnlink(RangeBoundary& aField)
+{
+  ImplCycleCollectionUnlink(aField.mParent);
+  ImplCycleCollectionUnlink(aField.mRef);
+}
+
+inline void
+ImplCycleCollectionTraverse(nsCycleCollectionTraversalCallback& aCallback,
+                            RangeBoundary& aField,
+                            const char* aName,
+                            uint32_t aFlags)
+{
+  ImplCycleCollectionTraverse(aCallback, aField.mParent, "mParent", 0);
+  ImplCycleCollectionTraverse(aCallback, aField.mRef, "mRef", 0);
+}
+
+} // namespace mozilla
+
+#endif // defined(mozilla_RangeBoundary_h)
diff --git a/dom/base/moz.build b/dom/base/moz.build
index 347656e0526b..53ffd47d5c5f 100644
--- a/dom/base/moz.build
+++ b/dom/base/moz.build
@@ -140,6 +140,7 @@ EXPORTS.mozilla += [
     'CORSMode.h',
     'FeedWriterEnabled.h',
     'FlushType.h',
+    'RangeBoundary.h',
     'TextInputProcessor.h',
     'UseCounter.h',
 ]
diff --git a/dom/base/nsRange.cpp b/dom/base/nsRange.cpp
index 8221450b828b..52b5e9dd652f 100644
--- a/dom/base/nsRange.cpp
+++ b/dom/base/nsRange.cpp
@@ -357,10 +357,8 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsRange)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mOwner)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mStart.mParent)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mStart.mRef)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mEnd.mParent)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mEnd.mRef)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mStart)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mEnd)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mRoot)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mSelection)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
diff --git a/dom/base/nsRange.h b/dom/base/nsRange.h
index ee509b32b9f6..531c844dbae6 100644
--- a/dom/base/nsRange.h
+++ b/dom/base/nsRange.h
@@ -23,6 +23,7 @@
 #include "mozilla/Attributes.h"
 #include "mozilla/GuardObjects.h"
 #include "mozilla/LinkedList.h"
+#include "mozilla/RangeBoundary.h"
 
 namespace mozilla {
 class ErrorResult;
@@ -44,6 +45,8 @@ class nsRange final : public nsIDOMRange,
   typedef mozilla::ErrorResult ErrorResult;
   typedef mozilla::dom::DOMRect DOMRect;
   typedef mozilla::dom::DOMRectList DOMRectList;
+  typedef mozilla::RangeBoundary RangeBoundary;
+  typedef mozilla::RawRangeBoundary RawRangeBoundary;
 
   virtual ~nsRange();
 
@@ -412,215 +415,6 @@ public:
   typedef nsTHashtable<nsPtrHashKey<nsRange> > RangeHashTable;
 protected:
 
-  // This class has two specializations, one using reference counting
-  // pointers and one using raw pointers. This helps us avoid unnecessary
-  // AddRef/Release calls.
-  template<typename ParentType, typename RefType>
-  class RangeBoundaryBase
-  {
-    // This class will maintain a reference to the child immediately
-    // before the boundary's offset. We try to avoid computing the
-    // offset as much as possible and just ensure mRef points to the
-    // correct child.
-    //
-    // mParent
-    //    |
-    // [child0] [child1] [child2]
-    //            /      |
-    //         mRef    mOffset=2
-    //
-    // If mOffset == 0, mRef is null.
-    // For text nodes, mRef will always be null and the offset will
-    // be kept up-to-date.
-
-    // for cycle collecting mParent and mRef;
-    friend class nsRange;
-
-  public:
-    RangeBoundaryBase(nsINode* aContainer, nsIContent* aRef)
-      : mParent(aContainer)
-      , mRef(aRef)
-    {
-      if (!mRef) {
-        mOffset = mozilla::Some(0);
-      } else {
-        mOffset.reset();
-      }
-    }
-
-    RangeBoundaryBase(nsINode* aContainer, int32_t aOffset)
-      : mParent(aContainer)
-      , mRef(nullptr)
-      , mOffset(mozilla::Some(aOffset))
-    {
-      if (mParent && mParent->IsContainerNode()) {
-        // Find a reference node
-        if (aOffset == static_cast<int32_t>(aContainer->GetChildCount())) {
-          mRef = aContainer->GetLastChild();
-        } else if (aOffset != 0) {
-          mRef = mParent->GetChildAt(aOffset - 1);
-          MOZ_ASSERT(mRef);
-        }
-
-        MOZ_ASSERT_IF(!mRef, aOffset == 0);
-      }
-
-      MOZ_ASSERT_IF(mRef, mRef->GetParentNode() == mParent);
-    }
-
-    RangeBoundaryBase()
-      : mParent(nullptr)
-      , mRef(nullptr)
-    {
-    }
-
-    // Needed for initializing RawRangeBoundary from an existing RangeBoundary.
-    explicit RangeBoundaryBase(const RangeBoundaryBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent>>& aOther)
-      : mParent(aOther.mParent)
-      , mRef(aOther.mRef)
-      , mOffset(aOther.mOffset)
-    {
-    }
-
-    nsIContent*
-    Ref() const
-    {
-      return mRef;
-    }
-
-    nsINode*
-    Container() const
-    {
-      return mParent;
-    }
-
-    nsIContent*
-    GetChildAtOffset() const
-    {
-      if (!mParent || !mParent->IsContainerNode()) {
-        return nullptr;
-      }
-      if (!mRef) {
-        MOZ_ASSERT(Offset() == 0);
-        return mParent->GetFirstChild();
-      }
-      MOZ_ASSERT(mParent->GetChildAt(Offset()) == mRef->GetNextSibling());
-      return mRef->GetNextSibling();
-    }
-
-    uint32_t
-    Offset() const
-    {
-      if (mOffset.isSome()) {
-        return mOffset.value();
-      }
-
-      if (!mParent) {
-        return 0;
-      }
-
-      MOZ_ASSERT(mRef);
-      MOZ_ASSERT(mRef->GetParentNode() == mParent);
-      mOffset = mozilla::Some(mParent->IndexOf(mRef) + 1);
-
-      return mOffset.value();
-    }
-
-    void
-    InvalidateOffset()
-    {
-      MOZ_ASSERT(mParent);
-      MOZ_ASSERT(mParent->IsContainerNode(), "Range is positioned on a text node!");
-
-      if (!mRef) {
-        MOZ_ASSERT(mOffset.isSome() && mOffset.value() == 0);
-        return;
-      }
-      mOffset.reset();
-    }
-
-    void
-    AdjustOffset(int32_t aDelta)
-    {
-      MOZ_ASSERT(mRef);
-      mOffset = mozilla::Some(Offset() + aDelta);
-    }
-
-    void
-    Set(nsINode* aContainer, int32_t aOffset)
-    {
-      mParent = aContainer;
-      if (mParent && mParent->IsContainerNode()) {
-        // Find a reference node
-        if (aOffset == static_cast<int32_t>(aContainer->GetChildCount())) {
-          mRef = aContainer->GetLastChild();
-        } else if (aOffset == 0) {
-          mRef = nullptr;
-        } else {
-          mRef = mParent->GetChildAt(aOffset - 1);
-          MOZ_ASSERT(mRef);
-        }
-
-        MOZ_ASSERT_IF(!mRef, aOffset == 0);
-      } else {
-        mRef = nullptr;
-      }
-
-      mOffset = mozilla::Some(aOffset);
-      MOZ_ASSERT_IF(mRef, mRef->GetParentNode() == mParent);
-    }
-
-    void
-    SetAfterRef(nsINode* aParent, nsIContent* aRef)
-    {
-      mParent = aParent;
-      mRef = aRef;
-      if (!mRef) {
-        mOffset = mozilla::Some(0);
-      } else {
-        mOffset.reset();
-      }
-    }
-
-    bool
-    IsSet() const
-    {
-      return mParent && (mRef || mOffset.isSome());
-    }
-
-    // Convenience methods for switching between the two types
-    // of RangeBoundary.
-    RangeBoundaryBase<nsINode*, nsIContent*>
-    AsRaw() const
-    {
-      return RangeBoundaryBase<nsINode*, nsIContent*>(*this);
-    }
-
-    template<typename A, typename B>
-    RangeBoundaryBase& operator=(const RangeBoundaryBase<A,B>& aOther)
-    {
-      // Since the member variables may be nsCOMPtrs, better to try to avoid
-      // extra Release/AddRef calls.
-      if (mParent != aOther.mParent) {
-        mParent = aOther.mParent;
-      }
-      if (mRef != aOther.mRef) {
-        mRef = aOther.mRef;
-      }
-      mOffset = aOther.mOffset;
-      return *this;
-    }
-
-  private:
-    ParentType mParent;
-    RefType mRef;
-
-    mutable mozilla::Maybe<uint32_t> mOffset;
-  };
-
-  typedef RangeBoundaryBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent>> RangeBoundary;
-  typedef RangeBoundaryBase<nsINode*, nsIContent*> RawRangeBoundary;
-
   void RegisterCommonAncestor(nsINode* aNode);
   void UnregisterCommonAncestor(nsINode* aNode, bool aIsUnlinking);
   nsINode* IsValidBoundary(nsINode* aNode) const

From 9601431bf25abbbf9761d1a13a2d9a1c2707b3f7 Mon Sep 17 00:00:00 2001
From: Michael Layzell <michael@thelayzells.com>
Date: Fri, 8 Sep 2017 11:19:19 -0400
Subject: [PATCH 13/29] Bug 1384915 - Part 2: Make NodePosition a wrapper
 around RangeBoundary, r=masayuki

---
 dom/base/RangeBoundary.h           |  13 ++++
 dom/events/ContentEventHandler.cpp | 101 +++++++++++++++--------------
 dom/events/ContentEventHandler.h   |  74 ++++++++++-----------
 3 files changed, 100 insertions(+), 88 deletions(-)

diff --git a/dom/base/RangeBoundary.h b/dom/base/RangeBoundary.h
index f632e3488e9d..fa28d0e2d531 100644
--- a/dom/base/RangeBoundary.h
+++ b/dom/base/RangeBoundary.h
@@ -190,6 +190,19 @@ public:
     return mParent && (mRef || mOffset.isSome());
   }
 
+  bool
+  IsSetAndValid() const
+  {
+    if (!IsSet()) {
+      return false;
+    }
+
+    if (Ref()) {
+      return Ref()->GetParentNode() == Container();
+    }
+    return Offset() <= Container()->Length();
+  }
+
   // Convenience methods for switching between the two types
   // of RangeBoundary.
   RangeBoundaryBase<nsINode*, nsIContent*>
diff --git a/dom/events/ContentEventHandler.cpp b/dom/events/ContentEventHandler.cpp
index 474ada152f8b..c21befd9449e 100644
--- a/dom/events/ContentEventHandler.cpp
+++ b/dom/events/ContentEventHandler.cpp
@@ -1615,8 +1615,8 @@ ContentEventHandler::NodePosition
 ContentEventHandler::GetNodePositionHavingFlatText(
                        const NodePosition& aNodePosition)
 {
-  return GetNodePositionHavingFlatText(aNodePosition.mNode,
-                                       aNodePosition.mOffset);
+  return GetNodePositionHavingFlatText(aNodePosition.Container(),
+                                       aNodePosition.Offset());
 }
 
 ContentEventHandler::NodePosition
@@ -1644,10 +1644,11 @@ ContentEventHandler::GetNodePositionHavingFlatText(nsINode* aNode,
   // child of it.  For example, if a range is |<p>[<br>]</p>|, then, the
   // end point is {<p>, 1}.  In such case, callers need the <br> node.
   if (aNodeOffset == childCount) {
-    NodePosition result;
-    result.mNode = aNode->GetChildAt(childCount - 1);
-    result.mOffset = result.mNode->IsNodeOfType(nsINode::eTEXT) ?
-      static_cast<int32_t>(result.mNode->AsContent()->TextLength()) : 1;
+    nsINode* node = aNode->GetChildAt(childCount - 1);
+    return NodePosition(node,
+      node->IsNodeOfType(nsINode::eTEXT)
+        ? static_cast<int32_t>(node->AsContent()->TextLength())
+        : 1);
   }
 
   NS_WARNING("aNodeOffset is invalid value");
@@ -1681,8 +1682,7 @@ ContentEventHandler::GetFirstFrameInRangeForTextRect(const RawRange& aRawRange)
       int32_t offsetInNode =
         node == aRawRange.GetStartContainer() ? aRawRange.StartOffset() : 0;
       if (static_cast<uint32_t>(offsetInNode) < node->Length()) {
-        nodePosition.mNode = node;
-        nodePosition.mOffset = offsetInNode;
+        nodePosition.Set(node, offsetInNode);
         break;
       }
       continue;
@@ -1692,19 +1692,18 @@ ContentEventHandler::GetFirstFrameInRangeForTextRect(const RawRange& aRawRange)
     // node causing text.
     if (ShouldBreakLineBefore(node->AsContent(), mRootContent) ||
         IsMozBR(node->AsContent())) {
-      nodePosition.mNode = node;
-      nodePosition.mOffset = 0;
+      nodePosition.Set(node, 0);
     }
   }
 
-  if (!nodePosition.IsValid()) {
+  if (!nodePosition.IsSet()) {
     return FrameAndNodeOffset();
   }
 
   nsIFrame* firstFrame = nullptr;
-  GetFrameForTextRect(nodePosition.mNode, nodePosition.mOffset,
+  GetFrameForTextRect(nodePosition.Container(), nodePosition.Offset(),
                       true, &firstFrame);
-  return FrameAndNodeOffset(firstFrame, nodePosition.mOffset);
+  return FrameAndNodeOffset(firstFrame, nodePosition.Offset());
 }
 
 ContentEventHandler::FrameAndNodeOffset
@@ -1761,17 +1760,19 @@ ContentEventHandler::GetLastFrameInRangeForTextRect(const RawRange& aRawRange)
     }
 
     if (node->IsNodeOfType(nsINode::eTEXT)) {
-      nodePosition.mNode = node;
+      uint32_t offset;
       if (node == aRawRange.GetEndContainer()) {
-        nodePosition.mOffset = aRawRange.EndOffset();
+        offset = aRawRange.EndOffset();
       } else {
-        nodePosition.mOffset = node->Length();
+        offset = node->Length();
       }
+      nodePosition.Set(node, offset);
+
       // If the text node is empty or the last node of the range but the index
       // is 0, we should store current position but continue looking for
       // previous node (If there are no nodes before it, we should use current
       // node position for returning its frame).
-      if (!nodePosition.mOffset) {
+      if (!nodePosition.Offset()) {
         continue;
       }
       break;
@@ -1779,18 +1780,18 @@ ContentEventHandler::GetLastFrameInRangeForTextRect(const RawRange& aRawRange)
 
     if (ShouldBreakLineBefore(node->AsContent(), mRootContent) ||
         IsMozBR(node->AsContent())) {
-      nodePosition.mNode = node;
-      nodePosition.mOffset = 0;
+      nodePosition.Set(node, 0);
       break;
     }
   }
 
-  if (!nodePosition.IsValid()) {
+  if (!nodePosition.IsSet()) {
     return FrameAndNodeOffset();
   }
 
   nsIFrame* lastFrame = nullptr;
-  GetFrameForTextRect(nodePosition.mNode, nodePosition.mOffset,
+  GetFrameForTextRect(nodePosition.Container(),
+                      nodePosition.Offset(),
                       true, &lastFrame);
   if (!lastFrame) {
     return FrameAndNodeOffset();
@@ -1800,7 +1801,7 @@ ContentEventHandler::GetLastFrameInRangeForTextRect(const RawRange& aRawRange)
   // includes at least one character in the range.  Therefore, if it's not a
   // text frame, we need to do nothing anymore.
   if (!lastFrame->IsTextFrame()) {
-    return FrameAndNodeOffset(lastFrame, nodePosition.mOffset);
+    return FrameAndNodeOffset(lastFrame, nodePosition.Offset());
   }
 
   int32_t start, end;
@@ -1812,15 +1813,16 @@ ContentEventHandler::GetLastFrameInRangeForTextRect(const RawRange& aRawRange)
   // node and it's not 0, the frame shouldn't be added to the text rect.  So,
   // this should return previous text frame and its last offset if there is
   // at least one text frame.
-  if (nodePosition.mOffset && nodePosition.mOffset == start) {
-    GetFrameForTextRect(nodePosition.mNode, --nodePosition.mOffset,
-                        true, &lastFrame);
+  if (nodePosition.Offset() && nodePosition.Offset() == static_cast<uint32_t>(start)) {
+    nodePosition.Set(nodePosition.Container(), nodePosition.Offset() - 1);
+    GetFrameForTextRect(nodePosition.Container(), nodePosition.Offset(), true,
+                        &lastFrame);
     if (NS_WARN_IF(!lastFrame)) {
       return FrameAndNodeOffset();
     }
   }
 
-  return FrameAndNodeOffset(lastFrame, nodePosition.mOffset);
+  return FrameAndNodeOffset(lastFrame, nodePosition.Offset());
 }
 
 ContentEventHandler::FrameRelativeRect
@@ -2873,8 +2875,8 @@ ContentEventHandler::GetFlatTextLengthInRange(
                        LineBreakType aLineBreakType,
                        bool aIsRemovingNode /* = false */)
 {
-  if (NS_WARN_IF(!aRootContent) || NS_WARN_IF(!aStartPosition.IsValid()) ||
-      NS_WARN_IF(!aEndPosition.IsValid()) || NS_WARN_IF(!aLength)) {
+  if (NS_WARN_IF(!aRootContent) || NS_WARN_IF(!aStartPosition.IsSet()) ||
+      NS_WARN_IF(!aEndPosition.IsSet()) || NS_WARN_IF(!aLength)) {
     return NS_ERROR_INVALID_ARG;
   }
 
@@ -2896,49 +2898,50 @@ ContentEventHandler::GetFlatTextLengthInRange(
   // be called after here.  However, the node was already removed from the
   // array of children of its parent.  So, be careful to handle this case.
   if (aIsRemovingNode) {
-    DebugOnly<nsIContent*> parent = aStartPosition.mNode->GetParent();
-    MOZ_ASSERT(parent && parent->IndexOf(aStartPosition.mNode) == -1,
+    DebugOnly<nsIContent*> parent = aStartPosition.Container()->GetParent();
+    MOZ_ASSERT(parent && parent->IndexOf(aStartPosition.Container()) == -1,
       "At removing the node, the node shouldn't be in the array of children "
       "of its parent");
-    MOZ_ASSERT(aStartPosition.mNode == endPosition.mNode,
+    MOZ_ASSERT(aStartPosition.Container() == endPosition.Container(),
       "At removing the node, start and end node should be same");
-    MOZ_ASSERT(aStartPosition.mOffset == 0,
+    MOZ_ASSERT(aStartPosition.Offset() == 0,
       "When the node is being removed, the start offset should be 0");
-    MOZ_ASSERT(static_cast<uint32_t>(endPosition.mOffset) ==
-                 endPosition.mNode->GetChildCount(),
+    MOZ_ASSERT(static_cast<uint32_t>(endPosition.Offset()) ==
+                 endPosition.Container()->GetChildCount(),
       "When the node is being removed, the end offset should be child count");
     iter = NS_NewPreContentIterator();
-    nsresult rv = iter->Init(aStartPosition.mNode);
+    nsresult rv = iter->Init(aStartPosition.Container());
     if (NS_WARN_IF(NS_FAILED(rv))) {
       return rv;
     }
   } else {
     RawRange prevRawRange;
     nsresult rv =
-      prevRawRange.SetStart(aStartPosition.mNode, aStartPosition.mOffset);
+      prevRawRange.SetStart(aStartPosition.Container(),
+                            aStartPosition.Offset());
     if (NS_WARN_IF(NS_FAILED(rv))) {
       return rv;
     }
 
     // When the end position is immediately after non-root element's open tag,
     // we need to include a line break caused by the open tag.
-    if (endPosition.mNode != aRootContent &&
+    if (endPosition.Container() != aRootContent &&
         endPosition.IsImmediatelyAfterOpenTag()) {
-      if (endPosition.mNode->HasChildren()) {
+      if (endPosition.Container()->HasChildren()) {
         // When the end node has some children, move the end position to before
         // the open tag of its first child.
-        nsINode* firstChild = endPosition.mNode->GetFirstChild();
+        nsINode* firstChild = endPosition.Container()->GetFirstChild();
         if (NS_WARN_IF(!firstChild)) {
           return NS_ERROR_FAILURE;
         }
         endPosition = NodePositionBefore(firstChild, 0);
       } else {
         // When the end node is empty, move the end position after the node.
-        nsIContent* parentContent = endPosition.mNode->GetParent();
+        nsIContent* parentContent = endPosition.Container()->GetParent();
         if (NS_WARN_IF(!parentContent)) {
           return NS_ERROR_FAILURE;
         }
-        int32_t indexInParent = parentContent->IndexOf(endPosition.mNode);
+        int32_t indexInParent = parentContent->IndexOf(endPosition.Container());
         if (NS_WARN_IF(indexInParent < 0)) {
           return NS_ERROR_FAILURE;
         }
@@ -2946,9 +2949,9 @@ ContentEventHandler::GetFlatTextLengthInRange(
       }
     }
 
-    if (endPosition.OffsetIsValid()) {
+    if (endPosition.IsSetAndValid()) {
       // Offset is within node's length; set end of range to that offset
-      rv = prevRawRange.SetEnd(endPosition.mNode, endPosition.mOffset);
+      rv = prevRawRange.SetEnd(endPosition.Container(), endPosition.Offset());
       if (NS_WARN_IF(NS_FAILED(rv))) {
         return rv;
       }
@@ -2959,9 +2962,9 @@ ContentEventHandler::GetFlatTextLengthInRange(
       if (NS_WARN_IF(NS_FAILED(rv))) {
         return rv;
       }
-    } else if (endPosition.mNode != aRootContent) {
+    } else if (endPosition.Container() != aRootContent) {
       // Offset is past node's length; set end of range to end of node
-      rv = prevRawRange.SetEndAfter(endPosition.mNode);
+      rv = prevRawRange.SetEndAfter(endPosition.Container());
       if (NS_WARN_IF(NS_FAILED(rv))) {
         return rv;
       }
@@ -2995,21 +2998,21 @@ ContentEventHandler::GetFlatTextLengthInRange(
 
     if (node->IsNodeOfType(nsINode::eTEXT)) {
       // Note: our range always starts from offset 0
-      if (node == endPosition.mNode) {
+      if (node == endPosition.Container()) {
         *aLength += GetTextLength(content, aLineBreakType,
-                                  endPosition.mOffset);
+                                  endPosition.Offset());
       } else {
         *aLength += GetTextLength(content, aLineBreakType);
       }
     } else if (ShouldBreakLineBefore(content, aRootContent)) {
       // If the start position is start of this node but doesn't include the
       // open tag, don't append the line break length.
-      if (node == aStartPosition.mNode && !aStartPosition.IsBeforeOpenTag()) {
+      if (node == aStartPosition.Container() && !aStartPosition.IsBeforeOpenTag()) {
         continue;
       }
       // If the end position is before the open tag, don't append the line
       // break length.
-      if (node == endPosition.mNode && endPosition.IsBeforeOpenTag()) {
+      if (node == endPosition.Container() && endPosition.IsBeforeOpenTag()) {
         continue;
       }
       *aLength += GetBRLength(aLineBreakType);
diff --git a/dom/events/ContentEventHandler.h b/dom/events/ContentEventHandler.h
index 5ad54439c4ac..b75150350391 100644
--- a/dom/events/ContentEventHandler.h
+++ b/dom/events/ContentEventHandler.h
@@ -163,76 +163,72 @@ public:
   // When mNode is an element and mOffset is 0, the start position means after
   // the open tag of mNode.
   // This is useful to receive one or more sets of them instead of nsRange.
-  struct NodePosition
+  // This type is intended to be used for short-lived operations, and is thus
+  // marked MOZ_STACK_CLASS.
+  struct MOZ_STACK_CLASS NodePosition : public RangeBoundary
   {
-    nsCOMPtr<nsINode> mNode;
-    int32_t mOffset;
     // Only when mNode is an element node and mOffset is 0, mAfterOpenTag is
     // referred.
-    bool mAfterOpenTag;
+    bool mAfterOpenTag = true;
 
     NodePosition()
-      : mOffset(-1)
-      , mAfterOpenTag(true)
+      : RangeBoundary()
     {
     }
 
-    NodePosition(nsINode* aNode, int32_t aOffset)
-      : mNode(aNode)
-      , mOffset(aOffset)
-      , mAfterOpenTag(true)
+    NodePosition(nsINode* aContainer, int32_t aOffset)
+      : RangeBoundary(aContainer, aOffset)
+    {
+    }
+
+    NodePosition(nsINode* aContainer, nsIContent* aRef)
+      : RangeBoundary(aContainer, aRef)
     {
     }
 
     explicit NodePosition(const nsIFrame::ContentOffsets& aContentOffsets)
-      : mNode(aContentOffsets.content)
-      , mOffset(aContentOffsets.offset)
-      , mAfterOpenTag(true)
-    {
-    }
-
-  protected:
-    NodePosition(nsINode* aNode, int32_t aOffset, bool aAfterOpenTag)
-      : mNode(aNode)
-      , mOffset(aOffset)
-      , mAfterOpenTag(aAfterOpenTag)
+      : RangeBoundary(aContentOffsets.content, aContentOffsets.offset)
     {
     }
 
   public:
     bool operator==(const NodePosition& aOther) const
     {
-      return mNode == aOther.mNode &&
-             mOffset == aOther.mOffset &&
-             mAfterOpenTag == aOther.mAfterOpenTag;
+      return RangeBoundary::operator==(aOther) &&
+        mAfterOpenTag == aOther.mAfterOpenTag;
     }
 
-    bool IsValid() const
-    {
-      return mNode && mOffset >= 0;
-    }
-    bool OffsetIsValid() const
-    {
-      return IsValid() && static_cast<uint32_t>(mOffset) <= mNode->Length();
-    }
     bool IsBeforeOpenTag() const
     {
-      return IsValid() && mNode->IsElement() && !mOffset && !mAfterOpenTag;
+      return IsSet() &&
+        Container()->IsElement() &&
+        !Ref() &&
+        !mAfterOpenTag;
     }
     bool IsImmediatelyAfterOpenTag() const
     {
-      return IsValid() && mNode->IsElement() && !mOffset && mAfterOpenTag;
+      return IsSet() &&
+        Container()->IsElement() &&
+        !Ref() &&
+        mAfterOpenTag;
     }
   };
 
-  // NodePositionBefore isn't good name if mNode isn't an element node nor
-  // mOffset is not 0, though, when mNode is an element node and mOffset is 0,
-  // this is treated as before the open tag of mNode.
+  // NodePositionBefore isn't good name if Container() isn't an element node nor
+  // Offset() is not 0, though, when Container() is an element node and mOffset
+  // is 0, this is treated as before the open tag of Container().
   struct NodePositionBefore final : public NodePosition
   {
-    NodePositionBefore(nsINode* aNode, int32_t aOffset)
-      : NodePosition(aNode, aOffset, false)
+    NodePositionBefore(nsINode* aContainer, int32_t aOffset)
+      : NodePosition(aContainer, aOffset)
     {
+      mAfterOpenTag = false;
+    }
+
+    NodePositionBefore(nsINode* aContainer, nsIContent* aRef)
+      : NodePosition(aContainer, aRef)
+    {
+      mAfterOpenTag = false;
     }
   };
 

From 74e8b70a80748836ce9c8112c42b32ef1957e237 Mon Sep 17 00:00:00 2001
From: Michael Layzell <michael@thelayzells.com>
Date: Wed, 6 Sep 2017 13:47:09 -0400
Subject: [PATCH 14/29] Bug 1384915 - Part 3: Avoid using node indices in
 IMEContentObserver, r=masayuki

MozReview-Commit-ID: 4iaNideXEFl
---
 dom/events/IMEContentObserver.cpp | 157 ++++++++++++++++--------------
 dom/events/IMEContentObserver.h   |  65 +++++++------
 2 files changed, 117 insertions(+), 105 deletions(-)

diff --git a/dom/events/IMEContentObserver.cpp b/dom/events/IMEContentObserver.cpp
index 29030490150b..520783642ed5 100644
--- a/dom/events/IMEContentObserver.cpp
+++ b/dom/events/IMEContentObserver.cpp
@@ -48,6 +48,29 @@ ToChar(bool aBool)
   return aBool ? "true" : "false";
 }
 
+// This method determines the node to use for the point before the current node.
+// If you have the following aContent and aContainer, and want to represent the
+// following point for `NodePosition` or `RangeBoundary`:
+//
+// <parent> {node} {node} | {node} </parent>
+//  ^                     ^     ^
+// aContainer           point  aContent
+//
+// This function will shift `aContent` to the left into the format which
+// `NodePosition` and `RangeBoundary` use:
+//
+// <parent> {node} {node} | {node} </parent>
+//  ^               ^     ^
+// aContainer    result  point
+static nsIContent*
+PointBefore(nsINode* aContainer, nsIContent* aContent)
+{
+  if (aContent) {
+    return aContent->GetPreviousSibling();
+  }
+  return aContainer->GetLastChild();
+}
+
 class WritingModeToString final : public nsAutoCString
 {
 public:
@@ -123,8 +146,8 @@ public:
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(IMEContentObserver)
 
-// Note that we don't need to add mFirstAddedNodeContainer nor
-// mLastAddedNodeContainer to cycle collection because they are non-null only
+// Note that we don't need to add mFirstAddedContainer nor
+// mLastAddedContainer to cycle collection because they are non-null only
 // during short time and shouldn't be touched while they are non-null.
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(IMEContentObserver)
@@ -174,9 +197,7 @@ NS_IMPL_CYCLE_COLLECTING_ADDREF(IMEContentObserver)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(IMEContentObserver)
 
 IMEContentObserver::IMEContentObserver()
-  : mFirstAddedNodeOffset(0)
-  , mLastAddedNodeOffset(0)
-  , mESM(nullptr)
+  : mESM(nullptr)
   , mIMENotificationRequests(nullptr)
   , mSuppressNotifications(0)
   , mPreCharacterDataChangeLength(-1)
@@ -1001,13 +1022,16 @@ IMEContentObserver::CharacterDataChanged(nsIDocument* aDocument,
 
 void
 IMEContentObserver::NotifyContentAdded(nsINode* aContainer,
-                                       int32_t aStartIndex,
-                                       int32_t aEndIndex)
+                                       nsIContent* aFirstContent,
+                                       nsIContent* aLastContent)
 {
   if (!NeedsTextChangeNotification()) {
     return;
   }
 
+  MOZ_ASSERT_IF(aFirstContent, aFirstContent->GetParentNode() == aContainer);
+  MOZ_ASSERT_IF(aLastContent, aLastContent->GetParentNode() == aContainer);
+
   mStartOfRemovingTextRangeCache.Clear();
 
   // If it's in a document change, nodes are added consecutively.  Therefore,
@@ -1019,9 +1043,9 @@ IMEContentObserver::NotifyContentAdded(nsINode* aContainer,
     // the last node in mEndOfAddedTextCache.  Clear it.
     mEndOfAddedTextCache.Clear();
     if (!HasAddedNodesDuringDocumentChange()) {
-      mFirstAddedNodeContainer = mLastAddedNodeContainer = aContainer;
-      mFirstAddedNodeOffset = aStartIndex;
-      mLastAddedNodeOffset = aEndIndex;
+      mFirstAddedContainer = mLastAddedContainer = aContainer;
+      mFirstAddedContent = aFirstContent;
+      mLastAddedContent = aLastContent;
       MOZ_LOG(sIMECOLog, LogLevel::Debug,
         ("0x%p IMEContentObserver::NotifyContentAdded(), starts to store "
          "consecutive added nodes", this));
@@ -1030,17 +1054,17 @@ IMEContentObserver::NotifyContentAdded(nsINode* aContainer,
     // If first node being added is not next node of the last node,
     // notify IME of the previous range first, then, restart to cache the
     // range.
-    if (NS_WARN_IF(!IsNextNodeOfLastAddedNode(aContainer, aStartIndex))) {
+    if (NS_WARN_IF(!IsNextNodeOfLastAddedNode(aContainer, aFirstContent))) {
       // Flush the old range first.
       MaybeNotifyIMEOfAddedTextDuringDocumentChange();
-      mFirstAddedNodeContainer = aContainer;
-      mFirstAddedNodeOffset = aStartIndex;
+      mFirstAddedContainer = aContainer;
+      mFirstAddedContent = aFirstContent;
       MOZ_LOG(sIMECOLog, LogLevel::Debug,
         ("0x%p IMEContentObserver::NotifyContentAdded(), starts to store "
          "consecutive added nodes", this));
     }
-    mLastAddedNodeContainer = aContainer;
-    mLastAddedNodeOffset = aEndIndex;
+    mLastAddedContainer = aContainer;
+    mLastAddedContent = aLastContent;
     return;
   }
   MOZ_ASSERT(!HasAddedNodesDuringDocumentChange(),
@@ -1048,11 +1072,14 @@ IMEContentObserver::NotifyContentAdded(nsINode* aContainer,
 
   uint32_t offset = 0;
   nsresult rv = NS_OK;
-  if (!mEndOfAddedTextCache.Match(aContainer, aStartIndex)) {
+  if (!mEndOfAddedTextCache.Match(aContainer,
+                                  aFirstContent->GetPreviousSibling())) {
     mEndOfAddedTextCache.Clear();
     rv = ContentEventHandler::GetFlatTextLengthInRange(
                                 NodePosition(mRootContent, 0),
-                                NodePositionBefore(aContainer, aStartIndex),
+                                NodePositionBefore(aContainer,
+                                                   PointBefore(aContainer,
+                                                               aFirstContent)),
                                 mRootContent, &offset, LINE_BREAK_TYPE_NATIVE);
     if (NS_WARN_IF(NS_FAILED((rv)))) {
       return;
@@ -1064,8 +1091,10 @@ IMEContentObserver::NotifyContentAdded(nsINode* aContainer,
   // get offset at the end of the last added node
   uint32_t addingLength = 0;
   rv = ContentEventHandler::GetFlatTextLengthInRange(
-                              NodePositionBefore(aContainer, aStartIndex),
-                              NodePosition(aContainer, aEndIndex),
+                              NodePositionBefore(aContainer,
+                                                 PointBefore(aContainer,
+                                                             aFirstContent)),
+                              NodePosition(aContainer, aLastContent),
                               mRootContent, &addingLength,
                               LINE_BREAK_TYPE_NATIVE);
   if (NS_WARN_IF(NS_FAILED((rv)))) {
@@ -1077,7 +1106,7 @@ IMEContentObserver::NotifyContentAdded(nsINode* aContainer,
   // NotifyContentAdded() is for adding next node.  Therefore, caching the text
   // length can skip to compute the text length before the adding node and
   // before of it.
-  mEndOfAddedTextCache.Cache(aContainer, aEndIndex, offset + addingLength);
+  mEndOfAddedTextCache.Cache(aContainer, aLastContent, offset + addingLength);
 
   if (!addingLength) {
     return;
@@ -1093,27 +1122,27 @@ void
 IMEContentObserver::ContentAppended(nsIDocument* aDocument,
                                     nsIContent* aContainer,
                                     nsIContent* aFirstNewContent,
-                                    int32_t aNewIndexInContainer)
+                                    int32_t /* unused */)
 {
-  NotifyContentAdded(aContainer, aNewIndexInContainer,
-                     aContainer->GetChildCount());
+  NotifyContentAdded(NODE_FROM(aContainer, aDocument),
+                     aFirstNewContent, aContainer->GetLastChild());
 }
 
 void
 IMEContentObserver::ContentInserted(nsIDocument* aDocument,
                                     nsIContent* aContainer,
                                     nsIContent* aChild,
-                                    int32_t aIndexInContainer)
+                                    int32_t /* unused */)
 {
   NotifyContentAdded(NODE_FROM(aContainer, aDocument),
-                     aIndexInContainer, aIndexInContainer + 1);
+                     aChild, aChild);
 }
 
 void
 IMEContentObserver::ContentRemoved(nsIDocument* aDocument,
                                    nsIContent* aContainer,
                                    nsIContent* aChild,
-                                   int32_t aIndexInContainer,
+                                   int32_t /* unused */,
                                    nsIContent* aPreviousSibling)
 {
   if (!NeedsTextChangeNotification()) {
@@ -1127,18 +1156,19 @@ IMEContentObserver::ContentRemoved(nsIDocument* aDocument,
 
   uint32_t offset = 0;
   nsresult rv = NS_OK;
-  if (!mStartOfRemovingTextRangeCache.Match(containerNode, aIndexInContainer)) {
+  if (!mStartOfRemovingTextRangeCache.Match(containerNode, aPreviousSibling)) {
     // At removing a child node of aContainer, we need the line break caused
-    // by open tag of aContainer.  Be careful when aIndexInContainer is 0.
+    // by open tag of aContainer.  Be careful when aPreviousSibling is nullptr.
+
     rv = ContentEventHandler::GetFlatTextLengthInRange(
                                 NodePosition(mRootContent, 0),
-                                NodePosition(containerNode, aIndexInContainer),
+                                NodePosition(containerNode, aPreviousSibling),
                                 mRootContent, &offset, LINE_BREAK_TYPE_NATIVE);
     if (NS_WARN_IF(NS_FAILED(rv))) {
       mStartOfRemovingTextRangeCache.Clear();
       return;
     }
-    mStartOfRemovingTextRangeCache.Cache(containerNode, aIndexInContainer,
+    mStartOfRemovingTextRangeCache.Cache(containerNode, aPreviousSibling,
                                          offset);
   } else {
     offset = mStartOfRemovingTextRangeCache.mFlatTextLength;
@@ -1230,8 +1260,8 @@ IMEContentObserver::AttributeChanged(nsIDocument* aDocument,
 void
 IMEContentObserver::ClearAddedNodesDuringDocumentChange()
 {
-  mFirstAddedNodeContainer = mLastAddedNodeContainer = nullptr;
-  mFirstAddedNodeOffset = mLastAddedNodeOffset = 0;
+  mFirstAddedContainer = mLastAddedContainer = nullptr;
+  mFirstAddedContent = mLastAddedContent = nullptr;
   MOZ_LOG(sIMECOLog, LogLevel::Debug,
     ("0x%p IMEContentObserver::ClearAddedNodesDuringDocumentChange()"
      ", finished storing consecutive nodes", this));
@@ -1256,66 +1286,46 @@ IMEContentObserver::GetChildNode(nsINode* aParent, int32_t aOffset)
 
 bool
 IMEContentObserver::IsNextNodeOfLastAddedNode(nsINode* aParent,
-                                              int32_t aOffset) const
+                                              nsIContent* aChild) const
 {
   MOZ_ASSERT(aParent);
-  MOZ_ASSERT(aOffset >= 0 &&
-             aOffset <= static_cast<int32_t>(aParent->Length()));
+  MOZ_ASSERT(aChild && aChild->GetParentNode() == aParent);
   MOZ_ASSERT(mRootContent);
   MOZ_ASSERT(HasAddedNodesDuringDocumentChange());
 
-  // If the parent node isn't changed, we can check it only with offset.
-  if (aParent == mLastAddedNodeContainer) {
-    if (NS_WARN_IF(mLastAddedNodeOffset != aOffset)) {
+  // If the parent node isn't changed, we can check that mLastAddedContent has
+  // aChild as its next sibling.
+  if (aParent == mLastAddedContainer) {
+    if (NS_WARN_IF(mLastAddedContent->GetNextSibling() != aChild)) {
       return false;
     }
     return true;
   }
 
-  // If the parent node is changed, that means that given offset should be the
-  // last added node not having next sibling.
-  if (NS_WARN_IF(mLastAddedNodeOffset !=
-                   static_cast<int32_t>(mLastAddedNodeContainer->Length()))) {
+  // If the parent node is changed, that means that the recorded last added node
+  // shouldn't have a sibling.
+  if (NS_WARN_IF(mLastAddedContent->GetNextSibling())) {
     return false;
   }
 
-  // If the node is aParent is a descendant of mLastAddedNodeContainer,
-  // aOffset should be 0.
-  if (mLastAddedNodeContainer == aParent->GetParent()) {
-    if (NS_WARN_IF(aOffset)) {
+  // If the node is aParent is a descendant of mLastAddedContainer,
+  // aChild should be the first child in the new container.
+  if (mLastAddedContainer == aParent->GetParent()) {
+    if (NS_WARN_IF(aChild->GetPreviousSibling())) {
       return false;
     }
     return true;
   }
 
   // Otherwise, we need to check it even with slow path.
-  nsIContent* lastAddedContent =
-    GetChildNode(mLastAddedNodeContainer, mLastAddedNodeOffset - 1);
-  if (NS_WARN_IF(!lastAddedContent)) {
-    return false;
-  }
-
   nsIContent* nextContentOfLastAddedContent =
-    lastAddedContent->GetNextNode(mRootContent->GetParentNode());
+    mLastAddedContent->GetNextNode(mRootContent->GetParentNode());
   if (NS_WARN_IF(!nextContentOfLastAddedContent)) {
     return false;
   }
-
-  nsIContent* startContent = GetChildNode(aParent, aOffset);
-  if (NS_WARN_IF(!startContent) ||
-      NS_WARN_IF(nextContentOfLastAddedContent != startContent)) {
+  if (NS_WARN_IF(nextContentOfLastAddedContent != aChild)) {
     return false;
   }
-#ifdef DEBUG
-  NS_WARNING_ASSERTION(
-    !aOffset || aOffset == static_cast<int32_t>(aParent->Length() - 1),
-    "Used slow path for aParent");
-  NS_WARNING_ASSERTION(
-    !(mLastAddedNodeOffset - 1) ||
-    mLastAddedNodeOffset ==
-      static_cast<int32_t>(mLastAddedNodeContainer->Length()),
-    "Used slow path for mLastAddedNodeContainer");
-#endif // #ifdef DEBUG
   return true;
 }
 
@@ -1338,8 +1348,9 @@ IMEContentObserver::MaybeNotifyIMEOfAddedTextDuringDocumentChange()
   nsresult rv =
     ContentEventHandler::GetFlatTextLengthInRange(
                             NodePosition(mRootContent, 0),
-                            NodePosition(mFirstAddedNodeContainer,
-                                         mFirstAddedNodeOffset),
+                            NodePosition(mFirstAddedContainer,
+                                         PointBefore(mFirstAddedContainer,
+                                                     mFirstAddedContent)),
                             mRootContent, &offset, LINE_BREAK_TYPE_NATIVE);
   if (NS_WARN_IF(NS_FAILED(rv))) {
     ClearAddedNodesDuringDocumentChange();
@@ -1350,10 +1361,10 @@ IMEContentObserver::MaybeNotifyIMEOfAddedTextDuringDocumentChange()
   uint32_t length;
   rv =
     ContentEventHandler::GetFlatTextLengthInRange(
-                           NodePosition(mFirstAddedNodeContainer,
-                                        mFirstAddedNodeOffset),
-                           NodePosition(mLastAddedNodeContainer,
-                                        mLastAddedNodeOffset),
+                           NodePosition(mFirstAddedContainer,
+                                        PointBefore(mFirstAddedContainer,
+                                                    mFirstAddedContent)),
+                           NodePosition(mLastAddedContainer, mLastAddedContent),
                            mRootContent, &length, LINE_BREAK_TYPE_NATIVE);
   if (NS_WARN_IF(NS_FAILED(rv))) {
     ClearAddedNodesDuringDocumentChange();
diff --git a/dom/events/IMEContentObserver.h b/dom/events/IMEContentObserver.h
index 6b24606a84cc..0822012a9b29 100644
--- a/dom/events/IMEContentObserver.h
+++ b/dom/events/IMEContentObserver.h
@@ -202,9 +202,9 @@ private:
 
   /**
    * MaybeNotifyIMEOfAddedTextDuringDocumentChange() may send text change
-   * notification caused by the nodes added between mFirstAddedNodeOffset in
-   * mFirstAddedNodeContainer and mLastAddedNodeOffset in
-   * mLastAddedNodeContainer and forgets the range.
+   * notification caused by the nodes added between mFirstAddedContent in
+   * mFirstAddedContainer and mLastAddedContent in
+   * mLastAddedContainer and forgets the range.
    */
   void MaybeNotifyIMEOfAddedTextDuringDocumentChange();
 
@@ -232,15 +232,14 @@ private:
    */
   bool HasAddedNodesDuringDocumentChange() const
   {
-    return mFirstAddedNodeContainer && mLastAddedNodeContainer;
+    return mFirstAddedContainer && mLastAddedContainer;
   }
 
   /**
-   * Returns true if the node at aOffset in aParent is next node of the node at
-   * mLastAddedNodeOffset in mLastAddedNodeContainer in pre-order tree
-   * traversal of the DOM.
+   * Returns true if the passed-in node in aParent is the next node of
+   * mLastAddedContent in pre-order tree traversal of the DOM.
    */
-  bool IsNextNodeOfLastAddedNode(nsINode* aParent, int32_t aOffset) const;
+  bool IsNextNodeOfLastAddedNode(nsINode* aParent, nsIContent* aChild) const;
 
   void PostFocusSetNotification();
   void MaybeNotifyIMEOfFocusSet();
@@ -256,7 +255,9 @@ private:
   void CancelNotifyingIMEOfPositionChange();
   void PostCompositionEventHandledNotification();
 
-  void NotifyContentAdded(nsINode* aContainer, int32_t aStart, int32_t aEnd);
+  void NotifyContentAdded(nsINode* aContainer,
+                          nsIContent* aFirstContent,
+                          nsIContent* aLastContent);
   void ObserveEditableNode();
   /**
    *  NotifyIMEOfBlur() notifies IME of blur.
@@ -431,42 +432,43 @@ private:
    */
   struct FlatTextCache
   {
-    // mContainerNode and mNodeOffset represent a point in DOM tree.  E.g.,
-    // if mContainerNode is a div element, mNodeOffset is index of its child.
+    // mContainerNode and mNode represent a point in DOM tree.  E.g.,
+    // if mContainerNode is a div element, mNode is a child.
     nsCOMPtr<nsINode> mContainerNode;
-    int32_t mNodeOffset;
+    // mNode points to the last child which participates in the current
+    // mFlatTextLength. If mNode is null, then that means that the end point for
+    // mFlatTextLength is immediately before the first child of mContainerNode.
+    nsCOMPtr<nsINode> mNode;
     // Length of flat text generated from contents between the start of content
     // and a child node whose index is mNodeOffset of mContainerNode.
     uint32_t mFlatTextLength;
 
     FlatTextCache()
-      : mNodeOffset(0)
-      , mFlatTextLength(0)
+      : mFlatTextLength(0)
     {
     }
 
     void Clear()
     {
       mContainerNode = nullptr;
-      mNodeOffset = 0;
+      mNode = nullptr;
       mFlatTextLength = 0;
     }
 
-    void Cache(nsINode* aContainer, int32_t aNodeOffset,
+    void Cache(nsINode* aContainer, nsINode* aNode,
                uint32_t aFlatTextLength)
     {
       MOZ_ASSERT(aContainer, "aContainer must not be null");
-      MOZ_ASSERT(
-        aNodeOffset <= static_cast<int32_t>(aContainer->GetChildCount()),
-        "aNodeOffset must be same as or less than the count of children");
+      MOZ_ASSERT(!aNode || aNode->GetParentNode() == aContainer,
+                 "aNode must be either null or a child of aContainer");
       mContainerNode = aContainer;
-      mNodeOffset = aNodeOffset;
+      mNode = aNode;
       mFlatTextLength = aFlatTextLength;
     }
 
-    bool Match(nsINode* aContainer, int32_t aNodeOffset) const
+    bool Match(nsINode* aContainer, nsINode* aNode) const
     {
-      return aContainer == mContainerNode && aNodeOffset == mNodeOffset;
+      return aContainer == mContainerNode && aNode == mNode;
     }
   };
   // mEndOfAddedTextCache caches text length from the start of content to
@@ -479,26 +481,25 @@ private:
   // handled by the editor and no other mutation (e.g., adding node) occur.
   FlatTextCache mStartOfRemovingTextRangeCache;
 
-  // mFirstAddedNodeContainer is parent node of first added node in current
+  // mFirstAddedContainer is parent node of first added node in current
   // document change.  So, this is not nullptr only when a node was added
   // during a document change and the change has not been included into
   // mTextChangeData yet.
   // Note that this shouldn't be in cycle collection since this is not nullptr
   // only during a document change.
-  nsCOMPtr<nsINode> mFirstAddedNodeContainer;
-  // mLastAddedNodeContainer is parent node of last added node in current
+  nsCOMPtr<nsINode> mFirstAddedContainer;
+  // mLastAddedContainer is parent node of last added node in current
   // document change.  So, this is not nullptr only when a node was added
   // during a document change and the change has not been included into
   // mTextChangeData yet.
   // Note that this shouldn't be in cycle collection since this is not nullptr
   // only during a document change.
-  nsCOMPtr<nsINode> mLastAddedNodeContainer;
-  // mFirstAddedNodeOffset is offset of first added node in
-  // mFirstAddedNodeContainer.
-  int32_t mFirstAddedNodeOffset;
-  // mLastAddedNodeOffset is offset of *after* last added node in
-  // mLastAddedNodeContainer.  I.e., the index of last added node + 1.
-  int32_t mLastAddedNodeOffset;
+  nsCOMPtr<nsINode> mLastAddedContainer;
+
+  // mFirstAddedContent is the first node added in mFirstAddedContainer.
+  nsCOMPtr<nsIContent> mFirstAddedContent;
+  // mLastAddedContent is the last node added in mLastAddedContainer;
+  nsCOMPtr<nsIContent> mLastAddedContent;
 
   TextChangeData mTextChangeData;
 

From 615d87dfaf6518fb2ca82e79c65e73387e94f36c Mon Sep 17 00:00:00 2001
From: Michael Layzell <michael@thelayzells.com>
Date: Fri, 8 Sep 2017 14:07:00 -0400
Subject: [PATCH 15/29] Bug 1384915 - Part 4: Update RawRange to use
 RangeBoundaries, r=masayuki

---
 dom/base/nsRange.h                 |  10 +++
 dom/events/ContentEventHandler.cpp | 101 ++++++++++++-----------------
 dom/events/ContentEventHandler.h   |  58 +++++++++--------
 3 files changed, 83 insertions(+), 86 deletions(-)

diff --git a/dom/base/nsRange.h b/dom/base/nsRange.h
index 531c844dbae6..b79a68e82e7a 100644
--- a/dom/base/nsRange.h
+++ b/dom/base/nsRange.h
@@ -85,11 +85,21 @@ public:
     return mRoot;
   }
 
+  const RangeBoundary& StartRef() const
+  {
+    return mStart;
+  }
+
   nsINode* GetStartContainer() const
   {
     return mStart.Container();
   }
 
+  const RangeBoundary& EndRef() const
+  {
+    return mEnd;
+  }
+
   nsINode* GetEndContainer() const
   {
     return mEnd.Container();
diff --git a/dom/events/ContentEventHandler.cpp b/dom/events/ContentEventHandler.cpp
index c21befd9449e..3ce7b711574a 100644
--- a/dom/events/ContentEventHandler.cpp
+++ b/dom/events/ContentEventHandler.cpp
@@ -47,69 +47,56 @@ void
 ContentEventHandler::RawRange::AssertStartIsBeforeOrEqualToEnd()
 {
   MOZ_ASSERT(
-    nsContentUtils::ComparePoints(mStartContainer,
-                                  static_cast<int32_t>(mStartOffset),
-                                  mEndContainer,
-                                  static_cast<int32_t>(mEndOffset)) <= 0);
-}
-
-bool
-ContentEventHandler::RawRange::IsValidOffset(nsINode* aContainer,
-                                             uint32_t aOffset) const
-{
-  return aContainer && aOffset <= aContainer->Length();
+    nsContentUtils::ComparePoints(mStart.Container(),
+                                  static_cast<int32_t>(mStart.Offset()),
+                                  mEnd.Container(),
+                                  static_cast<int32_t>(mEnd.Offset())) <= 0);
 }
 
 nsresult
-ContentEventHandler::RawRange::SetStart(nsINode* aStartContainer,
-                                        uint32_t aStartOffset)
+ContentEventHandler::RawRange::SetStart(const RawRangeBoundary& aStart)
 {
-  nsINode* newRoot = nsRange::ComputeRootNode(aStartContainer);
+  nsINode* newRoot = nsRange::ComputeRootNode(aStart.Container());
   if (!newRoot) {
     return NS_ERROR_DOM_INVALID_NODE_TYPE_ERR;
   }
 
-  if (!IsValidOffset(aStartContainer, aStartOffset)) {
+  if (!aStart.IsSetAndValid()) {
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
   }
 
   // Collapse if not positioned yet, or if positioned in another document.
   if (!IsPositioned() || newRoot != mRoot) {
     mRoot = newRoot;
-    mStartContainer = mEndContainer = aStartContainer;
-    mStartOffset = mEndOffset = aStartOffset;
+    mStart = mEnd = aStart;
     return NS_OK;
   }
 
-  mStartContainer = aStartContainer;
-  mStartOffset = aStartOffset;
+  mStart = aStart;
   AssertStartIsBeforeOrEqualToEnd();
   return NS_OK;
 }
 
 nsresult
-ContentEventHandler::RawRange::SetEnd(nsINode* aEndContainer,
-                                      uint32_t aEndOffset)
+ContentEventHandler::RawRange::SetEnd(const RawRangeBoundary& aEnd)
 {
-  nsINode* newRoot = nsRange::ComputeRootNode(aEndContainer);
+  nsINode* newRoot = nsRange::ComputeRootNode(aEnd.Container());
   if (!newRoot) {
     return NS_ERROR_DOM_INVALID_NODE_TYPE_ERR;
   }
 
-  if (!IsValidOffset(aEndContainer, aEndOffset)) {
+  if (!aEnd.IsSetAndValid()) {
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
   }
 
   // Collapse if not positioned yet, or if positioned in another document.
   if (!IsPositioned() || newRoot != mRoot) {
     mRoot = newRoot;
-    mStartContainer = mEndContainer = aEndContainer;
-    mStartOffset = mEndOffset = aEndOffset;
+    mStart = mEnd = aEnd;
     return NS_OK;
   }
 
-  mEndContainer = aEndContainer;
-  mEndOffset = aEndOffset;
+  mEnd = aEnd;
   AssertStartIsBeforeOrEqualToEnd();
   return NS_OK;
 }
@@ -126,61 +113,53 @@ ContentEventHandler::RawRange::SetEndAfter(nsINode* aEndContainer)
 void
 ContentEventHandler::RawRange::SetStartAndEnd(const nsRange* aRange)
 {
-  DebugOnly<nsresult> rv = SetStartAndEnd(aRange->GetStartContainer(),
-                                          aRange->StartOffset(),
-                                          aRange->GetEndContainer(),
-                                          aRange->EndOffset());
+  DebugOnly<nsresult> rv = SetStartAndEnd(aRange->StartRef().AsRaw(),
+                                          aRange->EndRef().AsRaw());
   MOZ_ASSERT(!aRange->IsPositioned() || NS_SUCCEEDED(rv));
 }
 
 nsresult
-ContentEventHandler::RawRange::SetStartAndEnd(nsINode* aStartContainer,
-                                              uint32_t aStartOffset,
-                                              nsINode* aEndContainer,
-                                              uint32_t aEndOffset)
+ContentEventHandler::RawRange::SetStartAndEnd(const RawRangeBoundary& aStart,
+                                              const RawRangeBoundary& aEnd)
 {
-  nsINode* newStartRoot = nsRange::ComputeRootNode(aStartContainer);
+  nsINode* newStartRoot = nsRange::ComputeRootNode(aStart.Container());
   if (!newStartRoot) {
     return NS_ERROR_DOM_INVALID_NODE_TYPE_ERR;
   }
-  if (!IsValidOffset(aStartContainer, aStartOffset)) {
+  if (!aStart.IsSetAndValid()) {
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
   }
 
-  if (aStartContainer == aEndContainer) {
-    if (!IsValidOffset(aEndContainer, aEndOffset)) {
+  if (aStart.Container() == aEnd.Container()) {
+    if (!aEnd.IsSetAndValid()) {
       return NS_ERROR_DOM_INDEX_SIZE_ERR;
     }
-    MOZ_ASSERT(aStartOffset <= aEndOffset);
+    MOZ_ASSERT(aStart.Offset() <= aEnd.Offset());
     mRoot = newStartRoot;
-    mStartContainer = mEndContainer = aStartContainer;
-    mStartOffset = aStartOffset;
-    mEndOffset = aEndOffset;
+    mStart = aStart;
+    mEnd = aEnd;
     return NS_OK;
   }
 
-  nsINode* newEndRoot = nsRange::ComputeRootNode(aEndContainer);
+  nsINode* newEndRoot = nsRange::ComputeRootNode(aEnd.Container());
   if (!newEndRoot) {
     return NS_ERROR_DOM_INVALID_NODE_TYPE_ERR;
   }
-  if (!IsValidOffset(aEndContainer, aEndOffset)) {
+  if (!aEnd.IsSetAndValid()) {
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
   }
 
   // If they have different root, this should be collapsed at the end point.
   if (newStartRoot != newEndRoot) {
     mRoot = newEndRoot;
-    mStartContainer = mEndContainer = aEndContainer;
-    mStartOffset = mEndOffset = aEndOffset;
+    mStart = mEnd = aEnd;
     return NS_OK;
   }
 
   // Otherwise, set the range as specified.
   mRoot = newStartRoot;
-  mStartContainer = aStartContainer;
-  mStartOffset = aStartOffset;
-  mEndContainer = aEndContainer;
-  mEndOffset = aEndOffset;
+  mStart = aStart;
+  mEnd = aEnd;
   AssertStartIsBeforeOrEqualToEnd();
   return NS_OK;
 }
@@ -194,9 +173,9 @@ ContentEventHandler::RawRange::SelectNodeContents(
     return NS_ERROR_DOM_INVALID_NODE_TYPE_ERR;
   }
   mRoot = newRoot;
-  mStartContainer = mEndContainer = aNodeToSelectContents;
-  mStartOffset = 0;
-  mEndOffset = aNodeToSelectContents->Length();
+  mStart = RawRangeBoundary(aNodeToSelectContents, nullptr);
+  mEnd = RawRangeBoundary(aNodeToSelectContents,
+                          aNodeToSelectContents->GetLastChild());
   return NS_OK;
 }
 
@@ -416,7 +395,7 @@ ContentEventHandler::InitCommon(SelectionType aSelectionType)
 
   // But otherwise, we need to assume that there is a selection range at the
   // beginning of the root content if aSelectionType is eNormal.
-  rv = mFirstSelectedRawRange.CollapseTo(mRootContent, 0);
+  rv = mFirstSelectedRawRange.CollapseTo(RawRangeBoundary(mRootContent, 0));
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return NS_ERROR_UNEXPECTED;
   }
@@ -1160,7 +1139,7 @@ ContentEventHandler::SetRawRangeFromFlatTextOffset(
 
   // Special case like <br contenteditable>
   if (!mRootContent->HasChildren()) {
-    nsresult rv = aRawRange->CollapseTo(mRootContent, 0);
+    nsresult rv = aRawRange->CollapseTo(RawRangeBoundary(mRootContent, 0));
     if (NS_WARN_IF(NS_FAILED(rv))) {
       return rv;
     }
@@ -2917,8 +2896,7 @@ ContentEventHandler::GetFlatTextLengthInRange(
   } else {
     RawRange prevRawRange;
     nsresult rv =
-      prevRawRange.SetStart(aStartPosition.Container(),
-                            aStartPosition.Offset());
+      prevRawRange.SetStart(aStartPosition.AsRaw());
     if (NS_WARN_IF(NS_FAILED(rv))) {
       return rv;
     }
@@ -2951,7 +2929,7 @@ ContentEventHandler::GetFlatTextLengthInRange(
 
     if (endPosition.IsSetAndValid()) {
       // Offset is within node's length; set end of range to that offset
-      rv = prevRawRange.SetEnd(endPosition.Container(), endPosition.Offset());
+      rv = prevRawRange.SetEnd(endPosition.AsRaw());
       if (NS_WARN_IF(NS_FAILED(rv))) {
         return rv;
       }
@@ -2999,6 +2977,8 @@ ContentEventHandler::GetFlatTextLengthInRange(
     if (node->IsNodeOfType(nsINode::eTEXT)) {
       // Note: our range always starts from offset 0
       if (node == endPosition.Container()) {
+        // NOTE: We should have an offset here, as endPosition.Container() is a
+        // nsINode::eTEXT, which always has an offset.
         *aLength += GetTextLength(content, aLineBreakType,
                                   endPosition.Offset());
       } else {
@@ -3099,7 +3079,8 @@ ContentEventHandler::AdjustCollapsedRangeMaybeIntoTextNode(RawRange& aRawRange)
     return NS_OK;
   }
 
-  nsresult rv = aRawRange.CollapseTo(childNode, offsetInChildNode);
+  nsresult rv =
+    aRawRange.CollapseTo(RawRangeBoundary(childNode, offsetInChildNode));
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return rv;
   }
diff --git a/dom/events/ContentEventHandler.h b/dom/events/ContentEventHandler.h
index b75150350391..409e8f5c869b 100644
--- a/dom/events/ContentEventHandler.h
+++ b/dom/events/ContentEventHandler.h
@@ -46,56 +46,62 @@ private:
   class MOZ_STACK_CLASS RawRange final
   {
   public:
-    RawRange()
-      : mStartOffset(0)
-      , mEndOffset(0)
-    {
-    }
+    RawRange() {}
 
     void Clear()
     {
-      mRoot = mStartContainer = mEndContainer = nullptr;
-      mStartOffset = mEndOffset = 0;
+      mRoot = nullptr;
+      mStart = RangeBoundary();
+      mEnd = RangeBoundary();
     }
 
     bool IsPositioned() const
     {
-      return mStartContainer && mEndContainer;
+      return mStart.IsSet() && mEnd.IsSet();
     }
     bool Collapsed() const
     {
-      return mStartContainer == mEndContainer &&
-             mStartOffset == mEndOffset &&
-             IsPositioned();
+      return mStart == mEnd && IsPositioned();
     }
-    nsINode* GetStartContainer() const { return mStartContainer; }
-    nsINode* GetEndContainer() const { return mEndContainer; }
-    uint32_t StartOffset() const { return mStartOffset; }
-    uint32_t EndOffset() const { return mEndOffset; }
+    nsINode* GetStartContainer() const { return mStart.Container(); }
+    nsINode* GetEndContainer() const { return mEnd.Container(); }
+    uint32_t StartOffset() const { return mStart.Offset(); }
+    uint32_t EndOffset() const { return mEnd.Offset(); }
+    nsIContent* StartRef() const { return mStart.Ref(); }
+    nsIContent* EndRef() const { return mEnd.Ref(); }
 
-    nsresult CollapseTo(nsINode* aContainer, uint32_t aOffset)
+    // XXX: Make these use RangeBoundaries...
+    nsresult CollapseTo(const RawRangeBoundary& aBoundary)
     {
-      return SetStartAndEnd(aContainer, aOffset, aContainer, aOffset);
+      return SetStartAndEnd(aBoundary, aBoundary);
     }
-    nsresult SetStart(nsINode* aStartContainer, uint32_t aStartOffset);
-    nsresult SetEnd(nsINode* aEndContainer, uint32_t aEndOffset);
+    nsresult SetStart(const RawRangeBoundary& aStart);
+    nsresult SetEnd(const RawRangeBoundary& aEnd);
+
+    // NOTE: These helpers can hide performance problems, as they perform a
+    // search to find aStartOffset in aStartContainer.
+    nsresult SetStart(nsINode* aStartContainer, uint32_t aStartOffset) {
+      return SetStart(RawRangeBoundary(aStartContainer, aStartOffset));
+    }
+    nsresult SetEnd(nsINode* aEndContainer, uint32_t aEndOffset) {
+      return SetEnd(RawRangeBoundary(aEndContainer, aEndOffset));
+    }
+
     nsresult SetEndAfter(nsINode* aEndContainer);
     void SetStartAndEnd(const nsRange* aRange);
-    nsresult SetStartAndEnd(nsINode* aStartContainer, uint32_t aStartOffset,
-                            nsINode* aEndContainer, uint32_t aEndOffset);
+    nsresult SetStartAndEnd(const RawRangeBoundary& aStart,
+                            const RawRangeBoundary& aEnd);
 
     nsresult SelectNodeContents(nsINode* aNodeToSelectContents);
 
   private:
-    bool IsValidOffset(nsINode* aContainer, uint32_t aOffset) const;
     nsINode* IsValidBoundary(nsINode* aNode) const;
     inline void AssertStartIsBeforeOrEqualToEnd();
 
     nsCOMPtr<nsINode> mRoot;
-    nsCOMPtr<nsINode> mStartContainer;
-    nsCOMPtr<nsINode> mEndContainer;
-    uint32_t mStartOffset;
-    uint32_t mEndOffset;
+
+    RangeBoundary mStart;
+    RangeBoundary mEnd;
   };
 
 public:

From 8e9f0c50e6dc4d2cdeb656b18a8beab8d8ad613f Mon Sep 17 00:00:00 2001
From: Michael Layzell <michael@thelayzells.com>
Date: Mon, 11 Sep 2017 17:17:01 -0400
Subject: [PATCH 16/29] Bug 1383411 - Introduce a distinction between
 nsCStr<'a> and nsCString, r=froydnj

---
 xpcom/rust/nserror/src/lib.rs  |   4 +-
 xpcom/rust/nsstring/src/lib.rs | 421 ++++++++++++++++++++++++---------
 2 files changed, 306 insertions(+), 119 deletions(-)

diff --git a/xpcom/rust/nserror/src/lib.rs b/xpcom/rust/nserror/src/lib.rs
index c8322faae167..94c962962de1 100644
--- a/xpcom/rust/nserror/src/lib.rs
+++ b/xpcom/rust/nserror/src/lib.rs
@@ -22,7 +22,7 @@ pub trait NsresultExt {
 
     /// Get a printable name for the nsresult error code. This function returns
     /// a nsCString<'static>, which implements `Display`.
-    fn error_name(self) -> nsCString<'static>;
+    fn error_name(self) -> nsCString;
 }
 
 impl NsresultExt for nsresult {
@@ -42,7 +42,7 @@ impl NsresultExt for nsresult {
         }
     }
 
-    fn error_name(self) -> nsCString<'static> {
+    fn error_name(self) -> nsCString {
         let mut cstr = nsCString::new();
         unsafe {
             Gecko_GetErrorName(self, &mut *cstr);
diff --git a/xpcom/rust/nsstring/src/lib.rs b/xpcom/rust/nsstring/src/lib.rs
index dddc8b81ca40..94e80c5fb003 100644
--- a/xpcom/rust/nsstring/src/lib.rs
+++ b/xpcom/rust/nsstring/src/lib.rs
@@ -5,12 +5,18 @@
 //! Use `&{mut,} nsA[C]String` for functions in rust which wish to take or
 //! mutate XPCOM strings. The other string types `Deref` to this type.
 //!
-//! Use `ns[C]String<'a>` (`ns[C]String` in C++) for string struct members, and
-//! as an intermediate between rust string data structures (such as `String`,
-//! `Vec<u16>`, `&str`, and `&[u16]`) and `&{mut,} nsA[C]String` (using
-//! `ns[C]String::from(value)`). These conversions, when possible, will not
-//! perform any allocations. When using this type in structs shared with C++,
-//! the correct lifetime argument is usually `'static`.
+//! Use `ns[C]String` (`ns[C]String` in C++) for string struct members, and as
+//! an intermediate between rust string data structures (such as `String` or
+//! `Vec<u16>`) and `&{mut,} nsA[C]String` (using `ns[C]String::from(value)`).
+//! These conversions will attempt to re-use the passed-in buffer, appending a
+//! null.
+//!
+//! Use `ns[C]Str` (`nsDependent[C]String` in C++) as an intermediate between
+//! borrowed rust data structures (such as `&str` and `&[u16]`) and `&{mut,}
+//! nsA[C]String` (using `ns[C]Str::from(value)`). These conversions should not
+//! perform any allocations. This type is not safe to share with `C++` as a
+//! struct field, but passing the borrowed `&{mut,} nsA[C]String` over FFI is
+//! safe.
 //!
 //! Use `nsFixed[C]String` or `ns_auto_[c]string!` for dynamic stack allocated
 //! strings which are expected to hold short string values.
@@ -48,7 +54,7 @@
 //! with the methods `.append`, `.append_utf{8,16}`, and with the `write!`
 //! macro, and can be assigned to with `.assign`.
 //!
-//! ## `ns[C]String<'a>`
+//! ## `ns[C]Str<'a>`
 //!
 //! This type is an maybe-owned string type. It acts similarially to a
 //! `Cow<[{u8,u16}]>`. This type provides `Deref` and `DerefMut` implementations
@@ -57,20 +63,36 @@
 //! storage. When modified this type may re-allocate in order to ensure that it
 //! does not mutate its backing storage.
 //!
-//! `ns[C]String`s can be constructed either with `ns[C]String::new()`, which
-//! creates an empty `ns[C]String<'static>`, or through one of the provided
-//! `From` implementations. Both string types may be constructed `From<&'a
-//! str>`, with `nsCString` having a `'a` lifetime, as the storage is shared
-//! with the `str`, while `nsString` has a `'static` lifetime, as its storage
-//! has to be transcoded.
+//! `ns[C]Str`s can be constructed either with `ns[C]Str::new()`, which creates
+//! an empty `ns[C]Str<'static>`, or through one of the provided `From`
+//! implementations. Only `nsCStr` can be constructed `From<'a str>`, as
+//! constructing a `nsStr` would require transcoding. Use `ns[C]String` instead.
 //!
 //! When passing this type by reference, prefer passing a `&nsA[C]String` or
 //! `&mut nsA[C]String`. to passing this type.
 //!
 //! When passing this type across the language boundary, pass it as `*const
 //! nsA[C]String` for an immutable reference, or `*mut nsA[C]String` for a
-//! mutable reference. This struct may also be included in `#[repr(C)]`
-//! structs shared with C++.
+//! mutable reference.
+//!
+//! ## `ns[C]String`
+//!
+//! This type is an owned, null-terminated string type. This type provides
+//! `Deref` and `DerefMut` implementations to `nsA[C]String`, which provides the
+//! methods for manipulating this type.
+//!
+//! `ns[C]String`s can be constructed either with `ns[C]String::new()`, which
+//! creates an empty `ns[C]String`, or through one of the provided `From`
+//! implementations, which will try to avoid reallocating when possible,
+//! although a terminating `null` will be added.
+//!
+//! When passing this type by reference, prefer passing a `&nsA[C]String` or
+//! `&mut nsA[C]String`. to passing this type.
+//!
+//! When passing this type across the language boundary, pass it as `*const
+//! nsA[C]String` for an immutable reference, or `*mut nsA[C]String` for a
+//! mutable reference. This struct may also be included in `#[repr(C)]` structs
+//! shared with C++.
 //!
 //! ## `nsFixed[C]String<'a>`
 //!
@@ -105,7 +127,7 @@
 //! ## `ns[C]StringRepr`
 //!
 //! This crate also provides the type `ns[C]StringRepr` which acts conceptually
-//! similar to an `ns[C]String<'static>`, however, it does not have a `Drop`
+//! similar to an `ns[C]String`, however, it does not have a `Drop`
 //! implementation.
 //!
 //! If this type is dropped in rust, it will not free its backing storage. This
@@ -122,7 +144,6 @@ use std::ops::{Deref, DerefMut};
 use std::marker::PhantomData;
 use std::borrow;
 use std::slice;
-use std::ptr;
 use std::mem;
 use std::fmt;
 use std::cmp;
@@ -175,6 +196,7 @@ macro_rules! define_string_types {
 
         AString = $AString: ident;
         String = $String: ident;
+        Str = $Str: ident;
         FixedString = $FixedString: ident;
 
         StringLike = $StringLike: ident;
@@ -207,6 +229,18 @@ macro_rules! define_string_types {
             classflags: ClassFlags,
         }
 
+        impl $StringRepr {
+            fn new(classflags: ClassFlags) -> $StringRepr {
+                static NUL: $char_t = 0;
+                $StringRepr {
+                    data: &NUL,
+                    length: 0,
+                    dataflags: data_flags::TERMINATED | data_flags::LITERAL,
+                    classflags: classflags,
+                }
+            }
+        }
+
         impl Deref for $StringRepr {
             type Target = $AString;
             fn deref(&self) -> &$AString {
@@ -385,8 +419,14 @@ macro_rules! define_string_types {
             }
         }
 
-        impl<'a> cmp::PartialEq<$String<'a>> for $AString {
-            fn eq(&self, other: &$String<'a>) -> bool {
+        impl cmp::PartialEq<$String> for $AString {
+            fn eq(&self, other: &$String) -> bool {
+                self.eq(&**other)
+            }
+        }
+
+        impl<'a> cmp::PartialEq<$Str<'a>> for $AString {
+            fn eq(&self, other: &$Str<'a>) -> bool {
                 self.eq(&**other)
             }
         }
@@ -398,26 +438,21 @@ macro_rules! define_string_types {
         }
 
         #[repr(C)]
-        pub struct $String<'a> {
+        pub struct $Str<'a> {
             hdr: $StringRepr,
             _marker: PhantomData<&'a [$char_t]>,
         }
 
-        impl $String<'static> {
-            pub fn new() -> $String<'static> {
-                $String {
-                    hdr: $StringRepr {
-                        data: ptr::null(),
-                        length: 0,
-                        dataflags: DataFlags::empty(),
-                        classflags: class_flags::NULL_TERMINATED,
-                    },
+        impl $Str<'static> {
+            pub fn new() -> $Str<'static> {
+                $Str {
+                    hdr: $StringRepr::new(ClassFlags::empty()),
                     _marker: PhantomData,
                 }
             }
         }
 
-        impl<'a> Drop for $String<'a> {
+        impl<'a> Drop for $Str<'a> {
             fn drop(&mut self) {
                 unsafe {
                     $drop(&mut **self);
@@ -425,65 +460,184 @@ macro_rules! define_string_types {
             }
         }
 
-        impl<'a> Deref for $String<'a> {
+        impl<'a> Deref for $Str<'a> {
             type Target = $AString;
             fn deref(&self) -> &$AString {
                 &self.hdr
             }
         }
 
-        impl<'a> DerefMut for $String<'a> {
+        impl<'a> DerefMut for $Str<'a> {
             fn deref_mut(&mut self) -> &mut $AString {
                 &mut self.hdr
             }
         }
 
-        impl<'a> AsRef<[$char_t]> for $String<'a> {
+        impl<'a> AsRef<[$char_t]> for $Str<'a> {
             fn as_ref(&self) -> &[$char_t] {
                 &self
             }
         }
 
-        impl<'a> From<&'a String> for $String<'a> {
-            fn from(s: &'a String) -> $String<'a> {
-                $String::from(&s[..])
-            }
-        }
-
-        impl<'a> From<&'a Vec<$char_t>> for $String<'a> {
-            fn from(s: &'a Vec<$char_t>) -> $String<'a> {
-                $String::from(&s[..])
-            }
-        }
-
-        impl<'a> From<&'a [$char_t]> for $String<'a> {
-            fn from(s: &'a [$char_t]) -> $String<'a> {
+        impl<'a> From<&'a [$char_t]> for $Str<'a> {
+            fn from(s: &'a [$char_t]) -> $Str<'a> {
                 assert!(s.len() < (u32::MAX as usize));
-                $String {
+                if s.is_empty() {
+                    return $Str::new();
+                }
+                $Str {
                     hdr: $StringRepr {
-                        data: if s.is_empty() { ptr::null() } else { s.as_ptr() },
+                        data: s.as_ptr(),
                         length: s.len() as u32,
                         dataflags: DataFlags::empty(),
-                        classflags: class_flags::NULL_TERMINATED,
+                        classflags: ClassFlags::empty(),
                     },
                     _marker: PhantomData,
                 }
             }
         }
 
-        impl From<Box<[$char_t]>> for $String<'static> {
-            fn from(s: Box<[$char_t]>) -> $String<'static> {
+        impl<'a> From<&'a Vec<$char_t>> for $Str<'a> {
+            fn from(s: &'a Vec<$char_t>) -> $Str<'a> {
+                $Str::from(&s[..])
+            }
+        }
+
+        impl<'a> From<&'a $AString> for $Str<'a> {
+            fn from(s: &'a $AString) -> $Str<'a> {
+                $Str::from(&s[..])
+            }
+        }
+
+        impl<'a> fmt::Write for $Str<'a> {
+            fn write_str(&mut self, s: &str) -> Result<(), fmt::Error> {
+                $AString::write_str(self, s)
+            }
+        }
+
+        impl<'a> fmt::Display for $Str<'a> {
+            fn fmt(&self, f: &mut fmt::Formatter) -> Result<(), fmt::Error> {
+                <$AString as fmt::Display>::fmt(self, f)
+            }
+        }
+
+        impl<'a> fmt::Debug for $Str<'a> {
+            fn fmt(&self, f: &mut fmt::Formatter) -> Result<(), fmt::Error> {
+                <$AString as fmt::Debug>::fmt(self, f)
+            }
+        }
+
+        impl<'a> cmp::PartialEq for $Str<'a> {
+            fn eq(&self, other: &$Str<'a>) -> bool {
+                $AString::eq(self, other)
+            }
+        }
+
+        impl<'a> cmp::PartialEq<[$char_t]> for $Str<'a> {
+            fn eq(&self, other: &[$char_t]) -> bool {
+                $AString::eq(self, other)
+            }
+        }
+
+        impl<'a, 'b> cmp::PartialEq<&'b [$char_t]> for $Str<'a> {
+            fn eq(&self, other: &&'b [$char_t]) -> bool {
+                $AString::eq(self, *other)
+            }
+        }
+
+        impl<'a> cmp::PartialEq<str> for $Str<'a> {
+            fn eq(&self, other: &str) -> bool {
+                $AString::eq(self, other)
+            }
+        }
+
+        impl<'a, 'b> cmp::PartialEq<&'b str> for $Str<'a> {
+            fn eq(&self, other: &&'b str) -> bool {
+                $AString::eq(self, *other)
+            }
+        }
+
+        #[repr(C)]
+        pub struct $String {
+            hdr: $StringRepr,
+        }
+
+        impl $String {
+            pub fn new() -> $String {
+                $String {
+                    hdr: $StringRepr::new(class_flags::NULL_TERMINATED),
+                }
+            }
+        }
+
+        impl Drop for $String {
+            fn drop(&mut self) {
+                unsafe {
+                    $drop(&mut **self);
+                }
+            }
+        }
+
+        impl Deref for $String {
+            type Target = $AString;
+            fn deref(&self) -> &$AString {
+                &self.hdr
+            }
+        }
+
+        impl DerefMut for $String {
+            fn deref_mut(&mut self) -> &mut $AString {
+                &mut self.hdr
+            }
+        }
+
+        impl AsRef<[$char_t]> for $String {
+            fn as_ref(&self) -> &[$char_t] {
+                &self
+            }
+        }
+
+        impl<'a> From<&'a [$char_t]> for $String {
+            fn from(s: &'a [$char_t]) -> $String {
+                let mut res = $String::new();
+                res.assign(&$Str::from(&s[..]));
+                res
+            }
+        }
+
+        impl<'a> From<&'a Vec<$char_t>> for $String {
+            fn from(s: &'a Vec<$char_t>) -> $String {
+                $String::from(&s[..])
+            }
+        }
+
+        impl<'a> From<&'a $AString> for $String {
+            fn from(s: &'a $AString) -> $String {
+                $String::from(&s[..])
+            }
+        }
+
+        impl From<Box<[$char_t]>> for $String {
+            fn from(s: Box<[$char_t]>) -> $String {
+                s.to_vec().into()
+            }
+        }
+
+        impl From<Vec<$char_t>> for $String {
+            fn from(mut s: Vec<$char_t>) -> $String {
                 assert!(s.len() < (u32::MAX as usize));
                 if s.is_empty() {
                     return $String::new();
                 }
 
+                let length = s.len() as u32;
+                s.push(0); // null terminator
+
                 // SAFETY NOTE: This method produces an data_flags::OWNED
                 // ns[C]String from a Box<[$char_t]>. this is only safe
                 // because in the Gecko tree, we use the same allocator for
                 // Rust code as for C++ code, meaning that our box can be
                 // legally freed with libc::free().
-                let length = s.len() as u32;
                 let ptr = s.as_ptr();
                 mem::forget(s);
                 unsafe {
@@ -493,72 +647,57 @@ macro_rules! define_string_types {
                     hdr: $StringRepr {
                         data: ptr,
                         length: length,
-                        dataflags: data_flags::OWNED,
+                        dataflags: data_flags::OWNED | data_flags::TERMINATED,
                         classflags: class_flags::NULL_TERMINATED,
-                    },
-                    _marker: PhantomData,
+                    }
                 }
             }
         }
 
-        impl From<Vec<$char_t>> for $String<'static> {
-            fn from(s: Vec<$char_t>) -> $String<'static> {
-                s.into_boxed_slice().into()
-            }
-        }
-
-        impl<'a> From<&'a $AString> for $String<'static> {
-            fn from(s: &'a $AString) -> $String<'static> {
-                let mut string = $String::new();
-                string.assign(s);
-                string
-            }
-        }
-
-        impl<'a> fmt::Write for $String<'a> {
+        impl fmt::Write for $String {
             fn write_str(&mut self, s: &str) -> Result<(), fmt::Error> {
                 $AString::write_str(self, s)
             }
         }
 
-        impl<'a> fmt::Display for $String<'a> {
+        impl fmt::Display for $String {
             fn fmt(&self, f: &mut fmt::Formatter) -> Result<(), fmt::Error> {
                 <$AString as fmt::Display>::fmt(self, f)
             }
         }
 
-        impl<'a> fmt::Debug for $String<'a> {
+        impl fmt::Debug for $String {
             fn fmt(&self, f: &mut fmt::Formatter) -> Result<(), fmt::Error> {
                 <$AString as fmt::Debug>::fmt(self, f)
             }
         }
 
-        impl<'a> cmp::PartialEq for $String<'a> {
-            fn eq(&self, other: &$String<'a>) -> bool {
+        impl cmp::PartialEq for $String {
+            fn eq(&self, other: &$String) -> bool {
                 $AString::eq(self, other)
             }
         }
 
-        impl<'a> cmp::PartialEq<[$char_t]> for $String<'a> {
+        impl cmp::PartialEq<[$char_t]> for $String {
             fn eq(&self, other: &[$char_t]) -> bool {
                 $AString::eq(self, other)
             }
         }
 
-        impl<'a, 'b> cmp::PartialEq<&'b [$char_t]> for $String<'a> {
-            fn eq(&self, other: &&'b [$char_t]) -> bool {
+        impl<'a> cmp::PartialEq<&'a [$char_t]> for $String {
+            fn eq(&self, other: &&'a [$char_t]) -> bool {
                 $AString::eq(self, *other)
             }
         }
 
-        impl<'a> cmp::PartialEq<str> for $String<'a> {
+        impl cmp::PartialEq<str> for $String {
             fn eq(&self, other: &str) -> bool {
                 $AString::eq(self, other)
             }
         }
 
-        impl<'a, 'b> cmp::PartialEq<&'b str> for $String<'a> {
-            fn eq(&self, other: &&'b str) -> bool {
+        impl<'a> cmp::PartialEq<&'a str> for $String {
+            fn eq(&self, other: &&'a str) -> bool {
                 $AString::eq(self, *other)
             }
         }
@@ -568,7 +707,7 @@ macro_rules! define_string_types {
         /// buffer, rather than using heap allocations.
         #[repr(C)]
         pub struct $FixedString<'a> {
-            base: $String<'a>,
+            base: $String,
             capacity: u32,
             buffer: *mut $char_t,
             _marker: PhantomData<&'a mut [$char_t]>,
@@ -581,13 +720,7 @@ macro_rules! define_string_types {
                 let buf_ptr = buf.as_mut_ptr();
                 $FixedString {
                     base: $String {
-                        hdr: $StringRepr {
-                            data: ptr::null(),
-                            length: 0,
-                            dataflags: DataFlags::empty(),
-                            classflags: class_flags::FIXED | class_flags::NULL_TERMINATED,
-                        },
-                        _marker: PhantomData,
+                        hdr: $StringRepr::new(class_flags::FIXED | class_flags::NULL_TERMINATED),
                     },
                     capacity: len as u32,
                     buffer: buf_ptr,
@@ -667,7 +800,7 @@ macro_rules! define_string_types {
         /// &[$char_type], and &$AString to a function, while still performing
         /// optimized operations when passed the $AString.
         pub enum $StringAdapter<'a> {
-            Borrowed($String<'a>),
+            Borrowed($Str<'a>),
             Abstract(&'a $AString),
         }
 
@@ -720,7 +853,13 @@ macro_rules! define_string_types {
             }
         }
 
-        impl<'a> $StringLike for $String<'a> {
+        impl<'a> $StringLike for $Str<'a> {
+            fn adapt(&self) -> $StringAdapter {
+                $StringAdapter::Abstract(self)
+            }
+        }
+
+        impl $StringLike for $String {
             fn adapt(&self) -> $StringAdapter {
                 $StringAdapter::Abstract(self)
             }
@@ -734,19 +873,19 @@ macro_rules! define_string_types {
 
         impl $StringLike for [$char_t] {
             fn adapt(&self) -> $StringAdapter {
-                $StringAdapter::Borrowed($String::from(self))
+                $StringAdapter::Borrowed($Str::from(self))
             }
         }
 
         impl $StringLike for Vec<$char_t> {
             fn adapt(&self) -> $StringAdapter {
-                $StringAdapter::Borrowed($String::from(&self[..]))
+                $StringAdapter::Borrowed($Str::from(&self[..]))
             }
         }
 
         impl $StringLike for Box<[$char_t]> {
             fn adapt(&self) -> $StringAdapter {
-                $StringAdapter::Borrowed($String::from(&self[..]))
+                $StringAdapter::Borrowed($Str::from(&self[..]))
             }
         }
     }
@@ -761,6 +900,7 @@ define_string_types! {
 
     AString = nsACString;
     String = nsCString;
+    Str = nsCStr;
     FixedString = nsFixedCString;
 
     StringLike = nsCStringLike;
@@ -805,20 +945,38 @@ impl nsACString {
     }
 }
 
-impl<'a> From<&'a str> for nsCString<'a> {
-    fn from(s: &'a str) -> nsCString<'a> {
+impl<'a> From<&'a str> for nsCStr<'a> {
+    fn from(s: &'a str) -> nsCStr<'a> {
         s.as_bytes().into()
     }
 }
 
-impl From<Box<str>> for nsCString<'static> {
-    fn from(s: Box<str>) -> nsCString<'static> {
+impl<'a> From<&'a String> for nsCStr<'a> {
+    fn from(s: &'a String) -> nsCStr<'a> {
+        nsCStr::from(&s[..])
+    }
+}
+
+impl<'a> From<&'a str> for nsCString {
+    fn from(s: &'a str) -> nsCString {
+        s.as_bytes().into()
+    }
+}
+
+impl<'a> From<&'a String> for nsCString {
+    fn from(s: &'a String) -> nsCString {
+        nsCString::from(&s[..])
+    }
+}
+
+impl From<Box<str>> for nsCString {
+    fn from(s: Box<str>) -> nsCString {
         s.into_string().into()
     }
 }
 
-impl From<String> for nsCString<'static> {
-    fn from(s: String) -> nsCString<'static> {
+impl From<String> for nsCString {
+    fn from(s: String) -> nsCString {
         s.into_bytes().into()
     }
 }
@@ -851,19 +1009,19 @@ impl cmp::PartialEq<str> for nsACString {
 
 impl nsCStringLike for str {
     fn adapt(&self) -> nsCStringAdapter {
-        nsCStringAdapter::Borrowed(nsCString::from(self))
+        nsCStringAdapter::Borrowed(nsCStr::from(self))
     }
 }
 
 impl nsCStringLike for String {
     fn adapt(&self) -> nsCStringAdapter {
-        nsCStringAdapter::Borrowed(nsCString::from(&self[..]))
+        nsCStringAdapter::Borrowed(nsCStr::from(&self[..]))
     }
 }
 
 impl nsCStringLike for Box<str> {
     fn adapt(&self) -> nsCStringAdapter {
-        nsCStringAdapter::Borrowed(nsCString::from(&self[..]))
+        nsCStringAdapter::Borrowed(nsCStr::from(&self[..]))
     }
 }
 
@@ -884,6 +1042,7 @@ define_string_types! {
 
     AString = nsAString;
     String = nsString;
+    Str = nsStr;
     FixedString = nsFixedString;
 
     StringLike = nsStringLike;
@@ -926,12 +1085,18 @@ impl nsAString {
 
 // NOTE: The From impl for a string slice for nsString produces a <'static>
 // lifetime, as it allocates.
-impl<'a> From<&'a str> for nsString<'static> {
-    fn from(s: &'a str) -> nsString<'static> {
+impl<'a> From<&'a str> for nsString {
+    fn from(s: &'a str) -> nsString {
         s.encode_utf16().collect::<Vec<u16>>().into()
     }
 }
 
+impl<'a> From<&'a String> for nsString {
+    fn from(s: &'a String) -> nsString {
+        nsString::from(&s[..])
+    }
+}
+
 // Support for the write!() macro for writing to nsStrings
 impl fmt::Write for nsAString {
     fn write_str(&mut self, s: &str) -> Result<(), fmt::Error> {
@@ -1022,6 +1187,8 @@ pub mod test_helpers {
         nsFixedString,
         nsCString,
         nsString,
+        nsCStr,
+        nsStr,
         nsCStringRepr,
         nsStringRepr,
         data_flags,
@@ -1042,7 +1209,7 @@ pub mod test_helpers {
                 }
             }
         };
-        ($T:ty, $U:ty, $fname:ident) => {
+        ($T:ty, $U:ty, $V:ty, $fname:ident) => {
             #[no_mangle]
             #[allow(non_snake_case)]
             pub extern fn $fname(size: *mut usize, align: *mut usize) {
@@ -1052,13 +1219,17 @@ pub mod test_helpers {
 
                     assert_eq!(*size, mem::size_of::<$U>());
                     assert_eq!(*align, mem::align_of::<$U>());
+                    assert_eq!(*size, mem::size_of::<$V>());
+                    assert_eq!(*align, mem::align_of::<$V>());
                 }
             }
         }
     }
 
-    size_align_check!(nsStringRepr, nsString<'static>, Rust_Test_ReprSizeAlign_nsString);
-    size_align_check!(nsCStringRepr, nsCString<'static>, Rust_Test_ReprSizeAlign_nsCString);
+    size_align_check!(nsStringRepr, nsString, nsStr<'static>,
+                      Rust_Test_ReprSizeAlign_nsString);
+    size_align_check!(nsCStringRepr, nsCString, nsCStr<'static>,
+                      Rust_Test_ReprSizeAlign_nsCString);
     size_align_check!(nsFixedString<'static>, Rust_Test_ReprSizeAlign_nsFixedString);
     size_align_check!(nsFixedCString<'static>, Rust_Test_ReprSizeAlign_nsFixedCString);
 
@@ -1088,7 +1259,7 @@ pub mod test_helpers {
                 }
             }
         };
-        ($T:ty, $U:ty, $member:ident, $method:ident) => {
+        ($T:ty, $U:ty, $V:ty, $member:ident, $method:ident) => {
             #[no_mangle]
             #[allow(non_snake_case)]
             pub extern fn $method(size: *mut usize,
@@ -1112,19 +1283,35 @@ pub mod test_helpers {
                                (&tmp.hdr.$member as *const _ as usize) -
                                (&tmp as *const _ as usize));
                     mem::forget(tmp);
+
+                    let tmp: $V = mem::zeroed();
+                    assert_eq!(*size, mem::size_of_val(&tmp.hdr.$member));
+                    assert_eq!(*align, mem::align_of_val(&tmp.hdr.$member));
+                    assert_eq!(*offset,
+                               (&tmp.hdr.$member as *const _ as usize) -
+                               (&tmp as *const _ as usize));
+                    mem::forget(tmp);
                 }
             }
         }
     }
 
-    member_check!(nsStringRepr, nsString<'static>, data, Rust_Test_Member_nsString_mData);
-    member_check!(nsStringRepr, nsString<'static>, length, Rust_Test_Member_nsString_mLength);
-    member_check!(nsStringRepr, nsString<'static>, dataflags, Rust_Test_Member_nsString_mDataFlags);
-    member_check!(nsStringRepr, nsString<'static>, classflags, Rust_Test_Member_nsString_mClassFlags);
-    member_check!(nsCStringRepr, nsCString<'static>, data, Rust_Test_Member_nsCString_mData);
-    member_check!(nsCStringRepr, nsCString<'static>, length, Rust_Test_Member_nsCString_mLength);
-    member_check!(nsCStringRepr, nsCString<'static>, dataflags, Rust_Test_Member_nsCString_mDataFlags);
-    member_check!(nsCStringRepr, nsCString<'static>, classflags, Rust_Test_Member_nsCString_mClassFlags);
+    member_check!(nsStringRepr, nsString, nsStr<'static>,
+                  data, Rust_Test_Member_nsString_mData);
+    member_check!(nsStringRepr, nsString, nsStr<'static>,
+                  length, Rust_Test_Member_nsString_mLength);
+    member_check!(nsStringRepr, nsString, nsStr<'static>,
+                  dataflags, Rust_Test_Member_nsString_mDataFlags);
+    member_check!(nsStringRepr, nsString, nsStr<'static>,
+                  classflags, Rust_Test_Member_nsString_mClassFlags);
+    member_check!(nsCStringRepr, nsCString, nsCStr<'static>,
+                  data, Rust_Test_Member_nsCString_mData);
+    member_check!(nsCStringRepr, nsCString, nsCStr<'static>,
+                  length, Rust_Test_Member_nsCString_mLength);
+    member_check!(nsCStringRepr, nsCString, nsCStr<'static>,
+                  dataflags, Rust_Test_Member_nsCString_mDataFlags);
+    member_check!(nsCStringRepr, nsCString, nsCStr<'static>,
+                  classflags, Rust_Test_Member_nsCString_mClassFlags);
     member_check!(nsFixedString<'static>, capacity, Rust_Test_Member_nsFixedString_mFixedCapacity);
     member_check!(nsFixedString<'static>, buffer, Rust_Test_Member_nsFixedString_mFixedBuf);
     member_check!(nsFixedCString<'static>, capacity, Rust_Test_Member_nsFixedCString_mFixedCapacity);

From 061f254d6e36b04bc361aca43915f0512713c948 Mon Sep 17 00:00:00 2001
From: Bill McCloskey <billm@mozilla.com>
Date: Fri, 22 Sep 2017 16:31:07 -0700
Subject: [PATCH 17/29] Bug 1398070 - Convert WillDestroyCurrentMessageLoop
 assertion to a safe no-op (r=dvander)

MozReview-Commit-ID: HZvW6nsvrj9
---
 ipc/glue/MessageChannel.cpp | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/ipc/glue/MessageChannel.cpp b/ipc/glue/MessageChannel.cpp
index 7443da313089..b1575b99e7e4 100644
--- a/ipc/glue/MessageChannel.cpp
+++ b/ipc/glue/MessageChannel.cpp
@@ -673,13 +673,17 @@ MessageChannel::CanSend() const
 void
 MessageChannel::WillDestroyCurrentMessageLoop()
 {
-#if !defined(ANDROID)
+#if defined(DEBUG)
 #if defined(MOZ_CRASHREPORTER)
     CrashReporter::AnnotateCrashReport(NS_LITERAL_CSTRING("ProtocolName"),
                                        nsDependentCString(mName));
 #endif
     MOZ_CRASH("MessageLoop destroyed before MessageChannel that's bound to it");
 #endif
+
+    // Clear mWorkerThread to avoid posting to it in the future.
+    MonitorAutoLock lock(*mMonitor);
+    mWorkerLoop = nullptr;
 }
 
 void
@@ -1964,7 +1968,7 @@ MessageChannel::MessageTask::Post()
 
     if (eventTarget) {
         eventTarget->Dispatch(self.forget(), NS_DISPATCH_NORMAL);
-    } else {
+    } else if (mChannel->mWorkerLoop) {
         mChannel->mWorkerLoop->PostTask(self.forget());
     }
 }
@@ -2406,7 +2410,9 @@ MessageChannel::OnChannelConnected(int32_t peer_id)
     mPeerPidSet = true;
     mPeerPid = peer_id;
     RefPtr<CancelableRunnable> task = mOnChannelConnectedTask;
-    mWorkerLoop->PostTask(task.forget());
+    if (mWorkerLoop) {
+        mWorkerLoop->PostTask(task.forget());
+    }
 }
 
 void
@@ -2599,7 +2605,9 @@ MessageChannel::OnNotifyMaybeChannelError()
         &MessageChannel::OnNotifyMaybeChannelError);
       RefPtr<Runnable> task = mChannelErrorTask;
       // 10 ms delay is completely arbitrary
-      mWorkerLoop->PostDelayedTask(task.forget(), 10);
+      if (mWorkerLoop) {
+          mWorkerLoop->PostDelayedTask(task.forget(), 10);
+      }
       return;
     }
 
@@ -2611,7 +2619,7 @@ MessageChannel::PostErrorNotifyTask()
 {
     mMonitor->AssertCurrentThreadOwns();
 
-    if (mChannelErrorTask)
+    if (mChannelErrorTask || !mWorkerLoop)
         return;
 
     // This must be the last code that runs on this thread!

From bff3932f551e2e6b8419654535fa965ab540947e Mon Sep 17 00:00:00 2001
From: Nicholas Nethercote <nnethercote@mozilla.com>
Date: Mon, 25 Sep 2017 11:46:07 +1000
Subject: [PATCH 18/29] Bug 1402743 - Remove
 nsIDOMWindowUtils::getCursorType(). r=bkelly.

It has no users in mozilla-central or comm-central. This also lets us remove
nsBaseWidget::GetCursor().

--HG--
extra : rebase_source : 3875ce37c78f82285c4e5dbd8133e9ae3dafa0de
---
 dom/base/nsDOMWindowUtils.cpp             | 31 -----------------------
 dom/interfaces/base/nsIDOMWindowUtils.idl |  6 -----
 widget/nsBaseWidget.cpp                   |  4 ---
 widget/nsBaseWidget.h                     |  1 -
 widget/nsIWidget.h                        |  8 ------
 5 files changed, 50 deletions(-)

diff --git a/dom/base/nsDOMWindowUtils.cpp b/dom/base/nsDOMWindowUtils.cpp
index 457c71d59e36..e8f5f745aae2 100644
--- a/dom/base/nsDOMWindowUtils.cpp
+++ b/dom/base/nsDOMWindowUtils.cpp
@@ -3039,37 +3039,6 @@ nsDOMWindowUtils::RenderDocument(const nsRect& aRect,
     return presShell->RenderDocument(aRect, aFlags, aBackgroundColor, aThebesContext);
 }
 
-NS_IMETHODIMP
-nsDOMWindowUtils::GetCursorType(int16_t *aCursor)
-{
-  NS_ENSURE_ARG_POINTER(aCursor);
-
-  nsIDocument* doc = GetDocument();
-  NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
-
-  bool isSameDoc = false;
-  do {
-    if (EventStateManager::sMouseOverDocument == doc) {
-      isSameDoc = true;
-      break;
-    }
-  } while ((doc = doc->GetParentDocument()));
-
-  if (!isSameDoc) {
-    *aCursor = eCursor_none;
-    return NS_OK;
-  }
-
-  nsCOMPtr<nsIWidget> widget = GetWidget();
-  if (!widget)
-    return NS_ERROR_FAILURE;
-
-  // fetch cursor value from window's widget
-  *aCursor = widget->GetCursor();
-
-  return NS_OK;
-}
-
 NS_IMETHODIMP
 nsDOMWindowUtils::GetDisplayDPI(float *aDPI)
 {
diff --git a/dom/interfaces/base/nsIDOMWindowUtils.idl b/dom/interfaces/base/nsIDOMWindowUtils.idl
index 6cb2d3de5f29..4e25ca24114d 100644
--- a/dom/interfaces/base/nsIDOMWindowUtils.idl
+++ b/dom/interfaces/base/nsIDOMWindowUtils.idl
@@ -80,12 +80,6 @@ interface nsIDOMWindowUtils : nsISupports {
    */
   readonly attribute boolean docCharsetIsForced;
 
-  /**
-   * Get current cursor type from this window
-   * @return the current value of nsCursor
-   */
-  short getCursorType();
-
   /**
    * Function to get metadata associated with the window's current document
    * @param aName the name of the metadata.  This should be all lowercase.
diff --git a/widget/nsBaseWidget.cpp b/widget/nsBaseWidget.cpp
index 996409f45db1..87173a6e6f01 100644
--- a/widget/nsBaseWidget.cpp
+++ b/widget/nsBaseWidget.cpp
@@ -697,10 +697,6 @@ nsBaseWidget::SetSizeMode(nsSizeMode aMode)
 // Get this component cursor
 //
 //-------------------------------------------------------------------------
-nsCursor nsBaseWidget::GetCursor()
-{
-  return mCursor;
-}
 
 void
 nsBaseWidget::SetCursor(nsCursor aCursor)
diff --git a/widget/nsBaseWidget.h b/widget/nsBaseWidget.h
index 6d6b93ea73d6..a1bb63b96496 100644
--- a/widget/nsBaseWidget.h
+++ b/widget/nsBaseWidget.h
@@ -174,7 +174,6 @@ public:
     return mIsFullyOccluded;
   }
 
-  virtual nsCursor        GetCursor() override;
   virtual void            SetCursor(nsCursor aCursor) override;
   virtual nsresult        SetCursor(imgIContainer* aCursor,
                                     uint32_t aHotspotX, uint32_t aHotspotY) override;
diff --git a/widget/nsIWidget.h b/widget/nsIWidget.h
index 7b8cdcc97608..cbedc9a82b2a 100644
--- a/widget/nsIWidget.h
+++ b/widget/nsIWidget.h
@@ -960,14 +960,6 @@ class nsIWidget : public nsISupports
 
     virtual void SetBackgroundColor(const nscolor &aColor) { }
 
-    /**
-     * Get the cursor for this widget.
-     *
-     * @return this widget's cursor.
-     */
-
-    virtual nsCursor GetCursor(void) = 0;
-
     /**
      * Set the cursor for this widget
      *

From fcd9a33eac7e4930dd7557349775340b70d51287 Mon Sep 17 00:00:00 2001
From: Nicholas Nethercote <nnethercote@mozilla.com>
Date: Thu, 21 Sep 2017 12:36:53 +1000
Subject: [PATCH 19/29] Bug 1401873 - Rename Atom as nsAtom. r=froydnj.

Because it's going to be exposed via nsIAtom.h in the next few patches.

MozReview-Commit-ID: A81s1nWrvmB

--HG--
extra : rebase_source : 43990feb460fc7343c994f72fb6c6679a3aeb1cc
---
 xpcom/ds/nsAtomTable.cpp | 101 ++++++++++++++++++++-------------------
 1 file changed, 51 insertions(+), 50 deletions(-)

diff --git a/xpcom/ds/nsAtomTable.cpp b/xpcom/ds/nsAtomTable.cpp
index 58999a140c04..9e9366620705 100644
--- a/xpcom/ds/nsAtomTable.cpp
+++ b/xpcom/ds/nsAtomTable.cpp
@@ -28,16 +28,16 @@
 
 // There are two kinds of atoms handled by this module.
 //
-// - Dynamic: the Atom itself is heap allocated, as is the nsStringBuffer it
-//   points to. |gAtomTable| holds weak references to dynamic Atoms. When the
-//   refcount of a dynamic Atom drops to zero, we increment a static counter.
-//   When that counter reaches a certain threshold, we iterate over the Atom
-//   table, removing and deleting dynamic Atoms with refcount zero. This allows
+// - Dynamic: the atom itself is heap allocated, as is the nsStringBuffer it
+//   points to. |gAtomTable| holds weak references to dynamic atoms. When the
+//   refcount of a dynamic atom drops to zero, we increment a static counter.
+//   When that counter reaches a certain threshold, we iterate over the atom
+//   table, removing and deleting dynamic atoms with refcount zero. This allows
 //   us to avoid acquiring the atom table lock during normal refcounting.
 //
-// - Static: the Atom itself is heap allocated, but it points to a static
-//   nsStringBuffer. |gAtomTable| effectively owns static Atoms, because such
-//   Atoms ignore all AddRef/Release calls, which ensures they stay alive until
+// - Static: the atom itself is heap allocated, but it points to a static
+//   nsStringBuffer. |gAtomTable| effectively owns static atoms, because such
+//   atoms ignore all AddRef/Release calls, which ensures they stay alive until
 //   |gAtomTable| itself is destroyed whereupon they are explicitly deleted.
 //
 // Note that gAtomTable is used on multiple threads, and callers must acquire
@@ -109,20 +109,20 @@ private:
 UniquePtr<nsTArray<FakeBufferRefcountHelper>> gFakeBuffers;
 #endif
 
-class Atom final : public nsIAtom
+class nsAtom final : public nsIAtom
 {
 public:
-  static already_AddRefed<Atom> CreateDynamic(const nsAString& aString,
-                                              uint32_t aHash)
+  static already_AddRefed<nsAtom> CreateDynamic(const nsAString& aString,
+                                                uint32_t aHash)
   {
     // The refcount is appropriately initialized in the constructor.
-    return dont_AddRef(new Atom(aString, aHash));
+    return dont_AddRef(new nsAtom(aString, aHash));
   }
 
-  static Atom* CreateStatic(nsStringBuffer* aStringBuffer, uint32_t aLength,
-                            uint32_t aHash)
+  static nsAtom* CreateStatic(nsStringBuffer* aStringBuffer, uint32_t aLength,
+                              uint32_t aHash)
   {
-    return new Atom(aStringBuffer, aLength, aHash);
+    return new nsAtom(aStringBuffer, aLength, aHash);
   }
 
   static void GCAtomTable();
@@ -136,8 +136,8 @@ public:
                                 GCKind aKind);
 
 private:
-  // This constructor is for dynamic Atoms.
-  Atom(const nsAString& aString, uint32_t aHash)
+  // This constructor is for dynamic atoms.
+  nsAtom(const nsAString& aString, uint32_t aHash)
     : mRefCnt(1)
   {
     mLength = aString.Length();
@@ -170,8 +170,8 @@ private:
     mozilla::Unused << buf.forget();
   }
 
-  // This constructor is for static Atoms.
-  Atom(nsStringBuffer* aStringBuffer, uint32_t aLength, uint32_t aHash)
+  // This constructor is for static atoms.
+  nsAtom(nsStringBuffer* aStringBuffer, uint32_t aLength, uint32_t aHash)
   {
     mLength = aLength;
     SetKind(AtomKind::StaticAtom);
@@ -199,10 +199,11 @@ private:
   }
 
 public:
-  // We don't need a virtual destructor because we always delete via an Atom*
-  // pointer (in AtomTableClearEntry() for static Atoms, and in
-  // GCAtomTableLocked() for dynamic Atoms), not an nsIAtom* pointer.
-  ~Atom() {
+  // We don't need a virtual destructor because we always delete via an nsAtom*
+  // pointer (in AtomTableClearEntry() for static atoms, and in
+  // GCAtomTableLocked() for dynamic atoms), not an nsIAtom* pointer.
+  ~nsAtom()
+  {
     if (IsDynamicAtom()) {
       nsStringBuffer::FromData(mString)->Release();
     } else {
@@ -222,17 +223,17 @@ protected:
   NS_DECL_OWNINGTHREAD
 };
 
-NS_IMPL_QUERY_INTERFACE(Atom, nsIAtom);
+NS_IMPL_QUERY_INTERFACE(nsAtom, nsIAtom);
 
 NS_IMETHODIMP
-Atom::ToUTF8String(nsACString& aBuf)
+nsAtom::ToUTF8String(nsACString& aBuf)
 {
   CopyUTF16toUTF8(nsDependentString(mString, mLength), aBuf);
   return NS_OK;
 }
 
 NS_IMETHODIMP_(size_t)
-Atom::SizeOfIncludingThis(MallocSizeOf aMallocSizeOf)
+nsAtom::SizeOfIncludingThis(MallocSizeOf aMallocSizeOf)
 {
   size_t n = aMallocSizeOf(this);
   // String buffers pointed to by static atoms are in static memory, and so
@@ -256,7 +257,7 @@ nsIAtom::AddRef()
     MOZ_ASSERT(IsStaticAtom());
     return 2;
   }
-  return static_cast<Atom*>(this)->DynamicAddRef();
+  return static_cast<nsAtom*>(this)->DynamicAddRef();
 }
 
 NS_IMETHODIMP_(MozExternalRefCountType)
@@ -267,7 +268,7 @@ nsIAtom::Release()
     MOZ_ASSERT(IsStaticAtom());
     return 1;
   }
-  return static_cast<Atom*>(this)->DynamicRelease();
+  return static_cast<nsAtom*>(this)->DynamicRelease();
 }
 
 //----------------------------------------------------------------------
@@ -334,10 +335,10 @@ struct AtomTableKey
 
 struct AtomTableEntry : public PLDHashEntryHdr
 {
-  // These references are either to dynamic Atoms, in which case they are
-  // non-owning, or they are to static Atoms, which aren't really refcounted.
+  // These references are either to dynamic atoms, in which case they are
+  // non-owning, or they are to static atoms, which aren't really refcounted.
   // See the comment at the top of this file for more details.
-  Atom* MOZ_NON_OWNING_REF mAtom;
+  nsAtom* MOZ_NON_OWNING_REF mAtom;
 };
 
 static PLDHashNumber
@@ -367,10 +368,10 @@ static void
 AtomTableClearEntry(PLDHashTable* aTable, PLDHashEntryHdr* aEntry)
 {
   auto entry = static_cast<AtomTableEntry*>(aEntry);
-  Atom* atom = entry->mAtom;
+  nsAtom* atom = entry->mAtom;
   if (atom->IsStaticAtom()) {
-    // This case -- when the entry being cleared holds a static Atom -- only
-    // occurs when gAtomTable is destroyed, whereupon all static Atoms within it
+    // This case -- when the entry being cleared holds a static atom -- only
+    // occurs when gAtomTable is destroyed, whereupon all static atoms within it
     // must be explicitly deleted.
     delete atom;
   }
@@ -393,11 +394,11 @@ static const PLDHashTableOps AtomTableOps = {
 //----------------------------------------------------------------------
 
 #define RECENTLY_USED_MAIN_THREAD_ATOM_CACHE_SIZE 31
-static Atom*
+static nsAtom*
   sRecentlyUsedMainThreadAtoms[RECENTLY_USED_MAIN_THREAD_ATOM_CACHE_SIZE] = {};
 
 void
-Atom::GCAtomTable()
+nsAtom::GCAtomTable()
 {
   if (NS_IsMainThread()) {
     MutexAutoLock lock(*gAtomTableLock);
@@ -406,7 +407,7 @@ Atom::GCAtomTable()
 }
 
 void
-Atom::GCAtomTableLocked(const MutexAutoLock& aProofOfLock, GCKind aKind)
+nsAtom::GCAtomTableLocked(const MutexAutoLock& aProofOfLock, GCKind aKind)
 {
   MOZ_ASSERT(NS_IsMainThread());
   for (uint32_t i = 0; i < RECENTLY_USED_MAIN_THREAD_ATOM_CACHE_SIZE; ++i) {
@@ -422,7 +423,7 @@ Atom::GCAtomTableLocked(const MutexAutoLock& aProofOfLock, GCKind aKind)
       continue;
     }
 
-    Atom* atom = entry->mAtom;
+    nsAtom* atom = entry->mAtom;
     if (atom->mRefCnt == 0) {
       i.Remove();
       delete atom;
@@ -474,7 +475,7 @@ Atom::GCAtomTableLocked(const MutexAutoLock& aProofOfLock, GCKind aKind)
 }
 
 MozExternalRefCountType
-Atom::DynamicAddRef()
+nsAtom::DynamicAddRef()
 {
   MOZ_ASSERT(IsDynamicAtom());
   nsrefcnt count = ++mRefCnt;
@@ -493,7 +494,7 @@ static const int32_t kAtomGCThreshold = 10000;
 #endif
 
 MozExternalRefCountType
-Atom::DynamicRelease()
+nsAtom::DynamicRelease()
 {
   MOZ_ASSERT(IsDynamicAtom());
   MOZ_ASSERT(mRefCnt > 0);
@@ -536,9 +537,9 @@ public:
 
   enum { ALLOW_MEMMOVE = true };
 
-  // Static Atoms aren't really refcounted. Because these entries live in a
+  // Static atoms aren't really refcounted. Because these entries live in a
   // global hashtable, this reference is essentially owning.
-  Atom* MOZ_OWNING_REF mAtom;
+  nsAtom* MOZ_OWNING_REF mAtom;
 };
 
 /**
@@ -603,7 +604,7 @@ NS_ShutdownAtomTable()
   // builds.
   {
     MutexAutoLock lock(*gAtomTableLock);
-    Atom::GCAtomTableLocked(lock, Atom::GCKind::Shutdown);
+    nsAtom::GCAtomTableLocked(lock, nsAtom::GCKind::Shutdown);
   }
 #endif
 
@@ -674,7 +675,7 @@ RegisterStaticAtoms(const nsStaticAtom* aAtoms, uint32_t aAtomCount)
       GetAtomHashEntry(static_cast<char16_t*>(stringBuffer->Data()),
                        stringLen, &hash);
 
-    Atom* atom = he->mAtom;
+    nsAtom* atom = he->mAtom;
     if (atom) {
       // Disallow creating a dynamic atom, and then later, while the
       // dynamic atom is still alive, registering that same atom as a
@@ -687,7 +688,7 @@ RegisterStaticAtoms(const nsStaticAtom* aAtoms, uint32_t aAtomCount)
           "Static atom registration for %s should be pushed back", name.get());
       }
     } else {
-      atom = Atom::CreateStatic(stringBuffer, stringLen, hash);
+      atom = nsAtom::CreateStatic(stringBuffer, stringLen, hash);
       he->mAtom = atom;
     }
     *atomp = atom;
@@ -727,7 +728,7 @@ NS_Atomize(const nsACString& aUTF8String)
   // Actually, now there is, sort of: ForgetSharedBuffer.
   nsString str;
   CopyUTF8toUTF16(aUTF8String, str);
-  RefPtr<Atom> atom = Atom::CreateDynamic(str, hash);
+  RefPtr<nsAtom> atom = nsAtom::CreateDynamic(str, hash);
 
   he->mAtom = atom;
 
@@ -755,7 +756,7 @@ NS_Atomize(const nsAString& aUTF16String)
     return atom.forget();
   }
 
-  RefPtr<Atom> atom = Atom::CreateDynamic(aUTF16String, hash);
+  RefPtr<nsAtom> atom = nsAtom::CreateDynamic(aUTF16String, hash);
   he->mAtom = atom;
 
   return atom.forget();
@@ -769,7 +770,7 @@ NS_AtomizeMainThread(const nsAString& aUTF16String)
   uint32_t hash;
   AtomTableKey key(aUTF16String.Data(), aUTF16String.Length(), &hash);
   uint32_t index = hash % RECENTLY_USED_MAIN_THREAD_ATOM_CACHE_SIZE;
-  Atom* atom = sRecentlyUsedMainThreadAtoms[index];
+  nsAtom* atom = sRecentlyUsedMainThreadAtoms[index];
   if (atom) {
     uint32_t length = atom->GetLength();
     if (length == key.mLength &&
@@ -786,7 +787,7 @@ NS_AtomizeMainThread(const nsAString& aUTF16String)
   if (he->mAtom) {
     retVal = he->mAtom;
   } else {
-    RefPtr<Atom> newAtom = Atom::CreateDynamic(aUTF16String, hash);
+    RefPtr<nsAtom> newAtom = nsAtom::CreateDynamic(aUTF16String, hash);
     he->mAtom = newAtom;
     retVal = newAtom.forget();
   }
@@ -798,7 +799,7 @@ NS_AtomizeMainThread(const nsAString& aUTF16String)
 nsrefcnt
 NS_GetNumberOfAtoms(void)
 {
-  Atom::GCAtomTable(); // Trigger a GC so that we return a deterministic result.
+  nsAtom::GCAtomTable(); // Trigger a GC so we return a deterministic result.
   MutexAutoLock lock(*gAtomTableLock);
   return gAtomTable->EntryCount();
 }

From de07428d79081d796f57a9a53e6adf178ba9cfb7 Mon Sep 17 00:00:00 2001
From: Nicholas Nethercote <nnethercote@mozilla.com>
Date: Mon, 25 Sep 2017 16:30:32 +1000
Subject: [PATCH 20/29] Bug 1401873 - Expose nsAtom in nsIAtom.h. r=froydnj.

This patch moves nsAtom's declaration to nsIAtom.h. In order to keep most of
nsAtom's members private the patch also does the following.

- It introduces a new class, nsAtomFriend, which encapsulates the functions
  that will need access to nsAtom's private members.

- It moves GCKind, GCAtomTable(), and GCAtomTableLocked() out of nsAtom.

- It removes the factory methods, and replaces their uses with direct
  constructor calls.

MozReview-Commit-ID: L8vfrHsR2cS

--HG--
extra : rebase_source : d38a65515ae82c355966ca80ab235bea11b638af
---
 xpcom/ds/nsAtomTable.cpp | 271 ++++++++++++++++++++-------------------
 xpcom/ds/nsIAtom.h       |  23 ++++
 2 files changed, 164 insertions(+), 130 deletions(-)

diff --git a/xpcom/ds/nsAtomTable.cpp b/xpcom/ds/nsAtomTable.cpp
index 9e9366620705..4470a143de8f 100644
--- a/xpcom/ds/nsAtomTable.cpp
+++ b/xpcom/ds/nsAtomTable.cpp
@@ -67,6 +67,32 @@ class CheckStaticAtomSizes
 
 //----------------------------------------------------------------------
 
+enum class GCKind {
+  RegularOperation,
+  Shutdown,
+};
+
+// This class encapsulates the functions that need access to nsAtom's private
+// members.
+class nsAtomFriend
+{
+public:
+  static void RegisterStaticAtoms(const nsStaticAtom* aAtoms,
+                                  uint32_t aAtomCount);
+
+  static void AtomTableClearEntry(PLDHashTable* aTable,
+                                  PLDHashEntryHdr* aEntry);
+
+  static void GCAtomTableLocked(const MutexAutoLock& aProofOfLock,
+                                GCKind aKind);
+
+  static already_AddRefed<nsIAtom> Atomize(const nsACString& aUTF8String);
+  static already_AddRefed<nsIAtom> Atomize(const nsAString& aUTF16String);
+  static already_AddRefed<nsIAtom> AtomizeMainThread(const nsAString& aUTF16Str);
+};
+
+//----------------------------------------------------------------------
+
 // gUnusedAtomCount is incremented when an atom loses its last reference
 // (and thus turned into unused state), and decremented when an unused
 // atom gets a reference again. The atom table relies on this value to
@@ -109,119 +135,79 @@ private:
 UniquePtr<nsTArray<FakeBufferRefcountHelper>> gFakeBuffers;
 #endif
 
-class nsAtom final : public nsIAtom
+// This constructor is for dynamic atoms.
+nsAtom::nsAtom(const nsAString& aString, uint32_t aHash)
+  : mRefCnt(1)
 {
-public:
-  static already_AddRefed<nsAtom> CreateDynamic(const nsAString& aString,
-                                                uint32_t aHash)
-  {
-    // The refcount is appropriately initialized in the constructor.
-    return dont_AddRef(new nsAtom(aString, aHash));
-  }
-
-  static nsAtom* CreateStatic(nsStringBuffer* aStringBuffer, uint32_t aLength,
-                              uint32_t aHash)
-  {
-    return new nsAtom(aStringBuffer, aLength, aHash);
-  }
-
-  static void GCAtomTable();
-
-  enum class GCKind {
-    RegularOperation,
-    Shutdown,
-  };
-
-  static void GCAtomTableLocked(const MutexAutoLock& aProofOfLock,
-                                GCKind aKind);
-
-private:
-  // This constructor is for dynamic atoms.
-  nsAtom(const nsAString& aString, uint32_t aHash)
-    : mRefCnt(1)
-  {
-    mLength = aString.Length();
-    SetKind(AtomKind::DynamicAtom);
-    RefPtr<nsStringBuffer> buf = nsStringBuffer::FromString(aString);
-    if (buf) {
-      mString = static_cast<char16_t*>(buf->Data());
-    } else {
-      const size_t size = (mLength + 1) * sizeof(char16_t);
-      buf = nsStringBuffer::Alloc(size);
-      if (MOZ_UNLIKELY(!buf)) {
-        // We OOM because atom allocations should be small and it's hard to
-        // handle them more gracefully in a constructor.
-        NS_ABORT_OOM(size);
-      }
-      mString = static_cast<char16_t*>(buf->Data());
-      CopyUnicodeTo(aString, 0, mString, mLength);
-      mString[mLength] = char16_t(0);
+  mLength = aString.Length();
+  SetKind(AtomKind::DynamicAtom);
+  RefPtr<nsStringBuffer> buf = nsStringBuffer::FromString(aString);
+  if (buf) {
+    mString = static_cast<char16_t*>(buf->Data());
+  } else {
+    const size_t size = (mLength + 1) * sizeof(char16_t);
+    buf = nsStringBuffer::Alloc(size);
+    if (MOZ_UNLIKELY(!buf)) {
+      // We OOM because atom allocations should be small and it's hard to
+      // handle them more gracefully in a constructor.
+      NS_ABORT_OOM(size);
     }
-
-    mHash = aHash;
-    MOZ_ASSERT(mHash == HashString(mString, mLength));
-
-    NS_ASSERTION(mString[mLength] == char16_t(0), "null terminated");
-    NS_ASSERTION(buf && buf->StorageSize() >= (mLength + 1) * sizeof(char16_t),
-                 "enough storage");
-    NS_ASSERTION(Equals(aString), "correct data");
-
-    // Take ownership of buffer
-    mozilla::Unused << buf.forget();
+    mString = static_cast<char16_t*>(buf->Data());
+    CopyUnicodeTo(aString, 0, mString, mLength);
+    mString[mLength] = char16_t(0);
   }
 
-  // This constructor is for static atoms.
-  nsAtom(nsStringBuffer* aStringBuffer, uint32_t aLength, uint32_t aHash)
-  {
-    mLength = aLength;
-    SetKind(AtomKind::StaticAtom);
-    mString = static_cast<char16_t*>(aStringBuffer->Data());
+  mHash = aHash;
+  MOZ_ASSERT(mHash == HashString(mString, mLength));
+
+  NS_ASSERTION(mString[mLength] == char16_t(0), "null terminated");
+  NS_ASSERTION(buf && buf->StorageSize() >= (mLength + 1) * sizeof(char16_t),
+               "enough storage");
+  NS_ASSERTION(Equals(aString), "correct data");
+
+  // Take ownership of buffer
+  mozilla::Unused << buf.forget();
+}
+
+// This constructor is for static atoms.
+nsAtom::nsAtom(nsStringBuffer* aStringBuffer, uint32_t aLength, uint32_t aHash)
+{
+  mLength = aLength;
+  SetKind(AtomKind::StaticAtom);
+  mString = static_cast<char16_t*>(aStringBuffer->Data());
 
 #if defined(NS_BUILD_REFCNT_LOGGING)
-    MOZ_ASSERT(NS_IsMainThread());
-    if (!gFakeBuffers) {
-      gFakeBuffers = MakeUnique<nsTArray<FakeBufferRefcountHelper>>();
-    }
-    gFakeBuffers->AppendElement(aStringBuffer);
+  MOZ_ASSERT(NS_IsMainThread());
+  if (!gFakeBuffers) {
+    gFakeBuffers = MakeUnique<nsTArray<FakeBufferRefcountHelper>>();
+  }
+  gFakeBuffers->AppendElement(aStringBuffer);
 #endif
 
-    // Technically we could currently avoid doing this addref by instead making
-    // the static atom buffers have an initial refcount of 2.
-    aStringBuffer->AddRef();
+  // Technically we could currently avoid doing this addref by instead making
+  // the static atom buffers have an initial refcount of 2.
+  aStringBuffer->AddRef();
 
-    mHash = aHash;
-    MOZ_ASSERT(mHash == HashString(mString, mLength));
+  mHash = aHash;
+  MOZ_ASSERT(mHash == HashString(mString, mLength));
 
-    MOZ_ASSERT(mString[mLength] == char16_t(0), "null terminated");
-    MOZ_ASSERT(aStringBuffer &&
-               aStringBuffer->StorageSize() == (mLength + 1) * sizeof(char16_t),
-               "correct storage");
+  MOZ_ASSERT(mString[mLength] == char16_t(0), "null terminated");
+  MOZ_ASSERT(aStringBuffer &&
+             aStringBuffer->StorageSize() == (mLength + 1) * sizeof(char16_t),
+             "correct storage");
+}
+
+// We don't need a virtual destructor because we always delete via an nsAtom*
+// pointer (in AtomTableClearEntry() for static atoms, and in
+// GCAtomTableLocked() for dynamic atoms), not an nsIAtom* pointer.
+nsAtom::~nsAtom()
+{
+  if (IsDynamicAtom()) {
+    nsStringBuffer::FromData(mString)->Release();
+  } else {
+    MOZ_ASSERT(IsStaticAtom());
   }
-
-public:
-  // We don't need a virtual destructor because we always delete via an nsAtom*
-  // pointer (in AtomTableClearEntry() for static atoms, and in
-  // GCAtomTableLocked() for dynamic atoms), not an nsIAtom* pointer.
-  ~nsAtom()
-  {
-    if (IsDynamicAtom()) {
-      nsStringBuffer::FromData(mString)->Release();
-    } else {
-      MOZ_ASSERT(IsStaticAtom());
-    }
-  }
-
-  NS_DECL_NSIATOM
-  NS_IMETHOD QueryInterface(REFNSIID aIID, void** aInstancePtr) final;
-  typedef mozilla::TrueType HasThreadSafeRefCnt;
-
-  MozExternalRefCountType DynamicAddRef();
-  MozExternalRefCountType DynamicRelease();
-
-protected:
-  ThreadSafeAutoRefCnt mRefCnt;
-  NS_DECL_OWNINGTHREAD
-};
+}
 
 NS_IMPL_QUERY_INTERFACE(nsAtom, nsIAtom);
 
@@ -364,8 +350,8 @@ AtomTableMatchKey(const PLDHashEntryHdr* aEntry, const void* aKey)
   return he->mAtom->Equals(k->mUTF16String, k->mLength);
 }
 
-static void
-AtomTableClearEntry(PLDHashTable* aTable, PLDHashEntryHdr* aEntry)
+void
+nsAtomFriend::AtomTableClearEntry(PLDHashTable* aTable, PLDHashEntryHdr* aEntry)
 {
   auto entry = static_cast<AtomTableEntry*>(aEntry);
   nsAtom* atom = entry->mAtom;
@@ -387,7 +373,7 @@ static const PLDHashTableOps AtomTableOps = {
   AtomTableGetHash,
   AtomTableMatchKey,
   PLDHashTable::MoveEntryStub,
-  AtomTableClearEntry,
+  nsAtomFriend::AtomTableClearEntry,
   AtomTableInitEntry
 };
 
@@ -398,16 +384,7 @@ static nsAtom*
   sRecentlyUsedMainThreadAtoms[RECENTLY_USED_MAIN_THREAD_ATOM_CACHE_SIZE] = {};
 
 void
-nsAtom::GCAtomTable()
-{
-  if (NS_IsMainThread()) {
-    MutexAutoLock lock(*gAtomTableLock);
-    GCAtomTableLocked(lock, GCKind::RegularOperation);
-  }
-}
-
-void
-nsAtom::GCAtomTableLocked(const MutexAutoLock& aProofOfLock, GCKind aKind)
+nsAtomFriend::GCAtomTableLocked(const MutexAutoLock& aProofOfLock, GCKind aKind)
 {
   MOZ_ASSERT(NS_IsMainThread());
   for (uint32_t i = 0; i < RECENTLY_USED_MAIN_THREAD_ATOM_CACHE_SIZE; ++i) {
@@ -474,6 +451,15 @@ nsAtom::GCAtomTableLocked(const MutexAutoLock& aProofOfLock, GCKind aKind)
   gUnusedAtomCount -= removedCount;
 }
 
+static void
+GCAtomTable()
+{
+  if (NS_IsMainThread()) {
+    MutexAutoLock lock(*gAtomTableLock);
+    nsAtomFriend::GCAtomTableLocked(lock, GCKind::RegularOperation);
+  }
+}
+
 MozExternalRefCountType
 nsAtom::DynamicAddRef()
 {
@@ -604,7 +590,7 @@ NS_ShutdownAtomTable()
   // builds.
   {
     MutexAutoLock lock(*gAtomTableLock);
-    nsAtom::GCAtomTableLocked(lock, nsAtom::GCKind::Shutdown);
+    nsAtomFriend::GCAtomTableLocked(lock, GCKind::Shutdown);
   }
 #endif
 
@@ -651,7 +637,8 @@ GetAtomHashEntry(const char16_t* aString, uint32_t aLength, uint32_t* aHashOut)
 }
 
 void
-RegisterStaticAtoms(const nsStaticAtom* aAtoms, uint32_t aAtomCount)
+nsAtomFriend::RegisterStaticAtoms(const nsStaticAtom* aAtoms,
+                                  uint32_t aAtomCount)
 {
   MutexAutoLock lock(*gAtomTableLock);
 
@@ -688,7 +675,7 @@ RegisterStaticAtoms(const nsStaticAtom* aAtoms, uint32_t aAtomCount)
           "Static atom registration for %s should be pushed back", name.get());
       }
     } else {
-      atom = nsAtom::CreateStatic(stringBuffer, stringLen, hash);
+      atom = new nsAtom(stringBuffer, stringLen, hash);
       he->mAtom = atom;
     }
     *atomp = atom;
@@ -702,14 +689,20 @@ RegisterStaticAtoms(const nsStaticAtom* aAtoms, uint32_t aAtomCount)
   }
 }
 
-already_AddRefed<nsIAtom>
-NS_Atomize(const char* aUTF8String)
+void
+RegisterStaticAtoms(const nsStaticAtom* aAtoms, uint32_t aAtomCount)
 {
-  return NS_Atomize(nsDependentCString(aUTF8String));
+  nsAtomFriend::RegisterStaticAtoms(aAtoms, aAtomCount);
 }
 
 already_AddRefed<nsIAtom>
-NS_Atomize(const nsACString& aUTF8String)
+NS_Atomize(const char* aUTF8String)
+{
+  return nsAtomFriend::Atomize(nsDependentCString(aUTF8String));
+}
+
+already_AddRefed<nsIAtom>
+nsAtomFriend::Atomize(const nsACString& aUTF8String)
 {
   MutexAutoLock lock(*gAtomTableLock);
   uint32_t hash;
@@ -728,7 +721,7 @@ NS_Atomize(const nsACString& aUTF8String)
   // Actually, now there is, sort of: ForgetSharedBuffer.
   nsString str;
   CopyUTF8toUTF16(aUTF8String, str);
-  RefPtr<nsAtom> atom = nsAtom::CreateDynamic(str, hash);
+  RefPtr<nsAtom> atom = dont_AddRef(new nsAtom(str, hash));
 
   he->mAtom = atom;
 
@@ -736,13 +729,19 @@ NS_Atomize(const nsACString& aUTF8String)
 }
 
 already_AddRefed<nsIAtom>
-NS_Atomize(const char16_t* aUTF16String)
+NS_Atomize(const nsACString& aUTF8String)
 {
-  return NS_Atomize(nsDependentString(aUTF16String));
+  return nsAtomFriend::Atomize(aUTF8String);
 }
 
 already_AddRefed<nsIAtom>
-NS_Atomize(const nsAString& aUTF16String)
+NS_Atomize(const char16_t* aUTF16String)
+{
+  return nsAtomFriend::Atomize(nsDependentString(aUTF16String));
+}
+
+already_AddRefed<nsIAtom>
+nsAtomFriend::Atomize(const nsAString& aUTF16String)
 {
   MutexAutoLock lock(*gAtomTableLock);
   uint32_t hash;
@@ -756,14 +755,20 @@ NS_Atomize(const nsAString& aUTF16String)
     return atom.forget();
   }
 
-  RefPtr<nsAtom> atom = nsAtom::CreateDynamic(aUTF16String, hash);
+  RefPtr<nsAtom> atom = dont_AddRef(new nsAtom(aUTF16String, hash));
   he->mAtom = atom;
 
   return atom.forget();
 }
 
 already_AddRefed<nsIAtom>
-NS_AtomizeMainThread(const nsAString& aUTF16String)
+NS_Atomize(const nsAString& aUTF16String)
+{
+  return nsAtomFriend::Atomize(aUTF16String);
+}
+
+already_AddRefed<nsIAtom>
+nsAtomFriend::AtomizeMainThread(const nsAString& aUTF16String)
 {
   MOZ_ASSERT(NS_IsMainThread());
   nsCOMPtr<nsIAtom> retVal;
@@ -787,7 +792,7 @@ NS_AtomizeMainThread(const nsAString& aUTF16String)
   if (he->mAtom) {
     retVal = he->mAtom;
   } else {
-    RefPtr<nsAtom> newAtom = nsAtom::CreateDynamic(aUTF16String, hash);
+    RefPtr<nsAtom> newAtom = dont_AddRef(new nsAtom(aUTF16String, hash));
     he->mAtom = newAtom;
     retVal = newAtom.forget();
   }
@@ -796,10 +801,16 @@ NS_AtomizeMainThread(const nsAString& aUTF16String)
   return retVal.forget();
 }
 
+already_AddRefed<nsIAtom>
+NS_AtomizeMainThread(const nsAString& aUTF16String)
+{
+  return nsAtomFriend::AtomizeMainThread(aUTF16String);
+}
+
 nsrefcnt
 NS_GetNumberOfAtoms(void)
 {
-  nsAtom::GCAtomTable(); // Trigger a GC so we return a deterministic result.
+  GCAtomTable(); // Trigger a GC so we return a deterministic result.
   MutexAutoLock lock(*gAtomTableLock);
   return gAtomTable->EntryCount();
 }
diff --git a/xpcom/ds/nsIAtom.h b/xpcom/ds/nsIAtom.h
index 9124e24f3e44..201c2ff97190 100644
--- a/xpcom/ds/nsIAtom.h
+++ b/xpcom/ds/nsIAtom.h
@@ -97,6 +97,29 @@ NS_DEFINE_STATIC_IID_ACCESSOR(nsIAtom, NS_IATOM_IID)
   NS_IMETHOD ToUTF8String(nsACString& _retval) override; \
   NS_IMETHOD_(size_t) SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf) override;
 
+class nsAtom final : public nsIAtom
+{
+public:
+  NS_DECL_NSIATOM
+  NS_IMETHOD QueryInterface(REFNSIID aIID, void** aInstancePtr) final;
+  typedef mozilla::TrueType HasThreadSafeRefCnt;
+
+private:
+  friend class nsIAtom;
+  friend class nsAtomFriend;
+
+  // Construction and destruction is done entirely by |friend|s.
+  nsAtom(const nsAString& aString, uint32_t aHash);
+  nsAtom(nsStringBuffer* aStringBuffer, uint32_t aLength, uint32_t aHash);
+  ~nsAtom();
+
+  MozExternalRefCountType DynamicAddRef();
+  MozExternalRefCountType DynamicRelease();
+
+  mozilla::ThreadSafeAutoRefCnt mRefCnt;
+  NS_DECL_OWNINGTHREAD
+};
+
 // The four forms of NS_Atomize (for use with |nsCOMPtr<nsIAtom>|) return the
 // atom for the string given. At any given time there will always be one atom
 // representing a given string. Atoms are intended to make string comparison

From 5018bb4f9b042166fb69d76184e3cc8c430dc1e9 Mon Sep 17 00:00:00 2001
From: Nicholas Nethercote <nnethercote@mozilla.com>
Date: Thu, 21 Sep 2017 14:02:05 +1000
Subject: [PATCH 21/29] Bug 1401873 - Remove nsHtml5Atom. r=froydnj,hsivonen.

nsHtml5Atoms are very similar to dynamic nsAtoms. This patch removes the former
in favour of the latter, which leaves nsAtom as the only subclass of nsIAtom.

nsAtom::mKind is still used to distinguish dynamic atoms from HTML5 atoms, and
the HTML5 parser still uses manual memory management to handle its HTML5 atoms.

nsHtml5AtomEntry::mAtom had to be changed from an nsAutoPtr to a raw pointer
because nsAtom's destructor is private.

MozReview-Commit-ID: 1pBzwkog3ut

--HG--
extra : rebase_source : fbb819e527cb30606348da9ce3eede62e00fb936
---
 parser/html/moz.build                  |  1 -
 parser/html/nsHtml5Atom.cpp            | 63 --------------------------
 parser/html/nsHtml5Atom.h              | 28 ------------
 parser/html/nsHtml5AtomTable.cpp       |  4 +-
 parser/html/nsHtml5AtomTable.h         | 10 +---
 parser/html/nsHtml5SpeculativeLoad.cpp |  1 +
 xpcom/ds/nsAtomTable.cpp               | 29 +++++++-----
 xpcom/ds/nsIAtom.h                     |  9 +++-
 8 files changed, 29 insertions(+), 116 deletions(-)
 delete mode 100644 parser/html/nsHtml5Atom.cpp
 delete mode 100644 parser/html/nsHtml5Atom.h

diff --git a/parser/html/moz.build b/parser/html/moz.build
index 256fa9f42e6a..457e07e69829 100644
--- a/parser/html/moz.build
+++ b/parser/html/moz.build
@@ -55,7 +55,6 @@ EXPORTS += [
 ]
 
 UNIFIED_SOURCES += [
-    'nsHtml5Atom.cpp',
     'nsHtml5AtomTable.cpp',
     'nsHtml5AttributeName.cpp',
     'nsHtml5DependentUTF16Buffer.cpp',
diff --git a/parser/html/nsHtml5Atom.cpp b/parser/html/nsHtml5Atom.cpp
deleted file mode 100644
index 19d1aa7d1e2c..000000000000
--- a/parser/html/nsHtml5Atom.cpp
+++ /dev/null
@@ -1,63 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsHtml5Atom.h"
-#include "nsAutoPtr.h"
-#include "mozilla/Unused.h"
-
-nsHtml5Atom::nsHtml5Atom(const nsAString& aString)
-{
-  mLength = aString.Length();
-  SetKind(AtomKind::HTML5Atom);
-  RefPtr<nsStringBuffer> buf = nsStringBuffer::FromString(aString);
-  if (buf) {
-    mString = static_cast<char16_t*>(buf->Data());
-  } else {
-    const size_t size = (mLength + 1) * sizeof(char16_t);
-    buf = nsStringBuffer::Alloc(size);
-    if (MOZ_UNLIKELY(!buf)) {
-      // We OOM because atom allocations should be small and it's hard to
-      // handle them more gracefully in a constructor.
-      NS_ABORT_OOM(size);
-    }
-    mString = static_cast<char16_t*>(buf->Data());
-    CopyUnicodeTo(aString, 0, mString, mLength);
-    mString[mLength] = char16_t(0);
-  }
-
-  NS_ASSERTION(mString[mLength] == char16_t(0), "null terminated");
-  NS_ASSERTION(buf && buf->StorageSize() >= (mLength+1) * sizeof(char16_t),
-               "enough storage");
-  NS_ASSERTION(Equals(aString), "correct data");
-
-  // Take ownership of buffer
-  mozilla::Unused << buf.forget();
-}
-
-nsHtml5Atom::~nsHtml5Atom()
-{
-  nsStringBuffer::FromData(mString)->Release();
-}
-
-NS_IMETHODIMP
-nsHtml5Atom::QueryInterface(REFNSIID aIID, void** aInstancePtr)
-{
-  NS_NOTREACHED("Attempt to call QueryInterface an nsHtml5Atom.");
-  return NS_ERROR_UNEXPECTED;
-}
-
-NS_IMETHODIMP
-nsHtml5Atom::ToUTF8String(nsACString& aReturn)
-{
-  NS_NOTREACHED("Should not attempt to convert to an UTF-8 string.");
-  return NS_ERROR_NOT_IMPLEMENTED;
-}
-
-NS_IMETHODIMP_(size_t)
-nsHtml5Atom::SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf)
-{
-  NS_NOTREACHED("Should not call SizeOfIncludingThis.");
-  return 0;
-}
-
diff --git a/parser/html/nsHtml5Atom.h b/parser/html/nsHtml5Atom.h
deleted file mode 100644
index be56b5ed6bab..000000000000
--- a/parser/html/nsHtml5Atom.h
+++ /dev/null
@@ -1,28 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef nsHtml5Atom_h
-#define nsHtml5Atom_h
-
-#include "nsIAtom.h"
-#include "mozilla/Attributes.h"
-
-/**
- * A dynamic atom implementation meant for use within the nsHtml5Tokenizer and 
- * nsHtml5TreeBuilder owned by one nsHtml5Parser or nsHtml5StreamParser 
- * instance.
- *
- * Usage is documented in nsHtml5AtomTable and nsIAtom.
- */
-class nsHtml5Atom final : public nsIAtom
-{
-  public:
-    NS_IMETHOD QueryInterface(REFNSIID aIID, void** aInstancePtr) final;
-    NS_DECL_NSIATOM
-
-    explicit nsHtml5Atom(const nsAString& aString);
-    ~nsHtml5Atom();
-};
-
-#endif // nsHtml5Atom_h
diff --git a/parser/html/nsHtml5AtomTable.cpp b/parser/html/nsHtml5AtomTable.cpp
index b8f967929838..ed149c056f2c 100644
--- a/parser/html/nsHtml5AtomTable.cpp
+++ b/parser/html/nsHtml5AtomTable.cpp
@@ -3,12 +3,11 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsHtml5AtomTable.h"
-#include "nsHtml5Atom.h"
 #include "nsThreadUtils.h"
 
 nsHtml5AtomEntry::nsHtml5AtomEntry(KeyTypePointer aStr)
   : nsStringHashKey(aStr)
-  , mAtom(new nsHtml5Atom(*aStr))
+  , mAtom(new nsAtom(nsAtom::AtomKind::HTML5Atom, *aStr, 0))
 {
 }
 
@@ -21,6 +20,7 @@ nsHtml5AtomEntry::nsHtml5AtomEntry(const nsHtml5AtomEntry& aOther)
 
 nsHtml5AtomEntry::~nsHtml5AtomEntry()
 {
+  delete mAtom;
 }
 
 nsHtml5AtomTable::nsHtml5AtomTable()
diff --git a/parser/html/nsHtml5AtomTable.h b/parser/html/nsHtml5AtomTable.h
index 48153c6ec12f..91e3469cbe81 100644
--- a/parser/html/nsHtml5AtomTable.h
+++ b/parser/html/nsHtml5AtomTable.h
@@ -7,26 +7,20 @@
 
 #include "nsHashKeys.h"
 #include "nsTHashtable.h"
-#include "nsAutoPtr.h"
 #include "nsIAtom.h"
 #include "nsISerialEventTarget.h"
 
 #define RECENTLY_USED_PARSER_ATOMS_SIZE 31
 
-class nsHtml5Atom;
-
 class nsHtml5AtomEntry : public nsStringHashKey
 {
   public:
     explicit nsHtml5AtomEntry(KeyTypePointer aStr);
     nsHtml5AtomEntry(const nsHtml5AtomEntry& aOther);
     ~nsHtml5AtomEntry();
-    inline nsHtml5Atom* GetAtom()
-    {
-      return mAtom;
-    }
+    inline nsAtom* GetAtom() { return mAtom; }
   private:
-    nsAutoPtr<nsHtml5Atom> mAtom;
+    nsAtom* mAtom;
 };
 
 /**
diff --git a/parser/html/nsHtml5SpeculativeLoad.cpp b/parser/html/nsHtml5SpeculativeLoad.cpp
index 82ebb916a54c..069e746f90e6 100644
--- a/parser/html/nsHtml5SpeculativeLoad.cpp
+++ b/parser/html/nsHtml5SpeculativeLoad.cpp
@@ -4,6 +4,7 @@
 
 #include "nsHtml5SpeculativeLoad.h"
 #include "nsHtml5TreeOpExecutor.h"
+#include "mozilla/Encoding.h"
 
 nsHtml5SpeculativeLoad::nsHtml5SpeculativeLoad()
   :
diff --git a/xpcom/ds/nsAtomTable.cpp b/xpcom/ds/nsAtomTable.cpp
index 4470a143de8f..6d3cd4ef8309 100644
--- a/xpcom/ds/nsAtomTable.cpp
+++ b/xpcom/ds/nsAtomTable.cpp
@@ -135,12 +135,13 @@ private:
 UniquePtr<nsTArray<FakeBufferRefcountHelper>> gFakeBuffers;
 #endif
 
-// This constructor is for dynamic atoms.
-nsAtom::nsAtom(const nsAString& aString, uint32_t aHash)
+// This constructor is for dynamic atoms and HTML5 atoms.
+nsAtom::nsAtom(AtomKind aKind, const nsAString& aString, uint32_t aHash)
   : mRefCnt(1)
 {
   mLength = aString.Length();
-  SetKind(AtomKind::DynamicAtom);
+  SetKind(aKind);
+  MOZ_ASSERT(IsDynamicAtom() || IsHTML5Atom());
   RefPtr<nsStringBuffer> buf = nsStringBuffer::FromString(aString);
   if (buf) {
     mString = static_cast<char16_t*>(buf->Data());
@@ -158,7 +159,7 @@ nsAtom::nsAtom(const nsAString& aString, uint32_t aHash)
   }
 
   mHash = aHash;
-  MOZ_ASSERT(mHash == HashString(mString, mLength));
+  MOZ_ASSERT_IF(IsDynamicAtom(), mHash == HashString(mString, mLength));
 
   NS_ASSERTION(mString[mLength] == char16_t(0), "null terminated");
   NS_ASSERTION(buf && buf->StorageSize() >= (mLength + 1) * sizeof(char16_t),
@@ -202,10 +203,9 @@ nsAtom::nsAtom(nsStringBuffer* aStringBuffer, uint32_t aLength, uint32_t aHash)
 // GCAtomTableLocked() for dynamic atoms), not an nsIAtom* pointer.
 nsAtom::~nsAtom()
 {
-  if (IsDynamicAtom()) {
+  if (!IsStaticAtom()) {
+    MOZ_ASSERT(IsDynamicAtom() || IsHTML5Atom());
     nsStringBuffer::FromData(mString)->Release();
-  } else {
-    MOZ_ASSERT(IsStaticAtom());
   }
 }
 
@@ -214,6 +214,7 @@ NS_IMPL_QUERY_INTERFACE(nsAtom, nsIAtom);
 NS_IMETHODIMP
 nsAtom::ToUTF8String(nsACString& aBuf)
 {
+  MOZ_ASSERT(!IsHTML5Atom(), "Called ToUTF8String() on an HTML5 atom");
   CopyUTF16toUTF8(nsDependentString(mString, mLength), aBuf);
   return NS_OK;
 }
@@ -221,6 +222,7 @@ nsAtom::ToUTF8String(nsACString& aBuf)
 NS_IMETHODIMP_(size_t)
 nsAtom::SizeOfIncludingThis(MallocSizeOf aMallocSizeOf)
 {
+  MOZ_ASSERT(!IsHTML5Atom(), "Called SizeOfIncludingThis() on an HTML5 atom");
   size_t n = aMallocSizeOf(this);
   // String buffers pointed to by static atoms are in static memory, and so
   // are not measured here.
@@ -238,7 +240,7 @@ nsAtom::SizeOfIncludingThis(MallocSizeOf aMallocSizeOf)
 NS_IMETHODIMP_(MozExternalRefCountType)
 nsIAtom::AddRef()
 {
-  MOZ_ASSERT(!IsHTML5Atom(), "Attempt to AddRef an nsHtml5Atom");
+  MOZ_ASSERT(!IsHTML5Atom(), "Attempt to AddRef an HTML5 atom");
   if (!IsDynamicAtom()) {
     MOZ_ASSERT(IsStaticAtom());
     return 2;
@@ -249,7 +251,7 @@ nsIAtom::AddRef()
 NS_IMETHODIMP_(MozExternalRefCountType)
 nsIAtom::Release()
 {
-  MOZ_ASSERT(!IsHTML5Atom(), "Attempt to Release an nsHtml5Atom");
+  MOZ_ASSERT(!IsHTML5Atom(), "Attempt to Release an HTML5 atom");
   if (!IsDynamicAtom()) {
     MOZ_ASSERT(IsStaticAtom());
     return 1;
@@ -721,7 +723,8 @@ nsAtomFriend::Atomize(const nsACString& aUTF8String)
   // Actually, now there is, sort of: ForgetSharedBuffer.
   nsString str;
   CopyUTF8toUTF16(aUTF8String, str);
-  RefPtr<nsAtom> atom = dont_AddRef(new nsAtom(str, hash));
+  RefPtr<nsAtom> atom =
+    dont_AddRef(new nsAtom(nsAtom::AtomKind::DynamicAtom, str, hash));
 
   he->mAtom = atom;
 
@@ -755,7 +758,8 @@ nsAtomFriend::Atomize(const nsAString& aUTF16String)
     return atom.forget();
   }
 
-  RefPtr<nsAtom> atom = dont_AddRef(new nsAtom(aUTF16String, hash));
+  RefPtr<nsAtom> atom =
+    dont_AddRef(new nsAtom(nsAtom::AtomKind::DynamicAtom, aUTF16String, hash));
   he->mAtom = atom;
 
   return atom.forget();
@@ -792,7 +796,8 @@ nsAtomFriend::AtomizeMainThread(const nsAString& aUTF16String)
   if (he->mAtom) {
     retVal = he->mAtom;
   } else {
-    RefPtr<nsAtom> newAtom = dont_AddRef(new nsAtom(aUTF16String, hash));
+    RefPtr<nsAtom> newAtom = dont_AddRef(
+      new nsAtom(nsAtom::AtomKind::DynamicAtom, aUTF16String, hash));
     he->mAtom = newAtom;
     retVal = newAtom.forget();
   }
diff --git a/xpcom/ds/nsIAtom.h b/xpcom/ds/nsIAtom.h
index 201c2ff97190..33a461ac12d7 100644
--- a/xpcom/ds/nsIAtom.h
+++ b/xpcom/ds/nsIAtom.h
@@ -79,7 +79,11 @@ public:
 
   // A hashcode that is better distributed than the actual atom pointer, for
   // use in situations that need a well-distributed hashcode.
-  uint32_t hash() const { return mHash; }
+  uint32_t hash() const
+  {
+    MOZ_ASSERT(!IsHTML5Atom());
+    return mHash;
+  }
 
 protected:
   uint32_t mLength: 30;
@@ -107,9 +111,10 @@ public:
 private:
   friend class nsIAtom;
   friend class nsAtomFriend;
+  friend class nsHtml5AtomEntry;
 
   // Construction and destruction is done entirely by |friend|s.
-  nsAtom(const nsAString& aString, uint32_t aHash);
+  nsAtom(AtomKind aKind, const nsAString& aString, uint32_t aHash);
   nsAtom(nsStringBuffer* aStringBuffer, uint32_t aLength, uint32_t aHash);
   ~nsAtom();
 

From 1c520e8c6fe215fd154419a077d719ab5498cc01 Mon Sep 17 00:00:00 2001
From: Nicholas Nethercote <nnethercote@mozilla.com>
Date: Tue, 5 Sep 2017 20:43:30 +1000
Subject: [PATCH 22/29] Bug 1402769 - Remove unused stuff in and around
 nsParserModule.cpp. r=mrbkap.

None of these things are used in mozilla-central or comm-central.

--HG--
extra : rebase_source : 470eeca24dda8a3d475208d0c7dd22d5280bb904
---
 parser/htmlparser/nsParserCIID.h     | 12 ---------
 parser/htmlparser/nsParserModule.cpp | 38 ++--------------------------
 parser/xml/nsSAXAttributes.h         |  6 -----
 parser/xml/nsSAXLocator.h            |  6 -----
 4 files changed, 2 insertions(+), 60 deletions(-)

diff --git a/parser/htmlparser/nsParserCIID.h b/parser/htmlparser/nsParserCIID.h
index a903a02db8c2..116268ce85a4 100644
--- a/parser/htmlparser/nsParserCIID.h
+++ b/parser/htmlparser/nsParserCIID.h
@@ -6,20 +6,8 @@
 #ifndef nsParserCIID_h__
 #define nsParserCIID_h__
 
-#include "nsISupports.h"
-#include "nsIFactory.h"
-#include "nsIComponentManager.h"
-
 // {2ce606b0-bee6-11d1-aad9-00805f8a3e14}
 #define NS_PARSER_CID      \
 { 0x2ce606b0, 0xbee6, 0x11d1, { 0xaa, 0xd9, 0x0, 0x80, 0x5f, 0x8a, 0x3e, 0x14 } }
 
-// {a6cf9107-15b3-11d2-932e-00805f8add32}
-#define NS_CNAVDTD_CID \
-{ 0xa6cf9107, 0x15b3, 0x11d2, { 0x93, 0x2e, 0x0, 0x80, 0x5f, 0x8a, 0xdd, 0x32 } }
-
-// {FFF4FBE9-528A-4b37-819D-FC18F3A401A7}
-#define NS_EXPAT_DRIVER_CID \
-{ 0xfff4fbe9, 0x528a, 0x4b37, { 0x81, 0x9d, 0xfc, 0x18, 0xf3, 0xa4, 0x1, 0xa7 } }
-
 #endif
diff --git a/parser/htmlparser/nsParserModule.cpp b/parser/htmlparser/nsParserModule.cpp
index 1a6e4ac4db40..b356f5c6691f 100644
--- a/parser/htmlparser/nsParserModule.cpp
+++ b/parser/htmlparser/nsParserModule.cpp
@@ -3,58 +3,27 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "nsIAtom.h"
-#include "nsString.h"
-#include "nspr.h"
-#include "nsCOMPtr.h"
 #include "mozilla/ModuleUtils.h"
-#include "nsParserCIID.h"
 #include "nsParser.h"
-#include "CNavDTD.h"
-#include "nsHTMLTokenizer.h"
-//#include "nsTextTokenizer.h"
-#include "nsElementTable.h"
-#include "nsSAXAttributes.h"
-#include "nsSAXLocator.h"
+#include "nsParserCIID.h"
+#include "nsHTMLTags.h"
 #include "nsSAXXMLReader.h"
 
-#if defined(DEBUG)
-#include "nsExpatDriver.h"
-#endif
-
 //----------------------------------------------------------------------
 
-#if defined(DEBUG)
-NS_GENERIC_FACTORY_CONSTRUCTOR(nsExpatDriver)
-#endif
-
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsParser)
-NS_GENERIC_FACTORY_CONSTRUCTOR(CNavDTD)
-
-NS_GENERIC_FACTORY_CONSTRUCTOR(nsSAXAttributes)
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsSAXXMLReader)
 
-#if defined(DEBUG)
-NS_DEFINE_NAMED_CID(NS_EXPAT_DRIVER_CID);
-#endif
 NS_DEFINE_NAMED_CID(NS_PARSER_CID);
-NS_DEFINE_NAMED_CID(NS_CNAVDTD_CID);
-NS_DEFINE_NAMED_CID(NS_SAXATTRIBUTES_CID);
 NS_DEFINE_NAMED_CID(NS_SAXXMLREADER_CID);
 
 static const mozilla::Module::CIDEntry kParserCIDs[] = {
-#if defined(DEBUG)
-  { &kNS_EXPAT_DRIVER_CID, false, nullptr, nsExpatDriverConstructor },
-#endif
   { &kNS_PARSER_CID, false, nullptr, nsParserConstructor },
-  { &kNS_CNAVDTD_CID, false, nullptr, CNavDTDConstructor },
-  { &kNS_SAXATTRIBUTES_CID, false, nullptr, nsSAXAttributesConstructor },
   { &kNS_SAXXMLREADER_CID, false, nullptr, nsSAXXMLReaderConstructor },
   { nullptr }
 };
 
 static const mozilla::Module::ContractIDEntry kParserContracts[] = {
-  { NS_SAXATTRIBUTES_CONTRACTID, &kNS_SAXATTRIBUTES_CID },
   { NS_SAXXMLREADER_CONTRACTID, &kNS_SAXXMLREADER_CID },
   { nullptr }
 };
@@ -67,9 +36,6 @@ Initialize()
 
 #ifdef DEBUG
   CheckElementTable();
-#endif
-
-#ifdef DEBUG
   nsHTMLTags::TestTagTable();
 #endif
 
diff --git a/parser/xml/nsSAXAttributes.h b/parser/xml/nsSAXAttributes.h
index f8da6f8a17c8..b24973a6d2e2 100644
--- a/parser/xml/nsSAXAttributes.h
+++ b/parser/xml/nsSAXAttributes.h
@@ -13,12 +13,6 @@
 #include "nsString.h"
 #include "mozilla/Attributes.h"
 
-#define NS_SAXATTRIBUTES_CONTRACTID "@mozilla.org/saxparser/attributes;1"
-#define NS_SAXATTRIBUTES_CID  \
-{/* {7bb40992-77eb-43db-9a4e-39d3bcc483ae}*/ \
-0x7bb40992, 0x77eb, 0x43db, \
-{ 0x9a, 0x4e, 0x39, 0xd3, 0xbc, 0xc3, 0x83, 0xae} }
-
 struct SAXAttr
 {
   nsString uri;
diff --git a/parser/xml/nsSAXLocator.h b/parser/xml/nsSAXLocator.h
index 14b9ef06313a..b4b2984d3c42 100644
--- a/parser/xml/nsSAXLocator.h
+++ b/parser/xml/nsSAXLocator.h
@@ -10,12 +10,6 @@
 #include "nsString.h"
 #include "mozilla/Attributes.h"
 
-#define NS_SAXLOCATOR_CONTRACTID "@mozilla.org/saxparser/locator;1"
-#define NS_SAXLOCATOR_CID  \
-{/* {c1cd4045-846b-43bb-a95e-745a3d7b40e0}*/ \
-0xc1cd4045, 0x846b, 0x43bb, \
-{ 0xa9, 0x5e, 0x74, 0x5a, 0x3d, 0x7b, 0x40, 0xe0} }
-
 class nsSAXLocator final : public nsISAXLocator
 {
 public:

From b283dc671fe723c562c434817d2a4394398bcb4e Mon Sep 17 00:00:00 2001
From: sotaro <sotaro.ikeda.g@gmail.com>
Date: Tue, 26 Sep 2017 09:58:37 +0900
Subject: [PATCH 23/29] Bug 1402739 - Fix mutex handling around async
 ImageContainer r=nical

---
 gfx/layers/ImageContainer.cpp       | 13 +++++++++++--
 gfx/layers/ImageContainer.h         |  1 +
 gfx/layers/ipc/ImageBridgeChild.cpp | 29 +++++++++++++++++------------
 gfx/layers/ipc/ImageBridgeChild.h   |  3 ++-
 4 files changed, 31 insertions(+), 15 deletions(-)

diff --git a/gfx/layers/ImageContainer.cpp b/gfx/layers/ImageContainer.cpp
index 95a6d09597f0..f278e10285af 100644
--- a/gfx/layers/ImageContainer.cpp
+++ b/gfx/layers/ImageContainer.cpp
@@ -126,6 +126,15 @@ ImageContainerListener::ClearImageContainer()
   mImageContainer = nullptr;
 }
 
+void
+ImageContainerListener::DropImageClient()
+{
+  MutexAutoLock lock(mLock);
+  if (mImageContainer) {
+    mImageContainer->DropImageClient();
+  }
+}
+
 already_AddRefed<ImageClient>
 ImageContainer::GetImageClient()
 {
@@ -162,12 +171,10 @@ ImageContainer::EnsureImageClient()
     mImageClient = imageBridge->CreateImageClient(CompositableType::IMAGE, this);
     if (mImageClient) {
       mAsyncContainerHandle = mImageClient->GetAsyncHandle();
-      mNotifyCompositeListener = new ImageContainerListener(this);
     } else {
       // It's okay to drop the async container handle since the ImageBridgeChild
       // is going to die anyway.
       mAsyncContainerHandle = CompositableHandle();
-      mNotifyCompositeListener = nullptr;
     }
   }
 }
@@ -183,6 +190,7 @@ ImageContainer::ImageContainer(Mode flag)
   mCurrentProducerID(-1)
 {
   if (flag == ASYNCHRONOUS) {
+    mNotifyCompositeListener = new ImageContainerListener(this);
     EnsureImageClient();
   }
 }
@@ -381,6 +389,7 @@ CompositableHandle ImageContainer::GetAsyncContainerHandle()
 {
   NS_ASSERTION(IsAsync(), "Shared image ID is only relevant to async ImageContainers");
   NS_ASSERTION(mAsyncContainerHandle, "Should have a shared image ID");
+  RecursiveMutexAutoLock mon(mRecursiveMutex);
   EnsureImageClient();
   return mAsyncContainerHandle;
 }
diff --git a/gfx/layers/ImageContainer.h b/gfx/layers/ImageContainer.h
index b95229ec116b..2662352ee3ea 100644
--- a/gfx/layers/ImageContainer.h
+++ b/gfx/layers/ImageContainer.h
@@ -344,6 +344,7 @@ public:
 
   void NotifyComposite(const ImageCompositeNotification& aNotification);
   void ClearImageContainer();
+  void DropImageClient();
 private:
   typedef mozilla::Mutex Mutex;
 
diff --git a/gfx/layers/ipc/ImageBridgeChild.cpp b/gfx/layers/ipc/ImageBridgeChild.cpp
index b92ab75b0066..0c7dbd3437b0 100644
--- a/gfx/layers/ipc/ImageBridgeChild.cpp
+++ b/gfx/layers/ipc/ImageBridgeChild.cpp
@@ -249,7 +249,7 @@ ImageBridgeChild::ActorDestroy(ActorDestroyReason aWhy)
   mCanSend = false;
   {
     MutexAutoLock lock(mContainerMapLock);
-    mImageContainers.Clear();
+    mImageContainerListeners.Clear();
   }
 }
 
@@ -322,8 +322,8 @@ ImageBridgeChild::Connect(CompositableClient* aCompositable,
 
   {
     MutexAutoLock lock(mContainerMapLock);
-    MOZ_ASSERT(!mImageContainers.Contains(id));
-    mImageContainers.Put(id, aImageContainer);
+    MOZ_ASSERT(!mImageContainerListeners.Contains(id));
+    mImageContainerListeners.Put(id, aImageContainer->GetImageContainerListener());
   }
 
   CompositableHandle handle(id);
@@ -335,7 +335,7 @@ void
 ImageBridgeChild::ForgetImageContainer(const CompositableHandle& aHandle)
 {
   MutexAutoLock lock(mContainerMapLock);
-  mImageContainers.Remove(aHandle.Value());
+  mImageContainerListeners.Remove(aHandle.Value());
 }
 
 Thread* ImageBridgeChild::GetThread() const
@@ -739,9 +739,16 @@ ImageBridgeChild::UpdateTextureFactoryIdentifier(const TextureFactoryIdentifier&
   if (disablingWebRender) {
     // ImageHost is incompatible between WebRender enabled and WebRender disabled.
     // Then drop all ImageContainers' ImageClients during disabling WebRender.
-    MutexAutoLock lock(mContainerMapLock);
-    for (auto iter = mImageContainers.Iter(); !iter.Done(); iter.Next()) {
-      ImageContainer* container = iter.Data();
+    nsTArray<RefPtr<ImageContainerListener> > listeners;
+    {
+      MutexAutoLock lock(mContainerMapLock);
+      for (auto iter = mImageContainerListeners.Iter(); !iter.Done(); iter.Next()) {
+        RefPtr<ImageContainerListener>& listener = iter.Data();
+        listeners.AppendElement(listener);
+      }
+    }
+    // Drop ImageContainer's ImageClient whithout holding mContainerMapLock to avoid deadlock.
+    for (auto container : listeners) {
       container->DropImageClient();
     }
   }
@@ -1014,10 +1021,8 @@ ImageBridgeChild::RecvDidComposite(InfallibleTArray<ImageCompositeNotification>&
     RefPtr<ImageContainerListener> listener;
     {
       MutexAutoLock lock(mContainerMapLock);
-      ImageContainer* imageContainer;
-      imageContainer = mImageContainers.Get(n.compositable().Value());
-      if (imageContainer) {
-        listener = imageContainer->GetImageContainerListener();
+      if (auto entry = mImageContainerListeners.Lookup(n.compositable().Value())) {
+        listener = entry.Data();
       }
     }
     if (listener) {
@@ -1128,7 +1133,7 @@ ImageBridgeChild::ReleaseCompositable(const CompositableHandle& aHandle)
 
   {
     MutexAutoLock lock(mContainerMapLock);
-    mImageContainers.Remove(aHandle.Value());
+    mImageContainerListeners.Remove(aHandle.Value());
   }
 }
 
diff --git a/gfx/layers/ipc/ImageBridgeChild.h b/gfx/layers/ipc/ImageBridgeChild.h
index 5b99769d99d0..8cc6c709e5b2 100644
--- a/gfx/layers/ipc/ImageBridgeChild.h
+++ b/gfx/layers/ipc/ImageBridgeChild.h
@@ -41,6 +41,7 @@ namespace layers {
 class AsyncCanvasRenderer;
 class ImageClient;
 class ImageContainer;
+class ImageContainerListener;
 class ImageBridgeParent;
 class CompositableClient;
 struct CompositableTransaction;
@@ -398,7 +399,7 @@ private:
    * Mapping from async compositable IDs to image containers.
    */
   Mutex mContainerMapLock;
-  nsDataHashtable<nsUint64HashKey, ImageContainer*> mImageContainers;
+  nsRefPtrHashtable<nsUint64HashKey, ImageContainerListener> mImageContainerListeners;
 };
 
 } // namespace layers

From d58801ad81f493648a57922d180bf9ea7d705aa1 Mon Sep 17 00:00:00 2001
From: Matt Woodrow <mwoodrow@mozilla.com>
Date: Tue, 26 Sep 2017 15:57:55 +1300
Subject: [PATCH 24/29] Bug 1402197 - Add an option for GetTransformToAncestor
 to stop at stacking contexts and displayport. r=mstange

---
 dom/base/Element.cpp          |  6 ++--
 layout/base/nsLayoutUtils.cpp | 54 +++++++++++++++++++++++-----
 layout/base/nsLayoutUtils.h   | 15 ++++++--
 layout/generic/nsFrame.cpp    | 68 ++++++++++++++++++++++++-----------
 layout/generic/nsIFrame.h     | 27 +++++++++++++-
 5 files changed, 135 insertions(+), 35 deletions(-)

diff --git a/dom/base/Element.cpp b/dom/base/Element.cpp
index dd52f9053981..c3870f51547b 100644
--- a/dom/base/Element.cpp
+++ b/dom/base/Element.cpp
@@ -3581,7 +3581,7 @@ Element::GetTransformToAncestor(Element& aAncestor)
     // then the call to GetTransformToAncestor will return the transform
     // all the way up through the parent chain.
     transform = nsLayoutUtils::GetTransformToAncestor(primaryFrame,
-      ancestorFrame, true);
+      ancestorFrame, nsIFrame::IN_CSS_UNITS);
   }
 
   DOMMatrixReadOnly* matrix = new DOMMatrix(this, transform);
@@ -3598,7 +3598,7 @@ Element::GetTransformToParent()
   if (primaryFrame) {
     nsIFrame* parentFrame = primaryFrame->GetParent();
     transform = nsLayoutUtils::GetTransformToAncestor(primaryFrame,
-      parentFrame, true);
+      parentFrame, nsIFrame::IN_CSS_UNITS);
   }
 
   DOMMatrixReadOnly* matrix = new DOMMatrix(this, transform);
@@ -3613,7 +3613,7 @@ Element::GetTransformToViewport()
   Matrix4x4 transform;
   if (primaryFrame) {
     transform = nsLayoutUtils::GetTransformToAncestor(primaryFrame,
-      nsLayoutUtils::GetDisplayRootFrame(primaryFrame), true);
+      nsLayoutUtils::GetDisplayRootFrame(primaryFrame), nsIFrame::IN_CSS_UNITS);
   }
 
   DOMMatrixReadOnly* matrix = new DOMMatrix(this, transform);
diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp
index 84fed85de70c..4698f180ff56 100644
--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@@ -2709,22 +2709,46 @@ nsLayoutUtils::PostTranslate(Matrix4x4& aTransform, const nsPoint& aOrigin, floa
   aTransform.PostTranslate(gfxOrigin);
 }
 
+// We want to this return true for the scroll frame, but not the
+// scrolled frame (which has the same content).
+bool
+nsLayoutUtils::FrameHasDisplayPort(nsIFrame* aFrame, nsIFrame* aScrolledFrame)
+{
+  if (!aFrame->GetContent() || !HasDisplayPort(aFrame->GetContent())) {
+    return false;
+  }
+  nsIScrollableFrame* sf = do_QueryFrame(aFrame);
+  if (sf) {
+    if (aScrolledFrame && aScrolledFrame != sf->GetScrolledFrame()) {
+      return false;
+    }
+    return true;
+  }
+  return false;
+}
+
 Matrix4x4
 nsLayoutUtils::GetTransformToAncestor(nsIFrame *aFrame,
                                       const nsIFrame *aAncestor,
-                                      bool aInCSSUnits)
+                                      uint32_t aFlags,
+                                      nsIFrame** aOutAncestor)
 {
   nsIFrame* parent;
   Matrix4x4 ctm;
   if (aFrame == aAncestor) {
     return ctm;
   }
-  ctm = aFrame->GetTransformMatrix(aAncestor, &parent, aInCSSUnits);
-  while (parent && parent != aAncestor) {
+  ctm = aFrame->GetTransformMatrix(aAncestor, &parent, aFlags);
+  while (parent && parent != aAncestor &&
+    (!(aFlags & nsIFrame::STOP_AT_STACKING_CONTEXT_AND_DISPLAY_PORT) ||
+      (!parent->IsStackingContext() && !FrameHasDisplayPort(parent)))) {
     if (!parent->Extend3DContext()) {
       ctm.ProjectTo2D();
     }
-    ctm = ctm * parent->GetTransformMatrix(aAncestor, &parent, aInCSSUnits);
+    ctm = ctm * parent->GetTransformMatrix(aAncestor, &parent, aFlags);
+  }
+  if (aOutAncestor) {
+    *aOutAncestor = parent;
   }
   return ctm;
 }
@@ -3029,7 +3053,9 @@ TransformGfxRectToAncestor(nsIFrame *aFrame,
                            const Rect &aRect,
                            const nsIFrame *aAncestor,
                            bool* aPreservesAxisAlignedRectangles = nullptr,
-                           Maybe<Matrix4x4>* aMatrixCache = nullptr)
+                           Maybe<Matrix4x4>* aMatrixCache = nullptr,
+                           bool aStopAtStackingContextAndDisplayPort = false,
+                           nsIFrame** aOutAncestor = nullptr)
 {
   Matrix4x4 ctm;
   if (aMatrixCache && *aMatrixCache) {
@@ -3037,7 +3063,11 @@ TransformGfxRectToAncestor(nsIFrame *aFrame,
     ctm = aMatrixCache->value();
   } else {
     // Else, compute it
-    ctm = nsLayoutUtils::GetTransformToAncestor(aFrame, aAncestor);
+    uint32_t flags = 0;
+    if (aStopAtStackingContextAndDisplayPort) {
+      flags |= nsIFrame::STOP_AT_STACKING_CONTEXT_AND_DISPLAY_PORT;
+    }
+    ctm = nsLayoutUtils::GetTransformToAncestor(aFrame, aAncestor, flags, aOutAncestor);
     if (aMatrixCache) {
       // and put it in the cache, if provided
       *aMatrixCache = Some(ctm);
@@ -3098,7 +3128,9 @@ nsLayoutUtils::TransformFrameRectToAncestor(nsIFrame* aFrame,
                                             const nsRect& aRect,
                                             const nsIFrame* aAncestor,
                                             bool* aPreservesAxisAlignedRectangles /* = nullptr */,
-                                            Maybe<Matrix4x4>* aMatrixCache /* = nullptr */)
+                                            Maybe<Matrix4x4>* aMatrixCache /* = nullptr */,
+                                            bool aStopAtStackingContextAndDisplayPort /* = false */,
+                                            nsIFrame** aOutAncestor /* = nullptr */)
 {
   SVGTextFrame* text = GetContainingSVGTextFrame(aFrame);
 
@@ -3107,7 +3139,9 @@ nsLayoutUtils::TransformFrameRectToAncestor(nsIFrame* aFrame,
 
   if (text) {
     result = ToRect(text->TransformFrameRectFromTextChild(aRect, aFrame));
-    result = TransformGfxRectToAncestor(text, result, aAncestor, nullptr, aMatrixCache);
+    result = TransformGfxRectToAncestor(text, result, aAncestor,
+                                        nullptr, aMatrixCache,
+                                        aStopAtStackingContextAndDisplayPort, aOutAncestor);
     // TransformFrameRectFromTextChild could involve any kind of transform, we
     // could drill down into it to get an answer out of it but we don't yet.
     if (aPreservesAxisAlignedRectangles)
@@ -3117,7 +3151,9 @@ nsLayoutUtils::TransformFrameRectToAncestor(nsIFrame* aFrame,
                   NSAppUnitsToFloatPixels(aRect.y, srcAppUnitsPerDevPixel),
                   NSAppUnitsToFloatPixels(aRect.width, srcAppUnitsPerDevPixel),
                   NSAppUnitsToFloatPixels(aRect.height, srcAppUnitsPerDevPixel));
-    result = TransformGfxRectToAncestor(aFrame, result, aAncestor, aPreservesAxisAlignedRectangles, aMatrixCache);
+    result = TransformGfxRectToAncestor(aFrame, result, aAncestor,
+                                        aPreservesAxisAlignedRectangles, aMatrixCache,
+                                        aStopAtStackingContextAndDisplayPort, aOutAncestor);
   }
 
   float destAppUnitsPerDevPixel = aAncestor->PresContext()->AppUnitsPerDevPixel();
diff --git a/layout/base/nsLayoutUtils.h b/layout/base/nsLayoutUtils.h
index 089cfe754e34..0639b30f6123 100644
--- a/layout/base/nsLayoutUtils.h
+++ b/layout/base/nsLayoutUtils.h
@@ -212,6 +212,14 @@ public:
    */
   static bool HasDisplayPort(nsIContent* aContent);
 
+  /**
+   * Check whether the given frame has a displayport. It returns false
+   * for scrolled frames and true for the corresponding scroll frame.
+   * Optionally pass the child, and it only returns true if the child is the
+   * scrolled frame for the displayport.
+   */
+  static bool FrameHasDisplayPort(nsIFrame* aFrame, nsIFrame* aScrolledFrame = nullptr);
+
   /**
    * Check if the given element has a margins based displayport but is missing a
    * displayport base rect that it needs to properly compute a displayport rect.
@@ -865,7 +873,9 @@ public:
                                              const nsRect& aRect,
                                              const nsIFrame* aAncestor,
                                              bool* aPreservesAxisAlignedRectangles = nullptr,
-                                             mozilla::Maybe<Matrix4x4>* aMatrixCache = nullptr);
+                                             mozilla::Maybe<Matrix4x4>* aMatrixCache = nullptr,
+                                             bool aStopAtStackingContextAndDisplayPort = false,
+                                             nsIFrame** aOutAncestor = nullptr);
 
 
   /**
@@ -875,7 +885,8 @@ public:
    */
   static Matrix4x4 GetTransformToAncestor(nsIFrame *aFrame,
                                           const nsIFrame *aAncestor,
-                                          bool aInCSSUnits = false);
+                                          uint32_t aFlags = 0,
+                                          nsIFrame** aOutAncestor = nullptr);
 
   /**
    * Gets the scale factors of the transform for aFrame relative to the root
diff --git a/layout/generic/nsFrame.cpp b/layout/generic/nsFrame.cpp
index 6e6f2bfa5379..1c16d5908ae3 100644
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -3108,21 +3108,10 @@ nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*   aBuilder,
   const nsStyleDisplay* disp = child->StyleDisplay();
   const nsStyleEffects* effects = child->StyleEffects();
   const nsStylePosition* pos = child->StylePosition();
-  bool isVisuallyAtomic = child->HasOpacity(effectSet)
-    || child->IsTransformed(disp, effectSet)
-    // strictly speaking, 'perspective' doesn't require visual atomicity,
-    // but the spec says it acts like the rest of these
-    || disp->mChildPerspective.GetUnit() == eStyleUnit_Coord
-    || effects->mMixBlendMode != NS_STYLE_BLEND_NORMAL
-    || nsSVGIntegrationUtils::UsingEffectsForFrame(child);
-
+  bool isVisuallyAtomic = child->IsVisuallyAtomic(effectSet, disp, effects);
   bool isPositioned = disp->IsAbsPosContainingBlock(child);
-  bool isStackingContext =
-    (isPositioned && (disp->IsPositionForcingStackingContext() ||
-                      pos->mZIndex.GetUnit() == eStyleUnit_Integer)) ||
-     (disp->mWillChangeBitField & NS_STYLE_WILL_CHANGE_STACKING_CONTEXT) ||
-     disp->mIsolation != NS_STYLE_ISOLATION_AUTO ||
-     isVisuallyAtomic || (aFlags & DISPLAY_CHILD_FORCE_STACKING_CONTEXT);
+  bool isStackingContext = child->IsStackingContext(disp, pos, isPositioned, isVisuallyAtomic) ||
+                           (aFlags & DISPLAY_CHILD_FORCE_STACKING_CONTEXT);
 
   if (isVisuallyAtomic || isPositioned || (!isSVG && disp->IsFloating(child)) ||
       ((effects->mClipFlags & NS_STYLE_CLIP_RECT) &&
@@ -6298,7 +6287,7 @@ nsIFrame::GetFlattenedTreeParentPrimaryFrame() const
 Matrix4x4
 nsIFrame::GetTransformMatrix(const nsIFrame* aStopAtAncestor,
                              nsIFrame** aOutAncestor,
-                             bool aInCSSUnits)
+                             uint32_t aFlags)
 {
   NS_PRECONDITION(aOutAncestor, "Need a place to put the ancestor!");
 
@@ -6312,8 +6301,8 @@ nsIFrame::GetTransformMatrix(const nsIFrame* aStopAtAncestor,
      */
     NS_ASSERTION(nsLayoutUtils::GetCrossDocParentFrame(this),
                  "Cannot transform the viewport frame!");
-    int32_t scaleFactor = (aInCSSUnits ? PresContext()->AppUnitsPerCSSPixel()
-                                       : PresContext()->AppUnitsPerDevPixel());
+    int32_t scaleFactor = ((aFlags & IN_CSS_UNITS) ? PresContext()->AppUnitsPerCSSPixel()
+                                                   : PresContext()->AppUnitsPerDevPixel());
 
     Matrix4x4 result = nsDisplayTransform::GetResultingTransformMatrix(this,
                          nsPoint(0,0), scaleFactor,
@@ -6381,14 +6370,18 @@ nsIFrame::GetTransformMatrix(const nsIFrame* aStopAtAncestor,
     return Matrix4x4();
 
   /* Keep iterating while the frame can't possibly be transformed. */
+  nsIFrame* current = this;
   while (!(*aOutAncestor)->IsTransformed() &&
          !nsLayoutUtils::IsPopup(*aOutAncestor) &&
-         *aOutAncestor != aStopAtAncestor) {
+         *aOutAncestor != aStopAtAncestor &&
+         (!(aFlags & STOP_AT_STACKING_CONTEXT_AND_DISPLAY_PORT) ||
+          (!(*aOutAncestor)->IsStackingContext() && !nsLayoutUtils::FrameHasDisplayPort(*aOutAncestor, current)))) {
     /* If no parent, stop iterating.  Otherwise, update the ancestor. */
     nsIFrame* parent = nsLayoutUtils::GetCrossDocParentFrame(*aOutAncestor);
     if (!parent)
       break;
 
+    current = *aOutAncestor;
     *aOutAncestor = parent;
   }
 
@@ -6398,8 +6391,8 @@ nsIFrame::GetTransformMatrix(const nsIFrame* aStopAtAncestor,
    * entire transform, so we're done.
    */
   nsPoint delta = GetOffsetToCrossDoc(*aOutAncestor);
-  int32_t scaleFactor = (aInCSSUnits ? PresContext()->AppUnitsPerCSSPixel()
-                                     : PresContext()->AppUnitsPerDevPixel());
+  int32_t scaleFactor = ((aFlags & IN_CSS_UNITS) ? PresContext()->AppUnitsPerCSSPixel()
+                                                 : PresContext()->AppUnitsPerDevPixel());
   return Matrix4x4::Translation(NSAppUnitsToFloatPixels(delta.x, scaleFactor),
                                 NSAppUnitsToFloatPixels(delta.y, scaleFactor),
                                 0.0f);
@@ -10506,6 +10499,41 @@ nsIFrame::IsPseudoStackingContextFromStyle() {
          (disp->mWillChangeBitField & NS_STYLE_WILL_CHANGE_STACKING_CONTEXT);
 }
 
+bool
+nsIFrame::IsVisuallyAtomic(EffectSet* aEffectSet,
+                           const nsStyleDisplay* aStyleDisplay,
+                           const nsStyleEffects* aStyleEffects) {
+  return HasOpacity(aEffectSet) ||
+         IsTransformed(aStyleDisplay) ||
+         // strictly speaking, 'perspective' doesn't require visual atomicity,
+         // but the spec says it acts like the rest of these
+         aStyleDisplay->mChildPerspective.GetUnit() == eStyleUnit_Coord ||
+         aStyleEffects->mMixBlendMode != NS_STYLE_BLEND_NORMAL ||
+         nsSVGIntegrationUtils::UsingEffectsForFrame(this);
+}
+
+bool
+nsIFrame::IsStackingContext(const nsStyleDisplay* aStyleDisplay,
+                            const nsStylePosition* aStylePosition,
+                            bool aIsPositioned,
+                            bool aIsVisuallyAtomic) {
+  return (aIsPositioned && (aStyleDisplay->IsPositionForcingStackingContext() ||
+                           aStylePosition->mZIndex.GetUnit() == eStyleUnit_Integer)) ||
+         (aStyleDisplay->mWillChangeBitField & NS_STYLE_WILL_CHANGE_STACKING_CONTEXT) ||
+         aStyleDisplay->mIsolation != NS_STYLE_ISOLATION_AUTO ||
+         aIsVisuallyAtomic;
+}
+
+bool
+nsIFrame::IsStackingContext()
+{
+  const nsStyleDisplay* disp = StyleDisplay();
+  bool isPositioned = disp->IsAbsPosContainingBlock(this);
+  bool isVisuallyAtomic = IsVisuallyAtomic(EffectSet::GetEffectSet(this),
+                                           disp, StyleEffects());
+  return IsStackingContext(disp, StylePosition(), isPositioned, isVisuallyAtomic);
+}
+
 Element*
 nsIFrame::GetPseudoElement(CSSPseudoElementType aType)
 {
diff --git a/layout/generic/nsIFrame.h b/layout/generic/nsIFrame.h
index e8fb4c71a16f..682e6a476d34 100644
--- a/layout/generic/nsIFrame.h
+++ b/layout/generic/nsIFrame.h
@@ -2789,9 +2789,13 @@ public:
    * @return A Matrix4x4 that converts points in this frame's coordinate space
    *   into points in aOutAncestor's coordinate space.
    */
+  enum {
+    IN_CSS_UNITS = 1 << 0,
+    STOP_AT_STACKING_CONTEXT_AND_DISPLAY_PORT = 1 << 1
+  };
   Matrix4x4 GetTransformMatrix(const nsIFrame* aStopAtAncestor,
                                nsIFrame **aOutAncestor,
-                               bool aInCSSUnits = false);
+                               uint32_t aFlags = 0);
 
   /**
    * Bit-flags to pass to IsFrameOfType()
@@ -3450,6 +3454,27 @@ public:
    */
   bool IsPseudoStackingContextFromStyle();
 
+  /**
+   * Determines if this frame has a container effect that requires
+   * it to paint as a visually atomic unit.
+   */
+  bool IsVisuallyAtomic(mozilla::EffectSet* aEffectSet,
+                        const nsStyleDisplay* aStyleDisplay,
+                        const nsStyleEffects* aStyleEffects);
+
+  /**
+   * Determines if this frame is a stacking context.
+   *
+   * @param aIsPositioned The precomputed result of IsAbsPosContainingBlock
+   * on the StyleDisplay().
+   * @param aIsVisuallyAtomic The precomputed result of IsVisuallyAtomic.
+   */
+  bool IsStackingContext(const nsStyleDisplay* aStyleDisplay,
+                         const nsStylePosition* aStylePosition,
+                         bool aIsPositioned,
+                         bool aIsVisuallyAtomic);
+  bool IsStackingContext();
+
   virtual bool HonorPrintBackgroundSettings() { return true; }
 
   /**

From 9304acdbbb20d0b98f255be4a930459aacd087aa Mon Sep 17 00:00:00 2001
From: Matt Woodrow <mwoodrow@mozilla.com>
Date: Tue, 26 Sep 2017 15:57:56 +1300
Subject: [PATCH 25/29] Bug 1397671 - Don't treat SVG transformed frames as
 being transformed for the purposes of computing
 Combines3DTransformWithAncestors. r=dbaron

---
 layout/generic/nsFrame.cpp                      | 11 +++++++++--
 layout/generic/nsIFrame.h                       |  6 ++++++
 .../reftests/transform-3d/preserve3d-8-ref.html | 11 +++++++++++
 layout/reftests/transform-3d/preserve3d-8.html  | 17 +++++++++++++++++
 4 files changed, 43 insertions(+), 2 deletions(-)
 create mode 100644 layout/reftests/transform-3d/preserve3d-8-ref.html
 create mode 100644 layout/reftests/transform-3d/preserve3d-8.html

diff --git a/layout/generic/nsFrame.cpp b/layout/generic/nsFrame.cpp
index 1c16d5908ae3..238fd2bd9087 100644
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -1326,11 +1326,18 @@ nsIFrame::GetMarginRectRelativeToSelf() const
 bool
 nsIFrame::IsTransformed(const nsStyleDisplay* aStyleDisplay,
                         EffectSet* aEffectSet) const
+{
+  return IsCSSTransformed(aStyleDisplay, aEffectSet) ||
+         IsSVGTransformed();
+}
+
+bool
+nsIFrame::IsCSSTransformed(const nsStyleDisplay* aStyleDisplay,
+                           EffectSet* aEffectSet) const
 {
   MOZ_ASSERT(aStyleDisplay == StyleDisplay());
   return ((mState & NS_FRAME_MAY_BE_TRANSFORMED) &&
           (aStyleDisplay->HasTransform(this) ||
-           IsSVGTransformed() ||
            HasAnimationOfTransform(aEffectSet)));
 }
 
@@ -1402,7 +1409,7 @@ nsIFrame::Combines3DTransformWithAncestors(const nsStyleDisplay* aStyleDisplay,
   if (!parent || !parent->Extend3DContext()) {
     return false;
   }
-  return IsTransformed(aStyleDisplay,aEffectSet) ||
+  return IsCSSTransformed(aStyleDisplay, aEffectSet) ||
          BackfaceIsHidden(aStyleDisplay);
 }
 
diff --git a/layout/generic/nsIFrame.h b/layout/generic/nsIFrame.h
index 682e6a476d34..1025e8e15bfc 100644
--- a/layout/generic/nsIFrame.h
+++ b/layout/generic/nsIFrame.h
@@ -1724,6 +1724,12 @@ public:
     return IsTransformed(StyleDisplay(), aEffectSet);
   }
 
+  /**
+   * Same as IsTransformed, except that it doesn't take SVG transforms
+   * into account.
+   */
+  bool IsCSSTransformed(const nsStyleDisplay* aStyleDisplay, mozilla::EffectSet* aEffectSet = nullptr) const;
+
   /**
    * True if this frame has any animation of transform in effect.
    *
diff --git a/layout/reftests/transform-3d/preserve3d-8-ref.html b/layout/reftests/transform-3d/preserve3d-8-ref.html
new file mode 100644
index 000000000000..afddf05d4d81
--- /dev/null
+++ b/layout/reftests/transform-3d/preserve3d-8-ref.html
@@ -0,0 +1,11 @@
+<html>
+<head>
+</head>
+<body style="width:100px">
+  <svg xmlns="http://www.w3.org/2000/svg" version="1.1" id="js" viewBox="0 0 200 200" style="transform: rotateX(180deg)">
+    <g>
+      <rect width="100" height="100" style="fill:rgb(0,0,255)"></rect>
+    </g>
+  </svg>
+</body>
+</html>
diff --git a/layout/reftests/transform-3d/preserve3d-8.html b/layout/reftests/transform-3d/preserve3d-8.html
new file mode 100644
index 000000000000..76e9c10c33bc
--- /dev/null
+++ b/layout/reftests/transform-3d/preserve3d-8.html
@@ -0,0 +1,17 @@
+<html>
+<head>
+</head>
+<body>
+  <div style="transform: rotatex(45deg); transform-style: preserve-3d; width: 100px;">
+    <div style="transform: rotatex(45deg); transform-style: preserve-3d; width: 100px;">
+      <div style="transform: rotatex(45deg); transform-style: preserve-3d; width: 100px;">
+        <svg xmlns="http://www.w3.org/2000/svg" version="1.1" id="js" viewBox="0 0 200 200" style="transform: rotateX(45deg)">
+          <g>
+            <rect width="100" height="100" style="fill:rgb(0,0,255)"></rect>
+          </g>
+        </svg>
+      </div>
+    </div>
+  </div>
+</body>
+</html>

From 991f510e8be4eed2d2779fa43e8775327f55be49 Mon Sep 17 00:00:00 2001
From: Matt Woodrow <mwoodrow@mozilla.com>
Date: Tue, 26 Sep 2017 15:57:56 +1300
Subject: [PATCH 26/29] Bug 1402199 - Move code for adding extra background
 items into a helper. r=mstange

---
 layout/base/nsLayoutUtils.cpp | 68 +++++++++++++++++++++--------------
 layout/base/nsLayoutUtils.h   |  7 ++++
 2 files changed, 48 insertions(+), 27 deletions(-)

diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp
index 4698f180ff56..97381dc07c73 100644
--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@@ -3528,6 +3528,46 @@ nsLayoutUtils::ExpireDisplayPortOnAsyncScrollableAncestor(nsIFrame* aFrame)
   }
 }
 
+void
+nsLayoutUtils::AddExtraBackgroundItems(nsDisplayListBuilder& aBuilder,
+                                       nsDisplayList& aList,
+                                       nsIFrame* aFrame,
+                                       const nsRect& aCanvasArea,
+                                       const nsRegion& aVisibleRegion,
+                                       nscolor aBackstop)
+{
+  LayoutFrameType frameType = aFrame->Type();
+  nsPresContext* presContext = aFrame->PresContext();
+  nsIPresShell* presShell = presContext->PresShell();
+
+  // For the viewport frame in print preview/page layout we want to paint
+  // the grey background behind the page, not the canvas color.
+  if (frameType == LayoutFrameType::Viewport &&
+      nsLayoutUtils::NeedsPrintPreviewBackground(presContext)) {
+    nsRect bounds = nsRect(aBuilder.ToReferenceFrame(aFrame),
+                           aFrame->GetSize());
+    nsDisplayListBuilder::AutoBuildingDisplayList
+      buildingDisplayList(&aBuilder, aFrame, bounds, false);
+    presShell->AddPrintPreviewBackgroundItem(aBuilder, aList, aFrame, bounds);
+  } else if (frameType != LayoutFrameType::Page) {
+    // For printing, this function is first called on an nsPageFrame, which
+    // creates a display list with a PageContent item. The PageContent item's
+    // paint function calls this function on the nsPageFrame's child which is
+    // an nsPageContentFrame. We only want to add the canvas background color
+    // item once, for the nsPageContentFrame.
+
+    // Add the canvas background color to the bottom of the list. This
+    // happens after we've built the list so that AddCanvasBackgroundColorItem
+    // can monkey with the contents if necessary.
+    nsRect canvasArea = aVisibleRegion.GetBounds();
+    canvasArea.IntersectRect(aCanvasArea, canvasArea);
+    nsDisplayListBuilder::AutoBuildingDisplayList
+      buildingDisplayList(&aBuilder, aFrame, canvasArea, false);
+    presShell->AddCanvasBackgroundColorItem(
+      aBuilder, aList, aFrame, canvasArea, aBackstop);
+  }
+}
+
 nsresult
 nsLayoutUtils::PaintFrame(gfxContext* aRenderingContext, nsIFrame* aFrame,
                           const nsRegion& aDirtyRegion, nscolor aBackstop,
@@ -3686,33 +3726,7 @@ nsLayoutUtils::PaintFrame(gfxContext* aRenderingContext, nsIFrame* aFrame,
       aFrame->BuildDisplayListForStackingContext(&builder, &list);
     }
 
-    LayoutFrameType frameType = aFrame->Type();
-
-    // For the viewport frame in print preview/page layout we want to paint
-    // the grey background behind the page, not the canvas color.
-    if (frameType == LayoutFrameType::Viewport &&
-        nsLayoutUtils::NeedsPrintPreviewBackground(presContext)) {
-      nsRect bounds = nsRect(builder.ToReferenceFrame(aFrame),
-                             aFrame->GetSize());
-      nsDisplayListBuilder::AutoBuildingDisplayList
-        buildingDisplayList(&builder, aFrame, bounds, false);
-      presShell->AddPrintPreviewBackgroundItem(builder, list, aFrame, bounds);
-    } else if (frameType != LayoutFrameType::Page) {
-      // For printing, this function is first called on an nsPageFrame, which
-      // creates a display list with a PageContent item. The PageContent item's
-      // paint function calls this function on the nsPageFrame's child which is
-      // an nsPageContentFrame. We only want to add the canvas background color
-      // item once, for the nsPageContentFrame.
-
-      // Add the canvas background color to the bottom of the list. This
-      // happens after we've built the list so that AddCanvasBackgroundColorItem
-      // can monkey with the contents if necessary.
-      canvasArea.IntersectRect(canvasArea, visibleRegion.GetBounds());
-      nsDisplayListBuilder::AutoBuildingDisplayList
-        buildingDisplayList(&builder, aFrame, canvasArea, false);
-      presShell->AddCanvasBackgroundColorItem(
-             builder, list, aFrame, canvasArea, aBackstop);
-    }
+    AddExtraBackgroundItems(builder, list, aFrame, canvasArea, visibleRegion, aBackstop);
 
     builder.LeavePresShell(aFrame, &list);
 
diff --git a/layout/base/nsLayoutUtils.h b/layout/base/nsLayoutUtils.h
index 0639b30f6123..71f6f65e042c 100644
--- a/layout/base/nsLayoutUtils.h
+++ b/layout/base/nsLayoutUtils.h
@@ -2246,6 +2246,13 @@ public:
   static nsIContent*
     GetEditableRootContentByContentEditable(nsIDocument* aDocument);
 
+  static void AddExtraBackgroundItems(nsDisplayListBuilder& aBuilder,
+                                      nsDisplayList& aList,
+                                      nsIFrame* aFrame,
+                                      const nsRect& aCanvasArea,
+                                      const nsRegion& aVisibleRegion,
+                                      nscolor aBackstop);
+
   /**
    * Returns true if the passed in prescontext needs the dark grey background
    * that goes behind the page of a print preview presentation.

From 5fa5f700153eda0316d525b6af6fb34bc37b40ce Mon Sep 17 00:00:00 2001
From: Matt Woodrow <mwoodrow@mozilla.com>
Date: Tue, 26 Sep 2017 15:57:56 +1300
Subject: [PATCH 27/29] Bug 1402200 - Expose nsRect to pixman_box helpers.
 r=jrmuizel

---
 gfx/src/nsRegion.h | 40 ++++++++++++++++++++--------------------
 1 file changed, 20 insertions(+), 20 deletions(-)

diff --git a/gfx/src/nsRegion.h b/gfx/src/nsRegion.h
index cccaaca0216d..5132013b6162 100644
--- a/gfx/src/nsRegion.h
+++ b/gfx/src/nsRegion.h
@@ -394,6 +394,26 @@ public:
 
   RectIterator RectIter() const { return RectIterator(*this); }
 
+  static inline pixman_box32_t RectToBox(const nsRect &aRect)
+  {
+    pixman_box32_t box = { aRect.X(), aRect.Y(), aRect.XMost(), aRect.YMost() };
+    return box;
+  }
+
+  static inline pixman_box32_t RectToBox(const mozilla::gfx::IntRect &aRect)
+  {
+    pixman_box32_t box = { aRect.X(), aRect.Y(), aRect.XMost(), aRect.YMost() };
+    return box;
+  }
+
+
+  static inline nsRect BoxToRect(const pixman_box32_t &aBox)
+  {
+    return nsRect(aBox.x1, aBox.y1,
+                  aBox.x2 - aBox.x1,
+                  aBox.y2 - aBox.y1);
+  }
+
 private:
   pixman_region32_t mImpl;
 
@@ -431,26 +451,6 @@ private:
     return *this;
   }
 
-  static inline pixman_box32_t RectToBox(const nsRect &aRect)
-  {
-    pixman_box32_t box = { aRect.x, aRect.y, aRect.XMost(), aRect.YMost() };
-    return box;
-  }
-
-  static inline pixman_box32_t RectToBox(const mozilla::gfx::IntRect &aRect)
-  {
-    pixman_box32_t box = { aRect.x, aRect.y, aRect.XMost(), aRect.YMost() };
-    return box;
-  }
-
-
-  static inline nsRect BoxToRect(const pixman_box32_t &aBox)
-  {
-    return nsRect(aBox.x1, aBox.y1,
-                  aBox.x2 - aBox.x1,
-                  aBox.y2 - aBox.y1);
-  }
-
   pixman_region32_t* Impl() const
   {
     return const_cast<pixman_region32_t*>(&mImpl);

From 9b61794af5697515b052613f3e3129a15d10891b Mon Sep 17 00:00:00 2001
From: Timothy Nikkel <tnikkel@gmail.com>
Date: Tue, 26 Sep 2017 15:57:57 +1300
Subject: [PATCH 28/29] Bug 1402203 - Add a new layout phase for displaylist
 building. r=mstange

---
 layout/base/moz.build             |  1 +
 layout/base/nsAutoLayoutPhase.cpp | 15 +++++++++++++++
 layout/base/nsPresContext.h       |  1 +
 layout/painting/nsDisplayList.cpp |  4 ++++
 layout/painting/nsDisplayList.h   |  4 ++++
 5 files changed, 25 insertions(+)

diff --git a/layout/base/moz.build b/layout/base/moz.build
index f8dd64499e1d..c4a7cb05c2d5 100644
--- a/layout/base/moz.build
+++ b/layout/base/moz.build
@@ -37,6 +37,7 @@ EXPORTS += [
     'FrameProperties.h',
     'LayoutLogging.h',
     'MobileViewportManager.h',
+    'nsAutoLayoutPhase.h',
     'nsBidi.h',
     'nsBidiPresUtils.h',
     'nsCaret.h',
diff --git a/layout/base/nsAutoLayoutPhase.cpp b/layout/base/nsAutoLayoutPhase.cpp
index a20d541f8ce3..5160f8b5f126 100644
--- a/layout/base/nsAutoLayoutPhase.cpp
+++ b/layout/base/nsAutoLayoutPhase.cpp
@@ -33,14 +33,27 @@ nsAutoLayoutPhase::Enter()
     case eLayoutPhase_Paint:
       MOZ_ASSERT(mPresContext->mLayoutPhaseCount[eLayoutPhase_Paint] == 0,
                  "recurring into paint");
+      MOZ_ASSERT(mPresContext->mLayoutPhaseCount[eLayoutPhase_DisplayListBuilding] == 0,
+                 "recurring into paint from display list building");
       MOZ_ASSERT(mPresContext->mLayoutPhaseCount[eLayoutPhase_Reflow] == 0,
                  "painting in the middle of reflow");
       MOZ_ASSERT(mPresContext->mLayoutPhaseCount[eLayoutPhase_FrameC] == 0,
                  "painting in the middle of frame construction");
       break;
+    case eLayoutPhase_DisplayListBuilding:
+      // It's fine and expected to be in a paint here.
+      MOZ_ASSERT(mPresContext->mLayoutPhaseCount[eLayoutPhase_DisplayListBuilding] == 0,
+                 "recurring into display list building");
+      MOZ_ASSERT(mPresContext->mLayoutPhaseCount[eLayoutPhase_Reflow] == 0,
+                 "display list building in the middle of reflow");
+      MOZ_ASSERT(mPresContext->mLayoutPhaseCount[eLayoutPhase_FrameC] == 0,
+                 "display list building in the middle of frame construction");
+      break;
     case eLayoutPhase_Reflow:
       MOZ_ASSERT(mPresContext->mLayoutPhaseCount[eLayoutPhase_Paint] == 0,
                  "reflowing in the middle of a paint");
+      MOZ_ASSERT(mPresContext->mLayoutPhaseCount[eLayoutPhase_DisplayListBuilding] == 0,
+                 "reflowing in the middle of a display list building");
       MOZ_ASSERT(mPresContext->mLayoutPhaseCount[eLayoutPhase_Reflow] == 0,
                  "recurring into reflow");
       MOZ_ASSERT(mPresContext->mLayoutPhaseCount[eLayoutPhase_FrameC] == 0,
@@ -49,6 +62,8 @@ nsAutoLayoutPhase::Enter()
     case eLayoutPhase_FrameC:
       MOZ_ASSERT(mPresContext->mLayoutPhaseCount[eLayoutPhase_Paint] == 0,
                  "constructing frames in the middle of a paint");
+      MOZ_ASSERT(mPresContext->mLayoutPhaseCount[eLayoutPhase_DisplayListBuilding] == 0,
+                 "constructing frames in the middle of a display list building");
       MOZ_ASSERT(mPresContext->mLayoutPhaseCount[eLayoutPhase_Reflow] == 0,
                  "constructing frames in the middle of reflow");
       MOZ_ASSERT(mPresContext->mLayoutPhaseCount[eLayoutPhase_FrameC] == 0,
diff --git a/layout/base/nsPresContext.h b/layout/base/nsPresContext.h
index 0a1dfe8cc8f6..fc047d7b8201 100644
--- a/layout/base/nsPresContext.h
+++ b/layout/base/nsPresContext.h
@@ -108,6 +108,7 @@ struct nsAutoLayoutPhase;
 
 enum nsLayoutPhase {
   eLayoutPhase_Paint,
+  eLayoutPhase_DisplayListBuilding, // sometimes a subset of the paint phase
   eLayoutPhase_Reflow,
   eLayoutPhase_FrameC,
   eLayoutPhase_COUNT
diff --git a/layout/painting/nsDisplayList.cpp b/layout/painting/nsDisplayList.cpp
index 7df3b11c4a81..ee9944439628 100644
--- a/layout/painting/nsDisplayList.cpp
+++ b/layout/painting/nsDisplayList.cpp
@@ -1218,6 +1218,10 @@ nsDisplayListBuilder::EnterPresShell(nsIFrame* aReferenceFrame,
   state->mCaretFrame = nullptr;
   state->mFirstFrameMarkedForDisplay = mFramesMarkedForDisplay.Length();
 
+#ifdef DEBUG
+  state->mAutoLayoutPhase.emplace(aReferenceFrame->PresContext(), eLayoutPhase_DisplayListBuilding);
+#endif
+
   state->mPresShell->UpdateCanvasBackground();
 
   if (mIsPaintingToWindow) {
diff --git a/layout/painting/nsDisplayList.h b/layout/painting/nsDisplayList.h
index b6c755cc56c3..24a35defbe0b 100644
--- a/layout/painting/nsDisplayList.h
+++ b/layout/painting/nsDisplayList.h
@@ -37,6 +37,7 @@
 #include "mozilla/gfx/UserData.h"
 #include "mozilla/layers/LayerAttributes.h"
 #include "nsCSSRenderingBorders.h"
+#include "nsAutoLayoutPhase.h"
 #include "nsDisplayItemTypes.h"
 
 #include <stdint.h>
@@ -1474,6 +1475,9 @@ private:
 
   struct PresShellState {
     nsIPresShell* mPresShell;
+#ifdef DEBUG
+    mozilla::Maybe<nsAutoLayoutPhase> mAutoLayoutPhase;
+#endif
     nsIFrame*     mCaretFrame;
     nsRect        mCaretRect;
     mozilla::Maybe<OutOfFlowDisplayData> mFixedBackgroundDisplayData;

From 0b12597ec200904c543522d8a023cbf77e559e78 Mon Sep 17 00:00:00 2001
From: Matt Woodrow <mwoodrow@mozilla.com>
Date: Wed, 20 Sep 2017 13:12:37 +1200
Subject: [PATCH 29/29] Bug 1402204 - Remove
 NS_SCROLLFRAME_INVALIDATE_CONTENTS_ON_SCROLL as it doesn't appear to be
 needed any more. r=mats

---
 layout/generic/TextOverflow.cpp     |  2 --
 layout/generic/nsFrameStateBits.h   | 11 -----------
 layout/generic/nsGfxScrollFrame.cpp | 18 +-----------------
 3 files changed, 1 insertion(+), 30 deletions(-)

diff --git a/layout/generic/TextOverflow.cpp b/layout/generic/TextOverflow.cpp
index 53c63b015289..98e6941939c9 100644
--- a/layout/generic/TextOverflow.cpp
+++ b/layout/generic/TextOverflow.cpp
@@ -366,8 +366,6 @@ TextOverflow::TextOverflow(nsDisplayListBuilder* aBuilder,
                         LogicalPoint(mBlockWM,
                                      mScrollableFrame->GetScrollPosition(),
                                      nullContainerSize));
-    nsIFrame* scrollFrame = do_QueryFrame(mScrollableFrame);
-    scrollFrame->AddStateBits(NS_SCROLLFRAME_INVALIDATE_CONTENTS_ON_SCROLL);
   }
   uint8_t direction = aBlockFrame->StyleVisibility()->mDirection;
   const nsStyleTextReset* style = aBlockFrame->StyleTextReset();
diff --git a/layout/generic/nsFrameStateBits.h b/layout/generic/nsFrameStateBits.h
index 392c25ef5d12..8cf02597a9a3 100644
--- a/layout/generic/nsFrameStateBits.h
+++ b/layout/generic/nsFrameStateBits.h
@@ -556,17 +556,6 @@ FRAME_STATE_BIT(Block, 62, BULLET_FRAME_HAS_FONT_INFLATION)
 FRAME_STATE_BIT(Block, 63, BULLET_FRAME_IMAGE_LOADING)
 
 
-// == Frame state bits that apply to scroll frames ============================
-
-FRAME_STATE_GROUP(Scroll, nsIScrollableFrame)
-
-// When set, the next scroll operation on the scrollframe will invalidate its
-// entire contents. Useful for text-overflow.
-// This bit is cleared after each time the scrollframe is scrolled. Whoever
-// needs to set it should set it again on each paint.
-FRAME_STATE_BIT(Scroll, 20, NS_SCROLLFRAME_INVALIDATE_CONTENTS_ON_SCROLL)
-
-
 // == Frame state bits that apply to image frames =============================
 
 FRAME_STATE_GROUP(Image, nsImageFrame)
diff --git a/layout/generic/nsGfxScrollFrame.cpp b/layout/generic/nsGfxScrollFrame.cpp
index b297106150cc..03791fda3ded 100644
--- a/layout/generic/nsGfxScrollFrame.cpp
+++ b/layout/generic/nsGfxScrollFrame.cpp
@@ -2421,12 +2421,6 @@ static void AdjustViews(nsIFrame* aFrame)
   }
 }
 
-static bool
-NeedToInvalidateOnScroll(nsIFrame* aFrame)
-{
-  return (aFrame->GetStateBits() & NS_SCROLLFRAME_INVALIDATE_CONTENTS_ON_SCROLL) != 0;
-}
-
 bool ScrollFrameHelper::IsIgnoringViewportClipping() const
 {
   if (!mIsRoot)
@@ -2603,14 +2597,7 @@ void ScrollFrameHelper::ScrollVisual()
   AdjustViews(mScrolledFrame);
   // We need to call this after fixing up the view positions
   // to be consistent with the frame hierarchy.
-  bool needToInvalidateOnScroll = NeedToInvalidateOnScroll(mOuter);
-  mOuter->RemoveStateBits(NS_SCROLLFRAME_INVALIDATE_CONTENTS_ON_SCROLL);
-  if (needToInvalidateOnScroll) {
-    MarkNotRecentlyScrolled();
-  } else {
-    MarkRecentlyScrolled();
-  }
-
+  MarkRecentlyScrolled();
 }
 
 /**
@@ -3279,9 +3266,6 @@ ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
 
   if (aBuilder->IsPaintingToWindow()) {
     mScrollPosAtLastPaint = GetScrollPosition();
-    if (IsMaybeScrollingActive() && NeedToInvalidateOnScroll(mOuter)) {
-      MarkNotRecentlyScrolled();
-    }
     if (IsMaybeScrollingActive()) {
       if (mScrollPosForLayerPixelAlignment == nsPoint(-1,-1)) {
         mScrollPosForLayerPixelAlignment = mScrollPosAtLastPaint;