From e84c2d42a3eef63a3e779397606a4ffdc1cca777 Mon Sep 17 00:00:00 2001
From: Gijs Kruitbosch <gijskruitbosch@gmail.com>
Date: Tue, 13 Oct 2015 13:46:14 +0100
Subject: [PATCH 01/63] Bug 1207641 - keep panel open when moving items to
 toolbar / to palette, r=MattN

--HG--
extra : commitid : 3o1vUEeqkKN
extra : rebase_source : d4999864661914c467e37c71f3a64a41620973bf
---
 browser/components/customizableui/content/panelUI.inc.xul | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/browser/components/customizableui/content/panelUI.inc.xul b/browser/components/customizableui/content/panelUI.inc.xul
index 0721f5485df9..f44873401123 100644
--- a/browser/components/customizableui/content/panelUI.inc.xul
+++ b/browser/components/customizableui/content/panelUI.inc.xul
@@ -243,10 +243,12 @@
        see bug 492960 comment 20. -->
   <menupopup id="customizationPanelItemContextMenu">
     <menuitem oncommand="gCustomizeMode.addToToolbar(document.popupNode)"
+              closemenu="single"
               class="customize-context-moveToToolbar"
               accesskey="&customizeMenu.moveToToolbar.accesskey;"
               label="&customizeMenu.moveToToolbar.label;"/>
     <menuitem oncommand="gCustomizeMode.removeFromArea(document.popupNode)"
+              closemenu="single"
               class="customize-context-removeFromPanel"
               accesskey="&customizeMenu.removeFromMenu.accesskey;"
               label="&customizeMenu.removeFromMenu.label;"/>

From 83bbfbe68ed6a6782ae54abeb68348e820ca4feb Mon Sep 17 00:00:00 2001
From: Gijs Kruitbosch <gijskruitbosch@gmail.com>
Date: Tue, 13 Oct 2015 13:24:14 +0100
Subject: [PATCH 02/63] Bug 1047595 - make picking colors work in HCM / when
 author colors are disabled, r=jaws

--HG--
extra : commitid : 6czZkr7SAqT
extra : rebase_source : cbb0635bfa7ae983e1fbf86c19d3612250c140b2
---
 toolkit/content/widgets/colorpicker.xml | 163 +++++++++++++-----------
 1 file changed, 90 insertions(+), 73 deletions(-)

diff --git a/toolkit/content/widgets/colorpicker.xml b/toolkit/content/widgets/colorpicker.xml
index 47346b4141be..121abe47341a 100644
--- a/toolkit/content/widgets/colorpicker.xml
+++ b/toolkit/content/widgets/colorpicker.xml
@@ -18,88 +18,88 @@
       <xul:vbox flex="1">
 
         <xul:hbox>
-          <xul:spacer class="colorpickertile cp-light" style="background-color: #FFFFFF" color="#FFFFFF"/>
-          <xul:spacer class="colorpickertile cp-light" style="background-color: #FFCCCC" color="#FFCCCC"/>
-          <xul:spacer class="colorpickertile cp-light" style="background-color: #FFCC99" color="#FFCC99"/>
-          <xul:spacer class="colorpickertile cp-light" style="background-color: #FFFF99" color="#FFFF99"/>
-          <xul:spacer class="colorpickertile cp-light" style="background-color: #FFFFCC" color="#FFFFCC"/>
-          <xul:spacer class="colorpickertile cp-light" style="background-color: #99FF99" color="#99FF99"/>
-          <xul:spacer class="colorpickertile cp-light" style="background-color: #99FFFF" color="#99FFFF"/>
-          <xul:spacer class="colorpickertile cp-light" style="background-color: #CCFFFF" color="#CCFFFF"/>
-          <xul:spacer class="colorpickertile cp-light" style="background-color: #CCCCFF" color="#CCCCFF"/>
-          <xul:spacer class="colorpickertile cp-light" style="background-color: #FFCCFF" color="#FFCCFF"/>
+          <xul:image class="colorpickertile cp-light" color="#FFFFFF"/>
+          <xul:image class="colorpickertile cp-light" color="#FFCCCC"/>
+          <xul:image class="colorpickertile cp-light" color="#FFCC99"/>
+          <xul:image class="colorpickertile cp-light" color="#FFFF99"/>
+          <xul:image class="colorpickertile cp-light" color="#FFFFCC"/>
+          <xul:image class="colorpickertile cp-light" color="#99FF99"/>
+          <xul:image class="colorpickertile cp-light" color="#99FFFF"/>
+          <xul:image class="colorpickertile cp-light" color="#CCFFFF"/>
+          <xul:image class="colorpickertile cp-light" color="#CCCCFF"/>
+          <xul:image class="colorpickertile cp-light" color="#FFCCFF"/>
         </xul:hbox>
         <xul:hbox>
-          <xul:spacer class="colorpickertile" style="background-color: #CCCCCC" color="#CCCCCC"/>
-          <xul:spacer class="colorpickertile" style="background-color: #FF6666" color="#FF6666"/>
-          <xul:spacer class="colorpickertile" style="background-color: #FF9966" color="#FF9966"/>
-          <xul:spacer class="colorpickertile cp-light" style="background-color: #FFFF66" color="#FFFF66"/>
-          <xul:spacer class="colorpickertile cp-light" style="background-color: #FFFF33" color="#FFFF33"/>
-          <xul:spacer class="colorpickertile cp-light" style="background-color: #66FF99" color="#66FF99"/>
-          <xul:spacer class="colorpickertile cp-light" style="background-color: #33FFFF" color="#33FFFF"/>
-          <xul:spacer class="colorpickertile cp-light" style="background-color: #66FFFF" color="#66FFFF"/>
-          <xul:spacer class="colorpickertile" style="background-color: #9999FF" color="#9999FF"/>
-          <xul:spacer class="colorpickertile" style="background-color: #FF99FF" color="#FF99FF"/>
+          <xul:image class="colorpickertile" color="#CCCCCC"/>
+          <xul:image class="colorpickertile" color="#FF6666"/>
+          <xul:image class="colorpickertile" color="#FF9966"/>
+          <xul:image class="colorpickertile cp-light" color="#FFFF66"/>
+          <xul:image class="colorpickertile cp-light" color="#FFFF33"/>
+          <xul:image class="colorpickertile cp-light" color="#66FF99"/>
+          <xul:image class="colorpickertile cp-light" color="#33FFFF"/>
+          <xul:image class="colorpickertile cp-light" color="#66FFFF"/>
+          <xul:image class="colorpickertile" color="#9999FF"/>
+          <xul:image class="colorpickertile" color="#FF99FF"/>
         </xul:hbox>
         <xul:hbox>
-          <xul:spacer class="colorpickertile" style="background-color: #C0C0C0" color="#C0C0C0"/>
-          <xul:spacer class="colorpickertile" style="background-color: #FF0000" color="#FF0000"/>
-          <xul:spacer class="colorpickertile" style="background-color: #FF9900" color="#FF9900"/>
-          <xul:spacer class="colorpickertile" style="background-color: #FFCC66" color="#FFCC66"/>
-          <xul:spacer class="colorpickertile cp-light" style="background-color: #FFFF00" color="#FFFF00"/>
-          <xul:spacer class="colorpickertile cp-light" style="background-color: #33FF33" color="#33FF33"/>
-          <xul:spacer class="colorpickertile" style="background-color: #66CCCC" color="#66CCCC"/>
-          <xul:spacer class="colorpickertile" style="background-color: #33CCFF" color="#33CCFF"/>
-          <xul:spacer class="colorpickertile" style="background-color: #6666CC" color="#6666CC"/>
-          <xul:spacer class="colorpickertile" style="background-color: #CC66CC" color="#CC66CC"/>
+          <xul:image class="colorpickertile" color="#C0C0C0"/>
+          <xul:image class="colorpickertile" color="#FF0000"/>
+          <xul:image class="colorpickertile" color="#FF9900"/>
+          <xul:image class="colorpickertile" color="#FFCC66"/>
+          <xul:image class="colorpickertile cp-light" color="#FFFF00"/>
+          <xul:image class="colorpickertile cp-light" color="#33FF33"/>
+          <xul:image class="colorpickertile" color="#66CCCC"/>
+          <xul:image class="colorpickertile" color="#33CCFF"/>
+          <xul:image class="colorpickertile" color="#6666CC"/>
+          <xul:image class="colorpickertile" color="#CC66CC"/>
         </xul:hbox>
         <xul:hbox>
-          <xul:spacer class="colorpickertile" style="background-color: #999999" color="#999999"/>
-          <xul:spacer class="colorpickertile" style="background-color: #CC0000" color="#CC0000"/>
-          <xul:spacer class="colorpickertile" style="background-color: #FF6600" color="#FF6600"/>
-          <xul:spacer class="colorpickertile" style="background-color: #FFCC33" color="#FFCC33"/>
-          <xul:spacer class="colorpickertile" style="background-color: #FFCC00" color="#FFCC00"/>
-          <xul:spacer class="colorpickertile" style="background-color: #33CC00" color="#33CC00"/>
-          <xul:spacer class="colorpickertile" style="background-color: #00CCCC" color="#00CCCC"/>
-          <xul:spacer class="colorpickertile" style="background-color: #3366FF" color="#3366FF"/>
-          <xul:spacer class="colorpickertile" style="background-color: #6633FF" color="#6633FF"/>
-          <xul:spacer class="colorpickertile" style="background-color: #CC33CC" color="#CC33CC"/>
+          <xul:image class="colorpickertile" color="#999999"/>
+          <xul:image class="colorpickertile" color="#CC0000"/>
+          <xul:image class="colorpickertile" color="#FF6600"/>
+          <xul:image class="colorpickertile" color="#FFCC33"/>
+          <xul:image class="colorpickertile" color="#FFCC00"/>
+          <xul:image class="colorpickertile" color="#33CC00"/>
+          <xul:image class="colorpickertile" color="#00CCCC"/>
+          <xul:image class="colorpickertile" color="#3366FF"/>
+          <xul:image class="colorpickertile" color="#6633FF"/>
+          <xul:image class="colorpickertile" color="#CC33CC"/>
         </xul:hbox>
         <xul:hbox>
-          <xul:spacer class="colorpickertile" style="background-color: #666666" color="#666666"/>
-          <xul:spacer class="colorpickertile" style="background-color: #990000" color="#990000"/>
-          <xul:spacer class="colorpickertile" style="background-color: #CC6600" color="#CC6600"/>
-          <xul:spacer class="colorpickertile" style="background-color: #CC9933" color="#CC9933"/>
-          <xul:spacer class="colorpickertile" style="background-color: #999900" color="#999900"/>
-          <xul:spacer class="colorpickertile" style="background-color: #009900" color="#009900"/>
-          <xul:spacer class="colorpickertile" style="background-color: #339999" color="#339999"/>
-          <xul:spacer class="colorpickertile" style="background-color: #3333FF" color="#3333FF"/>
-          <xul:spacer class="colorpickertile" style="background-color: #6600CC" color="#6600CC"/>
-          <xul:spacer class="colorpickertile" style="background-color: #993399" color="#993399"/>
+          <xul:image class="colorpickertile" color="#666666"/>
+          <xul:image class="colorpickertile" color="#990000"/>
+          <xul:image class="colorpickertile" color="#CC6600"/>
+          <xul:image class="colorpickertile" color="#CC9933"/>
+          <xul:image class="colorpickertile" color="#999900"/>
+          <xul:image class="colorpickertile" color="#009900"/>
+          <xul:image class="colorpickertile" color="#339999"/>
+          <xul:image class="colorpickertile" color="#3333FF"/>
+          <xul:image class="colorpickertile" color="#6600CC"/>
+          <xul:image class="colorpickertile" color="#993399"/>
         </xul:hbox>
         <xul:hbox>
-          <xul:spacer class="colorpickertile" style="background-color: #333333" color="#333333"/>
-          <xul:spacer class="colorpickertile" style="background-color: #660000" color="#660000"/>
-          <xul:spacer class="colorpickertile" style="background-color: #993300" color="#993300"/>
-          <xul:spacer class="colorpickertile" style="background-color: #996633" color="#996633"/>
-          <xul:spacer class="colorpickertile" style="background-color: #666600" color="#666600"/>
-          <xul:spacer class="colorpickertile" style="background-color: #006600" color="#006600"/>
-          <xul:spacer class="colorpickertile" style="background-color: #336666" color="#336666"/>
-          <xul:spacer class="colorpickertile" style="background-color: #000099" color="#000099"/>
-          <xul:spacer class="colorpickertile" style="background-color: #333399" color="#333399"/>
-          <xul:spacer class="colorpickertile" style="background-color: #663366" color="#663366"/>
+          <xul:image class="colorpickertile" color="#333333"/>
+          <xul:image class="colorpickertile" color="#660000"/>
+          <xul:image class="colorpickertile" color="#993300"/>
+          <xul:image class="colorpickertile" color="#996633"/>
+          <xul:image class="colorpickertile" color="#666600"/>
+          <xul:image class="colorpickertile" color="#006600"/>
+          <xul:image class="colorpickertile" color="#336666"/>
+          <xul:image class="colorpickertile" color="#000099"/>
+          <xul:image class="colorpickertile" color="#333399"/>
+          <xul:image class="colorpickertile" color="#663366"/>
         </xul:hbox>
         <xul:hbox>
-          <xul:spacer class="colorpickertile" style="background-color: #000000" color="#000000"/>
-          <xul:spacer class="colorpickertile" style="background-color: #330000" color="#330000"/>
-          <xul:spacer class="colorpickertile" style="background-color: #663300" color="#663300"/>
-          <xul:spacer class="colorpickertile" style="background-color: #663333" color="#663333"/>
-          <xul:spacer class="colorpickertile" style="background-color: #333300" color="#333300"/>
-          <xul:spacer class="colorpickertile" style="background-color: #003300" color="#003300"/>
-          <xul:spacer class="colorpickertile" style="background-color: #003333" color="#003333"/>
-          <xul:spacer class="colorpickertile" style="background-color: #000066" color="#000066"/>
-          <xul:spacer class="colorpickertile" style="background-color: #330099" color="#330099"/>
-          <xul:spacer class="colorpickertile" style="background-color: #330033" color="#330033"/>
+          <xul:image class="colorpickertile" color="#000000"/>
+          <xul:image class="colorpickertile" color="#330000"/>
+          <xul:image class="colorpickertile" color="#663300"/>
+          <xul:image class="colorpickertile" color="#663333"/>
+          <xul:image class="colorpickertile" color="#333300"/>
+          <xul:image class="colorpickertile" color="#003300"/>
+          <xul:image class="colorpickertile" color="#003333"/>
+          <xul:image class="colorpickertile" color="#000066"/>
+          <xul:image class="colorpickertile" color="#330099"/>
+          <xul:image class="colorpickertile" color="#330033"/>
         </xul:hbox>
       </xul:vbox>
       <!-- Something to take tab focus
@@ -198,6 +198,17 @@
           this.mIsPopup = false;
           this.mDoOnSelect = true;
 
+          let imageEls = this.mBox.querySelectorAll("image");
+          // We set the background of the picker tiles here using images in
+          // order for the color to show up even when author colors are
+          // disabled or the user is using high contrast mode.
+          for (let el of imageEls) {
+            let dataURI = "data:image/svg+xml,<svg style='background-color: " +
+                          encodeURIComponent(el.getAttribute("color")) +
+                          "' xmlns='http://www.w3.org/2000/svg' />";
+            el.setAttribute("src", dataURI);
+          }
+
           this.hoverCell(this.mBox.childNodes[0].childNodes[0]);
           
           // used to capture keydown at the document level
@@ -420,7 +431,7 @@
     </resources>
     
     <content>
-      <xul:hbox class="colorpicker-button-colorbox" anonid="colorbox" flex="1" xbl:inherits="disabled"/>
+      <xul:image class="colorpicker-button-colorbox" anonid="colorbox" flex="1" xbl:inherits="disabled"/>
 
       <xul:panel class="colorpicker-button-menupopup"
                  anonid="colorpopup" noautofocus="true" level="top"
@@ -441,7 +452,10 @@
           return this.getAttribute("color");
         ]]></getter>
         <setter><![CDATA[
-          this.mColorBox.style.backgroundColor = val;
+          this.mColorBox.setAttribute("src",
+            "data:image/svg+xml,<svg style='background-color: " +
+            encodeURIComponent(val) +
+            "' xmlns='http://www.w3.org/2000/svg' />");
           this.setAttribute("color", val);
           return val;
         ]]></setter>
@@ -450,7 +464,10 @@
       <method name="initialize">
         <body><![CDATA[
           this.mColorBox = document.getAnonymousElementByAttribute(this, "anonid", "colorbox");
-          this.mColorBox.style.backgroundColor = this.color;
+          this.mColorBox.setAttribute("src",
+            "data:image/svg+xml,<svg style='background-color: " +
+            encodeURIComponent(this.color) +
+            "' xmlns='http://www.w3.org/2000/svg' />");
         
           var popup = document.getAnonymousElementByAttribute(this, "anonid", "colorpopup")
           popup._colorPicker = this;

From ba12fbbe72586c0f33474c0a472c0f74ade112ff Mon Sep 17 00:00:00 2001
From: Mike Conley <mconley@mozilla.com>
Date: Mon, 5 Oct 2015 15:22:38 -0400
Subject: [PATCH 03/63] Bug 1180991 - Send up natural dimensions of background
 images loaded in content for Page Info. r=florian

--HG--
extra : commitid : 3WG0R3DrZ5K
extra : rebase_source : 9bd7c6c33b8de5342138c8c66c04ebac8c355477
extra : amend_source : 79a786a900756692614126e536135616adc719b0
---
 browser/base/content/content.js           | 21 ++++++++++++++-------
 browser/base/content/pageinfo/pageInfo.js | 12 ++++++++++--
 2 files changed, 24 insertions(+), 9 deletions(-)

diff --git a/browser/base/content/content.js b/browser/base/content/content.js
index 769fdce42e4e..1bbf1035597a 100644
--- a/browser/base/content/content.js
+++ b/browser/base/content/content.js
@@ -1104,9 +1104,6 @@ var PageInfoListener = {
 
   serializeElementInfo: function(document, url, type, alt, item, isBG)
   {
-    // Interface for image loading content.
-    const nsIImageLoadingContent = Components.interfaces.nsIImageLoadingContent;
-
     let result = {};
 
     let imageText;
@@ -1130,10 +1127,9 @@ var PageInfoListener = {
       result.mimeType = item.type;
     }
 
-    if (!result.mimeType && !isBG && item instanceof nsIImageLoadingContent) {
+    if (!result.mimeType && !isBG && item instanceof Ci.nsIImageLoadingContent) {
       // Interface for image loading content.
-      const nsIImageLoadingContent = Components.interfaces.nsIImageLoadingContent;
-      let imageRequest = item.getRequest(nsIImageLoadingContent.CURRENT_REQUEST);
+      let imageRequest = item.getRequest(Ci.nsIImageLoadingContent.CURRENT_REQUEST);
       if (imageRequest) {
         result.mimeType = imageRequest.mimeType;
         let image = !(imageRequest.imageStatus & imageRequest.STATUS_ERROR) && imageRequest.image;
@@ -1158,7 +1154,18 @@ var PageInfoListener = {
     result.HTMLVideoElement = item instanceof content.HTMLVideoElement;
     result.HTMLAudioElement = item instanceof content.HTMLAudioElement;
 
-    if (!isBG) {
+    if (isBG) {
+      // Items that are showing this image as a background
+      // image might not necessarily have a width or height,
+      // so we'll dynamically generate an image and send up the
+      // natural dimensions.
+      let img = content.document.createElement("img");
+      img.src = url;
+      result.naturalWidth = img.naturalWidth;
+      result.naturalHeight = img.naturalHeight;
+    } else {
+      // Otherwise, we can use the current width and height
+      // of the image.
       result.width = item.width;
       result.height = item.height;
     }
diff --git a/browser/base/content/pageinfo/pageInfo.js b/browser/base/content/pageinfo/pageInfo.js
index 404afbb18b24..0527de6630c4 100644
--- a/browser/base/content/pageinfo/pageInfo.js
+++ b/browser/base/content/pageinfo/pageInfo.js
@@ -895,6 +895,14 @@ function makePreview(row)
       // "width" and "height" attributes must be set to newImage,
       // even if there is no "width" or "height attribute in item;
       // otherwise, the preview image cannot be displayed correctly.
+      // Since the image might have been loaded out-of-process, we expect
+      // the item to tell us its width / height dimensions. Failing that
+      // the item should tell us the natural dimensions of the image. Finally
+      // failing that, we'll assume that the image was never loaded in the
+      // other process (this can be true for favicons, for example), and so
+      // we'll assume that we can use the natural dimensions of the newImage
+      // we just created. If the natural dimensions of newImage are not known
+      // then the image is probably broken.
       if (!isBG) {
         newImage.width = ("width" in item && item.width) || newImage.naturalWidth;
         newImage.height = ("height" in item && item.height) || newImage.naturalHeight;
@@ -902,8 +910,8 @@ function makePreview(row)
       else {
         // the Width and Height of an HTML tag should not be used for its background image
         // (for example, "table" can have "width" or "height" attributes)
-        newImage.width = newImage.naturalWidth;
-        newImage.height = newImage.naturalHeight;
+        newImage.width = item.naturalWidth || newImage.naturalWidth;
+        newImage.height = item.naturalHeight || newImage.naturalHeight;
       }
 
       if (item.SVGImageElement) {

From f8cdabf8610fc3063c414faae9da96cadb99ddce Mon Sep 17 00:00:00 2001
From: Aryeh Gregor <ayg@aryeh.name>
Date: Wed, 14 Oct 2015 11:16:08 +0530
Subject: [PATCH 04/63] Bug 799937 - Make createElement()'s result always in
 the HTML namespace (except for XUL documents); r=bz

The new expected failures in web-platform are in a test that doesn't
match the spec, which has already been synced upstream and will be
synced shortly.  For the same test in imptests, I chose to modify the
test instead, because it's easier and imptests is going to be removed.
---
 dom/base/nsDocument.cpp                       |  2 +
 dom/base/test/test_XHRSendData.html           |  2 +-
 dom/base/test/unit/test_xml_serializer.js     |  2 +-
 dom/html/nsHTMLDocument.cpp                   |  1 -
 .../dom/nodes/test_Node-properties.html.json  |  4 +-
 ...test_Document-createElement-namespace.html |  6 +-
 .../share-registry-create-document.html.ini   |  5 --
 .../dom/nodes/Document-constructor.html.ini   |  5 --
 .../Document-createElement-namespace.html.ini | 74 +++++++++++++++++++
 .../meta/dom/nodes/Node-properties.html.ini   |  8 --
 10 files changed, 80 insertions(+), 29 deletions(-)
 delete mode 100644 testing/web-platform/meta/custom-elements/creating-and-passing-registries/share-registry-create-document.html.ini
 delete mode 100644 testing/web-platform/meta/dom/nodes/Document-constructor.html.ini
 create mode 100644 testing/web-platform/meta/dom/nodes/Document-createElement-namespace.html.ini
 delete mode 100644 testing/web-platform/meta/dom/nodes/Node-properties.html.ini

diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
index 1ae96d223c71..6306b89fc10a 100644
--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -1550,6 +1550,8 @@ nsDocument::nsDocument(const char* aContentType)
   , mAnimatingImages(true)
   , mViewportType(Unknown)
 {
+  mDefaultElementType = kNameSpaceID_XHTML;
+
   SetContentTypeInternal(nsDependentCString(aContentType));
 
   if (!gDocumentLeakPRLog)
diff --git a/dom/base/test/test_XHRSendData.html b/dom/base/test/test_XHRSendData.html
index 05e0b4f49c2e..2274643202c3 100644
--- a/dom/base/test/test_XHRSendData.html
+++ b/dom/base/test/test_XHRSendData.html
@@ -34,7 +34,7 @@ is(testDoc1.inputEncoding, "windows-1252", "wrong encoding");
 
 testDoc2 = document.implementation.createDocument("", "", null);
 testDoc2.appendChild(testDoc2.createComment(" doc 2 "));
-testDoc2.appendChild(testDoc2.createElement("res"));
+testDoc2.appendChild(testDoc2.createElementNS(null, "res"));
 testDoc2.documentElement.appendChild(testDoc2.createTextNode("text"));
 is(testDoc2.inputEncoding, "UTF-8", "wrong encoding");
 
diff --git a/dom/base/test/unit/test_xml_serializer.js b/dom/base/test/unit/test_xml_serializer.js
index c74d067a8115..267fd9c8117a 100644
--- a/dom/base/test/unit/test_xml_serializer.js
+++ b/dom/base/test/unit/test_xml_serializer.js
@@ -175,7 +175,7 @@ function test5() {
   // Handling of kids in the null namespace when the default is a
   // different namespace (bug 301260).
   var doc = ParseXML('<root xmlns="ns1"/>')
-  var child = doc.createElement('child');
+  var child = doc.createElementNS(null, 'child');
   doc.documentElement.appendChild(child);
   do_check_serialize(doc);
   do_check_eq(SerializeXML(doc),
diff --git a/dom/html/nsHTMLDocument.cpp b/dom/html/nsHTMLDocument.cpp
index 7bb56d898df9..87cf1379d70c 100644
--- a/dom/html/nsHTMLDocument.cpp
+++ b/dom/html/nsHTMLDocument.cpp
@@ -176,7 +176,6 @@ nsHTMLDocument::nsHTMLDocument()
   // bother initializing members to 0.
 
   mType = eHTML;
-  mDefaultElementType = kNameSpaceID_XHTML;
   mCompatMode = eCompatibility_NavQuirks;
 }
 
diff --git a/dom/imptests/failures/html/dom/nodes/test_Node-properties.html.json b/dom/imptests/failures/html/dom/nodes/test_Node-properties.html.json
index 8c7b35264d9f..272c5e890a5a 100644
--- a/dom/imptests/failures/html/dom/nodes/test_Node-properties.html.json
+++ b/dom/imptests/failures/html/dom/nodes/test_Node-properties.html.json
@@ -1,7 +1,5 @@
 {
   "document.characterSet": true,
   "foreignDoc.characterSet": true,
-  "xmlDoc.characterSet": true,
-  "xmlElement.namespaceURI": true,
-  "detachedXmlElement.namespaceURI": true
+  "xmlDoc.characterSet": true
 }
diff --git a/dom/imptests/html/dom/nodes/test_Document-createElement-namespace.html b/dom/imptests/html/dom/nodes/test_Document-createElement-namespace.html
index 4898eeabc813..c9f1a33eaf36 100644
--- a/dom/imptests/html/dom/nodes/test_Document-createElement-namespace.html
+++ b/dom/imptests/html/dom/nodes/test_Document-createElement-namespace.html
@@ -24,11 +24,7 @@ function testDoc(doc, contentType) {
                   "Wrong MIME type -- incorrect server config?");
   }
 
-  var expectedNamespace = contentType == "text/html" ||
-                          contentType == "application/xhtml+xml"
-                          ? "http://www.w3.org/1999/xhtml" : null;
-
-  assert_equals(doc.createElement("x").namespaceURI, expectedNamespace);
+  assert_equals(doc.createElement("x").namespaceURI, "http://www.w3.org/1999/xhtml");
 }
 
 // First test various objects we create in JS
diff --git a/testing/web-platform/meta/custom-elements/creating-and-passing-registries/share-registry-create-document.html.ini b/testing/web-platform/meta/custom-elements/creating-and-passing-registries/share-registry-create-document.html.ini
deleted file mode 100644
index 482a2a2df574..000000000000
--- a/testing/web-platform/meta/custom-elements/creating-and-passing-registries/share-registry-create-document.html.ini
+++ /dev/null
@@ -1,5 +0,0 @@
-[share-registry-create-document.html]
-  type: testharness
-  [Document created by createDocument with HTML namespace should share an existing registry]
-    expected: FAIL
-
diff --git a/testing/web-platform/meta/dom/nodes/Document-constructor.html.ini b/testing/web-platform/meta/dom/nodes/Document-constructor.html.ini
deleted file mode 100644
index d86bc27bc9a0..000000000000
--- a/testing/web-platform/meta/dom/nodes/Document-constructor.html.ini
+++ /dev/null
@@ -1,5 +0,0 @@
-[Document-constructor.html]
-  type: testharness
-  [new Document(): URL parsing]
-    expected: FAIL
-
diff --git a/testing/web-platform/meta/dom/nodes/Document-createElement-namespace.html.ini b/testing/web-platform/meta/dom/nodes/Document-createElement-namespace.html.ini
new file mode 100644
index 000000000000..9647b1f7331e
--- /dev/null
+++ b/testing/web-platform/meta/dom/nodes/Document-createElement-namespace.html.ini
@@ -0,0 +1,74 @@
+[Document-createElement-namespace.html]
+  type: testharness
+  [Created element's namespace in created XML document]
+    expected: FAIL
+
+  [Created element's namespace in created XHTML document]
+    expected: FAIL
+
+  [Created element's namespace in created SVG document]
+    expected: FAIL
+
+  [Created element's namespace in created MathML document]
+    expected: FAIL
+
+  [Created element's namespace in empty.xml]
+    expected: FAIL
+
+  [Created element's namespace in empty.svg]
+    expected: FAIL
+
+  [Created element's namespace in minimal_html.xml]
+    expected: FAIL
+
+  [Created element's namespace in minimal_html.svg]
+    expected: FAIL
+
+  [Created element's namespace in xhtml.xml]
+    expected: FAIL
+
+  [Created element's namespace in xhtml.svg]
+    expected: FAIL
+
+  [Created element's namespace in svg.xml]
+    expected: FAIL
+
+  [Created element's namespace in svg.svg]
+    expected: FAIL
+
+  [Created element's namespace in mathml.xml]
+    expected: FAIL
+
+  [Created element's namespace in mathml.svg]
+    expected: FAIL
+
+  [Created element's namespace in bare_xhtml.xml]
+    expected: FAIL
+
+  [Created element's namespace in bare_xhtml.svg]
+    expected: FAIL
+
+  [Created element's namespace in bare_svg.xml]
+    expected: FAIL
+
+  [Created element's namespace in bare_svg.svg]
+    expected: FAIL
+
+  [Created element's namespace in bare_mathml.xml]
+    expected: FAIL
+
+  [Created element's namespace in bare_mathml.svg]
+    expected: FAIL
+
+  [Created element's namespace in xhtml_ns_removed.xml]
+    expected: FAIL
+
+  [Created element's namespace in xhtml_ns_removed.svg]
+    expected: FAIL
+
+  [Created element's namespace in xhtml_ns_changed.xml]
+    expected: FAIL
+
+  [Created element's namespace in xhtml_ns_changed.svg]
+    expected: FAIL
+
diff --git a/testing/web-platform/meta/dom/nodes/Node-properties.html.ini b/testing/web-platform/meta/dom/nodes/Node-properties.html.ini
deleted file mode 100644
index 2e1731cc21b4..000000000000
--- a/testing/web-platform/meta/dom/nodes/Node-properties.html.ini
+++ /dev/null
@@ -1,8 +0,0 @@
-[Node-properties.html]
-  type: testharness
-  [xmlElement.namespaceURI]
-    expected: FAIL
-
-  [detachedXmlElement.namespaceURI]
-    expected: FAIL
-

From b564e1db32eb0d49046fd2a1bbfa1e127edbd7ba Mon Sep 17 00:00:00 2001
From: sajitk <sajitk@rocketmail.com>
Date: Wed, 14 Oct 2015 11:17:07 +0530
Subject: [PATCH 05/63] Bug 996105 - Added tests for registry access. Fixed
 wrong condition in ReadStringValue code. r=bsmedberg

--HG--
extra : amend_source : 8b78a62b071a515f3652e77c2abd37561ebf3380
---
 xpcom/ds/nsWindowsRegKey.cpp              |   2 +-
 xpcom/tests/unit/test_windows_registry.js | 205 ++++++++++++++++++++++
 xpcom/tests/unit/xpcshell.ini             |   2 +
 3 files changed, 208 insertions(+), 1 deletion(-)
 create mode 100644 xpcom/tests/unit/test_windows_registry.js

diff --git a/xpcom/ds/nsWindowsRegKey.cpp b/xpcom/ds/nsWindowsRegKey.cpp
index e254dbda25a8..5ca46f1c7d96 100644
--- a/xpcom/ds/nsWindowsRegKey.cpp
+++ b/xpcom/ds/nsWindowsRegKey.cpp
@@ -310,7 +310,7 @@ nsWindowsRegKey::ReadStringValue(const nsAString& aName, nsAString& aResult)
 
   // This must be a string type in order to fetch the value as a string.
   // We're being a bit forgiving here by allowing types other than REG_SZ.
-  if (type != REG_SZ && type == REG_EXPAND_SZ && type == REG_MULTI_SZ) {
+  if (type != REG_SZ && type != REG_EXPAND_SZ && type != REG_MULTI_SZ) {
     return NS_ERROR_FAILURE;
   }
 
diff --git a/xpcom/tests/unit/test_windows_registry.js b/xpcom/tests/unit/test_windows_registry.js
new file mode 100644
index 000000000000..9a17678f830c
--- /dev/null
+++ b/xpcom/tests/unit/test_windows_registry.js
@@ -0,0 +1,205 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et: */
+
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+const Cr = Components.results;
+const Ci = Components.interfaces;
+const Cc = Components.classes;
+const Cu = Components.utils;
+const CC = Components.Constructor;
+
+const nsIWindowsRegKey = Ci.nsIWindowsRegKey;
+let regKeyComponent = Cc["@mozilla.org/windows-registry-key;1"];
+
+function run_test()
+{
+    //* create a key structure in a spot that's normally writable (somewhere under HKCU). 
+    let testKey = regKeyComponent.createInstance(nsIWindowsRegKey);
+
+    // If it's already present because a previous test crashed or didn't clean up properly, clean it up first.
+    let keyName = BASE_PATH + "\\" + TESTDATA_KEYNAME;
+    setup_test_run(testKey, keyName);
+
+    //* test that the write* functions write stuff
+    test_writing_functions(testKey);
+
+    //* check that the valueCount/getValueName functions work for the values we just wrote
+    test_value_functions(testKey);
+    
+    //* check that the get* functions work for the values we just wrote.
+    test_reading_functions(testKey);
+    
+    //* check that the get* functions fail with the right exception codes if we ask for the wrong type or if the value name doesn't exist at all
+    test_invalidread_functions(testKey);
+
+    //* check that creating/enumerating/deleting child keys works
+    test_childkey_functions(testKey);
+
+    test_watching_functions(testKey);
+
+    //* clean up
+    cleanup_test_run(testKey, keyName);
+}
+
+function setup_test_run(testKey, keyName)
+{
+    do_print("Setup test run");
+    try {
+        testKey.open(nsIWindowsRegKey.ROOT_KEY_CURRENT_USER, keyName, nsIWindowsRegKey.ACCESS_READ);
+        do_print("Test key exists. Needs cleanup.");
+        cleanup_test_run(testKey, keyName);
+    }
+    catch (e if (e instanceof Ci.nsIException && e.result == Cr.NS_ERROR_FAILURE))
+    {
+    }
+
+    testKey.create(nsIWindowsRegKey.ROOT_KEY_CURRENT_USER, keyName, nsIWindowsRegKey.ACCESS_ALL);
+}
+
+function test_writing_functions(testKey)
+{
+    strictEqual(testKey.valueCount, 0);
+
+    strictEqual(testKey.hasValue(TESTDATA_STRNAME), false);
+    testKey.writeStringValue(TESTDATA_STRNAME, TESTDATA_STRVALUE);
+    strictEqual(testKey.hasValue(TESTDATA_STRNAME), true);
+
+    strictEqual(testKey.hasValue(TESTDATA_INTNAME), false);
+    testKey.writeIntValue(TESTDATA_INTNAME, TESTDATA_INTVALUE);
+
+    strictEqual(testKey.hasValue(TESTDATA_INT64NAME), false);
+    testKey.writeInt64Value(TESTDATA_INT64NAME, TESTDATA_INT64VALUE);
+
+    strictEqual(testKey.hasValue(TESTDATA_BINARYNAME), false);
+    testKey.writeBinaryValue(TESTDATA_BINARYNAME, TESTDATA_BINARYVALUE);
+}
+
+function test_value_functions(testKey)
+{
+    strictEqual(testKey.valueCount, 4);
+    strictEqual(testKey.getValueName(0), TESTDATA_STRNAME);
+    strictEqual(testKey.getValueName(1), TESTDATA_INTNAME);
+    strictEqual(testKey.getValueName(2), TESTDATA_INT64NAME);
+    strictEqual(testKey.getValueName(3), TESTDATA_BINARYNAME);
+}
+
+function test_reading_functions(testKey)
+{
+    strictEqual(testKey.getValueType(TESTDATA_STRNAME), nsIWindowsRegKey.TYPE_STRING);
+    strictEqual(testKey.readStringValue(TESTDATA_STRNAME), TESTDATA_STRVALUE);
+
+    strictEqual(testKey.getValueType(TESTDATA_INTNAME), nsIWindowsRegKey.TYPE_INT);
+    strictEqual(testKey.readIntValue(TESTDATA_INTNAME), TESTDATA_INTVALUE);
+   
+    strictEqual(testKey.getValueType(TESTDATA_INT64NAME), nsIWindowsRegKey.TYPE_INT64);
+    strictEqual( testKey.readInt64Value(TESTDATA_INT64NAME), TESTDATA_INT64VALUE);
+    
+    strictEqual(testKey.getValueType(TESTDATA_BINARYNAME), nsIWindowsRegKey.TYPE_BINARY);
+    strictEqual( testKey.readBinaryValue(TESTDATA_BINARYNAME), TESTDATA_BINARYVALUE);
+}
+
+function test_invalidread_functions(testKey)
+{
+    try {
+        testKey.readIntValue(TESTDATA_STRNAME);
+        do_throw("Reading an integer from a string registry value should throw.");
+    } catch (e if (e instanceof Ci.nsIException && e.result == Cr.NS_ERROR_FAILURE)) {
+    }
+
+    try {
+        let val = testKey.readStringValue(TESTDATA_INTNAME);
+        do_throw("Reading an string from an Int registry value should throw." + val);
+    } catch (e if (e instanceof Ci.nsIException && e.result == Cr.NS_ERROR_FAILURE)) {
+    }
+
+    try {
+        testKey.readStringValue(TESTDATA_INT64NAME);
+        do_throw("Reading an string from an Int64 registry value should throw.");
+    } catch (e if (e instanceof Ci.nsIException && e.result == Cr.NS_ERROR_FAILURE)) {
+    }
+
+    try {
+        testKey.readStringValue(TESTDATA_BINARYNAME);
+        do_throw("Reading a string from an Binary registry value should throw.");
+    } catch (e if (e instanceof Ci.nsIException && e.result == Cr.NS_ERROR_FAILURE)) {
+    }
+
+}
+
+function test_childkey_functions(testKey)
+{
+    strictEqual(testKey.childCount, 0);
+    strictEqual(testKey.hasChild(TESTDATA_CHILD_KEY), false);
+    
+    let childKey = testKey.createChild(TESTDATA_CHILD_KEY, nsIWindowsRegKey.ACCESS_ALL);
+    childKey.close();
+
+    strictEqual(testKey.childCount, 1);
+    strictEqual(testKey.hasChild(TESTDATA_CHILD_KEY), true);
+    strictEqual(testKey.getChildName(0), TESTDATA_CHILD_KEY);
+
+    childKey = testKey.openChild(TESTDATA_CHILD_KEY, nsIWindowsRegKey.ACCESS_ALL);
+    testKey.removeChild(TESTDATA_CHILD_KEY);
+    strictEqual(testKey.childCount, 0);
+    strictEqual(testKey.hasChild(TESTDATA_CHILD_KEY), false);
+}
+
+function test_watching_functions(testKey)
+{
+    strictEqual(testKey.isWatching(), false);
+    strictEqual(testKey.hasChanged(), false);
+    
+    testKey.startWatching(true);
+    strictEqual(testKey.isWatching(), true);
+    
+    testKey.stopWatching();
+    strictEqual(testKey.isWatching(), false);
+
+    // Create a child key, and update a value
+    let childKey = testKey.createChild(TESTDATA_CHILD_KEY, nsIWindowsRegKey.ACCESS_ALL);
+    childKey.writeIntValue(TESTDATA_INTNAME, TESTDATA_INTVALUE);
+
+    // Start a recursive watch, and update the child's value
+    testKey.startWatching(true);
+    strictEqual(testKey.isWatching(), true);
+
+    childKey.writeIntValue(TESTDATA_INTNAME, 0);
+    strictEqual(testKey.hasChanged(), true);
+    testKey.stopWatching();
+    strictEqual(testKey.isWatching(), false);
+        
+    childKey.removeValue(TESTDATA_INTNAME);
+    childKey.close();
+    testKey.removeChild(TESTDATA_CHILD_KEY);
+}
+
+function cleanup_test_run(testKey, keyName)
+{
+    do_print("Cleaning up test.");
+
+    for (var i = 0; i < testKey.childCount; i++) {
+        testKey.removeChild(testKey.getChildName(i));
+    }
+    testKey.close();
+
+    let baseKey = regKeyComponent.createInstance(nsIWindowsRegKey);
+    baseKey.open(nsIWindowsRegKey.ROOT_KEY_CURRENT_USER, BASE_PATH, nsIWindowsRegKey.ACCESS_ALL);
+    baseKey.removeChild(TESTDATA_KEYNAME);
+    baseKey.close();
+}
+
+// Test data used above.
+const BASE_PATH = "SOFTWARE";
+const TESTDATA_KEYNAME = "TestRegXPC";
+const TESTDATA_STRNAME = "AString";
+const TESTDATA_STRVALUE = "The quick brown fox jumps over the lazy dog.";
+const TESTDATA_INTNAME = "AnInteger";
+const TESTDATA_INTVALUE = 65536;
+const TESTDATA_INT64NAME = "AnInt64";
+const TESTDATA_INT64VALUE = 9223372036854775807;
+const TESTDATA_BINARYNAME = "ABinary";
+const TESTDATA_BINARYVALUE = "She sells seashells by the seashore";
+const TESTDATA_CHILD_KEY = "TestChildKey";
diff --git a/xpcom/tests/unit/xpcshell.ini b/xpcom/tests/unit/xpcshell.ini
index bf1b2b7e4172..e340e3e850f7 100644
--- a/xpcom/tests/unit/xpcshell.ini
+++ b/xpcom/tests/unit/xpcshell.ini
@@ -75,3 +75,5 @@ skip-if = os == "win"
 fail-if = os == "android"
 [test_file_renameTo.js]
 [test_notxpcom_scriptable.js]
+[test_windows_registry.js]
+skip-if = os != "win"

From ba964b1f9c52d993520caa731f40c6723ebbcd12 Mon Sep 17 00:00:00 2001
From: Jukka Jylanki <jjylanki@mozilla.com>
Date: Wed, 14 Oct 2015 11:18:19 +0530
Subject: [PATCH 06/63] Bug 1147441 - Add SharedArrayBuffer support to WebGL
 and WebGL 2. r=jgilbert, r=bzbarsky

--HG--
extra : histedit_source : 141390e44859f0cdb1692979f08f873ad3480754
---
 dom/canvas/WebGL2Context.h                    |  17 +-
 dom/canvas/WebGL2ContextBuffers.cpp           |  31 ++-
 dom/canvas/WebGL2ContextTextures.cpp          |   8 +-
 dom/canvas/WebGLContext.h                     |  35 ++-
 dom/canvas/WebGLContextBuffers.cpp            | 188 ++++++++--------
 dom/canvas/WebGLContextGL.cpp                 |  39 +++-
 dom/canvas/WebGLContextTextures.cpp           |   8 +-
 dom/canvas/WebGLTexture.h                     |  17 +-
 dom/canvas/WebGLTextureUpload.cpp             |  66 +++---
 dom/canvas/test/webgl-mochitest.ini           |   1 +
 .../webgl-mochitest/test_sab_with_webgl.html  | 200 ++++++++++++++++++
 dom/webidl/WebGL2RenderingContext.webidl      |   9 +-
 dom/webidl/WebGLRenderingContext.webidl       |  14 +-
 13 files changed, 440 insertions(+), 193 deletions(-)
 create mode 100644 dom/canvas/test/webgl-mochitest/test_sab_with_webgl.html

diff --git a/dom/canvas/WebGL2Context.h b/dom/canvas/WebGL2Context.h
index 4fe61423e5b7..e3556ed6fd93 100644
--- a/dom/canvas/WebGL2Context.h
+++ b/dom/canvas/WebGL2Context.h
@@ -24,6 +24,7 @@ class WebGLVertexArrayObject;
 namespace dom {
 class OwningUnsignedLongOrUint32ArrayOrBoolean;
 class OwningWebGLBufferOrLongLong;
+class ArrayBufferViewOrSharedArrayBufferView;
 } // namespace dom
 
 class WebGL2Context
@@ -51,8 +52,16 @@ public:
 
     void CopyBufferSubData(GLenum readTarget, GLenum writeTarget,
                            GLintptr readOffset, GLintptr writeOffset, GLsizeiptr size);
+
+private:
+    template<typename BufferT>
+    void GetBufferSubDataT(GLenum target, GLintptr offset, const BufferT& data);
+
+public:
     void GetBufferSubData(GLenum target, GLintptr offset,
                           const dom::Nullable<dom::ArrayBuffer>& maybeData);
+    void GetBufferSubData(GLenum target, GLintptr offset,
+                          const dom::SharedArrayBuffer& data);
 
 
     // -------------------------------------------------------------------------
@@ -88,12 +97,12 @@ public:
     void TexImage3D(GLenum target, GLint level, GLenum internalformat,
                     GLsizei width, GLsizei height, GLsizei depth,
                     GLint border, GLenum format, GLenum type,
-                    const dom::Nullable<dom::ArrayBufferView>& pixels,
+                    const dom::Nullable<dom::ArrayBufferViewOrSharedArrayBufferView>& pixels,
                     ErrorResult& rv);
     void TexSubImage3D(GLenum target, GLint level,
                        GLint xoffset, GLint yoffset, GLint zoffset,
                        GLsizei width, GLsizei height, GLsizei depth,
-                       GLenum format, GLenum type, const dom::Nullable<dom::ArrayBufferView>& pixels,
+                       GLenum format, GLenum type, const dom::Nullable<dom::ArrayBufferViewOrSharedArrayBufferView>& pixels,
                        ErrorResult& rv);
     void TexSubImage3D(GLenum target, GLint level,
                        GLint xoffset, GLint yoffset, GLint zoffset,
@@ -109,10 +118,10 @@ public:
                            GLint x, GLint y, GLsizei width, GLsizei height);
     void CompressedTexImage3D(GLenum target, GLint level, GLenum internalformat,
                               GLsizei width, GLsizei height, GLsizei depth,
-                              GLint border, GLsizei imageSize, const dom::ArrayBufferView& data);
+                              GLint border, GLsizei imageSize, const dom::ArrayBufferViewOrSharedArrayBufferView& data);
     void CompressedTexSubImage3D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint zoffset,
                                  GLsizei width, GLsizei height, GLsizei depth,
-                                 GLenum format, GLsizei imageSize, const dom::ArrayBufferView& data);
+                                 GLenum format, GLsizei imageSize, const dom::ArrayBufferViewOrSharedArrayBufferView& data);
 
 
     // -------------------------------------------------------------------------
diff --git a/dom/canvas/WebGL2ContextBuffers.cpp b/dom/canvas/WebGL2ContextBuffers.cpp
index 4446e9ad66cc..97a08e5c584a 100644
--- a/dom/canvas/WebGL2ContextBuffers.cpp
+++ b/dom/canvas/WebGL2ContextBuffers.cpp
@@ -138,9 +138,12 @@ WebGL2Context::CopyBufferSubData(GLenum readTarget, GLenum writeTarget,
     }
 }
 
+// BufferT may be one of
+// const dom::ArrayBuffer&
+// const dom::SharedArrayBuffer&
+template<typename BufferT>
 void
-WebGL2Context::GetBufferSubData(GLenum target, GLintptr offset,
-                                const dom::Nullable<dom::ArrayBuffer>& maybeData)
+WebGL2Context::GetBufferSubDataT(GLenum target, GLintptr offset, const BufferT& data)
 {
     if (IsContextLost())
         return;
@@ -159,11 +162,6 @@ WebGL2Context::GetBufferSubData(GLenum target, GLintptr offset,
     if (offset < 0)
         return ErrorInvalidValue("getBufferSubData: negative offset");
 
-    // If returnedData is null then an INVALID_VALUE error is
-    // generated.
-    if (maybeData.IsNull())
-        return ErrorInvalidValue("getBufferSubData: returnedData is null");
-
     WebGLRefPtr<WebGLBuffer>& bufferSlot = GetBufferSlotByTarget(target);
     WebGLBuffer* boundBuffer = bufferSlot.get();
     if (!boundBuffer)
@@ -171,7 +169,6 @@ WebGL2Context::GetBufferSubData(GLenum target, GLintptr offset,
 
     // If offset + returnedData.byteLength would extend beyond the end
     // of the buffer an INVALID_VALUE error is generated.
-    const dom::ArrayBuffer& data = maybeData.Value();
     data.ComputeLengthAndData();
 
     CheckedInt<WebGLsizeiptr> neededByteLength = CheckedInt<WebGLsizeiptr>(offset) + data.Length();
@@ -225,4 +222,22 @@ WebGL2Context::GetBufferSubData(GLenum target, GLintptr offset,
     }
 }
 
+void WebGL2Context::GetBufferSubData(GLenum target, GLintptr offset,
+                                     const dom::Nullable<dom::ArrayBuffer>& maybeData)
+{
+    // If returnedData is null then an INVALID_VALUE error is
+    // generated.
+    if (maybeData.IsNull())
+        return ErrorInvalidValue("getBufferSubData: returnedData is null");
+
+    const dom::ArrayBuffer& data = maybeData.Value();
+    GetBufferSubDataT(target, offset, data);
+}
+
+void WebGL2Context::GetBufferSubData(GLenum target, GLintptr offset,
+                                     const dom::SharedArrayBuffer& data)
+{
+    GetBufferSubDataT(target, offset, data);
+}
+
 } // namespace mozilla
diff --git a/dom/canvas/WebGL2ContextTextures.cpp b/dom/canvas/WebGL2ContextTextures.cpp
index 45911cff98c3..3af21102527d 100644
--- a/dom/canvas/WebGL2ContextTextures.cpp
+++ b/dom/canvas/WebGL2ContextTextures.cpp
@@ -39,7 +39,7 @@ void
 WebGL2Context::TexImage3D(GLenum rawTexImageTarget, GLint level, GLenum internalFormat,
                           GLsizei width, GLsizei height, GLsizei depth,
                           GLint border, GLenum unpackFormat, GLenum unpackType,
-                          const dom::Nullable<dom::ArrayBufferView>& maybeView,
+                          const dom::Nullable<dom::ArrayBufferViewOrSharedArrayBufferView>& maybeView,
                           ErrorResult& out_rv)
 {
     const char funcName[] = "texImage3D";
@@ -59,7 +59,7 @@ WebGL2Context::TexSubImage3D(GLenum rawTexImageTarget, GLint level,
                              GLint xOffset, GLint yOffset, GLint zOffset,
                              GLsizei width, GLsizei height, GLsizei depth,
                              GLenum unpackFormat, GLenum unpackType,
-                             const dom::Nullable<dom::ArrayBufferView>& maybeView,
+                             const dom::Nullable<dom::ArrayBufferViewOrSharedArrayBufferView>& maybeView,
                              ErrorResult& out_rv)
 {
     const char funcName[] = "texSubImage3D";
@@ -95,7 +95,7 @@ WebGL2Context::CopyTexSubImage3D(GLenum target, GLint level,
 void
 WebGL2Context::CompressedTexImage3D(GLenum target, GLint level, GLenum internalFormat,
                                     GLsizei width, GLsizei height, GLsizei depth,
-                                    GLint border, GLsizei imageSize, const dom::ArrayBufferView& view)
+                                    GLint border, GLsizei imageSize, const dom::ArrayBufferViewOrSharedArrayBufferView& view)
 {
     GenerateWarning("compressedTexImage3D: Not implemented.");
 }
@@ -103,7 +103,7 @@ WebGL2Context::CompressedTexImage3D(GLenum target, GLint level, GLenum internalF
 void
 WebGL2Context::CompressedTexSubImage3D(GLenum target, GLint level, GLint xOffset, GLint yOffset, GLint zOffset,
                                        GLsizei width, GLsizei height, GLsizei depth,
-                                       GLenum unpackFormat, GLsizei imageSize, const dom::ArrayBufferView& view)
+                                       GLenum unpackFormat, GLsizei imageSize, const dom::ArrayBufferViewOrSharedArrayBufferView& view)
 {
     GenerateWarning("compressedTexSubImage3D: Not implemented.");
 }
diff --git a/dom/canvas/WebGLContext.h b/dom/canvas/WebGLContext.h
index 9bf80161897d..7badc1320f3a 100644
--- a/dom/canvas/WebGLContext.h
+++ b/dom/canvas/WebGLContext.h
@@ -45,7 +45,7 @@
 #include "mozilla/dom/HTMLCanvasElement.h"
 #include "nsWrapperCache.h"
 #include "nsLayoutUtils.h"
-
+#include "mozilla/dom/UnionTypes.h"
 
 class nsIDocShell;
 
@@ -100,6 +100,7 @@ class Element;
 class ImageData;
 class OwningHTMLCanvasElementOrOffscreenCanvas;
 struct WebGLContextAttributes;
+class ArrayBufferViewOrSharedArrayBufferView;
 template<typename> struct Nullable;
 } // namespace dom
 
@@ -528,7 +529,7 @@ public:
     void PolygonOffset(GLfloat factor, GLfloat units);
     void ReadPixels(GLint x, GLint y, GLsizei width, GLsizei height,
                     GLenum format, GLenum type,
-                    const dom::Nullable<dom::ArrayBufferView>& pixels,
+                    const dom::Nullable<dom::ArrayBufferViewOrSharedArrayBufferView>& pixels,
                     ErrorResult& rv);
     void RenderbufferStorage(GLenum target, GLenum internalFormat,
                              GLsizei width, GLsizei height);
@@ -749,8 +750,8 @@ public:
                          WebGLintptr offset, WebGLsizeiptr size);
 
 private:
-    void BufferDataUnchecked(GLenum target, GLsizeiptr size, const GLvoid* data, GLenum usage);
-    void BufferData(GLenum target, WebGLsizeiptr size, void* data, GLenum usage);
+    template<typename BufferT>
+    void BufferDataT(GLenum target, const BufferT& data, GLenum usage);
 
 public:
     void BufferData(GLenum target, WebGLsizeiptr size, GLenum usage);
@@ -758,16 +759,25 @@ public:
                     GLenum usage);
     void BufferData(GLenum target, const dom::Nullable<dom::ArrayBuffer>& maybeData,
                     GLenum usage);
+    void BufferData(GLenum target, const dom::SharedArrayBuffer& data,
+                    GLenum usage);
+    void BufferData(GLenum target, const dom::SharedArrayBufferView& data,
+                    GLenum usage);
 
 private:
-    void BufferSubDataUnchecked(GLenum target, GLintptr offset, GLsizeiptr size, const GLvoid* data);
-    void BufferSubData(GLenum target, GLintptr offset, GLsizeiptr size, const GLvoid* data);
+    template<typename BufferT>
+    void BufferSubDataT(GLenum target, WebGLsizeiptr byteOffset,
+                        const BufferT& data);
 
 public:
     void BufferSubData(GLenum target, WebGLsizeiptr byteOffset,
                        const dom::ArrayBufferView& data);
     void BufferSubData(GLenum target, WebGLsizeiptr byteOffset,
                        const dom::Nullable<dom::ArrayBuffer>& maybeData);
+    void BufferSubData(GLenum target, WebGLsizeiptr byteOffset,
+                       const dom::SharedArrayBuffer& data);
+    void BufferSubData(GLenum target, WebGLsizeiptr byteOffset,
+                       const dom::SharedArrayBufferView& data);
     already_AddRefed<WebGLBuffer> CreateBuffer();
     void DeleteBuffer(WebGLBuffer* buf);
     bool IsBuffer(WebGLBuffer* buf);
@@ -864,10 +874,10 @@ protected:
 public:
     void CompressedTexImage2D(GLenum texImageTarget, GLint level, GLenum internalFormat,
                               GLsizei width, GLsizei height, GLint border,
-                              const dom::ArrayBufferView& view);
+                              const dom::ArrayBufferViewOrSharedArrayBufferView& view);
     void CompressedTexSubImage2D(GLenum texImageTarget, GLint level, GLint xOffset,
                                  GLint yOffset, GLsizei width, GLsizei height,
-                                 GLenum unpackFormat, const dom::ArrayBufferView& view);
+                                 GLenum unpackFormat, const dom::ArrayBufferViewOrSharedArrayBufferView& view);
 
     void CopyTexImage2D(GLenum texImageTarget, GLint level, GLenum internalFormat,
                         GLint x, GLint y, GLsizei width, GLsizei height, GLint border);
@@ -878,7 +888,7 @@ public:
     void TexImage2D(GLenum texImageTarget, GLint level, GLenum internalFormat,
                     GLsizei width, GLsizei height, GLint border, GLenum unpackFormat,
                     GLenum unpackType,
-                    const dom::Nullable<dom::ArrayBufferView>& maybeView,
+                    const dom::Nullable<dom::ArrayBufferViewOrSharedArrayBufferView>& maybeView,
                     ErrorResult& out_rv);
     void TexImage2D(GLenum texImageTarget, GLint level, GLenum internalFormat,
                     GLenum unpackFormat, GLenum unpackType, dom::ImageData* imageData,
@@ -891,7 +901,7 @@ public:
     void TexSubImage2D(GLenum texImageTarget, GLint level, GLint xOffset, GLint yOffset,
                        GLsizei width, GLsizei height, GLenum unpackFormat,
                        GLenum unpackType,
-                       const dom::Nullable<dom::ArrayBufferView>& maybeView,
+                       const dom::Nullable<dom::ArrayBufferViewOrSharedArrayBufferView>& maybeView,
                        ErrorResult& out_rv);
     void TexSubImage2D(GLenum texImageTarget, GLint level, GLint xOffset, GLint yOffset,
                        GLenum unpackFormat, GLenum unpackType, dom::ImageData* imageData,
@@ -1634,6 +1644,11 @@ ValidateTexImageTarget(WebGLContext* webgl, GLenum rawTexImageTarget,
 // Returns x rounded to the next highest multiple of y.
 CheckedUint32 RoundedToNextMultipleOf(CheckedUint32 x, CheckedUint32 y);
 
+void
+ComputeLengthAndData(const dom::ArrayBufferViewOrSharedArrayBufferView& view,
+                     void** const out_data, size_t* const out_length,
+                     js::Scalar::Type* const out_type);
+
 } // namespace mozilla
 
 #endif
diff --git a/dom/canvas/WebGLContextBuffers.cpp b/dom/canvas/WebGLContextBuffers.cpp
index f0d419df69ea..bc25daa2ce73 100644
--- a/dom/canvas/WebGLContextBuffers.cpp
+++ b/dom/canvas/WebGLContextBuffers.cpp
@@ -182,25 +182,25 @@ WebGLContext::BufferData(GLenum target, WebGLsizeiptr size, GLenum usage)
     }
 }
 
+// BufferT may be one of
+// const dom::ArrayBuffer&
+// const dom::SharedArrayBuffer&
+// const dom::ArrayBufferView&
+// const dom::SharedArrayBufferView&
+template<typename BufferT>
 void
-WebGLContext::BufferData(GLenum target,
-                         const dom::Nullable<dom::ArrayBuffer>& maybeData,
-                         GLenum usage)
+WebGLContext::BufferDataT(GLenum target,
+                          const BufferT& data,
+                          GLenum usage)
 {
     if (IsContextLost())
         return;
 
-    if (maybeData.IsNull()) {
-        // see http://www.khronos.org/bugzilla/show_bug.cgi?id=386
-        return ErrorInvalidValue("bufferData: null object passed");
-    }
-
     if (!ValidateBufferTarget(target, "bufferData"))
         return;
 
     const WebGLRefPtr<WebGLBuffer>& bufferSlot = GetBufferSlotByTarget(target);
 
-    const dom::ArrayBuffer& data = maybeData.Value();
     data.ComputeLengthAndData();
 
     // Careful: data.Length() could conceivably be any uint32_t, but GLsizeiptr
@@ -231,20 +231,61 @@ WebGLContext::BufferData(GLenum target,
         return ErrorOutOfMemory("bufferData: out of memory");
 }
 
+void
+WebGLContext::BufferData(GLenum target,
+                         const dom::SharedArrayBuffer& data,
+                         GLenum usage)
+{
+    BufferDataT(target, data, usage);
+}
+
+void
+WebGLContext::BufferData(GLenum target,
+                         const dom::Nullable<dom::ArrayBuffer>& maybeData,
+                         GLenum usage)
+{
+    if (maybeData.IsNull()) {
+        // see http://www.khronos.org/bugzilla/show_bug.cgi?id=386
+        return ErrorInvalidValue("bufferData: null object passed");
+    }
+    BufferDataT(target, maybeData.Value(), usage);
+}
+
 void
 WebGLContext::BufferData(GLenum target, const dom::ArrayBufferView& data,
                          GLenum usage)
+{
+    BufferDataT(target, data, usage);
+}
+
+void
+WebGLContext::BufferData(GLenum target, const dom::SharedArrayBufferView& data,
+                         GLenum usage)
+{
+    BufferDataT(target, data, usage);
+}
+
+// BufferT may be one of
+// const dom::ArrayBuffer&
+// const dom::SharedArrayBuffer&
+// const dom::ArrayBufferView&
+// const dom::SharedArrayBufferView&
+template<typename BufferT>
+void
+WebGLContext::BufferSubDataT(GLenum target,
+                             WebGLsizeiptr byteOffset,
+                             const BufferT& data)
 {
     if (IsContextLost())
         return;
 
-    if (!ValidateBufferTarget(target, "bufferData"))
+    if (!ValidateBufferTarget(target, "bufferSubData"))
         return;
 
     WebGLRefPtr<WebGLBuffer>& bufferSlot = GetBufferSlotByTarget(target);
 
-    if (!ValidateBufferUsageEnum(usage, "bufferData: usage"))
-        return;
+    if (byteOffset < 0)
+        return ErrorInvalidValue("bufferSubData: negative offset");
 
     WebGLBuffer* boundBuffer = bufferSlot.get();
     if (!boundBuffer)
@@ -252,119 +293,60 @@ WebGLContext::BufferData(GLenum target, const dom::ArrayBufferView& data,
 
     data.ComputeLengthAndData();
 
-    // Careful: data.Length() could conceivably be any uint32_t, but GLsizeiptr
-    // is like intptr_t.
-    if (!CheckedInt<GLsizeiptr>(data.Length()).isValid())
-        return ErrorOutOfMemory("bufferData: bad size");
+    CheckedInt<WebGLsizeiptr> checked_neededByteLength =
+        CheckedInt<WebGLsizeiptr>(byteOffset) + data.Length();
 
-    InvalidateBufferFetching();
-    MakeContextCurrent();
-
-    GLenum error = CheckedBufferData(target, data.Length(), data.Data(), usage);
-    if (error) {
-        GenerateWarning("bufferData generated error %s", ErrorName(error));
+    if (!checked_neededByteLength.isValid()) {
+        ErrorInvalidValue("bufferSubData: Integer overflow computing the needed"
+                          " byte length.");
         return;
     }
 
-    boundBuffer->SetByteLength(data.Length());
-    if (!boundBuffer->ElementArrayCacheBufferData(data.Data(), data.Length()))
-        return ErrorOutOfMemory("bufferData: out of memory");
+    if (checked_neededByteLength.value() > boundBuffer->ByteLength()) {
+        ErrorInvalidValue("bufferSubData: Not enough data. Operation requires"
+                          " %d bytes, but buffer only has %d bytes.",
+                          checked_neededByteLength.value(),
+                          boundBuffer->ByteLength());
+        return;
+    }
+
+    boundBuffer->ElementArrayCacheBufferSubData(byteOffset, data.Data(),
+                                                data.Length());
+
+    MakeContextCurrent();
+    gl->fBufferSubData(target, byteOffset, data.Length(), data.Data());
 }
 
 void
 WebGLContext::BufferSubData(GLenum target, WebGLsizeiptr byteOffset,
                             const dom::Nullable<dom::ArrayBuffer>& maybeData)
 {
-    if (IsContextLost())
-        return;
-
     if (maybeData.IsNull()) {
         // see http://www.khronos.org/bugzilla/show_bug.cgi?id=386
         return;
     }
+    BufferSubDataT(target, byteOffset, maybeData.Value());
+}
 
-    if (!ValidateBufferTarget(target, "bufferSubData"))
-        return;
-
-    WebGLRefPtr<WebGLBuffer>& bufferSlot = GetBufferSlotByTarget(target);
-
-    if (byteOffset < 0)
-        return ErrorInvalidValue("bufferSubData: negative offset");
-
-    WebGLBuffer* boundBuffer = bufferSlot.get();
-    if (!boundBuffer)
-        return ErrorInvalidOperation("bufferData: no buffer bound!");
-
-    const dom::ArrayBuffer& data = maybeData.Value();
-    data.ComputeLengthAndData();
-
-    CheckedInt<WebGLsizeiptr> checked_neededByteLength =
-        CheckedInt<WebGLsizeiptr>(byteOffset) + data.Length();
-
-    if (!checked_neededByteLength.isValid()) {
-        ErrorInvalidValue("bufferSubData: Integer overflow computing the needed"
-                          " byte length.");
-        return;
-    }
-
-    if (checked_neededByteLength.value() > boundBuffer->ByteLength()) {
-        ErrorInvalidValue("bufferSubData: Not enough data. Operation requires"
-                          " %d bytes, but buffer only has %d bytes.",
-                          checked_neededByteLength.value(),
-                          boundBuffer->ByteLength());
-        return;
-    }
-
-    boundBuffer->ElementArrayCacheBufferSubData(byteOffset, data.Data(),
-                                                data.Length());
-
-    MakeContextCurrent();
-    gl->fBufferSubData(target, byteOffset, data.Length(), data.Data());
+void
+WebGLContext::BufferSubData(GLenum target, WebGLsizeiptr byteOffset,
+                            const dom::SharedArrayBuffer& data)
+{
+    BufferSubDataT(target, byteOffset, data);
 }
 
 void
 WebGLContext::BufferSubData(GLenum target, WebGLsizeiptr byteOffset,
                             const dom::ArrayBufferView& data)
 {
-    if (IsContextLost())
-        return;
+    BufferSubDataT(target, byteOffset, data);
+}
 
-    if (!ValidateBufferTarget(target, "bufferSubData"))
-        return;
-
-    WebGLRefPtr<WebGLBuffer>& bufferSlot = GetBufferSlotByTarget(target);
-
-    if (byteOffset < 0)
-        return ErrorInvalidValue("bufferSubData: negative offset");
-
-    WebGLBuffer* boundBuffer = bufferSlot.get();
-    if (!boundBuffer)
-        return ErrorInvalidOperation("bufferSubData: no buffer bound!");
-
-    data.ComputeLengthAndData();
-
-    CheckedInt<WebGLsizeiptr> checked_neededByteLength =
-        CheckedInt<WebGLsizeiptr>(byteOffset) + data.Length();
-
-    if (!checked_neededByteLength.isValid()) {
-        ErrorInvalidValue("bufferSubData: Integer overflow computing the needed"
-                          " byte length.");
-        return;
-    }
-
-    if (checked_neededByteLength.value() > boundBuffer->ByteLength()) {
-        ErrorInvalidValue("bufferSubData: Not enough data. Operation requires"
-                          " %d bytes, but buffer only has %d bytes.",
-                          checked_neededByteLength.value(),
-                          boundBuffer->ByteLength());
-        return;
-    }
-
-    boundBuffer->ElementArrayCacheBufferSubData(byteOffset, data.Data(),
-                                                data.Length());
-
-    MakeContextCurrent();
-    gl->fBufferSubData(target, byteOffset, data.Length(), data.Data());
+void
+WebGLContext::BufferSubData(GLenum target, WebGLsizeiptr byteOffset,
+                            const dom::SharedArrayBufferView& data)
+{
+    BufferSubDataT(target, byteOffset, data);
 }
 
 already_AddRefed<WebGLBuffer>
diff --git a/dom/canvas/WebGLContextGL.cpp b/dom/canvas/WebGLContextGL.cpp
index 53bd8d8e8ea5..4b70290cff7a 100644
--- a/dom/canvas/WebGLContextGL.cpp
+++ b/dom/canvas/WebGLContextGL.cpp
@@ -1381,10 +1381,32 @@ IsFormatAndTypeUnpackable(GLenum format, GLenum type)
     }
 }
 
+// This function is temporary, and will be removed once https://bugzilla.mozilla.org/show_bug.cgi?id=1176214 lands, which will
+// collapse the SharedArrayBufferView and ArrayBufferView into one.
+void
+ComputeLengthAndData(const dom::ArrayBufferViewOrSharedArrayBufferView& view,
+                     void** const out_data, size_t* const out_length,
+                     js::Scalar::Type* const out_type)
+{
+    if (view.IsArrayBufferView()) {
+        const dom::ArrayBufferView& pixbuf = view.GetAsArrayBufferView();
+        pixbuf.ComputeLengthAndData();
+        *out_length = pixbuf.Length();
+        *out_data = pixbuf.Data();
+        *out_type = JS_GetArrayBufferViewType(pixbuf.Obj());
+    } else {
+        const dom::SharedArrayBufferView& pixbuf = view.GetAsSharedArrayBufferView();
+        pixbuf.ComputeLengthAndData();
+        *out_length = pixbuf.Length();
+        *out_data = pixbuf.Data();
+        *out_type = JS_GetSharedArrayBufferViewType(pixbuf.Obj());
+    }
+}
+
 void
 WebGLContext::ReadPixels(GLint x, GLint y, GLsizei width,
                          GLsizei height, GLenum format,
-                         GLenum type, const dom::Nullable<dom::ArrayBufferView>& pixels,
+                         GLenum type, const dom::Nullable<dom::ArrayBufferViewOrSharedArrayBufferView>& pixels,
                          ErrorResult& rv)
 {
     if (IsContextLost())
@@ -1460,8 +1482,13 @@ WebGLContext::ReadPixels(GLint x, GLint y, GLsizei width,
         MOZ_CRASH("bad `type`");
     }
 
-    const dom::ArrayBufferView& pixbuf = pixels.Value();
-    int dataType = pixbuf.Type();
+    const dom::ArrayBufferViewOrSharedArrayBufferView &view = pixels.Value();
+    // Compute length and data.  Don't reenter after this point, lest the
+    // precomputed go out of sync with the instant length/data.
+    size_t dataByteLen;
+    void* data;
+    js::Scalar::Type dataType;
+    ComputeLengthAndData(view, &data, &dataByteLen, &dataType);
 
     // Check the pixels param type
     if (dataType != requiredDataType)
@@ -1479,15 +1506,9 @@ WebGLContext::ReadPixels(GLint x, GLint y, GLsizei width,
     if (!checked_neededByteLength.isValid())
         return ErrorInvalidOperation("readPixels: integer overflow computing the needed buffer size");
 
-    // Compute length and data.  Don't reenter after this point, lest the
-    // precomputed go out of sync with the instant length/data.
-    pixbuf.ComputeLengthAndData();
-
-    uint32_t dataByteLen = pixbuf.Length();
     if (checked_neededByteLength.value() > dataByteLen)
         return ErrorInvalidOperation("readPixels: buffer too small");
 
-    void* data = pixbuf.Data();
     if (!data) {
         ErrorOutOfMemory("readPixels: buffer storage is null. Did we run out of memory?");
         return rv.Throw(NS_ERROR_OUT_OF_MEMORY);
diff --git a/dom/canvas/WebGLContextTextures.cpp b/dom/canvas/WebGLContextTextures.cpp
index b7f8b81b2524..af8eba5afaca 100644
--- a/dom/canvas/WebGLContextTextures.cpp
+++ b/dom/canvas/WebGLContextTextures.cpp
@@ -298,7 +298,7 @@ void
 WebGLContext::TexImage2D(GLenum rawTexImageTarget, GLint level, GLenum internalFormat,
                          GLsizei width, GLsizei height, GLint border, GLenum unpackFormat,
                          GLenum unpackType,
-                         const dom::Nullable<dom::ArrayBufferView>& maybeView,
+                         const dom::Nullable<dom::ArrayBufferViewOrSharedArrayBufferView>& maybeView,
                          ErrorResult& out_rv)
 {
     TexImageTarget texImageTarget;
@@ -356,7 +356,7 @@ void
 WebGLContext::TexSubImage2D(GLenum rawTexImageTarget, GLint level, GLint xOffset,
                             GLint yOffset, GLsizei width, GLsizei height,
                             GLenum unpackFormat, GLenum unpackType,
-                            const dom::Nullable<dom::ArrayBufferView>& maybeView,
+                            const dom::Nullable<dom::ArrayBufferViewOrSharedArrayBufferView>& maybeView,
                             ErrorResult& out_rv)
 {
     TexImageTarget texImageTarget;
@@ -434,7 +434,7 @@ WebGLContext::CopyTexSubImage2D(GLenum rawTexImageTarget, GLint level, GLint xOf
 void
 WebGLContext::CompressedTexImage2D(GLenum rawTexImageTarget, GLint level,
                                    GLenum internalFormat, GLsizei width, GLsizei height,
-                                   GLint border, const dom::ArrayBufferView& view)
+                                   GLint border, const dom::ArrayBufferViewOrSharedArrayBufferView& view)
 {
     TexImageTarget texImageTarget;
     WebGLTexture* tex;
@@ -452,7 +452,7 @@ void
 WebGLContext::CompressedTexSubImage2D(GLenum rawTexImageTarget, GLint level,
                                       GLint xOffset, GLint yOffset, GLsizei width,
                                       GLsizei height, GLenum unpackFormat,
-                                      const dom::ArrayBufferView& view)
+                                      const dom::ArrayBufferViewOrSharedArrayBufferView& view)
 {
     TexImageTarget texImageTarget;
     WebGLTexture* tex;
diff --git a/dom/canvas/WebGLTexture.h b/dom/canvas/WebGLTexture.h
index d35effda70b6..66a5a238ca93 100644
--- a/dom/canvas/WebGLTexture.h
+++ b/dom/canvas/WebGLTexture.h
@@ -24,6 +24,7 @@ class ErrorResult;
 namespace dom {
 class Element;
 class ImageData;
+class ArrayBufferViewOrSharedArrayBufferView;
 } // namespace dom
 
 // Zero is not an integer power of two.
@@ -108,24 +109,24 @@ public:
 
     void CompressedTexImage2D(TexImageTarget texImageTarget, GLint level,
                               GLenum internalFormat, GLsizei width, GLsizei height,
-                              GLint border, const dom::ArrayBufferView& view);
+                              GLint border, const dom::ArrayBufferViewOrSharedArrayBufferView& view);
 
     void CompressedTexImage3D(TexImageTarget texImageTarget, GLint level,
                               GLenum internalFormat, GLsizei width, GLsizei height,
                               GLsizei depth, GLint border, GLsizei imageSize,
-                              const dom::ArrayBufferView& view);
+                              const dom::ArrayBufferViewOrSharedArrayBufferView& view);
 
 
     void CompressedTexSubImage2D(TexImageTarget texImageTarget, GLint level,
                                  GLint xOffset, GLint yOffset, GLsizei width,
                                  GLsizei height, GLenum unpackFormat,
-                                 const dom::ArrayBufferView& view);
+                                 const dom::ArrayBufferViewOrSharedArrayBufferView& view);
 
     void CompressedTexSubImage3D(TexImageTarget texImageTarget, GLint level,
                                  GLint xOffset, GLint yOffset, GLint zOffset,
                                  GLsizei width, GLsizei height, GLsizei depth,
                                  GLenum unpackFormat, GLsizei imageSize,
-                                 const dom::ArrayBufferView& view);
+                                 const dom::ArrayBufferViewOrSharedArrayBufferView& view);
 
 
     void CopyTexImage2D(TexImageTarget texImageTarget, GLint level, GLenum internalFormat,
@@ -144,7 +145,7 @@ public:
     void TexImage2D(TexImageTarget texImageTarget, GLint level, GLenum internalFormat,
                     GLsizei width, GLsizei height, GLint border, GLenum unpackFormat,
                     GLenum unpackType,
-                    const dom::Nullable<dom::ArrayBufferView>& maybeView,
+                    const dom::Nullable<dom::ArrayBufferViewOrSharedArrayBufferView>& maybeView,
                     ErrorResult* const out_rv);
     void TexImage2D(TexImageTarget texImageTarget, GLint level, GLenum internalFormat,
                     GLenum unpackFormat, GLenum unpackType, dom::ImageData* imageData,
@@ -156,7 +157,7 @@ public:
     void TexImage3D(TexImageTarget target, GLint level, GLenum internalFormat,
                     GLsizei width, GLsizei height, GLsizei depth, GLint border,
                     GLenum unpackFormat, GLenum unpackType,
-                    const dom::Nullable<dom::ArrayBufferView>& maybeView,
+                    const dom::Nullable<dom::ArrayBufferViewOrSharedArrayBufferView>& maybeView,
                     ErrorResult* const out_rv);
 
 
@@ -169,7 +170,7 @@ public:
     void TexSubImage2D(TexImageTarget texImageTarget, GLint level, GLint xOffset,
                        GLint yOffset, GLsizei width, GLsizei height, GLenum unpackFormat,
                        GLenum unpackType,
-                       const dom::Nullable<dom::ArrayBufferView>& maybeView,
+                       const dom::Nullable<dom::ArrayBufferViewOrSharedArrayBufferView>& maybeView,
                        ErrorResult* const out_rv);
     void TexSubImage2D(TexImageTarget texImageTarget, GLint level, GLint xOffset,
                        GLint yOffset, GLenum unpackFormat, GLenum unpackType,
@@ -181,7 +182,7 @@ public:
     void TexSubImage3D(TexImageTarget texImageTarget, GLint level, GLint xOffset,
                        GLint yOffset, GLint zOffset, GLsizei width, GLsizei height,
                        GLsizei depth, GLenum unpackFormat, GLenum unpackType,
-                       const dom::Nullable<dom::ArrayBufferView>& maybeView,
+                       const dom::Nullable<dom::ArrayBufferViewOrSharedArrayBufferView>& maybeView,
                        ErrorResult* const out_rv);
     void TexSubImage3D(TexImageTarget texImageTarget, GLint level, GLint xOffset,
                        GLint yOffset, GLint zOffset, GLenum unpackFormat,
diff --git a/dom/canvas/WebGLTextureUpload.cpp b/dom/canvas/WebGLTextureUpload.cpp
index ffb2258a395c..6a6b3f047c80 100644
--- a/dom/canvas/WebGLTextureUpload.cpp
+++ b/dom/canvas/WebGLTextureUpload.cpp
@@ -58,7 +58,7 @@ WebGLTexture::CompressedTexImage2D(TexImageTarget texImageTarget,
                                    GLint level,
                                    GLenum internalFormat,
                                    GLsizei width, GLsizei height, GLint border,
-                                   const dom::ArrayBufferView& view)
+                                   const dom::ArrayBufferViewOrSharedArrayBufferView& view)
 {
     const WebGLTexImageFunc func = WebGLTexImageFunc::CompTexImage;
     const WebGLTexDimensions dims = WebGLTexDimensions::Tex2D;
@@ -76,9 +76,11 @@ WebGLTexture::CompressedTexImage2D(TexImageTarget texImageTarget,
         return;
     }
 
-    view.ComputeLengthAndData();
+    size_t byteLength;
+    void* data;
+    js::Scalar::Type dataType;
+    ComputeLengthAndData(view, &data, &byteLength, &dataType);
 
-    uint32_t byteLength = view.Length();
     if (!mContext->ValidateCompTexImageDataSize(level, internalFormat, width, height, byteLength, func, dims)) {
         return;
     }
@@ -96,7 +98,7 @@ WebGLTexture::CompressedTexImage2D(TexImageTarget texImageTarget,
 
     mContext->MakeContextCurrent();
     gl::GLContext* gl = mContext->gl;
-    gl->fCompressedTexImage2D(texImageTarget.get(), level, internalFormat, width, height, border, byteLength, view.Data());
+    gl->fCompressedTexImage2D(texImageTarget.get(), level, internalFormat, width, height, border, byteLength, data);
 
     SetImageInfo(texImageTarget, level, width, height, 1, internalFormat,
                       WebGLImageDataStatus::InitializedImageData);
@@ -106,7 +108,7 @@ void
 WebGLTexture::CompressedTexSubImage2D(TexImageTarget texImageTarget, GLint level, GLint xOffset,
                                       GLint yOffset, GLsizei width, GLsizei height,
                                       GLenum internalFormat,
-                                      const dom::ArrayBufferView& view)
+                                      const dom::ArrayBufferViewOrSharedArrayBufferView& view)
 {
     const WebGLTexImageFunc func = WebGLTexImageFunc::CompTexSubImage;
     const WebGLTexDimensions dims = WebGLTexDimensions::Tex2D;
@@ -131,9 +133,11 @@ WebGLTexture::CompressedTexSubImage2D(TexImageTarget texImageTarget, GLint level
         return mContext->ErrorInvalidOperation("compressedTexImage2D: internalFormat does not match the existing image");
     }
 
-    view.ComputeLengthAndData();
+    size_t byteLength;
+    void* data;
+    js::Scalar::Type dataType;
+    ComputeLengthAndData(view, &data, &byteLength, &dataType);
 
-    uint32_t byteLength = view.Length();
     if (!mContext->ValidateCompTexImageDataSize(level, internalFormat, width, height, byteLength, func, dims))
         return;
 
@@ -161,7 +165,7 @@ WebGLTexture::CompressedTexSubImage2D(TexImageTarget texImageTarget, GLint level
 
     mContext->MakeContextCurrent();
     gl::GLContext* gl = mContext->gl;
-    gl->fCompressedTexSubImage2D(texImageTarget.get(), level, xOffset, yOffset, width, height, internalFormat, byteLength, view.Data());
+    gl->fCompressedTexSubImage2D(texImageTarget.get(), level, xOffset, yOffset, width, height, internalFormat, byteLength, data);
 }
 
 void
@@ -614,23 +618,19 @@ void
 WebGLTexture::TexImage2D(TexImageTarget texImageTarget, GLint level,
                          GLenum internalFormat, GLsizei width,
                          GLsizei height, GLint border, GLenum unpackFormat,
-                         GLenum unpackType, const dom::Nullable<dom::ArrayBufferView>& maybeView,
+                         GLenum unpackType, const dom::Nullable<dom::ArrayBufferViewOrSharedArrayBufferView>& maybeView,
                          ErrorResult* const out_rv)
 {
     void* data;
-    uint32_t length;
+    size_t length;
     js::Scalar::Type jsArrayType;
     if (maybeView.IsNull()) {
         data = nullptr;
         length = 0;
         jsArrayType = js::Scalar::MaxTypedArrayViewType;
     } else {
-        const dom::ArrayBufferView& view = maybeView.Value();
-        view.ComputeLengthAndData();
-
-        data = view.Data();
-        length = view.Length();
-        jsArrayType = view.Type();
+        const auto& view = maybeView.Value();
+        ComputeLengthAndData(view, &data, &length, &jsArrayType);
     }
 
     const char funcName[] = "texImage2D";
@@ -850,14 +850,17 @@ WebGLTexture::TexSubImage2D(TexImageTarget texImageTarget, GLint level,
                             GLint xOffset, GLint yOffset,
                             GLsizei width, GLsizei height,
                             GLenum unpackFormat, GLenum unpackType,
-                            const dom::Nullable<dom::ArrayBufferView>& maybeView,
+                            const dom::Nullable<dom::ArrayBufferViewOrSharedArrayBufferView>& maybeView,
                             ErrorResult* const out_rv)
 {
     if (maybeView.IsNull())
         return mContext->ErrorInvalidValue("texSubImage2D: pixels must not be null!");
 
-    const dom::ArrayBufferView& view = maybeView.Value();
-    view.ComputeLengthAndData();
+    const auto& view = maybeView.Value();
+    size_t length;
+    void* data;
+    js::Scalar::Type jsArrayType;
+    ComputeLengthAndData(view, &data, &length, &jsArrayType);
 
     const char funcName[] = "texSubImage2D";
     if (!DoesTargetMatchDimensions(mContext, texImageTarget, 2, funcName))
@@ -865,7 +868,7 @@ WebGLTexture::TexSubImage2D(TexImageTarget texImageTarget, GLint level,
 
     return TexSubImage2D_base(texImageTarget, level, xOffset, yOffset,
                               width, height, 0, unpackFormat, unpackType,
-                              view.Data(), view.Length(), view.Type(),
+                              data, length, jsArrayType,
                               WebGLTexelFormat::Auto, false);
 }
 
@@ -1211,7 +1214,7 @@ void
 WebGLTexture::TexImage3D(TexImageTarget texImageTarget, GLint level, GLenum internalFormat,
                           GLsizei width, GLsizei height, GLsizei depth,
                           GLint border, GLenum unpackFormat, GLenum unpackType,
-                          const dom::Nullable<dom::ArrayBufferView>& maybeView,
+                          const dom::Nullable<dom::ArrayBufferViewOrSharedArrayBufferView>& maybeView,
                           ErrorResult* const out_rv)
 {
     void* data;
@@ -1222,12 +1225,8 @@ WebGLTexture::TexImage3D(TexImageTarget texImageTarget, GLint level, GLenum inte
         dataLength = 0;
         jsArrayType = js::Scalar::MaxTypedArrayViewType;
     } else {
-        const dom::ArrayBufferView& view = maybeView.Value();
-        view.ComputeLengthAndData();
-
-        data = view.Data();
-        dataLength = view.Length();
-        jsArrayType = view.Type();
+        const auto& view = maybeView.Value();
+        ComputeLengthAndData(view, &data, &dataLength, &jsArrayType);
     }
 
     const char funcName[] = "texImage3D";
@@ -1318,14 +1317,17 @@ WebGLTexture::TexSubImage3D(TexImageTarget texImageTarget, GLint level,
                              GLint xOffset, GLint yOffset, GLint zOffset,
                              GLsizei width, GLsizei height, GLsizei depth,
                              GLenum unpackFormat, GLenum unpackType,
-                             const dom::Nullable<dom::ArrayBufferView>& maybeView,
+                             const dom::Nullable<dom::ArrayBufferViewOrSharedArrayBufferView>& maybeView,
                              ErrorResult* const out_rv)
 {
     if (maybeView.IsNull())
         return mContext->ErrorInvalidValue("texSubImage3D: pixels must not be null!");
 
-    const dom::ArrayBufferView& view = maybeView.Value();
-    view.ComputeLengthAndData();
+    const auto& view = maybeView.Value();
+    void* data;
+    size_t dataLength;
+    js::Scalar::Type jsArrayType;
+    ComputeLengthAndData(view, &data, &dataLength, &jsArrayType);
 
     const char funcName[] = "texSubImage3D";
     if (!DoesTargetMatchDimensions(mContext, texImageTarget, 3, funcName))
@@ -1358,10 +1360,6 @@ WebGLTexture::TexSubImage3D(TexImageTarget texImageTarget, GLint level,
         return mContext->ErrorInvalidOperation("texSubImage3D: type differs from that of the existing image");
     }
 
-    js::Scalar::Type jsArrayType = view.Type();
-    void* data = view.Data();
-    size_t dataLength = view.Length();
-
     if (!mContext->ValidateTexInputData(unpackType, jsArrayType, func, dims))
         return;
 
diff --git a/dom/canvas/test/webgl-mochitest.ini b/dom/canvas/test/webgl-mochitest.ini
index 2f70700a924c..1b20d3cbf1af 100644
--- a/dom/canvas/test/webgl-mochitest.ini
+++ b/dom/canvas/test/webgl-mochitest.ini
@@ -23,6 +23,7 @@ skip-if = android_version == '10' || android_version == '18' #Android 2.3 and 4.
 [webgl-mochitest/test_noprog_draw.html]
 [webgl-mochitest/test_privileged_exts.html]
 [webgl-mochitest/test_renderer_strings.html]
+[webgl-mochitest/test_sab_with_webgl.html]
 [webgl-mochitest/test_texsubimage_float.html]
 [webgl-mochitest/test_uninit_data.html]
 [webgl-mochitest/test_webgl_available.html]
diff --git a/dom/canvas/test/webgl-mochitest/test_sab_with_webgl.html b/dom/canvas/test/webgl-mochitest/test_sab_with_webgl.html
new file mode 100644
index 000000000000..e92a6568259d
--- /dev/null
+++ b/dom/canvas/test/webgl-mochitest/test_sab_with_webgl.html
@@ -0,0 +1,200 @@
+<html>
+  <head>
+    <meta charset='UTF-8'>
+    <script src='/tests/SimpleTest/SimpleTest.js'></script>
+    <link rel='stylesheet' href='/tests/SimpleTest/test.css'>
+  </head>
+  <body>
+<canvas id='c' width='200' height='200'></canvas>
+<canvas id='c2' width='200' height='200'></canvas>
+
+<script>
+
+var gl;
+
+function RGBAToString(arr) {
+  return '[' + arr[0].toPrecision(4) + ', ' +
+               arr[1].toPrecision(4) + ', ' +
+               arr[2].toPrecision(4) + ', ' +
+               arr[3].toPrecision(4) + ']';
+}
+
+function TestScreenColor(gl, r, g, b, a) {
+  var arr = new SharedArrayBuffer(4);
+  var view = new SharedUint8Array(arr);
+  gl.readPixels(0, 0, 1, 1, gl.RGBA, gl.UNSIGNED_BYTE, view);
+
+  var err = gl.getError();
+  ok(err == 0, 'Should be no errors.');
+  if (err)
+    return;
+
+  var floatArr;
+  floatArr = new Float32Array(4);
+  floatArr[0] = view[0] / 255.0;
+  floatArr[1] = view[1] / 255.0;
+  floatArr[2] = view[2] / 255.0;
+  floatArr[3] = view[3] / 255.0;
+
+  var testText = RGBAToString(floatArr);
+  var refText = RGBAToString([r, g, b, a]);
+
+  var eps = 1.0 / 255.0;
+  var isSame = (Math.abs(floatArr[0] - r) < eps &&
+                Math.abs(floatArr[1] - g) < eps &&
+                Math.abs(floatArr[2] - b) < eps &&
+                Math.abs(floatArr[3] - a) < eps);
+
+  ok(isSame, 'Should be ' + refText + ', was ' + testText + ',');
+}
+
+// Give ourselves a scope to return early from:
+(function() {
+  var canvas = document.getElementById('c');
+  var attribs = {
+    antialias: false,
+    depth: false,
+  };
+  gl = canvas.getContext('experimental-webgl', attribs);
+  if (!gl) {
+    todo(false, 'WebGL is unavailable.');
+    return;
+  }
+  if (typeof SharedArrayBuffer === 'undefined') {
+    todo(false, 'SharedArrayBuffer is unavailable.');
+    return;
+  }
+  if (SharedFloat32Array === 'undefined') {
+    todo(false, 'SharedFloat32Array is unavailable.');
+    return;
+  }
+
+  var vs = gl.createShader(gl.VERTEX_SHADER);
+  gl.shaderSource(vs, "attribute vec2 aVertCoord; void main(void) { gl_Position = vec4(aVertCoord, 0.0, 1.0); }");
+  gl.compileShader(vs);
+  var fs = gl.createShader(gl.FRAGMENT_SHADER);
+  gl.shaderSource(fs, "precision mediump float; uniform vec4 uFragColor; void main(void) { gl_FragColor = uFragColor; }");
+  gl.compileShader(fs);
+  var prog = gl.createProgram();
+  gl.attachShader(prog, vs);
+  gl.attachShader(prog, fs);
+  gl.linkProgram(prog);
+
+  var success = gl.getProgramParameter(prog, gl.LINK_STATUS);
+  if (!success) {
+    console.log('Error linking program for \'' + vsId + '\' and \'' + fsId + '\'.');
+    console.log('\nLink log: ' + gl.getProgramInfoLog(prog));
+    console.log('\nVert shader log: ' + gl.getShaderInfoLog(vs));
+    console.log('\nFrag shader log: ' + gl.getShaderInfoLog(fs));
+  }
+  ok(prog, 'Program should link.');
+  if (!prog) {
+    return;
+  }
+
+  prog.aVertCoord = gl.getAttribLocation(prog, 'aVertCoord');
+  prog.uFragColor = gl.getUniformLocation(prog, 'uFragColor');
+
+  gl.useProgram(prog);
+
+  // Test gl.bufferData(), gl.bufferSubData() and gl.readPixels() APIs with SAB as input.
+  var arr = new SharedArrayBuffer(8*4);
+  var view = new SharedFloat32Array(arr);
+  view.set(new Float32Array([-1, -1, 1, -1, -1,  1, 1,  1]));
+  var vb = gl.createBuffer();
+  gl.bindBuffer(gl.ARRAY_BUFFER, vb);
+  gl.bufferData(gl.ARRAY_BUFFER, arr, gl.STATIC_DRAW);
+  ok(gl.getError() == 0, 'bufferData with SAB as input parameter works ok.');
+  gl.bufferSubData(gl.ARRAY_BUFFER, 0, arr);
+  ok(gl.getError() == 0, 'bufferSubData with SAB as input parameter works ok.');
+  gl.enableVertexAttribArray(0);
+  gl.vertexAttribPointer(0, 2, gl.FLOAT, false, 0, 0);
+  gl.clearColor(0, 0, 0, 1.0);
+  gl.clear(gl.COLOR_BUFFER_BIT);
+  gl.uniform4f(prog.uFragColor, 0.2, 0.4, 0.6, 1.0);
+  gl.drawArrays(gl.TRIANGLE_STRIP, 0, 4);
+  var arr = new Uint8Array(4);
+  TestScreenColor(gl, 0.2, 0.4, 0.6, 1.0);
+
+  // Test gl.texImage2D() and gl.texSubImage2D() APIs with SAB as input.
+  var tex = gl.createTexture();
+  gl.bindTexture(gl.TEXTURE_2D, tex);
+  var width = 4;
+  var height = 4;
+  var numChannels = 4;
+  var sab = new SharedArrayBuffer(width * height * numChannels);
+  var data = new SharedUint8Array(sab);
+  for (var i = 0; i < data.length; ++i) {
+    data[i] = i;
+  }
+  gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, width, height, 0, gl.RGBA, gl.UNSIGNED_BYTE, data);
+  ok(gl.getError() == 0, 'texImage2D() with SAB as input parameter works ok.');
+  gl.texSubImage2D(gl.TEXTURE_2D, 0, 0, 0, width, height, gl.RGBA, gl.UNSIGNED_BYTE, data);
+  ok(gl.getError() == 0, 'texSubImage2D() with SAB as input parameter works ok.');
+
+  ok(gl.getError() == 0, 'Should be no errors after test.');
+})();
+
+// Test WebGL 2
+(function() {
+  var canvas = document.getElementById('c2');
+  var attribs = {
+    antialias: false,
+    depth: false,
+  };
+  gl = canvas.getContext('webgl2', attribs);
+  if (!gl) {
+    todo(false, 'WebGL 2 is unavailable.');
+    return;
+  }
+  if (typeof SharedArrayBuffer === 'undefined') {
+    todo(false, 'SharedArrayBuffer is unavailable.');
+    return;
+  }
+  if (SharedFloat32Array === 'undefined') {
+    todo(false, 'SharedFloat32Array is unavailable.');
+    return;
+  }
+
+  var arr = new SharedArrayBuffer(8*4);
+  var view = new SharedFloat32Array(arr);
+  view.set(new Float32Array([-1, -1, 1, -1, -1,  1, 1,  1]));
+  var vb = gl.createBuffer();
+  gl.bindBuffer(gl.ARRAY_BUFFER, vb);
+  gl.bufferData(gl.ARRAY_BUFFER, arr, gl.STATIC_DRAW);
+
+  var arr2 = new SharedArrayBuffer(8*4);
+  gl.getBufferSubData(gl.ARRAY_BUFFER, 0, arr2);
+  var view2 = new SharedFloat32Array(arr2);
+  var equal = true;
+  for(var i = 0; i < 8; ++i) {
+    if (view[i] != view2[i]) equal = false;
+  }
+  ok(equal, 'getBufferSubData with SAB as input parameter works ok.');
+
+  // Test gl.texImage3D() and gl.texSubImage3D() APIs with SAB as input.
+  var tex = gl.createTexture();
+  gl.bindTexture(gl.TEXTURE_3D, tex);
+  var width = 4;
+  var height = 4;
+  var depth = 4;
+  var numChannels = 4;
+  var sab = new SharedArrayBuffer(width * height * depth* numChannels);
+  var data = new SharedUint8Array(sab);
+  for (var i = 0; i < data.length; ++i) {
+    data[i] = i;
+  }
+  gl.texImage3D(gl.TEXTURE_3D, 0, gl.RGBA, width, height, depth, 0, gl.RGBA, gl.UNSIGNED_BYTE, data);
+  ok(gl.getError() == 0, 'texImage3D() with SAB as input parameter works ok.');
+  gl.texSubImage3D(gl.TEXTURE_3D, 0, 0, 0, 0, width, height, depth, gl.RGBA, gl.UNSIGNED_BYTE, data);
+  ok(gl.getError() == 0, 'texSubImage3D() with SAB as input parameter works ok.');
+
+  ok(gl.getError() == 0, 'Should be no errors after test.');
+})();
+
+ok(true, 'TEST COMPLETE');
+
+</script>
+
+  </body>
+</html>
diff --git a/dom/webidl/WebGL2RenderingContext.webidl b/dom/webidl/WebGL2RenderingContext.webidl
index 3be96123809f..f82d2022ae91 100644
--- a/dom/webidl/WebGL2RenderingContext.webidl
+++ b/dom/webidl/WebGL2RenderingContext.webidl
@@ -319,6 +319,7 @@ interface WebGL2RenderingContext : WebGLRenderingContext
     void copyBufferSubData(GLenum readTarget, GLenum writeTarget, GLintptr readOffset,
                            GLintptr writeOffset, GLsizeiptr size);
     void getBufferSubData(GLenum target, GLintptr offset, ArrayBuffer? returnedData);
+    void getBufferSubData(GLenum target, GLintptr offset, SharedArrayBuffer returnedData);
 
     /* Framebuffer objects */
     void blitFramebuffer(GLint srcX0, GLint srcY0, GLint srcX1, GLint srcY1, GLint dstX0, GLint dstY0,
@@ -347,10 +348,10 @@ interface WebGL2RenderingContext : WebGLRenderingContext
     void texImage3D(GLenum target, GLint level, GLenum internalformat,
                     GLsizei width, GLsizei height, GLsizei depth,
                     GLint border, GLenum format,
-                    GLenum type, ArrayBufferView? pixels);
+                    GLenum type, (ArrayBufferView or SharedArrayBufferView)? pixels);
     [Throws] void texSubImage3D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint zoffset,
                                 GLsizei width, GLsizei height, GLsizei depth, GLenum format, GLenum type,
-                                ArrayBufferView? pixels);
+                                (ArrayBufferView or SharedArrayBufferView)? pixels);
     [Throws] void texSubImage3D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint zoffset,
                                 GLenum format, GLenum type, ImageData? data);
     [Throws] void texSubImage3D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint zoffset,
@@ -363,10 +364,10 @@ interface WebGL2RenderingContext : WebGLRenderingContext
                            GLint x, GLint y, GLsizei width, GLsizei height);
     void compressedTexImage3D(GLenum target, GLint level, GLenum internalformat,
                               GLsizei width, GLsizei height, GLsizei depth,
-                              GLint border, GLsizei imageSize, ArrayBufferView data);
+                              GLint border, GLsizei imageSize, (ArrayBufferView or SharedArrayBufferView) data);
     void compressedTexSubImage3D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint zoffset,
                                  GLsizei width, GLsizei height, GLsizei depth,
-                                 GLenum format, GLsizei imageSize, ArrayBufferView data);
+                                 GLenum format, GLsizei imageSize, (ArrayBufferView or SharedArrayBufferView) data);
 
     /* Programs and shaders */
     [WebGLHandlesContextLoss] GLint getFragDataLocation(WebGLProgram? program, DOMString name);
diff --git a/dom/webidl/WebGLRenderingContext.webidl b/dom/webidl/WebGLRenderingContext.webidl
index 3ab31d10a372..d5859fd6c840 100644
--- a/dom/webidl/WebGLRenderingContext.webidl
+++ b/dom/webidl/WebGLRenderingContext.webidl
@@ -552,9 +552,13 @@ interface WebGLRenderingContext {
 
     void bufferData(GLenum target, GLsizeiptr size, GLenum usage);
     void bufferData(GLenum target, ArrayBufferView data, GLenum usage);
+    void bufferData(GLenum target, SharedArrayBufferView data, GLenum usage);
     void bufferData(GLenum target, ArrayBuffer? data, GLenum usage);
+    void bufferData(GLenum target, SharedArrayBuffer data, GLenum usage);
     void bufferSubData(GLenum target, GLintptr offset, ArrayBufferView data);
+    void bufferSubData(GLenum target, GLintptr offset, SharedArrayBufferView data);
     void bufferSubData(GLenum target, GLintptr offset, ArrayBuffer? data);
+    void bufferSubData(GLenum target, GLintptr offset, SharedArrayBuffer data);
 
     [WebGLHandlesContextLoss] GLenum checkFramebufferStatus(GLenum target);
     void clear(GLbitfield mask);
@@ -566,11 +570,11 @@ interface WebGLRenderingContext {
 
     void compressedTexImage2D(GLenum target, GLint level, GLenum internalformat,
                               GLsizei width, GLsizei height, GLint border,
-                              ArrayBufferView data);
+                              (ArrayBufferView or SharedArrayBufferView) data);
     void compressedTexSubImage2D(GLenum target, GLint level,
                                  GLint xoffset, GLint yoffset,
                                  GLsizei width, GLsizei height, GLenum format,
-                                 ArrayBufferView data);
+                                 (ArrayBufferView or SharedArrayBufferView) data);
 
     void copyTexImage2D(GLenum target, GLint level, GLenum internalformat,
                         GLint x, GLint y, GLsizei width, GLsizei height,
@@ -673,7 +677,7 @@ interface WebGLRenderingContext {
 
     [Throws]
     void readPixels(GLint x, GLint y, GLsizei width, GLsizei height,
-                    GLenum format, GLenum type, ArrayBufferView? pixels);
+                    GLenum format, GLenum type, (ArrayBufferView or SharedArrayBufferView)? pixels);
 
     void renderbufferStorage(GLenum target, GLenum internalformat,
                              GLsizei width, GLsizei height);
@@ -693,7 +697,7 @@ interface WebGLRenderingContext {
     [Throws]
     void texImage2D(GLenum target, GLint level, GLenum internalformat,
                     GLsizei width, GLsizei height, GLint border, GLenum format,
-                    GLenum type, ArrayBufferView? pixels);
+                    GLenum type, (ArrayBufferView or SharedArrayBufferView)? pixels);
     [Throws]
     void texImage2D(GLenum target, GLint level, GLenum internalformat,
                     GLenum format, GLenum type, ImageData? pixels);
@@ -713,7 +717,7 @@ interface WebGLRenderingContext {
     [Throws]
     void texSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset,
                        GLsizei width, GLsizei height,
-                       GLenum format, GLenum type, ArrayBufferView? pixels);
+                       GLenum format, GLenum type, (ArrayBufferView or SharedArrayBufferView)? pixels);
     [Throws]
     void texSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset,
                        GLenum format, GLenum type, ImageData? pixels);

From 00c1467dcaf562df55225cd63d63a83822f63b0d Mon Sep 17 00:00:00 2001
From: Joel Maher <jmaher@mozilla.com>
Date: Wed, 14 Oct 2015 11:18:40 +0530
Subject: [PATCH 07/63] Bug 1205005 - Talos-e10s(tp) occasionally fails with
 TALOSDATA was seen 0 times, expected 1. r=aklotz

--HG--
extra : histedit_source : 9d3f6fbef31b0c9338728c660b0705e6ed8bbe81
---
 testing/talos/talos/xtalos/etlparser.py         | 9 +++++----
 testing/talos/talos/xtalos/xperf_whitelist.json | 2 ++
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/testing/talos/talos/xtalos/etlparser.py b/testing/talos/talos/xtalos/etlparser.py
index f95378d0c95f..01553e20ad9c 100644
--- a/testing/talos/talos/xtalos/etlparser.py
+++ b/testing/talos/talos/xtalos/etlparser.py
@@ -455,10 +455,11 @@ def etlparser(xperf_path, etl_filename, processID, approot=None,
             with open(error_filename, 'w') as errorFile:
                 errorFile.write('\n'.join(errors))
 
-        mud = os.environ.get('MOZ_UPLOAD_DIR', None)
-        if mud:
-            mud_filename = os.path.join(mud, etl_filename)
-            os.rename(etl_filename, mud_filename)
+# TODO: commented this out from bug 1205005, we have a memory error in blobber upload
+#        mud = os.environ.get('MOZ_UPLOAD_DIR', None)
+#        if mud:
+#            mud_filename = os.path.join(mud, etl_filename)
+#            os.rename(etl_filename, mud_filename)
 
 
 def etlparser_from_config(config_file, **kwargs):
diff --git a/testing/talos/talos/xtalos/xperf_whitelist.json b/testing/talos/talos/xtalos/xperf_whitelist.json
index b96dc05a520d..6aa1928204ce 100644
--- a/testing/talos/talos/xtalos/xperf_whitelist.json
+++ b/testing/talos/talos/xtalos/xperf_whitelist.json
@@ -3,6 +3,7 @@
  "C:\\$Extend\\$UsnJrnl:$J": {"ignore": true}, 
  "C:\\Windows\\Prefetch\\{prefetch}.pf": {"ignore": true}, 
  "C:\\$Secure": {"ignore": true},
+ "C:\\$logfile": {"ignore": true},
  "{firefox}\\omni.ja": {"mincount": 0, "maxcount": 46, "minbytes": 0, "maxbytes": 3014656},
  "{firefox}\\browser\\omni.ja": {"mincount": 0, "maxcount": 28, "minbytes": 0, "maxbytes": 1835008},
  "{talos}\\tests\\tp5n\\tp5n.manifest": {"mincount": 0, "maxcount": 8, "minbytes": 0, "maxbytes": 32786},
@@ -31,6 +32,7 @@
  "c:\\windows\\fonts\\staticcache.dat": {"mincount": 2, "maxcount": 2, "minbytes": 120, "maxbytes": 120},
  "c:\\windows\\system32\\spool\\drivers\\color\\srgb color space profile.icm": {"mincount": 2, "maxcount": 2, "minbytes": 8192, "maxbytes": 8192},
  "{profile}\\search.json": {"mincount": 12, "maxcount": 12, "minbytes": 33350, "maxbytes": 33350},
+ "{profile}\\prefs-1.js": {"mincount": 0, "maxcount": 10, "minbytes": 0, "maxbytes": 53950},
  "{profile}\\prefs.js": {"mincount": 4, "maxcount": 4, "minbytes": 19612, "maxbytes": 20136},
  "{profile}\\compatibility.ini": {"mincount": 2, "maxcount": 34, "minbytes": 734, "maxbytes": 8192},
  "{profile}\\places.sqlite-shm": {"mincount": 2, "maxcount": 2, "minbytes": 65536, "maxbytes": 65536},

From b979c2d6f3c5c142e1f1f62cd01e2f3a3d79dd21 Mon Sep 17 00:00:00 2001
From: Jared Wein <jwein@mozilla.com>
Date: Wed, 14 Oct 2015 11:26:33 +0530
Subject: [PATCH 08/63] Bug 1209999 - Update string for push notification
 doorhanger.

---
 browser/components/nsBrowserGlue.js                     | 4 ++--
 browser/locales/en-US/chrome/browser/browser.properties | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/browser/components/nsBrowserGlue.js b/browser/components/nsBrowserGlue.js
index 51b1d5e4c77b..4e77065375f3 100644
--- a/browser/components/nsBrowserGlue.js
+++ b/browser/components/nsBrowserGlue.js
@@ -2621,11 +2621,11 @@ ContentPermissionPrompt.prototype = {
   },
 
   _promptWebNotifications : function(aRequest) {
-    var message = gBrowserBundle.GetStringFromName("webNotifications.showFromSite2");
+    var message = gBrowserBundle.GetStringFromName("webNotifications.receiveFromSite");
 
     var actions = [
       {
-        stringId: "webNotifications.alwaysShow",
+        stringId: "webNotifications.alwaysReceive",
         action: Ci.nsIPermissionManager.ALLOW_ACTION,
         expireType: null,
         callback: function() {},
diff --git a/browser/locales/en-US/chrome/browser/browser.properties b/browser/locales/en-US/chrome/browser/browser.properties
index 2d4cf60deae2..7ee0adc5e441 100644
--- a/browser/locales/en-US/chrome/browser/browser.properties
+++ b/browser/locales/en-US/chrome/browser/browser.properties
@@ -375,11 +375,11 @@ geolocation.neverShareLocation.accesskey=N
 geolocation.shareWithSite2=Would you like to share your location with this site?
 geolocation.shareWithFile2=Would you like to share your location with this file?
 
-webNotifications.alwaysShow=Always Show Notifications
-webNotifications.alwaysShow.accesskey=A
+webNotifications.alwaysReceive=Always Receive Notifications
+webNotifications.alwaysReceive.accesskey=A
 webNotifications.neverShow=Always Block Notifications
 webNotifications.neverShow.accesskey=N
-webNotifications.showFromSite2=Would you like to show notifications from this site?
+webNotifications.receiveFromSite=Would you like to receive notifications from this site?
 
 # Pointer lock UI
 

From d0922cb7a48ee08edb50e715e7f4c73f282024d5 Mon Sep 17 00:00:00 2001
From: Henry <hchang@mozilla.com>
Date: Mon, 12 Oct 2015 15:38:41 +0800
Subject: [PATCH 09/63] Bug 1210235 - Skip package verification if pref out or
 no signature. The package would be treated unsigned. r=valentin

--HG--
extra : histedit_source : e3820fb54cfbab00bf8db377aec2bc8afcb0fb0e
---
 modules/libpref/init/all.js                   |  4 ++++
 netwerk/protocol/http/PackagedAppService.cpp  | 19 ++++++++++++++++++-
 netwerk/protocol/http/PackagedAppVerifier.cpp |  9 +++++++++
 netwerk/protocol/http/PackagedAppVerifier.h   |  2 ++
 .../test_signed_web_packaged_app.html         |  1 +
 .../test/unit/test_packaged_app_channel.js    |  4 ++++
 .../test/unit/test_packaged_app_service.js    |  3 +++
 7 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index 8ec45ef8060b..6626cfde97b4 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -1448,6 +1448,10 @@ pref("network.http.enforce-framing.soft", true);
 // See http://www.w3.org/TR/web-packaging/#streamable-package-format
 pref("network.http.enable-packaged-apps", false);
 
+// Enable this to bring in the signature verification if the signature exists.
+// Set to false if you don't need the signed packaged web app support (i.e. NSec).
+pref("network.http.packaged-signed-apps-enabled", false);
+
 // Enable this pref to skip verification process. The packaged app
 // will be considered signed no matter the package has a valid/invalid
 // signature or no signature.
diff --git a/netwerk/protocol/http/PackagedAppService.cpp b/netwerk/protocol/http/PackagedAppService.cpp
index 25341fc6a18b..df660ad472b8 100644
--- a/netwerk/protocol/http/PackagedAppService.cpp
+++ b/netwerk/protocol/http/PackagedAppService.cpp
@@ -479,6 +479,12 @@ PackagedAppService::PackagedAppDownloader::OnStartRequest(nsIRequest *aRequest,
   NS_WARN_IF(NS_FAILED(rv));
 
   EnsureVerifier(aRequest);
+
+  if (!mVerifier->WouldVerify()) {
+    // It means there's no signature or the signed app is disabled.
+    return NS_OK;
+  }
+
   mVerifier->OnStartRequest(nullptr, uri);
 
   // Since the header is considered as a part of the streaming data,
@@ -640,7 +646,7 @@ PackagedAppService::PackagedAppDownloader::OnStopRequest(nsIRequest *aRequest,
       // Chances to get here:
       //   1) Very likely the package has been cached or
       //   2) Less likely the package is malformed.
-      if (!mVerifier) {
+      if (!mVerifier || !mVerifier->WouldVerify()) {
         FinalizeDownload(aStatusCode);
       } else {
         // We've got a broken last part and some resources might be still
@@ -676,6 +682,12 @@ PackagedAppService::PackagedAppDownloader::OnStopRequest(nsIRequest *aRequest,
   nsRefPtr<ResourceCacheInfo> info =
     new ResourceCacheInfo(uri, entry, aStatusCode, lastPart);
 
+  if (!mVerifier->WouldVerify()) {
+    // No manifest at all. Everything is simply a resource.
+    OnResourceVerified(info, true);
+    return NS_OK;
+  }
+
   mVerifier->OnStopRequest(nullptr, info, aStatusCode);
 
   return NS_OK;
@@ -704,6 +716,11 @@ PackagedAppService::PackagedAppDownloader::ConsumeData(nsIInputStream *aStream,
 
   self->mWriter->ConsumeData(aFromRawSegment, aCount, aWriteCount);
 
+  if (!self->mVerifier->WouldVerify()) {
+    // No signature or signed app support is disabled.
+    return NS_OK;
+  }
+
   if (self->mProcessingFirstRequest) {
     // mProcessingFirstRequest will be set to false on the first OnStopRequest.
     self->mManifestContent.Append(aFromRawSegment, aCount);
diff --git a/netwerk/protocol/http/PackagedAppVerifier.cpp b/netwerk/protocol/http/PackagedAppVerifier.cpp
index b30bb71ea893..d823b29dcd2b 100644
--- a/netwerk/protocol/http/PackagedAppVerifier.cpp
+++ b/netwerk/protocol/http/PackagedAppVerifier.cpp
@@ -22,6 +22,7 @@ static const short kResourceHashType = nsICryptoHash::SHA256;
 // If it's true, all the verification will be skipped and the package will
 // be treated signed.
 static bool gDeveloperMode = false;
+static bool gSignedAppEnabled = false;
 
 namespace mozilla {
 namespace net {
@@ -69,6 +70,8 @@ NS_IMETHODIMP PackagedAppVerifier::Init(nsIPackagedAppVerifierListener* aListene
   if (!onceThru) {
     Preferences::AddBoolVarCache(&gDeveloperMode,
                                  "network.http.packaged-apps-developer-mode", false);
+    Preferences::AddBoolVarCache(&gSignedAppEnabled,
+                                 "network.http.packaged-signed-apps-enabled", false);
     onceThru = true;
   }
 
@@ -418,6 +421,12 @@ PackagedAppVerifier::SetHasBrokenLastPart(nsresult aStatusCode)
   mPendingResourceCacheInfoList.insertBack(info);
 }
 
+bool
+PackagedAppVerifier::WouldVerify() const
+{
+  return gSignedAppEnabled && !mSignature.IsEmpty();
+}
+
 //---------------------------------------------------------------
 // nsIPackagedAppVerifier.
 //---------------------------------------------------------------
diff --git a/netwerk/protocol/http/PackagedAppVerifier.h b/netwerk/protocol/http/PackagedAppVerifier.h
index b733bc46cbe0..4241bbeba4bc 100644
--- a/netwerk/protocol/http/PackagedAppVerifier.h
+++ b/netwerk/protocol/http/PackagedAppVerifier.h
@@ -114,6 +114,8 @@ public:
     return mPackageOrigin;
   }
 
+  bool WouldVerify() const;
+
   static const char* kSignedPakOriginMetadataKey;
 
 private:
diff --git a/netwerk/test/mochitests/test_signed_web_packaged_app.html b/netwerk/test/mochitests/test_signed_web_packaged_app.html
index 7eae7b895689..b1d0b6eda2c2 100644
--- a/netwerk/test/mochitests/test_signed_web_packaged_app.html
+++ b/netwerk/test/mochitests/test_signed_web_packaged_app.html
@@ -22,6 +22,7 @@ var Cr = SpecialPowers.Cr;
 SpecialPowers.pushPrefEnv(
   { "set": [["network.http.enable-packaged-apps", true],
             ["network.http.packaged-apps-developer-mode", true],
+            ["network.http.packaged-signed-apps-enabled", true],
             ["dom.ipc.processPriorityManager.testMode", true],
             ["dom.ipc.processPriorityManager.enabled", true],
             ["dom.ipc.tabs.disabled", false],
diff --git a/netwerk/test/unit/test_packaged_app_channel.js b/netwerk/test/unit/test_packaged_app_channel.js
index 171f48f8140d..6c361f06ec62 100644
--- a/netwerk/test/unit/test_packaged_app_channel.js
+++ b/netwerk/test/unit/test_packaged_app_channel.js
@@ -118,6 +118,7 @@ function contentHandlerWithSignature(metadata, response)
 var httpserver = null;
 var originalPref = false;
 var originalDevMode = false;
+var originalSignedAppEnabled = false;
 
 function run_test()
 {
@@ -131,8 +132,10 @@ function run_test()
   // Enable the feature and save the original pref value
   originalPref = Services.prefs.getBoolPref("network.http.enable-packaged-apps");
   originalDevMode = Services.prefs.getBoolPref("network.http.packaged-apps-developer-mode");
+  originalSignedAppEnabled = Services.prefs.getBoolPref("network.http.packaged-signed-apps-enabled");
   Services.prefs.setBoolPref("network.http.enable-packaged-apps", true);
   Services.prefs.setBoolPref("network.http.packaged-apps-developer-mode", false);
+  Services.prefs.setBoolPref("network.http.packaged-signed-apps-enabled", true);
   do_register_cleanup(reset_pref);
 
   add_test(test_channel);
@@ -206,4 +209,5 @@ function reset_pref() {
   // Set the pref to its original value
   Services.prefs.setBoolPref("network.http.enable-packaged-apps", originalPref);
   Services.prefs.setBoolPref("network.http.packaged-apps-developer-mode", originalDevMode);
+  Services.prefs.setBoolPref("network.http.packaged-signed-apps-enabled", originalSignedAppEnabled);
 }
diff --git a/netwerk/test/unit/test_packaged_app_service.js b/netwerk/test/unit/test_packaged_app_service.js
index bebb875890f0..3014ff9dd2cd 100644
--- a/netwerk/test/unit/test_packaged_app_service.js
+++ b/netwerk/test/unit/test_packaged_app_service.js
@@ -155,12 +155,15 @@ function run_test()
   // TODO: To be removed in Bug 1178518.
   do_register_cleanup(function() {
     gPrefs.clearUserPref("network.http.packaged-apps-developer-mode");
+    gPrefs.clearUserPref("network.http.packaged-signed-apps-enabled");
   });
 
   paservice = Cc["@mozilla.org/network/packaged-app-service;1"]
                      .getService(Ci.nsIPackagedAppService);
   ok(!!paservice, "test service exists");
 
+  gPrefs.setBoolPref("network.http.packaged-signed-apps-enabled", true);
+
   add_test(test_bad_args);
 
   add_test(test_callback_gets_called);

From 94c0ba5263040a88166b9ff9cb1b40fcac8e6bb3 Mon Sep 17 00:00:00 2001
From: Andrea Marchesini <amarchesini@mozilla.com>
Date: Wed, 14 Oct 2015 11:32:23 +0530
Subject: [PATCH 10/63] Bug 1207546 - Integrate WebRTC with audio channels,
 r=roc

--HG--
rename : dom/base/test/test_audioNotification.html => dom/base/test/test_audioNotificationStream.html
extra : histedit_source : 194f9f7d34be735e8359d0e769dd4783d46b304c
---
 dom/base/test/mochitest.ini                   |  2 +
 .../test/test_audioNotificationStream.html    | 71 +++++++++++++++++++
 dom/html/HTMLMediaElement.cpp                 |  3 +-
 3 files changed, 75 insertions(+), 1 deletion(-)
 create mode 100644 dom/base/test/test_audioNotificationStream.html

diff --git a/dom/base/test/mochitest.ini b/dom/base/test/mochitest.ini
index a0bae4613277..686157158b38 100644
--- a/dom/base/test/mochitest.ini
+++ b/dom/base/test/mochitest.ini
@@ -269,6 +269,8 @@ support-files =
 [test_audioWindowUtils.html]
 [test_audioNotification.html]
 skip-if = buildapp == 'mulet'
+[test_audioNotificationStream.html]
+skip-if = buildapp == 'mulet'
 [test_audioNotificationStopOnNavigation.html]
 skip-if = buildapp == 'mulet'
 [test_audioNotificationWithEarlyPlay.html]
diff --git a/dom/base/test/test_audioNotificationStream.html b/dom/base/test/test_audioNotificationStream.html
new file mode 100644
index 000000000000..adb513a7c78e
--- /dev/null
+++ b/dom/base/test/test_audioNotificationStream.html
@@ -0,0 +1,71 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test for audio controller in windows</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<pre id="test">
+</pre>
+
+<script type="application/javascript">
+
+SimpleTest.waitForExplicitFinish();
+
+var expectedNotification = null;
+
+var observer = {
+  observe: function(subject, topic, data) {
+    is(topic, "audio-playback", "audio-playback received");
+    is(data, expectedNotification, "This is the right notification");
+    runTest();
+  }
+};
+
+var observerService = SpecialPowers.Cc["@mozilla.org/observer-service;1"]
+                                   .getService(SpecialPowers.Ci.nsIObserverService);
+
+var audio = new Audio();
+audio.srcObject = (new AudioContext()).createMediaStreamDestination().stream;
+
+var tests = [
+  function() {
+    observerService.addObserver(observer, "audio-playback", false);
+    ok(true, "Observer set");
+    runTest();
+  },
+
+  function() {
+    expectedNotification = 'active';
+    audio.play();
+  },
+
+  function() {
+    expectedNotification = 'inactive';
+    audio.pause();
+  },
+
+  function() {
+    observerService.removeObserver(observer, "audio-playback");
+    ok(true, "Observer removed");
+    runTest();
+  }
+];
+
+function runTest() {
+  if (!tests.length) {
+    SimpleTest.finish();
+    return;
+  }
+
+  var test = tests.shift();
+  test();
+}
+
+runTest();
+
+</script>
+</body>
+</html>
+
diff --git a/dom/html/HTMLMediaElement.cpp b/dom/html/HTMLMediaElement.cpp
index 572c0b8cf8d2..3ac7988a11aa 100644
--- a/dom/html/HTMLMediaElement.cpp
+++ b/dom/html/HTMLMediaElement.cpp
@@ -4730,7 +4730,8 @@ HTMLMediaElement::UpdateAudioChannelPlayingState()
       (HasAttr(kNameSpaceID_None, nsGkAtoms::loop) ||
        (mReadyState >= nsIDOMHTMLMediaElement::HAVE_CURRENT_DATA &&
         !IsPlaybackEnded()) ||
-       mPlayingThroughTheAudioChannelBeforeSeek));
+       mPlayingThroughTheAudioChannelBeforeSeek ||
+       mSrcAttrStream));
   if (playingThroughTheAudioChannel != mPlayingThroughTheAudioChannel) {
     mPlayingThroughTheAudioChannel = playingThroughTheAudioChannel;
 

From 7bf802c0be3de221025a101d9d3780e610abd3e5 Mon Sep 17 00:00:00 2001
From: Jamie Nicol <jnicol@mozilla.com>
Date: Wed, 14 Oct 2015 11:32:35 +0530
Subject: [PATCH 11/63] Bug 1209801 - Part 1: Add TextureFlags parameter to
 TextureClientPool. r=mattwoodrow

--HG--
extra : histedit_source : d33f4c7f92f0903d1324a153e5243634acda594d
---
 gfx/layers/client/ClientLayerManager.cpp | 19 ++++++++++++-------
 gfx/layers/client/ClientLayerManager.h   |  2 +-
 gfx/layers/client/TextureClientPool.cpp  |  6 ++++--
 gfx/layers/client/TextureClientPool.h    |  8 +++++++-
 gfx/layers/client/TiledContentClient.cpp |  3 ++-
 5 files changed, 26 insertions(+), 12 deletions(-)

diff --git a/gfx/layers/client/ClientLayerManager.cpp b/gfx/layers/client/ClientLayerManager.cpp
index 513642a0749b..99875dc3767a 100644
--- a/gfx/layers/client/ClientLayerManager.cpp
+++ b/gfx/layers/client/ClientLayerManager.cpp
@@ -681,17 +681,19 @@ ClientLayerManager::SetIsFirstPaint()
 }
 
 TextureClientPool*
-ClientLayerManager::GetTexturePool(SurfaceFormat aFormat)
+ClientLayerManager::GetTexturePool(SurfaceFormat aFormat, TextureFlags aFlags)
 {
   for (size_t i = 0; i < mTexturePools.Length(); i++) {
-    if (mTexturePools[i]->GetFormat() == aFormat) {
+    if (mTexturePools[i]->GetFormat() == aFormat &&
+        mTexturePools[i]->GetFlags() == aFlags) {
       return mTexturePools[i];
     }
   }
 
   mTexturePools.AppendElement(
-      new TextureClientPool(aFormat, IntSize(gfxPlatform::GetPlatform()->GetTileWidth(),
-                                             gfxPlatform::GetPlatform()->GetTileHeight()),
+      new TextureClientPool(aFormat, aFlags,
+                            IntSize(gfxPlatform::GetPlatform()->GetTileWidth(),
+                                    gfxPlatform::GetPlatform()->GetTileHeight()),
                             gfxPrefs::LayersTileMaxPoolSize(),
                             gfxPrefs::LayersTileShrinkPoolTimeout(),
                             mForwarder));
@@ -701,17 +703,20 @@ ClientLayerManager::GetTexturePool(SurfaceFormat aFormat)
 
 void
 ClientLayerManager::ReturnTextureClientDeferred(TextureClient& aClient) {
-  GetTexturePool(aClient.GetFormat())->ReturnTextureClientDeferred(&aClient);
+  GetTexturePool(aClient.GetFormat(),
+                 aClient.GetFlags())->ReturnTextureClientDeferred(&aClient);
 }
 
 void
 ClientLayerManager::ReturnTextureClient(TextureClient& aClient) {
-  GetTexturePool(aClient.GetFormat())->ReturnTextureClient(&aClient);
+  GetTexturePool(aClient.GetFormat(),
+                 aClient.GetFlags())->ReturnTextureClient(&aClient);
 }
 
 void
 ClientLayerManager::ReportClientLost(TextureClient& aClient) {
-  GetTexturePool(aClient.GetFormat())->ReportClientLost();
+  GetTexturePool(aClient.GetFormat(),
+                 aClient.GetFlags())->ReportClientLost();
 }
 
 void
diff --git a/gfx/layers/client/ClientLayerManager.h b/gfx/layers/client/ClientLayerManager.h
index 9defd20bdfab..23926a218e8c 100644
--- a/gfx/layers/client/ClientLayerManager.h
+++ b/gfx/layers/client/ClientLayerManager.h
@@ -121,7 +121,7 @@ public:
 
   virtual void SetIsFirstPaint() override;
 
-  TextureClientPool* GetTexturePool(gfx::SurfaceFormat aFormat);
+  TextureClientPool* GetTexturePool(gfx::SurfaceFormat aFormat, TextureFlags aFlags);
 
   /// Utility methods for managing texture clients.
   void ReturnTextureClientDeferred(TextureClient& aClient);
diff --git a/gfx/layers/client/TextureClientPool.cpp b/gfx/layers/client/TextureClientPool.cpp
index 2a38f5a6a909..c0d5fe0d7d16 100644
--- a/gfx/layers/client/TextureClientPool.cpp
+++ b/gfx/layers/client/TextureClientPool.cpp
@@ -24,11 +24,13 @@ ShrinkCallback(nsITimer *aTimer, void *aClosure)
 }
 
 TextureClientPool::TextureClientPool(gfx::SurfaceFormat aFormat,
+                                     TextureFlags aFlags,
                                      gfx::IntSize aSize,
                                      uint32_t aMaxTextureClients,
                                      uint32_t aShrinkTimeoutMsec,
                                      CompositableForwarder* aAllocator)
   : mFormat(aFormat)
+  , mFlags(aFlags)
   , mSize(aSize)
   , mMaxTextureClients(aMaxTextureClients)
   , mShrinkTimeoutMsec(aShrinkTimeoutMsec)
@@ -108,10 +110,10 @@ TextureClientPool::GetTextureClient()
     // gfx::BackendType::NONE means use the content backend
     textureClient = TextureClient::CreateForRawBufferAccess(mSurfaceAllocator,
       mFormat, mSize, gfx::BackendType::NONE,
-      TextureFlags::IMMEDIATE_UPLOAD, ALLOC_DEFAULT);
+      mFlags, ALLOC_DEFAULT);
   } else {
     textureClient = TextureClient::CreateForDrawing(mSurfaceAllocator,
-      mFormat, mSize, BackendSelector::Content, TextureFlags::IMMEDIATE_UPLOAD);
+      mFormat, mSize, BackendSelector::Content, mFlags);
   }
 
   mOutstandingClients++;
diff --git a/gfx/layers/client/TextureClientPool.h b/gfx/layers/client/TextureClientPool.h
index e4ec86632a83..76abe4c8c605 100644
--- a/gfx/layers/client/TextureClientPool.h
+++ b/gfx/layers/client/TextureClientPool.h
@@ -42,7 +42,9 @@ class TextureClientPool final : public TextureClientAllocator
   ~TextureClientPool();
 
 public:
-  TextureClientPool(gfx::SurfaceFormat aFormat, gfx::IntSize aSize,
+  TextureClientPool(gfx::SurfaceFormat aFormat,
+                    TextureFlags aFlags,
+                    gfx::IntSize aSize,
                     uint32_t aMaxTextureClients,
                     uint32_t aShrinkTimeoutMsec,
                     CompositableForwarder* aAllocator);
@@ -101,6 +103,7 @@ public:
   void Clear();
 
   gfx::SurfaceFormat GetFormat() { return mFormat; }
+  TextureFlags GetFlags() const { return mFlags; }
 
 private:
   // The minimum size of the pool (the number of tiles that will be kept after
@@ -110,6 +113,9 @@ private:
   /// Format is passed to the TextureClient for buffer creation.
   gfx::SurfaceFormat mFormat;
 
+  /// Flags passed to the TextureClient for buffer creation.
+  const TextureFlags mFlags;
+
   /// The width and height of the tiles to be used.
   gfx::IntSize mSize;
 
diff --git a/gfx/layers/client/TiledContentClient.cpp b/gfx/layers/client/TiledContentClient.cpp
index 7020f3c56d0a..8edd8164fbdc 100644
--- a/gfx/layers/client/TiledContentClient.cpp
+++ b/gfx/layers/client/TiledContentClient.cpp
@@ -1240,7 +1240,8 @@ ClientMultiTiledLayerBuffer::ValidateTile(TileClient& aTile,
   if (aTile.IsPlaceholderTile()) {
     aTile.SetLayerManager(mManager);
     aTile.SetTextureAllocator(mManager->GetTexturePool(
-      gfxPlatform::GetPlatform()->Optimal2DFormatForContent(content)));
+      gfxPlatform::GetPlatform()->Optimal2DFormatForContent(content),
+      TextureFlags::IMMEDIATE_UPLOAD));
   }
   aTile.SetCompositableClient(mCompositableClient);
 

From 2e1135737ea46053968c6544390800da6fc4ba3e Mon Sep 17 00:00:00 2001
From: Jamie Nicol <jnicol@mozilla.com>
Date: Wed, 14 Oct 2015 11:32:44 +0530
Subject: [PATCH 12/63] Bug 1209801 - Part 2: Do not allow big image textures
 to be used with TiledLayerBuffers. r=mattwoodrow

Big-image textures (where multiple textures are tiled together to act as
a single larger texture, e.g. TiledTextureImage) were in some cases
being used to back the TextureSources associated with each Tile in a
TiledLayerBuffer. CompositorOGL was unaware of this, so when compositing
would only render the first tile in each big image, stretching it to the
size of the entire big image.

It doesn't make much sense to allow tiling-within-tiling, so set the
DISALLOW_BIGIMAGE flag for textures created for use with TiledLayerBuffers.

--HG--
extra : histedit_source : 7783b2132cb2037dda2a736b1497dc13231b4dee
---
 gfx/layers/client/SingleTiledContentClient.cpp | 2 +-
 gfx/layers/client/TiledContentClient.cpp       | 2 +-
 gfx/layers/composite/TextureHost.cpp           | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/gfx/layers/client/SingleTiledContentClient.cpp b/gfx/layers/client/SingleTiledContentClient.cpp
index b6f64f80f98e..ab611645b51e 100644
--- a/gfx/layers/client/SingleTiledContentClient.cpp
+++ b/gfx/layers/client/SingleTiledContentClient.cpp
@@ -110,7 +110,7 @@ ClientSingleTiledLayerBuffer::GetTextureClient()
 {
   return mCompositableClient->CreateTextureClientForDrawing(
     gfx::ImageFormatToSurfaceFormat(mFormat), mSize, BackendSelector::Content,
-    TextureFlags::IMMEDIATE_UPLOAD);
+    TextureFlags::DISALLOW_BIGIMAGE | TextureFlags::IMMEDIATE_UPLOAD);
 }
 
 void
diff --git a/gfx/layers/client/TiledContentClient.cpp b/gfx/layers/client/TiledContentClient.cpp
index 8edd8164fbdc..97a66d18ff8b 100644
--- a/gfx/layers/client/TiledContentClient.cpp
+++ b/gfx/layers/client/TiledContentClient.cpp
@@ -1241,7 +1241,7 @@ ClientMultiTiledLayerBuffer::ValidateTile(TileClient& aTile,
     aTile.SetLayerManager(mManager);
     aTile.SetTextureAllocator(mManager->GetTexturePool(
       gfxPlatform::GetPlatform()->Optimal2DFormatForContent(content),
-      TextureFlags::IMMEDIATE_UPLOAD));
+      TextureFlags::DISALLOW_BIGIMAGE | TextureFlags::IMMEDIATE_UPLOAD));
   }
   aTile.SetCompositableClient(mCompositableClient);
 
diff --git a/gfx/layers/composite/TextureHost.cpp b/gfx/layers/composite/TextureHost.cpp
index c2a1ee90888e..da83349c3fcb 100644
--- a/gfx/layers/composite/TextureHost.cpp
+++ b/gfx/layers/composite/TextureHost.cpp
@@ -599,7 +599,7 @@ BufferTextureHost::Upload(nsIntRegion *aRegion)
   } else {
     // non-YCbCr case
     if (!mFirstSource) {
-      mFirstSource = mCompositor->CreateDataTextureSource();
+      mFirstSource = mCompositor->CreateDataTextureSource(mFlags);
     }
     ImageDataDeserializer deserializer(GetBuffer(), GetBufferSize());
     if (!deserializer.IsValid()) {

From f94b0bf68fe89e33fd711cff0a0ee2741d288202 Mon Sep 17 00:00:00 2001
From: Jamie Nicol <jnicol@mozilla.com>
Date: Wed, 14 Oct 2015 11:32:55 +0530
Subject: [PATCH 13/63] Bug 1209801 - Part 3: Adjust reftest fuzz and expected
 fails. r=mattwoodrow

Due to parts 1 and 2 the fuzz factor on a test needed to be slightly
increased, and several tests which were failing now pass.

--HG--
extra : histedit_source : 68e1ea753227e5bfc576d0083a49fe64b72d31a2
---
 layout/reftests/backgrounds/reftest.list   | 12 ++++++------
 layout/reftests/border-radius/reftest.list |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/layout/reftests/backgrounds/reftest.list b/layout/reftests/backgrounds/reftest.list
index da9c07b788ec..922a881a2f7d 100644
--- a/layout/reftests/backgrounds/reftest.list
+++ b/layout/reftests/backgrounds/reftest.list
@@ -148,17 +148,17 @@ HTTP == background-referrer.html background-referrer-ref.html
 == attachment-local-clipping-color-1.html attachment-local-clipping-color-1-ref.html
 == attachment-local-clipping-color-2.html attachment-local-clipping-color-1-ref.html  # Same ref as the previous test.
 == attachment-local-clipping-color-3.html attachment-local-clipping-color-3-ref.html
-fails-if(Android&&AndroidVersion==15) == attachment-local-clipping-color-4.html attachment-local-clipping-color-4-ref.html #Bug 959165
-fails-if(Android&&AndroidVersion==15) == attachment-local-clipping-color-5.html attachment-local-clipping-color-4-ref.html  # Same ref as the previous test. #Bug 959165
-fails-if(Android&&AndroidVersion==15) fuzzy-if(!Android||(Android&&AndroidVersion!=15),50,500) == attachment-local-clipping-color-6.html attachment-local-clipping-color-6-ref.html #Bug 959165
+== attachment-local-clipping-color-4.html attachment-local-clipping-color-4-ref.html
+== attachment-local-clipping-color-5.html attachment-local-clipping-color-4-ref.html
+fuzzy(50,500) == attachment-local-clipping-color-6.html attachment-local-clipping-color-6-ref.html
 
 == attachment-local-clipping-image-1.html attachment-local-clipping-image-1-ref.html
 == attachment-local-clipping-image-2.html attachment-local-clipping-image-1-ref.html  # Same ref as the previous test.
 == attachment-local-clipping-image-3.html attachment-local-clipping-image-3-ref.html
 # The next three tests are fuzzy due to bug 1128229.
-fails-if(Android&&AndroidVersion==15) fuzzy-if(winWidget||(Android&&AndroidVersion!=15),16,69) == attachment-local-clipping-image-4.html attachment-local-clipping-image-4-ref.html #Bug 959165
-fails-if(Android&&AndroidVersion==15) fuzzy-if(winWidget||(Android&&AndroidVersion!=15),16,69) == attachment-local-clipping-image-5.html attachment-local-clipping-image-4-ref.html  # Same ref as the previous test. #Bug 959165
-fails-if(Android&&AndroidVersion==15) fuzzy-if(!Android||(Android&&AndroidVersion!=15),80,500) == attachment-local-clipping-image-6.html attachment-local-clipping-image-6-ref.html #Bug 959165
+fuzzy(16,69) == attachment-local-clipping-image-4.html attachment-local-clipping-image-4-ref.html
+fuzzy(16,69) == attachment-local-clipping-image-5.html attachment-local-clipping-image-4-ref.html
+fuzzy(80,500) == attachment-local-clipping-image-6.html attachment-local-clipping-image-6-ref.html
 
 == background-multiple-with-border-radius.html background-multiple-with-border-radius-ref.html
 == background-repeat-large-area.html background-repeat-large-area-ref.html
diff --git a/layout/reftests/border-radius/reftest.list b/layout/reftests/border-radius/reftest.list
index 11e6fa571afa..76beabc1f86c 100644
--- a/layout/reftests/border-radius/reftest.list
+++ b/layout/reftests/border-radius/reftest.list
@@ -51,7 +51,7 @@ fuzzy-if(/^Windows\x20NT\x206\.2/.test(http.oscpu),1,5) == clipping-5-image.html
 fuzzy-if(/^Windows\x20NT\x206\.2/.test(http.oscpu),1,5) == clipping-5-overflow-hidden.html clipping-5-ref.html
 fuzzy-if(/^Windows\x20NT\x206\.2/.test(http.oscpu),1,5) fuzzy-if(Android,5,21) == clipping-5-refi.html clipping-5-ref.html
 fuzzy-if(true,1,7) fuzzy-if(cocoaWidget,1,99) fuzzy-if(Android&&browserIsRemote,7,89) fuzzy-if(Android&&!browserIsRemote,99,115) == clipping-5-refc.html clipping-5-ref.html # bug 732535
-fuzzy-if(winWidget,105,71) fuzzy-if(Android,8,464) == clipping-6.html clipping-6-ref.html # PaintedLayer and MaskLayer with transforms that aren't identical
+fuzzy-if(winWidget,105,71) fuzzy-if(Android,8,469) == clipping-6.html clipping-6-ref.html # PaintedLayer and MaskLayer with transforms that aren't identical
 fuzzy-if(true,2,29) fuzzy-if(Android&&AndroidVersion<15,12,81) fuzzy-if(Android&&AndroidVersion>=15,255,586) == clipping-7.html clipping-7-ref.html # ColorLayer and MaskLayer with transforms that aren't identical. Reference image rendered without using layers (which causes fuzzy failures).
 fuzzy-if(/^Windows\x20NT\x206\.2/.test(http.oscpu),1,5) == clipping-and-zindex-1.html clipping-and-zindex-1-ref.html
 fuzzy-if(cocoaWidget,1,4) == intersecting-clipping-1-canvas.html intersecting-clipping-1-refc.html

From 7924ef22c9460cf1911ecc4eaf2e379c5dc936ff Mon Sep 17 00:00:00 2001
From: David Rajchenbach-Teller <dteller@mozilla.com>
Date: Mon, 12 Oct 2015 09:30:23 +0200
Subject: [PATCH 14/63] Bug 1213672 - Turning onWindowOpened into a variable;
 r=mak

--HG--
extra : amend_source : 4749a0f13895765ec3431c51405483543742fafc
---
 browser/base/content/sanitize.js | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/browser/base/content/sanitize.js b/browser/base/content/sanitize.js
index dd2703e23664..e98cf3add9a7 100644
--- a/browser/base/content/sanitize.js
+++ b/browser/base/content/sanitize.js
@@ -635,8 +635,9 @@ Sanitizer.prototype = {
         let newWindow = existingWindow.openDialog("chrome://browser/content/", "_blank",
                                                   features, defaultArgs);
 
+        let onFullScreen = null;
         if (AppConstants.platform == "macosx") {
-          let onFullScreen = function(e) {
+          onFullScreen = function(e) {
             newWindow.removeEventListener("fullscreen", onFullScreen);
             let docEl = newWindow.document.documentElement;
             let sizemode = docEl.getAttribute("sizemode");
@@ -658,7 +659,7 @@ Sanitizer.prototype = {
           // closes) and/or run too late (and not have a fully-formed window yet
           // in existence). See bug 1088137.
           let newWindowOpened = false;
-          function onWindowOpened(subject, topic, data) {
+          let onWindowOpened = function(subject, topic, data) {
             if (subject != newWindow)
               return;
 
@@ -675,7 +676,7 @@ Sanitizer.prototype = {
           }
 
           let numWindowsClosing = windowList.length;
-          function onWindowClosed() {
+          let onWindowClosed = function() {
             numWindowsClosing--;
             if (numWindowsClosing == 0) {
               Services.obs.removeObserver(onWindowClosed, "xul-window-destroyed");
@@ -686,9 +687,9 @@ Sanitizer.prototype = {
               }
             }
           }
+          Services.obs.addObserver(onWindowOpened, "browser-delayed-startup-finished", false);
+          Services.obs.addObserver(onWindowClosed, "xul-window-destroyed", false);
         });
-        Services.obs.addObserver(onWindowOpened, "browser-delayed-startup-finished", false);
-        Services.obs.addObserver(onWindowClosed, "xul-window-destroyed", false);
 
         // Start the process of closing windows
         while (windowList.length) {

From d30806ea5eaf1298b63b614241e5068330599f31 Mon Sep 17 00:00:00 2001
From: Ekanan Ketunuti <ananuti@gmail.com>
Date: Mon, 12 Oct 2015 15:21:51 +0700
Subject: [PATCH 15/63] Bug 1213765 - Add preliminarily to the en-US
 dictionary. r=ehsan

--HG--
extra : amend_source : 0cef2913097daad80cdc55b45ba0554dbac73334
---
 extensions/spellcheck/locales/en-US/hunspell/en-US.dic | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/extensions/spellcheck/locales/en-US/hunspell/en-US.dic b/extensions/spellcheck/locales/en-US/hunspell/en-US.dic
index 15ce5bc9706c..04e9d3165929 100644
--- a/extensions/spellcheck/locales/en-US/hunspell/en-US.dic
+++ b/extensions/spellcheck/locales/en-US/hunspell/en-US.dic
@@ -1,4 +1,4 @@
-54851
+54852
 0/nm
 0th/pt
 1/n1
@@ -42923,6 +42923,7 @@ prekindergarten/SM
 prelacy/M
 prelate/SM
 prelim/SM
+preliminarily
 preliminary/SM
 preliterate
 prelude/MS

From a23a8d3c5089f1c32f68368354a27593d1043abd Mon Sep 17 00:00:00 2001
From: Seth Fowler <mark.seth.fowler@gmail.com>
Date: Tue, 13 Oct 2015 23:21:39 -0700
Subject: [PATCH 16/63] Bug 1209715 - Add operator overloads for combining
 DrawResults. r=tn

---
 image/DrawResult.h      | 89 +++++++++++++++++++++++++++++++++++++++++
 image/imgIContainer.idl | 45 +--------------------
 image/moz.build         |  1 +
 3 files changed, 91 insertions(+), 44 deletions(-)
 create mode 100644 image/DrawResult.h

diff --git a/image/DrawResult.h b/image/DrawResult.h
new file mode 100644
index 000000000000..307255d1ab0d
--- /dev/null
+++ b/image/DrawResult.h
@@ -0,0 +1,89 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_image_DrawResult_h
+#define mozilla_image_DrawResult_h
+
+#include "mozilla/Attributes.h"
+#include "mozilla/Likely.h"
+
+namespace mozilla {
+namespace image {
+
+/**
+ * An enumeration representing the result of a drawing operation.
+ *
+ * Most users of DrawResult will only be interested in whether the value is
+ * SUCCESS or not. The other values are primarily useful for debugging and error
+ * handling.
+ *
+ * SUCCESS: We successfully drew a completely decoded frame of the requested
+ * size. Drawing again with FLAG_SYNC_DECODE would not change the result.
+ *
+ * INCOMPLETE: We successfully drew a frame that was partially decoded. (Note
+ * that successfully drawing a partially decoded frame may not actually draw any
+ * pixels!) Drawing again with FLAG_SYNC_DECODE would improve the result.
+ *
+ * WRONG_SIZE: We successfully drew a wrongly-sized frame that had to be scaled.
+ * This is only returned if drawing again with FLAG_SYNC_DECODE would improve
+ * the result; if the size requested was larger than the intrinsic size of the
+ * image, for example, we would generally have to scale whether FLAG_SYNC_DECODE
+ * was specified or not, and therefore we would not return WRONG_SIZE.
+ *
+ * NOT_READY: We failed to draw because no decoded version of the image was
+ * available. Drawing again with FLAG_SYNC_DECODE would improve the result.
+ * (Though FLAG_SYNC_DECODE will not necessarily work until after the image's
+ * load event!)
+ *
+ * TEMPORARY_ERROR: We failed to draw due to a temporary error. Drawing may
+ * succeed at a later time.
+ *
+ * BAD_IMAGE: We failed to draw because the image has an error. This is a
+ * permanent condition.
+ *
+ * BAD_ARGS: We failed to draw because bad arguments were passed to draw().
+ */
+enum class DrawResult : uint8_t
+{
+  SUCCESS,
+  INCOMPLETE,
+  WRONG_SIZE,
+  NOT_READY,
+  TEMPORARY_ERROR,
+  BAD_IMAGE,
+  BAD_ARGS
+};
+
+/**
+ * You can combine DrawResults with &. By analogy to bitwise-&, the result is
+ * DrawResult::SUCCESS only if both operands are DrawResult::SUCCESS. Otherwise,
+ * a failing DrawResult is returned; we favor the left operand's failure when
+ * deciding which failure to return, with the exception that we always prefer
+ * any other kind of failure over DrawResult::BAD_IMAGE, since other failures
+ * are recoverable and we want to know if any recoverable failures occurred.
+ */
+inline DrawResult
+operator&(const DrawResult aLeft, const DrawResult aRight)
+{
+  if (MOZ_LIKELY(aLeft == DrawResult::SUCCESS)) {
+    return aRight;
+  }
+  if (aLeft == DrawResult::BAD_IMAGE && aRight != DrawResult::SUCCESS) {
+    return aRight;
+  }
+  return aLeft;
+}
+
+inline DrawResult&
+operator&=(DrawResult& aLeft, const DrawResult aRight)
+{
+  aLeft = aLeft & aRight;
+  return aLeft;
+}
+
+} // namespace image
+} // namespace mozilla
+
+#endif // mozilla_image_DrawResult_h
diff --git a/image/imgIContainer.idl b/image/imgIContainer.idl
index 730a0cf1e6d6..c190494ca6a1 100644
--- a/image/imgIContainer.idl
+++ b/image/imgIContainer.idl
@@ -7,6 +7,7 @@
 #include "nsISupports.idl"
 
 %{C++
+#include "DrawResult.h"
 #include "gfxContext.h"
 #include "gfxMatrix.h"
 #include "gfxRect.h"
@@ -39,50 +40,6 @@ namespace image {
 class ImageRegion;
 struct Orientation;
 
-/**
- * An enumeration representing the result of a drawing operation.
- *
- * Most users of DrawResult will only be interested in whether the value is
- * SUCCESS or not. The other values are primarily useful for debugging and error
- * handling.
- *
- * SUCCESS: We successfully drew a completely decoded frame of the requested
- * size. Drawing again with FLAG_SYNC_DECODE would not change the result.
- *
- * INCOMPLETE: We successfully drew a frame that was partially decoded. (Note
- * that successfully drawing a partially decoded frame may not actually draw any
- * pixels!) Drawing again with FLAG_SYNC_DECODE would improve the result.
- *
- * WRONG_SIZE: We successfully drew a wrongly-sized frame that had to be scaled.
- * This is only returned if drawing again with FLAG_SYNC_DECODE would improve
- * the result; if the size requested was larger than the intrinsic size of the
- * image, for example, we would generally have to scale whether FLAG_SYNC_DECODE
- * was specified or not, and therefore we would not return WRONG_SIZE.
- *
- * NOT_READY: We failed to draw because no decoded version of the image was
- * available. Drawing again with FLAG_SYNC_DECODE would improve the result.
- * (Though FLAG_SYNC_DECODE will not necessarily work until after the image's
- * load event!)
- *
- * TEMPORARY_ERROR: We failed to draw due to a temporary error. Drawing may
- * succeed at a later time.
- *
- * BAD_IMAGE: We failed to draw because the image has an error. This is a
- * permanent condition.
- *
- * BAD_ARGS: We failed to draw because bad arguments were passed to draw().
- */
-enum class DrawResult : uint8_t
-{
-  SUCCESS,
-  INCOMPLETE,
-  WRONG_SIZE,
-  NOT_READY,
-  TEMPORARY_ERROR,
-  BAD_IMAGE,
-  BAD_ARGS
-};
-
 }
 }
 
diff --git a/image/moz.build b/image/moz.build
index 7d92a204c331..2efdb2190a80 100644
--- a/image/moz.build
+++ b/image/moz.build
@@ -36,6 +36,7 @@ XPIDL_SOURCES += [
 XPIDL_MODULE = 'imglib2'
 
 EXPORTS += [
+    'DrawResult.h',
     'ImageCacheKey.h',
     'ImageLogging.h',
     'ImageOps.h',

From 8e658a6b4454da2fc44db679590a1971d9db3d26 Mon Sep 17 00:00:00 2001
From: Seth Fowler <mark.seth.fowler@gmail.com>
Date: Tue, 13 Oct 2015 23:21:39 -0700
Subject: [PATCH 17/63] Bug 1209725 - Use DrawResult combining operators in
 nsCSSRendering::PaintBackgroundWithSC. r=tn

---
 layout/base/nsCSSRendering.cpp | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/layout/base/nsCSSRendering.cpp b/layout/base/nsCSSRendering.cpp
index c02478b646df..b31544006728 100644
--- a/layout/base/nsCSSRendering.cpp
+++ b/layout/base/nsCSSRendering.cpp
@@ -2832,9 +2832,6 @@ nsCSSRendering::PaintBackgroundWithSC(nsPresContext* aPresContext,
   NS_PRECONDITION(aForFrame,
                   "Frame is expected to be provided to PaintBackground");
 
-  // Initialize our result to success. We update it only if its value is
-  // currently DrawResult::SUCCESS, which means that as soon as we hit our first
-  // non-successful draw, we stop updating and will return that value.
   DrawResult result = DrawResult::SUCCESS;
 
   // Check to see if we have an appearance defined.  If so, we let the theme
@@ -3010,16 +3007,12 @@ nsCSSRendering::PaintBackgroundWithSC(nsPresContext* aPresContext,
             ctx->SetOp(state.mCompositionOp);
           }
 
-          DrawResult resultForLayer =
+          result &=
             state.mImageRenderer.DrawBackground(aPresContext, aRenderingContext,
                                                 state.mDestArea, state.mFillArea,
                                                 state.mAnchor + paintBorderArea.TopLeft(),
                                                 clipState.mDirtyRect);
 
-          if (result == DrawResult::SUCCESS) {
-            result = resultForLayer;
-          }
-
           if (state.mCompositionOp != CompositionOp::OP_OVER) {
             ctx->SetOp(CompositionOp::OP_OVER);
           }

From 6b523d316314c59cd9231b7b1f1c74d774062e66 Mon Sep 17 00:00:00 2001
From: Daniel Holbert <dholbert@cs.stanford.edu>
Date: Tue, 13 Oct 2015 23:35:48 -0700
Subject: [PATCH 18/63] Bug 1212191: In CSS mochitest helper-file
 "property_database.js", add subproperties array for aliases that are missing
 it, and make it mandatory for CSS_TYPE_SHORTHAND_AND_LONGHAND. r=heycam

---
 layout/style/test/property_database.js        | 10 ++++++++++
 layout/style/test/test_property_database.html |  4 ++--
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/layout/style/test/property_database.js b/layout/style/test/property_database.js
index e74486493073..bf3ab100dd96 100644
--- a/layout/style/test/property_database.js
+++ b/layout/style/test/property_database.js
@@ -4743,6 +4743,7 @@ if (IsCSSPropertyPrefEnabled("layout.css.vertical-text.enabled")) {
       inherited: false,
       type: CSS_TYPE_SHORTHAND_AND_LONGHAND,
       alias_for: "border-inline-end-color",
+      subproperties: [ "border-inline-end-color" ],
       get_computed: logical_box_prop_get_computed,
     },
     "-moz-border-end-style": {
@@ -4750,6 +4751,7 @@ if (IsCSSPropertyPrefEnabled("layout.css.vertical-text.enabled")) {
       inherited: false,
       type: CSS_TYPE_SHORTHAND_AND_LONGHAND,
       alias_for: "border-inline-end-style",
+      subproperties: [ "border-inline-end-style" ],
       get_computed: logical_box_prop_get_computed,
     },
     "-moz-border-end-width": {
@@ -4757,6 +4759,7 @@ if (IsCSSPropertyPrefEnabled("layout.css.vertical-text.enabled")) {
       inherited: false,
       type: CSS_TYPE_SHORTHAND_AND_LONGHAND,
       alias_for: "border-inline-end-width",
+      subproperties: [ "border-inline-end-width" ],
       get_computed: logical_box_prop_get_computed,
     },
     "-moz-border-start": {
@@ -4771,6 +4774,7 @@ if (IsCSSPropertyPrefEnabled("layout.css.vertical-text.enabled")) {
       inherited: false,
       type: CSS_TYPE_SHORTHAND_AND_LONGHAND,
       alias_for: "border-inline-start-color",
+      subproperties: [ "border-inline-start-color" ],
       get_computed: logical_box_prop_get_computed,
     },
     "-moz-border-start-style": {
@@ -4778,6 +4782,7 @@ if (IsCSSPropertyPrefEnabled("layout.css.vertical-text.enabled")) {
       inherited: false,
       type: CSS_TYPE_SHORTHAND_AND_LONGHAND,
       alias_for: "border-inline-start-style",
+      subproperties: [ "border-inline-start-style" ],
       get_computed: logical_box_prop_get_computed,
     },
     "-moz-border-start-width": {
@@ -4785,6 +4790,7 @@ if (IsCSSPropertyPrefEnabled("layout.css.vertical-text.enabled")) {
       inherited: false,
       type: CSS_TYPE_SHORTHAND_AND_LONGHAND,
       alias_for: "border-inline-start-width",
+      subproperties: [ "border-inline-start-width" ],
       get_computed: logical_box_prop_get_computed,
     },
     "inline-size": {
@@ -4855,6 +4861,7 @@ if (IsCSSPropertyPrefEnabled("layout.css.vertical-text.enabled")) {
       inherited: false,
       type: CSS_TYPE_SHORTHAND_AND_LONGHAND,
       alias_for: "margin-inline-end",
+      subproperties: [ "margin-inline-end" ],
       get_computed: logical_box_prop_get_computed,
     },
     "-moz-margin-start": {
@@ -4862,6 +4869,7 @@ if (IsCSSPropertyPrefEnabled("layout.css.vertical-text.enabled")) {
       inherited: false,
       type: CSS_TYPE_SHORTHAND_AND_LONGHAND,
       alias_for: "margin-inline-start",
+      subproperties: [ "margin-inline-start" ],
       get_computed: logical_box_prop_get_computed,
     },
     "max-block-size": {
@@ -5061,6 +5069,7 @@ if (IsCSSPropertyPrefEnabled("layout.css.vertical-text.enabled")) {
       inherited: false,
       type: CSS_TYPE_SHORTHAND_AND_LONGHAND,
       alias_for: "padding-inline-end",
+      subproperties: [ "padding-inline-end" ],
       get_computed: logical_box_prop_get_computed,
     },
     "-moz-padding-start": {
@@ -5068,6 +5077,7 @@ if (IsCSSPropertyPrefEnabled("layout.css.vertical-text.enabled")) {
       inherited: false,
       type: CSS_TYPE_SHORTHAND_AND_LONGHAND,
       alias_for: "padding-inline-start",
+      subproperties: [ "padding-inline-start" ],
       get_computed: logical_box_prop_get_computed,
     },
   };
diff --git a/layout/style/test/test_property_database.html b/layout/style/test/test_property_database.html
index e8c1b37e5c09..30e6618fcb21 100644
--- a/layout/style/test/test_property_database.html
+++ b/layout/style/test/test_property_database.html
@@ -94,11 +94,11 @@ for (var prop in gCSSProperties) {
   if (entry.type == CSS_TYPE_LONGHAND) {
     ok(!("subproperties" in entry),
        "longhand property '" + prop + "' must not have subproperty list");
-  } else if (entry.type == CSS_TYPE_TRUE_SHORTHAND) {
+  } else if (entry.type == CSS_TYPE_TRUE_SHORTHAND ||
+             entry.type == CSS_TYPE_SHORTHAND_AND_LONGHAND) {
     ok("subproperties" in entry,
        "shorthand property '" + prop + "' must have subproperty list");
   }
-  /* optional for CSS_TYPE_SHORTHAND_AND_LONGHAND */
 
   if ("subproperties" in entry) {
     var good = true;

From 2375870ce26d8a906fee640494a4870e25e0ba33 Mon Sep 17 00:00:00 2001
From: Gian-Carlo Pascutto <gcp@mozilla.com>
Date: Wed, 14 Oct 2015 08:39:10 +0200
Subject: [PATCH 19/63] Bug 1209987 - webrtc.org Engine creation and
 destruction should happen on the WebRTC threads. r=jesup

---
 dom/media/systemservices/CamerasParent.cpp | 386 +++++++++++----------
 dom/media/systemservices/CamerasParent.h   |  25 +-
 2 files changed, 219 insertions(+), 192 deletions(-)

diff --git a/dom/media/systemservices/CamerasParent.cpp b/dom/media/systemservices/CamerasParent.cpp
index f77635f02273..a7584df9d22f 100644
--- a/dom/media/systemservices/CamerasParent.cpp
+++ b/dom/media/systemservices/CamerasParent.cpp
@@ -14,6 +14,7 @@
 #include "mozilla/Logging.h"
 #include "mozilla/ipc/BackgroundParent.h"
 #include "nsThreadUtils.h"
+#include "nsXPCOM.h"
 
 #undef LOG
 #undef LOG_ENABLED
@@ -142,6 +143,79 @@ private:
   int mResult;
 };
 
+NS_IMPL_ISUPPORTS(CamerasParent, nsIObserver)
+
+NS_IMETHODIMP
+CamerasParent::Observe(nsISupports *aSubject,
+                       const char *aTopic,
+                       const char16_t *aData)
+{
+  MOZ_ASSERT(!strcmp(aTopic, NS_XPCOM_WILL_SHUTDOWN_OBSERVER_ID));
+  nsCOMPtr<nsIObserverService> obs = services::GetObserverService();
+  MOZ_ASSERT(obs);
+  obs->RemoveObserver(this, NS_XPCOM_WILL_SHUTDOWN_OBSERVER_ID);
+  StopVideoCapture();
+  return NS_OK;
+}
+
+nsresult
+CamerasParent::DispatchToVideoCaptureThread(nsRunnable *event)
+{
+  MonitorAutoLock lock(mThreadMonitor);
+
+  while(mChildIsAlive && mWebRTCAlive &&
+        (!mVideoCaptureThread || !mVideoCaptureThread->IsRunning())) {
+    mThreadMonitor.Wait();
+  }
+  if (!mVideoCaptureThread || !mVideoCaptureThread->IsRunning()) {
+    return NS_ERROR_FAILURE;
+  }
+  mVideoCaptureThread->message_loop()->PostTask(FROM_HERE,
+                                                new RunnableTask(event));
+  return NS_OK;
+}
+
+void
+CamerasParent::StopVideoCapture()
+{
+  // We are called from the main thread (xpcom-shutdown) or
+  // from PBackground (when the Actor shuts down).
+  // Shut down the WebRTC stack (on the capture thread)
+  nsRefPtr<CamerasParent> self(this);
+  nsRefPtr<nsRunnable> webrtc_runnable =
+    media::NewRunnableFrom([self]() -> nsresult {
+        MonitorAutoLock lock(self->mThreadMonitor);
+        self->CloseEngines();
+        self->mThreadMonitor.NotifyAll();
+        return NS_OK;
+      });
+  DispatchToVideoCaptureThread(webrtc_runnable);
+  // Hold here until the WebRTC thread is gone. We need to dispatch
+  // the thread deletion *now*, or there will be no more possibility
+  // to get to the main thread.
+  MonitorAutoLock lock(mThreadMonitor);
+  while (mWebRTCAlive) {
+    mThreadMonitor.Wait();
+  }
+  // After closing the WebRTC stack, clean up the
+  // VideoCapture thread.
+  if (self->mVideoCaptureThread) {
+    base::Thread *thread = self->mVideoCaptureThread;
+    self->mVideoCaptureThread = nullptr;
+    nsRefPtr<nsRunnable> threadShutdown =
+      media::NewRunnableFrom([thread]() -> nsresult {
+        if (thread->IsRunning()) {
+          thread->Stop();
+        }
+        delete thread;
+        return NS_OK;
+      });
+    if (NS_FAILED(NS_DispatchToMainThread(threadShutdown))) {
+      LOG(("Could not dispatch VideoCaptureThread destruction"));
+    }
+  }
+}
+
 int
 CamerasParent::DeliverFrameOverIPC(CaptureEngine cap_engine,
                                    int cap_id,
@@ -235,6 +309,7 @@ CamerasParent::RecvReleaseFrame(mozilla::ipc::Shmem&& s) {
 bool
 CamerasParent::SetupEngine(CaptureEngine aCapEngine)
 {
+  MOZ_ASSERT(mVideoCaptureThread->thread_id() == PlatformThread::CurrentId());
   EngineHelper *helper = &mEngines[aCapEngine];
 
   // Already initialized
@@ -308,51 +383,57 @@ CamerasParent::SetupEngine(CaptureEngine aCapEngine)
 void
 CamerasParent::CloseEngines()
 {
-  {
-    MutexAutoLock lock(mCallbackMutex);
-    // Stop the callers
-    while (mCallbacks.Length()) {
-      auto capEngine = mCallbacks[0]->mCapEngine;
-      auto capNum = mCallbacks[0]->mCapturerId;
-      LOG(("Forcing shutdown of engine %d, capturer %d", capEngine, capNum));
-      {
-        MutexAutoUnlock unlock(mCallbackMutex);
-        RecvStopCapture(capEngine, capNum);
-        RecvReleaseCaptureDevice(capEngine, capNum);
-      }
-      // The callbacks list might have changed while we released the lock,
-      // but note that due to the loop construct this will not break us.
+  if (!mWebRTCAlive) {
+    return;
+  }
+  MOZ_ASSERT(mVideoCaptureThread->thread_id() == PlatformThread::CurrentId());
+
+  // Stop the callers
+  while (mCallbacks.Length()) {
+    auto capEngine = mCallbacks[0]->mCapEngine;
+    auto capNum = mCallbacks[0]->mCapturerId;
+    LOG(("Forcing shutdown of engine %d, capturer %d", capEngine, capNum));
+    RecvStopCapture(capEngine, capNum);
+    RecvReleaseCaptureDevice(capEngine, capNum);
+  }
+
+  for (int i = 0; i < CaptureEngine::MaxEngine; i++) {
+    if (mEngines[i].mEngineIsRunning) {
+      LOG(("Being closed down while engine %d is running!", i));
+    }
+    if (mEngines[i].mPtrViERender) {
+      mEngines[i].mPtrViERender->Release();
+      mEngines[i].mPtrViERender = nullptr;
+    }
+    if (mEngines[i].mPtrViECapture) {
+      mEngines[i].mPtrViECapture->Release();
+        mEngines[i].mPtrViECapture = nullptr;
+    }
+    if(mEngines[i].mPtrViEBase) {
+      mEngines[i].mPtrViEBase->Release();
+      mEngines[i].mPtrViEBase = nullptr;
+    }
+    if (mEngines[i].mEngine) {
+      mEngines[i].mEngine->SetTraceCallback(nullptr);
+      webrtc::VideoEngine::Delete(mEngines[i].mEngine);
+      mEngines[i].mEngine = nullptr;
     }
   }
 
-  {
-    MutexAutoLock lock(mEngineMutex);
-    for (int i = 0; i < CaptureEngine::MaxEngine; i++) {
-      if (mEngines[i].mEngineIsRunning) {
-        LOG(("Being closed down while engine %d is running!", i));
-      }
-      if (mEngines[i].mPtrViERender) {
-        mEngines[i].mPtrViERender->Release();
-        mEngines[i].mPtrViERender = nullptr;
-      }
-      if (mEngines[i].mPtrViECapture) {
-        mEngines[i].mPtrViECapture->Release();
-        mEngines[i].mPtrViECapture = nullptr;
-      }
-      if(mEngines[i].mPtrViEBase) {
-        mEngines[i].mPtrViEBase->Release();
-        mEngines[i].mPtrViEBase = nullptr;
-      }
-    }
-  }
+  mWebRTCAlive = false;
 }
 
 bool
 CamerasParent::EnsureInitialized(int aEngine)
 {
   LOG((__PRETTY_FUNCTION__));
+  // We're shutting down, don't try to do new WebRTC ops.
+  if (!mWebRTCAlive) {
+    return false;
+  }
   CaptureEngine capEngine = static_cast<CaptureEngine>(aEngine);
   if (!SetupEngine(capEngine)) {
+    LOG(("CamerasParent failed to initialize engine"));
     return false;
   }
 
@@ -368,18 +449,12 @@ bool
 CamerasParent::RecvNumberOfCaptureDevices(const int& aCapEngine)
 {
   LOG((__PRETTY_FUNCTION__));
-  if (!EnsureInitialized(aCapEngine)) {
-    LOG(("RecvNumberOfCaptureDevices fails to initialize"));
-    unused << SendReplyFailure();
-    return false;
-  }
 
   nsRefPtr<CamerasParent> self(this);
   nsRefPtr<nsRunnable> webrtc_runnable =
     media::NewRunnableFrom([self, aCapEngine]() -> nsresult {
-      MutexAutoLock lock(self->mEngineMutex);
       int num = -1;
-      if (self->mEngines[aCapEngine].mPtrViECapture) {
+      if (self->EnsureInitialized(aCapEngine)) {
         num = self->mEngines[aCapEngine].mPtrViECapture->NumberOfCaptureDevices();
       }
       nsRefPtr<nsIRunnable> ipc_runnable =
@@ -400,8 +475,7 @@ CamerasParent::RecvNumberOfCaptureDevices(const int& aCapEngine)
         self->mPBackgroundThread->Dispatch(ipc_runnable, NS_DISPATCH_NORMAL);
       return NS_OK;
     });
-  mVideoCaptureThread->message_loop()->PostTask(FROM_HERE, new RunnableTask(webrtc_runnable));
-
+  DispatchToVideoCaptureThread(webrtc_runnable);
   return true;
 }
 
@@ -410,19 +484,13 @@ CamerasParent::RecvNumberOfCapabilities(const int& aCapEngine,
                                         const nsCString& unique_id)
 {
   LOG((__PRETTY_FUNCTION__));
-  if (!EnsureInitialized(aCapEngine)) {
-    LOG(("RecvNumberOfCapabilities fails to initialize"));
-    unused << SendReplyFailure();
-    return false;
-  }
-
   LOG(("Getting caps for %s", unique_id.get()));
+
   nsRefPtr<CamerasParent> self(this);
   nsRefPtr<nsRunnable> webrtc_runnable =
     media::NewRunnableFrom([self, unique_id, aCapEngine]() -> nsresult {
-      MutexAutoLock lock(self->mEngineMutex);
       int num = -1;
-      if (self->mEngines[aCapEngine].mPtrViECapture) {
+      if (self->EnsureInitialized(aCapEngine)) {
         num =
           self->mEngines[aCapEngine].mPtrViECapture->NumberOfCapabilities(
             unique_id.get(),
@@ -446,7 +514,7 @@ CamerasParent::RecvNumberOfCapabilities(const int& aCapEngine,
       self->mPBackgroundThread->Dispatch(ipc_runnable, NS_DISPATCH_NORMAL);
       return NS_OK;
     });
-  mVideoCaptureThread->message_loop()->PostTask(FROM_HERE, new RunnableTask(webrtc_runnable));
+  DispatchToVideoCaptureThread(webrtc_runnable);
   return true;
 }
 
@@ -456,21 +524,14 @@ CamerasParent::RecvGetCaptureCapability(const int &aCapEngine,
                                         const int& num)
 {
   LOG((__PRETTY_FUNCTION__));
-  if (!EnsureInitialized(aCapEngine)) {
-    LOG(("Fails to initialize"));
-    unused << SendReplyFailure();
-    return false;
-  }
-
   LOG(("RecvGetCaptureCapability: %s %d", unique_id.get(), num));
 
   nsRefPtr<CamerasParent> self(this);
   nsRefPtr<nsRunnable> webrtc_runnable =
     media::NewRunnableFrom([self, unique_id, aCapEngine, num]() -> nsresult {
       webrtc::CaptureCapability webrtcCaps;
-      MutexAutoLock lock(self->mEngineMutex);
       int error = -1;
-      if (self->mEngines[aCapEngine].mPtrViECapture) {
+      if (self->EnsureInitialized(aCapEngine)) {
         error = self->mEngines[aCapEngine].mPtrViECapture->GetCaptureCapability(
           unique_id.get(), MediaEngineSource::kMaxUniqueIdLength, num, webrtcCaps);
       }
@@ -503,7 +564,7 @@ CamerasParent::RecvGetCaptureCapability(const int &aCapEngine,
       self->mPBackgroundThread->Dispatch(ipc_runnable, NS_DISPATCH_NORMAL);
       return NS_OK;
     });
-  mVideoCaptureThread->message_loop()->PostTask(FROM_HERE, new RunnableTask(webrtc_runnable));
+  DispatchToVideoCaptureThread(webrtc_runnable);
   return true;
 }
 
@@ -512,13 +573,7 @@ CamerasParent::RecvGetCaptureDevice(const int& aCapEngine,
                                     const int& aListNumber)
 {
   LOG((__PRETTY_FUNCTION__));
-  if (!EnsureInitialized(aCapEngine)) {
-    LOG(("Fails to initialize"));
-    unused << SendReplyFailure();
-    return false;
-  }
 
-  LOG(("RecvGetCaptureDevice"));
   nsRefPtr<CamerasParent> self(this);
   nsRefPtr<nsRunnable> webrtc_runnable =
     media::NewRunnableFrom([self, aCapEngine, aListNumber]() -> nsresult {
@@ -526,20 +581,18 @@ CamerasParent::RecvGetCaptureDevice(const int& aCapEngine,
       char deviceUniqueId[MediaEngineSource::kMaxUniqueIdLength];
       nsCString name;
       nsCString uniqueId;
-      MutexAutoLock lock(self->mEngineMutex);
       int error = -1;
-      if (self->mEngines[aCapEngine].mPtrViECapture) {
-        error = self->mEngines[aCapEngine].mPtrViECapture->GetCaptureDevice(aListNumber,
-                                                                            deviceName,
-                                                                            sizeof(deviceName),
-                                                                            deviceUniqueId,
-                                                                            sizeof(deviceUniqueId));
+      if (self->EnsureInitialized(aCapEngine)) {
+          error = self->mEngines[aCapEngine].mPtrViECapture->GetCaptureDevice(aListNumber,
+                                                                              deviceName,
+                                                                              sizeof(deviceName),
+                                                                              deviceUniqueId,
+                                                                              sizeof(deviceUniqueId));
       }
       if (!error) {
         name.Assign(deviceName);
         uniqueId.Assign(deviceUniqueId);
       }
-
       nsRefPtr<nsIRunnable> ipc_runnable =
         media::NewRunnableFrom([self, error, name, uniqueId]() -> nsresult {
           if (self->IsShuttingDown()) {
@@ -558,7 +611,7 @@ CamerasParent::RecvGetCaptureDevice(const int& aCapEngine,
       self->mPBackgroundThread->Dispatch(ipc_runnable, NS_DISPATCH_NORMAL);
       return NS_OK;
     });
-  mVideoCaptureThread->message_loop()->PostTask(FROM_HERE, new RunnableTask(webrtc_runnable));
+  DispatchToVideoCaptureThread(webrtc_runnable);
   return true;
 }
 
@@ -567,19 +620,13 @@ CamerasParent::RecvAllocateCaptureDevice(const int& aCapEngine,
                                          const nsCString& unique_id)
 {
   LOG((__PRETTY_FUNCTION__));
-  if (!EnsureInitialized(aCapEngine)) {
-    LOG(("Fails to initialize"));
-    unused << SendReplyFailure();
-    return false;
-  }
 
   nsRefPtr<CamerasParent> self(this);
   nsRefPtr<nsRunnable> webrtc_runnable =
     media::NewRunnableFrom([self, aCapEngine, unique_id]() -> nsresult {
       int numdev = -1;
-      MutexAutoLock lock(self->mEngineMutex);
       int error = -1;
-      if (self->mEngines[aCapEngine].mPtrViECapture) {
+      if (self->EnsureInitialized(aCapEngine)) {
         error = self->mEngines[aCapEngine].mPtrViECapture->AllocateCaptureDevice(
           unique_id.get(), MediaEngineSource::kMaxUniqueIdLength, numdev);
       }
@@ -600,7 +647,7 @@ CamerasParent::RecvAllocateCaptureDevice(const int& aCapEngine,
       self->mPBackgroundThread->Dispatch(ipc_runnable, NS_DISPATCH_NORMAL);
       return NS_OK;
     });
-  mVideoCaptureThread->message_loop()->PostTask(FROM_HERE, new RunnableTask(webrtc_runnable));
+  DispatchToVideoCaptureThread(webrtc_runnable);
   return true;
 }
 
@@ -609,19 +656,13 @@ CamerasParent::RecvReleaseCaptureDevice(const int& aCapEngine,
                                         const int& numdev)
 {
   LOG((__PRETTY_FUNCTION__));
-  if (!EnsureInitialized(aCapEngine)) {
-    LOG(("Fails to initialize"));
-    unused << SendReplyFailure();
-    return false;
-  }
+  LOG(("RecvReleaseCamera device nr %d", numdev));
 
   nsRefPtr<CamerasParent> self(this);
   nsRefPtr<nsRunnable> webrtc_runnable =
     media::NewRunnableFrom([self, aCapEngine, numdev]() -> nsresult {
-      LOG(("RecvReleaseCamera device nr %d", numdev));
-      MutexAutoLock lock(self->mEngineMutex);
       int error = -1;
-      if (self->mEngines[aCapEngine].mPtrViECapture) {
+      if (self->EnsureInitialized(aCapEngine)) {
         error = self->mEngines[aCapEngine].mPtrViECapture->ReleaseCaptureDevice(numdev);
       }
       nsRefPtr<nsIRunnable> ipc_runnable =
@@ -641,12 +682,7 @@ CamerasParent::RecvReleaseCaptureDevice(const int& aCapEngine,
       self->mPBackgroundThread->Dispatch(ipc_runnable, NS_DISPATCH_NORMAL);
       return NS_OK;
     });
-#ifndef XP_MACOSX
-  mVideoCaptureThread->message_loop()->PostTask(FROM_HERE, new RunnableTask(webrtc_runnable));
-#else
-  // Mac OS X hangs on shutdown if we don't do this on the main thread.
-  NS_DispatchToMainThread(webrtc_runnable);
-#endif
+  DispatchToVideoCaptureThread(webrtc_runnable);
   return true;
 }
 
@@ -656,11 +692,6 @@ CamerasParent::RecvStartCapture(const int& aCapEngine,
                                 const CaptureCapability& ipcCaps)
 {
   LOG((__PRETTY_FUNCTION__));
-  if (!EnsureInitialized(aCapEngine)) {
-    LOG(("Failure to initialize"));
-    unused << SendReplyFailure();
-    return false;
-  }
 
   nsRefPtr<CamerasParent> self(this);
   nsRefPtr<nsRunnable> webrtc_runnable =
@@ -668,23 +699,15 @@ CamerasParent::RecvStartCapture(const int& aCapEngine,
       CallbackHelper** cbh;
       webrtc::ExternalRenderer* render;
       EngineHelper* helper = nullptr;
-      int error;
-      {
-        MutexAutoLock lockCallback(self->mCallbackMutex);
+      int error = -1;
+      if (self->EnsureInitialized(aCapEngine)) {
         cbh = self->mCallbacks.AppendElement(
           new CallbackHelper(static_cast<CaptureEngine>(aCapEngine), capnum, self));
         render = static_cast<webrtc::ExternalRenderer*>(*cbh);
-      }
-      {
-        MutexAutoLock lockEngine(self->mEngineMutex);
-        if (self->mEngines[aCapEngine].mPtrViECapture) {
-          helper = &self->mEngines[aCapEngine];
-          error =
-            helper->mPtrViERender->AddRenderer(capnum, webrtc::kVideoI420, render);
-        } else {
-          error = -1;
-        }
 
+        helper = &self->mEngines[aCapEngine];
+        error =
+          helper->mPtrViERender->AddRenderer(capnum, webrtc::kVideoI420, render);
         if (!error) {
           error = helper->mPtrViERender->StartRender(capnum);
         }
@@ -705,7 +728,6 @@ CamerasParent::RecvStartCapture(const int& aCapEngine,
           helper->mEngineIsRunning = true;
         }
       }
-
       nsRefPtr<nsIRunnable> ipc_runnable =
         media::NewRunnableFrom([self, error]() -> nsresult {
           if (self->IsShuttingDown()) {
@@ -722,7 +744,7 @@ CamerasParent::RecvStartCapture(const int& aCapEngine,
       self->mPBackgroundThread->Dispatch(ipc_runnable, NS_DISPATCH_NORMAL);
       return NS_OK;
     });
-  mVideoCaptureThread->message_loop()->PostTask(FROM_HERE, new RunnableTask(webrtc_runnable));
+  DispatchToVideoCaptureThread(webrtc_runnable);
   return true;
 }
 
@@ -731,40 +753,32 @@ CamerasParent::RecvStopCapture(const int& aCapEngine,
                                const int& capnum)
 {
   LOG((__PRETTY_FUNCTION__));
-  if (!EnsureInitialized(aCapEngine)) {
-    LOG(("Failure to initialize"));
-    unused << SendReplyFailure();
-    return false;
-  }
 
   nsRefPtr<CamerasParent> self(this);
   nsRefPtr<nsRunnable> webrtc_runnable =
     media::NewRunnableFrom([self, aCapEngine, capnum]() -> nsresult {
-      {
-        MutexAutoLock lock(self->mEngineMutex);
-        // We only need to check mPtrViECapture as all other engines are guaranteed
-        // to be nulled under the same lock.
-        if (self->mEngines[aCapEngine].mPtrViECapture) {
-          self->mEngines[aCapEngine].mPtrViECapture->StopCapture(capnum);
-          self->mEngines[aCapEngine].mPtrViERender->StopRender(capnum);
-          self->mEngines[aCapEngine].mPtrViERender->RemoveRenderer(capnum);
-          self->mEngines[aCapEngine].mEngineIsRunning = false;
-        }
-      }
-      MutexAutoLock lock(self->mCallbackMutex);
-      for (unsigned int i = 0; i < self->mCallbacks.Length(); i++) {
-        if (self->mCallbacks[i]->mCapEngine == aCapEngine
-            && self->mCallbacks[i]->mCapturerId == capnum) {
-          delete self->mCallbacks[i];
-          self->mCallbacks.RemoveElementAt(i);
-          break;
+      if (self->EnsureInitialized(aCapEngine)) {
+        self->mEngines[aCapEngine].mPtrViECapture->StopCapture(capnum);
+        self->mEngines[aCapEngine].mPtrViERender->StopRender(capnum);
+        self->mEngines[aCapEngine].mPtrViERender->RemoveRenderer(capnum);
+        self->mEngines[aCapEngine].mEngineIsRunning = false;
+
+        for (size_t i = 0; i < self->mCallbacks.Length(); i++) {
+          if (self->mCallbacks[i]->mCapEngine == aCapEngine
+              && self->mCallbacks[i]->mCapturerId == capnum) {
+            delete self->mCallbacks[i];
+            self->mCallbacks.RemoveElementAt(i);
+            break;
+          }
         }
       }
       return NS_OK;
     });
-
-  mVideoCaptureThread->message_loop()->PostTask(FROM_HERE, new RunnableTask(webrtc_runnable));
-  return SendReplySuccess();
+  if (NS_SUCCEEDED(DispatchToVideoCaptureThread(webrtc_runnable))) {
+    return SendReplySuccess();
+  } else {
+    return SendReplyFailure();
+  }
 }
 
 void
@@ -788,49 +802,24 @@ CamerasParent::RecvAllDone()
   return Send__delete__(this);
 }
 
-void CamerasParent::DoShutdown()
-{
-  LOG((__PRETTY_FUNCTION__));
-  CloseEngines();
-
-  {
-    MutexAutoLock lock(mEngineMutex);
-    for (int i = 0; i < CaptureEngine::MaxEngine; i++) {
-      if (mEngines[i].mEngine) {
-        mEngines[i].mEngine->SetTraceCallback(nullptr);
-        webrtc::VideoEngine::Delete(mEngines[i].mEngine);
-        mEngines[i].mEngine = nullptr;
-      }
-    }
-  }
-
-  mPBackgroundThread = nullptr;
-
-  if (mVideoCaptureThread) {
-    if (mVideoCaptureThread->IsRunning()) {
-      mVideoCaptureThread->Stop();
-    }
-    delete mVideoCaptureThread;
-    mVideoCaptureThread = nullptr;
-  }
-}
-
 void
 CamerasParent::ActorDestroy(ActorDestroyReason aWhy)
 {
   // No more IPC from here
   LOG((__PRETTY_FUNCTION__));
   StopIPC();
-  CloseEngines();
+  // Shut down WebRTC (if we're not in full shutdown, else this
+  // will already have happened)
+  StopVideoCapture();
 }
 
 CamerasParent::CamerasParent()
-  : mCallbackMutex("CamerasParent.mCallbackMutex"),
-    mEngineMutex("CamerasParent.mEngineMutex"),
-    mShmemPool(CaptureEngine::MaxEngine),
+  : mShmemPool(CaptureEngine::MaxEngine),
+    mThreadMonitor("CamerasParent::mThreadMonitor"),
     mVideoCaptureThread(nullptr),
     mChildIsAlive(true),
-    mDestroyed(false)
+    mDestroyed(false),
+    mWebRTCAlive(true)
 {
   if (!gCamerasParentLog) {
     gCamerasParentLog = PR_NewLogModule("CamerasParent");
@@ -841,16 +830,37 @@ CamerasParent::CamerasParent()
   MOZ_ASSERT(mPBackgroundThread != nullptr, "GetCurrentThread failed");
 
   LOG(("Spinning up WebRTC Cameras Thread"));
-  mVideoCaptureThread = new base::Thread("VideoCapture");
-  base::Thread::Options options;
+
+  nsRefPtr<CamerasParent> self(this);
+  nsRefPtr<nsRunnable> threadStart =
+    media::NewRunnableFrom([self]() -> nsresult {
+      // Register thread shutdown observer
+      nsCOMPtr<nsIObserverService> obs = services::GetObserverService();
+      if (NS_WARN_IF(!obs)) {
+        return NS_ERROR_FAILURE;
+      }
+      nsresult rv =
+        obs->AddObserver(self, NS_XPCOM_WILL_SHUTDOWN_OBSERVER_ID, false);
+      if (NS_WARN_IF(NS_FAILED(rv))) {
+        return rv;
+      }
+      // Start the thread
+      MonitorAutoLock lock(self->mThreadMonitor);
+      self->mVideoCaptureThread = new base::Thread("VideoCapture");
+      base::Thread::Options options;
 #if defined(_WIN32)
-  options.message_loop_type = MessageLoop::TYPE_MOZILLA_NONMAINUITHREAD;
+      options.message_loop_type = MessageLoop::TYPE_MOZILLA_NONMAINUITHREAD;
 #else
-  options.message_loop_type = MessageLoop::TYPE_MOZILLA_NONMAINTHREAD;
+
+      options.message_loop_type = MessageLoop::TYPE_MOZILLA_NONMAINTHREAD;
 #endif
-  if (!mVideoCaptureThread->StartWithOptions(options)) {
-    MOZ_CRASH();
-  }
+      if (!self->mVideoCaptureThread->StartWithOptions(options)) {
+        MOZ_CRASH();
+      }
+      self->mThreadMonitor.NotifyAll();
+      return NS_OK;
+    });
+  NS_DispatchToMainThread(threadStart);
 
   MOZ_COUNT_CTOR(CamerasParent);
 }
@@ -860,7 +870,15 @@ CamerasParent::~CamerasParent()
   LOG(("~CamerasParent: %p", this));
 
   MOZ_COUNT_DTOR(CamerasParent);
-  DoShutdown();
+#ifdef DEBUG
+  // Verify we have shut down the webrtc engines, this is
+  // supposed to happen in ActorDestroy.
+  // That runnable takes a ref to us, so it must have finished
+  // by the time we get here.
+  for (int i = 0; i < CaptureEngine::MaxEngine; i++) {
+    MOZ_ASSERT(!mEngines[i].mEngine);
+  }
+#endif
 }
 
 already_AddRefed<CamerasParent>
diff --git a/dom/media/systemservices/CamerasParent.h b/dom/media/systemservices/CamerasParent.h
index dfdd2d2d6abc..db08834fff0a 100644
--- a/dom/media/systemservices/CamerasParent.h
+++ b/dom/media/systemservices/CamerasParent.h
@@ -7,10 +7,12 @@
 #ifndef mozilla_CamerasParent_h
 #define mozilla_CamerasParent_h
 
+#include "nsIObserver.h"
 #include "mozilla/dom/ContentParent.h"
 #include "mozilla/camera/PCamerasParent.h"
 #include "mozilla/ipc/Shmem.h"
 #include "mozilla/ShmemPool.h"
+#include "mozilla/Atomics.h"
 
 // conflicts with #include of scoped_ptr.h
 #undef FF
@@ -73,9 +75,11 @@ public:
   bool mEngineIsRunning;
 };
 
-class CamerasParent :  public PCamerasParent
+class CamerasParent :  public PCamerasParent,
+                       public nsIObserver
 {
-  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(CamerasParent);
+  NS_DECL_THREADSAFE_ISUPPORTS
+  NS_DECL_NSIOBSERVER
 
 public:
   static already_AddRefed<CamerasParent> Create();
@@ -94,7 +98,9 @@ public:
   virtual void ActorDestroy(ActorDestroyReason aWhy) override;
 
   nsIThread* GetBackgroundThread() { return mPBackgroundThread; };
-  bool IsShuttingDown() { return !mChildIsAlive || mDestroyed; };
+  bool IsShuttingDown() { return !mChildIsAlive
+                              ||  mDestroyed
+                              || !mWebRTCAlive; };
   ShmemBuffer GetBuffer(size_t aSize);
 
   // helper to forward to the PBackground thread
@@ -116,15 +122,12 @@ protected:
   bool SetupEngine(CaptureEngine aCapEngine);
   void CloseEngines();
   bool EnsureInitialized(int aEngine);
-  void DoShutdown();
   void StopIPC();
+  void StopVideoCapture();
+  nsresult DispatchToVideoCaptureThread(nsRunnable *event);
 
   EngineHelper mEngines[CaptureEngine::MaxEngine];
   nsTArray<CallbackHelper*> mCallbacks;
-  // Protects the callback arrays
-  Mutex mCallbackMutex;
-  // Protects the engines array
-  Mutex mEngineMutex;
 
   // image buffers
   mozilla::ShmemPool mShmemPool;
@@ -132,12 +135,18 @@ protected:
   // PBackground parent thread
   nsCOMPtr<nsIThread> mPBackgroundThread;
 
+  // Monitors creation of the thread below
+  Monitor mThreadMonitor;
+
   // video processing thread - where webrtc.org capturer code runs
   base::Thread* mVideoCaptureThread;
 
   // Shutdown handling
   bool mChildIsAlive;
   bool mDestroyed;
+  // Above 2 are PBackground only, but this is potentially
+  // read cross-thread.
+  mozilla::Atomic<bool> mWebRTCAlive;
 };
 
 PCamerasParent* CreateCamerasParent();

From efe66b4acaa9654ce35154e6054558991687acb8 Mon Sep 17 00:00:00 2001
From: Chris Pearce <cpearce@mozilla.com>
Date: Wed, 14 Oct 2015 19:42:24 +1300
Subject: [PATCH 20/63] Bug 1214469 - Ensure gmp-clearkey accounts for
 mNumInputTasks when flushing. r=gerald

---
 media/gmp-clearkey/0.1/VideoDecoder.cpp | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/media/gmp-clearkey/0.1/VideoDecoder.cpp b/media/gmp-clearkey/0.1/VideoDecoder.cpp
index 8259ace8f4f3..92786ca5f993 100644
--- a/media/gmp-clearkey/0.1/VideoDecoder.cpp
+++ b/media/gmp-clearkey/0.1/VideoDecoder.cpp
@@ -141,17 +141,17 @@ VideoDecoder::DecodeTask(GMPVideoEncodedFrame* aInput)
   AutoReleaseVideoFrame ensureFrameReleased(aInput);
   HRESULT hr;
 
-  if (mIsFlushing) {
-    CK_LOGD("VideoDecoder::DecodeTask rejecting frame: flushing.");
-    return;
-  }
-
   {
     AutoLock lock(mMutex);
     mNumInputTasks--;
     assert(mNumInputTasks >= 0);
   }
 
+  if (mIsFlushing) {
+    CK_LOGD("VideoDecoder::DecodeTask rejecting frame: flushing.");
+    return;
+  }
+
   if (!aInput || !mHostAPI || !mDecoder) {
     CK_LOGE("Decode job not set up correctly!");
     return;

From 7f29db1d5a3b54136534b5684066e389805e9fea Mon Sep 17 00:00:00 2001
From: Chris Pearce <cpearce@mozilla.com>
Date: Wed, 14 Oct 2015 19:42:24 +1300
Subject: [PATCH 21/63] Bug 1214478 - Ensure MediaKeySession.close() does not
 store its promise twice. r=gerald

---
 dom/media/eme/MediaKeySession.cpp     |  2 +-
 dom/media/eme/MediaKeys.cpp           |  8 ++++++++
 dom/media/test/eme.js                 | 14 ++++++++++++++
 dom/media/test/test_eme_playback.html |  2 +-
 4 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/dom/media/eme/MediaKeySession.cpp b/dom/media/eme/MediaKeySession.cpp
index 72729bb58c74..d3a10737ddde 100644
--- a/dom/media/eme/MediaKeySession.cpp
+++ b/dom/media/eme/MediaKeySession.cpp
@@ -315,7 +315,7 @@ MediaKeySession::Close(ErrorResult& aRv)
     return promise.forget();
   }
   PromiseId pid = mKeys->StorePromise(promise);
-  mKeys->GetCDMProxy()->CloseSession(mSessionId, mKeys->StorePromise(promise));
+  mKeys->GetCDMProxy()->CloseSession(mSessionId, pid);
 
   EME_LOG("MediaKeySession[%p,'%s'] Close() sent to CDM, promiseId=%d",
           this, NS_ConvertUTF16toUTF8(mSessionId).get(), pid);
diff --git a/dom/media/eme/MediaKeys.cpp b/dom/media/eme/MediaKeys.cpp
index c73659a631e1..451049045f15 100644
--- a/dom/media/eme/MediaKeys.cpp
+++ b/dom/media/eme/MediaKeys.cpp
@@ -180,6 +180,13 @@ MediaKeys::StorePromise(DetailedPromise* aPromise)
   // promises are rejected in Shutdown().
   AddRef();
 
+#ifdef DEBUG
+  // We should not have already stored this promise!
+  for (auto iter = mPromises.ConstIter(); !iter.Done(); iter.Next()) {
+    MOZ_ASSERT(iter.Data() != aPromise);
+  }
+#endif
+
   mPromises.Put(id, aPromise);
   return id;
 }
@@ -274,6 +281,7 @@ MediaKeys::ResolvePromise(PromiseId aId)
   } else {
     promise->MaybeResolve(JS::UndefinedHandleValue);
   }
+  MOZ_ASSERT(!mPromises.Contains(aId));
 }
 
 already_AddRefed<DetailedPromise>
diff --git a/dom/media/test/eme.js b/dom/media/test/eme.js
index 64d2217e52cf..a2776d19e2d1 100644
--- a/dom/media/test/eme.js
+++ b/dom/media/test/eme.js
@@ -277,6 +277,19 @@ function SetupEME(test, token, params)
 {
   var v = document.createElement("video");
   v.crossOrigin = test.crossOrigin || false;
+  v.sessions = [];
+
+  v.closeSessions = function() {
+    return Promise.all(v.sessions.map(s => s.close().then(() => s.closed))).then(
+      () => {
+        v.setMediaKeys(null);
+        if (v.parentNode) {
+          v.parentNode.removeChild(v);
+        }
+        v.onerror = null;
+        v.src = null;
+      });
+  };
 
   // Log events dispatched to make debugging easier...
   [ "canplay", "canplaythrough", "ended", "error", "loadeddata",
@@ -311,6 +324,7 @@ function SetupEME(test, token, params)
     if (params && params.onsessioncreated) {
       params.onsessioncreated(session);
     }
+    v.sessions.push(session);
 
     return new Promise(function (resolve, reject) {
       session.addEventListener("message", UpdateSessionFunc(test, token, sessionType, resolve, reject));
diff --git a/dom/media/test/test_eme_playback.html b/dom/media/test/test_eme_playback.html
index 239d9176c038..2823a6ae38ac 100644
--- a/dom/media/test/test_eme_playback.html
+++ b/dom/media/test/test_eme_playback.html
@@ -95,7 +95,7 @@ function startTest(test, token)
       ok(keyIdsReceived[kid], TimeStamp(token) + " key with id " + kid + " was usable as expected");
     }
 
-    manager.finished(token);
+    v.closeSessions().then(() => manager.finished(token));
   });
 
   LoadTest(test, v, token)

From 2c28e666652fe8b9f4d8dcc098d15609ac776477 Mon Sep 17 00:00:00 2001
From: Chris Pearce <cpearce@mozilla.com>
Date: Wed, 14 Oct 2015 19:42:25 +1300
Subject: [PATCH 22/63] Bug 1209385 - Backout 417dab86a413 and 6078e8b4878b.
 r=backout

---
 dom/media/gmp/GMPChild.cpp              | 15 ++----------
 dom/media/gmp/GMPChild.h                |  2 +-
 dom/media/gmp/GMPContentParent.cpp      | 12 ----------
 dom/media/gmp/GMPContentParent.h        |  3 ---
 dom/media/gmp/GMPMessageUtils.h         |  9 -------
 dom/media/gmp/GMPParent.cpp             |  4 ++--
 dom/media/gmp/GMPParent.h               |  3 +--
 dom/media/gmp/GMPServiceChild.cpp       | 32 -------------------------
 dom/media/gmp/GMPServiceChild.h         |  3 ---
 dom/media/gmp/GMPServiceParent.cpp      | 32 +------------------------
 dom/media/gmp/GMPServiceParent.h        |  5 ----
 dom/media/gmp/GMPUtils.h                |  6 -----
 dom/media/gmp/GMPVideoDecoderParent.cpp |  1 -
 dom/media/gmp/PGMP.ipdl                 |  3 +--
 dom/media/gmp/PGMPService.ipdl          |  3 ---
 modules/libpref/init/all.js             |  2 --
 16 files changed, 8 insertions(+), 127 deletions(-)

diff --git a/dom/media/gmp/GMPChild.cpp b/dom/media/gmp/GMPChild.cpp
index 8226396b2bf5..8d0279ecea53 100644
--- a/dom/media/gmp/GMPChild.cpp
+++ b/dom/media/gmp/GMPChild.cpp
@@ -599,21 +599,10 @@ GMPChild::GetGMPStorage()
   return mStorage;
 }
 
-static MOZ_NEVER_INLINE void
-CrashForApiTimeout()
-{
-  // Never inline so that crash reports are distinctive.
-  MOZ_CRASH("Bug 1209385; GMP API actor failed to respond.");
-}
-
 bool
-GMPChild::RecvCrashPluginNow(const GMPCrashReason& aReason)
+GMPChild::RecvCrashPluginNow()
 {
-  if (aReason == kGmpApiTimeout) {
-    CrashForApiTimeout();
-  } else {
-    MOZ_CRASH();
-  }
+  MOZ_CRASH();
   return true;
 }
 
diff --git a/dom/media/gmp/GMPChild.h b/dom/media/gmp/GMPChild.h
index 5fb5ea3d6b3e..bb75939125bf 100644
--- a/dom/media/gmp/GMPChild.h
+++ b/dom/media/gmp/GMPChild.h
@@ -71,7 +71,7 @@ private:
                                                   ProcessId aOtherPid) override;
   void GMPContentChildActorDestroy(GMPContentChild* aGMPContentChild);
 
-  virtual bool RecvCrashPluginNow(const GMPCrashReason& aReason) override;
+  virtual bool RecvCrashPluginNow() override;
   virtual bool RecvBeginAsyncShutdown() override;
   virtual bool RecvCloseActive() override;
 
diff --git a/dom/media/gmp/GMPContentParent.cpp b/dom/media/gmp/GMPContentParent.cpp
index 9cbb58cb1e45..2e692a0e573f 100644
--- a/dom/media/gmp/GMPContentParent.cpp
+++ b/dom/media/gmp/GMPContentParent.cpp
@@ -118,18 +118,6 @@ GMPContentParent::DecryptorDestroyed(GMPDecryptorParent* aSession)
   CloseIfUnused();
 }
 
-void
-GMPContentParent::CrashPluginNow(GMPCrashReason aReason)
-{
-  if (mParent) {
-    mParent->Crash(aReason);
-  } else {
-    nsRefPtr<GeckoMediaPluginServiceChild> gmp(
-      GeckoMediaPluginServiceChild::GetSingleton());
-    gmp->CrashPluginNow(mPluginId, aReason);
-  }
-}
-
 void
 GMPContentParent::CloseIfUnused()
 {
diff --git a/dom/media/gmp/GMPContentParent.h b/dom/media/gmp/GMPContentParent.h
index 89b3ed337944..b1747a60215d 100644
--- a/dom/media/gmp/GMPContentParent.h
+++ b/dom/media/gmp/GMPContentParent.h
@@ -9,7 +9,6 @@
 #include "mozilla/gmp/PGMPContentParent.h"
 #include "GMPSharedMemManager.h"
 #include "nsISupportsImpl.h"
-#include "GMPUtils.h"
 
 namespace mozilla {
 namespace gmp {
@@ -62,8 +61,6 @@ public:
     return mPluginId;
   }
 
-  void CrashPluginNow(GMPCrashReason aReason);
-
 private:
   ~GMPContentParent();
 
diff --git a/dom/media/gmp/GMPMessageUtils.h b/dom/media/gmp/GMPMessageUtils.h
index af84c52fa0e1..471f928e5e6d 100644
--- a/dom/media/gmp/GMPMessageUtils.h
+++ b/dom/media/gmp/GMPMessageUtils.h
@@ -11,8 +11,6 @@
 #include "gmp-audio-codec.h"
 #include "gmp-decryption.h"
 
-#include "GMPUtils.h"
-
 namespace IPC {
 
 template <>
@@ -249,13 +247,6 @@ struct ParamTraits<GMPVideoCodec>
   }
 };
 
-template <>
-struct ParamTraits<mozilla::GMPCrashReason>
-  : public ContiguousEnumSerializer<mozilla::GMPCrashReason,
-  mozilla::kPrefChange,
-  mozilla::kInvalid>
-{};
-
 } // namespace IPC
 
 #endif // GMPMessageUtils_h_
diff --git a/dom/media/gmp/GMPParent.cpp b/dom/media/gmp/GMPParent.cpp
index 870fb3f64379..1e027f0cdbbc 100644
--- a/dom/media/gmp/GMPParent.cpp
+++ b/dom/media/gmp/GMPParent.cpp
@@ -119,10 +119,10 @@ GMPParent::Init(GeckoMediaPluginServiceParent* aService, nsIFile* aPluginDir)
 }
 
 void
-GMPParent::Crash(GMPCrashReason aReason)
+GMPParent::Crash()
 {
   if (mState != GMPStateNotLoaded) {
-    unused << SendCrashPluginNow(aReason);
+    unused << SendCrashPluginNow();
   }
 }
 
diff --git a/dom/media/gmp/GMPParent.h b/dom/media/gmp/GMPParent.h
index 1fbbe738f039..130f1d52a990 100644
--- a/dom/media/gmp/GMPParent.h
+++ b/dom/media/gmp/GMPParent.h
@@ -22,7 +22,6 @@
 #include "nsTArray.h"
 #include "nsIFile.h"
 #include "ThreadSafeRefcountingWithMainThreadDestruction.h"
-#include "GMPUtils.h"
 
 class nsIThread;
 
@@ -80,7 +79,7 @@ public:
   nsresult Init(GeckoMediaPluginServiceParent* aService, nsIFile* aPluginDir);
   nsresult CloneFrom(const GMPParent* aOther);
 
-  void Crash(GMPCrashReason aReason);
+  void Crash();
 
   nsresult LoadProcess();
 
diff --git a/dom/media/gmp/GMPServiceChild.cpp b/dom/media/gmp/GMPServiceChild.cpp
index 671887fee1b2..fa4f6fd58328 100644
--- a/dom/media/gmp/GMPServiceChild.cpp
+++ b/dom/media/gmp/GMPServiceChild.cpp
@@ -215,38 +215,6 @@ GeckoMediaPluginServiceChild::UpdateTrialCreateState(const nsAString& aKeySystem
   return NS_OK;
 }
 
-void
-GeckoMediaPluginServiceChild::CrashPluginNow(uint32_t aPluginId, GMPCrashReason aReason)
-{
-  if (NS_GetCurrentThread() != mGMPThread) {
-    mGMPThread->Dispatch(NS_NewRunnableMethodWithArgs<uint32_t, GMPCrashReason>(
-      this, &GeckoMediaPluginServiceChild::CrashPluginNow,
-      aPluginId, aReason), NS_DISPATCH_NORMAL);
-    return;
-  }
-
-  class Callback : public GetServiceChildCallback
-  {
-  public:
-    Callback(uint32_t aPluginId, GMPCrashReason aReason)
-      : mPluginId(aPluginId)
-      , mReason(aReason)
-    { }
-
-    virtual void Done(GMPServiceChild* aService) override
-    {
-      aService->SendCrashPluginNow(mPluginId, mReason);
-    }
-
-  private:
-    uint32_t mPluginId;
-    GMPCrashReason mReason;
-  };
-
-  UniquePtr<GetServiceChildCallback> callback(new Callback(aPluginId, aReason));
-  GetServiceChild(Move(callback));
-}
-
 NS_IMETHODIMP
 GeckoMediaPluginServiceChild::Observe(nsISupports* aSubject,
                                       const char* aTopic,
diff --git a/dom/media/gmp/GMPServiceChild.h b/dom/media/gmp/GMPServiceChild.h
index 717c2659e201..8f529cb1d263 100644
--- a/dom/media/gmp/GMPServiceChild.h
+++ b/dom/media/gmp/GMPServiceChild.h
@@ -11,7 +11,6 @@
 #include "mozilla/ipc/Transport.h"
 #include "mozilla/gmp/PGMPServiceChild.h"
 #include "nsRefPtrHashtable.h"
-#include "GMPUtils.h"
 
 namespace mozilla {
 namespace gmp {
@@ -53,8 +52,6 @@ public:
   NS_IMETHOD UpdateTrialCreateState(const nsAString& aKeySystem,
                                     uint32_t aState) override;
 
-  void CrashPluginNow(uint32_t aPluginId, GMPCrashReason aReason);
-
   NS_DECL_NSIOBSERVER
 
   void SetServiceChild(UniquePtr<GMPServiceChild>&& aServiceChild);
diff --git a/dom/media/gmp/GMPServiceParent.cpp b/dom/media/gmp/GMPServiceParent.cpp
index 68c354199a4c..469c32a548bd 100644
--- a/dom/media/gmp/GMPServiceParent.cpp
+++ b/dom/media/gmp/GMPServiceParent.cpp
@@ -84,7 +84,6 @@ NS_IMPL_ISUPPORTS_INHERITED(GeckoMediaPluginServiceParent,
 
 static int32_t sMaxAsyncShutdownWaitMs = 0;
 static bool sHaveSetTimeoutPrefCache = false;
-static bool sKillHungPlugins = true;
 
 GeckoMediaPluginServiceParent::GeckoMediaPluginServiceParent()
   : mShuttingDown(false)
@@ -100,9 +99,6 @@ GeckoMediaPluginServiceParent::GeckoMediaPluginServiceParent()
     Preferences::AddIntVarCache(&sMaxAsyncShutdownWaitMs,
                                 "media.gmp.async-shutdown-timeout",
                                 GMP_DEFAULT_ASYNC_SHUTDONW_TIMEOUT);
-    Preferences::AddBoolVarCache(&sKillHungPlugins,
-                                "media.gmp.kill-hung-plugins",
-                                true);
   }
 }
 
@@ -668,7 +664,7 @@ GeckoMediaPluginServiceParent::CrashPlugins()
 
   MutexAutoLock lock(mMutex);
   for (size_t i = 0; i < mPlugins.Length(); i++) {
-    mPlugins[i]->Crash(kPrefChange);
+    mPlugins[i]->Crash();
   }
 }
 
@@ -1378,24 +1374,6 @@ GeckoMediaPluginServiceParent::UpdateTrialCreateState(const nsAString& aKeySyste
 #endif
 }
 
-void
-GeckoMediaPluginServiceParent::CrashPluginNow(uint32_t aPluginId, GMPCrashReason aReason)
-{
-  MOZ_ASSERT(NS_GetCurrentThread() == mGMPThread);
-  if (aReason == kGmpApiTimeout && !sKillHungPlugins) {
-    LOGD(("%s::%s(%u, %u) but killing hung plugins disabled.",
-          __CLASS__, __FUNCTION__, aPluginId, aReason));
-    return;
-  }
-  LOGD(("%s::%s(%u, %u)", __CLASS__, __FUNCTION__, aPluginId, aReason));
-  MutexAutoLock lock(mMutex);
-  for (const auto& plugin : mPlugins) {
-    if (plugin->GetPluginId() == aPluginId) {
-      plugin->Crash(aReason);
-    }
-  }
-}
-
 static bool
 ExtractHostName(const nsACString& aOrigin, nsACString& aOutData)
 {
@@ -1730,14 +1708,6 @@ GMPServiceParent::~GMPServiceParent()
                                    new DeleteTask<Transport>(GetTransport()));
 }
 
-bool
-GMPServiceParent::RecvCrashPluginNow(const uint32_t& aPluginId,
-                                     const GMPCrashReason& aReason)
-{
-  mService->CrashPluginNow(aPluginId, aReason);
-  return true;
-}
-
 bool
 GMPServiceParent::RecvLoadGMP(const nsCString& aNodeId,
                               const nsCString& aAPI,
diff --git a/dom/media/gmp/GMPServiceParent.h b/dom/media/gmp/GMPServiceParent.h
index f437643a5ab0..7cfcf01c94bc 100644
--- a/dom/media/gmp/GMPServiceParent.h
+++ b/dom/media/gmp/GMPServiceParent.h
@@ -13,7 +13,6 @@
 #include "nsDataHashtable.h"
 #include "mozilla/Atomics.h"
 #include "nsThreadUtils.h"
-#include "GMPUtils.h"
 
 template <class> struct already_AddRefed;
 
@@ -58,8 +57,6 @@ public:
   void SetAsyncShutdownPluginState(GMPParent* aGMPParent, char aId, const nsCString& aState);
 #endif // MOZ_CRASHREPORTER
 
-  void CrashPluginNow(uint32_t aPluginId, GMPCrashReason aReason);
-
 private:
   friend class GMPServiceParent;
 
@@ -226,8 +223,6 @@ public:
                                             nsCString* aVersion);
   virtual bool RecvUpdateGMPTrialCreateState(const nsString& aKeySystem,
                                              const uint32_t& aState) override;
-  virtual bool RecvCrashPluginNow(const uint32_t& aPluginId,
-                                  const GMPCrashReason& aReason) override;
 
   virtual void ActorDestroy(ActorDestroyReason aWhy) override;
 
diff --git a/dom/media/gmp/GMPUtils.h b/dom/media/gmp/GMPUtils.h
index d9071b5e4d36..3b300dd901d9 100644
--- a/dom/media/gmp/GMPUtils.h
+++ b/dom/media/gmp/GMPUtils.h
@@ -37,12 +37,6 @@ SplitAt(const char* aDelims,
 nsCString
 ToBase64(const nsTArray<uint8_t>& aBytes);
 
-enum GMPCrashReason {
-  kPrefChange, // media.gmp.plugin.crash has been toggled.
-  kGmpApiTimeout, // Some API did not respond.
-  kInvalid,
-};
-
 bool
 FileExists(nsIFile* aFile);
 
diff --git a/dom/media/gmp/GMPVideoDecoderParent.cpp b/dom/media/gmp/GMPVideoDecoderParent.cpp
index 2daec9917034..eacc05b447eb 100644
--- a/dom/media/gmp/GMPVideoDecoderParent.cpp
+++ b/dom/media/gmp/GMPVideoDecoderParent.cpp
@@ -188,7 +188,6 @@ GMPVideoDecoderParent::Reset()
     LOGD(("GMPVideoDecoderParent[%p]::ResetCompleteTimeout() timed out waiting for ResetComplete", self.get()));
     self->mResetCompleteTimeout = nullptr;
     LogToBrowserConsole(NS_LITERAL_STRING("GMPVideoDecoderParent timed out waiting for ResetComplete()"));
-    self->mPlugin->CrashPluginNow(kGmpApiTimeout);
   });
   CancelResetCompleteTimeout();
   mResetCompleteTimeout = SimpleTimer::Create(task, 5000, mPlugin->GMPThread());
diff --git a/dom/media/gmp/PGMP.ipdl b/dom/media/gmp/PGMP.ipdl
index 1162161ab707..23513924a498 100644
--- a/dom/media/gmp/PGMP.ipdl
+++ b/dom/media/gmp/PGMP.ipdl
@@ -9,7 +9,6 @@ include protocol PGMPTimer;
 include protocol PGMPStorage;
 
 using mozilla::dom::NativeThreadId from "mozilla/dom/TabMessageUtils.h";
-using mozilla::GMPCrashReason from "GMPUtils.h";
 
 namespace mozilla {
 namespace gmp {
@@ -34,7 +33,7 @@ parent:
 
 child:
   async BeginAsyncShutdown();
-  async CrashPluginNow(GMPCrashReason aReason);
+  async CrashPluginNow();
   intr StartPlugin();
   async SetNodeId(nsCString nodeId);
   async CloseActive();
diff --git a/dom/media/gmp/PGMPService.ipdl b/dom/media/gmp/PGMPService.ipdl
index 865d2a22056a..440ee4638e66 100644
--- a/dom/media/gmp/PGMPService.ipdl
+++ b/dom/media/gmp/PGMPService.ipdl
@@ -6,7 +6,6 @@
 include protocol PGMP;
 
 using base::ProcessId from "base/process.h";
-using mozilla::GMPCrashReason from "GMPUtils.h";
 
 namespace mozilla {
 namespace gmp {
@@ -24,8 +23,6 @@ parent:
     returns (nsCString id);
 
   async UpdateGMPTrialCreateState(nsString keySystem, uint32_t status);
-
-  async CrashPluginNow(uint32_t pluginId, GMPCrashReason aReason);
 };
 
 } // namespace gmp
diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index 6626cfde97b4..95741051892b 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -310,8 +310,6 @@ pref("media.hardware-video-decoding.enabled", true);
 pref("media.decoder.heuristic.dormant.enabled", true);
 pref("media.decoder.heuristic.dormant.timeout", 60000);
 
-pref("media.gmp.kill-hung-plugins", true);
-
 #ifdef MOZ_WMF
 pref("media.wmf.decoder.thread-count", -1);
 #endif

From eafccd90eb4ea7fa2648081d7290e71832f23d49 Mon Sep 17 00:00:00 2001
From: "Byron Campen [:bwc]" <docfaraday@gmail.com>
Date: Tue, 6 Oct 2015 15:06:36 -0500
Subject: [PATCH 23/63] Bug 1208176 - Part 1: Add a couple of interface names.
 r=drno

--HG--
extra : rebase_source : 5c5f621394ed6b69893c58ec13c50ad71272608a
---
 media/mtransport/nrinterfaceprioritizer.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/media/mtransport/nrinterfaceprioritizer.cpp b/media/mtransport/nrinterfaceprioritizer.cpp
index e19f10feabcc..90ab1bc60e4e 100644
--- a/media/mtransport/nrinterfaceprioritizer.cpp
+++ b/media/mtransport/nrinterfaceprioritizer.cpp
@@ -128,6 +128,8 @@ private:
     result.push_back("rl0");
     result.push_back("wi0");
     result.push_back("en0");
+    result.push_back("enp2s0");
+    result.push_back("enp3s0");
     result.push_back("en1");
     result.push_back("en2");
     result.push_back("en3");

From c5137786511bbfda4355c7293aef43f50cd62273 Mon Sep 17 00:00:00 2001
From: "Byron Campen [:bwc]" <docfaraday@gmail.com>
Date: Tue, 6 Oct 2015 15:07:19 -0500
Subject: [PATCH 24/63] Bug 1208176 - Part 2: Add a one-sided trickle test case
 to ice_unittest. r=drno

--HG--
extra : rebase_source : 24f6c0d825a2f0fc161197c0143e0808c6df67f2
---
 media/mtransport/test/ice_unittest.cpp | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/media/mtransport/test/ice_unittest.cpp b/media/mtransport/test/ice_unittest.cpp
index ac337c422c29..6491211638ed 100644
--- a/media/mtransport/test/ice_unittest.cpp
+++ b/media/mtransport/test/ice_unittest.cpp
@@ -2457,6 +2457,10 @@ void DelayRelayCandidates(
   }
 }
 
+void DropTrickleCandidates(
+    std::vector<SchedulableTrickleCandidate*>& candidates) {
+}
+
 TEST_F(IceConnectTest, TestConnectTrickleAddStreamDuringICE) {
   AddStream("first", 1);
   ASSERT_TRUE(Gather());
@@ -2506,6 +2510,26 @@ TEST_F(IceConnectTest, RemoveStream) {
   ConnectTrickle();
 }
 
+TEST_F(IceConnectTest, P1NoTrickle) {
+  AddStream("first", 1);
+  ASSERT_TRUE(Gather());
+  ConnectTrickle();
+  DropTrickleCandidates(p1_->ControlTrickle(0));
+  RealisticTrickleDelay(p2_->ControlTrickle(0));
+  ASSERT_TRUE_WAIT(p1_->ice_complete(), 1000);
+  ASSERT_TRUE_WAIT(p2_->ice_complete(), 1000);
+}
+
+TEST_F(IceConnectTest, P2NoTrickle) {
+  AddStream("first", 1);
+  ASSERT_TRUE(Gather());
+  ConnectTrickle();
+  RealisticTrickleDelay(p1_->ControlTrickle(0));
+  DropTrickleCandidates(p2_->ControlTrickle(0));
+  ASSERT_TRUE_WAIT(p1_->ice_complete(), 1000);
+  ASSERT_TRUE_WAIT(p2_->ice_complete(), 1000);
+}
+
 TEST_F(IceConnectTest, RemoveAndAddStream) {
   AddStream("first", 1);
   AddStream("second", 1);

From c80a5ed958bb85824e852628eb0ce40a8afd8d18 Mon Sep 17 00:00:00 2001
From: "Byron Campen [:bwc]" <docfaraday@gmail.com>
Date: Tue, 6 Oct 2015 15:09:45 -0500
Subject: [PATCH 25/63] Bug 1208176 - Part 3: Be forgiving when we see prflx
 instead of host candidates in ice_unittest. r=drno

--HG--
extra : rebase_source : efe5b4e6c631a354d70ccbdd53427a282d254222
---
 media/mtransport/test/ice_unittest.cpp | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/media/mtransport/test/ice_unittest.cpp b/media/mtransport/test/ice_unittest.cpp
index 6491211638ed..5e1ee850fc81 100644
--- a/media/mtransport/test/ice_unittest.cpp
+++ b/media/mtransport/test/ice_unittest.cpp
@@ -706,13 +706,21 @@ class IceTestPeer : public sigslot::has_slots<> {
         } else {
           ASSERT_TRUE(NS_SUCCEEDED(res));
           DumpCandidate("Local  ", *local);
-          ASSERT_EQ(expected_local_type_, local->type);
+          /* Depending on timing, and the whims of the network
+           * stack/configuration we're running on top of, prflx is always a
+           * possibility. */
+          if (expected_local_type_ == NrIceCandidate::ICE_HOST) {
+            ASSERT_NE(NrIceCandidate::ICE_SERVER_REFLEXIVE, local->type);
+            ASSERT_NE(NrIceCandidate::ICE_RELAYED, local->type);
+          } else {
+            ASSERT_EQ(expected_local_type_, local->type);
+          }
           ASSERT_EQ(expected_local_transport_, local->local_addr.transport);
           DumpCandidate("Remote ", *remote);
-          /* Remote ICE TCP active candidates are always trickled with port 9
-             so they will get discovered as peer reflexive locally. */
-          if (expected_local_transport_ == kNrIceTransportTcp &&
-              expected_remote_type_ == NrIceCandidate::ICE_HOST) {
+          /* Depending on timing, and the whims of the network
+           * stack/configuration we're running on top of, prflx is always a
+           * possibility. */
+          if (expected_remote_type_ == NrIceCandidate::ICE_HOST) {
             ASSERT_NE(NrIceCandidate::ICE_SERVER_REFLEXIVE, remote->type);
             ASSERT_NE(NrIceCandidate::ICE_RELAYED, remote->type);
           } else {

From 93c62cd98681db4ca99c388fddbc82bad514d7e7 Mon Sep 17 00:00:00 2001
From: Seth Fowler <mark.seth.fowler@gmail.com>
Date: Wed, 14 Oct 2015 00:02:37 -0700
Subject: [PATCH 26/63] Bug 1209731 - Return DrawResult::NOT_READY from
 PaintBackgroundWithSC if we couldn't prepare the nsImageRenderer. r=tn

---
 layout/base/nsCSSRendering.cpp | 33 +++++++++++++++++++++------------
 layout/base/nsCSSRendering.h   |  5 +++--
 2 files changed, 24 insertions(+), 14 deletions(-)

diff --git a/layout/base/nsCSSRendering.cpp b/layout/base/nsCSSRendering.cpp
index b31544006728..d5c97af40dae 100644
--- a/layout/base/nsCSSRendering.cpp
+++ b/layout/base/nsCSSRendering.cpp
@@ -3000,6 +3000,8 @@ nsCSSRendering::PaintBackgroundWithSC(nsPresContext* aPresContext,
           !clipState.mDirtyRectGfx.IsEmpty()) {
         nsBackgroundLayerState state = PrepareBackgroundLayer(aPresContext, aForFrame,
             aFlags, paintBorderArea, clipState.mBGClipArea, layer);
+        result &= state.mImageRenderer.PrepareResult();
+
         if (!state.mFillArea.IsEmpty()) {
           if (state.mCompositionOp != CompositionOp::OP_OVER) {
             NS_ASSERTION(ctx->CurrentOp() == CompositionOp::OP_OVER,
@@ -4607,7 +4609,7 @@ nsImageRenderer::nsImageRenderer(nsIFrame* aForFrame,
   , mImageContainer(nullptr)
   , mGradientData(nullptr)
   , mPaintServerFrame(nullptr)
-  , mIsReady(false)
+  , mPrepareResult(DrawResult::NOT_READY)
   , mSize(0, 0)
   , mFlags(aFlags)
 {
@@ -4620,8 +4622,10 @@ nsImageRenderer::~nsImageRenderer()
 bool
 nsImageRenderer::PrepareImage()
 {
-  if (mImage->IsEmpty())
+  if (mImage->IsEmpty()) {
+    mPrepareResult = DrawResult::BAD_IMAGE;
     return false;
+  }
 
   if (!mImage->IsComplete()) {
     // Make sure the image is actually decoding
@@ -4636,8 +4640,10 @@ nsImageRenderer::PrepareImage()
       nsCOMPtr<imgIContainer> img;
       if (!((mFlags & FLAG_SYNC_DECODE_IMAGES) &&
             (mType == eStyleImageType_Image) &&
-            (NS_SUCCEEDED(mImage->GetImageData()->GetImage(getter_AddRefs(img))))))
+            (NS_SUCCEEDED(mImage->GetImageData()->GetImage(getter_AddRefs(img)))))) {
+        mPrepareResult = DrawResult::NOT_READY;
         return false;
+      }
     }
   }
 
@@ -4661,6 +4667,7 @@ nsImageRenderer::PrepareImage()
         NS_ASSERTION(success, "ComputeActualCropRect() should not fail here");
         if (!success || actualCropRect.IsEmpty()) {
           // The cropped image has zero size
+          mPrepareResult = DrawResult::BAD_IMAGE;
           return false;
         }
         if (isEntireImage) {
@@ -4671,12 +4678,12 @@ nsImageRenderer::PrepareImage()
           mImageContainer.swap(subImage);
         }
       }
-      mIsReady = true;
+      mPrepareResult = DrawResult::SUCCESS;
       break;
     }
     case eStyleImageType_Gradient:
       mGradientData = mImage->GetGradientData();
-      mIsReady = true;
+      mPrepareResult = DrawResult::SUCCESS;
       break;
     case eStyleImageType_Element:
     {
@@ -4690,6 +4697,7 @@ nsImageRenderer::PrepareImage()
           targetURI, mForFrame->FirstContinuation(),
           nsSVGEffects::BackgroundImageProperty());
       if (!property) {
+        mPrepareResult = DrawResult::BAD_IMAGE;
         return false;
       }
 
@@ -4700,11 +4708,12 @@ nsImageRenderer::PrepareImage()
       if (!mImageElementSurface.mSourceSurface) {
         mPaintServerFrame = property->GetReferencedFrame();
         if (!mPaintServerFrame) {
+          mPrepareResult = DrawResult::BAD_IMAGE;
           return false;
         }
       }
 
-      mIsReady = true;
+      mPrepareResult = DrawResult::SUCCESS;
       break;
     }
     case eStyleImageType_Null:
@@ -4712,7 +4721,7 @@ nsImageRenderer::PrepareImage()
       break;
   }
 
-  return mIsReady;
+  return IsReady();
 }
 
 nsSize
@@ -4739,8 +4748,8 @@ CSSSizeOrRatio::ComputeConcreteSize() const
 CSSSizeOrRatio
 nsImageRenderer::ComputeIntrinsicSize()
 {
-  NS_ASSERTION(mIsReady, "Ensure PrepareImage() has returned true "
-                         "before calling me");
+  NS_ASSERTION(IsReady(), "Ensure PrepareImage() has returned true "
+                          "before calling me");
 
   CSSSizeOrRatio result;
   switch (mType) {
@@ -4941,7 +4950,7 @@ nsImageRenderer::Draw(nsPresContext*       aPresContext,
                       const nsPoint&       aAnchor,
                       const CSSIntRect&    aSrc)
 {
-  if (!mIsReady) {
+  if (!IsReady()) {
     NS_NOTREACHED("Ensure PrepareImage() has returned true before calling me");
     return DrawResult::TEMPORARY_ERROR;
   }
@@ -5047,7 +5056,7 @@ nsImageRenderer::DrawBackground(nsPresContext*       aPresContext,
                                 const nsPoint&       aAnchor,
                                 const nsRect&        aDirty)
 {
-  if (!mIsReady) {
+  if (!IsReady()) {
     NS_NOTREACHED("Ensure PrepareImage() has returned true before calling me");
     return DrawResult::TEMPORARY_ERROR;
   }
@@ -5145,7 +5154,7 @@ nsImageRenderer::DrawBorderImageComponent(nsPresContext*       aPresContext,
                                           const nsSize&        aUnitSize,
                                           uint8_t              aIndex)
 {
-  if (!mIsReady) {
+  if (!IsReady()) {
     NS_NOTREACHED("Ensure PrepareImage() has returned true before calling me");
     return;
   }
diff --git a/layout/base/nsCSSRendering.h b/layout/base/nsCSSRendering.h
index 361549358778..b7d59bc8bdce 100644
--- a/layout/base/nsCSSRendering.h
+++ b/layout/base/nsCSSRendering.h
@@ -252,7 +252,8 @@ public:
   /// Retrieves the image associated with this nsImageRenderer, if there is one.
   already_AddRefed<imgIContainer> GetImage();
 
-  bool IsReady() { return mIsReady; }
+  bool IsReady() const { return mPrepareResult == DrawResult::SUCCESS; }
+  DrawResult PrepareResult() const { return mPrepareResult; }
 
 private:
   /**
@@ -286,7 +287,7 @@ private:
   nsRefPtr<nsStyleGradient> mGradientData;
   nsIFrame*                 mPaintServerFrame;
   nsLayoutUtils::SurfaceFromElementResult mImageElementSurface;
-  bool                      mIsReady;
+  DrawResult                mPrepareResult;
   nsSize                    mSize; // unscaled size of the image, in app units
   uint32_t                  mFlags;
 };

From d06321a00c7e52e31db59242e776de197fabd12f Mon Sep 17 00:00:00 2001
From: Seth Fowler <mark.seth.fowler@gmail.com>
Date: Wed, 14 Oct 2015 00:02:37 -0700
Subject: [PATCH 27/63] Bug 1209739 - Make nsImageRenderer::PrepareImage() fail
 unless an image has STATUS_LOAD_COMPLETE. r=tn

---
 layout/base/nsCSSRendering.cpp | 57 +++++++++++++++++++++++++---------
 1 file changed, 43 insertions(+), 14 deletions(-)

diff --git a/layout/base/nsCSSRendering.cpp b/layout/base/nsCSSRendering.cpp
index d5c97af40dae..b4057df2334e 100644
--- a/layout/base/nsCSSRendering.cpp
+++ b/layout/base/nsCSSRendering.cpp
@@ -4619,6 +4619,40 @@ nsImageRenderer::~nsImageRenderer()
 {
 }
 
+static bool
+ShouldTreatAsCompleteDueToSyncDecode(const nsStyleImage* aImage,
+                                     uint32_t aFlags)
+{
+  if (!(aFlags & nsImageRenderer::FLAG_SYNC_DECODE_IMAGES)) {
+    return false;
+  }
+
+  if (aImage->GetType() != eStyleImageType_Image) {
+    return false;
+  }
+
+  uint32_t status = 0;
+  if (NS_FAILED(aImage->GetImageData()->GetImageStatus(&status))) {
+    return false;
+  }
+
+  if (status & imgIRequest::STATUS_ERROR) {
+    // The image is "complete" since it's a corrupt image. If we created an
+    // imgIContainer at all, return true.
+    nsCOMPtr<imgIContainer> image;
+    aImage->GetImageData()->GetImage(getter_AddRefs(image));
+    return bool(image);
+  }
+
+  if (!(status & imgIRequest::STATUS_LOAD_COMPLETE)) {
+    // We must have loaded all of the image's data and the size must be
+    // available, or else sync decoding won't be able to decode the image.
+    return false;
+  }
+
+  return true;
+}
+
 bool
 nsImageRenderer::PrepareImage()
 {
@@ -4628,22 +4662,17 @@ nsImageRenderer::PrepareImage()
   }
 
   if (!mImage->IsComplete()) {
-    // Make sure the image is actually decoding
+    // Make sure the image is actually decoding.
     mImage->StartDecoding();
 
-    // check again to see if we finished
-    if (!mImage->IsComplete()) {
-      // We can not prepare the image for rendering if it is not fully loaded.
-      //
-      // Special case: If we requested a sync decode and we have an image, push
-      // on through because the Draw() will do a sync decode then
-      nsCOMPtr<imgIContainer> img;
-      if (!((mFlags & FLAG_SYNC_DECODE_IMAGES) &&
-            (mType == eStyleImageType_Image) &&
-            (NS_SUCCEEDED(mImage->GetImageData()->GetImage(getter_AddRefs(img)))))) {
-        mPrepareResult = DrawResult::NOT_READY;
-        return false;
-      }
+    // Check again to see if we finished.
+    // We cannot prepare the image for rendering if it is not fully loaded.
+    // Special case: If we requested a sync decode and the image has loaded, push
+    // on through because the Draw() will do a sync decode then.
+    if (!mImage->IsComplete() &&
+        !ShouldTreatAsCompleteDueToSyncDecode(mImage, mFlags)) {
+      mPrepareResult = DrawResult::NOT_READY;
+      return false;
     }
   }
 

From 1eb70fbe5b70fba0cf045164415a1d734fab4d6a Mon Sep 17 00:00:00 2001
From: Joel Maher <jmaher@mozilla.com>
Date: Tue, 13 Oct 2015 14:10:00 +0200
Subject: [PATCH 28/63] Bug 1210863 - test_bug618176.xul fails on windows debug
 with runByDir enabled. r=dvander

--HG--
extra : rebase_source : 73d28be6270179719f42b51dd0978c9afce85abc
---
 js/xpconnect/tests/chrome/chrome.ini | 1 -
 1 file changed, 1 deletion(-)

diff --git a/js/xpconnect/tests/chrome/chrome.ini b/js/xpconnect/tests/chrome/chrome.ini
index 003cbfab87d5..5809eed34105 100644
--- a/js/xpconnect/tests/chrome/chrome.ini
+++ b/js/xpconnect/tests/chrome/chrome.ini
@@ -29,7 +29,6 @@ skip-if = buildapp == 'mulet'
 [test_bug614757.xul]
 [test_bug616992.xul]
 [test_bug618176.xul]
-skip-if = os == 'win' && debug # Bug 1210863
 [test_bug654370.xul]
 [test_bug658560.xul]
 [test_bug658909.xul]

From cbe8e23af4d9fd8fdc2ff2ce3f61b724554926e5 Mon Sep 17 00:00:00 2001
From: David Rajchenbach-Teller <dteller@mozilla.com>
Date: Wed, 7 Oct 2015 12:42:43 +0200
Subject: [PATCH 29/63] Bug 1212244 - Same-process sendAsyncMessage can now
 throw instead of OOM. r=smaug

--HG--
extra : rebase_source : 50d89efacee7103452218782c92a53a7cf07dd9b
---
 dom/base/nsFrameLoader.cpp                   |  41 +++---
 dom/base/nsFrameLoader.h                     |  10 +-
 dom/base/nsFrameMessageManager.cpp           | 128 ++++++++++---------
 dom/base/nsFrameMessageManager.h             |  34 ++---
 dom/base/nsInProcessTabChildGlobal.cpp       |  26 ++--
 dom/base/nsInProcessTabChildGlobal.h         |  10 +-
 dom/ipc/ContentParent.cpp                    |  13 +-
 dom/ipc/ContentParent.h                      |  10 +-
 dom/ipc/TabChild.cpp                         |  13 +-
 dom/ipc/TabChild.h                           |  10 +-
 toolkit/components/telemetry/Histograms.json |   8 ++
 11 files changed, 169 insertions(+), 134 deletions(-)

diff --git a/dom/base/nsFrameLoader.cpp b/dom/base/nsFrameLoader.cpp
index 49f3d6a4cbae..54e712dbe87a 100644
--- a/dom/base/nsFrameLoader.cpp
+++ b/dom/base/nsFrameLoader.cpp
@@ -2453,13 +2453,8 @@ class nsAsyncMessageToChild : public nsSameProcessAsyncMessageBase,
                               public nsRunnable
 {
 public:
-  nsAsyncMessageToChild(JSContext* aCx,
-                        nsFrameLoader* aFrameLoader,
-                        const nsAString& aMessage,
-                        StructuredCloneData& aData,
-                        JS::Handle<JSObject *> aCpows,
-                        nsIPrincipal* aPrincipal)
-    : nsSameProcessAsyncMessageBase(aCx, aMessage, aData, aCpows, aPrincipal)
+  nsAsyncMessageToChild(JSContext* aCx, JS::Handle<JSObject*> aCpows, nsFrameLoader* aFrameLoader)
+    : nsSameProcessAsyncMessageBase(aCx, aCpows)
     , mFrameLoader(aFrameLoader)
   {
   }
@@ -2478,7 +2473,7 @@ public:
   nsRefPtr<nsFrameLoader> mFrameLoader;
 };
 
-bool
+nsresult
 nsFrameLoader::DoSendAsyncMessage(JSContext* aCx,
                                   const nsAString& aMessage,
                                   StructuredCloneData& aData,
@@ -2490,27 +2485,37 @@ nsFrameLoader::DoSendAsyncMessage(JSContext* aCx,
     ClonedMessageData data;
     nsIContentParent* cp = tabParent->Manager();
     if (!BuildClonedMessageDataForParent(cp, aData, data)) {
-      return false;
+      MOZ_CRASH();
+      return NS_ERROR_DOM_DATA_CLONE_ERR;
     }
     InfallibleTArray<mozilla::jsipc::CpowEntry> cpows;
     jsipc::CPOWManager* mgr = cp->GetCPOWManager();
     if (aCpows && (!mgr || !mgr->Wrap(aCx, aCpows, &cpows))) {
-      return false;
+      return NS_ERROR_UNEXPECTED;
+    }
+    if (tabParent->SendAsyncMessage(nsString(aMessage), data, cpows,
+                                    IPC::Principal(aPrincipal))) {
+      return NS_OK;
+    } else {
+      return NS_ERROR_UNEXPECTED;
     }
-    return tabParent->SendAsyncMessage(nsString(aMessage), data, cpows,
-                                       IPC::Principal(aPrincipal));
   }
 
   if (mChildMessageManager) {
-    nsCOMPtr<nsIRunnable> ev = new nsAsyncMessageToChild(aCx, this, aMessage,
-                                                         aData, aCpows,
-                                                         aPrincipal);
-    NS_DispatchToCurrentThread(ev);
-    return true;
+    nsRefPtr<nsAsyncMessageToChild> ev = new nsAsyncMessageToChild(aCx, aCpows, this);
+    nsresult rv = ev->Init(aCx, aMessage, aData, aPrincipal);
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
+    rv = NS_DispatchToCurrentThread(ev);
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
+    return rv;
   }
 
   // We don't have any targets to send our asynchronous message to.
-  return false;
+  return NS_ERROR_UNEXPECTED;
 }
 
 bool
diff --git a/dom/base/nsFrameLoader.h b/dom/base/nsFrameLoader.h
index c5ca7ae180b3..f91a840514ec 100644
--- a/dom/base/nsFrameLoader.h
+++ b/dom/base/nsFrameLoader.h
@@ -91,11 +91,11 @@ public:
    */
   virtual bool DoLoadMessageManagerScript(const nsAString& aURL,
                                           bool aRunInGlobalScope) override;
-  virtual bool DoSendAsyncMessage(JSContext* aCx,
-                                  const nsAString& aMessage,
-                                  mozilla::dom::ipc::StructuredCloneData& aData,
-                                  JS::Handle<JSObject *> aCpows,
-                                  nsIPrincipal* aPrincipal) override;
+  virtual nsresult DoSendAsyncMessage(JSContext* aCx,
+                                      const nsAString& aMessage,
+                                      mozilla::dom::ipc::StructuredCloneData& aData,
+                                      JS::Handle<JSObject *> aCpows,
+                                      nsIPrincipal* aPrincipal) override;
   virtual bool CheckPermission(const nsAString& aPermission) override;
   virtual bool CheckManifestURL(const nsAString& aManifestURL) override;
   virtual bool CheckAppHasPermission(const nsAString& aPermission) override;
diff --git a/dom/base/nsFrameMessageManager.cpp b/dom/base/nsFrameMessageManager.cpp
index 4c4086440b4f..0e597204a922 100644
--- a/dom/base/nsFrameMessageManager.cpp
+++ b/dom/base/nsFrameMessageManager.cpp
@@ -31,6 +31,7 @@
 #include "mozilla/CycleCollectedJSRuntime.h"
 #include "mozilla/IntentionalCrash.h"
 #include "mozilla/Preferences.h"
+#include "mozilla/Telemetry.h"
 #include "mozilla/dom/File.h"
 #include "mozilla/dom/nsIContentParent.h"
 #include "mozilla/dom/PermissionMessageUtils.h"
@@ -809,8 +810,9 @@ nsFrameMessageManager::DispatchAsyncMessageInternal(JSContext* aCx,
     return NS_ERROR_NOT_INITIALIZED;
   }
 
-  if (!mCallback->DoSendAsyncMessage(aCx, aMessage, aData, aCpows, aPrincipal)) {
-    return NS_ERROR_FAILURE;
+  nsresult rv = mCallback->DoSendAsyncMessage(aCx, aMessage, aData, aCpows, aPrincipal);
+  if (NS_FAILED(rv)) {
+    return rv;
   }
   return NS_OK;
 }
@@ -1889,15 +1891,9 @@ class nsAsyncMessageToSameProcessChild : public nsSameProcessAsyncMessageBase,
                                          public nsRunnable
 {
 public:
-  nsAsyncMessageToSameProcessChild(JSContext* aCx,
-                                   const nsAString& aMessage,
-                                   StructuredCloneData& aData,
-                                   JS::Handle<JSObject *> aCpows,
-                                   nsIPrincipal* aPrincipal)
-    : nsSameProcessAsyncMessageBase(aCx, aMessage, aData, aCpows, aPrincipal)
-  {
-  }
-
+  nsAsyncMessageToSameProcessChild(JSContext* aCx, JS::Handle<JSObject*> aCpows)
+    : nsSameProcessAsyncMessageBase(aCx, aCpows)
+  { }
   NS_IMETHOD Run()
   {
     nsFrameMessageManager* ppm = nsFrameMessageManager::GetChildProcessManager();
@@ -1931,17 +1927,24 @@ public:
     return true;
   }
 
-  virtual bool DoSendAsyncMessage(JSContext* aCx,
-                                  const nsAString& aMessage,
-                                  StructuredCloneData& aData,
-                                  JS::Handle<JSObject *> aCpows,
-                                  nsIPrincipal* aPrincipal) override
+  virtual nsresult DoSendAsyncMessage(JSContext* aCx,
+                                      const nsAString& aMessage,
+                                      StructuredCloneData& aData,
+                                      JS::Handle<JSObject *> aCpows,
+                                      nsIPrincipal* aPrincipal) override
   {
-    nsCOMPtr<nsIRunnable> ev =
-      new nsAsyncMessageToSameProcessChild(aCx, aMessage, aData, aCpows,
-                                           aPrincipal);
-    NS_DispatchToCurrentThread(ev);
-    return true;
+    nsRefPtr<nsAsyncMessageToSameProcessChild> ev =
+      new nsAsyncMessageToSameProcessChild(aCx, aCpows);
+
+    nsresult rv = ev->Init(aCx, aMessage, aData, aPrincipal);
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
+    rv = NS_DispatchToCurrentThread(ev);
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
+    return NS_OK;
   }
 
   bool CheckPermission(const nsAString& aPermission) override
@@ -2014,29 +2017,32 @@ public:
                               IPC::Principal(aPrincipal), aRetVal);
   }
 
-  virtual bool DoSendAsyncMessage(JSContext* aCx,
-                                  const nsAString& aMessage,
-                                  StructuredCloneData& aData,
-                                  JS::Handle<JSObject *> aCpows,
-                                  nsIPrincipal* aPrincipal) override
+  virtual nsresult DoSendAsyncMessage(JSContext* aCx,
+                                      const nsAString& aMessage,
+                                      StructuredCloneData& aData,
+                                      JS::Handle<JSObject *> aCpows,
+                                      nsIPrincipal* aPrincipal) override
   {
     mozilla::dom::ContentChild* cc =
       mozilla::dom::ContentChild::GetSingleton();
     if (!cc) {
-      return true;
+      return NS_OK;
     }
     ClonedMessageData data;
     if (!BuildClonedMessageDataForChild(cc, aData, data)) {
-      return false;
+      return NS_ERROR_DOM_DATA_CLONE_ERR;
     }
     InfallibleTArray<mozilla::jsipc::CpowEntry> cpows;
     if (aCpows && !cc->GetCPOWManager()->Wrap(aCx, aCpows, &cpows)) {
-      return false;
+      return NS_ERROR_UNEXPECTED;
+    }
+    if (!cc->SendAsyncMessage(PromiseFlatString(aMessage), data, cpows,
+                              IPC::Principal(aPrincipal))) {
+      return NS_ERROR_UNEXPECTED;
     }
-    return cc->SendAsyncMessage(PromiseFlatString(aMessage), data, cpows,
-                                IPC::Principal(aPrincipal));
-  }
 
+    return NS_OK;
+  }
 };
 
 
@@ -2044,15 +2050,9 @@ class nsAsyncMessageToSameProcessParent : public nsSameProcessAsyncMessageBase,
                                           public SameProcessMessageQueue::Runnable
 {
 public:
-  nsAsyncMessageToSameProcessParent(JSContext* aCx,
-                                    const nsAString& aMessage,
-                                    StructuredCloneData& aData,
-                                    JS::Handle<JSObject *> aCpows,
-                                    nsIPrincipal* aPrincipal)
-    : nsSameProcessAsyncMessageBase(aCx, aMessage, aData, aCpows, aPrincipal)
-  {
-  }
-
+  nsAsyncMessageToSameProcessParent(JSContext* aCx, JS::Handle<JSObject*> aCpows)
+    : nsSameProcessAsyncMessageBase(aCx, aCpows)
+  { }
   virtual nsresult HandleMessage() override
   {
     nsFrameMessageManager* ppm = nsFrameMessageManager::sSameProcessParentManager;
@@ -2096,7 +2096,7 @@ public:
     return true;
   }
 
-  virtual bool DoSendAsyncMessage(JSContext* aCx,
+  virtual nsresult DoSendAsyncMessage(JSContext* aCx,
                                   const nsAString& aMessage,
                                   StructuredCloneData& aData,
                                   JS::Handle<JSObject *> aCpows,
@@ -2104,9 +2104,14 @@ public:
   {
     SameProcessMessageQueue* queue = SameProcessMessageQueue::Get();
     nsRefPtr<nsAsyncMessageToSameProcessParent> ev =
-      new nsAsyncMessageToSameProcessParent(aCx, aMessage, aData, aCpows, aPrincipal);
+      new nsAsyncMessageToSameProcessParent(aCx, aCpows);
+    nsresult rv = ev->Init(aCx, aMessage, aData, aPrincipal);
+
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
     queue->Push(ev);
-    return true;
+    return NS_OK;
   }
 
 };
@@ -2202,23 +2207,28 @@ nsFrameMessageManager::MarkForCC()
   return true;
 }
 
-nsSameProcessAsyncMessageBase::nsSameProcessAsyncMessageBase(JSContext* aCx,
-                                                             const nsAString& aMessage,
-                                                             StructuredCloneData& aData,
-                                                             JS::Handle<JSObject*> aCpows,
-                                                             nsIPrincipal* aPrincipal)
-  : mRuntime(js::GetRuntime(aCx)),
-    mMessage(aMessage),
-    mCpows(aCx, aCpows),
-    mPrincipal(aPrincipal)
+nsSameProcessAsyncMessageBase::nsSameProcessAsyncMessageBase(JSContext* aCx, JS::Handle<JSObject*> aCpows)
+  : mRuntime(nullptr)
+  , mCpows(aCx, aCpows)
+{ }
+
+
+nsresult
+nsSameProcessAsyncMessageBase::Init(JSContext* aCx,
+                                    const nsAString& aMessage,
+                                    StructuredCloneData& aData,
+                                    nsIPrincipal* aPrincipal)
 {
   if (!mData.Copy(aData)) {
-#ifdef MOZ_CRASHREPORTER
-    CrashReporter::AnnotateCrashReport(NS_LITERAL_CSTRING("AsyncMessageOOM"),
-                                       NS_ConvertUTF16toUTF8(aMessage));
-#endif
-    NS_ABORT_OOM(aData.DataLength());
+    Telemetry::Accumulate(Telemetry::IPC_SAME_PROCESS_MESSAGE_COPY_OOM_KB, aData.DataLength());
+    return NS_ERROR_OUT_OF_MEMORY;
   }
+
+  mRuntime = js::GetRuntime(aCx);
+  mMessage = aMessage;
+  mPrincipal = aPrincipal;
+
+  return NS_OK;
 }
 
 void
@@ -2226,6 +2236,8 @@ nsSameProcessAsyncMessageBase::ReceiveMessage(nsISupports* aTarget,
                                               nsIFrameLoader* aTargetFrameLoader,
                                               nsFrameMessageManager* aManager)
 {
+  // Make sure that we have called Init() and it has succeeded.
+  MOZ_ASSERT(mRuntime);
   if (aManager) {
     SameProcessCpowHolder cpows(mRuntime, mCpows);
 
diff --git a/dom/base/nsFrameMessageManager.h b/dom/base/nsFrameMessageManager.h
index d247fdfc47d2..2211b99f4482 100644
--- a/dom/base/nsFrameMessageManager.h
+++ b/dom/base/nsFrameMessageManager.h
@@ -73,13 +73,13 @@ public:
     return true;
   }
 
-  virtual bool DoSendAsyncMessage(JSContext* aCx,
-                                  const nsAString& aMessage,
-                                  StructuredCloneData& aData,
-                                  JS::Handle<JSObject*> aCpows,
-                                  nsIPrincipal* aPrincipal)
+  virtual nsresult DoSendAsyncMessage(JSContext* aCx,
+                                      const nsAString& aMessage,
+                                      StructuredCloneData& aData,
+                                      JS::Handle<JSObject*> aCpows,
+                                      nsIPrincipal* aPrincipal)
   {
-    return true;
+    return NS_OK;
   }
 
   virtual bool CheckPermission(const nsAString& aPermission)
@@ -317,28 +317,32 @@ private:
 
    class MyAsyncMessage : public nsSameProcessAsyncMessageBase, public nsRunnable
    {
-     // Initialize nsSameProcessAsyncMessageBase...
-
      NS_IMETHOD Run() {
        ReceiveMessage(..., ...);
        return NS_OK;
      }
    };
- */
+
+
+   nsRefPtr<nsSameProcessAsyncMessageBase> ev = new MyAsyncMessage();
+   nsresult rv = ev->Init(...);
+   if (NS_SUCCEEDED(rv)) {
+     NS_DispatchToMainThread(ev);
+   }
+*/
 class nsSameProcessAsyncMessageBase
 {
 public:
   typedef mozilla::dom::ipc::StructuredCloneData StructuredCloneData;
 
-  nsSameProcessAsyncMessageBase(JSContext* aCx,
-                                const nsAString& aMessage,
-                                StructuredCloneData& aData,
-                                JS::Handle<JSObject*> aCpows,
-                                nsIPrincipal* aPrincipal);
+  nsSameProcessAsyncMessageBase(JSContext* aCx, JS::Handle<JSObject*> aCpows);
+  nsresult Init(JSContext* aCx,
+                const nsAString& aMessage,
+                StructuredCloneData& aData,
+                nsIPrincipal* aPrincipal);
 
   void ReceiveMessage(nsISupports* aTarget, nsIFrameLoader* aTargetFrameLoader,
                       nsFrameMessageManager* aManager);
-
 private:
   nsSameProcessAsyncMessageBase(const nsSameProcessAsyncMessageBase&);
 
diff --git a/dom/base/nsInProcessTabChildGlobal.cpp b/dom/base/nsInProcessTabChildGlobal.cpp
index 813f7be48e39..08ed390183c6 100644
--- a/dom/base/nsInProcessTabChildGlobal.cpp
+++ b/dom/base/nsInProcessTabChildGlobal.cpp
@@ -49,16 +49,10 @@ class nsAsyncMessageToParent : public nsSameProcessAsyncMessageBase,
                                public SameProcessMessageQueue::Runnable
 {
 public:
-  nsAsyncMessageToParent(JSContext* aCx,
-                         nsInProcessTabChildGlobal* aTabChild,
-                         const nsAString& aMessage,
-                         StructuredCloneData& aData,
-                         JS::Handle<JSObject *> aCpows,
-                         nsIPrincipal* aPrincipal)
-    : nsSameProcessAsyncMessageBase(aCx, aMessage, aData, aCpows, aPrincipal),
-      mTabChild(aTabChild)
-  {
-  }
+  nsAsyncMessageToParent(JSContext* aCx, JS::Handle<JSObject*> aCpows, nsInProcessTabChildGlobal* aTabChild)
+    : nsSameProcessAsyncMessageBase(aCx, aCpows)
+    , mTabChild(aTabChild)
+  { }
 
   virtual nsresult HandleMessage() override
   {
@@ -69,7 +63,7 @@ public:
   nsRefPtr<nsInProcessTabChildGlobal> mTabChild;
 };
 
-bool
+nsresult
 nsInProcessTabChildGlobal::DoSendAsyncMessage(JSContext* aCx,
                                               const nsAString& aMessage,
                                               StructuredCloneData& aData,
@@ -78,9 +72,15 @@ nsInProcessTabChildGlobal::DoSendAsyncMessage(JSContext* aCx,
 {
   SameProcessMessageQueue* queue = SameProcessMessageQueue::Get();
   nsRefPtr<nsAsyncMessageToParent> ev =
-    new nsAsyncMessageToParent(aCx, this, aMessage, aData, aCpows, aPrincipal);
+    new nsAsyncMessageToParent(aCx, aCpows, this);
+
+  nsresult rv = ev->Init(aCx, aMessage, aData, aPrincipal);
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+
   queue->Push(ev);
-  return true;
+  return NS_OK;
 }
 
 nsInProcessTabChildGlobal::nsInProcessTabChildGlobal(nsIDocShell* aShell,
diff --git a/dom/base/nsInProcessTabChildGlobal.h b/dom/base/nsInProcessTabChildGlobal.h
index b861329f629b..36d046eada05 100644
--- a/dom/base/nsInProcessTabChildGlobal.h
+++ b/dom/base/nsInProcessTabChildGlobal.h
@@ -88,11 +88,11 @@ public:
                                       nsIPrincipal* aPrincipal,
                                       nsTArray<StructuredCloneData>* aRetVal,
                                       bool aIsSync) override;
-  virtual bool DoSendAsyncMessage(JSContext* aCx,
-                                  const nsAString& aMessage,
-                                  StructuredCloneData& aData,
-                                  JS::Handle<JSObject *> aCpows,
-                                  nsIPrincipal* aPrincipal) override;
+  virtual nsresult DoSendAsyncMessage(JSContext* aCx,
+                                      const nsAString& aMessage,
+                                      StructuredCloneData& aData,
+                                      JS::Handle<JSObject *> aCpows,
+                                      nsIPrincipal* aPrincipal) override;
 
   virtual nsresult PreHandleEvent(
                      mozilla::EventChainPreVisitor& aVisitor) override;
diff --git a/dom/ipc/ContentParent.cpp b/dom/ipc/ContentParent.cpp
index 03cdca4eea91..b00a95b80501 100755
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -4567,7 +4567,7 @@ ContentParent::DoLoadMessageManagerScript(const nsAString& aURL,
     return SendLoadProcessScript(nsString(aURL));
 }
 
-bool
+nsresult
 ContentParent::DoSendAsyncMessage(JSContext* aCx,
                                   const nsAString& aMessage,
                                   StructuredCloneData& aHelper,
@@ -4576,18 +4576,21 @@ ContentParent::DoSendAsyncMessage(JSContext* aCx,
 {
     ClonedMessageData data;
     if (!BuildClonedMessageDataForParent(this, aHelper, data)) {
-        return false;
+        return NS_ERROR_DOM_DATA_CLONE_ERR;
     }
     InfallibleTArray<CpowEntry> cpows;
     jsipc::CPOWManager* mgr = GetCPOWManager();
     if (aCpows && (!mgr || !mgr->Wrap(aCx, aCpows, &cpows))) {
-        return false;
+        return NS_ERROR_UNEXPECTED;
     }
     if (IsReadyNuwaProcess()) {
         // Nuwa won't receive frame messages after it is frozen.
-        return true;
+        return NS_OK;
     }
-    return SendAsyncMessage(nsString(aMessage), data, cpows, Principal(aPrincipal));
+    if (!SendAsyncMessage(nsString(aMessage), data, cpows, Principal(aPrincipal))) {
+        return NS_ERROR_UNEXPECTED;
+    }
+    return NS_OK;
 }
 
 bool
diff --git a/dom/ipc/ContentParent.h b/dom/ipc/ContentParent.h
index 3298b0203c7d..6b0b0fe8fc7d 100644
--- a/dom/ipc/ContentParent.h
+++ b/dom/ipc/ContentParent.h
@@ -206,11 +206,11 @@ public:
      */
     virtual bool DoLoadMessageManagerScript(const nsAString& aURL,
                                             bool aRunInGlobalScope) override;
-    virtual bool DoSendAsyncMessage(JSContext* aCx,
-                                    const nsAString& aMessage,
-                                    StructuredCloneData& aData,
-                                    JS::Handle<JSObject *> aCpows,
-                                    nsIPrincipal* aPrincipal) override;
+    virtual nsresult DoSendAsyncMessage(JSContext* aCx,
+                                        const nsAString& aMessage,
+                                        StructuredCloneData& aData,
+                                        JS::Handle<JSObject *> aCpows,
+                                        nsIPrincipal* aPrincipal) override;
     virtual bool CheckPermission(const nsAString& aPermission) override;
     virtual bool CheckManifestURL(const nsAString& aManifestURL) override;
     virtual bool CheckAppHasPermission(const nsAString& aPermission) override;
diff --git a/dom/ipc/TabChild.cpp b/dom/ipc/TabChild.cpp
index e8778794eebc..b159ef048c91 100644
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -2921,7 +2921,7 @@ TabChild::DoSendBlockingMessage(JSContext* aCx,
                         Principal(aPrincipal), aRetVal);
 }
 
-bool
+nsresult
 TabChild::DoSendAsyncMessage(JSContext* aCx,
                              const nsAString& aMessage,
                              StructuredCloneData& aData,
@@ -2930,14 +2930,17 @@ TabChild::DoSendAsyncMessage(JSContext* aCx,
 {
   ClonedMessageData data;
   if (!BuildClonedMessageDataForChild(Manager(), aData, data)) {
-    return false;
+    return NS_ERROR_DOM_DATA_CLONE_ERR;
   }
   InfallibleTArray<CpowEntry> cpows;
   if (aCpows && !Manager()->GetCPOWManager()->Wrap(aCx, aCpows, &cpows)) {
-    return false;
+    return NS_ERROR_UNEXPECTED;
   }
-  return SendAsyncMessage(PromiseFlatString(aMessage), data, cpows,
-                          Principal(aPrincipal));
+  if (!SendAsyncMessage(PromiseFlatString(aMessage), data, cpows,
+                        Principal(aPrincipal))) {
+    return NS_ERROR_UNEXPECTED;
+  }
+  return NS_OK;
 }
 
 TabChild*
diff --git a/dom/ipc/TabChild.h b/dom/ipc/TabChild.h
index bd20bd55d4d8..8bf1fd347de0 100644
--- a/dom/ipc/TabChild.h
+++ b/dom/ipc/TabChild.h
@@ -280,11 +280,11 @@ public:
                                        nsIPrincipal* aPrincipal,
                                        nsTArray<StructuredCloneData>* aRetVal,
                                        bool aIsSync) override;
-    virtual bool DoSendAsyncMessage(JSContext* aCx,
-                                    const nsAString& aMessage,
-                                    StructuredCloneData& aData,
-                                    JS::Handle<JSObject *> aCpows,
-                                    nsIPrincipal* aPrincipal) override;
+    virtual nsresult DoSendAsyncMessage(JSContext* aCx,
+                                        const nsAString& aMessage,
+                                        StructuredCloneData& aData,
+                                        JS::Handle<JSObject *> aCpows,
+                                        nsIPrincipal* aPrincipal) override;
     virtual bool DoUpdateZoomConstraints(const uint32_t& aPresShellId,
                                          const ViewID& aViewId,
                                          const Maybe<ZoomConstraints>& aConstraints) override;
diff --git a/toolkit/components/telemetry/Histograms.json b/toolkit/components/telemetry/Histograms.json
index 1681f2fe3bef..07934fdd6c94 100644
--- a/toolkit/components/telemetry/Histograms.json
+++ b/toolkit/components/telemetry/Histograms.json
@@ -5191,6 +5191,14 @@
     "kind": "boolean",
     "description": "True when an IPC transaction is canceled"
   },
+  "IPC_SAME_PROCESS_MESSAGE_COPY_OOM_KB": {
+     "expires_in_version": "50",
+     "kind": "exponential",
+     "low": 100,
+     "high": 10000000,
+     "n_buckets": 10,
+     "description": "Whenever the same-process MessageManager cannot be sent through sendAsyncMessage as it would cause an OOM, the size of the message content, in kb."
+  },
   "MISBEHAVING_ADDONS_CPOW_TIME_MS": {
     "expires_in_version": "never",
     "kind": "exponential",

From 42685fa873cc784943fb15de177fd3fc7ebdfd12 Mon Sep 17 00:00:00 2001
From: Olli Pettay <Olli.Pettay@helsinki.fi>
Date: Tue, 13 Oct 2015 22:08:00 +0300
Subject: [PATCH 30/63] Bug 1213382 - proxy more accessible selection methods,
 r=tbsaunde

--HG--
extra : rebase_source : 1d8d688d4b1ab671aed5ba28bdcc14b2c4b94f70
---
 accessible/generic/Accessible.h            |  5 -----
 accessible/interfaces/nsIAccessible.idl    |  8 +-------
 accessible/ipc/DocAccessibleChild.cpp      | 22 ++++++++++++++++++++++
 accessible/ipc/DocAccessibleChild.h        |  4 ++++
 accessible/ipc/PDocAccessible.ipdl         |  3 +++
 accessible/ipc/ProxyAccessible.cpp         | 12 ++++++++++++
 accessible/ipc/ProxyAccessible.h           |  3 +++
 accessible/windows/msaa/AccessibleWrap.cpp |  3 ---
 accessible/xpcom/xpcAccessible.cpp         | 10 ----------
 accessible/xpcom/xpcAccessible.h           |  1 -
 10 files changed, 45 insertions(+), 26 deletions(-)

diff --git a/accessible/generic/Accessible.h b/accessible/generic/Accessible.h
index cf705ac0e98c..c2094fa47daa 100644
--- a/accessible/generic/Accessible.h
+++ b/accessible/generic/Accessible.h
@@ -533,11 +533,6 @@ public:
    */
   virtual void SetSelected(bool aSelect);
 
-  /**
-   * Extend selection to this accessible.
-   */
-  void ExtendSelection() { };
-
   /**
    * Select the accessible within its container.
    */
diff --git a/accessible/interfaces/nsIAccessible.idl b/accessible/interfaces/nsIAccessible.idl
index 361a6144d7cd..0a13b93adc41 100644
--- a/accessible/interfaces/nsIAccessible.idl
+++ b/accessible/interfaces/nsIAccessible.idl
@@ -30,7 +30,7 @@ class Accessible;
  * Mozilla creates the implementations of nsIAccessible on demand.
  * See http://www.mozilla.org/projects/ui/accessibility for more information.
  */
-[scriptable, uuid(66b110b0-c25a-4784-8623-f6ba40c7cfee)]
+[scriptable, uuid(de2869d9-563c-4943-996b-31a4daa4d097)]
 interface nsIAccessible : nsISupports
 {
   /**
@@ -231,12 +231,6 @@ interface nsIAccessible : nsISupports
    */
   void setSelected(in boolean isSelected);
 
-  /**
-   * Extend the current selection from its current accessible anchor node
-   * to this accessible
-   */
-  void extendSelection();
-
   /**
    * Select this accessible node only
    */
diff --git a/accessible/ipc/DocAccessibleChild.cpp b/accessible/ipc/DocAccessibleChild.cpp
index d548e6679478..9ae1b5e6d5e6 100644
--- a/accessible/ipc/DocAccessibleChild.cpp
+++ b/accessible/ipc/DocAccessibleChild.cpp
@@ -1621,6 +1621,28 @@ DocAccessibleChild::RecvUnselectAll(const uint64_t& aID,
   return true;
 }
 
+bool
+DocAccessibleChild::RecvTakeSelection(const uint64_t& aID)
+{
+  Accessible* acc = IdToAccessible(aID);
+  if (acc) {
+    acc->TakeSelection();
+  }
+
+  return true;
+}
+
+bool
+DocAccessibleChild::RecvSetSelected(const uint64_t& aID, const bool& aSelect)
+{
+  Accessible* acc = IdToAccessible(aID);
+  if (acc) {
+    acc->SetSelected(aSelect);
+  }
+
+  return true;
+}
+
 bool
 DocAccessibleChild::RecvDoAction(const uint64_t& aID,
                                  const uint8_t& aIndex,
diff --git a/accessible/ipc/DocAccessibleChild.h b/accessible/ipc/DocAccessibleChild.h
index 53944f2d59f8..6fbb5c844797 100644
--- a/accessible/ipc/DocAccessibleChild.h
+++ b/accessible/ipc/DocAccessibleChild.h
@@ -401,6 +401,10 @@ public:
   virtual bool RecvUnselectAll(const uint64_t& aID,
                                bool* aSuccess) override;
 
+  virtual bool RecvTakeSelection(const uint64_t& aID) override;
+  virtual bool RecvSetSelected(const uint64_t& aID,
+                               const bool& aSelect) override;
+
   virtual bool RecvDoAction(const uint64_t& aID,
                             const uint8_t& aIndex,
                             bool* aSuccess) override;
diff --git a/accessible/ipc/PDocAccessible.ipdl b/accessible/ipc/PDocAccessible.ipdl
index 506fbe9b3dcc..182cbc26f7a8 100644
--- a/accessible/ipc/PDocAccessible.ipdl
+++ b/accessible/ipc/PDocAccessible.ipdl
@@ -216,6 +216,9 @@ child:
   prio(high) sync SelectAll(uint64_t aID) returns(bool aSuccess);
   prio(high) sync UnselectAll(uint64_t aID) returns(bool aSuccess);
 
+  async TakeSelection(uint64_t aID);
+  async SetSelected(uint64_t aID, bool aSelected);
+
   prio(high) sync DoAction(uint64_t aID, uint8_t aIndex) returns(bool aSuccess);
   prio(high) sync ActionCount(uint64_t aID) returns(uint8_t aCount);
   prio(high) sync ActionDescriptionAt(uint64_t aID, uint8_t aIndex) returns(nsString aDescription);
diff --git a/accessible/ipc/ProxyAccessible.cpp b/accessible/ipc/ProxyAccessible.cpp
index af54e4b1d833..d4db727243bf 100644
--- a/accessible/ipc/ProxyAccessible.cpp
+++ b/accessible/ipc/ProxyAccessible.cpp
@@ -906,6 +906,18 @@ ProxyAccessible::UnselectAll()
   return success;
 }
 
+void
+ProxyAccessible::TakeSelection()
+{
+  unused << mDoc->SendTakeSelection(mID);
+}
+
+void
+ProxyAccessible::SetSelected(bool aSelect)
+{
+  unused << mDoc->SendSetSelected(mID, aSelect);
+}
+
 bool
 ProxyAccessible::DoAction(uint8_t aIndex)
 {
diff --git a/accessible/ipc/ProxyAccessible.h b/accessible/ipc/ProxyAccessible.h
index 3d9c8334dead..b6176973c994 100644
--- a/accessible/ipc/ProxyAccessible.h
+++ b/accessible/ipc/ProxyAccessible.h
@@ -309,6 +309,9 @@ public:
   bool SelectAll();
   bool UnselectAll();
 
+  void TakeSelection();
+  void SetSelected(bool aSelect);
+
   bool DoAction(uint8_t aIndex);
   uint8_t ActionCount();
   void ActionDescriptionAt(uint8_t aIndex, nsString& aDescription);
diff --git a/accessible/windows/msaa/AccessibleWrap.cpp b/accessible/windows/msaa/AccessibleWrap.cpp
index 844ae6dcfc8a..3681c840f7d6 100644
--- a/accessible/windows/msaa/AccessibleWrap.cpp
+++ b/accessible/windows/msaa/AccessibleWrap.cpp
@@ -913,9 +913,6 @@ AccessibleWrap::accSelect(
     if (flagsSelect & SELFLAG_REMOVESELECTION)
       xpAccessible->SetSelected(false);
 
-    if (flagsSelect & SELFLAG_EXTENDSELECTION)
-      xpAccessible->ExtendSelection();
-
     return S_OK;
   }
 
diff --git a/accessible/xpcom/xpcAccessible.cpp b/accessible/xpcom/xpcAccessible.cpp
index 76e01bf4acf8..1952da872bd6 100644
--- a/accessible/xpcom/xpcAccessible.cpp
+++ b/accessible/xpcom/xpcAccessible.cpp
@@ -498,16 +498,6 @@ xpcAccessible::SetSelected(bool aSelect)
   return NS_OK;
 }
 
-NS_IMETHODIMP
-xpcAccessible::ExtendSelection()
-{
-  if (!Intl())
-    return NS_ERROR_FAILURE;
-
-  Intl()->ExtendSelection();
-  return NS_OK;
-}
-
 NS_IMETHODIMP
 xpcAccessible::TakeSelection()
 {
diff --git a/accessible/xpcom/xpcAccessible.h b/accessible/xpcom/xpcAccessible.h
index 6f1132a6a893..124b1add761b 100644
--- a/accessible/xpcom/xpcAccessible.h
+++ b/accessible/xpcom/xpcAccessible.h
@@ -73,7 +73,6 @@ public:
     final override;
 
   NS_IMETHOD SetSelected(bool aSelect) final override;
-  NS_IMETHOD ExtendSelection() final override;
   NS_IMETHOD TakeSelection() final override;
   NS_IMETHOD TakeFocus() final override;
 

From b36bf706087426e5c66d7312d1ba25b0c26a543f Mon Sep 17 00:00:00 2001
From: Jed Davis <jld@mozilla.com>
Date: Fri, 9 Oct 2015 16:20:00 +0200
Subject: [PATCH 31/63] Bug 1213491 - Change
 CanvasRenderingContext2D::ContextState::clipsPushed to an nsTArray. r=nical

---
 dom/canvas/CanvasRenderingContext2D.cpp | 8 ++++----
 dom/canvas/CanvasRenderingContext2D.h   | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/dom/canvas/CanvasRenderingContext2D.cpp b/dom/canvas/CanvasRenderingContext2D.cpp
index c9a21b171b3a..8f14a9590654 100644
--- a/dom/canvas/CanvasRenderingContext2D.cpp
+++ b/dom/canvas/CanvasRenderingContext2D.cpp
@@ -1235,7 +1235,7 @@ bool CanvasRenderingContext2D::SwitchRenderingMode(RenderingMode aRenderingMode)
   mTarget->DrawSurface(snapshot, r, r);
 
   // Restore the clips and transform
-  for (uint32_t i = 0; i < CurrentState().clipsPushed.size(); i++) {
+  for (uint32_t i = 0; i < CurrentState().clipsPushed.Length(); i++) {
     mTarget->PushClip(CurrentState().clipsPushed[i]);
   }
 
@@ -1719,7 +1719,7 @@ CanvasRenderingContext2D::Restore()
 
   TransformWillUpdate();
 
-  for (uint32_t i = 0; i < CurrentState().clipsPushed.size(); i++) {
+  for (uint32_t i = 0; i < CurrentState().clipsPushed.Length(); i++) {
     mTarget->PopClip();
   }
 
@@ -2864,7 +2864,7 @@ CanvasRenderingContext2D::Clip(const CanvasWindingRule& winding)
   }
 
   mTarget->PushClip(mPath);
-  CurrentState().clipsPushed.push_back(mPath);
+  CurrentState().clipsPushed.AppendElement(mPath);
 }
 
 void
@@ -2879,7 +2879,7 @@ CanvasRenderingContext2D::Clip(const CanvasPath& path, const CanvasWindingRule&
   }
 
   mTarget->PushClip(gfxpath);
-  CurrentState().clipsPushed.push_back(gfxpath);
+  CurrentState().clipsPushed.AppendElement(gfxpath);
 }
 
 void
diff --git a/dom/canvas/CanvasRenderingContext2D.h b/dom/canvas/CanvasRenderingContext2D.h
index b04c1d672fab..0d73a6ca5127 100644
--- a/dom/canvas/CanvasRenderingContext2D.h
+++ b/dom/canvas/CanvasRenderingContext2D.h
@@ -984,7 +984,7 @@ protected:
       return std::min(SIGMA_MAX, shadowBlur / 2.0f);
     }
 
-    std::vector<mozilla::RefPtr<mozilla::gfx::Path> > clipsPushed;
+    nsTArray<mozilla::RefPtr<mozilla::gfx::Path> > clipsPushed;
 
     nsRefPtr<gfxFontGroup> fontGroup;
     nsCOMPtr<nsIAtom> fontLanguage;

From dad9a8cbfb9a8d53f2d99197b01a25ba05d4654c Mon Sep 17 00:00:00 2001
From: Jan-Ivar Bruaroey <jib@mozilla.com>
Date: Mon, 12 Oct 2015 19:12:01 -0400
Subject: [PATCH 32/63] Bug 1213738 - media::NewRunnableFrom() and
 media::NewTaskFrom() move lambda arg instead of copying it. r=jesup

--HG--
extra : transplant_source : 7%CD%AD%C5%CA%01%D6%D6%CB71%C8L%B6w6%9A%E9%ECN
---
 dom/media/systemservices/MediaUtils.h | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/dom/media/systemservices/MediaUtils.h b/dom/media/systemservices/MediaUtils.h
index bda56d81839e..9f35a8a1df63 100644
--- a/dom/media/systemservices/MediaUtils.h
+++ b/dom/media/systemservices/MediaUtils.h
@@ -186,7 +186,7 @@ template<typename OnRunType>
 class LambdaRunnable : public nsRunnable
 {
 public:
-  explicit LambdaRunnable(OnRunType& aOnRun) : mOnRun(aOnRun) {}
+  explicit LambdaRunnable(OnRunType&& aOnRun) : mOnRun(Move(aOnRun)) {}
 private:
   NS_IMETHODIMP
   Run()
@@ -198,16 +198,16 @@ private:
 
 template<typename OnRunType>
 LambdaRunnable<OnRunType>*
-NewRunnableFrom(OnRunType aOnRun)
+NewRunnableFrom(OnRunType&& aOnRun)
 {
-  return new LambdaRunnable<OnRunType>(aOnRun);
+  return new LambdaRunnable<OnRunType>(Forward<OnRunType>(aOnRun));
 }
 
 template<typename OnRunType>
 class LambdaTask : public Task
 {
 public:
-  explicit LambdaTask(OnRunType& aOnRun) : mOnRun(aOnRun) {}
+  explicit LambdaTask(OnRunType&& aOnRun) : mOnRun(Move(aOnRun)) {}
 private:
   void
   Run()
@@ -219,9 +219,9 @@ private:
 
 template<typename OnRunType>
 LambdaTask<OnRunType>*
-NewTaskFrom(OnRunType aOnRun)
+NewTaskFrom(OnRunType&& aOnRun)
 {
-  return new LambdaTask<OnRunType>(aOnRun);
+  return new LambdaTask<OnRunType>(Forward<OnRunType>(aOnRun));
 }
 
 /* media::CoatCheck - There and back again. Park an object in exchange for an id.

From 48f52094475a19f22015ba13e9ea798a01d24188 Mon Sep 17 00:00:00 2001
From: Jan-Ivar Bruaroey <jib@mozilla.com>
Date: Tue, 13 Oct 2015 14:34:54 -0400
Subject: [PATCH 33/63] Bug 1213738 - media::Pledge.Then() moves lambda args
 instead of copying them. r=jesup

--HG--
extra : transplant_source : X%BAyz%A1%BBD%03%3D%21Tv%C7%3E%CFT%02%D0%5D%85
---
 dom/media/systemservices/MediaUtils.h | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/dom/media/systemservices/MediaUtils.h b/dom/media/systemservices/MediaUtils.h
index 9f35a8a1df63..a1f496a96f6b 100644
--- a/dom/media/systemservices/MediaUtils.h
+++ b/dom/media/systemservices/MediaUtils.h
@@ -68,19 +68,19 @@ public:
   Pledge& operator = (const Pledge&) = delete;
 
   template<typename OnSuccessType>
-  void Then(OnSuccessType aOnSuccess)
+  void Then(OnSuccessType&& aOnSuccess)
   {
-    Then(aOnSuccess, [](ErrorType&){});
+    Then(Forward<OnSuccessType>(aOnSuccess), [](ErrorType&){});
   }
 
   template<typename OnSuccessType, typename OnFailureType>
-  void Then(OnSuccessType aOnSuccess, OnFailureType aOnFailure)
+  void Then(OnSuccessType&& aOnSuccess, OnFailureType&& aOnFailure)
   {
     class Functors : public FunctorsBase
     {
     public:
-      Functors(OnSuccessType& aOnSuccess, OnFailureType& aOnFailure)
-        : mOnSuccess(aOnSuccess), mOnFailure(aOnFailure) {}
+      Functors(OnSuccessType&& aOnSuccess, OnFailureType&& aOnFailure)
+        : mOnSuccess(Move(aOnSuccess)), mOnFailure(Move(aOnFailure)) {}
 
       void Succeed(ValueType& result)
       {
@@ -94,8 +94,8 @@ public:
       OnSuccessType mOnSuccess;
       OnFailureType mOnFailure;
     };
-    mFunctors = new Functors(aOnSuccess, aOnFailure);
-
+    mFunctors = new Functors(Forward<OnSuccessType>(aOnSuccess),
+                             Forward<OnFailureType>(aOnFailure));
     if (mDone) {
       if (!mRejected) {
         mFunctors->Succeed(mValue);

From 73266dd62b8f9914f0615444b095516f9e4d7954 Mon Sep 17 00:00:00 2001
From: Aryeh Gregor <ayg@aryeh.name>
Date: Tue, 13 Oct 2015 11:28:00 +0200
Subject: [PATCH 34/63] Bug 1214164 - Don't honor all <option> descendants of
 <select>; r=bz

Per spec, we should only pay attention to options that are children of
the select, or of an optgroup child of the select.
---
 dom/html/HTMLOptGroupElement.cpp              |  16 +-
 dom/html/HTMLOptGroupElement.h                |   2 +-
 dom/html/HTMLSelectElement.cpp                | 249 ++++++++----------
 dom/html/HTMLSelectElement.h                  |  26 --
 .../htmloptionscollection.html.ini            |   5 -
 5 files changed, 109 insertions(+), 189 deletions(-)
 delete mode 100644 testing/web-platform/meta/html/infrastructure/common-dom-interfaces/collections/htmloptionscollection.html.ini

diff --git a/dom/html/HTMLOptGroupElement.cpp b/dom/html/HTMLOptGroupElement.cpp
index 20acca501acd..8e523201943e 100644
--- a/dom/html/HTMLOptGroupElement.cpp
+++ b/dom/html/HTMLOptGroupElement.cpp
@@ -69,20 +69,14 @@ HTMLOptGroupElement::PreHandleEvent(EventChainPreVisitor& aVisitor)
   return nsGenericHTMLElement::PreHandleEvent(aVisitor);
 }
 
-nsIContent*
+Element*
 HTMLOptGroupElement::GetSelect()
 {
-  nsIContent* parent = this;
-  while ((parent = parent->GetParent()) && parent->IsHTMLElement()) {
-    if (parent->IsHTMLElement(nsGkAtoms::select)) {
-      return parent;
-    }
-    if (!parent->IsHTMLElement(nsGkAtoms::optgroup)) {
-      break;
-    }
+  Element* parent = nsINode::GetParentElement();
+  if (!parent || !parent->IsHTMLElement(nsGkAtoms::select)) {
+    return nullptr;
   }
-  
-  return nullptr;
+  return parent;
 }
 
 nsresult
diff --git a/dom/html/HTMLOptGroupElement.h b/dom/html/HTMLOptGroupElement.h
index 10349a735187..d53a2e32b134 100644
--- a/dom/html/HTMLOptGroupElement.h
+++ b/dom/html/HTMLOptGroupElement.h
@@ -76,7 +76,7 @@ protected:
    * Get the select content element that contains this option
    * @param aSelectElement the select element [OUT]
    */
-  nsIContent* GetSelect();
+  Element* GetSelect();
 };
 
 } // namespace dom
diff --git a/dom/html/HTMLSelectElement.cpp b/dom/html/HTMLSelectElement.cpp
index 188a6ba3908e..4497394b24f6 100644
--- a/dom/html/HTMLSelectElement.cpp
+++ b/dom/html/HTMLSelectElement.cpp
@@ -226,7 +226,33 @@ HTMLSelectElement::InsertOptionsIntoList(nsIContent* aOptions,
                                          bool aNotify)
 {
   int32_t insertIndex = aListIndex;
-  InsertOptionsIntoListRecurse(aOptions, &insertIndex, aDepth);
+
+  HTMLOptionElement* optElement = HTMLOptionElement::FromContent(aOptions);
+  if (optElement) {
+    mOptions->InsertOptionAt(optElement, insertIndex);
+    insertIndex++;
+  } else {
+    // If it's at the top level, then we just found out there are non-options
+    // at the top level, which will throw off the insert count
+    if (aDepth == 0) {
+      mNonOptionChildren++;
+    }
+
+    // Deal with optgroups
+    if (aOptions->IsHTMLElement(nsGkAtoms::optgroup)) {
+      mOptGroupCount++;
+
+      for (nsIContent* child = aOptions->GetFirstChild();
+           child;
+           child = child->GetNextSibling()) {
+        optElement = HTMLOptionElement::FromContent(child);
+        if (optElement) {
+          mOptions->InsertOptionAt(optElement, insertIndex);
+          insertIndex++;
+        }
+      }
+    }
+  }
 
   // Deal with the selected list
   if (insertIndex - aListIndex) {
@@ -282,9 +308,40 @@ HTMLSelectElement::RemoveOptionsFromList(nsIContent* aOptions,
                                          bool aNotify)
 {
   int32_t numRemoved = 0;
-  nsresult rv = RemoveOptionsFromListRecurse(aOptions, aListIndex, &numRemoved,
-                                             aDepth);
-  NS_ENSURE_SUCCESS(rv, rv);
+
+  HTMLOptionElement* optElement = HTMLOptionElement::FromContent(aOptions);
+  if (optElement) {
+    if (mOptions->ItemAsOption(aListIndex) != optElement) {
+      NS_ERROR("wrong option at index");
+      return NS_ERROR_UNEXPECTED;
+    }
+    mOptions->RemoveOptionAt(aListIndex);
+    numRemoved++;
+  } else {
+    // Yay, one less artifact at the top level.
+    if (aDepth == 0) {
+      mNonOptionChildren--;
+    }
+
+    // Recurse down deeper for options
+    if (mOptGroupCount && aOptions->IsHTMLElement(nsGkAtoms::optgroup)) {
+      mOptGroupCount--;
+
+      for (nsIContent* child = aOptions->GetFirstChild();
+          child;
+          child = child->GetNextSibling()) {
+        optElement = HTMLOptionElement::FromContent(child);
+        if (optElement) {
+          if (mOptions->ItemAsOption(aListIndex) != optElement) {
+            NS_ERROR("wrong option at index");
+            return NS_ERROR_UNEXPECTED;
+          }
+          mOptions->RemoveOptionAt(aListIndex);
+          numRemoved++;
+        }
+      }
+    }
+  }
 
   if (numRemoved) {
     // Tell the widget we removed the options
@@ -324,91 +381,6 @@ HTMLSelectElement::RemoveOptionsFromList(nsIContent* aOptions,
   return NS_OK;
 }
 
-// If the document is such that recursing over these options gets us
-// deeper than four levels, there is something terribly wrong with the
-// world.
-void
-HTMLSelectElement::InsertOptionsIntoListRecurse(nsIContent* aOptions,
-                                                int32_t* aInsertIndex,
-                                                int32_t aDepth)
-{
-  // We *assume* here that someone's brain has not gone horribly
-  // wrong by putting <option> inside of <option>.  I'm sorry, I'm
-  // just not going to look for an option inside of an option.
-  // Sue me.
-
-  HTMLOptionElement* optElement = HTMLOptionElement::FromContent(aOptions);
-  if (optElement) {
-    mOptions->InsertOptionAt(optElement, *aInsertIndex);
-    (*aInsertIndex)++;
-    return;
-  }
-
-  // If it's at the top level, then we just found out there are non-options
-  // at the top level, which will throw off the insert count
-  if (aDepth == 0) {
-    mNonOptionChildren++;
-  }
-
-  // Recurse down into optgroups
-  if (aOptions->IsHTMLElement(nsGkAtoms::optgroup)) {
-    mOptGroupCount++;
-
-    for (nsIContent* child = aOptions->GetFirstChild();
-         child;
-         child = child->GetNextSibling()) {
-      InsertOptionsIntoListRecurse(child, aInsertIndex, aDepth + 1);
-    }
-  }
-}
-
-// If the document is such that recursing over these options gets us deeper than
-// four levels, there is something terribly wrong with the world.
-nsresult
-HTMLSelectElement::RemoveOptionsFromListRecurse(nsIContent* aOptions,
-                                                int32_t aRemoveIndex,
-                                                int32_t* aNumRemoved,
-                                                int32_t aDepth)
-{
-  // We *assume* here that someone's brain has not gone horribly
-  // wrong by putting <option> inside of <option>.  I'm sorry, I'm
-  // just not going to look for an option inside of an option.
-  // Sue me.
-
-  nsCOMPtr<nsIDOMHTMLOptionElement> optElement(do_QueryInterface(aOptions));
-  if (optElement) {
-    if (mOptions->ItemAsOption(aRemoveIndex) != optElement) {
-      NS_ERROR("wrong option at index");
-      return NS_ERROR_UNEXPECTED;
-    }
-    mOptions->RemoveOptionAt(aRemoveIndex);
-    (*aNumRemoved)++;
-    return NS_OK;
-  }
-
-  // Yay, one less artifact at the top level.
-  if (aDepth == 0) {
-    mNonOptionChildren--;
-  }
-
-  // Recurse down deeper for options
-  if (mOptGroupCount && aOptions->IsHTMLElement(nsGkAtoms::optgroup)) {
-    mOptGroupCount--;
-
-    for (nsIContent* child = aOptions->GetFirstChild();
-         child;
-         child = child->GetNextSibling()) {
-      nsresult rv = RemoveOptionsFromListRecurse(child,
-                                                 aRemoveIndex,
-                                                 aNumRemoved,
-                                                 aDepth + 1);
-      NS_ENSURE_SUCCESS(rv, rv);
-    }
-  }
-
-  return NS_OK;
-}
-
 // XXXldb Doing the processing before the content nodes have been added
 // to the document (as the name of this function seems to require, and
 // as the callers do), is highly unusual.  Passing around unparented
@@ -420,10 +392,10 @@ HTMLSelectElement::WillAddOptions(nsIContent* aOptions,
                                   int32_t aContentIndex,
                                   bool aNotify)
 {
-  int32_t level = GetContentDepth(aParent);
-  if (level == -1) {
-    return NS_ERROR_FAILURE;
+  if (this != aParent && this != aParent->GetParent()) {
+    return NS_OK;
   }
+  int32_t level = aParent == this ? 0 : 1;
 
   // Get the index where the options will be inserted
   int32_t ind = -1;
@@ -462,11 +434,10 @@ HTMLSelectElement::WillRemoveOptions(nsIContent* aParent,
                                      int32_t aContentIndex,
                                      bool aNotify)
 {
-  int32_t level = GetContentDepth(aParent);
-  NS_ASSERTION(level >= 0, "getting notified by unexpected content");
-  if (level == -1) {
-    return NS_ERROR_FAILURE;
+  if (this != aParent && this != aParent->GetParent()) {
+    return NS_OK;
   }
+  int32_t level = this == aParent ? 0 : 1;
 
   // Get the index where the options will be removed
   nsIContent* currentKid = aParent->GetChildAt(aContentIndex);
@@ -489,24 +460,6 @@ HTMLSelectElement::WillRemoveOptions(nsIContent* aParent,
   return NS_OK;
 }
 
-int32_t
-HTMLSelectElement::GetContentDepth(nsIContent* aContent)
-{
-  nsIContent* content = aContent;
-
-  int32_t retval = 0;
-  while (content != this) {
-    retval++;
-    content = content->GetParent();
-    if (!content) {
-      retval = -1;
-      break;
-    }
-  }
-
-  return retval;
-}
-
 int32_t
 HTMLSelectElement::GetOptionIndexAt(nsIContent* aOptions)
 {
@@ -528,9 +481,7 @@ HTMLSelectElement::GetOptionIndexAfter(nsIContent* aOptions)
   //   in the parent.
   // - If it's not there, search for the first option after the parent.
   if (aOptions == this) {
-    uint32_t len;
-    GetLength(&len);
-    return len;
+    return Length();
   }
 
   int32_t retval = -1;
@@ -558,8 +509,6 @@ HTMLSelectElement::GetFirstOptionIndex(nsIContent* aOptions)
   HTMLOptionElement* optElement = HTMLOptionElement::FromContent(aOptions);
   if (optElement) {
     GetOptionIndex(optElement, 0, true, &listIndex);
-    // If you nested stuff under the option, you're just plain
-    // screwed.  *I'm* not going to aid and abet your evil deed.
     return listIndex;
   }
 
@@ -1785,16 +1734,23 @@ HTMLSelectElement::DispatchContentReset()
 }
 
 static void
-AddOptionsRecurse(nsIContent* aRoot, HTMLOptionsCollection* aArray)
+AddOptions(nsIContent* aRoot, HTMLOptionsCollection* aArray)
 {
-  for (nsIContent* cur = aRoot->GetFirstChild();
-       cur;
-       cur = cur->GetNextSibling()) {
-    HTMLOptionElement* opt = HTMLOptionElement::FromContent(cur);
+  for (nsIContent* child = aRoot->GetFirstChild();
+       child;
+       child = child->GetNextSibling()) {
+    HTMLOptionElement* opt = HTMLOptionElement::FromContent(child);
     if (opt) {
       aArray->AppendOption(opt);
-    } else if (cur->IsHTMLElement(nsGkAtoms::optgroup)) {
-      AddOptionsRecurse(cur, aArray);
+    } else if (child->IsHTMLElement(nsGkAtoms::optgroup)) {
+      for (nsIContent* grandchild = child->GetFirstChild();
+           grandchild;
+           grandchild = grandchild->GetNextSibling()) {
+        opt = HTMLOptionElement::FromContent(grandchild);
+        if (opt) {
+          aArray->AppendOption(opt);
+        }
+      }
     }
   }
 }
@@ -1803,7 +1759,7 @@ void
 HTMLSelectElement::RebuildOptionsArray(bool aNotify)
 {
   mOptions->Clear();
-  AddOptionsRecurse(this, mOptions);
+  AddOptions(this, mOptions);
   FindSelectedIndex(0, aNotify);
 }
 
@@ -1863,28 +1819,29 @@ HTMLSelectElement::GetValidationMessage(nsAString& aValidationMessage,
 
 #ifdef DEBUG
 
-static void
-VerifyOptionsRecurse(nsIContent* aRoot, int32_t& aIndex,
-                     HTMLOptionsCollection* aArray)
-{
-  for (nsIContent* cur = aRoot->GetFirstChild();
-       cur;
-       cur = cur->GetNextSibling()) {
-    nsCOMPtr<nsIDOMHTMLOptionElement> opt = do_QueryInterface(cur);
-    if (opt) {
-      NS_ASSERTION(opt == aArray->ItemAsOption(aIndex++),
-                   "Options collection broken");
-    } else if (cur->IsHTMLElement(nsGkAtoms::optgroup)) {
-      VerifyOptionsRecurse(cur, aIndex, aArray);
-    }
-  }
-}
-
 void
 HTMLSelectElement::VerifyOptionsArray()
 {
-  int32_t aIndex = 0;
-  VerifyOptionsRecurse(this, aIndex, mOptions);
+  int32_t index = 0;
+  for (nsIContent* child = nsINode::GetFirstChild();
+       child;
+       child = child->GetNextSibling()) {
+    HTMLOptionElement* opt = HTMLOptionElement::FromContent(child);
+    if (opt) {
+      NS_ASSERTION(opt == mOptions->ItemAsOption(index++),
+                   "Options collection broken");
+    } else if (child->IsHTMLElement(nsGkAtoms::optgroup)) {
+      for (nsIContent* grandchild = child->GetFirstChild();
+           grandchild;
+           grandchild = grandchild->GetNextSibling()) {
+        opt = HTMLOptionElement::FromContent(grandchild);
+        if (opt) {
+          NS_ASSERTION(opt == mOptions->ItemAsOption(index++),
+                       "Options collection broken");
+        }
+      }
+    }
+  }
 }
 
 #endif
diff --git a/dom/html/HTMLSelectElement.h b/dom/html/HTMLSelectElement.h
index f06c30ea5c7c..308ca08c4c94 100644
--- a/dom/html/HTMLSelectElement.h
+++ b/dom/html/HTMLSelectElement.h
@@ -502,37 +502,11 @@ protected:
                                  int32_t aListIndex,
                                  int32_t aDepth,
                                  bool aNotify);
-  /**
-   * Insert option(s) into the options[] array (called by InsertOptionsIntoList)
-   * @param aOptions the option or optgroup being added
-   * @param aInsertIndex the index to start adding options into the list at
-   * @param aDepth the depth of aOptions (1=direct child of select ...)
-   */
-  void InsertOptionsIntoListRecurse(nsIContent* aOptions,
-                                    int32_t* aInsertIndex,
-                                    int32_t aDepth);
-  /**
-   * Remove option(s) from the options[] array (called by RemoveOptionsFromList)
-   * @param aOptions the option or optgroup being added
-   * @param aListIndex the index to start removing options from the list at
-   * @param aNumRemoved the number removed so far [OUT]
-   * @param aDepth the depth of aOptions (1=direct child of select ...)
-   */
-  nsresult RemoveOptionsFromListRecurse(nsIContent* aOptions,
-                                        int32_t aRemoveIndex,
-                                        int32_t* aNumRemoved,
-                                        int32_t aDepth);
 
   // nsIConstraintValidation
   void UpdateBarredFromConstraintValidation();
   bool IsValueMissing();
 
-  /**
-   * Find out how deep this content is from the select (1=direct child)
-   * @param aContent the content to check
-   * @return the depth
-   */
-  int32_t GetContentDepth(nsIContent* aContent);
   /**
    * Get the index of the first option at, under or following the content in
    * the select, or length of options[] if none are found
diff --git a/testing/web-platform/meta/html/infrastructure/common-dom-interfaces/collections/htmloptionscollection.html.ini b/testing/web-platform/meta/html/infrastructure/common-dom-interfaces/collections/htmloptionscollection.html.ini
deleted file mode 100644
index b19990b23b8f..000000000000
--- a/testing/web-platform/meta/html/infrastructure/common-dom-interfaces/collections/htmloptionscollection.html.ini
+++ /dev/null
@@ -1,5 +0,0 @@
-[htmloptionscollection.html]
-  type: testharness
-  [Insert <optgroup><optgroup><option>6</option></optgroup></optgroup> into <select>]
-    expected: FAIL
-

From 46310c2e6d714a9551a71cf1ef71f050ab899728 Mon Sep 17 00:00:00 2001
From: Olli Pettay <Olli.Pettay@helsinki.fi>
Date: Tue, 13 Oct 2015 22:00:35 +0300
Subject: [PATCH 35/63] Bug 1214316 - Improve assertions on top level remote
 accessible doc handling, r=tbsaunde

---
 accessible/generic/OuterDocAccessible.cpp | 7 +------
 dom/ipc/TabParent.cpp                     | 3 +++
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/accessible/generic/OuterDocAccessible.cpp b/accessible/generic/OuterDocAccessible.cpp
index 792afd138ad5..daf7b77de8b8 100644
--- a/accessible/generic/OuterDocAccessible.cpp
+++ b/accessible/generic/OuterDocAccessible.cpp
@@ -192,10 +192,5 @@ OuterDocAccessible::RemoteChildDoc() const
   if (!tab)
     return nullptr;
 
-  if (DocAccessibleParent* doc = tab->GetTopLevelDocAccessible()) {
-    return doc;
-  }
-
-  MOZ_ASSERT(false, "no top level tab document?");
-  return nullptr;
+  return tab->GetTopLevelDocAccessible();
 }
diff --git a/dom/ipc/TabParent.cpp b/dom/ipc/TabParent.cpp
index 1417f2477933..bfbead5efa00 100644
--- a/dom/ipc/TabParent.cpp
+++ b/dom/ipc/TabParent.cpp
@@ -1454,6 +1454,9 @@ TabParent::GetTopLevelDocAccessible() const
       return doc;
     }
   }
+
+  MOZ_ASSERT(docCount == 0, "If there isn't a top level accessible doc "
+                             "there shouldn't be an accessible doc at all!");
 #endif
   return nullptr;
 }

From 3073aa69bc0308337a64956151b3533868fca162 Mon Sep 17 00:00:00 2001
From: Lars T Hansen <lhansen@mozilla.com>
Date: Fri, 9 Oct 2015 18:10:37 +0100
Subject: [PATCH 36/63] Bug 1211409 - load/store exclusive for ARM-32. 
 r=jolesen

---
 .../tests/atomics/mutual-exclusion.js         |  91 +++++++
 js/src/jit/arm/Simulator-arm.cpp              | 244 +++++++++++++++---
 js/src/jit/arm/Simulator-arm.h                |  21 ++
 3 files changed, 320 insertions(+), 36 deletions(-)
 create mode 100644 js/src/jit-test/tests/atomics/mutual-exclusion.js

diff --git a/js/src/jit-test/tests/atomics/mutual-exclusion.js b/js/src/jit-test/tests/atomics/mutual-exclusion.js
new file mode 100644
index 000000000000..665d8be56866
--- /dev/null
+++ b/js/src/jit-test/tests/atomics/mutual-exclusion.js
@@ -0,0 +1,91 @@
+// Let a few threads hammer on memory with atomics to provoke errors
+// in exclusion work.  This test is not 100% fail-safe: the test may
+// pass despite a bug, but this is unlikely.
+
+if (!(this.SharedArrayBuffer && this.getSharedArrayBuffer && this.setSharedArrayBuffer))
+    quit(0);
+
+// Map an Int32Array on shared memory.  The first location is used as
+// a counter, each worker counts up on exit and the main thread will
+// wait until the counter reaches the number of workers.  The other
+// elements are contended accumulators where we count up and down very
+// rapidly and for a long time, any failure in mutual exclusion should
+// lead to errors in the result.  (For example, the test fails almost
+// immediately when I disable simulation of mutual exclusion in the
+// ARM simulator.)
+
+const numWorkers = 4;           // You're not meant to change this
+const iterCount = 255;          // Nor this
+const sabLength = 1024;         // Nor this
+
+const oddResult = (function () {
+    var v = 0;
+    for ( var j=0 ; j < numWorkers ; j++ )
+        v |= (iterCount << (8 * j));
+    return v;
+})();
+
+const evenResult = 0;
+
+const sab = new SharedArrayBuffer(sabLength);
+
+setSharedArrayBuffer(sab);
+
+const iab = new SharedInt32Array(sab);
+
+function testRun(limit) {
+    console.log("Limit = " + limit);
+
+    // Fork off workers to hammer on memory.
+    for ( var i=0 ; i < numWorkers ; i++ ) {
+        evalInWorker(`
+                     const iab = new SharedInt32Array(getSharedArrayBuffer());
+                     const v = 1 << (8 * ${i});
+                     for ( var i=0 ; i < ${limit} ; i++ ) {
+                         for ( var k=0 ; k < ${iterCount} ; k++ ) {
+                             if (i & 1) {
+                                 for ( var j=1 ; j < iab.length ; j++ )
+                                     Atomics.sub(iab, j, v);
+                             }
+                             else {
+                                 for ( var j=1 ; j < iab.length ; j++ )
+                                     Atomics.add(iab, j, v);
+                             }
+                         }
+                     }
+                     Atomics.add(iab, 0, 1);
+                     `);
+    }
+
+    // Wait...
+    while (Atomics.load(iab, 0) != numWorkers)
+        ;
+    Atomics.store(iab, 0, 0);
+
+    // Check the results and clear the array again.
+    const v = (limit & 1) ? oddResult : evenResult;
+    for ( var i=1 ; i < iab.length ; i++ ) {
+        assertEq(iab[i], v);
+        iab[i] = 0;
+    }
+}
+
+function fib(n) {
+    if (n < 2)
+        return n;
+    return fib(n-1) + fib(n-2);
+}
+
+const limit = (function () {
+    var val = 5;
+    if (typeof getJitCompilerOptions == "function") {
+        var opt = getJitCompilerOptions();
+        if (opt["ion.enable"])
+            val = 10;
+    }
+    return val;
+})();
+
+console.log("This test can easily take 60s on 2015-class x86 hardware");
+for ( var i=2 ; i < limit ; i++ )
+    testRun(fib(i));
diff --git a/js/src/jit/arm/Simulator-arm.cpp b/js/src/jit/arm/Simulator-arm.cpp
index d369e759b828..6d15308bba98 100644
--- a/js/src/jit/arm/Simulator-arm.cpp
+++ b/js/src/jit/arm/Simulator-arm.cpp
@@ -36,9 +36,11 @@
 #include "mozilla/SizePrintfMacros.h"
 
 #include "asmjs/AsmJSValidate.h"
+#include "jit/AtomicOperations.h"
 #include "jit/arm/Assembler-arm.h"
 #include "jit/arm/disasm/Constants-arm.h"
 #include "vm/Runtime.h"
+#include "vm/SharedMem.h"
 
 extern "C" {
 
@@ -1127,6 +1129,8 @@ Simulator::Simulator()
     cacheLockHolder_ = nullptr;
 #endif
     redirection_ = nullptr;
+    exclusiveMonitorHeld_ = false;
+    exclusiveMonitor_ = 0;
 }
 
 bool
@@ -1478,6 +1482,27 @@ Simulator::setCallResult(int64_t res)
     set_register(r1, static_cast<int32_t>(res >> 32));
 }
 
+void
+Simulator::exclusiveMonitorSet(uint64_t value)
+{
+    exclusiveMonitor_ = value;
+    exclusiveMonitorHeld_ = true;
+}
+
+uint64_t
+Simulator::exclusiveMonitorGetAndClear(bool* held)
+{
+    *held = exclusiveMonitorHeld_;
+    exclusiveMonitorHeld_ = false;
+    return *held ? exclusiveMonitor_ : 0;
+}
+
+void
+Simulator::exclusiveMonitorClear()
+{
+    exclusiveMonitorHeld_ = false;
+}
+
 int
 Simulator::readW(int32_t addr, SimInstruction* instr)
 {
@@ -1504,14 +1529,66 @@ Simulator::writeW(int32_t addr, int value, SimInstruction* instr)
     }
 }
 
+// For the time being, define Relaxed operations in terms of SeqCst
+// operations - we don't yet need Relaxed operations anywhere else in
+// the system, and the distinction is not important to the simulation
+// at the level where we're operating.
+
+template<typename T>
+static
+T loadRelaxed(SharedMem<T*> addr)
+{
+    return AtomicOperations::loadSeqCst(addr);
+}
+
+template<typename T>
+static
+T compareExchangeRelaxed(SharedMem<T*> addr, T oldval, T newval)
+{
+    return AtomicOperations::compareExchangeSeqCst(addr, oldval, newval);
+}
+
+int
+Simulator::readExW(int32_t addr, SimInstruction* instr)
+{
+    // The regexp engine emits unaligned loads, so we don't check for them here
+    // like most of the other methods do.
+    if ((addr & 3) == 0 || !HasAlignmentFault()) {
+        SharedMem<int32_t*> ptr = SharedMem<int32_t*>::shared(reinterpret_cast<int32_t*>(addr));
+        int32_t value = loadRelaxed(ptr);
+        exclusiveMonitorSet(value);
+        return value;
+    } else {
+        printf("Unaligned write at 0x%08x, pc=%p\n", addr, instr);
+        MOZ_CRASH();
+    }
+}
+
+int32_t
+Simulator::writeExW(int32_t addr, int value, SimInstruction* instr)
+{
+    if ((addr & 3) == 0) {
+        SharedMem<int32_t*> ptr = SharedMem<int32_t*>::shared(reinterpret_cast<int32_t*>(addr));
+        bool held;
+        int32_t expected = int32_t(exclusiveMonitorGetAndClear(&held));
+        if (!held)
+            return 1;
+        int32_t old = compareExchangeRelaxed(ptr, expected, int32_t(value));
+        return old != expected;
+    } else {
+        printf("Unaligned write at 0x%08x, pc=%p\n", addr, instr);
+        MOZ_CRASH();
+    }
+}
+
 uint16_t
 Simulator::readHU(int32_t addr, SimInstruction* instr)
 {
     // The regexp engine emits unaligned loads, so we don't check for them here
     // like most of the other methods do.
     if ((addr & 1) == 0 || !HasAlignmentFault()) {
-       uint16_t* ptr = reinterpret_cast<uint16_t*>(addr);
-       return *ptr;
+        uint16_t* ptr = reinterpret_cast<uint16_t*>(addr);
+        return *ptr;
     }
     printf("Unaligned unsigned halfword read at 0x%08x, pc=%p\n", addr, instr);
     MOZ_CRASH();
@@ -1554,6 +1631,39 @@ Simulator::writeH(int32_t addr, int16_t value, SimInstruction* instr)
     }
 }
 
+uint16_t
+Simulator::readExHU(int32_t addr, SimInstruction* instr)
+{
+    // The regexp engine emits unaligned loads, so we don't check for them here
+    // like most of the other methods do.
+    if ((addr & 1) == 0 || !HasAlignmentFault()) {
+        SharedMem<uint16_t*> ptr = SharedMem<uint16_t*>::shared(reinterpret_cast<uint16_t*>(addr));
+        uint16_t value = loadRelaxed(ptr);
+        exclusiveMonitorSet(value);
+        return value;
+    }
+    printf("Unaligned atomic unsigned halfword read at 0x%08x, pc=%p\n", addr, instr);
+    MOZ_CRASH();
+    return 0;
+}
+
+int32_t
+Simulator::writeExH(int32_t addr, uint16_t value, SimInstruction* instr)
+{
+    if ((addr & 1) == 0) {
+        SharedMem<uint16_t*> ptr = SharedMem<uint16_t*>::shared(reinterpret_cast<uint16_t*>(addr));
+        bool held;
+        uint16_t expected = uint16_t(exclusiveMonitorGetAndClear(&held));
+        if (!held)
+            return 1;
+        uint16_t old = compareExchangeRelaxed(ptr, expected, value);
+        return old != expected;
+    } else {
+        printf("Unaligned atomic unsigned halfword write at 0x%08x, pc=%p\n", addr, instr);
+        MOZ_CRASH();
+    }
+}
+
 uint8_t
 Simulator::readBU(int32_t addr)
 {
@@ -1561,6 +1671,27 @@ Simulator::readBU(int32_t addr)
     return *ptr;
 }
 
+uint8_t
+Simulator::readExBU(int32_t addr)
+{
+    SharedMem<uint8_t*> ptr = SharedMem<uint8_t*>::shared(reinterpret_cast<uint8_t*>(addr));
+    uint8_t value = loadRelaxed(ptr);
+    exclusiveMonitorSet(value);
+    return value;
+}
+
+int32_t
+Simulator::writeExB(int32_t addr, uint8_t value)
+{
+    SharedMem<uint8_t*> ptr = SharedMem<uint8_t*>::shared(reinterpret_cast<uint8_t*>(addr));
+    bool held;
+    uint8_t expected = uint8_t(exclusiveMonitorGetAndClear(&held));
+    if (!held)
+        return 1;
+    uint8_t old = compareExchangeRelaxed(ptr, expected, value);
+    return old != expected;
+}
+
 int8_t
 Simulator::readB(int32_t addr)
 {
@@ -1607,6 +1738,49 @@ Simulator::writeDW(int32_t addr, int32_t value1, int32_t value2)
     }
 }
 
+int32_t
+Simulator::readExDW(int32_t addr, int32_t* hibits)
+{
+#if defined(__clang__) && defined(__i386)
+    // This is OK for now, we don't yet generate LDREXD.
+    MOZ_CRASH("Unimplemented - 8-byte atomics are unsupported in Clang on i386");
+#else
+    if ((addr & 3) == 0) {
+        SharedMem<uint64_t*> ptr = SharedMem<uint64_t*>::shared(reinterpret_cast<uint64_t*>(addr));
+        uint64_t value = loadRelaxed(ptr);
+        exclusiveMonitorSet(value);
+        *hibits = int32_t(value);
+        return int32_t(value >> 32);
+    }
+    printf("Unaligned read at 0x%08x\n", addr);
+    MOZ_CRASH();
+    return 0;
+#endif
+}
+
+int32_t
+Simulator::writeExDW(int32_t addr, int32_t value1, int32_t value2)
+{
+#if defined(__clang__) && defined(__i386)
+    // This is OK for now, we don't yet generate STREXD.
+    MOZ_CRASH("Unimplemented - 8-byte atomics are unsupported in Clang on i386");
+#else
+    if ((addr & 3) == 0) {
+        SharedMem<uint64_t*> ptr = SharedMem<uint64_t*>::shared(reinterpret_cast<uint64_t*>(addr));
+        uint64_t value = (uint64_t(value1) << 32) | uint32_t(value2);
+        bool held;
+        uint64_t expected = exclusiveMonitorGetAndClear(&held);
+        if (!held)
+            return 1;
+        uint64_t old = compareExchangeRelaxed(ptr, expected, value);
+        return old != expected;
+    } else {
+        printf("Unaligned write at 0x%08x\n", addr);
+        MOZ_CRASH();
+    }
+#endif
+}
+
 uintptr_t
 Simulator::stackLimit() const
 {
@@ -2554,33 +2728,27 @@ Simulator::decodeType01(SimInstruction* instr)
             } else {
                 if (instr->bits(disasm::ExclusiveOpHi, disasm::ExclusiveOpLo) == disasm::ExclusiveOpcode) {
                     // Load-exclusive / store-exclusive.
-                    //
-                    // Bare-bones simulation: the store always succeeds, and we
-                    // do not execute any fences.  Also, we allow readDW and
-                    // writeDW to split the memory transaction.
-                    //
-                    // The next step up would involve remembering the value
-                    // that was read with load-exclusive so that we could use
-                    // compareExchange for the store-exclusive, and to
-                    // implement atomic doubleword read and write.
-                    //
-                    // Also see DMB/DSB/ISB below.
                     if (instr->bit(disasm::ExclusiveLoad)) {
                         int rn = instr->rnValue();
                         int rt = instr->rtValue();
                         int32_t address = get_register(rn);
                         switch (instr->bits(disasm::ExclusiveSizeHi, disasm::ExclusiveSizeLo)) {
                           case disasm::ExclusiveWord:
-                            set_register(rt, readW(address, instr));
+                            set_register(rt, readExW(address, instr));
                             break;
-                          case disasm::ExclusiveDouble:
-                            set_dw_register(rt, readDW(address));
+                          case disasm::ExclusiveDouble: {
+                            MOZ_ASSERT((rt % 2) == 0);
+                            int32_t hibits;
+                            int32_t lobits = readExDW(address, &hibits);
+                            set_register(rt, lobits);
+                            set_register(rt+1, hibits);
                             break;
+                          }
                           case disasm::ExclusiveByte:
-                            set_register(rt, readBU(address));
+                            set_register(rt, readExBU(address));
                             break;
                           case disasm::ExclusiveHalf:
-                            set_register(rt, readHU(address, instr));
+                            set_register(rt, readExHU(address, instr));
                             break;
                         }
                     } else {
@@ -2589,24 +2757,25 @@ Simulator::decodeType01(SimInstruction* instr)
                         int rt = instr->bits(3,0);
                         int32_t address = get_register(rn);
                         int32_t value = get_register(rt);
+                        int32_t result = 0;
                         switch (instr->bits(disasm::ExclusiveSizeHi, disasm::ExclusiveSizeLo)) {
                           case disasm::ExclusiveWord:
-                            writeW(address, value, instr);
+                            result = writeExW(address, value, instr);
                             break;
                           case disasm::ExclusiveDouble: {
-                              MOZ_ASSERT((rt % 2) == 0);
-                              int32_t value2 = get_register(rt+1);
-                              writeDW(address, value, value2);
-                              break;
+                            MOZ_ASSERT((rt % 2) == 0);
+                            int32_t value2 = get_register(rt+1);
+                            result = writeExDW(address, value, value2);
+                            break;
                           }
                           case disasm::ExclusiveByte:
-                            writeB(address, (uint8_t)value);
+                            result = writeExB(address, (uint8_t)value);
                             break;
                           case disasm::ExclusiveHalf:
-                            writeH(address, (uint16_t)value, instr);
+                            result = writeExH(address, (uint16_t)value, instr);
                             break;
                         }
-                        set_register(rd, 0);
+                        set_register(rd, result);
                     }
                 } else {
                     MOZ_CRASH(); // Not used atm
@@ -3329,12 +3498,15 @@ Simulator::decodeType7CoprocessorIns(SimInstruction* instr)
             int CRn = instr->bits(19,16);
             int CRm = instr->bits(3,0);
             if (opc1 == 0 && opc2 == 4 && CRn == 7 && CRm == 10) {
-                // ARMv6 DSB instruction - do nothing now, see comments above
+                // ARMv6 DSB instruction.  We do not use DSB.
+                MOZ_CRASH("DSB not implemented");
             } else if (opc1 == 0 && opc2 == 5 && CRn == 7 && CRm == 10) {
-                // ARMv6 DMB instruction - do nothing now, see comments above
+                // ARMv6 DMB instruction.
+                AtomicOperations::fenceSeqCst();
             }
             else if (opc1 == 0 && opc2 == 4 && CRn == 7 && CRm == 5) {
-                // ARMv6 ISB instruction - do nothing now, see comments above
+                // ARMv6 ISB instruction.  We do not use ISB.
+                MOZ_CRASH("ISB not implemented");
             }
             else {
                 MOZ_CRASH();
@@ -4156,16 +4328,16 @@ Simulator::decodeSpecialCondition(SimInstruction* instr)
         break;
       case 0xA:
         if (instr->bits(31,20) == 0xf57) {
-            // Minimal simulation: do nothing.
-            //
-            // If/when we upgrade load-exclusive and store-exclusive (above) to
-            // do something useful concurrency-wise, we should also upgrade
-            // these instructions.
             switch (instr->bits(7,4)) {
               case 5: // DMB
-              case 4: // DSB
-              case 6: // ISB
+                AtomicOperations::fenceSeqCst();
                 break;
+              case 4: // DSB
+                // We do not use DSB.
+                MOZ_CRASH("DSB unimplemented");
+              case 6: // ISB
+                // We do not use ISB.
+                MOZ_CRASH("ISB unimplemented");
               default:
                 MOZ_CRASH();
             }
diff --git a/js/src/jit/arm/Simulator-arm.h b/js/src/jit/arm/Simulator-arm.h
index f6785a4138b8..5f0f865b0942 100644
--- a/js/src/jit/arm/Simulator-arm.h
+++ b/js/src/jit/arm/Simulator-arm.h
@@ -248,18 +248,30 @@ class Simulator
     inline void writeB(int32_t addr, uint8_t value);
     inline void writeB(int32_t addr, int8_t value);
 
+    inline uint8_t readExBU(int32_t addr);
+    inline int32_t writeExB(int32_t addr, uint8_t value);
+
     inline uint16_t readHU(int32_t addr, SimInstruction* instr);
     inline int16_t readH(int32_t addr, SimInstruction* instr);
     // Note: Overloaded on the sign of the value.
     inline void writeH(int32_t addr, uint16_t value, SimInstruction* instr);
     inline void writeH(int32_t addr, int16_t value, SimInstruction* instr);
 
+    inline uint16_t readExHU(int32_t addr, SimInstruction* instr);
+    inline int32_t writeExH(int32_t addr, uint16_t value, SimInstruction* instr);
+
     inline int readW(int32_t addr, SimInstruction* instr);
     inline void writeW(int32_t addr, int value, SimInstruction* instr);
 
+    inline int readExW(int32_t addr, SimInstruction* instr);
+    inline int writeExW(int32_t addr, int value, SimInstruction* instr);
+
     int32_t* readDW(int32_t addr);
     void writeDW(int32_t addr, int32_t value1, int32_t value2);
 
+    int32_t readExDW(int32_t addr, int32_t* hibits);
+    int32_t writeExDW(int32_t addr, int32_t value1, int32_t value2);
+
     // Executing is handled based on the instruction type.
     // Both type 0 and type 1 rolled into one.
     void decodeType01(SimInstruction* instr);
@@ -432,6 +444,15 @@ class Simulator
         MOZ_ASSERT(cacheLockHolder_);
         redirection_ = redirection;
     }
+
+  private:
+    // Exclusive access monitor
+    void exclusiveMonitorSet(uint64_t value);
+    uint64_t exclusiveMonitorGetAndClear(bool* held);
+    void exclusiveMonitorClear();
+
+    bool exclusiveMonitorHeld_;
+    uint64_t exclusiveMonitor_;
 };
 
 #define JS_CHECK_SIMULATOR_RECURSION_WITH_EXTRA(cx, extra, onerror)             \

From 372d96ff2687083b4a4811a308cd1011fe03769a Mon Sep 17 00:00:00 2001
From: Tooru Fujisawa <arai_a@mac.com>
Date: Wed, 14 Oct 2015 02:55:08 +0900
Subject: [PATCH 37/63] Bug 1214049 - Use ReportOutOfMemory in
 NativeObject::goodElementsAllocationAmount. r=Waldo

--HG--
extra : commitid : LSM1VK7jkP
extra : rebase_source : 8cb3bb4be0cf3fac6306a2c8d24dae6b349f94ae
---
 js/src/jit-test/tests/arrays/too-long-array-splice.js | 6 ++++++
 js/src/vm/NativeObject.cpp                            | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)
 create mode 100644 js/src/jit-test/tests/arrays/too-long-array-splice.js

diff --git a/js/src/jit-test/tests/arrays/too-long-array-splice.js b/js/src/jit-test/tests/arrays/too-long-array-splice.js
new file mode 100644
index 000000000000..7e3f9386c8e3
--- /dev/null
+++ b/js/src/jit-test/tests/arrays/too-long-array-splice.js
@@ -0,0 +1,6 @@
+// |jit-test| allow-oom
+// array.splice should throw if array.length is too large.
+
+var length = 4294967295;
+var array = new Array(length);
+array.splice(100);
diff --git a/js/src/vm/NativeObject.cpp b/js/src/vm/NativeObject.cpp
index 67bf73f10ee5..df02d2c984b8 100644
--- a/js/src/vm/NativeObject.cpp
+++ b/js/src/vm/NativeObject.cpp
@@ -677,7 +677,7 @@ NativeObject::goodElementsAllocationAmount(ExclusiveContext* cx, uint32_t reqCap
                                            uint32_t length, uint32_t* goodAmount)
 {
     if (reqCapacity > MAX_DENSE_ELEMENTS_COUNT) {
-        ReportAllocationOverflow(cx);
+        ReportOutOfMemory(cx);
         return false;
     }
 

From a2f3106edef98223f14cd4b1af8f837018dee44f Mon Sep 17 00:00:00 2001
From: Nigel Babu <nigelbabu@gmail.com>
Date: Wed, 14 Oct 2015 13:29:03 +0530
Subject: [PATCH 38/63] Backed out changeset e184609e1d13 (bug 1207546) for
 bustage ON A CLOSED TREE

--HG--
extra : amend_source : 2ba50d75927848525041bea8ab3bbf371c72342d
---
 dom/base/test/mochitest.ini                   |  2 -
 .../test/test_audioNotificationStream.html    | 71 -------------------
 dom/html/HTMLMediaElement.cpp                 |  3 +-
 3 files changed, 1 insertion(+), 75 deletions(-)
 delete mode 100644 dom/base/test/test_audioNotificationStream.html

diff --git a/dom/base/test/mochitest.ini b/dom/base/test/mochitest.ini
index 686157158b38..a0bae4613277 100644
--- a/dom/base/test/mochitest.ini
+++ b/dom/base/test/mochitest.ini
@@ -269,8 +269,6 @@ support-files =
 [test_audioWindowUtils.html]
 [test_audioNotification.html]
 skip-if = buildapp == 'mulet'
-[test_audioNotificationStream.html]
-skip-if = buildapp == 'mulet'
 [test_audioNotificationStopOnNavigation.html]
 skip-if = buildapp == 'mulet'
 [test_audioNotificationWithEarlyPlay.html]
diff --git a/dom/base/test/test_audioNotificationStream.html b/dom/base/test/test_audioNotificationStream.html
deleted file mode 100644
index adb513a7c78e..000000000000
--- a/dom/base/test/test_audioNotificationStream.html
+++ /dev/null
@@ -1,71 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-  <title>Test for audio controller in windows</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<body>
-<pre id="test">
-</pre>
-
-<script type="application/javascript">
-
-SimpleTest.waitForExplicitFinish();
-
-var expectedNotification = null;
-
-var observer = {
-  observe: function(subject, topic, data) {
-    is(topic, "audio-playback", "audio-playback received");
-    is(data, expectedNotification, "This is the right notification");
-    runTest();
-  }
-};
-
-var observerService = SpecialPowers.Cc["@mozilla.org/observer-service;1"]
-                                   .getService(SpecialPowers.Ci.nsIObserverService);
-
-var audio = new Audio();
-audio.srcObject = (new AudioContext()).createMediaStreamDestination().stream;
-
-var tests = [
-  function() {
-    observerService.addObserver(observer, "audio-playback", false);
-    ok(true, "Observer set");
-    runTest();
-  },
-
-  function() {
-    expectedNotification = 'active';
-    audio.play();
-  },
-
-  function() {
-    expectedNotification = 'inactive';
-    audio.pause();
-  },
-
-  function() {
-    observerService.removeObserver(observer, "audio-playback");
-    ok(true, "Observer removed");
-    runTest();
-  }
-];
-
-function runTest() {
-  if (!tests.length) {
-    SimpleTest.finish();
-    return;
-  }
-
-  var test = tests.shift();
-  test();
-}
-
-runTest();
-
-</script>
-</body>
-</html>
-
diff --git a/dom/html/HTMLMediaElement.cpp b/dom/html/HTMLMediaElement.cpp
index 3ac7988a11aa..572c0b8cf8d2 100644
--- a/dom/html/HTMLMediaElement.cpp
+++ b/dom/html/HTMLMediaElement.cpp
@@ -4730,8 +4730,7 @@ HTMLMediaElement::UpdateAudioChannelPlayingState()
       (HasAttr(kNameSpaceID_None, nsGkAtoms::loop) ||
        (mReadyState >= nsIDOMHTMLMediaElement::HAVE_CURRENT_DATA &&
         !IsPlaybackEnded()) ||
-       mPlayingThroughTheAudioChannelBeforeSeek ||
-       mSrcAttrStream));
+       mPlayingThroughTheAudioChannelBeforeSeek));
   if (playingThroughTheAudioChannel != mPlayingThroughTheAudioChannel) {
     mPlayingThroughTheAudioChannel = playingThroughTheAudioChannel;
 

From b85d91e42519365e282ccbee4792c2fcd92dedc2 Mon Sep 17 00:00:00 2001
From: Lars T Hansen <lhansen@mozilla.com>
Date: Wed, 14 Oct 2015 10:13:30 +0200
Subject: [PATCH 39/63] Bug 1211409 - fix include order ON CLOSED TREE.

---
 js/src/jit/arm/Simulator-arm.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/src/jit/arm/Simulator-arm.cpp b/js/src/jit/arm/Simulator-arm.cpp
index 6d15308bba98..9fa0fba4562e 100644
--- a/js/src/jit/arm/Simulator-arm.cpp
+++ b/js/src/jit/arm/Simulator-arm.cpp
@@ -36,9 +36,9 @@
 #include "mozilla/SizePrintfMacros.h"
 
 #include "asmjs/AsmJSValidate.h"
-#include "jit/AtomicOperations.h"
 #include "jit/arm/Assembler-arm.h"
 #include "jit/arm/disasm/Constants-arm.h"
+#include "jit/AtomicOperations.h"
 #include "vm/Runtime.h"
 #include "vm/SharedMem.h"
 

From 0c8f234c7f3bb4471e8e0333ef9122e86ff9616c Mon Sep 17 00:00:00 2001
From: "Carsten \"Tomcat\" Book" <cbook@mozilla.com>
Date: Wed, 14 Oct 2015 10:44:39 +0200
Subject: [PATCH 40/63] Backed out changeset 315e05e75b35 (bug 1211409)

---
 js/src/jit/arm/Simulator-arm.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/src/jit/arm/Simulator-arm.cpp b/js/src/jit/arm/Simulator-arm.cpp
index 9fa0fba4562e..6d15308bba98 100644
--- a/js/src/jit/arm/Simulator-arm.cpp
+++ b/js/src/jit/arm/Simulator-arm.cpp
@@ -36,9 +36,9 @@
 #include "mozilla/SizePrintfMacros.h"
 
 #include "asmjs/AsmJSValidate.h"
+#include "jit/AtomicOperations.h"
 #include "jit/arm/Assembler-arm.h"
 #include "jit/arm/disasm/Constants-arm.h"
-#include "jit/AtomicOperations.h"
 #include "vm/Runtime.h"
 #include "vm/SharedMem.h"
 

From b5df6bcbac2bf6d6fc04ba681d6ed0a179b4a349 Mon Sep 17 00:00:00 2001
From: "Carsten \"Tomcat\" Book" <cbook@mozilla.com>
Date: Wed, 14 Oct 2015 10:45:09 +0200
Subject: [PATCH 41/63] Backed out changeset 30eae53d9cb5 (bug 1211409) for
 spidermonkey test failures on a CLOSED TREE

---
 .../tests/atomics/mutual-exclusion.js         |  91 -------
 js/src/jit/arm/Simulator-arm.cpp              | 242 +++---------------
 js/src/jit/arm/Simulator-arm.h                |  21 --
 3 files changed, 35 insertions(+), 319 deletions(-)
 delete mode 100644 js/src/jit-test/tests/atomics/mutual-exclusion.js

diff --git a/js/src/jit-test/tests/atomics/mutual-exclusion.js b/js/src/jit-test/tests/atomics/mutual-exclusion.js
deleted file mode 100644
index 665d8be56866..000000000000
--- a/js/src/jit-test/tests/atomics/mutual-exclusion.js
+++ /dev/null
@@ -1,91 +0,0 @@
-// Let a few threads hammer on memory with atomics to provoke errors
-// in exclusion work.  This test is not 100% fail-safe: the test may
-// pass despite a bug, but this is unlikely.
-
-if (!(this.SharedArrayBuffer && this.getSharedArrayBuffer && this.setSharedArrayBuffer))
-    quit(0);
-
-// Map an Int32Array on shared memory.  The first location is used as
-// a counter, each worker counts up on exit and the main thread will
-// wait until the counter reaches the number of workers.  The other
-// elements are contended accumulators where we count up and down very
-// rapidly and for a long time, any failure in mutual exclusion should
-// lead to errors in the result.  (For example, the test fails almost
-// immediately when I disable simulation of mutual exclusion in the
-// ARM simulator.)
-
-const numWorkers = 4;           // You're not meant to change this
-const iterCount = 255;          // Nor this
-const sabLength = 1024;         // Nor this
-
-const oddResult = (function () {
-    var v = 0;
-    for ( var j=0 ; j < numWorkers ; j++ )
-        v |= (iterCount << (8 * j));
-    return v;
-})();
-
-const evenResult = 0;
-
-const sab = new SharedArrayBuffer(sabLength);
-
-setSharedArrayBuffer(sab);
-
-const iab = new SharedInt32Array(sab);
-
-function testRun(limit) {
-    console.log("Limit = " + limit);
-
-    // Fork off workers to hammer on memory.
-    for ( var i=0 ; i < numWorkers ; i++ ) {
-        evalInWorker(`
-                     const iab = new SharedInt32Array(getSharedArrayBuffer());
-                     const v = 1 << (8 * ${i});
-                     for ( var i=0 ; i < ${limit} ; i++ ) {
-                         for ( var k=0 ; k < ${iterCount} ; k++ ) {
-                             if (i & 1) {
-                                 for ( var j=1 ; j < iab.length ; j++ )
-                                     Atomics.sub(iab, j, v);
-                             }
-                             else {
-                                 for ( var j=1 ; j < iab.length ; j++ )
-                                     Atomics.add(iab, j, v);
-                             }
-                         }
-                     }
-                     Atomics.add(iab, 0, 1);
-                     `);
-    }
-
-    // Wait...
-    while (Atomics.load(iab, 0) != numWorkers)
-        ;
-    Atomics.store(iab, 0, 0);
-
-    // Check the results and clear the array again.
-    const v = (limit & 1) ? oddResult : evenResult;
-    for ( var i=1 ; i < iab.length ; i++ ) {
-        assertEq(iab[i], v);
-        iab[i] = 0;
-    }
-}
-
-function fib(n) {
-    if (n < 2)
-        return n;
-    return fib(n-1) + fib(n-2);
-}
-
-const limit = (function () {
-    var val = 5;
-    if (typeof getJitCompilerOptions == "function") {
-        var opt = getJitCompilerOptions();
-        if (opt["ion.enable"])
-            val = 10;
-    }
-    return val;
-})();
-
-console.log("This test can easily take 60s on 2015-class x86 hardware");
-for ( var i=2 ; i < limit ; i++ )
-    testRun(fib(i));
diff --git a/js/src/jit/arm/Simulator-arm.cpp b/js/src/jit/arm/Simulator-arm.cpp
index 6d15308bba98..d369e759b828 100644
--- a/js/src/jit/arm/Simulator-arm.cpp
+++ b/js/src/jit/arm/Simulator-arm.cpp
@@ -36,11 +36,9 @@
 #include "mozilla/SizePrintfMacros.h"
 
 #include "asmjs/AsmJSValidate.h"
-#include "jit/AtomicOperations.h"
 #include "jit/arm/Assembler-arm.h"
 #include "jit/arm/disasm/Constants-arm.h"
 #include "vm/Runtime.h"
-#include "vm/SharedMem.h"
 
 extern "C" {
 
@@ -1129,8 +1127,6 @@ Simulator::Simulator()
     cacheLockHolder_ = nullptr;
 #endif
     redirection_ = nullptr;
-    exclusiveMonitorHeld_ = false;
-    exclusiveMonitor_ = 0;
 }
 
 bool
@@ -1482,27 +1478,6 @@ Simulator::setCallResult(int64_t res)
     set_register(r1, static_cast<int32_t>(res >> 32));
 }
 
-void
-Simulator::exclusiveMonitorSet(uint64_t value)
-{
-    exclusiveMonitor_ = value;
-    exclusiveMonitorHeld_ = true;
-}
-
-uint64_t
-Simulator::exclusiveMonitorGetAndClear(bool* held)
-{
-    *held = exclusiveMonitorHeld_;
-    exclusiveMonitorHeld_ = false;
-    return *held ? exclusiveMonitor_ : 0;
-}
-
-void
-Simulator::exclusiveMonitorClear()
-{
-    exclusiveMonitorHeld_ = false;
-}
-
 int
 Simulator::readW(int32_t addr, SimInstruction* instr)
 {
@@ -1529,66 +1504,14 @@ Simulator::writeW(int32_t addr, int value, SimInstruction* instr)
     }
 }
 
-// For the time being, define Relaxed operations in terms of SeqCst
-// operations - we don't yet need Relaxed operations anywhere else in
-// the system, and the distinction is not important to the simulation
-// at the level where we're operating.
-
-template<typename T>
-static
-T loadRelaxed(SharedMem<T*> addr)
-{
-    return AtomicOperations::loadSeqCst(addr);
-}
-
-template<typename T>
-static
-T compareExchangeRelaxed(SharedMem<T*> addr, T oldval, T newval)
-{
-    return AtomicOperations::compareExchangeSeqCst(addr, oldval, newval);
-}
-
-int
-Simulator::readExW(int32_t addr, SimInstruction* instr)
-{
-    // The regexp engine emits unaligned loads, so we don't check for them here
-    // like most of the other methods do.
-    if ((addr & 3) == 0 || !HasAlignmentFault()) {
-        SharedMem<int32_t*> ptr = SharedMem<int32_t*>::shared(reinterpret_cast<int32_t*>(addr));
-        int32_t value = loadRelaxed(ptr);
-        exclusiveMonitorSet(value);
-        return value;
-    } else {
-        printf("Unaligned write at 0x%08x, pc=%p\n", addr, instr);
-        MOZ_CRASH();
-    }
-}
-
-int32_t
-Simulator::writeExW(int32_t addr, int value, SimInstruction* instr)
-{
-    if ((addr & 3) == 0) {
-        SharedMem<int32_t*> ptr = SharedMem<int32_t*>::shared(reinterpret_cast<int32_t*>(addr));
-        bool held;
-        int32_t expected = int32_t(exclusiveMonitorGetAndClear(&held));
-        if (!held)
-            return 1;
-        int32_t old = compareExchangeRelaxed(ptr, expected, int32_t(value));
-        return old != expected;
-    } else {
-        printf("Unaligned write at 0x%08x, pc=%p\n", addr, instr);
-        MOZ_CRASH();
-    }
-}
-
 uint16_t
 Simulator::readHU(int32_t addr, SimInstruction* instr)
 {
     // The regexp engine emits unaligned loads, so we don't check for them here
     // like most of the other methods do.
     if ((addr & 1) == 0 || !HasAlignmentFault()) {
-        uint16_t* ptr = reinterpret_cast<uint16_t*>(addr);
-        return *ptr;
+       uint16_t* ptr = reinterpret_cast<uint16_t*>(addr);
+       return *ptr;
     }
     printf("Unaligned unsigned halfword read at 0x%08x, pc=%p\n", addr, instr);
     MOZ_CRASH();
@@ -1631,39 +1554,6 @@ Simulator::writeH(int32_t addr, int16_t value, SimInstruction* instr)
     }
 }
 
-uint16_t
-Simulator::readExHU(int32_t addr, SimInstruction* instr)
-{
-    // The regexp engine emits unaligned loads, so we don't check for them here
-    // like most of the other methods do.
-    if ((addr & 1) == 0 || !HasAlignmentFault()) {
-        SharedMem<uint16_t*> ptr = SharedMem<uint16_t*>::shared(reinterpret_cast<uint16_t*>(addr));
-        uint16_t value = loadRelaxed(ptr);
-        exclusiveMonitorSet(value);
-        return value;
-    }
-    printf("Unaligned atomic unsigned halfword read at 0x%08x, pc=%p\n", addr, instr);
-    MOZ_CRASH();
-    return 0;
-}
-
-int32_t
-Simulator::writeExH(int32_t addr, uint16_t value, SimInstruction* instr)
-{
-    if ((addr & 1) == 0) {
-        SharedMem<uint16_t*> ptr = SharedMem<uint16_t*>::shared(reinterpret_cast<uint16_t*>(addr));
-        bool held;
-        uint16_t expected = uint16_t(exclusiveMonitorGetAndClear(&held));
-        if (!held)
-            return 1;
-        uint16_t old = compareExchangeRelaxed(ptr, expected, value);
-        return old != expected;
-    } else {
-        printf("Unaligned atomic unsigned halfword write at 0x%08x, pc=%p\n", addr, instr);
-        MOZ_CRASH();
-    }
-}
-
 uint8_t
 Simulator::readBU(int32_t addr)
 {
@@ -1671,27 +1561,6 @@ Simulator::readBU(int32_t addr)
     return *ptr;
 }
 
-uint8_t
-Simulator::readExBU(int32_t addr)
-{
-    SharedMem<uint8_t*> ptr = SharedMem<uint8_t*>::shared(reinterpret_cast<uint8_t*>(addr));
-    uint8_t value = loadRelaxed(ptr);
-    exclusiveMonitorSet(value);
-    return value;
-}
-
-int32_t
-Simulator::writeExB(int32_t addr, uint8_t value)
-{
-    SharedMem<uint8_t*> ptr = SharedMem<uint8_t*>::shared(reinterpret_cast<uint8_t*>(addr));
-    bool held;
-    uint8_t expected = uint8_t(exclusiveMonitorGetAndClear(&held));
-    if (!held)
-        return 1;
-    uint8_t old = compareExchangeRelaxed(ptr, expected, value);
-    return old != expected;
-}
-
 int8_t
 Simulator::readB(int32_t addr)
 {
@@ -1738,49 +1607,6 @@ Simulator::writeDW(int32_t addr, int32_t value1, int32_t value2)
     }
 }
 
-int32_t
-Simulator::readExDW(int32_t addr, int32_t* hibits)
-{
-#if defined(__clang__) && defined(__i386)
-    // This is OK for now, we don't yet generate LDREXD.
-    MOZ_CRASH("Unimplemented - 8-byte atomics are unsupported in Clang on i386");
-#else
-    if ((addr & 3) == 0) {
-        SharedMem<uint64_t*> ptr = SharedMem<uint64_t*>::shared(reinterpret_cast<uint64_t*>(addr));
-        uint64_t value = loadRelaxed(ptr);
-        exclusiveMonitorSet(value);
-        *hibits = int32_t(value);
-        return int32_t(value >> 32);
-    }
-    printf("Unaligned read at 0x%08x\n", addr);
-    MOZ_CRASH();
-    return 0;
-#endif
-}
-
-int32_t
-Simulator::writeExDW(int32_t addr, int32_t value1, int32_t value2)
-{
-#if defined(__clang__) && defined(__i386)
-    // This is OK for now, we don't yet generate STREXD.
-    MOZ_CRASH("Unimplemented - 8-byte atomics are unsupported in Clang on i386");
-#else
-    if ((addr & 3) == 0) {
-        SharedMem<uint64_t*> ptr = SharedMem<uint64_t*>::shared(reinterpret_cast<uint64_t*>(addr));
-        uint64_t value = (uint64_t(value1) << 32) | uint32_t(value2);
-        bool held;
-        uint64_t expected = exclusiveMonitorGetAndClear(&held);
-        if (!held)
-            return 1;
-        uint64_t old = compareExchangeRelaxed(ptr, expected, value);
-        return old != expected;
-    } else {
-        printf("Unaligned write at 0x%08x\n", addr);
-        MOZ_CRASH();
-    }
-#endif
-}
-
 uintptr_t
 Simulator::stackLimit() const
 {
@@ -2728,27 +2554,33 @@ Simulator::decodeType01(SimInstruction* instr)
             } else {
                 if (instr->bits(disasm::ExclusiveOpHi, disasm::ExclusiveOpLo) == disasm::ExclusiveOpcode) {
                     // Load-exclusive / store-exclusive.
+                    //
+                    // Bare-bones simulation: the store always succeeds, and we
+                    // do not execute any fences.  Also, we allow readDW and
+                    // writeDW to split the memory transaction.
+                    //
+                    // The next step up would involve remembering the value
+                    // that was read with load-exclusive so that we could use
+                    // compareExchange for the store-exclusive, and to
+                    // implement atomic doubleword read and write.
+                    //
+                    // Also see DMB/DSB/ISB below.
                     if (instr->bit(disasm::ExclusiveLoad)) {
                         int rn = instr->rnValue();
                         int rt = instr->rtValue();
                         int32_t address = get_register(rn);
                         switch (instr->bits(disasm::ExclusiveSizeHi, disasm::ExclusiveSizeLo)) {
                           case disasm::ExclusiveWord:
-                            set_register(rt, readExW(address, instr));
+                            set_register(rt, readW(address, instr));
                             break;
-                          case disasm::ExclusiveDouble: {
-                            MOZ_ASSERT((rt % 2) == 0);
-                            int32_t hibits;
-                            int32_t lobits = readExDW(address, &hibits);
-                            set_register(rt, lobits);
-                            set_register(rt+1, hibits);
+                          case disasm::ExclusiveDouble:
+                            set_dw_register(rt, readDW(address));
                             break;
-                          }
                           case disasm::ExclusiveByte:
-                            set_register(rt, readExBU(address));
+                            set_register(rt, readBU(address));
                             break;
                           case disasm::ExclusiveHalf:
-                            set_register(rt, readExHU(address, instr));
+                            set_register(rt, readHU(address, instr));
                             break;
                         }
                     } else {
@@ -2757,25 +2589,24 @@ Simulator::decodeType01(SimInstruction* instr)
                         int rt = instr->bits(3,0);
                         int32_t address = get_register(rn);
                         int32_t value = get_register(rt);
-                        int32_t result = 0;
                         switch (instr->bits(disasm::ExclusiveSizeHi, disasm::ExclusiveSizeLo)) {
                           case disasm::ExclusiveWord:
-                            result = writeExW(address, value, instr);
+                            writeW(address, value, instr);
                             break;
                           case disasm::ExclusiveDouble: {
-                            MOZ_ASSERT((rt % 2) == 0);
-                            int32_t value2 = get_register(rt+1);
-                            result = writeExDW(address, value, value2);
-                            break;
+                              MOZ_ASSERT((rt % 2) == 0);
+                              int32_t value2 = get_register(rt+1);
+                              writeDW(address, value, value2);
+                              break;
                           }
                           case disasm::ExclusiveByte:
-                            result = writeExB(address, (uint8_t)value);
+                            writeB(address, (uint8_t)value);
                             break;
                           case disasm::ExclusiveHalf:
-                            result = writeExH(address, (uint16_t)value, instr);
+                            writeH(address, (uint16_t)value, instr);
                             break;
                         }
-                        set_register(rd, result);
+                        set_register(rd, 0);
                     }
                 } else {
                     MOZ_CRASH(); // Not used atm
@@ -3498,15 +3329,12 @@ Simulator::decodeType7CoprocessorIns(SimInstruction* instr)
             int CRn = instr->bits(19,16);
             int CRm = instr->bits(3,0);
             if (opc1 == 0 && opc2 == 4 && CRn == 7 && CRm == 10) {
-                // ARMv6 DSB instruction.  We do not use DSB.
-                MOZ_CRASH("DSB not implemented");
+                // ARMv6 DSB instruction - do nothing now, see comments above
             } else if (opc1 == 0 && opc2 == 5 && CRn == 7 && CRm == 10) {
-                // ARMv6 DMB instruction.
-                AtomicOperations::fenceSeqCst();
+                // ARMv6 DMB instruction - do nothing now, see comments above
             }
             else if (opc1 == 0 && opc2 == 4 && CRn == 7 && CRm == 5) {
-                // ARMv6 ISB instruction.  We do not use ISB.
-                MOZ_CRASH("ISB not implemented");
+                // ARMv6 ISB instruction - do nothing now, see comments above
             }
             else {
                 MOZ_CRASH();
@@ -4328,16 +4156,16 @@ Simulator::decodeSpecialCondition(SimInstruction* instr)
         break;
       case 0xA:
         if (instr->bits(31,20) == 0xf57) {
+            // Minimal simulation: do nothing.
+            //
+            // If/when we upgrade load-exclusive and store-exclusive (above) to
+            // do something useful concurrency-wise, we should also upgrade
+            // these instructions.
             switch (instr->bits(7,4)) {
               case 5: // DMB
-                AtomicOperations::fenceSeqCst();
-                break;
               case 4: // DSB
-                // We do not use DSB.
-                MOZ_CRASH("DSB unimplemented");
               case 6: // ISB
-                // We do not use ISB.
-                MOZ_CRASH("ISB unimplemented");
+                break;
               default:
                 MOZ_CRASH();
             }
diff --git a/js/src/jit/arm/Simulator-arm.h b/js/src/jit/arm/Simulator-arm.h
index 5f0f865b0942..f6785a4138b8 100644
--- a/js/src/jit/arm/Simulator-arm.h
+++ b/js/src/jit/arm/Simulator-arm.h
@@ -248,30 +248,18 @@ class Simulator
     inline void writeB(int32_t addr, uint8_t value);
     inline void writeB(int32_t addr, int8_t value);
 
-    inline uint8_t readExBU(int32_t addr);
-    inline int32_t writeExB(int32_t addr, uint8_t value);
-
     inline uint16_t readHU(int32_t addr, SimInstruction* instr);
     inline int16_t readH(int32_t addr, SimInstruction* instr);
     // Note: Overloaded on the sign of the value.
     inline void writeH(int32_t addr, uint16_t value, SimInstruction* instr);
     inline void writeH(int32_t addr, int16_t value, SimInstruction* instr);
 
-    inline uint16_t readExHU(int32_t addr, SimInstruction* instr);
-    inline int32_t writeExH(int32_t addr, uint16_t value, SimInstruction* instr);
-
     inline int readW(int32_t addr, SimInstruction* instr);
     inline void writeW(int32_t addr, int value, SimInstruction* instr);
 
-    inline int readExW(int32_t addr, SimInstruction* instr);
-    inline int writeExW(int32_t addr, int value, SimInstruction* instr);
-
     int32_t* readDW(int32_t addr);
     void writeDW(int32_t addr, int32_t value1, int32_t value2);
 
-    int32_t readExDW(int32_t addr, int32_t* hibits);
-    int32_t writeExDW(int32_t addr, int32_t value1, int32_t value2);
-
     // Executing is handled based on the instruction type.
     // Both type 0 and type 1 rolled into one.
     void decodeType01(SimInstruction* instr);
@@ -444,15 +432,6 @@ class Simulator
         MOZ_ASSERT(cacheLockHolder_);
         redirection_ = redirection;
     }
-
-  private:
-    // Exclusive access monitor
-    void exclusiveMonitorSet(uint64_t value);
-    uint64_t exclusiveMonitorGetAndClear(bool* held);
-    void exclusiveMonitorClear();
-
-    bool exclusiveMonitorHeld_;
-    uint64_t exclusiveMonitor_;
 };
 
 #define JS_CHECK_SIMULATOR_RECURSION_WITH_EXTRA(cx, extra, onerror)             \

From 1cc6677a9097c379b3c5e0f5ba0e2126e70d4fcf Mon Sep 17 00:00:00 2001
From: JW Wang <jwwang@mozilla.com>
Date: Wed, 14 Oct 2015 11:46:27 +0800
Subject: [PATCH 42/63] Bug 1214065 - Remove unused arguments from
 MediaDecoder::Load() and its friends. r=kinetik.

---
 dom/html/HTMLMediaElement.cpp                | 11 +++++------
 dom/html/HTMLMediaElement.h                  |  5 ++---
 dom/media/MediaDecoder.cpp                   | 11 ++++-------
 dom/media/MediaDecoder.h                     |  5 ++---
 dom/media/MediaDecoderStateMachine.cpp       |  2 +-
 dom/media/MediaDecoderStateMachine.h         |  2 +-
 dom/media/mediasource/MediaSourceDecoder.cpp |  4 ++--
 dom/media/mediasource/MediaSourceDecoder.h   |  2 +-
 8 files changed, 18 insertions(+), 24 deletions(-)

diff --git a/dom/html/HTMLMediaElement.cpp b/dom/html/HTMLMediaElement.cpp
index 572c0b8cf8d2..a6403cb21080 100644
--- a/dom/html/HTMLMediaElement.cpp
+++ b/dom/html/HTMLMediaElement.cpp
@@ -1277,7 +1277,7 @@ nsresult HTMLMediaElement::LoadResource()
     if (IsAutoplayEnabled()) {
       mJoinLatency.Start();
     }
-    return FinishDecoderSetup(decoder, resource, nullptr, nullptr);
+    return FinishDecoderSetup(decoder, resource, nullptr);
   }
 
   // determine what security checks need to be performed in AsyncOpen2().
@@ -2777,7 +2777,7 @@ nsresult HTMLMediaElement::InitializeDecoderAsClone(MediaDecoder* aOriginal)
     return NS_ERROR_FAILURE;
   }
 
-  return FinishDecoderSetup(decoder, resource, nullptr, aOriginal);
+  return FinishDecoderSetup(decoder, resource, nullptr);
 }
 
 nsresult HTMLMediaElement::InitializeDecoderForChannel(nsIChannel* aChannel,
@@ -2821,14 +2821,13 @@ nsresult HTMLMediaElement::InitializeDecoderForChannel(nsIChannel* aChannel,
     }
     return NS_OK;
   } else {
-    return FinishDecoderSetup(decoder, resource, aListener, nullptr);
+    return FinishDecoderSetup(decoder, resource, aListener);
   }
 }
 
 nsresult HTMLMediaElement::FinishDecoderSetup(MediaDecoder* aDecoder,
                                               MediaResource* aStream,
-                                              nsIStreamListener** aListener,
-                                              MediaDecoder* aCloneDonor)
+                                              nsIStreamListener** aListener)
 {
   ChangeNetworkState(nsIDOMHTMLMediaElement::NETWORK_LOADING);
 
@@ -2858,7 +2857,7 @@ nsresult HTMLMediaElement::FinishDecoderSetup(MediaDecoder* aDecoder,
   // can affect how we feed data to MediaStreams
   NotifyDecoderPrincipalChanged();
 
-  nsresult rv = aDecoder->Load(aListener, aCloneDonor);
+  nsresult rv = aDecoder->Load(aListener);
   if (NS_FAILED(rv)) {
     ShutdownDecoder();
     LOG(LogLevel::Debug, ("%p Failed to load for decoder %p", this, aDecoder));
diff --git a/dom/html/HTMLMediaElement.h b/dom/html/HTMLMediaElement.h
index 364767ce9f06..5a57dbab68b1 100644
--- a/dom/html/HTMLMediaElement.h
+++ b/dom/html/HTMLMediaElement.h
@@ -651,7 +651,7 @@ public:
    * A public wrapper for FinishDecoderSetup()
    */
   nsresult FinishDecoderSetup(MediaDecoder* aDecoder, MediaResource* aStream) {
-    return FinishDecoderSetup(aDecoder, aStream, nullptr, nullptr);
+    return FinishDecoderSetup(aDecoder, aStream, nullptr);
   }
 
   // Returns true if the media element is being destroyed. Used in
@@ -811,8 +811,7 @@ protected:
    */
   nsresult FinishDecoderSetup(MediaDecoder* aDecoder,
                               MediaResource* aStream,
-                              nsIStreamListener **aListener,
-                              MediaDecoder* aCloneDonor);
+                              nsIStreamListener **aListener);
 
   /**
    * Call this after setting up mLoadingSrc and mDecoder.
diff --git a/dom/media/MediaDecoder.cpp b/dom/media/MediaDecoder.cpp
index 738a4cd7d7c8..ac47717afdf0 100644
--- a/dom/media/MediaDecoder.cpp
+++ b/dom/media/MediaDecoder.cpp
@@ -509,8 +509,7 @@ MediaDecoder::OpenResource(nsIStreamListener** aStreamListener)
 }
 
 nsresult
-MediaDecoder::Load(nsIStreamListener** aStreamListener,
-                   MediaDecoder* aCloneDonor)
+MediaDecoder::Load(nsIStreamListener** aStreamListener)
 {
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(mResource, "Can't load without a MediaResource");
@@ -521,18 +520,16 @@ MediaDecoder::Load(nsIStreamListener** aStreamListener,
   SetStateMachine(CreateStateMachine());
   NS_ENSURE_TRUE(GetStateMachine(), NS_ERROR_FAILURE);
 
-  return InitializeStateMachine(aCloneDonor);
+  return InitializeStateMachine();
 }
 
 nsresult
-MediaDecoder::InitializeStateMachine(MediaDecoder* aCloneDonor)
+MediaDecoder::InitializeStateMachine()
 {
   MOZ_ASSERT(NS_IsMainThread());
   NS_ASSERTION(mDecoderStateMachine, "Cannot initialize null state machine!");
 
-  MediaDecoder* cloneDonor = static_cast<MediaDecoder*>(aCloneDonor);
-  nsresult rv = mDecoderStateMachine->Init(
-      cloneDonor ? cloneDonor->mDecoderStateMachine.get() : nullptr);
+  nsresult rv = mDecoderStateMachine->Init();
   NS_ENSURE_SUCCESS(rv, rv);
 
   // If some parameters got set before the state machine got created,
diff --git a/dom/media/MediaDecoder.h b/dom/media/MediaDecoder.h
index 486e69a05f39..627d7c4eeaf9 100644
--- a/dom/media/MediaDecoder.h
+++ b/dom/media/MediaDecoder.h
@@ -323,8 +323,7 @@ public:
   // Start downloading the media. Decode the downloaded data up to the
   // point of the first frame of data.
   // This is called at most once per decoder, after Init().
-  virtual nsresult Load(nsIStreamListener** aListener,
-                        MediaDecoder* aCloneDonor);
+  virtual nsresult Load(nsIStreamListener** aListener);
 
   // Called in |Load| to open mResource.
   nsresult OpenResource(nsIStreamListener** aStreamListener);
@@ -363,7 +362,7 @@ public:
   virtual nsresult Seek(double aTime, SeekTarget::Type aSeekType);
 
   // Initialize state machine and schedule it.
-  nsresult InitializeStateMachine(MediaDecoder* aCloneDonor);
+  nsresult InitializeStateMachine();
 
   // Start playback of a video. 'Load' must have previously been
   // called.
diff --git a/dom/media/MediaDecoderStateMachine.cpp b/dom/media/MediaDecoderStateMachine.cpp
index f29b82ddafe0..d2e41b2c3c99 100644
--- a/dom/media/MediaDecoderStateMachine.cpp
+++ b/dom/media/MediaDecoderStateMachine.cpp
@@ -1030,7 +1030,7 @@ bool MediaDecoderStateMachine::IsPlaying() const
   return mMediaSink->IsPlaying();
 }
 
-nsresult MediaDecoderStateMachine::Init(MediaDecoderStateMachine* aCloneDonor)
+nsresult MediaDecoderStateMachine::Init()
 {
   MOZ_ASSERT(NS_IsMainThread());
   nsresult rv = mReader->Init();
diff --git a/dom/media/MediaDecoderStateMachine.h b/dom/media/MediaDecoderStateMachine.h
index a5846f4bfafc..fbd7d266ce39 100644
--- a/dom/media/MediaDecoderStateMachine.h
+++ b/dom/media/MediaDecoderStateMachine.h
@@ -134,7 +134,7 @@ public:
                            MediaDecoderReader* aReader,
                            bool aRealTime = false);
 
-  nsresult Init(MediaDecoderStateMachine* aCloneDonor);
+  nsresult Init();
 
   // Enumeration for the valid decoding states
   enum State {
diff --git a/dom/media/mediasource/MediaSourceDecoder.cpp b/dom/media/mediasource/MediaSourceDecoder.cpp
index 0f86bd4bddcb..4313d59dc0c6 100644
--- a/dom/media/mediasource/MediaSourceDecoder.cpp
+++ b/dom/media/mediasource/MediaSourceDecoder.cpp
@@ -51,7 +51,7 @@ MediaSourceDecoder::CreateStateMachine()
 }
 
 nsresult
-MediaSourceDecoder::Load(nsIStreamListener**, MediaDecoder*)
+MediaSourceDecoder::Load(nsIStreamListener**)
 {
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(!GetStateMachine());
@@ -61,7 +61,7 @@ MediaSourceDecoder::Load(nsIStreamListener**, MediaDecoder*)
     return NS_ERROR_FAILURE;
   }
 
-  nsresult rv = GetStateMachine()->Init(nullptr);
+  nsresult rv = GetStateMachine()->Init();
   NS_ENSURE_SUCCESS(rv, rv);
 
   SetStateMachineParameters();
diff --git a/dom/media/mediasource/MediaSourceDecoder.h b/dom/media/mediasource/MediaSourceDecoder.h
index dd0043b05967..72e3a685015a 100644
--- a/dom/media/mediasource/MediaSourceDecoder.h
+++ b/dom/media/mediasource/MediaSourceDecoder.h
@@ -38,7 +38,7 @@ public:
 
   virtual MediaDecoder* Clone() override;
   virtual MediaDecoderStateMachine* CreateStateMachine() override;
-  virtual nsresult Load(nsIStreamListener**, MediaDecoder*) override;
+  virtual nsresult Load(nsIStreamListener**) override;
   virtual media::TimeIntervals GetSeekable() override;
   media::TimeIntervals GetBuffered() override;
 

From 6765563707928725b081287f5eff06d4c5ca4e96 Mon Sep 17 00:00:00 2001
From: JW Wang <jwwang@mozilla.com>
Date: Wed, 14 Oct 2015 11:52:26 +0800
Subject: [PATCH 43/63] Bug 1214073 - MediaDecoderReader::ReleaseMediaResources
 will do dispatch if necessary. r=gerald.

---
 dom/media/MediaDecoderReader.h         | 14 +++++++++++++-
 dom/media/MediaDecoderStateMachine.cpp |  3 +--
 dom/media/MediaFormatReader.cpp        |  3 ++-
 dom/media/MediaFormatReader.h          |  7 ++++---
 dom/media/omx/MediaCodecReader.cpp     |  4 +++-
 dom/media/omx/MediaCodecReader.h       |  7 ++++---
 dom/media/omx/MediaOmxReader.cpp       |  4 +++-
 dom/media/omx/MediaOmxReader.h         |  4 ++--
 8 files changed, 32 insertions(+), 14 deletions(-)

diff --git a/dom/media/MediaDecoderReader.h b/dom/media/MediaDecoderReader.h
index 909390c7e80d..2ce96cff204a 100644
--- a/dom/media/MediaDecoderReader.h
+++ b/dom/media/MediaDecoderReader.h
@@ -96,7 +96,16 @@ public:
 
   // Release media resources they should be released in dormant state
   // The reader can be made usable again by calling ReadMetadata().
-  virtual void ReleaseMediaResources() {};
+  void ReleaseMediaResources()
+  {
+    if (OnTaskQueue()) {
+      ReleaseMediaResourcesInternal();
+      return;
+    }
+    nsCOMPtr<nsIRunnable> r = NS_NewRunnableMethod(
+      this, &MediaDecoderReader::ReleaseMediaResourcesInternal);
+    OwnerThread()->Dispatch(r.forget());
+  }
   // Breaks reference-counted cycles. Called during shutdown.
   // WARNING: If you override this, you must call the base implementation
   // in your override.
@@ -243,6 +252,9 @@ public:
   virtual size_t SizeOfVideoQueueInFrames();
   virtual size_t SizeOfAudioQueueInFrames();
 
+private:
+  virtual void ReleaseMediaResourcesInternal() {}
+
 protected:
   friend class TrackBuffer;
   virtual void NotifyDataArrivedInternal(uint32_t aLength, int64_t aOffset) { }
diff --git a/dom/media/MediaDecoderStateMachine.cpp b/dom/media/MediaDecoderStateMachine.cpp
index d2e41b2c3c99..fae408ddeae0 100644
--- a/dom/media/MediaDecoderStateMachine.cpp
+++ b/dom/media/MediaDecoderStateMachine.cpp
@@ -1269,8 +1269,7 @@ MediaDecoderStateMachine::SetDormant(bool aDormant)
     // that run after ResetDecode are supposed to run with a clean slate. We rely
     // on that in other places (i.e. seeking), so it seems reasonable to rely on
     // it here as well.
-    nsCOMPtr<nsIRunnable> r = NS_NewRunnableMethod(mReader, &MediaDecoderReader::ReleaseMediaResources);
-    DecodeTaskQueue()->Dispatch(r.forget());
+    mReader->ReleaseMediaResources();
   } else if ((aDormant != true) && (mState == DECODER_STATE_DORMANT)) {
     ScheduleStateMachine();
     mDecodingFirstFrame = true;
diff --git a/dom/media/MediaFormatReader.cpp b/dom/media/MediaFormatReader.cpp
index 5855a8e74558..3312bbee1bca 100644
--- a/dom/media/MediaFormatReader.cpp
+++ b/dom/media/MediaFormatReader.cpp
@@ -1569,8 +1569,9 @@ MediaFormatReader::GetBuffered()
   return intervals.Shift(media::TimeUnit::FromMicroseconds(-startTime));
 }
 
-void MediaFormatReader::ReleaseMediaResources()
+void MediaFormatReader::ReleaseMediaResourcesInternal()
 {
+  MOZ_ASSERT(OnTaskQueue());
   // Before freeing a video codec, all video buffers needed to be released
   // even from graphics pipeline.
   VideoFrameContainer* container =
diff --git a/dom/media/MediaFormatReader.h b/dom/media/MediaFormatReader.h
index 4a0d0d868dad..8e401e349910 100644
--- a/dom/media/MediaFormatReader.h
+++ b/dom/media/MediaFormatReader.h
@@ -70,9 +70,6 @@ public:
 
   virtual bool ForceZeroStartTime() const override;
 
-  // For Media Resource Management
-  void ReleaseMediaResources() override;
-
   nsresult ResetDecode() override;
 
   nsRefPtr<ShutdownPromise> Shutdown() override;
@@ -436,6 +433,10 @@ private:
 #if defined(READER_DORMANT_HEURISTIC)
   const bool mDormantEnabled;
 #endif
+
+private:
+  // For Media Resource Management
+  void ReleaseMediaResourcesInternal() override;
 };
 
 } // namespace mozilla
diff --git a/dom/media/omx/MediaCodecReader.cpp b/dom/media/omx/MediaCodecReader.cpp
index 42da43bcc61c..ef0eea9bb2ed 100644
--- a/dom/media/omx/MediaCodecReader.cpp
+++ b/dom/media/omx/MediaCodecReader.cpp
@@ -284,8 +284,10 @@ MediaCodecReader::~MediaCodecReader()
 }
 
 void
-MediaCodecReader::ReleaseMediaResources()
+MediaCodecReader::ReleaseMediaResourcesInternal()
 {
+  MOZ_ASSERT(OnTaskQueue());
+
   // Stop the mSource because we are in the dormant state and the stop function
   // will rewind the mSource to the beginning of the stream.
   if (mVideoTrack.mSource != nullptr && !mVideoTrack.mSourceIsStopped) {
diff --git a/dom/media/omx/MediaCodecReader.h b/dom/media/omx/MediaCodecReader.h
index fb67cf1f0567..1c00d3cf5e14 100644
--- a/dom/media/omx/MediaCodecReader.h
+++ b/dom/media/omx/MediaCodecReader.h
@@ -60,9 +60,6 @@ public:
   MediaCodecReader(AbstractMediaDecoder* aDecoder);
   virtual ~MediaCodecReader();
 
-  // Release media resources they should be released in dormant state
-  virtual void ReleaseMediaResources();
-
   // Destroys the decoding state. The reader cannot be made usable again.
   // This is different from ReleaseMediaResources() as Shutdown() is
   // irreversible, whereas ReleaseMediaResources() is reversible.
@@ -436,6 +433,10 @@ private:
   nsTArray<ReleaseItem> mPendingReleaseItems;
 
   NotifyDataArrivedFilter mFilter;
+
+private:
+  // Release media resources they should be released in dormant state
+  virtual void ReleaseMediaResourcesInternal() override;
 };
 
 } // namespace mozilla
diff --git a/dom/media/omx/MediaOmxReader.cpp b/dom/media/omx/MediaOmxReader.cpp
index 202896342866..a5cf2604553c 100644
--- a/dom/media/omx/MediaOmxReader.cpp
+++ b/dom/media/omx/MediaOmxReader.cpp
@@ -170,8 +170,10 @@ MediaOmxReader::Shutdown()
   return p;
 }
 
-void MediaOmxReader::ReleaseMediaResources()
+void MediaOmxReader::ReleaseMediaResourcesInternal()
 {
+  MOZ_ASSERT(OnTaskQueue());
+
   mMediaResourceRequest.DisconnectIfExists();
   mMetadataPromise.RejectIfExists(ReadMetadataFailureReason::METADATA_ERROR, __func__);
 
diff --git a/dom/media/omx/MediaOmxReader.h b/dom/media/omx/MediaOmxReader.h
index 85b7d37403ac..8f5700691985 100644
--- a/dom/media/omx/MediaOmxReader.h
+++ b/dom/media/omx/MediaOmxReader.h
@@ -95,8 +95,6 @@ public:
     return mHasVideo;
   }
 
-  virtual void ReleaseMediaResources();
-
   virtual nsRefPtr<MediaDecoderReader::MetadataPromise> AsyncReadMetadata() override;
 
   virtual nsRefPtr<SeekPromise>
@@ -118,6 +116,8 @@ private:
   class ProcessCachedDataTask;
   class NotifyDataArrivedRunnable;
 
+  virtual void ReleaseMediaResourcesInternal() override;
+
   bool IsShutdown() {
     MutexAutoLock lock(mShutdownMutex);
     return mIsShutdown;

From 1065049ddb513046966b5006d929508c0991da7e Mon Sep 17 00:00:00 2001
From: JW Wang <jwwang@mozilla.com>
Date: Wed, 14 Oct 2015 14:25:01 +0800
Subject: [PATCH 44/63] Bug 1214498 -
 MediaDecoderReader::DisableHardwareAcceleration should figure out which
 thread to dispatch the job. r=gerald.

---
 dom/media/MediaDecoderReader.h         | 15 +++++++++++++--
 dom/media/MediaDecoderStateMachine.cpp |  4 +---
 dom/media/MediaFormatReader.cpp        |  2 +-
 dom/media/MediaFormatReader.h          |  3 +--
 4 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/dom/media/MediaDecoderReader.h b/dom/media/MediaDecoderReader.h
index 2ce96cff204a..73e6b166a276 100644
--- a/dom/media/MediaDecoderReader.h
+++ b/dom/media/MediaDecoderReader.h
@@ -106,6 +106,18 @@ public:
       this, &MediaDecoderReader::ReleaseMediaResourcesInternal);
     OwnerThread()->Dispatch(r.forget());
   }
+
+  void DisableHardwareAcceleration()
+  {
+    if (OnTaskQueue()) {
+      DisableHardwareAccelerationInternal();
+      return;
+    }
+    nsCOMPtr<nsIRunnable> r = NS_NewRunnableMethod(
+      this, &MediaDecoderReader::DisableHardwareAccelerationInternal);
+    OwnerThread()->Dispatch(r.forget());
+  }
+
   // Breaks reference-counted cycles. Called during shutdown.
   // WARNING: If you override this, you must call the base implementation
   // in your override.
@@ -254,6 +266,7 @@ public:
 
 private:
   virtual void ReleaseMediaResourcesInternal() {}
+  virtual void DisableHardwareAccelerationInternal() {}
 
 protected:
   friend class TrackBuffer;
@@ -334,8 +347,6 @@ public:
   // decoding.
   virtual bool VideoIsHardwareAccelerated() const { return false; }
 
-  virtual void DisableHardwareAcceleration() {}
-
   TimedMetadataEventSource& TimedMetadataEvent() {
     return mTimedMetadataEvent;
   }
diff --git a/dom/media/MediaDecoderStateMachine.cpp b/dom/media/MediaDecoderStateMachine.cpp
index fae408ddeae0..542a61d62b94 100644
--- a/dom/media/MediaDecoderStateMachine.cpp
+++ b/dom/media/MediaDecoderStateMachine.cpp
@@ -2463,9 +2463,7 @@ MediaDecoderStateMachine::CheckFrameValidity(VideoData* aData)
     if (mReader->VideoIsHardwareAccelerated() &&
         frameStats.GetPresentedFrames() > 60 &&
         mCorruptFrames.mean() >= 2 /* 20% */) {
-        nsCOMPtr<nsIRunnable> task =
-          NS_NewRunnableMethod(mReader, &MediaDecoderReader::DisableHardwareAcceleration);
-        DecodeTaskQueue()->Dispatch(task.forget());
+        mReader->DisableHardwareAcceleration();
         mCorruptFrames.clear();
       gfxCriticalNote << "Too many dropped/corrupted frames, disabling DXVA";
     }
diff --git a/dom/media/MediaFormatReader.cpp b/dom/media/MediaFormatReader.cpp
index 3312bbee1bca..22c4bc9e1126 100644
--- a/dom/media/MediaFormatReader.cpp
+++ b/dom/media/MediaFormatReader.cpp
@@ -534,7 +534,7 @@ MediaFormatReader::GetDecoderData(TrackType aTrack)
 }
 
 void
-MediaFormatReader::DisableHardwareAcceleration()
+MediaFormatReader::DisableHardwareAccelerationInternal()
 {
   MOZ_ASSERT(OnTaskQueue());
   if (HasVideo() && !mHardwareAccelerationDisabled) {
diff --git a/dom/media/MediaFormatReader.h b/dom/media/MediaFormatReader.h
index 8e401e349910..126e6cbe7c97 100644
--- a/dom/media/MediaFormatReader.h
+++ b/dom/media/MediaFormatReader.h
@@ -78,8 +78,6 @@ public:
 
   bool VideoIsHardwareAccelerated() const override;
 
-  void DisableHardwareAcceleration() override;
-
   bool IsWaitForDataSupported() override { return true; }
   nsRefPtr<WaitForDataPromise> WaitForData(MediaData::Type aType) override;
 
@@ -437,6 +435,7 @@ private:
 private:
   // For Media Resource Management
   void ReleaseMediaResourcesInternal() override;
+  void DisableHardwareAccelerationInternal() override;
 };
 
 } // namespace mozilla

From 0d7595b59b6631f125444ea9fa77e449e8debf9f Mon Sep 17 00:00:00 2001
From: Andrea Marchesini <amarchesini@mozilla.com>
Date: Wed, 14 Oct 2015 11:29:55 +0100
Subject: [PATCH 45/63] Bug 1214300 - AsyncErrorReporter doesn't use JSRuntime
 param., r=smaug

---
 dom/base/nsJSEnvironment.h           | 4 ++--
 dom/promise/Promise.cpp              | 3 +--
 dom/workers/ServiceWorkerPrivate.cpp | 3 +--
 3 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/dom/base/nsJSEnvironment.h b/dom/base/nsJSEnvironment.h
index 471e838bf994..0b3638d84ef0 100644
--- a/dom/base/nsJSEnvironment.h
+++ b/dom/base/nsJSEnvironment.h
@@ -189,11 +189,11 @@ nsScriptNameSpaceManager* GetNameSpaceManager();
 nsScriptNameSpaceManager* PeekNameSpaceManager();
 
 // Runnable that's used to do async error reporting
-class AsyncErrorReporter : public nsRunnable
+class AsyncErrorReporter final : public nsRunnable
 {
 public:
   // aWindow may be null if this error report is not associated with a window
-  AsyncErrorReporter(JSRuntime* aRuntime, xpc::ErrorReport* aReport)
+  explicit AsyncErrorReporter(xpc::ErrorReport* aReport)
     : mReport(aReport)
   {}
 
diff --git a/dom/promise/Promise.cpp b/dom/promise/Promise.cpp
index 8c03a5dca7ca..3a7b4fcfe73e 100644
--- a/dom/promise/Promise.cpp
+++ b/dom/promise/Promise.cpp
@@ -1231,8 +1231,7 @@ Promise::MaybeReportRejected()
     NS_WARNING("!!! Trying to report rejected Promise after MainThread shutdown");
   }
   if (mainThread) {
-    nsRefPtr<AsyncErrorReporter> r =
-      new AsyncErrorReporter(CycleCollectedJSRuntime::Get()->Runtime(), xpcReport);
+    nsRefPtr<AsyncErrorReporter> r = new AsyncErrorReporter(xpcReport);
     mainThread->Dispatch(r.forget(), NS_DISPATCH_NORMAL);
   }
 }
diff --git a/dom/workers/ServiceWorkerPrivate.cpp b/dom/workers/ServiceWorkerPrivate.cpp
index 20f4bca185c0..f732a3d9819e 100644
--- a/dom/workers/ServiceWorkerPrivate.cpp
+++ b/dom/workers/ServiceWorkerPrivate.cpp
@@ -338,8 +338,7 @@ public:
     xpcReport->Init(report.report(), report.message(),
                     /* aIsChrome = */ false, /* aWindowID = */ 0);
 
-    nsRefPtr<AsyncErrorReporter> aer =
-      new AsyncErrorReporter(CycleCollectedJSRuntime::Get()->Runtime(), xpcReport);
+    nsRefPtr<AsyncErrorReporter> aer = new AsyncErrorReporter(xpcReport);
     NS_DispatchToMainThread(aer);
   }
 };

From e9fd48c65adb83d82a1169f1a17f7a4147f26b89 Mon Sep 17 00:00:00 2001
From: Jan de Mooij <jdemooij@mozilla.com>
Date: Wed, 14 Oct 2015 12:35:09 +0200
Subject: [PATCH 46/63] Bug 1214173 - Remove unused
 MSetPropertyInstruction::needsBarrier_. r=h4writer

---
 js/src/jit/IonBuilder.cpp | 6 +-----
 js/src/jit/MIR.h          | 9 +--------
 2 files changed, 2 insertions(+), 13 deletions(-)

diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index add14822c223..9a5848c913b6 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -12451,12 +12451,8 @@ IonBuilder::setPropTryCache(bool* emitted, MDefinition* obj,
     MOZ_ASSERT(*emitted == false);
 
     bool strict = IsStrictSetPC(pc);
-    // Emit SetPropertyCache.
+
     MSetPropertyCache* ins = MSetPropertyCache::New(alloc(), obj, value, name, strict, barrier);
-
-    if (!objTypes || objTypes->propertyNeedsBarrier(constraints(), NameToId(name)))
-        ins->setNeedsBarrier();
-
     current->add(ins);
     current->push(value);
 
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index 942ecca6adc8..ff0dc1a3b7a3 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -11224,13 +11224,12 @@ class MSetPropertyInstruction : public MBinaryInstruction
 {
     CompilerPropertyName name_;
     bool strict_;
-    bool needsBarrier_;
 
   protected:
     MSetPropertyInstruction(MDefinition* obj, MDefinition* value, PropertyName* name,
                             bool strict)
       : MBinaryInstruction(obj, value),
-        name_(name), strict_(strict), needsBarrier_(true)
+        name_(name), strict_(strict)
     {}
 
   public:
@@ -11246,12 +11245,6 @@ class MSetPropertyInstruction : public MBinaryInstruction
     bool strict() const {
         return strict_;
     }
-    bool needsBarrier() const {
-        return needsBarrier_;
-    }
-    void setNeedsBarrier() {
-        needsBarrier_ = true;
-    }
 };
 
 class MSetElementInstruction

From d3a0b9cc9d243778f9fdb18324b24b9daec50cb1 Mon Sep 17 00:00:00 2001
From: Jan de Mooij <jdemooij@mozilla.com>
Date: Wed, 14 Oct 2015 12:37:02 +0200
Subject: [PATCH 47/63] Bug 1211939 - Don't call JSRuntime::onOutOfMemory from
 helper threads. r=jonco

---
 js/src/gc/Zone.h      | 2 ++
 js/src/jscntxt.h      | 4 +++-
 js/src/vm/Runtime.cpp | 1 +
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/js/src/gc/Zone.h b/js/src/gc/Zone.h
index 9f621f7d2e85..87f99dd53e67 100644
--- a/js/src/gc/Zone.h
+++ b/js/src/gc/Zone.h
@@ -142,6 +142,8 @@ struct Zone : public JS::shadow::Zone,
     void onTooMuchMalloc();
 
     void* onOutOfMemory(js::AllocFunction allocFunc, size_t nbytes, void* reallocPtr = nullptr) {
+        if (!CurrentThreadCanAccessRuntime(runtime_))
+            return nullptr;
         return runtimeFromMainThread()->onOutOfMemory(allocFunc, nbytes, reallocPtr);
     }
     void reportAllocationOverflow() { js::ReportAllocationOverflow(nullptr); }
diff --git a/js/src/jscntxt.h b/js/src/jscntxt.h
index b835dd070aff..891d5159e05e 100644
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -163,7 +163,9 @@ class ExclusiveContext : public ContextFriendFields,
     }
 
     void* onOutOfMemory(js::AllocFunction allocFunc, size_t nbytes, void* reallocPtr = nullptr) {
-        return runtime_->onOutOfMemory(allocFunc, nbytes, reallocPtr, maybeJSContext());
+        if (!isJSContext())
+            return nullptr;
+        return runtime_->onOutOfMemory(allocFunc, nbytes, reallocPtr, asJSContext());
     }
 
     /* Clear the pending exception (if any) due to OOM. */
diff --git a/js/src/vm/Runtime.cpp b/js/src/vm/Runtime.cpp
index 781dbe938c86..58e9d0a325f2 100644
--- a/js/src/vm/Runtime.cpp
+++ b/js/src/vm/Runtime.cpp
@@ -760,6 +760,7 @@ JSRuntime::onOutOfMemory(AllocFunction allocFunc, size_t nbytes, void* reallocPt
                          JSContext* maybecx)
 {
     MOZ_ASSERT_IF(allocFunc != AllocFunction::Realloc, !reallocPtr);
+    MOZ_ASSERT(CurrentThreadCanAccessRuntime(this));
 
     if (isHeapBusy())
         return nullptr;

From d9f0dc8b4338f3a6da52fa4cef0c26b874e63384 Mon Sep 17 00:00:00 2001
From: Masatoshi Kimura <VYV03354@nifty.ne.jp>
Date: Wed, 14 Oct 2015 21:12:33 +0900
Subject: [PATCH 48/63] Bug 1168635 - Extend nsITLSServerSocket to customize
 cipher suites. r=keeler

---
 netwerk/base/TLSServerSocket.cpp    | 25 +++++++++++++++++++++++++
 netwerk/base/nsITLSServerSocket.idl | 11 ++++++++++-
 2 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/netwerk/base/TLSServerSocket.cpp b/netwerk/base/TLSServerSocket.cpp
index 962b0ceab11c..fe94ce6a4e5f 100644
--- a/netwerk/base/TLSServerSocket.cpp
+++ b/netwerk/base/TLSServerSocket.cpp
@@ -222,6 +222,31 @@ TLSServerSocket::SetRequestClientCertificate(uint32_t aMode)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+TLSServerSocket::SetCipherSuites(uint16_t* aCipherSuites, uint32_t aLength)
+{
+  // If AsyncListen was already called (and set mListener), it's too late to set
+  // this.
+  if (NS_WARN_IF(mListener)) {
+    return NS_ERROR_IN_PROGRESS;
+  }
+
+  for (uint16_t i = 0; i < SSL_NumImplementedCiphers; ++i) {
+    uint16_t cipher_id = SSL_ImplementedCiphers[i];
+    if (SSL_CipherPrefSet(mFD, cipher_id, false) != SECSuccess) {
+      return mozilla::psm::GetXPCOMFromNSSError(PR_GetError());
+    }
+  }
+
+  for (uint32_t i = 0; i < aLength; ++i) {
+    if (SSL_CipherPrefSet(mFD, aCipherSuites[i], true) != SECSuccess) {
+      return mozilla::psm::GetXPCOMFromNSSError(PR_GetError());
+    }
+  }
+
+  return NS_OK;
+}
+
 //-----------------------------------------------------------------------------
 // TLSServerConnectionInfo
 //-----------------------------------------------------------------------------
diff --git a/netwerk/base/nsITLSServerSocket.idl b/netwerk/base/nsITLSServerSocket.idl
index e22596072ba6..447a14483195 100644
--- a/netwerk/base/nsITLSServerSocket.idl
+++ b/netwerk/base/nsITLSServerSocket.idl
@@ -8,7 +8,7 @@ interface nsIX509Cert;
 interface nsITLSServerSecurityObserver;
 interface nsISocketTransport;
 
-[scriptable, uuid(2e025b6c-96ba-4781-85fb-d1cf1a653207)]
+[scriptable, uuid(cc2c30f9-cfaa-4b8a-bd44-c24881981b74)]
 interface nsITLSServerSocket : nsIServerSocket
 {
   /**
@@ -60,6 +60,15 @@ interface nsITLSServerSocket : nsIServerSocket
    * change the default.
    */
   void setRequestClientCertificate(in unsigned long aRequestClientCert);
+
+  /**
+   * setCipherSuites
+   *
+   * The server's cipher suites that is used by the TLS handshake.
+   * This is required to be set before calling |asyncListen|.
+   */
+  void setCipherSuites([array, size_is(aLength)] in unsigned short aCipherSuites,
+                       in unsigned long aLength);
 };
 
 /**

From 00d864d31389c2aee8812d524fc9b9ae8eedff51 Mon Sep 17 00:00:00 2001
From: Masatoshi Kimura <VYV03354@nifty.ne.jp>
Date: Wed, 14 Oct 2015 21:12:35 +0900
Subject: [PATCH 49/63] Bug 1168635 - Add an XPCOM interface to allow RC4.
 r=keeler

--HG--
rename : netwerk/test/unit/test_tls_server.js => security/manager/ssl/tests/unit/test_weak_crypto.js
---
 security/manager/ssl/WeakCryptoOverride.cpp   |  62 +++++
 security/manager/ssl/WeakCryptoOverride.h     |  35 +++
 security/manager/ssl/moz.build                |   2 +
 .../manager/ssl/nsIWeakCryptoOverride.idl     |  45 +++
 security/manager/ssl/nsNSSCallbacks.cpp       |   3 +
 security/manager/ssl/nsNSSIOLayer.cpp         | 108 +++++++-
 security/manager/ssl/nsNSSIOLayer.h           |   4 +
 security/manager/ssl/nsNSSModule.cpp          |  72 ++---
 .../manager/ssl/nsSecureBrowserUIImpl.cpp     |   1 +
 security/manager/ssl/tests/unit/head_psm.js   |   1 +
 .../ssl/tests/unit/test_weak_crypto.js        | 262 ++++++++++++++++++
 security/manager/ssl/tests/unit/xpcshell.ini  |   2 +
 12 files changed, 555 insertions(+), 42 deletions(-)
 create mode 100644 security/manager/ssl/WeakCryptoOverride.cpp
 create mode 100644 security/manager/ssl/WeakCryptoOverride.h
 create mode 100644 security/manager/ssl/nsIWeakCryptoOverride.idl
 create mode 100644 security/manager/ssl/tests/unit/test_weak_crypto.js

diff --git a/security/manager/ssl/WeakCryptoOverride.cpp b/security/manager/ssl/WeakCryptoOverride.cpp
new file mode 100644
index 000000000000..e747a33008bc
--- /dev/null
+++ b/security/manager/ssl/WeakCryptoOverride.cpp
@@ -0,0 +1,62 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "WeakCryptoOverride.h"
+
+#include "MainThreadUtils.h"
+#include "SharedSSLState.h"
+
+using namespace mozilla;
+using namespace mozilla::psm;
+
+NS_IMPL_ISUPPORTS(WeakCryptoOverride,
+                  nsIWeakCryptoOverride)
+
+WeakCryptoOverride::WeakCryptoOverride()
+{
+}
+
+WeakCryptoOverride::~WeakCryptoOverride()
+{
+}
+
+NS_IMETHODIMP
+WeakCryptoOverride::AddWeakCryptoOverride(const nsACString& aHostName,
+                                          bool aPrivate, bool aTemporary)
+{
+  if (!NS_IsMainThread()) {
+    return NS_ERROR_NOT_SAME_THREAD;
+  }
+
+  SharedSSLState* sharedState = aPrivate ? PrivateSSLState()
+                                         : PublicSSLState();
+  if (!sharedState) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+  const nsPromiseFlatCString& host = PromiseFlatCString(aHostName);
+  sharedState->IOLayerHelpers().addInsecureFallbackSite(host, aTemporary);
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+WeakCryptoOverride::RemoveWeakCryptoOverride(const nsACString& aHostName,
+                                             int32_t aPort, bool aPrivate)
+{
+  if (!NS_IsMainThread()) {
+    return NS_ERROR_NOT_SAME_THREAD;
+  }
+
+  SharedSSLState* sharedState = aPrivate ? PrivateSSLState()
+                                         : PublicSSLState();
+  if (!sharedState) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+  const nsPromiseFlatCString& host = PromiseFlatCString(aHostName);
+  sharedState->IOLayerHelpers().removeInsecureFallbackSite(host, aPort);
+
+  return NS_OK;
+}
diff --git a/security/manager/ssl/WeakCryptoOverride.h b/security/manager/ssl/WeakCryptoOverride.h
new file mode 100644
index 000000000000..fefee75ef958
--- /dev/null
+++ b/security/manager/ssl/WeakCryptoOverride.h
@@ -0,0 +1,35 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef WEAKCRYPTOOVERRIDE_H
+#define WEAKCRYPTOOVERRIDE_H
+
+#include "nsIWeakCryptoOverride.h"
+#include "nsWeakReference.h"
+
+namespace mozilla {
+namespace psm {
+
+class WeakCryptoOverride final : public nsIWeakCryptoOverride
+{
+public:
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIWEAKCRYPTOOVERRIDE
+
+  WeakCryptoOverride();
+
+protected:
+  ~WeakCryptoOverride();
+};
+
+} // psm
+} // mozilla
+
+#define NS_WEAKCRYPTOOVERRIDE_CID /* ffb06724-3c20-447c-8328-ae71513dd618 */ \
+{ 0xffb06724, 0x3c20, 0x447c, \
+  { 0x83, 0x28, 0xae, 0x71, 0x51, 0x3d, 0xd6, 0x18 } }
+
+#endif
diff --git a/security/manager/ssl/moz.build b/security/manager/ssl/moz.build
index fbad6cb40700..59a47bca6660 100644
--- a/security/manager/ssl/moz.build
+++ b/security/manager/ssl/moz.build
@@ -37,6 +37,7 @@ XPIDL_SOURCES += [
     'nsITokenDialogs.idl',
     'nsITokenPasswordDialogs.idl',
     'nsIUserCertPicker.idl',
+    'nsIWeakCryptoOverride.idl',
     'nsIX509Cert.idl',
     'nsIX509CertDB.idl',
     'nsIX509CertList.idl',
@@ -126,6 +127,7 @@ UNIFIED_SOURCES += [
     'SharedSSLState.cpp',
     'SSLServerCertVerification.cpp',
     'TransportSecurityInfo.cpp',
+    'WeakCryptoOverride.cpp',
 ]
 
 # nsNSSCertificateDB.cpp needs to include nscert.h before everything else.
diff --git a/security/manager/ssl/nsIWeakCryptoOverride.idl b/security/manager/ssl/nsIWeakCryptoOverride.idl
new file mode 100644
index 000000000000..5b474c13d4f8
--- /dev/null
+++ b/security/manager/ssl/nsIWeakCryptoOverride.idl
@@ -0,0 +1,45 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+%{C++
+#define NS_WEAKCRYPTOOVERRIDE_CONTRACTID "@mozilla.org/security/weakcryptooverride;1"
+%}
+
+/**
+ * This represents the fallback whitelist for
+ * weak crypto servers such as RC4-only.
+ */
+[scriptable, uuid(27b4d3df-8f15-4eb4-a35f-474e911b61e7)]
+interface nsIWeakCryptoOverride : nsISupports {
+  /**
+   *  Add a weak crypto override for the given hostname:port.
+   *  Main thread only.
+   *
+   *  @param aHostName The host (punycode) this mapping belongs to
+   *  @param aPrivate The override info will used for the private browsing
+   *                  session and no information will be written to the disk.
+   *  @param aTemporary The override info will not persist between sessions.
+   *                    Ignored if aPrivate is true.
+   */
+  void addWeakCryptoOverride(in ACString aHostName,
+                             in boolean aPrivate,
+                             [optional] in boolean aTemporary);
+
+  /**
+   *  Remove a weak crypto override for the given hostname:port.
+   *  Main thread only.
+   *
+   *  @param aHostName The host (punycode) whose entry should be cleared.
+   *  @param aPort The port whose entry should be cleared.
+   *  @param aPrivate The override info will used for the private browsing
+   *                  session.
+   */
+  void removeWeakCryptoOverride(in ACString aHostName,
+                                in int32_t aPort,
+                                in boolean aPrivate);
+};
diff --git a/security/manager/ssl/nsNSSCallbacks.cpp b/security/manager/ssl/nsNSSCallbacks.cpp
index 3e14c3985c44..a553c61a3412 100644
--- a/security/manager/ssl/nsNSSCallbacks.cpp
+++ b/security/manager/ssl/nsNSSCallbacks.cpp
@@ -1239,6 +1239,9 @@ void HandshakeCallback(PRFileDesc* fd, void* client_data) {
   } else {
     state = nsIWebProgressListener::STATE_IS_SECURE |
             nsIWebProgressListener::STATE_SECURE_HIGH;
+    // we know this site no longer requires a weak cipher
+    ioLayerHelpers.removeInsecureFallbackSite(infoObject->GetHostName(),
+                                              infoObject->GetPort());
   }
   infoObject->SetSecurityState(state);
 
diff --git a/security/manager/ssl/nsNSSIOLayer.cpp b/security/manager/ssl/nsNSSIOLayer.cpp
index 4779b7c579e6..bee79c6ef122 100644
--- a/security/manager/ssl/nsNSSIOLayer.cpp
+++ b/security/manager/ssl/nsNSSIOLayer.cpp
@@ -1539,9 +1539,11 @@ PrefObserver::Observe(nsISupports* aSubject, const char* aTopic,
     } else if (prefName.EqualsLiteral("security.tls.version.fallback-limit")) {
       mOwner->loadVersionFallbackLimit();
     } else if (prefName.EqualsLiteral("security.tls.insecure_fallback_hosts")) {
-      nsCString insecureFallbackHosts;
-      Preferences::GetCString("security.tls.insecure_fallback_hosts", &insecureFallbackHosts);
-      mOwner->setInsecureFallbackSites(insecureFallbackHosts);
+      // Changes to the whitelist on the public side will update the pref.
+      // Don't propagate the changes to the private side.
+      if (mOwner->isPublic()) {
+        mOwner->initInsecureFallbackSites();
+      }
     } else if (prefName.EqualsLiteral("security.tls.insecure_fallback_hosts.use_static_list")) {
       mOwner->mUseStaticFallbackList =
         Preferences::GetBool("security.tls.insecure_fallback_hosts.use_static_list", true);
@@ -1642,9 +1644,7 @@ nsSSLIOLayerHelpers::Init()
     Preferences::GetBool("security.ssl.false_start.require-npn",
                          FALSE_START_REQUIRE_NPN_DEFAULT);
   loadVersionFallbackLimit();
-  nsCString insecureFallbackHosts;
-  Preferences::GetCString("security.tls.insecure_fallback_hosts", &insecureFallbackHosts);
-  setInsecureFallbackSites(insecureFallbackHosts);
+  initInsecureFallbackSites();
   mUseStaticFallbackList =
     Preferences::GetBool("security.tls.insecure_fallback_hosts.use_static_list", true);
   mUnrestrictedRC4Fallback =
@@ -1707,6 +1707,102 @@ nsSSLIOLayerHelpers::setInsecureFallbackSites(const nsCString& str)
   }
 }
 
+void
+nsSSLIOLayerHelpers::initInsecureFallbackSites()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  nsCString insecureFallbackHosts;
+  Preferences::GetCString("security.tls.insecure_fallback_hosts",
+                          &insecureFallbackHosts);
+  setInsecureFallbackSites(insecureFallbackHosts);
+}
+
+bool
+nsSSLIOLayerHelpers::isPublic() const
+{
+  return this == &PublicSSLState()->IOLayerHelpers();
+}
+
+void
+nsSSLIOLayerHelpers::addInsecureFallbackSite(const nsCString& hostname,
+                                             bool temporary)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  {
+    MutexAutoLock lock(mutex);
+    if (mInsecureFallbackSites.Contains(hostname)) {
+      return;
+    }
+    mInsecureFallbackSites.PutEntry(hostname);
+  }
+  if (!isPublic() || temporary) {
+    return;
+  }
+  nsCString value;
+  Preferences::GetCString("security.tls.insecure_fallback_hosts", &value);
+  if (!value.IsEmpty()) {
+    value.Append(',');
+  }
+  value.Append(hostname);
+  Preferences::SetCString("security.tls.insecure_fallback_hosts", value);
+}
+
+class FallbackPrefRemover final : public nsRunnable
+{
+public:
+  explicit FallbackPrefRemover(const nsACString& aHost)
+    : mHost(aHost)
+  {}
+  NS_IMETHOD Run() override;
+private:
+  nsCString mHost;
+};
+
+NS_IMETHODIMP
+FallbackPrefRemover::Run()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  nsCString oldValue;
+  Preferences::GetCString("security.tls.insecure_fallback_hosts", &oldValue);
+  nsCCharSeparatedTokenizer toker(oldValue, ',');
+  nsCString newValue;
+  while (toker.hasMoreTokens()) {
+    const nsCSubstring& host = toker.nextToken();
+    if (host.Equals(mHost)) {
+      continue;
+    }
+    if (!newValue.IsEmpty()) {
+      newValue.Append(',');
+    }
+    newValue.Append(host);
+  }
+  Preferences::SetCString("security.tls.insecure_fallback_hosts", newValue);
+  return NS_OK;
+}
+
+void
+nsSSLIOLayerHelpers::removeInsecureFallbackSite(const nsACString& hostname,
+                                                uint16_t port)
+{
+  forgetIntolerance(hostname, port);
+  {
+    MutexAutoLock lock(mutex);
+    if (!mInsecureFallbackSites.Contains(hostname)) {
+      return;
+    }
+    mInsecureFallbackSites.RemoveEntry(hostname);
+  }
+  if (!isPublic()) {
+    return;
+  }
+  RefPtr<nsRunnable> runnable = new FallbackPrefRemover(hostname);
+  if (NS_IsMainThread()) {
+    runnable->Run();
+  } else {
+    NS_DispatchToMainThread(runnable);
+  }
+}
+
 struct FallbackListComparator
 {
   explicit FallbackListComparator(const char* aTarget)
diff --git a/security/manager/ssl/nsNSSIOLayer.h b/security/manager/ssl/nsNSSIOLayer.h
index 965eca879a66..0ec84072af0c 100644
--- a/security/manager/ssl/nsNSSIOLayer.h
+++ b/security/manager/ssl/nsNSSIOLayer.h
@@ -226,6 +226,10 @@ public:
   void clearStoredData();
   void loadVersionFallbackLimit();
   void setInsecureFallbackSites(const nsCString& str);
+  void initInsecureFallbackSites();
+  bool isPublic() const;
+  void addInsecureFallbackSite(const nsCString& hostname, bool temporary);
+  void removeInsecureFallbackSite(const nsACString& hostname, uint16_t port);
   bool isInsecureFallbackSite(const nsACString& hostname);
 
   bool mFalseStartRequireNPN;
diff --git a/security/manager/ssl/nsNSSModule.cpp b/security/manager/ssl/nsNSSModule.cpp
index f0f84765031a..ea74d1f62a2a 100644
--- a/security/manager/ssl/nsNSSModule.cpp
+++ b/security/manager/ssl/nsNSSModule.cpp
@@ -4,48 +4,44 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "mozilla/ModuleUtils.h"
-
-#include "nsNSSComponent.h"
-#include "nsSSLSocketProvider.h"
-#include "nsTLSSocketProvider.h"
+#include "CertBlocklist.h"
+#include "nsCertOverrideService.h"
+#include "nsCertPicker.h"
+#include "nsCrypto.h"
+#include "nsCryptoHash.h"
+#include "nsCURILoader.h"
+#include "nsDataSignatureVerifier.h"
+#include "nsDOMCID.h" //For the NS_CRYPTO_CONTRACTID define
+#include "nsEntropyCollector.h"
+#include "nsICategoryManager.h"
 #include "nsKeygenHandler.h"
-
-#include "nsSDR.h"
-
+#include "nsKeyModule.h"
+#include "mozilla/ModuleUtils.h"
+#include "nsNetCID.h"
+#include "nsNSSCertificate.h"
+#include "nsNSSCertificateDB.h"
+#include "nsNSSCertificateFakeTransport.h"
+#include "nsNSSComponent.h"
+#include "NSSErrorsService.h"
+#include "nsNSSVersion.h"
+#include "nsNTLMAuthModule.h"
 #include "nsPK11TokenDB.h"
 #include "nsPKCS11Slot.h"
-#include "nsNSSCertificate.h"
-#include "nsNSSCertificateFakeTransport.h"
-#include "nsNSSCertificateDB.h"
+#include "PSMContentListener.h"
+#include "nsRandomGenerator.h"
+#include "nsSDR.h"
+#include "nsSecureBrowserUIImpl.h"
+#include "nsSiteSecurityService.h"
+#include "nsSSLSocketProvider.h"
+#include "nsSSLStatus.h"
+#include "nsTLSSocketProvider.h"
+#include "TransportSecurityInfo.h"
+#include "WeakCryptoOverride.h"
+#include "nsXULAppAPI.h"
+
 #ifdef MOZ_XUL
 #include "nsCertTree.h"
 #endif
-#include "nsCrypto.h"
-#include "nsCryptoHash.h"
-//For the NS_CRYPTO_CONTRACTID define
-#include "nsDOMCID.h"
-#include "nsNetCID.h"
-#include "nsCertPicker.h"
-#include "nsCURILoader.h"
-#include "nsICategoryManager.h"
-#include "nsNTLMAuthModule.h"
-#include "nsKeyModule.h"
-#include "nsDataSignatureVerifier.h"
-#include "nsCertOverrideService.h"
-#include "nsRandomGenerator.h"
-#include "nsSSLStatus.h"
-#include "TransportSecurityInfo.h"
-#include "NSSErrorsService.h"
-#include "nsNSSVersion.h"
-#include "CertBlocklist.h"
-#include "nsEntropyCollector.h"
-#include "nsSecureBrowserUIImpl.h"
-#include "nsSiteSecurityService.h"
-
-#include "nsXULAppAPI.h"
-
-#include "PSMContentListener.h"
 
 #define NS_IS_PROCESS_DEFAULT                                                 \
     (GeckoProcessType_Default == XRE_GetProcessType())
@@ -223,6 +219,7 @@ NS_GENERIC_FACTORY_CONSTRUCTOR(nsEntropyCollector)
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsSecureBrowserUIImpl)
 NS_GENERIC_FACTORY_CONSTRUCTOR_INIT(CertBlocklist, Init)
 NS_GENERIC_FACTORY_CONSTRUCTOR_INIT(nsSiteSecurityService, Init)
+NS_GENERIC_FACTORY_CONSTRUCTOR(WeakCryptoOverride)
 
 NS_DEFINE_NAMED_CID(NS_NSSCOMPONENT_CID);
 NS_DEFINE_NAMED_CID(NS_SSLSOCKETPROVIDER_CID);
@@ -256,6 +253,7 @@ NS_DEFINE_NAMED_CID(NS_ENTROPYCOLLECTOR_CID);
 NS_DEFINE_NAMED_CID(NS_SECURE_BROWSER_UI_CID);
 NS_DEFINE_NAMED_CID(NS_SITE_SECURITY_SERVICE_CID);
 NS_DEFINE_NAMED_CID(NS_CERT_BLOCKLIST_CID);
+NS_DEFINE_NAMED_CID(NS_WEAKCRYPTOOVERRIDE_CID);
 
 static const mozilla::Module::CIDEntry kNSSCIDs[] = {
   { &kNS_NSSCOMPONENT_CID, false, nullptr, nsNSSComponentConstructor },
@@ -290,6 +288,7 @@ static const mozilla::Module::CIDEntry kNSSCIDs[] = {
   { &kNS_SECURE_BROWSER_UI_CID, false, nullptr, nsSecureBrowserUIImplConstructor },
   { &kNS_SITE_SECURITY_SERVICE_CID, false, nullptr, nsSiteSecurityServiceConstructor },
   { &kNS_CERT_BLOCKLIST_CID, false, nullptr, CertBlocklistConstructor},
+  { &kNS_WEAKCRYPTOOVERRIDE_CID, false, nullptr, WeakCryptoOverrideConstructor },
   { nullptr }
 };
 
@@ -325,6 +324,7 @@ static const mozilla::Module::ContractIDEntry kNSSContracts[] = {
   { NS_SECURE_BROWSER_UI_CONTRACTID, &kNS_SECURE_BROWSER_UI_CID },
   { NS_SSSERVICE_CONTRACTID, &kNS_SITE_SECURITY_SERVICE_CID },
   { NS_CERTBLOCKLIST_CONTRACTID, &kNS_CERT_BLOCKLIST_CID },
+  { NS_WEAKCRYPTOOVERRIDE_CONTRACTID, &kNS_WEAKCRYPTOOVERRIDE_CID },
   { nullptr }
 };
 
diff --git a/security/manager/ssl/nsSecureBrowserUIImpl.cpp b/security/manager/ssl/nsSecureBrowserUIImpl.cpp
index b930be9aded4..1aabc02aa5fe 100644
--- a/security/manager/ssl/nsSecureBrowserUIImpl.cpp
+++ b/security/manager/ssl/nsSecureBrowserUIImpl.cpp
@@ -31,6 +31,7 @@
 #include "imgIRequest.h"
 #include "nsThreadUtils.h"
 #include "nsNetCID.h"
+#include "nsNetUtil.h"
 #include "nsCRT.h"
 #include "nsIInterfaceRequestorUtils.h"
 #include "nsIProtocolHandler.h"
diff --git a/security/manager/ssl/tests/unit/head_psm.js b/security/manager/ssl/tests/unit/head_psm.js
index 56022d020bf0..5bb6b1abef17 100644
--- a/security/manager/ssl/tests/unit/head_psm.js
+++ b/security/manager/ssl/tests/unit/head_psm.js
@@ -63,6 +63,7 @@ const SEC_ERROR_POLICY_VALIDATION_FAILED                = SEC_ERROR_BASE + 160;
 const SEC_ERROR_OCSP_BAD_SIGNATURE                      = SEC_ERROR_BASE + 157;
 const SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED       = SEC_ERROR_BASE + 176;
 
+const SSL_ERROR_NO_CYPHER_OVERLAP                       = SSL_ERROR_BASE +   2;
 const SSL_ERROR_BAD_CERT_DOMAIN                         = SSL_ERROR_BASE +  12;
 const SSL_ERROR_BAD_CERT_ALERT                          = SSL_ERROR_BASE +  17;
 const SSL_ERROR_WEAK_SERVER_CERT_KEY                    = SSL_ERROR_BASE + 132;
diff --git a/security/manager/ssl/tests/unit/test_weak_crypto.js b/security/manager/ssl/tests/unit/test_weak_crypto.js
new file mode 100644
index 000000000000..d93fe7c62130
--- /dev/null
+++ b/security/manager/ssl/tests/unit/test_weak_crypto.js
@@ -0,0 +1,262 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+// Tests the weak crypto override
+
+const TLS_RSA_WITH_RC4_128_MD5         = 0x0004;
+const TLS_RSA_WITH_RC4_128_SHA         = 0x0005;
+const TLS_ECDHE_ECDSA_WITH_RC4_128_SHA = 0xC007;
+const TLS_ECDHE_RSA_WITH_RC4_128_SHA   = 0xC011;
+
+// Need profile dir to store the key / cert
+do_get_profile();
+// Ensure PSM is initialized
+Cc["@mozilla.org/psm;1"].getService(Ci.nsISupports);
+
+const certService = Cc["@mozilla.org/security/local-cert-service;1"]
+                    .getService(Ci.nsILocalCertService);
+const certOverrideService = Cc["@mozilla.org/security/certoverride;1"]
+                            .getService(Ci.nsICertOverrideService);
+const weakCryptoOverride = Cc["@mozilla.org/security/weakcryptooverride;1"]
+                           .getService(Ci.nsIWeakCryptoOverride);
+const socketTransportService =
+  Cc["@mozilla.org/network/socket-transport-service;1"]
+  .getService(Ci.nsISocketTransportService);
+
+function getCert() {
+  let deferred = Promise.defer();
+  certService.getOrCreateCert("tls-test", {
+    handleCert: function(c, rv) {
+      if (rv) {
+        deferred.reject(rv);
+        return;
+      }
+      deferred.resolve(c);
+    }
+  });
+  return deferred.promise;
+}
+
+function startServer(cert, rc4only) {
+  let tlsServer = Cc["@mozilla.org/network/tls-server-socket;1"]
+                  .createInstance(Ci.nsITLSServerSocket);
+  tlsServer.init(-1, true, -1);
+  tlsServer.serverCert = cert;
+
+  let input, output;
+
+  let listener = {
+    onSocketAccepted: function(socket, transport) {
+      do_print("Accept TLS client connection");
+      let connectionInfo = transport.securityInfo
+                           .QueryInterface(Ci.nsITLSServerConnectionInfo);
+      connectionInfo.setSecurityObserver(listener);
+      input = transport.openInputStream(0, 0, 0);
+      output = transport.openOutputStream(0, 0, 0);
+    },
+    onHandshakeDone: function(socket, status) {
+      do_print("TLS handshake done");
+
+      equal(status.tlsVersionUsed, Ci.nsITLSClientStatus.TLS_VERSION_1_2,
+            "Using TLS 1.2");
+      let expectedCipher = rc4only ? "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA"
+                                   : "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256";
+      equal(status.cipherName, expectedCipher,
+            "Using expected cipher");
+      equal(status.keyLength, 128, "Using 128-bit key");
+      equal(status.macLength, rc4only ? 160 : 128, "Using MAC of expected length");
+
+      input.asyncWait({
+        onInputStreamReady: function(input) {
+          NetUtil.asyncCopy(input, output);
+        }
+      }, 0, 0, Services.tm.currentThread);
+    },
+    onStopListening: function() {}
+  };
+
+  tlsServer.setSessionCache(false);
+  tlsServer.setSessionTickets(false);
+  tlsServer.setRequestClientCertificate(Ci.nsITLSServerSocket.REQUEST_NEVER);
+  if (rc4only) {
+    let cipherSuites = [
+      TLS_ECDHE_RSA_WITH_RC4_128_SHA,
+      TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
+      TLS_RSA_WITH_RC4_128_SHA,
+      TLS_RSA_WITH_RC4_128_MD5
+    ];
+    tlsServer.setCipherSuites(cipherSuites, cipherSuites.length);
+  }
+
+  tlsServer.asyncListen(listener);
+
+  return tlsServer.port;
+}
+
+function storeCertOverride(port, cert) {
+  let overrideBits = Ci.nsICertOverrideService.ERROR_UNTRUSTED |
+                     Ci.nsICertOverrideService.ERROR_MISMATCH;
+  certOverrideService.rememberValidityOverride("127.0.0.1", port, cert,
+                                               overrideBits, true);
+}
+
+function startClient(port, expectedResult, options = {}) {
+  let SSL_ERROR_BASE = Ci.nsINSSErrorsService.NSS_SSL_ERROR_BASE;
+  let SSL_ERROR_BAD_CERT_ALERT = SSL_ERROR_BASE + 17;
+  let transport =
+    socketTransportService.createTransport(["ssl"], 1, "127.0.0.1", port, null);
+  if (options.isPrivate) {
+    transport.connectionFlags |= Ci.nsISocketTransport.NO_PERMANENT_STORAGE;
+  }
+  let input;
+  let output;
+
+  let inputDeferred = Promise.defer();
+  let outputDeferred = Promise.defer();
+
+  let handler = {
+
+    onTransportStatus: function(transport, status) {
+      if (status === Ci.nsISocketTransport.STATUS_CONNECTED_TO) {
+        output.asyncWait(handler, 0, 0, Services.tm.currentThread);
+      }
+    },
+
+    onInputStreamReady: function(input) {
+      let errorCode = Cr.NS_OK;
+      try {
+        let data = NetUtil.readInputStreamToString(input, input.available());
+        equal(data, "HELLO", "Echoed data received");
+        input.close();
+        output.close();
+      } catch (e) {
+        errorCode = e.result;
+      }
+      try {
+        equal(errorCode, expectedResult,
+              "Actual and expected connection result should match");
+        inputDeferred.resolve();
+      } catch (e) {
+        inputDeferred.reject(e);
+      }
+    },
+
+    onOutputStreamReady: function(output) {
+      try {
+        output.write("HELLO", 5);
+        do_print("Output to server written");
+        outputDeferred.resolve();
+        input = transport.openInputStream(0, 0, 0);
+        input.asyncWait(handler, 0, 0, Services.tm.currentThread);
+      } catch (e) {
+        let errorCode = -1 * (e.result & 0xFFFF);
+        if (errorCode == SSL_ERROR_BAD_CERT_ALERT) {
+          do_print("Server doesn't like client cert");
+        }
+        outputDeferred.reject(e);
+      }
+    }
+
+  };
+
+  transport.setEventSink(handler, Services.tm.currentThread);
+  output = transport.openOutputStream(0, 0, 0);
+
+  return Promise.all([inputDeferred.promise, outputDeferred.promise]);
+}
+
+function run_test() {
+  Services.prefs.setBoolPref("security.tls.unrestricted_rc4_fallback", false);
+  run_next_test();
+}
+
+// for sanity check
+add_task(function*() {
+  let cert = yield getCert();
+  ok(!!cert, "Got self-signed cert");
+  let port = startServer(cert, false);
+  storeCertOverride(port, cert);
+  yield startClient(port, Cr.NS_OK);
+  yield startClient(port, Cr.NS_OK, {isPrivate: true});
+});
+
+add_task(function*() {
+  let cert = yield getCert();
+  ok(!!cert, "Got self-signed cert");
+  let port = startServer(cert, true);
+  storeCertOverride(port, cert);
+  yield startClient(port, getXPCOMStatusFromNSS(SSL_ERROR_NO_CYPHER_OVERLAP));
+  yield startClient(port, getXPCOMStatusFromNSS(SSL_ERROR_NO_CYPHER_OVERLAP),
+                    {isPrivate: true});
+
+  weakCryptoOverride.addWeakCryptoOverride("127.0.0.1", true);
+  // private browsing should not affect the permanent storage.
+  equal(Services.prefs.getCharPref("security.tls.insecure_fallback_hosts"),
+        "");
+  yield startClient(port, getXPCOMStatusFromNSS(SSL_ERROR_NO_CYPHER_OVERLAP));
+  // The auto-retry on connection reset is implemented in our HTTP layer.
+  // So we will see the crafted NS_ERROR_NET_RESET when we use
+  // nsISocketTransport directly.
+  yield startClient(port, Cr.NS_ERROR_NET_RESET, {isPrivate: true});
+  // retry manually to simulate the HTTP layer
+  yield startClient(port, Cr.NS_OK, {isPrivate: true});
+
+  weakCryptoOverride.removeWeakCryptoOverride("127.0.0.1", port, true);
+  equal(Services.prefs.getCharPref("security.tls.insecure_fallback_hosts"),
+        "");
+  yield startClient(port, getXPCOMStatusFromNSS(SSL_ERROR_NO_CYPHER_OVERLAP));
+  yield startClient(port, getXPCOMStatusFromNSS(SSL_ERROR_NO_CYPHER_OVERLAP),
+                    {isPrivate: true});
+
+  weakCryptoOverride.addWeakCryptoOverride("127.0.0.1", false, true);
+  // temporary override should not change the pref.
+  equal(Services.prefs.getCharPref("security.tls.insecure_fallback_hosts"),
+        "");
+  yield startClient(port, Cr.NS_ERROR_NET_RESET);
+  yield startClient(port, Cr.NS_OK);
+  yield startClient(port, getXPCOMStatusFromNSS(SSL_ERROR_NO_CYPHER_OVERLAP),
+                    {isPrivate: true});
+
+  weakCryptoOverride.removeWeakCryptoOverride("127.0.0.1", port, false);
+  equal(Services.prefs.getCharPref("security.tls.insecure_fallback_hosts"),
+        "");
+  yield startClient(port, getXPCOMStatusFromNSS(SSL_ERROR_NO_CYPHER_OVERLAP));
+  yield startClient(port, getXPCOMStatusFromNSS(SSL_ERROR_NO_CYPHER_OVERLAP),
+                    {isPrivate: true});
+
+  weakCryptoOverride.addWeakCryptoOverride("127.0.0.1", false);
+  // permanent override should change the pref.
+  equal(Services.prefs.getCharPref("security.tls.insecure_fallback_hosts"),
+        "127.0.0.1");
+  yield startClient(port, Cr.NS_ERROR_NET_RESET);
+  yield startClient(port, Cr.NS_OK);
+  yield startClient(port, getXPCOMStatusFromNSS(SSL_ERROR_NO_CYPHER_OVERLAP),
+                    {isPrivate: true});
+
+  weakCryptoOverride.removeWeakCryptoOverride("127.0.0.1", port, false);
+  equal(Services.prefs.getCharPref("security.tls.insecure_fallback_hosts"),
+        "");
+  yield startClient(port, getXPCOMStatusFromNSS(SSL_ERROR_NO_CYPHER_OVERLAP));
+  yield startClient(port, getXPCOMStatusFromNSS(SSL_ERROR_NO_CYPHER_OVERLAP),
+                    {isPrivate: true});
+
+  // add a host to the pref to prepare the next test
+  weakCryptoOverride.addWeakCryptoOverride("127.0.0.1", false);
+  yield startClient(port, Cr.NS_ERROR_NET_RESET);
+  yield startClient(port, Cr.NS_OK);
+  equal(Services.prefs.getCharPref("security.tls.insecure_fallback_hosts"),
+        "127.0.0.1");
+});
+
+add_task(function*() {
+  let cert = yield getCert();
+  ok(!!cert, "Got self-signed cert");
+  let port = startServer(cert, false);
+  storeCertOverride(port, cert);
+  yield startClient(port, Cr.NS_OK);
+  // Successful strong cipher will remove the host from the pref.
+  equal(Services.prefs.getCharPref("security.tls.insecure_fallback_hosts"),
+        "");
+});
diff --git a/security/manager/ssl/tests/unit/xpcshell.ini b/security/manager/ssl/tests/unit/xpcshell.ini
index b7e0c770fbff..a54b71a56861 100644
--- a/security/manager/ssl/tests/unit/xpcshell.ini
+++ b/security/manager/ssl/tests/unit/xpcshell.ini
@@ -149,3 +149,5 @@ run-sequentially = hardcoded ports
 run-sequentially = hardcoded ports
 [test_certviewer_invalid_oids.js]
 skip-if = toolkit == 'android' || buildapp == 'b2g'
+
+[test_weak_crypto.js]

From 41d99381eb9ff7c9b8963de9d3f72bf8d92199a9 Mon Sep 17 00:00:00 2001
From: Henri Sivonen <hsivonen@hsivonen.fi>
Date: Wed, 14 Oct 2015 15:28:50 +0300
Subject: [PATCH 50/63] Bug 943296 - widget/gtk/nsDragService.cpp should assume
 Gtk uses UTF-8. r=karlt.

---
 widget/gtk/nsDragService.cpp | 74 ++++++++++++++++++++----------------
 1 file changed, 41 insertions(+), 33 deletions(-)

diff --git a/widget/gtk/nsDragService.cpp b/widget/gtk/nsDragService.cpp
index 264d2c05619b..2a19597c245c 100644
--- a/widget/gtk/nsDragService.cpp
+++ b/widget/gtk/nsDragService.cpp
@@ -555,6 +555,26 @@ nsDragService::GetCanDrop(bool *aCanDrop)
     return NS_OK;
 }
 
+static void
+UTF16ToNewUTF8(const char16_t* aUTF16,
+               uint32_t aUTF16Len,
+               char** aUTF8,
+               uint32_t* aUTF8Len)
+{
+  nsDependentSubstring utf16(aUTF16, aUTF16Len);
+  *aUTF8 = ToNewUTF8String(utf16, aUTF8Len);
+}
+
+static void
+UTF8ToNewUTF16(const char* aUTF8,
+               uint32_t aUTF8Len,
+               char16_t** aUTF16,
+               uint32_t* aUTF16Len)
+{
+  nsDependentCSubstring utf8(aUTF8, aUTF8Len);
+  *aUTF16 = UTF8ToNewUnicode(utf8, aUTF16Len);
+}
+
 // count the number of URIs in some text/uri-list format data.
 static uint32_t
 CountTextUriListItems(const char *data,
@@ -586,7 +606,7 @@ GetTextUriListItem(const char *data,
                    uint32_t datalen,
                    uint32_t aItemIndex,
                    char16_t **convertedText,
-                   int32_t *convertedTextLen)
+                   uint32_t *convertedTextLen)
 {
     const char *p = data;
     const char *endPtr = p + datalen;
@@ -605,8 +625,7 @@ GetTextUriListItem(const char *data,
             const char *q = p;
             while (q < endPtr && *q != '\0' && *q != '\n' && *q != '\r')
               q++;
-            nsPrimitiveHelpers::ConvertPlatformPlainTextToUnicode(
-                                p, q - p, convertedText, convertedTextLen);
+            UTF8ToNewUTF16(p, q - p, convertedText, convertedTextLen);
             break;
         }
         // skip to the end of the line
@@ -617,8 +636,7 @@ GetTextUriListItem(const char *data,
 
     // didn't find the desired item, so just pass the whole lot
     if (!*convertedText) {
-        nsPrimitiveHelpers::ConvertPlatformPlainTextToUnicode(
-                            data, datalen, convertedText, convertedTextLen);
+        UTF8ToNewUTF16(data, datalen, convertedText, convertedTextLen);
     }
 }
 
@@ -776,7 +794,7 @@ nsDragService::GetData(nsITransferable * aTransferable,
                     if (mTargetDragData) {
                         const char* text = static_cast<char*>(mTargetDragData);
                         char16_t* convertedText = nullptr;
-                        int32_t convertedTextLen = 0;
+                        uint32_t convertedTextLen = 0;
 
                         GetTextUriListItem(text, mTargetDragDataLen, aItemIndex,
                                            &convertedText, &convertedTextLen);
@@ -848,10 +866,9 @@ nsDragService::GetData(nsITransferable * aTransferable,
                             const char* castedText =
                                         reinterpret_cast<char*>(mTargetDragData);
                             char16_t* convertedText = nullptr;
-                            int32_t convertedTextLen = 0;
-                            nsPrimitiveHelpers::ConvertPlatformPlainTextToUnicode(
-                                                castedText, mTargetDragDataLen,
-                                                &convertedText, &convertedTextLen);
+                            uint32_t convertedTextLen = 0;
+                            UTF8ToNewUTF16(castedText, mTargetDragDataLen,
+                                           &convertedText, &convertedTextLen);
                             if ( convertedText ) {
                                 MOZ_LOG(sDragLm, LogLevel::Debug,
                                        ("successfully converted plain text \
@@ -881,7 +898,7 @@ nsDragService::GetData(nsITransferable * aTransferable,
                         const char *data =
                                    reinterpret_cast<char*>(mTargetDragData);
                         char16_t* convertedText = nullptr;
-                        int32_t convertedTextLen = 0;
+                        uint32_t convertedTextLen = 0;
 
                         GetTextUriListItem(data, mTargetDragDataLen, aItemIndex,
                                            &convertedText, &convertedTextLen);
@@ -913,8 +930,8 @@ nsDragService::GetData(nsITransferable * aTransferable,
                             const char* castedText =
                                   reinterpret_cast<char*>(mTargetDragData);
                             char16_t* convertedText = nullptr;
-                            int32_t convertedTextLen = 0;
-                            nsPrimitiveHelpers::ConvertPlatformPlainTextToUnicode(castedText, mTargetDragDataLen, &convertedText, &convertedTextLen);
+                            uint32_t convertedTextLen = 0;
+                            UTF8ToNewUTF16(castedText, mTargetDragDataLen, &convertedText, &convertedTextLen);
                             if ( convertedText ) {
                                 MOZ_LOG(sDragLm,
                                        LogLevel::Debug,
@@ -1471,14 +1488,13 @@ CreateUriList(nsISupportsArray *items, gchar **text, gint *length)
                 char* plainTextData = nullptr;
                 char16_t* castedUnicode = reinterpret_cast<char16_t*>
                                                            (tmpData);
-                int32_t plainTextLen = 0;
-                nsPrimitiveHelpers::ConvertUnicodeToPlatformPlainText(
-                                    castedUnicode,
-                                    tmpDataLen / 2,
-                                    &plainTextData,
-                                    &plainTextLen);
+                uint32_t plainTextLen = 0;
+                UTF16ToNewUTF8(castedUnicode,
+                               tmpDataLen / 2,
+                               &plainTextData,
+                               &plainTextLen);
                 if (plainTextData) {
-                    int32_t j;
+                    uint32_t j;
 
                     // text/x-moz-url is of form url + "\n" + title.
                     // We just want the url.
@@ -1577,19 +1593,11 @@ nsDragService::SourceDataGet(GtkWidget        *aWidget,
                 char* plainTextData = nullptr;
                 char16_t* castedUnicode = reinterpret_cast<char16_t*>
                                                            (tmpData);
-                int32_t plainTextLen = 0;
-                if (strcmp(mimeFlavor, gTextPlainUTF8Type) == 0) {
-                    plainTextData =
-                        ToNewUTF8String(
-                            nsDependentString(castedUnicode, tmpDataLen / 2),
-                            (uint32_t*)&plainTextLen);
-                } else {
-                    nsPrimitiveHelpers::ConvertUnicodeToPlatformPlainText(
-                                        castedUnicode,
-                                        tmpDataLen / 2,
-                                        &plainTextData,
-                                        &plainTextLen);
-                }
+                uint32_t plainTextLen = 0;
+                UTF16ToNewUTF8(castedUnicode,
+                               tmpDataLen / 2,
+                               &plainTextData,
+                               &plainTextLen);
                 if (tmpData) {
                     // this was not allocated using glib
                     free(tmpData);

From 85ba0b6e2ff79140f8af5c7ab3c0daa229aba1de Mon Sep 17 00:00:00 2001
From: Henri Sivonen <hsivonen@hsivonen.fi>
Date: Wed, 14 Oct 2015 15:28:50 +0300
Subject: [PATCH 51/63] Bug 1211454 - Avoid requesting a zero-terminated string
 in TextEncoder when zero-termination is not needed. r=emk.

---
 dom/encoding/TextEncoder.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dom/encoding/TextEncoder.cpp b/dom/encoding/TextEncoder.cpp
index 5845cda48e88..4f3d8d155afb 100644
--- a/dom/encoding/TextEncoder.cpp
+++ b/dom/encoding/TextEncoder.cpp
@@ -46,7 +46,7 @@ TextEncoder::Encode(JSContext* aCx,
   // Run the steps of the encoding algorithm.
   int32_t srcLen = aString.Length();
   int32_t maxLen;
-  const char16_t* data = PromiseFlatString(aString).get();
+  const char16_t* data = aString.BeginReading();
   nsresult rv = mEncoder->GetMaxLength(data, srcLen, &maxLen);
   if (NS_FAILED(rv)) {
     aRv.Throw(rv);

From 03157a17ce4b8512ad411037d3a4b18d6a30c9f3 Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Wed, 14 Oct 2015 13:24:08 +0100
Subject: [PATCH 52/63] Bug 1175755 - Only clear GC statistics aborted flag at
 the end of the outermost nested GC r=bbouvier

--HG--
extra : rebase_source : 4b2b228f7c8637545e352e5b497766cabc1f93dd
---
 js/src/gc/Statistics.cpp                | 18 ++++++++++++------
 js/src/jit-test/tests/gc/bug-1175755.js |  9 +++++++++
 2 files changed, 21 insertions(+), 6 deletions(-)
 create mode 100644 js/src/jit-test/tests/gc/bug-1175755.js

diff --git a/js/src/gc/Statistics.cpp b/js/src/gc/Statistics.cpp
index cf4eb34b926b..c6fc551d5405 100644
--- a/js/src/gc/Statistics.cpp
+++ b/js/src/gc/Statistics.cpp
@@ -937,13 +937,16 @@ Statistics::endGC()
     for (size_t d = PHASE_DAG_NONE; d < NumTimingArrays; d++)
         PodZero(&phaseTimes[d][PHASE_GC_BEGIN], PHASE_LIMIT - PHASE_GC_BEGIN);
 
-    aborted = false;
+    // Clear the OOM flag but only if we are not in a nested GC.
+    if (gcDepth == 1)
+        aborted = false;
 }
 
 void
 Statistics::beginSlice(const ZoneGCStats& zoneStats, JSGCInvocationKind gckind,
                        SliceBudget budget, JS::gcreason::Reason reason)
 {
+    gcDepth++;
     this->zoneStats = zoneStats;
 
     bool first = !runtime->gc.isIncrementalGCInProgress();
@@ -952,15 +955,15 @@ Statistics::beginSlice(const ZoneGCStats& zoneStats, JSGCInvocationKind gckind,
 
     SliceData data(budget, reason, PRMJ_Now(), JS_GetCurrentEmbedderTime(), GetPageFaultCount());
     if (!slices.append(data)) {
-        // OOM testing fails if we crash here, so set a flag instead.
+        // If we are OOM, set a flag to indicate we have missing slice data.
         aborted = true;
         return;
     }
 
     runtime->addTelemetry(JS_TELEMETRY_GC_REASON, reason);
 
-    // Slice callbacks should only fire for the outermost level
-    if (++gcDepth == 1) {
+    // Slice callbacks should only fire for the outermost level.
+    if (gcDepth == 1) {
         bool wasFullGC = zoneStats.isCollectingAllZones();
         if (sliceCallback)
             (*sliceCallback)(runtime, first ? JS::GC_CYCLE_BEGIN : JS::GC_SLICE_BEGIN,
@@ -998,8 +1001,8 @@ Statistics::endSlice()
     if (last)
         endGC();
 
-    // Slice callbacks should only fire for the outermost level
-    if (--gcDepth == 0) {
+    // Slice callbacks should only fire for the outermost level.
+    if (gcDepth == 1 && !aborted) {
         bool wasFullGC = zoneStats.isCollectingAllZones();
         if (sliceCallback)
             (*sliceCallback)(runtime, last ? JS::GC_CYCLE_END : JS::GC_SLICE_END,
@@ -1009,6 +1012,9 @@ Statistics::endSlice()
     /* Do this after the slice callback since it uses these values. */
     if (last)
         PodArrayZero(counts);
+
+    gcDepth--;
+    MOZ_ASSERT(gcDepth >= 0);
 }
 
 void
diff --git a/js/src/jit-test/tests/gc/bug-1175755.js b/js/src/jit-test/tests/gc/bug-1175755.js
new file mode 100644
index 000000000000..e0a319ce55c8
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-1175755.js
@@ -0,0 +1,9 @@
+// |jit-test| allow-oom; allow-unhandlable-oom
+
+if (!('oomAfterAllocations' in this))
+    quit();
+
+setGCCallback({
+    action: "majorGC",
+});
+oomAfterAllocations(50);

From 0936ac225690921c6baa9495d20d1a32c53c064e Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Wed, 14 Oct 2015 13:24:08 +0100
Subject: [PATCH 53/63] Bug 1214006 - Take account of the fact that
 JSScript::atoms may be null while tracing r=terrence

--HG--
extra : rebase_source : 6dea26039415d8b48b46d4f0998811a89a670c59
---
 js/src/jit-test/tests/gc/bug-1214006.js | 17 +++++++++++++++++
 js/src/jsscript.cpp                     |  8 +++++---
 2 files changed, 22 insertions(+), 3 deletions(-)
 create mode 100644 js/src/jit-test/tests/gc/bug-1214006.js

diff --git a/js/src/jit-test/tests/gc/bug-1214006.js b/js/src/jit-test/tests/gc/bug-1214006.js
new file mode 100644
index 000000000000..b1bef3d6c0ea
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-1214006.js
@@ -0,0 +1,17 @@
+if (!('oomAtAllocation' in this && 'resetOOMFailure' in this))
+    quit();
+
+function f() {
+    var i = 1;
+    do {
+        try {
+            oomAtAllocation(i);
+            (function() y)();
+        } catch (e) {
+            x = resetOOMFailure();
+        }
+        i++;
+    } while (x);
+}
+f();
+fullcompartmentchecks(true);
diff --git a/js/src/jsscript.cpp b/js/src/jsscript.cpp
index 1910597bfe6c..da6f00516785 100644
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -3772,9 +3772,11 @@ JSScript::traceChildren(JSTracer* trc)
                   static_cast<GCMarker*>(trc)->shouldCheckCompartments(),
                   zone()->isCollecting());
 
-    for (uint32_t i = 0; i < natoms(); ++i) {
-        if (atoms[i])
-            TraceEdge(trc, &atoms[i], "atom");
+    if (atoms) {
+        for (uint32_t i = 0; i < natoms(); ++i) {
+            if (atoms[i])
+                TraceEdge(trc, &atoms[i], "atom");
+        }
     }
 
     if (hasObjects()) {

From 224fd0ff0d6624e34fdc46518e5a74db1312e244 Mon Sep 17 00:00:00 2001
From: "Nicolas B. Pierron" <nicolas.b.pierron@mozilla.com>
Date: Wed, 14 Oct 2015 14:32:40 +0200
Subject: [PATCH 54/63] Bug 1211331 - Ensure that GC slices are terminated such
 that we can safely iterate the heap. r=terrence

---
 js/src/jsopcode.cpp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
index 7fc518613817..c59eee1c2fbe 100644
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -36,6 +36,7 @@
 #include "asmjs/AsmJSModule.h"
 #include "frontend/BytecodeCompiler.h"
 #include "frontend/SourceNotes.h"
+#include "gc/GCInternals.h"
 #include "js/CharacterEncoding.h"
 #include "vm/CodeCoverage.h"
 #include "vm/Opcodes.h"
@@ -1952,6 +1953,9 @@ GenerateLcovInfo(JSContext* cx, JSCompartment* comp, GenericPrinter& out)
     JSRuntime* rt = cx->runtime();
 
     // Collect the list of scripts which are part of the current compartment.
+    {
+        js::gc::AutoPrepareForTracing apft(rt, SkipAtoms);
+    }
     Rooted<ScriptVector> topScripts(cx, ScriptVector(cx));
     for (ZonesIter zone(rt, SkipAtoms); !zone.done(); zone.next()) {
         for (ZoneCellIter i(zone, AllocKind::SCRIPT); !i.done(); i.next()) {

From 55e80012870fd777675ad91a02040418f48866b4 Mon Sep 17 00:00:00 2001
From: Jan de Mooij <jdemooij@mozilla.com>
Date: Wed, 14 Oct 2015 15:13:21 +0200
Subject: [PATCH 55/63] Bug 1208819 - Fix irregexp overrecursion check to
 ignore interrupts. r=bhackett

---
 js/src/irregexp/NativeRegExpMacroAssembler.cpp | 6 ++++--
 js/src/vm/Runtime.cpp                          | 2 ++
 js/src/vm/Runtime.h                            | 5 +++++
 3 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/js/src/irregexp/NativeRegExpMacroAssembler.cpp b/js/src/irregexp/NativeRegExpMacroAssembler.cpp
index 161f7d5d114b..aab0fb4de2ac 100644
--- a/js/src/irregexp/NativeRegExpMacroAssembler.cpp
+++ b/js/src/irregexp/NativeRegExpMacroAssembler.cpp
@@ -154,9 +154,11 @@ NativeRegExpMacroAssembler::GenerateCode(JSContext* cx, bool match_only)
     masm.reserveStack(frameSize);
     masm.checkStackAlignment();
 
-    // Check if we have space on the stack.
+    // Check if we have space on the stack. Use the *NoInterrupt stack limit to
+    // avoid failing repeatedly when the regex code is called from Ion JIT code,
+    // see bug 1208819.
     Label stack_ok;
-    void* stack_limit = runtime->addressOfJitStackLimit();
+    void* stack_limit = runtime->addressOfJitStackLimitNoInterrupt();
     masm.branchStackPtrRhs(Assembler::Below, AbsoluteAddress(stack_limit), &stack_ok);
 
     // Exit with an exception. There is not enough space on the stack
diff --git a/js/src/vm/Runtime.cpp b/js/src/vm/Runtime.cpp
index 58e9d0a325f2..8a538794a654 100644
--- a/js/src/vm/Runtime.cpp
+++ b/js/src/vm/Runtime.cpp
@@ -130,6 +130,7 @@ JSRuntime::JSRuntime(JSRuntime* parentRuntime)
     jitJSContext(nullptr),
     jitActivation(nullptr),
     jitStackLimit_(0xbad),
+    jitStackLimitNoInterrupt_(0xbad),
     activation_(nullptr),
     profilingActivation_(nullptr),
     profilerSampleBufferGen_(0),
@@ -623,6 +624,7 @@ JSRuntime::resetJitStackLimit()
 #else
     jitStackLimit_ = mainThread.nativeStackLimit[StackForUntrustedScript];
 #endif
+    jitStackLimitNoInterrupt_ = jitStackLimit_;
 }
 
 void
diff --git a/js/src/vm/Runtime.h b/js/src/vm/Runtime.h
index 1a953cd1e13e..3c0740d95a7f 100644
--- a/js/src/vm/Runtime.h
+++ b/js/src/vm/Runtime.h
@@ -632,6 +632,9 @@ struct JSRuntime : public JS::shadow::Runtime,
     mozilla::Atomic<uintptr_t, mozilla::Relaxed> jitStackLimit_;
     void resetJitStackLimit();
 
+    // Like jitStackLimit_, but not reset to trigger interrupts.
+    uintptr_t jitStackLimitNoInterrupt_;
+
   public:
     void initJitStackLimit();
 
@@ -641,6 +644,8 @@ struct JSRuntime : public JS::shadow::Runtime,
     void* addressOfJitStackLimit() { return &jitStackLimit_; }
     static size_t offsetOfJitStackLimit() { return offsetof(JSRuntime, jitStackLimit_); }
 
+    void* addressOfJitStackLimitNoInterrupt() { return &jitStackLimitNoInterrupt_; }
+
     // Information about the heap allocated backtrack stack used by RegExp JIT code.
     js::irregexp::RegExpStack regexpStack;
 

From 17a3104f225f03721484b72b3ca8f95694576649 Mon Sep 17 00:00:00 2001
From: "Carsten \"Tomcat\" Book" <cbook@mozilla.com>
Date: Wed, 14 Oct 2015 16:28:41 +0200
Subject: [PATCH 56/63] Backed out changeset 66e3972e9150 (bug 1168635)

---
 security/manager/ssl/WeakCryptoOverride.cpp   |  62 -----
 security/manager/ssl/WeakCryptoOverride.h     |  35 ---
 security/manager/ssl/moz.build                |   2 -
 .../manager/ssl/nsIWeakCryptoOverride.idl     |  45 ---
 security/manager/ssl/nsNSSCallbacks.cpp       |   3 -
 security/manager/ssl/nsNSSIOLayer.cpp         | 108 +-------
 security/manager/ssl/nsNSSIOLayer.h           |   4 -
 security/manager/ssl/nsNSSModule.cpp          |  70 ++---
 .../manager/ssl/nsSecureBrowserUIImpl.cpp     |   1 -
 security/manager/ssl/tests/unit/head_psm.js   |   1 -
 .../ssl/tests/unit/test_weak_crypto.js        | 262 ------------------
 security/manager/ssl/tests/unit/xpcshell.ini  |   2 -
 12 files changed, 41 insertions(+), 554 deletions(-)
 delete mode 100644 security/manager/ssl/WeakCryptoOverride.cpp
 delete mode 100644 security/manager/ssl/WeakCryptoOverride.h
 delete mode 100644 security/manager/ssl/nsIWeakCryptoOverride.idl
 delete mode 100644 security/manager/ssl/tests/unit/test_weak_crypto.js

diff --git a/security/manager/ssl/WeakCryptoOverride.cpp b/security/manager/ssl/WeakCryptoOverride.cpp
deleted file mode 100644
index e747a33008bc..000000000000
--- a/security/manager/ssl/WeakCryptoOverride.cpp
+++ /dev/null
@@ -1,62 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "WeakCryptoOverride.h"
-
-#include "MainThreadUtils.h"
-#include "SharedSSLState.h"
-
-using namespace mozilla;
-using namespace mozilla::psm;
-
-NS_IMPL_ISUPPORTS(WeakCryptoOverride,
-                  nsIWeakCryptoOverride)
-
-WeakCryptoOverride::WeakCryptoOverride()
-{
-}
-
-WeakCryptoOverride::~WeakCryptoOverride()
-{
-}
-
-NS_IMETHODIMP
-WeakCryptoOverride::AddWeakCryptoOverride(const nsACString& aHostName,
-                                          bool aPrivate, bool aTemporary)
-{
-  if (!NS_IsMainThread()) {
-    return NS_ERROR_NOT_SAME_THREAD;
-  }
-
-  SharedSSLState* sharedState = aPrivate ? PrivateSSLState()
-                                         : PublicSSLState();
-  if (!sharedState) {
-    return NS_ERROR_NOT_AVAILABLE;
-  }
-  const nsPromiseFlatCString& host = PromiseFlatCString(aHostName);
-  sharedState->IOLayerHelpers().addInsecureFallbackSite(host, aTemporary);
-
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-WeakCryptoOverride::RemoveWeakCryptoOverride(const nsACString& aHostName,
-                                             int32_t aPort, bool aPrivate)
-{
-  if (!NS_IsMainThread()) {
-    return NS_ERROR_NOT_SAME_THREAD;
-  }
-
-  SharedSSLState* sharedState = aPrivate ? PrivateSSLState()
-                                         : PublicSSLState();
-  if (!sharedState) {
-    return NS_ERROR_NOT_AVAILABLE;
-  }
-  const nsPromiseFlatCString& host = PromiseFlatCString(aHostName);
-  sharedState->IOLayerHelpers().removeInsecureFallbackSite(host, aPort);
-
-  return NS_OK;
-}
diff --git a/security/manager/ssl/WeakCryptoOverride.h b/security/manager/ssl/WeakCryptoOverride.h
deleted file mode 100644
index fefee75ef958..000000000000
--- a/security/manager/ssl/WeakCryptoOverride.h
+++ /dev/null
@@ -1,35 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef WEAKCRYPTOOVERRIDE_H
-#define WEAKCRYPTOOVERRIDE_H
-
-#include "nsIWeakCryptoOverride.h"
-#include "nsWeakReference.h"
-
-namespace mozilla {
-namespace psm {
-
-class WeakCryptoOverride final : public nsIWeakCryptoOverride
-{
-public:
-  NS_DECL_ISUPPORTS
-  NS_DECL_NSIWEAKCRYPTOOVERRIDE
-
-  WeakCryptoOverride();
-
-protected:
-  ~WeakCryptoOverride();
-};
-
-} // psm
-} // mozilla
-
-#define NS_WEAKCRYPTOOVERRIDE_CID /* ffb06724-3c20-447c-8328-ae71513dd618 */ \
-{ 0xffb06724, 0x3c20, 0x447c, \
-  { 0x83, 0x28, 0xae, 0x71, 0x51, 0x3d, 0xd6, 0x18 } }
-
-#endif
diff --git a/security/manager/ssl/moz.build b/security/manager/ssl/moz.build
index 59a47bca6660..fbad6cb40700 100644
--- a/security/manager/ssl/moz.build
+++ b/security/manager/ssl/moz.build
@@ -37,7 +37,6 @@ XPIDL_SOURCES += [
     'nsITokenDialogs.idl',
     'nsITokenPasswordDialogs.idl',
     'nsIUserCertPicker.idl',
-    'nsIWeakCryptoOverride.idl',
     'nsIX509Cert.idl',
     'nsIX509CertDB.idl',
     'nsIX509CertList.idl',
@@ -127,7 +126,6 @@ UNIFIED_SOURCES += [
     'SharedSSLState.cpp',
     'SSLServerCertVerification.cpp',
     'TransportSecurityInfo.cpp',
-    'WeakCryptoOverride.cpp',
 ]
 
 # nsNSSCertificateDB.cpp needs to include nscert.h before everything else.
diff --git a/security/manager/ssl/nsIWeakCryptoOverride.idl b/security/manager/ssl/nsIWeakCryptoOverride.idl
deleted file mode 100644
index 5b474c13d4f8..000000000000
--- a/security/manager/ssl/nsIWeakCryptoOverride.idl
+++ /dev/null
@@ -1,45 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsISupports.idl"
-
-%{C++
-#define NS_WEAKCRYPTOOVERRIDE_CONTRACTID "@mozilla.org/security/weakcryptooverride;1"
-%}
-
-/**
- * This represents the fallback whitelist for
- * weak crypto servers such as RC4-only.
- */
-[scriptable, uuid(27b4d3df-8f15-4eb4-a35f-474e911b61e7)]
-interface nsIWeakCryptoOverride : nsISupports {
-  /**
-   *  Add a weak crypto override for the given hostname:port.
-   *  Main thread only.
-   *
-   *  @param aHostName The host (punycode) this mapping belongs to
-   *  @param aPrivate The override info will used for the private browsing
-   *                  session and no information will be written to the disk.
-   *  @param aTemporary The override info will not persist between sessions.
-   *                    Ignored if aPrivate is true.
-   */
-  void addWeakCryptoOverride(in ACString aHostName,
-                             in boolean aPrivate,
-                             [optional] in boolean aTemporary);
-
-  /**
-   *  Remove a weak crypto override for the given hostname:port.
-   *  Main thread only.
-   *
-   *  @param aHostName The host (punycode) whose entry should be cleared.
-   *  @param aPort The port whose entry should be cleared.
-   *  @param aPrivate The override info will used for the private browsing
-   *                  session.
-   */
-  void removeWeakCryptoOverride(in ACString aHostName,
-                                in int32_t aPort,
-                                in boolean aPrivate);
-};
diff --git a/security/manager/ssl/nsNSSCallbacks.cpp b/security/manager/ssl/nsNSSCallbacks.cpp
index a553c61a3412..3e14c3985c44 100644
--- a/security/manager/ssl/nsNSSCallbacks.cpp
+++ b/security/manager/ssl/nsNSSCallbacks.cpp
@@ -1239,9 +1239,6 @@ void HandshakeCallback(PRFileDesc* fd, void* client_data) {
   } else {
     state = nsIWebProgressListener::STATE_IS_SECURE |
             nsIWebProgressListener::STATE_SECURE_HIGH;
-    // we know this site no longer requires a weak cipher
-    ioLayerHelpers.removeInsecureFallbackSite(infoObject->GetHostName(),
-                                              infoObject->GetPort());
   }
   infoObject->SetSecurityState(state);
 
diff --git a/security/manager/ssl/nsNSSIOLayer.cpp b/security/manager/ssl/nsNSSIOLayer.cpp
index bee79c6ef122..4779b7c579e6 100644
--- a/security/manager/ssl/nsNSSIOLayer.cpp
+++ b/security/manager/ssl/nsNSSIOLayer.cpp
@@ -1539,11 +1539,9 @@ PrefObserver::Observe(nsISupports* aSubject, const char* aTopic,
     } else if (prefName.EqualsLiteral("security.tls.version.fallback-limit")) {
       mOwner->loadVersionFallbackLimit();
     } else if (prefName.EqualsLiteral("security.tls.insecure_fallback_hosts")) {
-      // Changes to the whitelist on the public side will update the pref.
-      // Don't propagate the changes to the private side.
-      if (mOwner->isPublic()) {
-        mOwner->initInsecureFallbackSites();
-      }
+      nsCString insecureFallbackHosts;
+      Preferences::GetCString("security.tls.insecure_fallback_hosts", &insecureFallbackHosts);
+      mOwner->setInsecureFallbackSites(insecureFallbackHosts);
     } else if (prefName.EqualsLiteral("security.tls.insecure_fallback_hosts.use_static_list")) {
       mOwner->mUseStaticFallbackList =
         Preferences::GetBool("security.tls.insecure_fallback_hosts.use_static_list", true);
@@ -1644,7 +1642,9 @@ nsSSLIOLayerHelpers::Init()
     Preferences::GetBool("security.ssl.false_start.require-npn",
                          FALSE_START_REQUIRE_NPN_DEFAULT);
   loadVersionFallbackLimit();
-  initInsecureFallbackSites();
+  nsCString insecureFallbackHosts;
+  Preferences::GetCString("security.tls.insecure_fallback_hosts", &insecureFallbackHosts);
+  setInsecureFallbackSites(insecureFallbackHosts);
   mUseStaticFallbackList =
     Preferences::GetBool("security.tls.insecure_fallback_hosts.use_static_list", true);
   mUnrestrictedRC4Fallback =
@@ -1707,102 +1707,6 @@ nsSSLIOLayerHelpers::setInsecureFallbackSites(const nsCString& str)
   }
 }
 
-void
-nsSSLIOLayerHelpers::initInsecureFallbackSites()
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  nsCString insecureFallbackHosts;
-  Preferences::GetCString("security.tls.insecure_fallback_hosts",
-                          &insecureFallbackHosts);
-  setInsecureFallbackSites(insecureFallbackHosts);
-}
-
-bool
-nsSSLIOLayerHelpers::isPublic() const
-{
-  return this == &PublicSSLState()->IOLayerHelpers();
-}
-
-void
-nsSSLIOLayerHelpers::addInsecureFallbackSite(const nsCString& hostname,
-                                             bool temporary)
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  {
-    MutexAutoLock lock(mutex);
-    if (mInsecureFallbackSites.Contains(hostname)) {
-      return;
-    }
-    mInsecureFallbackSites.PutEntry(hostname);
-  }
-  if (!isPublic() || temporary) {
-    return;
-  }
-  nsCString value;
-  Preferences::GetCString("security.tls.insecure_fallback_hosts", &value);
-  if (!value.IsEmpty()) {
-    value.Append(',');
-  }
-  value.Append(hostname);
-  Preferences::SetCString("security.tls.insecure_fallback_hosts", value);
-}
-
-class FallbackPrefRemover final : public nsRunnable
-{
-public:
-  explicit FallbackPrefRemover(const nsACString& aHost)
-    : mHost(aHost)
-  {}
-  NS_IMETHOD Run() override;
-private:
-  nsCString mHost;
-};
-
-NS_IMETHODIMP
-FallbackPrefRemover::Run()
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  nsCString oldValue;
-  Preferences::GetCString("security.tls.insecure_fallback_hosts", &oldValue);
-  nsCCharSeparatedTokenizer toker(oldValue, ',');
-  nsCString newValue;
-  while (toker.hasMoreTokens()) {
-    const nsCSubstring& host = toker.nextToken();
-    if (host.Equals(mHost)) {
-      continue;
-    }
-    if (!newValue.IsEmpty()) {
-      newValue.Append(',');
-    }
-    newValue.Append(host);
-  }
-  Preferences::SetCString("security.tls.insecure_fallback_hosts", newValue);
-  return NS_OK;
-}
-
-void
-nsSSLIOLayerHelpers::removeInsecureFallbackSite(const nsACString& hostname,
-                                                uint16_t port)
-{
-  forgetIntolerance(hostname, port);
-  {
-    MutexAutoLock lock(mutex);
-    if (!mInsecureFallbackSites.Contains(hostname)) {
-      return;
-    }
-    mInsecureFallbackSites.RemoveEntry(hostname);
-  }
-  if (!isPublic()) {
-    return;
-  }
-  RefPtr<nsRunnable> runnable = new FallbackPrefRemover(hostname);
-  if (NS_IsMainThread()) {
-    runnable->Run();
-  } else {
-    NS_DispatchToMainThread(runnable);
-  }
-}
-
 struct FallbackListComparator
 {
   explicit FallbackListComparator(const char* aTarget)
diff --git a/security/manager/ssl/nsNSSIOLayer.h b/security/manager/ssl/nsNSSIOLayer.h
index 0ec84072af0c..965eca879a66 100644
--- a/security/manager/ssl/nsNSSIOLayer.h
+++ b/security/manager/ssl/nsNSSIOLayer.h
@@ -226,10 +226,6 @@ public:
   void clearStoredData();
   void loadVersionFallbackLimit();
   void setInsecureFallbackSites(const nsCString& str);
-  void initInsecureFallbackSites();
-  bool isPublic() const;
-  void addInsecureFallbackSite(const nsCString& hostname, bool temporary);
-  void removeInsecureFallbackSite(const nsACString& hostname, uint16_t port);
   bool isInsecureFallbackSite(const nsACString& hostname);
 
   bool mFalseStartRequireNPN;
diff --git a/security/manager/ssl/nsNSSModule.cpp b/security/manager/ssl/nsNSSModule.cpp
index ea74d1f62a2a..f0f84765031a 100644
--- a/security/manager/ssl/nsNSSModule.cpp
+++ b/security/manager/ssl/nsNSSModule.cpp
@@ -4,44 +4,48 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "CertBlocklist.h"
-#include "nsCertOverrideService.h"
-#include "nsCertPicker.h"
-#include "nsCrypto.h"
-#include "nsCryptoHash.h"
-#include "nsCURILoader.h"
-#include "nsDataSignatureVerifier.h"
-#include "nsDOMCID.h" //For the NS_CRYPTO_CONTRACTID define
-#include "nsEntropyCollector.h"
-#include "nsICategoryManager.h"
-#include "nsKeygenHandler.h"
-#include "nsKeyModule.h"
 #include "mozilla/ModuleUtils.h"
-#include "nsNetCID.h"
-#include "nsNSSCertificate.h"
-#include "nsNSSCertificateDB.h"
-#include "nsNSSCertificateFakeTransport.h"
+
 #include "nsNSSComponent.h"
-#include "NSSErrorsService.h"
-#include "nsNSSVersion.h"
-#include "nsNTLMAuthModule.h"
+#include "nsSSLSocketProvider.h"
+#include "nsTLSSocketProvider.h"
+#include "nsKeygenHandler.h"
+
+#include "nsSDR.h"
+
 #include "nsPK11TokenDB.h"
 #include "nsPKCS11Slot.h"
-#include "PSMContentListener.h"
-#include "nsRandomGenerator.h"
-#include "nsSDR.h"
-#include "nsSecureBrowserUIImpl.h"
-#include "nsSiteSecurityService.h"
-#include "nsSSLSocketProvider.h"
-#include "nsSSLStatus.h"
-#include "nsTLSSocketProvider.h"
-#include "TransportSecurityInfo.h"
-#include "WeakCryptoOverride.h"
-#include "nsXULAppAPI.h"
-
+#include "nsNSSCertificate.h"
+#include "nsNSSCertificateFakeTransport.h"
+#include "nsNSSCertificateDB.h"
 #ifdef MOZ_XUL
 #include "nsCertTree.h"
 #endif
+#include "nsCrypto.h"
+#include "nsCryptoHash.h"
+//For the NS_CRYPTO_CONTRACTID define
+#include "nsDOMCID.h"
+#include "nsNetCID.h"
+#include "nsCertPicker.h"
+#include "nsCURILoader.h"
+#include "nsICategoryManager.h"
+#include "nsNTLMAuthModule.h"
+#include "nsKeyModule.h"
+#include "nsDataSignatureVerifier.h"
+#include "nsCertOverrideService.h"
+#include "nsRandomGenerator.h"
+#include "nsSSLStatus.h"
+#include "TransportSecurityInfo.h"
+#include "NSSErrorsService.h"
+#include "nsNSSVersion.h"
+#include "CertBlocklist.h"
+#include "nsEntropyCollector.h"
+#include "nsSecureBrowserUIImpl.h"
+#include "nsSiteSecurityService.h"
+
+#include "nsXULAppAPI.h"
+
+#include "PSMContentListener.h"
 
 #define NS_IS_PROCESS_DEFAULT                                                 \
     (GeckoProcessType_Default == XRE_GetProcessType())
@@ -219,7 +223,6 @@ NS_GENERIC_FACTORY_CONSTRUCTOR(nsEntropyCollector)
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsSecureBrowserUIImpl)
 NS_GENERIC_FACTORY_CONSTRUCTOR_INIT(CertBlocklist, Init)
 NS_GENERIC_FACTORY_CONSTRUCTOR_INIT(nsSiteSecurityService, Init)
-NS_GENERIC_FACTORY_CONSTRUCTOR(WeakCryptoOverride)
 
 NS_DEFINE_NAMED_CID(NS_NSSCOMPONENT_CID);
 NS_DEFINE_NAMED_CID(NS_SSLSOCKETPROVIDER_CID);
@@ -253,7 +256,6 @@ NS_DEFINE_NAMED_CID(NS_ENTROPYCOLLECTOR_CID);
 NS_DEFINE_NAMED_CID(NS_SECURE_BROWSER_UI_CID);
 NS_DEFINE_NAMED_CID(NS_SITE_SECURITY_SERVICE_CID);
 NS_DEFINE_NAMED_CID(NS_CERT_BLOCKLIST_CID);
-NS_DEFINE_NAMED_CID(NS_WEAKCRYPTOOVERRIDE_CID);
 
 static const mozilla::Module::CIDEntry kNSSCIDs[] = {
   { &kNS_NSSCOMPONENT_CID, false, nullptr, nsNSSComponentConstructor },
@@ -288,7 +290,6 @@ static const mozilla::Module::CIDEntry kNSSCIDs[] = {
   { &kNS_SECURE_BROWSER_UI_CID, false, nullptr, nsSecureBrowserUIImplConstructor },
   { &kNS_SITE_SECURITY_SERVICE_CID, false, nullptr, nsSiteSecurityServiceConstructor },
   { &kNS_CERT_BLOCKLIST_CID, false, nullptr, CertBlocklistConstructor},
-  { &kNS_WEAKCRYPTOOVERRIDE_CID, false, nullptr, WeakCryptoOverrideConstructor },
   { nullptr }
 };
 
@@ -324,7 +325,6 @@ static const mozilla::Module::ContractIDEntry kNSSContracts[] = {
   { NS_SECURE_BROWSER_UI_CONTRACTID, &kNS_SECURE_BROWSER_UI_CID },
   { NS_SSSERVICE_CONTRACTID, &kNS_SITE_SECURITY_SERVICE_CID },
   { NS_CERTBLOCKLIST_CONTRACTID, &kNS_CERT_BLOCKLIST_CID },
-  { NS_WEAKCRYPTOOVERRIDE_CONTRACTID, &kNS_WEAKCRYPTOOVERRIDE_CID },
   { nullptr }
 };
 
diff --git a/security/manager/ssl/nsSecureBrowserUIImpl.cpp b/security/manager/ssl/nsSecureBrowserUIImpl.cpp
index 1aabc02aa5fe..b930be9aded4 100644
--- a/security/manager/ssl/nsSecureBrowserUIImpl.cpp
+++ b/security/manager/ssl/nsSecureBrowserUIImpl.cpp
@@ -31,7 +31,6 @@
 #include "imgIRequest.h"
 #include "nsThreadUtils.h"
 #include "nsNetCID.h"
-#include "nsNetUtil.h"
 #include "nsCRT.h"
 #include "nsIInterfaceRequestorUtils.h"
 #include "nsIProtocolHandler.h"
diff --git a/security/manager/ssl/tests/unit/head_psm.js b/security/manager/ssl/tests/unit/head_psm.js
index 5bb6b1abef17..56022d020bf0 100644
--- a/security/manager/ssl/tests/unit/head_psm.js
+++ b/security/manager/ssl/tests/unit/head_psm.js
@@ -63,7 +63,6 @@ const SEC_ERROR_POLICY_VALIDATION_FAILED                = SEC_ERROR_BASE + 160;
 const SEC_ERROR_OCSP_BAD_SIGNATURE                      = SEC_ERROR_BASE + 157;
 const SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED       = SEC_ERROR_BASE + 176;
 
-const SSL_ERROR_NO_CYPHER_OVERLAP                       = SSL_ERROR_BASE +   2;
 const SSL_ERROR_BAD_CERT_DOMAIN                         = SSL_ERROR_BASE +  12;
 const SSL_ERROR_BAD_CERT_ALERT                          = SSL_ERROR_BASE +  17;
 const SSL_ERROR_WEAK_SERVER_CERT_KEY                    = SSL_ERROR_BASE + 132;
diff --git a/security/manager/ssl/tests/unit/test_weak_crypto.js b/security/manager/ssl/tests/unit/test_weak_crypto.js
deleted file mode 100644
index d93fe7c62130..000000000000
--- a/security/manager/ssl/tests/unit/test_weak_crypto.js
+++ /dev/null
@@ -1,262 +0,0 @@
-/* Any copyright is dedicated to the Public Domain.
-   http://creativecommons.org/publicdomain/zero/1.0/ */
-
-"use strict";
-
-// Tests the weak crypto override
-
-const TLS_RSA_WITH_RC4_128_MD5         = 0x0004;
-const TLS_RSA_WITH_RC4_128_SHA         = 0x0005;
-const TLS_ECDHE_ECDSA_WITH_RC4_128_SHA = 0xC007;
-const TLS_ECDHE_RSA_WITH_RC4_128_SHA   = 0xC011;
-
-// Need profile dir to store the key / cert
-do_get_profile();
-// Ensure PSM is initialized
-Cc["@mozilla.org/psm;1"].getService(Ci.nsISupports);
-
-const certService = Cc["@mozilla.org/security/local-cert-service;1"]
-                    .getService(Ci.nsILocalCertService);
-const certOverrideService = Cc["@mozilla.org/security/certoverride;1"]
-                            .getService(Ci.nsICertOverrideService);
-const weakCryptoOverride = Cc["@mozilla.org/security/weakcryptooverride;1"]
-                           .getService(Ci.nsIWeakCryptoOverride);
-const socketTransportService =
-  Cc["@mozilla.org/network/socket-transport-service;1"]
-  .getService(Ci.nsISocketTransportService);
-
-function getCert() {
-  let deferred = Promise.defer();
-  certService.getOrCreateCert("tls-test", {
-    handleCert: function(c, rv) {
-      if (rv) {
-        deferred.reject(rv);
-        return;
-      }
-      deferred.resolve(c);
-    }
-  });
-  return deferred.promise;
-}
-
-function startServer(cert, rc4only) {
-  let tlsServer = Cc["@mozilla.org/network/tls-server-socket;1"]
-                  .createInstance(Ci.nsITLSServerSocket);
-  tlsServer.init(-1, true, -1);
-  tlsServer.serverCert = cert;
-
-  let input, output;
-
-  let listener = {
-    onSocketAccepted: function(socket, transport) {
-      do_print("Accept TLS client connection");
-      let connectionInfo = transport.securityInfo
-                           .QueryInterface(Ci.nsITLSServerConnectionInfo);
-      connectionInfo.setSecurityObserver(listener);
-      input = transport.openInputStream(0, 0, 0);
-      output = transport.openOutputStream(0, 0, 0);
-    },
-    onHandshakeDone: function(socket, status) {
-      do_print("TLS handshake done");
-
-      equal(status.tlsVersionUsed, Ci.nsITLSClientStatus.TLS_VERSION_1_2,
-            "Using TLS 1.2");
-      let expectedCipher = rc4only ? "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA"
-                                   : "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256";
-      equal(status.cipherName, expectedCipher,
-            "Using expected cipher");
-      equal(status.keyLength, 128, "Using 128-bit key");
-      equal(status.macLength, rc4only ? 160 : 128, "Using MAC of expected length");
-
-      input.asyncWait({
-        onInputStreamReady: function(input) {
-          NetUtil.asyncCopy(input, output);
-        }
-      }, 0, 0, Services.tm.currentThread);
-    },
-    onStopListening: function() {}
-  };
-
-  tlsServer.setSessionCache(false);
-  tlsServer.setSessionTickets(false);
-  tlsServer.setRequestClientCertificate(Ci.nsITLSServerSocket.REQUEST_NEVER);
-  if (rc4only) {
-    let cipherSuites = [
-      TLS_ECDHE_RSA_WITH_RC4_128_SHA,
-      TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
-      TLS_RSA_WITH_RC4_128_SHA,
-      TLS_RSA_WITH_RC4_128_MD5
-    ];
-    tlsServer.setCipherSuites(cipherSuites, cipherSuites.length);
-  }
-
-  tlsServer.asyncListen(listener);
-
-  return tlsServer.port;
-}
-
-function storeCertOverride(port, cert) {
-  let overrideBits = Ci.nsICertOverrideService.ERROR_UNTRUSTED |
-                     Ci.nsICertOverrideService.ERROR_MISMATCH;
-  certOverrideService.rememberValidityOverride("127.0.0.1", port, cert,
-                                               overrideBits, true);
-}
-
-function startClient(port, expectedResult, options = {}) {
-  let SSL_ERROR_BASE = Ci.nsINSSErrorsService.NSS_SSL_ERROR_BASE;
-  let SSL_ERROR_BAD_CERT_ALERT = SSL_ERROR_BASE + 17;
-  let transport =
-    socketTransportService.createTransport(["ssl"], 1, "127.0.0.1", port, null);
-  if (options.isPrivate) {
-    transport.connectionFlags |= Ci.nsISocketTransport.NO_PERMANENT_STORAGE;
-  }
-  let input;
-  let output;
-
-  let inputDeferred = Promise.defer();
-  let outputDeferred = Promise.defer();
-
-  let handler = {
-
-    onTransportStatus: function(transport, status) {
-      if (status === Ci.nsISocketTransport.STATUS_CONNECTED_TO) {
-        output.asyncWait(handler, 0, 0, Services.tm.currentThread);
-      }
-    },
-
-    onInputStreamReady: function(input) {
-      let errorCode = Cr.NS_OK;
-      try {
-        let data = NetUtil.readInputStreamToString(input, input.available());
-        equal(data, "HELLO", "Echoed data received");
-        input.close();
-        output.close();
-      } catch (e) {
-        errorCode = e.result;
-      }
-      try {
-        equal(errorCode, expectedResult,
-              "Actual and expected connection result should match");
-        inputDeferred.resolve();
-      } catch (e) {
-        inputDeferred.reject(e);
-      }
-    },
-
-    onOutputStreamReady: function(output) {
-      try {
-        output.write("HELLO", 5);
-        do_print("Output to server written");
-        outputDeferred.resolve();
-        input = transport.openInputStream(0, 0, 0);
-        input.asyncWait(handler, 0, 0, Services.tm.currentThread);
-      } catch (e) {
-        let errorCode = -1 * (e.result & 0xFFFF);
-        if (errorCode == SSL_ERROR_BAD_CERT_ALERT) {
-          do_print("Server doesn't like client cert");
-        }
-        outputDeferred.reject(e);
-      }
-    }
-
-  };
-
-  transport.setEventSink(handler, Services.tm.currentThread);
-  output = transport.openOutputStream(0, 0, 0);
-
-  return Promise.all([inputDeferred.promise, outputDeferred.promise]);
-}
-
-function run_test() {
-  Services.prefs.setBoolPref("security.tls.unrestricted_rc4_fallback", false);
-  run_next_test();
-}
-
-// for sanity check
-add_task(function*() {
-  let cert = yield getCert();
-  ok(!!cert, "Got self-signed cert");
-  let port = startServer(cert, false);
-  storeCertOverride(port, cert);
-  yield startClient(port, Cr.NS_OK);
-  yield startClient(port, Cr.NS_OK, {isPrivate: true});
-});
-
-add_task(function*() {
-  let cert = yield getCert();
-  ok(!!cert, "Got self-signed cert");
-  let port = startServer(cert, true);
-  storeCertOverride(port, cert);
-  yield startClient(port, getXPCOMStatusFromNSS(SSL_ERROR_NO_CYPHER_OVERLAP));
-  yield startClient(port, getXPCOMStatusFromNSS(SSL_ERROR_NO_CYPHER_OVERLAP),
-                    {isPrivate: true});
-
-  weakCryptoOverride.addWeakCryptoOverride("127.0.0.1", true);
-  // private browsing should not affect the permanent storage.
-  equal(Services.prefs.getCharPref("security.tls.insecure_fallback_hosts"),
-        "");
-  yield startClient(port, getXPCOMStatusFromNSS(SSL_ERROR_NO_CYPHER_OVERLAP));
-  // The auto-retry on connection reset is implemented in our HTTP layer.
-  // So we will see the crafted NS_ERROR_NET_RESET when we use
-  // nsISocketTransport directly.
-  yield startClient(port, Cr.NS_ERROR_NET_RESET, {isPrivate: true});
-  // retry manually to simulate the HTTP layer
-  yield startClient(port, Cr.NS_OK, {isPrivate: true});
-
-  weakCryptoOverride.removeWeakCryptoOverride("127.0.0.1", port, true);
-  equal(Services.prefs.getCharPref("security.tls.insecure_fallback_hosts"),
-        "");
-  yield startClient(port, getXPCOMStatusFromNSS(SSL_ERROR_NO_CYPHER_OVERLAP));
-  yield startClient(port, getXPCOMStatusFromNSS(SSL_ERROR_NO_CYPHER_OVERLAP),
-                    {isPrivate: true});
-
-  weakCryptoOverride.addWeakCryptoOverride("127.0.0.1", false, true);
-  // temporary override should not change the pref.
-  equal(Services.prefs.getCharPref("security.tls.insecure_fallback_hosts"),
-        "");
-  yield startClient(port, Cr.NS_ERROR_NET_RESET);
-  yield startClient(port, Cr.NS_OK);
-  yield startClient(port, getXPCOMStatusFromNSS(SSL_ERROR_NO_CYPHER_OVERLAP),
-                    {isPrivate: true});
-
-  weakCryptoOverride.removeWeakCryptoOverride("127.0.0.1", port, false);
-  equal(Services.prefs.getCharPref("security.tls.insecure_fallback_hosts"),
-        "");
-  yield startClient(port, getXPCOMStatusFromNSS(SSL_ERROR_NO_CYPHER_OVERLAP));
-  yield startClient(port, getXPCOMStatusFromNSS(SSL_ERROR_NO_CYPHER_OVERLAP),
-                    {isPrivate: true});
-
-  weakCryptoOverride.addWeakCryptoOverride("127.0.0.1", false);
-  // permanent override should change the pref.
-  equal(Services.prefs.getCharPref("security.tls.insecure_fallback_hosts"),
-        "127.0.0.1");
-  yield startClient(port, Cr.NS_ERROR_NET_RESET);
-  yield startClient(port, Cr.NS_OK);
-  yield startClient(port, getXPCOMStatusFromNSS(SSL_ERROR_NO_CYPHER_OVERLAP),
-                    {isPrivate: true});
-
-  weakCryptoOverride.removeWeakCryptoOverride("127.0.0.1", port, false);
-  equal(Services.prefs.getCharPref("security.tls.insecure_fallback_hosts"),
-        "");
-  yield startClient(port, getXPCOMStatusFromNSS(SSL_ERROR_NO_CYPHER_OVERLAP));
-  yield startClient(port, getXPCOMStatusFromNSS(SSL_ERROR_NO_CYPHER_OVERLAP),
-                    {isPrivate: true});
-
-  // add a host to the pref to prepare the next test
-  weakCryptoOverride.addWeakCryptoOverride("127.0.0.1", false);
-  yield startClient(port, Cr.NS_ERROR_NET_RESET);
-  yield startClient(port, Cr.NS_OK);
-  equal(Services.prefs.getCharPref("security.tls.insecure_fallback_hosts"),
-        "127.0.0.1");
-});
-
-add_task(function*() {
-  let cert = yield getCert();
-  ok(!!cert, "Got self-signed cert");
-  let port = startServer(cert, false);
-  storeCertOverride(port, cert);
-  yield startClient(port, Cr.NS_OK);
-  // Successful strong cipher will remove the host from the pref.
-  equal(Services.prefs.getCharPref("security.tls.insecure_fallback_hosts"),
-        "");
-});
diff --git a/security/manager/ssl/tests/unit/xpcshell.ini b/security/manager/ssl/tests/unit/xpcshell.ini
index a54b71a56861..b7e0c770fbff 100644
--- a/security/manager/ssl/tests/unit/xpcshell.ini
+++ b/security/manager/ssl/tests/unit/xpcshell.ini
@@ -149,5 +149,3 @@ run-sequentially = hardcoded ports
 run-sequentially = hardcoded ports
 [test_certviewer_invalid_oids.js]
 skip-if = toolkit == 'android' || buildapp == 'b2g'
-
-[test_weak_crypto.js]

From cfcbb3d26171e732d5ab06326fa4e8439d5e17f6 Mon Sep 17 00:00:00 2001
From: "Carsten \"Tomcat\" Book" <cbook@mozilla.com>
Date: Wed, 14 Oct 2015 16:28:59 +0200
Subject: [PATCH 57/63] Backed out changeset 32357df66881 (bug 1168635) for
 Android s4 test failures

---
 netwerk/base/TLSServerSocket.cpp    | 25 -------------------------
 netwerk/base/nsITLSServerSocket.idl | 11 +----------
 2 files changed, 1 insertion(+), 35 deletions(-)

diff --git a/netwerk/base/TLSServerSocket.cpp b/netwerk/base/TLSServerSocket.cpp
index fe94ce6a4e5f..962b0ceab11c 100644
--- a/netwerk/base/TLSServerSocket.cpp
+++ b/netwerk/base/TLSServerSocket.cpp
@@ -222,31 +222,6 @@ TLSServerSocket::SetRequestClientCertificate(uint32_t aMode)
   return NS_OK;
 }
 
-NS_IMETHODIMP
-TLSServerSocket::SetCipherSuites(uint16_t* aCipherSuites, uint32_t aLength)
-{
-  // If AsyncListen was already called (and set mListener), it's too late to set
-  // this.
-  if (NS_WARN_IF(mListener)) {
-    return NS_ERROR_IN_PROGRESS;
-  }
-
-  for (uint16_t i = 0; i < SSL_NumImplementedCiphers; ++i) {
-    uint16_t cipher_id = SSL_ImplementedCiphers[i];
-    if (SSL_CipherPrefSet(mFD, cipher_id, false) != SECSuccess) {
-      return mozilla::psm::GetXPCOMFromNSSError(PR_GetError());
-    }
-  }
-
-  for (uint32_t i = 0; i < aLength; ++i) {
-    if (SSL_CipherPrefSet(mFD, aCipherSuites[i], true) != SECSuccess) {
-      return mozilla::psm::GetXPCOMFromNSSError(PR_GetError());
-    }
-  }
-
-  return NS_OK;
-}
-
 //-----------------------------------------------------------------------------
 // TLSServerConnectionInfo
 //-----------------------------------------------------------------------------
diff --git a/netwerk/base/nsITLSServerSocket.idl b/netwerk/base/nsITLSServerSocket.idl
index 447a14483195..e22596072ba6 100644
--- a/netwerk/base/nsITLSServerSocket.idl
+++ b/netwerk/base/nsITLSServerSocket.idl
@@ -8,7 +8,7 @@ interface nsIX509Cert;
 interface nsITLSServerSecurityObserver;
 interface nsISocketTransport;
 
-[scriptable, uuid(cc2c30f9-cfaa-4b8a-bd44-c24881981b74)]
+[scriptable, uuid(2e025b6c-96ba-4781-85fb-d1cf1a653207)]
 interface nsITLSServerSocket : nsIServerSocket
 {
   /**
@@ -60,15 +60,6 @@ interface nsITLSServerSocket : nsIServerSocket
    * change the default.
    */
   void setRequestClientCertificate(in unsigned long aRequestClientCert);
-
-  /**
-   * setCipherSuites
-   *
-   * The server's cipher suites that is used by the TLS handshake.
-   * This is required to be set before calling |asyncListen|.
-   */
-  void setCipherSuites([array, size_is(aLength)] in unsigned short aCipherSuites,
-                       in unsigned long aLength);
 };
 
 /**

From 6acbffcfa543f073cadaf43969dd20a0d41e2e8d Mon Sep 17 00:00:00 2001
From: Rail Aliiev <rail@mozilla.com>
Date: Wed, 14 Oct 2015 10:42:29 -0400
Subject: [PATCH 58/63] Bug 1184089 - L10N nightly repacks should not
 manipulate mozconfigs. r=Callek DONTBUILD

---
 testing/mozharness/configs/merge_day/aurora_to_beta.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/testing/mozharness/configs/merge_day/aurora_to_beta.py b/testing/mozharness/configs/merge_day/aurora_to_beta.py
index 3b20555b2683..af9923bd0a10 100644
--- a/testing/mozharness/configs/merge_day/aurora_to_beta.py
+++ b/testing/mozharness/configs/merge_day/aurora_to_beta.py
@@ -28,7 +28,8 @@ config = {
         for f in ["debug", "nightly"]
     ] + [
         # File, from, to
-        (f, "ac_add_options --with-branding=browser/branding/aurora", "")
+        (f, "ac_add_options --with-branding=browser/branding/aurora",
+         "ac_add_options --enable-official-branding")
         for f in ["browser/config/mozconfigs/linux32/l10n-mozconfig",
                   "browser/config/mozconfigs/linux64/l10n-mozconfig",
                   "browser/config/mozconfigs/win32/l10n-mozconfig",

From d7e5ec0950221272972bd9dae70bd419652c3f05 Mon Sep 17 00:00:00 2001
From: Bas Schouten <bschouten@mozilla.com>
Date: Wed, 14 Oct 2015 17:00:42 +0200
Subject: [PATCH 59/63] Bug 1211615: Upload the full texture on the first
 upload for component alpha textures. r=nical

---
 gfx/layers/composite/TextureHost.cpp | 7 ++++++-
 gfx/layers/d3d9/TextureD3D9.cpp      | 7 ++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/gfx/layers/composite/TextureHost.cpp b/gfx/layers/composite/TextureHost.cpp
index da83349c3fcb..e086cb964a70 100644
--- a/gfx/layers/composite/TextureHost.cpp
+++ b/gfx/layers/composite/TextureHost.cpp
@@ -598,8 +598,13 @@ BufferTextureHost::Upload(nsIntRegion *aRegion)
     }
   } else {
     // non-YCbCr case
+    nsIntRegion* regionToUpdate = aRegion;
     if (!mFirstSource) {
       mFirstSource = mCompositor->CreateDataTextureSource(mFlags);
+      if (mFlags & TextureFlags::COMPONENT_ALPHA) {
+        // Update the full region the first time for component alpha textures.
+        regionToUpdate = nullptr;
+      }
     }
     ImageDataDeserializer deserializer(GetBuffer(), GetBufferSize());
     if (!deserializer.IsValid()) {
@@ -612,7 +617,7 @@ BufferTextureHost::Upload(nsIntRegion *aRegion)
       return false;
     }
 
-    if (!mFirstSource->Update(surf.get(), aRegion)) {
+    if (!mFirstSource->Update(surf.get(), regionToUpdate)) {
       NS_WARNING("failed to update the DataTextureSource");
       return false;
     }
diff --git a/gfx/layers/d3d9/TextureD3D9.cpp b/gfx/layers/d3d9/TextureD3D9.cpp
index e3b198ce6a6c..004b97520dd9 100644
--- a/gfx/layers/d3d9/TextureD3D9.cpp
+++ b/gfx/layers/d3d9/TextureD3D9.cpp
@@ -860,12 +860,17 @@ TextureHostD3D9::UpdatedInternal(const nsIntRegion* aRegion)
     return;
   }
 
+  const nsIntRegion* regionToUpdate = aRegion;
   if (!mTextureSource) {
     mTextureSource = new DataTextureSourceD3D9(mFormat, mSize, mCompositor,
                                                nullptr, mFlags);
+    if (mFlags & TextureFlags::COMPONENT_ALPHA) {
+      // Update the full region the first time for component alpha textures.
+      regionToUpdate = nullptr;
+    }
   }
 
-  if (!mTextureSource->UpdateFromTexture(mTexture, aRegion)) {
+  if (!mTextureSource->UpdateFromTexture(mTexture, regionToUpdate)) {
     gfxCriticalError() << "[D3D9] DataTextureSourceD3D9::UpdateFromTexture failed";
   }
 }

From 04e870501203d0b7cd7fff7affc890aec8686478 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Wed, 14 Oct 2015 11:07:06 -0400
Subject: [PATCH 60/63] Backing out changeset f6759ed53f46 (bug 799937) due to
 causing extension breakage.

---
 dom/base/nsDocument.cpp                       |  2 -
 dom/base/test/test_XHRSendData.html           |  2 +-
 dom/base/test/unit/test_xml_serializer.js     |  2 +-
 dom/html/nsHTMLDocument.cpp                   |  1 +
 .../dom/nodes/test_Node-properties.html.json  |  4 +-
 ...test_Document-createElement-namespace.html |  6 +-
 .../share-registry-create-document.html.ini   |  5 ++
 .../dom/nodes/Document-constructor.html.ini   |  5 ++
 .../Document-createElement-namespace.html.ini | 74 -------------------
 .../meta/dom/nodes/Node-properties.html.ini   |  8 ++
 10 files changed, 29 insertions(+), 80 deletions(-)
 create mode 100644 testing/web-platform/meta/custom-elements/creating-and-passing-registries/share-registry-create-document.html.ini
 create mode 100644 testing/web-platform/meta/dom/nodes/Document-constructor.html.ini
 delete mode 100644 testing/web-platform/meta/dom/nodes/Document-createElement-namespace.html.ini
 create mode 100644 testing/web-platform/meta/dom/nodes/Node-properties.html.ini

diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
index 6306b89fc10a..1ae96d223c71 100644
--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -1550,8 +1550,6 @@ nsDocument::nsDocument(const char* aContentType)
   , mAnimatingImages(true)
   , mViewportType(Unknown)
 {
-  mDefaultElementType = kNameSpaceID_XHTML;
-
   SetContentTypeInternal(nsDependentCString(aContentType));
 
   if (!gDocumentLeakPRLog)
diff --git a/dom/base/test/test_XHRSendData.html b/dom/base/test/test_XHRSendData.html
index 2274643202c3..05e0b4f49c2e 100644
--- a/dom/base/test/test_XHRSendData.html
+++ b/dom/base/test/test_XHRSendData.html
@@ -34,7 +34,7 @@ is(testDoc1.inputEncoding, "windows-1252", "wrong encoding");
 
 testDoc2 = document.implementation.createDocument("", "", null);
 testDoc2.appendChild(testDoc2.createComment(" doc 2 "));
-testDoc2.appendChild(testDoc2.createElementNS(null, "res"));
+testDoc2.appendChild(testDoc2.createElement("res"));
 testDoc2.documentElement.appendChild(testDoc2.createTextNode("text"));
 is(testDoc2.inputEncoding, "UTF-8", "wrong encoding");
 
diff --git a/dom/base/test/unit/test_xml_serializer.js b/dom/base/test/unit/test_xml_serializer.js
index 267fd9c8117a..c74d067a8115 100644
--- a/dom/base/test/unit/test_xml_serializer.js
+++ b/dom/base/test/unit/test_xml_serializer.js
@@ -175,7 +175,7 @@ function test5() {
   // Handling of kids in the null namespace when the default is a
   // different namespace (bug 301260).
   var doc = ParseXML('<root xmlns="ns1"/>')
-  var child = doc.createElementNS(null, 'child');
+  var child = doc.createElement('child');
   doc.documentElement.appendChild(child);
   do_check_serialize(doc);
   do_check_eq(SerializeXML(doc),
diff --git a/dom/html/nsHTMLDocument.cpp b/dom/html/nsHTMLDocument.cpp
index 87cf1379d70c..7bb56d898df9 100644
--- a/dom/html/nsHTMLDocument.cpp
+++ b/dom/html/nsHTMLDocument.cpp
@@ -176,6 +176,7 @@ nsHTMLDocument::nsHTMLDocument()
   // bother initializing members to 0.
 
   mType = eHTML;
+  mDefaultElementType = kNameSpaceID_XHTML;
   mCompatMode = eCompatibility_NavQuirks;
 }
 
diff --git a/dom/imptests/failures/html/dom/nodes/test_Node-properties.html.json b/dom/imptests/failures/html/dom/nodes/test_Node-properties.html.json
index 272c5e890a5a..8c7b35264d9f 100644
--- a/dom/imptests/failures/html/dom/nodes/test_Node-properties.html.json
+++ b/dom/imptests/failures/html/dom/nodes/test_Node-properties.html.json
@@ -1,5 +1,7 @@
 {
   "document.characterSet": true,
   "foreignDoc.characterSet": true,
-  "xmlDoc.characterSet": true
+  "xmlDoc.characterSet": true,
+  "xmlElement.namespaceURI": true,
+  "detachedXmlElement.namespaceURI": true
 }
diff --git a/dom/imptests/html/dom/nodes/test_Document-createElement-namespace.html b/dom/imptests/html/dom/nodes/test_Document-createElement-namespace.html
index c9f1a33eaf36..4898eeabc813 100644
--- a/dom/imptests/html/dom/nodes/test_Document-createElement-namespace.html
+++ b/dom/imptests/html/dom/nodes/test_Document-createElement-namespace.html
@@ -24,7 +24,11 @@ function testDoc(doc, contentType) {
                   "Wrong MIME type -- incorrect server config?");
   }
 
-  assert_equals(doc.createElement("x").namespaceURI, "http://www.w3.org/1999/xhtml");
+  var expectedNamespace = contentType == "text/html" ||
+                          contentType == "application/xhtml+xml"
+                          ? "http://www.w3.org/1999/xhtml" : null;
+
+  assert_equals(doc.createElement("x").namespaceURI, expectedNamespace);
 }
 
 // First test various objects we create in JS
diff --git a/testing/web-platform/meta/custom-elements/creating-and-passing-registries/share-registry-create-document.html.ini b/testing/web-platform/meta/custom-elements/creating-and-passing-registries/share-registry-create-document.html.ini
new file mode 100644
index 000000000000..482a2a2df574
--- /dev/null
+++ b/testing/web-platform/meta/custom-elements/creating-and-passing-registries/share-registry-create-document.html.ini
@@ -0,0 +1,5 @@
+[share-registry-create-document.html]
+  type: testharness
+  [Document created by createDocument with HTML namespace should share an existing registry]
+    expected: FAIL
+
diff --git a/testing/web-platform/meta/dom/nodes/Document-constructor.html.ini b/testing/web-platform/meta/dom/nodes/Document-constructor.html.ini
new file mode 100644
index 000000000000..d86bc27bc9a0
--- /dev/null
+++ b/testing/web-platform/meta/dom/nodes/Document-constructor.html.ini
@@ -0,0 +1,5 @@
+[Document-constructor.html]
+  type: testharness
+  [new Document(): URL parsing]
+    expected: FAIL
+
diff --git a/testing/web-platform/meta/dom/nodes/Document-createElement-namespace.html.ini b/testing/web-platform/meta/dom/nodes/Document-createElement-namespace.html.ini
deleted file mode 100644
index 9647b1f7331e..000000000000
--- a/testing/web-platform/meta/dom/nodes/Document-createElement-namespace.html.ini
+++ /dev/null
@@ -1,74 +0,0 @@
-[Document-createElement-namespace.html]
-  type: testharness
-  [Created element's namespace in created XML document]
-    expected: FAIL
-
-  [Created element's namespace in created XHTML document]
-    expected: FAIL
-
-  [Created element's namespace in created SVG document]
-    expected: FAIL
-
-  [Created element's namespace in created MathML document]
-    expected: FAIL
-
-  [Created element's namespace in empty.xml]
-    expected: FAIL
-
-  [Created element's namespace in empty.svg]
-    expected: FAIL
-
-  [Created element's namespace in minimal_html.xml]
-    expected: FAIL
-
-  [Created element's namespace in minimal_html.svg]
-    expected: FAIL
-
-  [Created element's namespace in xhtml.xml]
-    expected: FAIL
-
-  [Created element's namespace in xhtml.svg]
-    expected: FAIL
-
-  [Created element's namespace in svg.xml]
-    expected: FAIL
-
-  [Created element's namespace in svg.svg]
-    expected: FAIL
-
-  [Created element's namespace in mathml.xml]
-    expected: FAIL
-
-  [Created element's namespace in mathml.svg]
-    expected: FAIL
-
-  [Created element's namespace in bare_xhtml.xml]
-    expected: FAIL
-
-  [Created element's namespace in bare_xhtml.svg]
-    expected: FAIL
-
-  [Created element's namespace in bare_svg.xml]
-    expected: FAIL
-
-  [Created element's namespace in bare_svg.svg]
-    expected: FAIL
-
-  [Created element's namespace in bare_mathml.xml]
-    expected: FAIL
-
-  [Created element's namespace in bare_mathml.svg]
-    expected: FAIL
-
-  [Created element's namespace in xhtml_ns_removed.xml]
-    expected: FAIL
-
-  [Created element's namespace in xhtml_ns_removed.svg]
-    expected: FAIL
-
-  [Created element's namespace in xhtml_ns_changed.xml]
-    expected: FAIL
-
-  [Created element's namespace in xhtml_ns_changed.svg]
-    expected: FAIL
-
diff --git a/testing/web-platform/meta/dom/nodes/Node-properties.html.ini b/testing/web-platform/meta/dom/nodes/Node-properties.html.ini
new file mode 100644
index 000000000000..2e1731cc21b4
--- /dev/null
+++ b/testing/web-platform/meta/dom/nodes/Node-properties.html.ini
@@ -0,0 +1,8 @@
+[Node-properties.html]
+  type: testharness
+  [xmlElement.namespaceURI]
+    expected: FAIL
+
+  [detachedXmlElement.namespaceURI]
+    expected: FAIL
+

From 71bb23b14d69c04992e75b77f4941e51017ae108 Mon Sep 17 00:00:00 2001
From: Marco Bonardo <mbonardo@mozilla.com>
Date: Wed, 14 Oct 2015 18:49:19 +0200
Subject: [PATCH 61/63] Bug 1206488 - Unable to get URL of a livemark from a
 bookmarks tree. r=gijs

---
 toolkit/components/places/PlacesUtils.jsm | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/toolkit/components/places/PlacesUtils.jsm b/toolkit/components/places/PlacesUtils.jsm
index 63d091d5bb26..90e5afed84aa 100644
--- a/toolkit/components/places/PlacesUtils.jsm
+++ b/toolkit/components/places/PlacesUtils.jsm
@@ -581,11 +581,11 @@ this.PlacesUtils = {
       if (PlacesUtils.nodeIsFolder(node) &&
           node.type != Ci.nsINavHistoryResultNode.RESULT_TYPE_FOLDER_SHORTCUT &&
           asQuery(node).queryOptions.excludeItems) {
-        let node = PlacesUtils.getFolderContents(node.itemId, false, true).root;
+        let folderRoot = PlacesUtils.getFolderContents(node.itemId, false, true).root;
         try {
-          return gatherDataFunc(node);
+          return gatherDataFunc(folderRoot);
         } finally {
-          node.containerOpen = false;
+          folderRoot.containerOpen = false;
         }
       }
       // If we didn't create our own query, do not alter the node's state.

From c647f9c6b1ce9f1043be3543e8f0ced814c260be Mon Sep 17 00:00:00 2001
From: Marco Bonardo <mbonardo@mozilla.com>
Date: Wed, 14 Oct 2015 18:49:23 +0200
Subject: [PATCH 62/63] Bug 1190350 - Bookmarks sidebar displays regular folder
 icons for livemarks. r=gijs

---
 browser/components/places/content/treeView.js | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/browser/components/places/content/treeView.js b/browser/components/places/content/treeView.js
index 4cd6bb8eff61..6c027b468056 100644
--- a/browser/components/places/content/treeView.js
+++ b/browser/components/places/content/treeView.js
@@ -178,8 +178,9 @@ PlacesTreeView.prototype = {
 
     let row = -1;
     let useNodeIndex = typeof(aNodeIndex) == "number";
-    if (parent == this._rootNode)
+    if (parent == this._rootNode) {
       row = useNodeIndex ? aNodeIndex : this._rootNode.getChildIndex(aNode);
+    }
     else if (useNodeIndex && typeof(aParentRow) == "number") {
       // If we have both the row of the parent node, and the node's index, we
       // can avoid searching the rows array if the parent is a plain container.
@@ -855,8 +856,7 @@ PlacesTreeView.prototype = {
         .then(aLivemark => {
           this._controller.cacheLivemarkInfo(aNode, aLivemark);
           let properties = this._cellProperties.get(aNode);
-          this._cellProperties.set(aNode, properties += " livemark ");
-
+          this._cellProperties.set(aNode, properties += " livemark");
           // The livemark attribute is set as a cell property on the title cell.
           this._invalidateCellValue(aNode, this.COLUMN_TYPE_TITLE);
         }, Components.utils.reportError);
@@ -1175,7 +1175,8 @@ PlacesTreeView.prototype = {
             PlacesUtils.livemarks.getLivemark({ id: node.itemId })
               .then(aLivemark => {
                 this._controller.cacheLivemarkInfo(node, aLivemark);
-                properties += " livemark";
+                let props = this._cellProperties.get(node);
+                this._cellProperties.set(node, props += " livemark");
                 // The livemark attribute is set as a cell property on the title cell.
                 this._invalidateCellValue(node, this.COLUMN_TYPE_TITLE);
               }, () => undefined);

From cd1103e7d01a33f89f38303053b3af807fe1c486 Mon Sep 17 00:00:00 2001
From: Jordan Santell <jsantell@mozilla.com>
Date: Thu, 8 Oct 2015 18:08:09 -0700
Subject: [PATCH 63/63] Bug 1213138 - Add react-redux library to developer
 tools. r=gerv

---
 .../client/shared/vendor/REACT_REDUX_LICENSE  |  21 +
 .../shared/vendor/REACT_REDUX_UPGRADING       |   9 +
 devtools/client/shared/vendor/moz.build       |   1 +
 devtools/client/shared/vendor/react-redux.js  | 724 ++++++++++++++++++
 toolkit/content/license.html                  |  29 +
 5 files changed, 784 insertions(+)
 create mode 100644 devtools/client/shared/vendor/REACT_REDUX_LICENSE
 create mode 100644 devtools/client/shared/vendor/REACT_REDUX_UPGRADING
 create mode 100644 devtools/client/shared/vendor/react-redux.js

diff --git a/devtools/client/shared/vendor/REACT_REDUX_LICENSE b/devtools/client/shared/vendor/REACT_REDUX_LICENSE
new file mode 100644
index 000000000000..af2353dca4ed
--- /dev/null
+++ b/devtools/client/shared/vendor/REACT_REDUX_LICENSE
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2015 Dan Abramov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/devtools/client/shared/vendor/REACT_REDUX_UPGRADING b/devtools/client/shared/vendor/REACT_REDUX_UPGRADING
new file mode 100644
index 000000000000..7739751dbe23
--- /dev/null
+++ b/devtools/client/shared/vendor/REACT_REDUX_UPGRADING
@@ -0,0 +1,9 @@
+"react-redux" uses UMD style loading to work in many different environments.
+It assumes that "react" and "redux" are both included via `require("react")`
+as in node or browserify, but the paths to our react and redux installation are different.
+
+If upgrading react-redux, define the correct paths and replace the require statements
+for the module.exports case with the correct paths.
+
+Path to react: "devtools/client/shared/vendor/react"
+Path to redux: "devtools/client/shared/vendor/redux"
diff --git a/devtools/client/shared/vendor/moz.build b/devtools/client/shared/vendor/moz.build
index 4995bc32f8fb..1a0c240401c6 100644
--- a/devtools/client/shared/vendor/moz.build
+++ b/devtools/client/shared/vendor/moz.build
@@ -12,6 +12,7 @@ if CONFIG['DEBUG_JS_MODULES']:
     ]
 
 modules += [
+    'react-redux.js',
     'react.js',
     'redux.js',
 ]
diff --git a/devtools/client/shared/vendor/react-redux.js b/devtools/client/shared/vendor/react-redux.js
new file mode 100644
index 000000000000..562f4916f210
--- /dev/null
+++ b/devtools/client/shared/vendor/react-redux.js
@@ -0,0 +1,724 @@
+var REACT_PATH = "devtools/client/shared/vendor/react";
+var REDUX_PATH = "devtools/client/shared/vendor/redux";
+
+(function webpackUniversalModuleDefinition(root, factory) {
+	if(typeof exports === 'object' && typeof module === 'object')
+		module.exports = factory(require(REACT_PATH), require(REDUX_PATH));
+	else if(typeof define === 'function' && define.amd)
+		define(["react", "redux"], factory);
+	else if(typeof exports === 'object')
+		exports["ReactRedux"] = factory(require("react"), require("redux"));
+	else
+		root["ReactRedux"] = factory(root["React"], root["Redux"]);
+})(this, function(__WEBPACK_EXTERNAL_MODULE_10__, __WEBPACK_EXTERNAL_MODULE_11__) {
+return /******/ (function(modules) { // webpackBootstrap
+/******/ 	// The module cache
+/******/ 	var installedModules = {};
+
+/******/ 	// The require function
+/******/ 	function __webpack_require__(moduleId) {
+
+/******/ 		// Check if module is in cache
+/******/ 		if(installedModules[moduleId])
+/******/ 			return installedModules[moduleId].exports;
+
+/******/ 		// Create a new module (and put it into the cache)
+/******/ 		var module = installedModules[moduleId] = {
+/******/ 			exports: {},
+/******/ 			id: moduleId,
+/******/ 			loaded: false
+/******/ 		};
+
+/******/ 		// Execute the module function
+/******/ 		modules[moduleId].call(module.exports, module, module.exports, __webpack_require__);
+
+/******/ 		// Flag the module as loaded
+/******/ 		module.loaded = true;
+
+/******/ 		// Return the exports of the module
+/******/ 		return module.exports;
+/******/ 	}
+
+
+/******/ 	// expose the modules object (__webpack_modules__)
+/******/ 	__webpack_require__.m = modules;
+
+/******/ 	// expose the module cache
+/******/ 	__webpack_require__.c = installedModules;
+
+/******/ 	// __webpack_public_path__
+/******/ 	__webpack_require__.p = "";
+
+/******/ 	// Load entry module and return exports
+/******/ 	return __webpack_require__(0);
+/******/ })
+/************************************************************************/
+/******/ ([
+/* 0 */
+/***/ function(module, exports, __webpack_require__) {
+
+	'use strict';
+
+	exports.__esModule = true;
+
+	function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { 'default': obj }; }
+
+	var _react = __webpack_require__(10);
+
+	var _react2 = _interopRequireDefault(_react);
+
+	var _componentsCreateAll = __webpack_require__(2);
+
+	var _componentsCreateAll2 = _interopRequireDefault(_componentsCreateAll);
+
+	var _createAll = _componentsCreateAll2['default'](_react2['default']);
+
+	var Provider = _createAll.Provider;
+	var connect = _createAll.connect;
+	exports.Provider = Provider;
+	exports.connect = connect;
+
+/***/ },
+/* 1 */
+/***/ function(module, exports) {
+
+	"use strict";
+
+	exports.__esModule = true;
+	exports["default"] = createStoreShape;
+
+	function createStoreShape(PropTypes) {
+	  return PropTypes.shape({
+	    subscribe: PropTypes.func.isRequired,
+	    dispatch: PropTypes.func.isRequired,
+	    getState: PropTypes.func.isRequired
+	  });
+	}
+
+	module.exports = exports["default"];
+
+/***/ },
+/* 2 */
+/***/ function(module, exports, __webpack_require__) {
+
+	'use strict';
+
+	exports.__esModule = true;
+	exports['default'] = createAll;
+
+	function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { 'default': obj }; }
+
+	var _createProvider = __webpack_require__(4);
+
+	var _createProvider2 = _interopRequireDefault(_createProvider);
+
+	var _createConnect = __webpack_require__(3);
+
+	var _createConnect2 = _interopRequireDefault(_createConnect);
+
+	function createAll(React) {
+	  var Provider = _createProvider2['default'](React);
+	  var connect = _createConnect2['default'](React);
+
+	  return { Provider: Provider, connect: connect };
+	}
+
+	module.exports = exports['default'];
+
+/***/ },
+/* 3 */
+/***/ function(module, exports, __webpack_require__) {
+
+	'use strict';
+
+	exports.__esModule = true;
+
+	var _extends = Object.assign || function (target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i]; for (var key in source) { if (Object.prototype.hasOwnProperty.call(source, key)) { target[key] = source[key]; } } } return target; };
+
+	exports['default'] = createConnect;
+
+	function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { 'default': obj }; }
+
+	function _classCallCheck(instance, Constructor) { if (!(instance instanceof Constructor)) { throw new TypeError('Cannot call a class as a function'); } }
+
+	function _inherits(subClass, superClass) { if (typeof superClass !== 'function' && superClass !== null) { throw new TypeError('Super expression must either be null or a function, not ' + typeof superClass); } subClass.prototype = Object.create(superClass && superClass.prototype, { constructor: { value: subClass, enumerable: false, writable: true, configurable: true } }); if (superClass) Object.setPrototypeOf ? Object.setPrototypeOf(subClass, superClass) : subClass.__proto__ = superClass; }
+
+	var _utilsCreateStoreShape = __webpack_require__(1);
+
+	var _utilsCreateStoreShape2 = _interopRequireDefault(_utilsCreateStoreShape);
+
+	var _utilsShallowEqual = __webpack_require__(6);
+
+	var _utilsShallowEqual2 = _interopRequireDefault(_utilsShallowEqual);
+
+	var _utilsIsPlainObject = __webpack_require__(5);
+
+	var _utilsIsPlainObject2 = _interopRequireDefault(_utilsIsPlainObject);
+
+	var _utilsWrapActionCreators = __webpack_require__(7);
+
+	var _utilsWrapActionCreators2 = _interopRequireDefault(_utilsWrapActionCreators);
+
+	var _hoistNonReactStatics = __webpack_require__(8);
+
+	var _hoistNonReactStatics2 = _interopRequireDefault(_hoistNonReactStatics);
+
+	var _invariant = __webpack_require__(9);
+
+	var _invariant2 = _interopRequireDefault(_invariant);
+
+	var defaultMapStateToProps = function defaultMapStateToProps() {
+	  return {};
+	};
+	var defaultMapDispatchToProps = function defaultMapDispatchToProps(dispatch) {
+	  return { dispatch: dispatch };
+	};
+	var defaultMergeProps = function defaultMergeProps(stateProps, dispatchProps, parentProps) {
+	  return _extends({}, parentProps, stateProps, dispatchProps);
+	};
+
+	function getDisplayName(Component) {
+	  return Component.displayName || Component.name || 'Component';
+	}
+
+	// Helps track hot reloading.
+	var nextVersion = 0;
+
+	function createConnect(React) {
+	  var Component = React.Component;
+	  var PropTypes = React.PropTypes;
+
+	  var storeShape = _utilsCreateStoreShape2['default'](PropTypes);
+
+	  return function connect(mapStateToProps, mapDispatchToProps, mergeProps) {
+	    var options = arguments.length <= 3 || arguments[3] === undefined ? {} : arguments[3];
+
+	    var shouldSubscribe = Boolean(mapStateToProps);
+	    var finalMapStateToProps = mapStateToProps || defaultMapStateToProps;
+	    var finalMapDispatchToProps = _utilsIsPlainObject2['default'](mapDispatchToProps) ? _utilsWrapActionCreators2['default'](mapDispatchToProps) : mapDispatchToProps || defaultMapDispatchToProps;
+	    var finalMergeProps = mergeProps || defaultMergeProps;
+	    var shouldUpdateStateProps = finalMapStateToProps.length > 1;
+	    var shouldUpdateDispatchProps = finalMapDispatchToProps.length > 1;
+	    var _options$pure = options.pure;
+	    var pure = _options$pure === undefined ? true : _options$pure;
+
+	    // Helps track hot reloading.
+	    var version = nextVersion++;
+
+	    function computeStateProps(store, props) {
+	      var state = store.getState();
+	      var stateProps = shouldUpdateStateProps ? finalMapStateToProps(state, props) : finalMapStateToProps(state);
+
+	      _invariant2['default'](_utilsIsPlainObject2['default'](stateProps), '`mapStateToProps` must return an object. Instead received %s.', stateProps);
+	      return stateProps;
+	    }
+
+	    function computeDispatchProps(store, props) {
+	      var dispatch = store.dispatch;
+
+	      var dispatchProps = shouldUpdateDispatchProps ? finalMapDispatchToProps(dispatch, props) : finalMapDispatchToProps(dispatch);
+
+	      _invariant2['default'](_utilsIsPlainObject2['default'](dispatchProps), '`mapDispatchToProps` must return an object. Instead received %s.', dispatchProps);
+	      return dispatchProps;
+	    }
+
+	    function _computeNextState(stateProps, dispatchProps, parentProps) {
+	      var mergedProps = finalMergeProps(stateProps, dispatchProps, parentProps);
+	      _invariant2['default'](_utilsIsPlainObject2['default'](mergedProps), '`mergeProps` must return an object. Instead received %s.', mergedProps);
+	      return mergedProps;
+	    }
+
+	    return function wrapWithConnect(WrappedComponent) {
+	      var Connect = (function (_Component) {
+	        _inherits(Connect, _Component);
+
+	        Connect.prototype.shouldComponentUpdate = function shouldComponentUpdate(nextProps, nextState) {
+	          if (!pure) {
+	            this.updateStateProps(nextProps);
+	            this.updateDispatchProps(nextProps);
+	            this.updateState(nextProps);
+	            return true;
+	          }
+
+	          var storeChanged = nextState.storeState !== this.state.storeState;
+	          var propsChanged = !_utilsShallowEqual2['default'](nextProps, this.props);
+	          var mapStateProducedChange = false;
+	          var dispatchPropsChanged = false;
+
+	          if (storeChanged || propsChanged && shouldUpdateStateProps) {
+	            mapStateProducedChange = this.updateStateProps(nextProps);
+	          }
+
+	          if (propsChanged && shouldUpdateDispatchProps) {
+	            dispatchPropsChanged = this.updateDispatchProps(nextProps);
+	          }
+
+	          if (propsChanged || mapStateProducedChange || dispatchPropsChanged) {
+	            this.updateState(nextProps);
+	            return true;
+	          }
+
+	          return false;
+	        };
+
+	        function Connect(props, context) {
+	          _classCallCheck(this, Connect);
+
+	          _Component.call(this, props, context);
+	          this.version = version;
+	          this.store = props.store || context.store;
+
+	          _invariant2['default'](this.store, 'Could not find "store" in either the context or ' + ('props of "' + this.constructor.displayName + '". ') + 'Either wrap the root component in a <Provider>, ' + ('or explicitly pass "store" as a prop to "' + this.constructor.displayName + '".'));
+
+	          this.stateProps = computeStateProps(this.store, props);
+	          this.dispatchProps = computeDispatchProps(this.store, props);
+	          this.state = { storeState: null };
+	          this.updateState();
+	        }
+
+	        Connect.prototype.computeNextState = function computeNextState() {
+	          var props = arguments.length <= 0 || arguments[0] === undefined ? this.props : arguments[0];
+
+	          return _computeNextState(this.stateProps, this.dispatchProps, props);
+	        };
+
+	        Connect.prototype.updateStateProps = function updateStateProps() {
+	          var props = arguments.length <= 0 || arguments[0] === undefined ? this.props : arguments[0];
+
+	          var nextStateProps = computeStateProps(this.store, props);
+	          if (_utilsShallowEqual2['default'](nextStateProps, this.stateProps)) {
+	            return false;
+	          }
+
+	          this.stateProps = nextStateProps;
+	          return true;
+	        };
+
+	        Connect.prototype.updateDispatchProps = function updateDispatchProps() {
+	          var props = arguments.length <= 0 || arguments[0] === undefined ? this.props : arguments[0];
+
+	          var nextDispatchProps = computeDispatchProps(this.store, props);
+	          if (_utilsShallowEqual2['default'](nextDispatchProps, this.dispatchProps)) {
+	            return false;
+	          }
+
+	          this.dispatchProps = nextDispatchProps;
+	          return true;
+	        };
+
+	        Connect.prototype.updateState = function updateState() {
+	          var props = arguments.length <= 0 || arguments[0] === undefined ? this.props : arguments[0];
+
+	          this.nextState = this.computeNextState(props);
+	        };
+
+	        Connect.prototype.isSubscribed = function isSubscribed() {
+	          return typeof this.unsubscribe === 'function';
+	        };
+
+	        Connect.prototype.trySubscribe = function trySubscribe() {
+	          if (shouldSubscribe && !this.unsubscribe) {
+	            this.unsubscribe = this.store.subscribe(this.handleChange.bind(this));
+	            this.handleChange();
+	          }
+	        };
+
+	        Connect.prototype.tryUnsubscribe = function tryUnsubscribe() {
+	          if (this.unsubscribe) {
+	            this.unsubscribe();
+	            this.unsubscribe = null;
+	          }
+	        };
+
+	        Connect.prototype.componentDidMount = function componentDidMount() {
+	          this.trySubscribe();
+	        };
+
+	        Connect.prototype.componentWillUnmount = function componentWillUnmount() {
+	          this.tryUnsubscribe();
+	        };
+
+	        Connect.prototype.handleChange = function handleChange() {
+	          if (!this.unsubscribe) {
+	            return;
+	          }
+
+	          this.setState({
+	            storeState: this.store.getState()
+	          });
+	        };
+
+	        Connect.prototype.getWrappedInstance = function getWrappedInstance() {
+	          return this.refs.wrappedInstance;
+	        };
+
+	        Connect.prototype.render = function render() {
+	          return React.createElement(WrappedComponent, _extends({ ref: 'wrappedInstance'
+	          }, this.nextState));
+	        };
+
+	        return Connect;
+	      })(Component);
+
+	      Connect.displayName = 'Connect(' + getDisplayName(WrappedComponent) + ')';
+	      Connect.WrappedComponent = WrappedComponent;
+	      Connect.contextTypes = {
+	        store: storeShape
+	      };
+	      Connect.propTypes = {
+	        store: storeShape
+	      };
+
+	      if (true) {
+	        Connect.prototype.componentWillUpdate = function componentWillUpdate() {
+	          if (this.version === version) {
+	            return;
+	          }
+
+	          // We are hot reloading!
+	          this.version = version;
+
+	          // Update the state and bindings.
+	          this.trySubscribe();
+	          this.updateStateProps();
+	          this.updateDispatchProps();
+	          this.updateState();
+	        };
+	      }
+
+	      return _hoistNonReactStatics2['default'](Connect, WrappedComponent);
+	    };
+	  };
+	}
+
+	module.exports = exports['default'];
+
+/***/ },
+/* 4 */
+/***/ function(module, exports, __webpack_require__) {
+
+	'use strict';
+
+	exports.__esModule = true;
+	exports['default'] = createProvider;
+
+	function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { 'default': obj }; }
+
+	function _classCallCheck(instance, Constructor) { if (!(instance instanceof Constructor)) { throw new TypeError('Cannot call a class as a function'); } }
+
+	function _inherits(subClass, superClass) { if (typeof superClass !== 'function' && superClass !== null) { throw new TypeError('Super expression must either be null or a function, not ' + typeof superClass); } subClass.prototype = Object.create(superClass && superClass.prototype, { constructor: { value: subClass, enumerable: false, writable: true, configurable: true } }); if (superClass) Object.setPrototypeOf ? Object.setPrototypeOf(subClass, superClass) : subClass.__proto__ = superClass; }
+
+	var _utilsCreateStoreShape = __webpack_require__(1);
+
+	var _utilsCreateStoreShape2 = _interopRequireDefault(_utilsCreateStoreShape);
+
+	function isUsingOwnerContext(React) {
+	  var version = React.version;
+
+	  if (typeof version !== 'string') {
+	    return true;
+	  }
+
+	  var sections = version.split('.');
+	  var major = parseInt(sections[0], 10);
+	  var minor = parseInt(sections[1], 10);
+
+	  return major === 0 && minor === 13;
+	}
+
+	function createProvider(React) {
+	  var Component = React.Component;
+	  var PropTypes = React.PropTypes;
+	  var Children = React.Children;
+
+	  var storeShape = _utilsCreateStoreShape2['default'](PropTypes);
+	  var requireFunctionChild = isUsingOwnerContext(React);
+
+	  var didWarnAboutChild = false;
+	  function warnAboutFunctionChild() {
+	    if (didWarnAboutChild || requireFunctionChild) {
+	      return;
+	    }
+
+	    didWarnAboutChild = true;
+	    console.error( // eslint-disable-line no-console
+	    'With React 0.14 and later versions, you no longer need to ' + 'wrap <Provider> child into a function.');
+	  }
+	  function warnAboutElementChild() {
+	    if (didWarnAboutChild || !requireFunctionChild) {
+	      return;
+	    }
+
+	    didWarnAboutChild = true;
+	    console.error( // eslint-disable-line no-console
+	    'With React 0.13, you need to ' + 'wrap <Provider> child into a function. ' + 'This restriction will be removed with React 0.14.');
+	  }
+
+	  var didWarnAboutReceivingStore = false;
+	  function warnAboutReceivingStore() {
+	    if (didWarnAboutReceivingStore) {
+	      return;
+	    }
+
+	    didWarnAboutReceivingStore = true;
+	    console.error( // eslint-disable-line no-console
+	    '<Provider> does not support changing `store` on the fly. ' + 'It is most likely that you see this error because you updated to ' + 'Redux 2.x and React Redux 2.x which no longer hot reload reducers ' + 'automatically. See https://github.com/rackt/react-redux/releases/' + 'tag/v2.0.0 for the migration instructions.');
+	  }
+
+	  var Provider = (function (_Component) {
+	    _inherits(Provider, _Component);
+
+	    Provider.prototype.getChildContext = function getChildContext() {
+	      return { store: this.store };
+	    };
+
+	    function Provider(props, context) {
+	      _classCallCheck(this, Provider);
+
+	      _Component.call(this, props, context);
+	      this.store = props.store;
+	    }
+
+	    Provider.prototype.componentWillReceiveProps = function componentWillReceiveProps(nextProps) {
+	      var store = this.store;
+	      var nextStore = nextProps.store;
+
+	      if (store !== nextStore) {
+	        warnAboutReceivingStore();
+	      }
+	    };
+
+	    Provider.prototype.render = function render() {
+	      var children = this.props.children;
+
+	      if (typeof children === 'function') {
+	        warnAboutFunctionChild();
+	        children = children();
+	      } else {
+	        warnAboutElementChild();
+	      }
+
+	      return Children.only(children);
+	    };
+
+	    return Provider;
+	  })(Component);
+
+	  Provider.childContextTypes = {
+	    store: storeShape.isRequired
+	  };
+	  Provider.propTypes = {
+	    store: storeShape.isRequired,
+	    children: (requireFunctionChild ? PropTypes.func : PropTypes.element).isRequired
+	  };
+
+	  return Provider;
+	}
+
+	module.exports = exports['default'];
+
+/***/ },
+/* 5 */
+/***/ function(module, exports) {
+
+	'use strict';
+
+	exports.__esModule = true;
+	exports['default'] = isPlainObject;
+	var fnToString = function fnToString(fn) {
+	  return Function.prototype.toString.call(fn);
+	};
+
+	/**
+	 * @param {any} obj The object to inspect.
+	 * @returns {boolean} True if the argument appears to be a plain object.
+	 */
+
+	function isPlainObject(obj) {
+	  if (!obj || typeof obj !== 'object') {
+	    return false;
+	  }
+
+	  var proto = typeof obj.constructor === 'function' ? Object.getPrototypeOf(obj) : Object.prototype;
+
+	  if (proto === null) {
+	    return true;
+	  }
+
+	  var constructor = proto.constructor;
+
+	  return typeof constructor === 'function' && constructor instanceof constructor && fnToString(constructor) === fnToString(Object);
+	}
+
+	module.exports = exports['default'];
+
+/***/ },
+/* 6 */
+/***/ function(module, exports) {
+
+	"use strict";
+
+	exports.__esModule = true;
+	exports["default"] = shallowEqual;
+
+	function shallowEqual(objA, objB) {
+	  if (objA === objB) {
+	    return true;
+	  }
+
+	  var keysA = Object.keys(objA);
+	  var keysB = Object.keys(objB);
+
+	  if (keysA.length !== keysB.length) {
+	    return false;
+	  }
+
+	  // Test for A's keys different from B.
+	  var hasOwn = Object.prototype.hasOwnProperty;
+	  for (var i = 0; i < keysA.length; i++) {
+	    if (!hasOwn.call(objB, keysA[i]) || objA[keysA[i]] !== objB[keysA[i]]) {
+	      return false;
+	    }
+	  }
+
+	  return true;
+	}
+
+	module.exports = exports["default"];
+
+/***/ },
+/* 7 */
+/***/ function(module, exports, __webpack_require__) {
+
+	'use strict';
+
+	exports.__esModule = true;
+	exports['default'] = wrapActionCreators;
+
+	var _redux = __webpack_require__(11);
+
+	function wrapActionCreators(actionCreators) {
+	  return function (dispatch) {
+	    return _redux.bindActionCreators(actionCreators, dispatch);
+	  };
+	}
+
+	module.exports = exports['default'];
+
+/***/ },
+/* 8 */
+/***/ function(module, exports) {
+
+	/**
+	 * Copyright 2015, Yahoo! Inc.
+	 * Copyrights licensed under the New BSD License. See the accompanying LICENSE file for terms.
+	 */
+	'use strict';
+
+	var REACT_STATICS = {
+	    childContextTypes: true,
+	    contextTypes: true,
+	    defaultProps: true,
+	    displayName: true,
+	    getDefaultProps: true,
+	    mixins: true,
+	    propTypes: true,
+	    type: true
+	};
+
+	var KNOWN_STATICS = {
+	    name: true,
+	    length: true,
+	    prototype: true,
+	    caller: true,
+	    arguments: true,
+	    arity: true
+	};
+
+	module.exports = function hoistNonReactStatics(targetComponent, sourceComponent) {
+	    var keys = Object.getOwnPropertyNames(sourceComponent);
+	    for (var i=0; i<keys.length; ++i) {
+	        if (!REACT_STATICS[keys[i]] && !KNOWN_STATICS[keys[i]]) {
+	            targetComponent[keys[i]] = sourceComponent[keys[i]];
+	        }
+	    }
+
+	    return targetComponent;
+	};
+
+
+/***/ },
+/* 9 */
+/***/ function(module, exports, __webpack_require__) {
+
+	/**
+	 * Copyright 2013-2015, Facebook, Inc.
+	 * All rights reserved.
+	 *
+	 * This source code is licensed under the BSD-style license found in the
+	 * LICENSE file in the root directory of this source tree. An additional grant
+	 * of patent rights can be found in the PATENTS file in the same directory.
+	 *
+	 * @providesModule invariant
+	 */
+
+	'use strict';
+
+	/**
+	 * Use invariant() to assert state which your program assumes to be true.
+	 *
+	 * Provide sprintf-style format (only %s is supported) and arguments
+	 * to provide information about what broke and what you were
+	 * expecting.
+	 *
+	 * The invariant message will be stripped in production, but the invariant
+	 * will remain to ensure logic does not differ in production.
+	 */
+
+	var invariant = function(condition, format, a, b, c, d, e, f) {
+	  if (true) {
+	    if (format === undefined) {
+	      throw new Error('invariant requires an error message argument');
+	    }
+	  }
+
+	  if (!condition) {
+	    var error;
+	    if (format === undefined) {
+	      error = new Error(
+	        'Minified exception occurred; use the non-minified dev environment ' +
+	        'for the full error message and additional helpful warnings.'
+	      );
+	    } else {
+	      var args = [a, b, c, d, e, f];
+	      var argIndex = 0;
+	      error = new Error(
+	        'Invariant Violation: ' +
+	        format.replace(/%s/g, function() { return args[argIndex++]; })
+	      );
+	    }
+
+	    error.framesToPop = 1; // we don't care about invariant's own frame
+	    throw error;
+	  }
+	};
+
+	module.exports = invariant;
+
+
+/***/ },
+/* 10 */
+/***/ function(module, exports) {
+
+	module.exports = __WEBPACK_EXTERNAL_MODULE_10__;
+
+/***/ },
+/* 11 */
+/***/ function(module, exports) {
+
+	module.exports = __WEBPACK_EXTERNAL_MODULE_11__;
+
+/***/ }
+/******/ ])
+});
+;
diff --git a/toolkit/content/license.html b/toolkit/content/license.html
index 4557f9168013..f2aebac3f992 100644
--- a/toolkit/content/license.html
+++ b/toolkit/content/license.html
@@ -127,6 +127,7 @@
       <li><a href="about:license#qcms">qcms License</a></li>
       <li><a href="about:license#qrcode-generator">QR Code Generator License</a></li>
       <li><a href="about:license#react">React License</a></li>
+      <li><a href="about:license#react-redux">React-Redux License</a></li>
       <li><a href="about:license#xdg">Red Hat xdg_user_dir_lookup License</a></li>
       <li><a href="about:license#redux">Redux License</a></li>
       <li><a href="about:license#hunspell-ru">Russian Spellchecking Dictionary License</a></li>
@@ -4480,6 +4481,34 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
     <hr>
 
+    <h1><a id="react-redux"></a>React-Redux License</h1>
+
+    <p>This license applies to the file
+    <span class="path">devtools/client/shared/vendor/react-redux.js</span>.</p>
+<pre>
+Copyright (c) 2015 Dan Abramov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+</pre>
+
+    <hr>
+
     <h1><a id="xdg"></a>Red Hat xdg_user_dir_lookup License</h1>
 
     <p>This license applies to the